Traffic Management Shell (tmsh)
Reference Guide
Version 12.0
Table of Contents
Legal Notices............................................................................................................................29
Legal notices....................................................................................................................30
Using tmsh................................................................................................................................33
About loading and saving the system configuration.........................................................33
About working within the tmsh hierarchy..........................................................................33
About working within a module.............................................................................34
About working within a component.......................................................................35
About working in object mode...............................................................................35
About exiting a mode, module, or tmsh itself.........................................................36
About the scripting feature...............................................................................................37
About checking the tmsh version..........................................................................37
About command completion.............................................................................................38
About using glob with command completion.........................................................38
About command completion behavior...................................................................39
About the help feature......................................................................................................40
About context-sensitive help............................................................................................40
About interrupting a command.........................................................................................41
About entering multiple commands..................................................................................41
About the glob feature......................................................................................................41
Changing whether the date and time display in the glob file.................................42
Displaying the commands in the tmsh glob list.....................................................42
Finding and running a tmsh glob list command using a partial string...................43
Running the previous command............................................................................43
Searching for a command using the pager's search feature.................................43
Searching for a command using grep...................................................................44
About the tmsh keyboard map..............................................................................44
About the command audit feature....................................................................................45
About audit-log entries..........................................................................................45
Viewing historical logs...........................................................................................46
About command aliases...................................................................................................47
About creating command aliases..........................................................................47
About using command aliases..............................................................................47
Setting the tmsh preference for show-aliases.......................................................48
About the wildcard search feature....................................................................................48
About the statistics feature...............................................................................................48
About setting preferences for statistics..................................................................48
About resetting statistics.......................................................................................50
About using grep to filter tmsh output..............................................................................51
3
Table of Contents
About batch mode transactions........................................................................................51
Creating a batch mode transaction.......................................................................51
About viewing the commands in a transaction......................................................52
About deleting a command from the transaction...................................................52
About replacing a command in the transaction.....................................................52
About inserting a command in the transaction......................................................52
About submitting a transaction..............................................................................53
About cancelling the transaction...........................................................................53
About tmsh behavior controls...........................................................................................53
About tmsh options................................................................................................53
About using special characters in tmsh.................................................................54
Global.........................................................................................................................................57
cd.....................................................................................................................................57
cp.....................................................................................................................................58
create...............................................................................................................................59
delete...............................................................................................................................59
edit...................................................................................................................................60
exit....................................................................................................................................62
generate...........................................................................................................................62
help..................................................................................................................................63
install................................................................................................................................64
list.....................................................................................................................................64
load..................................................................................................................................66
modify..............................................................................................................................66
mv....................................................................................................................................67
publish..............................................................................................................................68
pwd..................................................................................................................................69
quit...................................................................................................................................69
reboot...............................................................................................................................69
reset-stats........................................................................................................................70
restart...............................................................................................................................72
run....................................................................................................................................72
save..................................................................................................................................76
send-mail.........................................................................................................................76
show.................................................................................................................................76
shutdown..........................................................................................................................79
start..................................................................................................................................80
stop..................................................................................................................................80
submit..............................................................................................................................81
time..................................................................................................................................81
tmsh................................................................................................................................84
Analytics....................................................................................................................................91
4
Table of Contents
report................................................................................................................................91
Analytics Application Security................................................................................................97
report................................................................................................................................97
scheduled-report............................................................................................................100
Analytics Application Security Anomalies...........................................................................103
report..............................................................................................................................103
Analytics Application Security Network...............................................................................107
report..............................................................................................................................107
Analytics ASM Bypass...........................................................................................................111
report..............................................................................................................................111
Analytics ASM CPU................................................................................................................115
report..............................................................................................................................115
Analytics ASM Memory..........................................................................................................119
report..............................................................................................................................119
Analytics CPU.........................................................................................................................123
report..............................................................................................................................123
Analytics Disk Info..................................................................................................................127
report..............................................................................................................................127
Analytics DNS.........................................................................................................................131
report..............................................................................................................................131
Analytics DOS L3....................................................................................................................135
report..............................................................................................................................135
Analytics DOS L7....................................................................................................................139
report..............................................................................................................................139
Analytics HTTP........................................................................................................................145
report..............................................................................................................................145
Analytics IP Layer...................................................................................................................151
5
Table of Contents
report..............................................................................................................................151
Analytics LSN Pool.................................................................................................................155
report..............................................................................................................................155
Analytics Memory...................................................................................................................159
report..............................................................................................................................159
Analytics Network...................................................................................................................163
report..............................................................................................................................163
stale-rules......................................................................................................................169
Analytics PEM.........................................................................................................................171
report..............................................................................................................................171
Analytics Protocol Security...................................................................................................175
report..............................................................................................................................175
Analytics SIP...........................................................................................................................179
report..............................................................................................................................179
Analytics SWG........................................................................................................................183
report..............................................................................................................................183
Analytics SWG Blocked.........................................................................................................187
report..............................................................................................................................187
Analytics TCP..........................................................................................................................191
report..............................................................................................................................191
Analytics UDP.........................................................................................................................195
report..............................................................................................................................195
Analytics VCMP.......................................................................................................................199
report..............................................................................................................................199
Analytics Virtual......................................................................................................................205
report..............................................................................................................................205
APM..........................................................................................................................................209
6
Table of Contents
acl..................................................................................................................................209
apm-avr-config...............................................................................................................212
license............................................................................................................................213
log-setting......................................................................................................................214
swg-scheme...................................................................................................................216
url-filter...........................................................................................................................217
APM AAA.................................................................................................................................219
active-directory...............................................................................................................219
active-directory-trusted-domains....................................................................................221
crldp...............................................................................................................................223
endpoint-management-system.......................................................................................225
http.................................................................................................................................228
kerberos.........................................................................................................................231
kerberos-keytab-file........................................................................................................232
ldap................................................................................................................................234
oam................................................................................................................................236
ocsp...............................................................................................................................239
radius.............................................................................................................................242
saml...............................................................................................................................245
saml-idp-connector.........................................................................................................249
securid...........................................................................................................................252
tacacsplus......................................................................................................................254
APM EPSEC.............................................................................................................................257
epsec-package...............................................................................................................257
software-status...............................................................................................................258
APM NTLM...............................................................................................................................261
machine-account............................................................................................................261
ntlm-auth........................................................................................................................263
APM Policy..............................................................................................................................265
access-policy..................................................................................................................265
customization-group.......................................................................................................265
image-file.......................................................................................................................265
policy-item......................................................................................................................266
windows-group-policy-file...............................................................................................266
APM Policy Agent...................................................................................................................267
aaa-active-directory.......................................................................................................267
aaa-client-cert................................................................................................................269
aaa-crldp........................................................................................................................271
7
Table of Contents
aaa-http..........................................................................................................................272
aaa-ldap.........................................................................................................................273
aaa-ocsp........................................................................................................................276
aaa-radius......................................................................................................................278
aaa-securid....................................................................................................................279
acct-radius......................................................................................................................281
acct-tacacsplus..............................................................................................................282
decision-box...................................................................................................................284
dynamic-acl....................................................................................................................285
ending-allow...................................................................................................................286
ending-deny...................................................................................................................288
ending-redirect...............................................................................................................289
endpoint-check-machine-cert.........................................................................................291
endpoint-check-software................................................................................................293
endpoint-linux-check-file................................................................................................296
endpoint-linux-check-process........................................................................................298
endpoint-mac-check-file.................................................................................................300
endpoint-mac-check-process.........................................................................................302
endpoint-machine-info....................................................................................................304
endpoint-windows-browser-cache-cleaner.....................................................................305
endpoint-windows-check-file..........................................................................................307
endpoint-windows-check-process..................................................................................310
endpoint-windows-check-registry...................................................................................312
endpoint-windows-group-policy......................................................................................314
endpoint-windows-info-os..............................................................................................315
endpoint-windows-protected-workspace........................................................................317
external-logon-page.......................................................................................................319
http-header-modify.........................................................................................................320
irule-event......................................................................................................................323
kerberos.........................................................................................................................325
logging...........................................................................................................................327
logon-page.....................................................................................................................328
message-box..................................................................................................................331
oam................................................................................................................................333
resource-assign..............................................................................................................335
route-domain-selection...................................................................................................336
tacacsplus......................................................................................................................338
variable-assign...............................................................................................................339
APM Profile..............................................................................................................................343
access............................................................................................................................343
connectivity....................................................................................................................348
exchange........................................................................................................................355
remote-desktop..............................................................................................................357
8
Table of Contents
vdi..................................................................................................................................358
APM Resource.........................................................................................................................361
app-tunnel......................................................................................................................361
client-rate-class..............................................................................................................363
client-traffic-classifier......................................................................................................366
ipv6-leasepool................................................................................................................368
leasepool........................................................................................................................370
network-access..............................................................................................................371
portal-access..................................................................................................................378
sandbox..........................................................................................................................380
webtop............................................................................................................................382
webtop-link.....................................................................................................................385
APM Resource Remote Desktop...........................................................................................387
citrix................................................................................................................................387
citrix-client-bundle..........................................................................................................389
citrix-client-package-file..................................................................................................391
quest..............................................................................................................................392
rdp..................................................................................................................................395
vmware-view..................................................................................................................399
APM SAML...............................................................................................................................403
artifact-resolution-service...............................................................................................403
APM SSO.................................................................................................................................407
basic...............................................................................................................................407
form-based.....................................................................................................................409
form-basedv2.................................................................................................................412
kerberos.........................................................................................................................419
ntlmv1............................................................................................................................422
ntlmv2............................................................................................................................424
saml...............................................................................................................................426
saml-resource................................................................................................................430
saml-sp-connector..........................................................................................................431
ASM..........................................................................................................................................435
device-sync....................................................................................................................435
http-method....................................................................................................................435
httpclass-asm.................................................................................................................436
policy..............................................................................................................................438
predefined-policy............................................................................................................441
response-code...............................................................................................................442
9
Table of Contents
webapp-language...........................................................................................................442
Auth..........................................................................................................................................445
apm-auth........................................................................................................................445
cert-ldap.........................................................................................................................446
ldap................................................................................................................................451
login-failures...................................................................................................................455
partition..........................................................................................................................456
password........................................................................................................................457
password-policy.............................................................................................................458
radius.............................................................................................................................460
radius-server..................................................................................................................462
remote-role.....................................................................................................................464
remote-user....................................................................................................................467
source............................................................................................................................469
tacacs.............................................................................................................................470
user................................................................................................................................472
CLI............................................................................................................................................477
admin-partitions.............................................................................................................477
global-settings................................................................................................................477
history............................................................................................................................479
preference......................................................................................................................480
script..............................................................................................................................485
transaction......................................................................................................................501
version............................................................................................................................503
CLI Alias..................................................................................................................................505
private............................................................................................................................505
shared............................................................................................................................507
CM............................................................................................................................................509
add-to-trust.....................................................................................................................509
cert.................................................................................................................................510
config-sync.....................................................................................................................513
device.............................................................................................................................514
device-group..................................................................................................................517
failover-status.................................................................................................................520
key..................................................................................................................................521
remove-from-trust...........................................................................................................523
sniff-updates..................................................................................................................524
sync-status.....................................................................................................................525
traffic-group....................................................................................................................525
10
Table of Contents
trust-domain...................................................................................................................528
watch-devicegroup-device..............................................................................................531
watch-sys-device............................................................................................................532
watch-trafficgroup-device...............................................................................................534
GTM..........................................................................................................................................537
datacenter......................................................................................................................537
distributed-app...............................................................................................................539
iquery.............................................................................................................................542
ldns................................................................................................................................543
link..................................................................................................................................543
listener...........................................................................................................................547
path................................................................................................................................552
persist............................................................................................................................553
prober-pool.....................................................................................................................554
region.............................................................................................................................556
rule.................................................................................................................................559
server.............................................................................................................................561
topology.........................................................................................................................567
traffic..............................................................................................................................570
GTM Global Settings...............................................................................................................571
general...........................................................................................................................571
load-balancing................................................................................................................574
metrics...........................................................................................................................576
metrics-exclusions..........................................................................................................578
GTM Monitor............................................................................................................................581
bigip...............................................................................................................................581
bigip-link.........................................................................................................................584
external..........................................................................................................................586
firepass..........................................................................................................................588
ftp...................................................................................................................................591
gateway-icmp.................................................................................................................594
gtp..................................................................................................................................597
http.................................................................................................................................599
https...............................................................................................................................602
imap...............................................................................................................................606
ldap................................................................................................................................609
mssql..............................................................................................................................612
mysql..............................................................................................................................616
nntp................................................................................................................................619
oracle.............................................................................................................................622
pop3...............................................................................................................................625
11
Table of Contents
postgresql.......................................................................................................................628
radius.............................................................................................................................631
radius-accounting...........................................................................................................634
real-server......................................................................................................................637
scripted..........................................................................................................................639
sip..................................................................................................................................642
smtp...............................................................................................................................646
snmp..............................................................................................................................648
snmp-link........................................................................................................................651
soap...............................................................................................................................654
tcp..................................................................................................................................657
tcp-half-open..................................................................................................................660
udp.................................................................................................................................663
wap.................................................................................................................................666
wmi.................................................................................................................................669
LTM...........................................................................................................................................673
alg-log-profile.................................................................................................................673
default-node-monitor......................................................................................................675
eviction-policy.................................................................................................................676
ifile..................................................................................................................................681
lsn-log-profile..................................................................................................................682
lsn-pool..........................................................................................................................685
nat..................................................................................................................................691
node...............................................................................................................................693
policy..............................................................................................................................697
policy-strategy................................................................................................................708
pool................................................................................................................................712
rule.................................................................................................................................722
snat................................................................................................................................725
snat-translation...............................................................................................................728
snatpool.........................................................................................................................730
traffic-class.....................................................................................................................732
urlcat-query....................................................................................................................734
virtual.............................................................................................................................735
virtual-address...............................................................................................................743
LTM Auth..................................................................................................................................749
crldp-server....................................................................................................................749
kerberos-delegation.......................................................................................................751
ldap................................................................................................................................753
ocsp-responder..............................................................................................................757
profile.............................................................................................................................761
radius.............................................................................................................................763
12
Table of Contents
radius-server..................................................................................................................766
ssl-cc-ldap......................................................................................................................768
ssl-crldp..........................................................................................................................771
ssl-ocsp..........................................................................................................................774
tacacs.............................................................................................................................775
LTM Classification..................................................................................................................779
application......................................................................................................................779
category.........................................................................................................................780
signature-definition.........................................................................................................782
signature-update-schedule.............................................................................................784
signature-version............................................................................................................785
signatures......................................................................................................................786
update-signatures..........................................................................................................787
url-cat-policy...................................................................................................................787
url-category....................................................................................................................789
urldb-feed-list.................................................................................................................790
urldb-file.........................................................................................................................792
LTM Classification Stats.........................................................................................................795
application......................................................................................................................795
url-category....................................................................................................................796
LTM ClientSSL.........................................................................................................................799
ocsp-stapling-responses................................................................................................799
LTM ClientSSL Proxy..............................................................................................................801
cached-certs..................................................................................................................801
LTM Data Group......................................................................................................................803
external..........................................................................................................................803
internal...........................................................................................................................805
LTM DNS..................................................................................................................................809
dns-express-db..............................................................................................................809
nameserver....................................................................................................................809
tsig-key...........................................................................................................................811
zone...............................................................................................................................813
LTM DNS Analytics.................................................................................................................817
global-settings................................................................................................................817
13
Table of Contents
LTM DNS Cache......................................................................................................................819
global-settings................................................................................................................819
resolver..........................................................................................................................820
transparent.....................................................................................................................824
validating-resolver..........................................................................................................827
LTM DNS Cache Records.......................................................................................................833
key..................................................................................................................................833
msg................................................................................................................................834
nameserver....................................................................................................................835
rrset................................................................................................................................837
LTM DNS DNSsec....................................................................................................................839
generation......................................................................................................................839
key..................................................................................................................................840
zone...............................................................................................................................843
LTM Global Settings...............................................................................................................847
connection......................................................................................................................847
general...........................................................................................................................848
traffic-control..................................................................................................................850
LTM Message Routing Diameter............................................................................................853
peer................................................................................................................................853
route...............................................................................................................................855
transport-config..............................................................................................................856
LTM Message Routing Diameter Profile................................................................................859
router..............................................................................................................................859
session...........................................................................................................................861
LTM Message Routing Generic..............................................................................................865
peer................................................................................................................................865
protocol..........................................................................................................................866
route...............................................................................................................................868
router..............................................................................................................................870
transport-config..............................................................................................................873
LTM Message Routing SIP.....................................................................................................877
peer................................................................................................................................877
route...............................................................................................................................879
14
Table of Contents
transport-config..............................................................................................................881
LTM Message Routing SIP Profile.........................................................................................885
router..............................................................................................................................885
session...........................................................................................................................887
LTM Monitor.............................................................................................................................893
diameter.........................................................................................................................893
dns.................................................................................................................................896
external..........................................................................................................................901
firepass..........................................................................................................................904
ftp...................................................................................................................................907
gateway-icmp.................................................................................................................910
http.................................................................................................................................914
https...............................................................................................................................918
icmp...............................................................................................................................923
imap...............................................................................................................................926
inband............................................................................................................................929
ldap................................................................................................................................932
module-score.................................................................................................................936
mssql..............................................................................................................................939
mysql..............................................................................................................................943
nntp................................................................................................................................946
oracle.............................................................................................................................950
pop3...............................................................................................................................953
postgresql.......................................................................................................................956
radius.............................................................................................................................960
radius-accounting...........................................................................................................963
real-server......................................................................................................................967
rpc..................................................................................................................................969
sasp...............................................................................................................................972
scripted..........................................................................................................................975
sip..................................................................................................................................978
smb................................................................................................................................982
smtp...............................................................................................................................986
snmp-dca.......................................................................................................................989
snmp-dca-base..............................................................................................................991
soap...............................................................................................................................994
tcp..................................................................................................................................997
tcp-echo.......................................................................................................................1002
tcp-half-open................................................................................................................1005
udp...............................................................................................................................1008
virtual-location..............................................................................................................1012
wap...............................................................................................................................1015
15
Table of Contents
wmi...............................................................................................................................1019
LTM Persistence....................................................................................................................1023
cookie...........................................................................................................................1023
dest-addr......................................................................................................................1026
global-settings..............................................................................................................1029
hash.............................................................................................................................1030
msrdp...........................................................................................................................1034
persist-records.............................................................................................................1036
sip................................................................................................................................1038
source-addr..................................................................................................................1041
ssl.................................................................................................................................1044
universal.......................................................................................................................1047
LTM Profile.............................................................................................................................1051
analytics.......................................................................................................................1051
certificate-authority.......................................................................................................1059
classification.................................................................................................................1061
client-ldap.....................................................................................................................1062
client-ssl.......................................................................................................................1064
dhcpv4.........................................................................................................................1075
dhcpv6.........................................................................................................................1080
diameter.......................................................................................................................1084
dns...............................................................................................................................1088
dns-logging..................................................................................................................1092
fasthttp.........................................................................................................................1094
fastl4.............................................................................................................................1099
fix.................................................................................................................................1105
ftp.................................................................................................................................1107
gtp................................................................................................................................1109
html..............................................................................................................................1111
http...............................................................................................................................1113
http-compression..........................................................................................................1122
http2.............................................................................................................................1126
icap..............................................................................................................................1128
iiop...............................................................................................................................1130
ipother..........................................................................................................................1132
mblb.............................................................................................................................1134
mssql............................................................................................................................1137
ntlm..............................................................................................................................1139
ocsp-stapling-params...................................................................................................1141
one-connect.................................................................................................................1144
pcp...............................................................................................................................1147
pptp..............................................................................................................................1150
16
Table of Contents
qoe...............................................................................................................................1152
radius...........................................................................................................................1153
ramcache.....................................................................................................................1155
request-adapt...............................................................................................................1156
request-log...................................................................................................................1159
response-adapt............................................................................................................1162
rewrite..........................................................................................................................1164
rtsp...............................................................................................................................1168
sctp..............................................................................................................................1172
server-ldap...................................................................................................................1175
server-ssl.....................................................................................................................1177
sip................................................................................................................................1185
smtp.............................................................................................................................1189
smtps...........................................................................................................................1191
socks............................................................................................................................1193
spdy.............................................................................................................................1195
statistics.......................................................................................................................1198
stream..........................................................................................................................1200
tcp................................................................................................................................1203
tftp................................................................................................................................1211
udp...............................................................................................................................1213
wa-cache......................................................................................................................1216
web-acceleration..........................................................................................................1217
web-security.................................................................................................................1220
xml...............................................................................................................................1221
LTM TacDB.............................................................................................................................1225
customdb.....................................................................................................................1225
customdb-file................................................................................................................1226
Net..........................................................................................................................................1229
arp................................................................................................................................1229
cmetrics........................................................................................................................1231
dag-globals..................................................................................................................1232
ike-evt-stat....................................................................................................................1233
ike-msg-stat..................................................................................................................1234
interface.......................................................................................................................1235
interface-cos.................................................................................................................1239
mroute..........................................................................................................................1240
multicast-globals..........................................................................................................1241
ndp...............................................................................................................................1242
packet-filter...................................................................................................................1244
packet-filter-trusted......................................................................................................1248
port-mirror....................................................................................................................1250
17
Table of Contents
route.............................................................................................................................1251
route-domain................................................................................................................1254
router-advertisement....................................................................................................1257
rst-cause......................................................................................................................1260
self...............................................................................................................................1261
self-allow......................................................................................................................1264
service-policy...............................................................................................................1266
stp................................................................................................................................1267
stp-globals....................................................................................................................1270
timer-policy...................................................................................................................1272
trunk.............................................................................................................................1276
vlan..............................................................................................................................1280
vlan-allowed.................................................................................................................1284
vlan-group....................................................................................................................1285
wccp.............................................................................................................................1288
Net Bwc..................................................................................................................................1293
policy............................................................................................................................1293
priority-group................................................................................................................1302
traffic-group..................................................................................................................1303
Net Cos..................................................................................................................................1307
global-settings..............................................................................................................1307
map-8021p...................................................................................................................1308
map-dscp.....................................................................................................................1309
traffic-priority................................................................................................................1311
Net DNS Resolver.................................................................................................................1313
resolver........................................................................................................................1313
Net FDB..................................................................................................................................1317
tunnel...........................................................................................................................1317
vlan..............................................................................................................................1318
Net IPsec................................................................................................................................1321
ike-daemon..................................................................................................................1321
ike-peer........................................................................................................................1322
ike-sa............................................................................................................................1326
ipsec-policy..................................................................................................................1327
ipsec-sa........................................................................................................................1330
manual-security-association........................................................................................1331
traffic-selector...............................................................................................................1333
18
Table of Contents
Net Rate Shaping..................................................................................................................1335
class.............................................................................................................................1335
color-policer..................................................................................................................1338
drop-policy...................................................................................................................1340
queue...........................................................................................................................1342
shaping-policy..............................................................................................................1345
Net Tunnels............................................................................................................................1349
etherip..........................................................................................................................1349
fec................................................................................................................................1350
fec-stat.........................................................................................................................1353
geneve.........................................................................................................................1354
gre................................................................................................................................1356
ipip...............................................................................................................................1358
ipsec.............................................................................................................................1360
map..............................................................................................................................1361
ppp...............................................................................................................................1363
tunnel...........................................................................................................................1365
v6rd..............................................................................................................................1368
vxlan.............................................................................................................................1370
wccp.............................................................................................................................1372
PEM........................................................................................................................................1375
forwarding-endpoint.....................................................................................................1375
interception-endpoint...................................................................................................1378
irule..............................................................................................................................1380
listener.........................................................................................................................1382
policy............................................................................................................................1384
service-chain-endpoint.................................................................................................1399
sessiondb.....................................................................................................................1402
subscriber....................................................................................................................1405
subscriber-attribute......................................................................................................1407
subscribers...................................................................................................................1410
PEM Global Settings.............................................................................................................1411
analytics.......................................................................................................................1411
insert-content...............................................................................................................1412
quota-mgmt..................................................................................................................1413
subscriber-activity-log..................................................................................................1414
PEM Profile............................................................................................................................1417
diameter-endpoint........................................................................................................1417
19
Table of Contents
radius-aaa....................................................................................................................1419
spm..............................................................................................................................1421
PEM Protocol.........................................................................................................................1425
diameter-avp................................................................................................................1425
radius-avp....................................................................................................................1428
PEM Protocol Profile............................................................................................................1431
gx.................................................................................................................................1431
radius...........................................................................................................................1435
PEM Quota Management......................................................................................................1441
rating-group..................................................................................................................1441
PEM Reporting......................................................................................................................1445
format-script.................................................................................................................1445
PEM Stats..............................................................................................................................1449
action...........................................................................................................................1449
dtos..............................................................................................................................1451
gx.................................................................................................................................1452
gy.................................................................................................................................1454
hsl................................................................................................................................1455
radius...........................................................................................................................1457
subscriber....................................................................................................................1458
tethering.......................................................................................................................1459
Security Analytics.................................................................................................................1461
settings.........................................................................................................................1461
Security Anti Fraud...............................................................................................................1465
engine-update..............................................................................................................1465
profile...........................................................................................................................1466
signatures-update........................................................................................................1486
Security Datasync.................................................................................................................1489
device-stats..................................................................................................................1489
global-profile................................................................................................................1490
local-profile...................................................................................................................1492
Security DOS.........................................................................................................................1495
bot-signature................................................................................................................1495
20
Table of Contents
bot-signature-category.................................................................................................1496
device-config................................................................................................................1497
network-whitelist..........................................................................................................1505
profile...........................................................................................................................1508
spva-stats.....................................................................................................................1522
udp-portlist...................................................................................................................1524
Security Firewall...................................................................................................................1527
address-list...................................................................................................................1527
config-change-log........................................................................................................1529
container-stat...............................................................................................................1530
current-state.................................................................................................................1531
fqdn-entity....................................................................................................................1531
fqdn-info.......................................................................................................................1532
global-fqdn-policy.........................................................................................................1533
global-rules..................................................................................................................1534
management-ip-rules...................................................................................................1536
matching-rule...............................................................................................................1542
on-demand-compilation................................................................................................1543
on-demand-rule-deploy................................................................................................1544
policy............................................................................................................................1545
port-list.........................................................................................................................1550
port-misuse-policy........................................................................................................1552
rule-list.........................................................................................................................1554
rule-stat........................................................................................................................1563
schedule.......................................................................................................................1563
user-domain.................................................................................................................1566
user-list........................................................................................................................1567
Security HTTP.......................................................................................................................1569
file-type........................................................................................................................1569
mandatory-header........................................................................................................1569
profile...........................................................................................................................1570
Security IP Intelligence........................................................................................................1577
blacklist-category.........................................................................................................1577
feed-list.........................................................................................................................1578
global-policy.................................................................................................................1581
info...............................................................................................................................1583
policy............................................................................................................................1584
Security Log..........................................................................................................................1587
network-storage-field....................................................................................................1587
21
Table of Contents
profile...........................................................................................................................1587
protocol-dns-storage-field............................................................................................1601
protocol-sip-storage-field..............................................................................................1601
remote-format...............................................................................................................1602
storage-field.................................................................................................................1603
Sys.........................................................................................................................................1605
autoscale-group...........................................................................................................1605
clock.............................................................................................................................1606
cluster..........................................................................................................................1606
config...........................................................................................................................1608
config-diff.....................................................................................................................1613
connection....................................................................................................................1614
console.........................................................................................................................1616
cpu...............................................................................................................................1617
daemon-ha...................................................................................................................1617
datastor........................................................................................................................1619
db.................................................................................................................................1621
default-config................................................................................................................1622
dns...............................................................................................................................1623
failover..........................................................................................................................1624
feature-module.............................................................................................................1626
fix-connection...............................................................................................................1627
folder............................................................................................................................1628
geoip............................................................................................................................1630
global-settings..............................................................................................................1631
ha-group.......................................................................................................................1634
ha-status......................................................................................................................1637
hardware......................................................................................................................1637
host-info.......................................................................................................................1638
httpd.............................................................................................................................1639
hypervisor-info..............................................................................................................1643
icmp-stat......................................................................................................................1644
icontrol-soap................................................................................................................1644
ip-address....................................................................................................................1645
ip-stat...........................................................................................................................1646
iprep-status..................................................................................................................1647
license..........................................................................................................................1648
log................................................................................................................................1649
log-rotate......................................................................................................................1651
mac-address................................................................................................................1653
management-dhcp.......................................................................................................1654
management-ip............................................................................................................1655
management-ovsdb.....................................................................................................1656
22
Table of Contents
management-route.......................................................................................................1658
mcp-state.....................................................................................................................1660
memory........................................................................................................................1660
ntp................................................................................................................................1661
outbound-smtp.............................................................................................................1664
proc-info.......................................................................................................................1665
provision.......................................................................................................................1665
pva-traffic.....................................................................................................................1668
scriptd..........................................................................................................................1669
service..........................................................................................................................1670
smtp-server..................................................................................................................1672
snmp............................................................................................................................1673
sshd.............................................................................................................................1684
state-mirroring..............................................................................................................1687
sync-sys-files................................................................................................................1688
syslog...........................................................................................................................1689
tmm-info.......................................................................................................................1692
tmm-traffic....................................................................................................................1693
traffic............................................................................................................................1693
ucs...............................................................................................................................1694
version..........................................................................................................................1696
Sys Application.....................................................................................................................1697
apl-script......................................................................................................................1697
custom-stat..................................................................................................................1699
service..........................................................................................................................1700
template.......................................................................................................................1703
Sys Crypto.............................................................................................................................1715
cert...............................................................................................................................1715
check-cert....................................................................................................................1717
client.............................................................................................................................1718
crl.................................................................................................................................1720
csr................................................................................................................................1721
key................................................................................................................................1723
master-key...................................................................................................................1727
pkcs12..........................................................................................................................1728
server...........................................................................................................................1730
Sys Crypto FIPs....................................................................................................................1733
by-handle.....................................................................................................................1733
external-hsm................................................................................................................1733
key................................................................................................................................1734
23
Table of Contents
Sys Daemon Log Settings....................................................................................................1737
clusterd........................................................................................................................1737
csyncd..........................................................................................................................1738
icrd...............................................................................................................................1739
lind...............................................................................................................................1740
mcpd............................................................................................................................1741
tmm..............................................................................................................................1742
Sys Disk.................................................................................................................................1745
application-volume.......................................................................................................1745
directory.......................................................................................................................1746
logical-disk...................................................................................................................1747
Sys File..................................................................................................................................1749
apache-ssl-cert............................................................................................................1749
data-group....................................................................................................................1751
device-capabilities-db...................................................................................................1753
external-monitor...........................................................................................................1755
ifile................................................................................................................................1756
rewrite-rule...................................................................................................................1758
ssl-cert.........................................................................................................................1759
ssl-crl............................................................................................................................1762
ssl-key..........................................................................................................................1763
Sys FPGA..............................................................................................................................1767
firmware-config............................................................................................................1767
info...............................................................................................................................1768
Sys iCall.................................................................................................................................1769
event............................................................................................................................1769
istats-trigger.................................................................................................................1770
publisher.......................................................................................................................1771
script............................................................................................................................1772
Sys iCall Handler..................................................................................................................1775
periodic........................................................................................................................1775
perpetual......................................................................................................................1777
triggered.......................................................................................................................1778
Sys IPFIX...............................................................................................................................1781
destination....................................................................................................................1781
24
Table of Contents
element........................................................................................................................1781
irules............................................................................................................................1783
Sys Log Config.....................................................................................................................1785
filter..............................................................................................................................1785
publisher.......................................................................................................................1787
Sys Log Config Destination.................................................................................................1789
alertd............................................................................................................................1789
arcsight........................................................................................................................1790
ipfix...............................................................................................................................1792
local-database..............................................................................................................1794
local-syslog..................................................................................................................1795
management-port.........................................................................................................1796
remote-high-speed-log.................................................................................................1798
remote-syslog...............................................................................................................1800
splunk...........................................................................................................................1802
Sys Performance...................................................................................................................1805
all-stats.........................................................................................................................1805
connections..................................................................................................................1806
dnsexpress...................................................................................................................1806
dnssec..........................................................................................................................1807
gtm...............................................................................................................................1808
ramcache.....................................................................................................................1809
system..........................................................................................................................1809
throughput....................................................................................................................1810
Sys Raid.................................................................................................................................1813
array.............................................................................................................................1813
bay...............................................................................................................................1814
disk...............................................................................................................................1815
Sys Sflow...............................................................................................................................1817
receiver........................................................................................................................1817
Sys Sflow Data Source.........................................................................................................1819
http...............................................................................................................................1819
interface.......................................................................................................................1819
system..........................................................................................................................1820
vlan..............................................................................................................................1820
25
Table of Contents
Sys Sflow Global Settings....................................................................................................1823
http...............................................................................................................................1823
interface.......................................................................................................................1824
system..........................................................................................................................1825
vlan..............................................................................................................................1826
Sys Software.........................................................................................................................1829
block-device-image......................................................................................................1829
block-device-software-hotfix.........................................................................................1831
hotfix............................................................................................................................1833
image...........................................................................................................................1836
signature......................................................................................................................1838
status...........................................................................................................................1839
update..........................................................................................................................1841
update-status...............................................................................................................1842
volume..........................................................................................................................1843
Sys URL DB...........................................................................................................................1847
download-result............................................................................................................1847
download-schedule......................................................................................................1848
url-category..................................................................................................................1849
Util..........................................................................................................................................1853
ccmode.......................................................................................................................1853
diadb...........................................................................................................................1853
dnat.............................................................................................................................1854
finalize-custom-ami......................................................................................................1856
lsndb...........................................................................................................................1857
platform_check.............................................................................................................1859
sipdb...........................................................................................................................1859
ssh-keyswap...............................................................................................................1860
test-monitor..................................................................................................................1861
VCMP.....................................................................................................................................1863
global...........................................................................................................................1863
guest............................................................................................................................1863
traffic-profile.................................................................................................................1868
vdisk.............................................................................................................................1869
virtual-disk....................................................................................................................1870
virtual-disk-template.....................................................................................................1871
VCMP Health.........................................................................................................................1873
26
Table of Contents
ha-status......................................................................................................................1873
module-provision..........................................................................................................1873
prompt..........................................................................................................................1874
software........................................................................................................................1875
WAM.......................................................................................................................................1877
ad-policy.......................................................................................................................1877
application....................................................................................................................1878
domain-list....................................................................................................................1883
object-type...................................................................................................................1884
policy............................................................................................................................1886
roi-statistics..................................................................................................................1908
WAM Resource......................................................................................................................1909
concat-set....................................................................................................................1909
domain-list....................................................................................................................1910
url.................................................................................................................................1911
WOM.......................................................................................................................................1913
advertised-route...........................................................................................................1913
deduplication................................................................................................................1915
diagnose-conn.............................................................................................................1916
endpoint-discovery.......................................................................................................1916
local-endpoint...............................................................................................................1918
remote-endpoint...........................................................................................................1921
remote-route................................................................................................................1924
server-discovery...........................................................................................................1925
verify-config..................................................................................................................1927
WOM Profile...........................................................................................................................1929
cifs................................................................................................................................1929
isession........................................................................................................................1931
mapi.............................................................................................................................1934
27
Table of Contents
28
Table of Contents
Legal Notices
Publication Date
This document was published on September 1, 2015.
Publication Number
MAN-0306-10
Copyright
Copyright
©
2012-2015, F5 Networks, Inc. All rights reserved.
F5 Networks, Inc. (F5) believes the information it furnishes to be accurate and reliable. However, F5 assumes
no responsibility for the use of this information, nor any infringement of patents or other rights of third
parties which may result from its use. No license is granted by implication or otherwise under any patent,
copyright, or other intellectual property right of F5 except as specically described by applicable user
licenses. F5 reserves the right to change specications at any time without notice.
Trademarks
3DNS, Access Policy Manager, Acopia, Acopia Networks, Advanced Client Authentication, Advanced
Routing, APM, Application Security Manager, ARX, AskF5, ASM, BIG-IP, Cloud Extender, CloudFucious,
CMP, Data Manager, DevCentral, DevCentral [DESIGN], DNS Express, DSC, DSI, Edge Client, Edge
Gateway, Edge Portal, EM, Enterprise Manager, F5, F5 [DESIGN], F5 Management Pack, F5 Networks,
F5 World, Fast Application Proxy, Fast Cache, FirePass, Global Trafc Manager, GTM, IBR, Intelligent
Browser Referencing, Intelligent Compression, IPv6 Gateway, iApps, iControl, iHealth, iQuery, iRules,
iRules OnDemand, iSession, IT agility. Your way., L7 Rate Shaping, LC, Link Controller, Local Trafc
Manager, LTM, Message Security Module, MSM, Netcelera, OneConnect, Packet Velocity, Protocol
Security Module, PSM, Real Trafc Policy Builder, Scale
N
, SSL Acceleration, StrongBox, SuperVIP, SYN
Check, TCP Express, TDR, TMOS, Trafc Management Operating System, TrafcShield, Transparent
Data Reduction, VIPRION, vCMP, WA, WAN Optimization Manager, WANJet, WebAccelerator, WOM,
and ZoneRunner, are trademarks or service marks of F5 Networks, Inc., in the U.S. and other countries,
and may not be used without F5's express written consent.
All other product and company names herein may be trademarks of their respective owners.
Patents
This product may be protected by one or more patents indicated at:
http://www.f5.com/about/guidelines-policies/patents
Export Regulation Notice
This product may include cryptographic software. Under the Export Administration Act, the United States
government may consider it a criminal offense to export this product from the United States.
RF Interference Warning
This is a Class A product. In a domestic environment this product may cause radio interference, in which
case the user may be required to take adequate measures.
FCC Compliance
This equipment has been tested and found to comply with the limits for a Class A digital device pursuant
to Part 15 of FCC rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This unit generates, uses, and
can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual,
may cause harmful interference to radio communications. Operation of this equipment in a residential area
is likely to cause harmful interference, in which case the user, at his own expense, will be required to take
whatever measures may be required to correct the interference.
Any modications to this device, unless expressly approved by the manufacturer, can void the user's authority
to operate this equipment under part 15 of the FCC rules.
Canadian Regulatory Compliance
This Class A digital apparatus complies with Canadian ICES-003.
Standards Compliance
This product conforms to the IEC, European Union, ANSI/UL and Canadian CSA standards applicable to
Information Technology products at the time of manufacture.
Legal notices
Publication Date
This document was published on September 1, 2015.
Publication Number
MAN-0306-10
Copyright
Copyright
©
2015, F5 Networks, Inc. All rights reserved.
F5 Networks, Inc. (F5) believes the information it furnishes to be accurate and reliable. However, F5 assumes
no responsibility for the use of this information, nor any infringement of patents or other rights of third
parties which may result from its use. No license is granted by implication or otherwise under any patent,
copyright, or other intellectual property right of F5 except as specically described by applicable user
licenses. F5 reserves the right to change specications at any time without notice.
Trademarks
AAM, Access Policy Manager, Advanced Client Authentication, Advanced Firewall Manager, Advanced
Routing, AFM, APM, Application Acceleration Manager, Application Security Manager, AskF5, ASM,
BIG-IP, BIG-IP EDGE GATEWAY, BIG-IQ, Cloud Extender, Cloud Manager, CloudFucious, Clustered
Multiprocessing, CMP, COHESION, Data Manager, DDoS Frontline, DDoS SWAT, Defense.Net, defense.net
[DESIGN], DevCentral, DevCentral [DESIGN], DNS Express, DSC, DSI, Edge Client, Edge Gateway,
Edge Mobile, Edge Mobility, Edge Portal, ELEVATE, EM, ENGAGE, Enterprise Manager, F5, F5
[DESIGN], F5 Agility, F5 Certied [DESIGN], F5 Networks, F5 SalesXchange [DESIGN], F5 Synthesis,
f5 Synthesis, F5 Synthesis [DESIGN], F5 TechXchange [DESIGN], Fast Application Proxy, Fast Cache,
FCINCO, Global Trafc Manager, GTM, GUARDIAN, iApps, IBR, iCall, iControl, iHealth, Intelligent
Browser Referencing, Intelligent Compression, IPv6 Gateway, iQuery, iRules, iRules OnDemand, iSession,
L7 Rate Shaping, LC, Link Controller, LineRate, LineRate Point, LineRate Precision, LineRate Systems
30
Legal Notices
[DESIGN], Local Trafc Manager, LROS, LTM, Message Security Manager, MobileSafe, MSM,
OneConnect, Packet Velocity, PEM, Policy Enforcement Manager, Protocol Security Manager, PSM, Ready
Defense, Real Trafc Policy Builder, SalesXchange, ScaleN, SDAS (except in Japan), SDC, Signalling
Delivery Controller, Solutions for an application world, Software Designed Application Services, Silverline,
SSL Acceleration, SSL Everywhere, StrongBox, SuperVIP, SYN Check, SYNTHESIS, TCP Express, TDR,
TechXchange, TMOS, TotALL, TDR, TMOS, Trafc Management Operating System, Trafx, Trafx
[DESIGN], Transparent Data Reduction, UNITY, VAULT, vCMP, VE F5 [DESIGN], Versafe, Versafe
[DESIGN], VIPRION, Virtual Clustered Multiprocessing, WebSafe, and ZoneRunner, are trademarks or
service marks of F5 Networks, Inc., in the U.S. and other countries, and may not be used without F5's
express written consent.
All other product and company names herein may be trademarks of their respective owners.
Patents
This product may be protected by one or more patents indicated at: https://f5.com/about-us/policies/patents
Export Regulation Notice
This product may include cryptographic software. Under the Export Administration Act, the United States
government may consider it a criminal offense to export this product from the United States.
RF Interference Warning
This is a Class A product. In a domestic environment this product may cause radio interference, in which
case the user may be required to take adequate measures.
FCC Compliance
This equipment has been tested and found to comply with the limits for a Class A digital device pursuant
to Part 15 of FCC rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This unit generates, uses, and
can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual,
may cause harmful interference to radio communications. Operation of this equipment in a residential area
is likely to cause harmful interference, in which case the user, at his own expense, will be required to take
whatever measures may be required to correct the interference.
Any modications to this device, unless expressly approved by the manufacturer, can void the user's authority
to operate this equipment under part 15 of the FCC rules.
Canadian Regulatory Compliance
This Class A digital apparatus complies with Canadian ICES-003.
Standards Compliance
This product conforms to the IEC, European Union, ANSI/UL and Canadian CSA standards applicable to
Information Technology products at the time of manufacture.
31
Traffic Management Shell (tmsh) Reference Guide
Using tmsh
About loading and saving the system configuration
The system applies all conguration changes that you make from within tmsh to the running conguration
of the system. You can save a portion of the running conguration known as the base conguration. You
can also load the base conguration from the stored conguration les.
• To save the base conguration to the stored conguration les, use the following command sequence:
save /sys config base
• To replace the base conguration with the conguration in the stored conguration les, use the following
command sequence:
load /sys config base
• To save the entire running conguration to the stored conguration les, use the following command
sequence:
save /sys config
• To replace the entire running conguration with the conguration in the stored conguration les using
the following command sequence:
load /sys config
About working within the tmsh hierarchy
It is important to understand how to use the command syntax based on where you are in the tmsh hierarchy.
When you are working in the root module, you enter a command sequence using this syntax:
[command] [module...module] [component] (options)
When you are working in a subordinate module, and you want to congure a component that resides within
another module, you enter a command sequence using this syntax:
[command] / [module...module] [component] (options)
Note that the slash provides the path from one module to another. The rst slash can optionally have space
after it; “/ ltm” is equivalent to “/ltm.”
As you navigate within tmsh, the prompt contains a visual cue to your location within the hierarchy.
You can navigate to a module, a component within a module, or a specic component (object mode). The
following list provides examples of how the tmsh prompt changes as you navigate through the hierarchy.
From the root module prompt:
• To navigate to the ltm module, type: ltm
The ltm module prompt displays: (tmos.ltm)#
• To navigate to the ltm pool component, type: ltm pool
The ltm pool component prompt displays: (tmos.ltm.pool)#
• To navigate to pool1, type: modify ltm pool pool1
The pool1 object prompt displays: (tmos.ltm.pool.pool1)#
Note: You can navigate only to an object that already exists, and you must use the modify command to
navigate to that object.
Note: You can change the information that displays in the tmsh prompt, but the prompt always includes
your location in the hierarchy and ends with a pound sign (#). For information about customizing the
prompt, see the documentation for cli preference.
About working within a module
From the root module, you can navigate to another module by entering the name of the module at the prompt.
tmsh opens the module, and displays the prompt:
(tmos.module)#
For example, from the root module, to navigate to the gtm module, type:
gtm
The prompt now indicates that the current location in the hierarchy is the gtm module.
Within a module, you can type a command sequence using this syntax:
[command] [component] (options)
For example, you can display all the properties of all Global Trafc Manager
™
pools by entering the following
command sequence at the gtm module prompt:
list pool all-properties
Additionally, from a module, you can manage a component in a different module using this syntax:
[command] / [module...module] [component] (options)
34
Using tmsh
For example, from the gtm module, you can show all of the properties of the VLANs on your network by
entering the following command sequence at the gtm module prompt:
list / net vlan all-properties
About working within a component
From a tmsh module, you can navigate to a component by entering the name of the component at the prompt.
tmsh displays the component prompt:
(tmos.module.component)#
For example, from the gtm module, to navigate to the gtm pool module, type:
pool
The prompt now indicates that the current location in the hierarchy is the gtm pool component.
Within the component, you can type a command sequence using this syntax:
[command] (options)
For example, you can display all of the properties of all of the Local Trafc Manager
™
pools by entering
the following command sequence at the ltm pool component prompt:
list all-properties
From within a component, you can also manage a component in a different module using this syntax:
[command] / [module...module] [component] (options)
Note that you can manage a component from anywhere within the tmsh hierarchy by using the full path to
the component. For example, from the gtm pool component, you can show all of the properties of the VLANs
on your network by entering the following command sequence at the prompt:
list / net vlan all-properties
About working in object mode
From a tmsh component, you can navigate to a specic object of that type, by entering the modify command
followed by the name of the component at the prompt. tmsh opens the component and displays the prompt:
(tmos.module.component.object_name)#
35
Traffic Management Shell (tmsh) Reference Guide
For example, from the gtm pool module, to navigate to the Global Trafc Manager pool, named pool1,
type:
modify pool1
The prompt now indicates that the current location in the hierarchy is the gtm pool pool1 object.
The Properties list contains the available properties of the current object.
For example, to navigate to the Global Trafc Manager pool named pool1 type the following command
sequence:
modify gtm pool pool1
tmsh displays this prompt:
(tmos.gtm.pool.pool1)#
In the object mode, you can type a command sequence using this syntax:
[command] (options)
For example, you can display all of the properties of gtm pool1 by entering the following command sequence
at the gtm pool1 object prompt:
list all-properties
From within an object, you can also manage a component in a different module using this syntax:
[command] / [module...module] [component] (options)
For example, from within the gtm pool pool1 object, you can display all of the properties of the Local Trafc
Manager
™
pool named my_ pool by entering the following command sequence at the gtm pool pool1 object
prompt:
list / ltm pool pool1 all-properties
About exiting a mode, module, or tmsh itself
This table describes the commands you use to navigate out of a mode or a module, and eventually close
tmsh and return to the BIG-IP system prompt.
Table 1: Commands for navigating out of a mode, module, or tmsh
ActionCommand
From any level of the tmsh hierarchy, returns you to the root module./
36
Using tmsh
ActionCommand
From within object mode, returns you to the component within which the object
resides.
From within a component, returns you to the module within which the component
resides.
exit
From within a module, returns you to the parent module.
From within a module, closes tmsh.quit
About the scripting feature
You can use the tmsh script component to build Tcl scripts to automate and customize management of the
BIG-IP system. The tmsh scripting feature is a small API that provides structured programmatic access to
all system conguration, status, and statistics. The API mirrors the interactive command line syntax. The
structured access of the API eliminates the need to screen scrape output.
Using the tmsh scripting feature, you can write scripts that perform the following:
• Accept parameters from the command line
• Provide command completion and context-sensitive help
• Handle the management of complex system congurations with simple form-based input
• Run in their own execution environment separate from the shell from which they were started
This feature also gives you the ability to perform the following:
• Build reusable script libraries and include them in other scripts using the #include directive
• Use transactional semantics
• Combine command aliases with scripts, allowing you to extend tmsh to build commands that are
customized to your environment
About checking the tmsh version
Each release of tmsh has a unique tree of modules and components, so if a tmsh script functions with one
version, it may not function with another. To see the current version of tmsh, use the following command
sequence:
show cli version
cli version {
active 11.5.0
latest 11.5.0
supported { 11.5.0 }
}
This identies the currently-active tmsh version as well as all the versions supported on this system.
37
Traffic Management Shell (tmsh) Reference Guide
About reverting to a former version
For a script that supports an older version of tmsh, you can use the modify cli version command to
set the active tmsh version:
modify cli version active new-version
This changes the tree of available modules and components to be compatible with the tmsh version that you
choose. The tmsh interface reverts entirely to the former version. If you place this command at the top of
a script that was built for the given version, the script functions the same way it did on earlier releases of
the software.
Software Release 11.5.0 is the rst release to support tmsh version control. We recommend setting the
version to 11.5.0 at the top of your 11.5.0 tmsh scripts, to guard against the script breaking in a future version
of tmsh.
About command completion
At any point while typing or editing a command in tmsh, you can press the Tab key. tmsh either completes
the current or next word, or displays possible completions for the current or next word.
The command completion feature reduces the amount of typing that is required to run commands. When
you press the Tab key, the system automatically completes the current command-line element to as many
unique characters as possible. If there is more than one possible completion the list of possible completions
displays. Command completion also completes conguration object identiers.
For example, if the command has only one option, tmsh lls in the remainder of the word with that option
and a trailing space. If the command has more than one option, tmsh completes the current word with the
longest possible match, while also displaying the other possible matches. If tmsh displays nothing after you
press the Tab key, no options exist to complete the word.
If you move the cursor anywhere on the command line and press the Tab key, tmsh completes what is to
the left of the cursor. For example, tmsh completes sho[Tab] pool as show pool.
About using glob with command completion
tmsh uses glob matching to complete object identiers. glob matching checks for the presence of the
constituents of a given pattern. This means that if you partially type an object identier, such as the IP
address of a node, tmsh completes the command by offering all IP addresses that contain the partial address
you entered.
For example, tmsh returns addresses that match 10.1.1* when you type the following command sequence:
show node 10.1.1[Tab]
Likewise, tmsh returns addresses that match 10*22*, when you type the following command sequence:
show node 10*22[Tab]
38
Using tmsh
About command completion behavior
There are several behaviors to be aware of when using the command completion feature. When you press
the Tab key, the components that display in the Conguration Items list are determined by your permissions
and the action you are taking. The following rules apply:
• When you congure a component that is not a child component, the Conguration Items list contains
the existing components of the type that you are conguring that you have permission to view.
For example, tmsh displays all virtual servers that you have permission to view in the Conguration
Items list when you congure a virtual server using the following syntax:
[create | delete | modify] virtual [Tab]
• When you congure a child component, (for example, when you add a pool member to a pool), the
Conguration Items list contains the existing components of the type that you are conguring based on
the following rules:
• When you add a child component to its parent, the list contains only the components of that type
that you have permission to view that are not yet associated with the parent component. For example,
the list contains all of the virtual servers that you have permission to view that are not yet associated
with poolA when you add members to poolA using the following syntax:
modify pool poolA members add { [Tab]
• When you replace all of the child components that are associated with a parent component, the list
contains all of the components of that type that you have permission to view. For example, the list
contains all of the virtual servers that you have permission to view when you replace all of the
members of poolA using the following syntax:
modify pool poolA members replace-all-with { [Tab]
• When you delete or modify the child components that are associated with a parent component, the
list contains only the components of that type that are already associated with the parent. For example,
the list contains all of the virtual servers that are currently a member of poolA when you delete the
members of poolA using the following syntax:
modify pool poolA members delete { [Tab]
• When you congure a component, the Properties list only contains properties that you can use with
other already congured properties of that component.
The command route is a good example. If you specify a pool for the route, then the interface, gateway,
and blackhole options are no longer valid, so they do not appear in the list.
Note: At the BIG-IP system prompt, tmsh displays possible completions for a command, only if you type
the tmsh command followed by: Ctrl + V Ctrl + T Enter
39
Traffic Management Shell (tmsh) Reference Guide
About the help feature
tmsh includes man pages for each of the commands and components that are available within tmsh. You
access the man pages using the following command syntax:
help [ [command] | [full path to component]
For example, to access the man page for the vlan component from the root module, use the following
command sequence:
help / net vlancl
You can also search the man pages for information on a specic term or topic. To do this, you use the
following command syntax:
help search [term or topic]
You can perform a help search from within any module in the tmsh hierarchy. For example, to nd the man
pages that contain a reference to VLANs, use the following command sequence:
help search vlan
Additionally, you can display a list of topics that are available in a module using the following command
sequence:
help [full path to module]
For example, to display the topics that are available in the current module, use this command: help. To
display the topics that are available in the net module, use the following command sequence: help / net.
About context-sensitive help
tmsh includes a context-sensitive help feature that provides help as you type commands. At any time, you
can type a question mark (?) on the command line, and tmsh returns information to assist you in completing
the command. Based on when you type the question mark, you get the following results:
• When you type a question mark immediately following any portion of a command, tmsh returns possible
completions for the command, but does not complete the command as the command completion feature
does.
• When you type a space before the question mark, tmsh returns descriptive text that explains the commands,
components, or properties that you can congure.
• When you type a question mark in the middle of a command, tmsh returns help on the command to the
left of the cursor.
Note: To use a question mark in a glob or regular expression, you must escape the question mark using
quotation marks, apostrophes, or a backslash.
40
Using tmsh
Additionally, you can request context-sensitive help for the last command in a series of commands. For
more information, see Entering multiple commands, on page 2-10.
About interrupting a command
You can cancel a command that you issued by typing Ctrl + C one or more times.
About entering multiple commands
You can enter multiple commands on the command line by separating the commands with semi-colons (;).
For example, to display the properties of the self IP addresses and VLANs of the system, use the following
command sequence:
list / net self ; list / net vlan
When you enter multiple commands in this way, all of the commands are added to the command glob in a
single line item, regardless of whether any of the commands were successful. However, if one of the
commands that you enter fails to parse, tmsh does not run the remaining commands you entered. tmsh audits
commands as the commands run; therefore, if a command fails to parse, tmsh does not audit the remaining
commands.
You can also specify multiple commands in a command alias by separating the commands with semi-colons.
For example, to create an alias that displays the properties of the VLANs and VLAN groups on the system,
use the following command sequence:
create / cli alias vlans command "list / net vlan ; list / net vlan-group"
Additionally, you can request context-sensitive help and use the command completion feature on the last
command in a series of commands. For example, to display help for the vlan-group component, use the
following command sequence:
list / net vlan ; list / net vlan-group ?
About the glob feature
tmsh saves each command that you enter in the command glob file.
The command glob persists when you log off of the system. The next time you log on to the system, you
can search for, display, and then edit, the tmsh commands that you entered in previous sessions. The command
glob persists even through a restart of the BIG-IP system.
There are two limits that you can set for the command glob: the number of commands that tmsh saves in
the command glob le, and the number of commands that you can view or search from the command line.
• You use the set cli preference glob-le-size command to set the maximum number of commands that
you want tmsh to save in the command glob le.
41
Traffic Management Shell (tmsh) Reference Guide
The default is 10,000 commands. The maximum number of commands that the le can contain is 100,000
commands. If you do not want to use the command glob feature, set the maximum number of commands
to 0 (zero). This means that tmsh does not save any commands in the glob le.
• You use the set cli preference glob-size command to set the number of commands that you want to be
able to view or search from the command line.
The default is 500 commands. The maximum number of commands that you can view or search is 10,000
commands. When you set the glob-size option to (0) zero, tmsh does not add commands to the in-memory
list of commands, but does continue to write commands to the command glob le.
Note: After you change the value of the glob-size option, tmsh might renumber the commands; however,
the commands remain in the same order.
Note: tmsh does not save commands in the command glob le that end in a question mark (?) or begin with
an exclamation point (!). Likewise, these types of commands do not appear in the command glob list.
Changing whether the date and time display in the glob file
The date and time the command was issued displays before the command in this format: [Month day
hh:mm:ss]. You can disable this feature.
1.
Log on to tmsh and navigate to the cli preference module.
2.
To disable the display of the date and time in the glob le, type:
modify glob-date-time disabled
3.
To enable the display of the date and time in the glob le, type:
modify glob-date-time enabled
Displaying the commands in the tmsh glob list
Each command in the glob list is identied by a numeric ID. The larger the ID, the more recently the
command was issued relative to other commands.
1.
Log on to tmsh.
2.
Enter an exclamation point (!).
The command glob list displays the previously used commands in the reverse order of use.
3.
After you locate the command that you want to use again, type:
! [numeric ID]
For example, to run the command with a numeric ID of 32, type:
!32
42
Using tmsh
Finding and running a tmsh glob list command using a partial string
1.
Log on to tmsh.
The tmsh prompt displays.
2.
To run the most recent command in the glob list that begins with the specied string, type the following
command:
![string]
tmsh locates the command in the glob list and runs it.
For example, from the cli module, to run the most recent command that you used to set the preferences
for the command line, type:
!set preference.
Running the previous command
When you are logged on to tmsh, you can use the glob list to run the previous command, even if it was run
in the previous tmsh session.
1.
Issue commands to congure the system.
tmsh runs the commands you issue.
2.
Type the following command:
!!
The previous command runs.
Searching for a command using the pager's search feature
When you are logged on to tmsh, you can use pager’s search feature to locate a tmsh command by date/time
stamp.
1.
Log on to tmsh.
2.
Type one of the following commands:
show glob
or
!
3.
Use the pager’s search feature to nd a specic date and time.
43
Traffic Management Shell (tmsh) Reference Guide
Searching for a command using grep
When you are logged on to tmsh, you can pipe the output of the glob le to the grep utility to search for a
command by the date/time stamp.
1.
Log on to tmsh.
The tmsh prompt displays.
2.
Type the following command:
show glob | grep "[hh:mm:ss]"
About the tmsh keyboard map
You can use the default keyboard map to search the command glob list for a specied command. For
example, to search for the previous command that contains a specied string, type the following command:
[string] Alt-P
You must press Enter to run the command.
The following table describes the default keyboard map for tmsh. The key sequences are not case-sensitive.
Table 2: Default keyboard map for tmsh
ActionKey Sequences
Moves the cursor to the beginning of the line.Ctrl + A
Moves the cursor to the left one character.Ctrl + B
Cancels the current command.Ctrl + C
Deletes the character under the cursor, or when the command line is empty, exits
tmsh.
Ctrl + D
Moves the cursor to the end of the line.Ctrl + E
Moves the cursor to the right one character.Ctrl + F
Clears all characters from the command line.Ctrl + G
Deletes the previous character.Ctrl + H
Enters a new line and runs the current command.Ctrl + J
Deletes all characters from the cursor to the end of the line.Ctrl + K
Clears the screen, repositions the prompt at the upper left, and leaves the current
command intact.
Ctrl + L
Enters a new line and runs the current command.Ctrl + M
Displays the next item in the command glob.Ctrl + N
Displays the previous item in the command glob.Ctrl + P
Resumes input.Ctrl + Q
44
Using tmsh
ActionKey Sequences
Clears the screen, repositions the prompt at upper left, and leaves the current command
intact.
Ctrl + R
Suspends input.Ctrl + S
Transposes the character under the cursor with the character to the left of the cursor.Ctrl + T
Deletes all characters before the cursor.Ctrl + U
Deletes the word before the cursor.Ctrl + W
Moves the cursor one word to the left.Esc + B
Deletes all characters from the cursor to the end of the current or next word.Esc + D
Moves the cursor one word to the right.Esc + F
Changes the word to the right and the word under the cursor to lowercase.Esc + L
Searches command glob search for the next item.Esc + N
Searches command glob search for the previous item.Esc + P
Changes the word to the right and the word under the cursor to uppercase.Esc + U
Deletes the word to the left of the cursor.Esc + Backspace
Deletes the character to the left of the cursor.Backspace
Delete
Scrolls back through the command glob.Up Arrow
Scrolls forward through the command glob.Down Arrow
About the command audit feature
The BIG-IP system contains a read-only audit le named /var/log/audit. tmsh writes an entry in the audit
le for each tmsh command that runs, providing a historical log of issued commands. Only users with the
role of Administrator or Resource-Administrator can view the audit logs.
You can change whether tmsh audits commands using the following syntax:
modify / cli global-settings audit [enabled | disabled]
Note: If tmsh cannot connect to the mcpd daemon, tmsh audits all commands until the connection is
re-established.
About audit-log entries
The audit le contains entries with the format shown below:
01420002:5: AUDIT – pid=number user=user_id query_partitions=p1,p2,…,pn
update_partition=partition_name module=(tmos.module…)# status=[success/fail]
cmd_data=command that was issued
45
Traffic Management Shell (tmsh) Reference Guide
This table denes each portion of an audit entry.
Table 3: Audit entry components
DenitionAudit Entry
Component
Identies the entry as a tmsh command.01420002:5:
AUDIT
Species the process ID of the tmsh instance that generated the entry.pid=number
Identies, by user ID, the user who issued the tmsh command. For commands run
by the system, this portion of the entry is empty, for example: user=" ".
user=user_id
Identies the administrative partitions, in a comma-separated list, that the user can
query. For more information about setting the administrative partitions that a user
can query, see the documentation about cli admin-partitions.
query_partitions=
Identies the administrative partitions that the user can update. For more information
about setting the administrative partitions that a user can update, see the documentation
about cli admin-partitions.
update_partition=
Identies the tmsh module within which the user issued the command.module=
Indicates whether the command was run successfully. The possible values are:status
• Command OK
Indicates that the command was successful.
• [error syntax]
Displays the same error that the system displayed when the command failed. Note
that when you use the edit command, and it fails, the audit log contains each line
of the le that you attempted to run with the error displayed
Indicates the command sequence that the user entered. Note that when the edit
command runs successfully, the audit le contains each line of the le that was
cmd_data=
submitted as a separate entry. For more information about the command edit, see
GTM rule, on page 46-44.
Viewing historical logs
When you view an audit log from the sys module, you can use the lines or range options to reduce the
number of log entries that display.
1.
Log on to tmsh.
The tmsh prompt displays.
2.
Type the following command sequence:
show / sys log audit lines 5
The rst ve lines in the audit log display.
46
Using tmsh
About command aliases
You can create command aliases to use as short cuts within tmsh. For example, if you perform specic
operations on a regular basis, or if you congure the system using long commands, you can create a command
alias to save you some typing.
You can issue a command alias from within any tmsh module. For example, if you create an alias named
show to display all of the components in the ltm module, when you type show in the cli module, tmsh
displays only the ltm module components. This example illustrates that the command alias you created
takes precedence over the system default show command, which normally displays the components of the
module within which you issue the command.
Note: Aliases that you create take precedence over system commands. Additionally, an alias with the same
name as a tmsh module causes the module to be hidden from the command completion feature.
About creating command aliases
A command alias consists of a name and a command sequence that runs when you use the name of the
command alias on the command line. When you create a command alias, the name of the command alias:
• Is not case-sensitive
• Cannot be create or delete
• Cannot contain spaces, tabs, exclamation points, or question marks
The following rules apply to the command sequence for which you are creating a command alias.
• The command cannot be empty.
• You can use multiple command sequences, separated by semi-colons.
• You can use another alias as the rst argument in the command sequence.
• tmsh does not verify validity of the command sequence until you issue the command alias.
• When you include an exclamation point in the command sequence, the exclamation point does not invoke
the command glob.
• If you include spaces in the command sequence, then you must use quotation marks around the command
sequence.
About using command aliases
When you use a command alias on the command line, the following rules apply.
• When you use a command alias within a command, you must use the alias at the beginning of the
command sequence.
• When you use the command completion or context-sensitive help feature with a command alias, tmsh
responds as if you had entered the command sequence that the command alias references.
• Command aliases display in all command completion lists, regardless of whether the command itself is
valid within the current module.
• The name of the command alias displays in the command glob list.
• The command, for which you created the alias, not the name of the command alias, displays in error
messages related to usage of the alias.
47
Traffic Management Shell (tmsh) Reference Guide
Setting the tmsh preference for show-aliases
You can congure tmsh to include command aliases in the list of commands in the Commands section on
the command line when you use the command completion and context-sensitive help features.
1.
Log on to tmsh.
The tmsh prompt displays.
2.
Type the following command:
cli
3.
Type the following command sequence:
set preference show-aliases enabled
When you type a question mark (?) on the command line or use the command completion feature, tmsh
now displays command aliases in the Commands section on the command line.
About the wildcard search feature
tmsh supports regular expression (RE) and glob-based wildcard search methods. For more information
about these programs, access the man page for each program using the following tmsh commands:
• help regex
• help glob
About the statistics feature
You can use tmsh to display statistics, including historical performance statistics. You can select the format
in which these statistics display, as well as reset the statistics for some of the tmsh components. To determine
if statistics are available for a specic component, see the specic component in one of the following
chapters.
About setting preferences for statistics
You can view statistics for many of the tmsh components using the show command. You can specify the
units in which you want tmsh to display statistics. You do this using the following command syntax:
set / cli preference stat-units [default | kil | meg | gig | raw]
For example, to set tmsh to display statistics in parts per million, use the following command sequence:
set / cli preference stat-units meg
48
Using tmsh
While you are working in tmsh, you can override the stat-units setting to display statistics for a specic
component in a different unit. For example, to display the statistics for the ltm pools in gigabits, use the
following command sequence:
show / ltm pool gig
This table describes the units in which tmsh can display statistics.
Table 4: Unit options for statistics
DescriptionOption
Displays data in the simplest units.
For example, if the data is 1,200,001, tmsh displays 1.20M; however, if the data is 1,200,
tmsh displays 1.2K.
default
This is the default value for system statistics.
Displays data in parts per billion.gig
Displays data in parts per thousand.kil
Displays data in parts per million.meg
Displays raw data.raw
For some tmsh components, you can choose the level of statistics that you want to view. The next table
contains a description of the options you can use to display statistics, depending upon the information that
you want to view. Note that all levels are not available for all components. To determine which of these
options is available for a specic component, refer to the man page for the component or use the command
completion feature.
To display the statistics for a specic component at a specic level, use the following command syntax:
show / [module...module] [component] [detail | global | historical]
For example, use the following command sequence when you want to view detailed pool statistics for Local
Trafc Manager pools:
show / ltm pool detail
tmsh also provides a historical view of system performance. You can use the historical option, shown in
the table below, to display historical performance data. This option displays data that is equivalent to the
performance graphs in the Conguration utility. For more information, see Collecting performance data in
the TMOS Management Guide for BIG-IP Systems.
For example, to display statistics about current connections, and for connections that have occurred within
the last 3 hours, 24 hours, 7 days, and 30 days, use the following command sequence:
show / sys performance connections historical
The components for which you can view historical data are in the system performance module. They include
connections, gtm, ramcache, system, and throughput.
49
Traffic Management Shell (tmsh) Reference Guide
Table 5: Levels in which you can display statistics in tmsh
Syntax of show commandStatistics that displayShow
Command
Option
Used
show / [module...module] [component] detail
Statistics for all of the
components of the
specied type, and the
detail
components with which
these components are
associated.
show / [module...module] [component]
[component_name] detail
Statistics for the specied
component, and the
components with which
the specied component
is associated.
show / [module...module] [component] global
Roll-up statistics for the
component, and all
related components.
global
show / [module...module] [component]
[component_name] global
Roll-up statistics for the
specied component, and
all related components.
show / system performance [component]
historical
Historical system
performance statistics.
historical
Note: You can also view statistics from the BIG-IP system prompt, using the following command syntax:
tmsh show / [module...module] [component] \
[detail | global | historical] [default | kil | meg | gig | raw]
About resetting statistics
When you are evaluating the performance of your system, you might want to reset the statistics for a
component. You can do that in one of two ways:
• You can reset the statistics for a type of component using this syntax:
reset-stats / [module...module] [component]
• You can reset the statistics for a specic component using this syntax:
reset-stats / [module...module] [component] [component_name]
50
Using tmsh
Note: After you reset statistics, when you run the show command, you might see a value of nan. This stands
for not a number, which indicates that no data is currently available. Wait a few moments and run the show
command again, and in most cases the nan value will be replaced by an integer value.
About using grep to filter tmsh output
grep is a command line search utility. For more information about grep, see the man page using the tmsh
command help grep.
To use the output of a tmsh command as input to the grep utility, use this syntax:
[command] | grep [grep options]
tmsh supports the grep utility options shown in this Table.
Table 6: grep options supported in tmsh
UsageSupported option
These options require a numeric argument between 0 and 4294967295.-A, -B, -C, -m
These options do not accept arguments. Instead, the grep utility treats arguments for
these options as either another option or a search pattern.
-c, -E, -G, -i, -n, -o,
-P, -v, -w, -x
This option requires one argument, a search pattern.-e
Unsupported options preceded by a hyphen result in syntax errors.-[unsupported
option]
tmsh treats any argument that is not preceded by a supported option, and does not
begin with a hyphen, as a search pattern preceded by -e.
For example, if you enter show pool | grep 10.2.3.4 within the ltm module,
tmsh runs show pool | grep -e 10.2.3.4.
[argument]
About batch mode transactions
You can issue a set of commands in a batch, and tmsh processes the commands as a single transaction. You
enter batch mode by using the transaction component within the cli module.
When you run a set of commands in batch mode, tmsh does one of two things:
• Successfully runs all of the commands in the transaction.
• Does not commit any of the commands in the transaction, if the syntax of any of the commands does
not pass the syntax check. In other words, tmsh does not partially commit a transaction.
Creating a batch mode transaction
1.
Log on to tmsh.
51
Traffic Management Shell (tmsh) Reference Guide
2.
Type the following command sequence:
create /cli transaction
The tmsh batch mode prompt displays:
[batch mode] (tmos)#
3.
Enter a command using the full path to the command. tmsh parses the command, and if the command
passes syntax checks, tmsh indicates that the command has been added to the transaction.
About viewing the commands in a transaction
At the tmsh batch mode prompt, type:
list transaction
tmsh displays the commands in the transaction by numeric ID.
About deleting a command from the transaction
At the tmsh batch mode prompt, type:
modify transaction delete [numeric ID]
tmsh deletes the command that you specify with a numeric ID. Note that the system might renumber the
commands in the transaction.
About replacing a command in the transaction
At the tmsh batch mode prompt, type:
modify transaction replace [numeric ID] [command sequence]
tmsh checks the syntax of the new command that you specify with a numeric ID, replaces the existing
command identied by the numeric ID with the new command, and indicates that the transaction was
updated successfully.
About inserting a command in the transaction
At the tmsh batch mode prompt, type:
modify transaction insert [numeric ID] [command sequence]
52
Using tmsh
tmsh checks the syntax of the new command that you specify to insert before a command identied by a
numeric ID, renumbers the existing commands identied, and indicates that the transaction was updated
successfully.
About submitting a transaction
At the tmsh batch mode prompt, type:
submit transaction
tmsh runs the transaction. Note that if the transaction fails, tmsh remains in batch mode, and you can update
the transaction, and then resubmit it.
About cancelling the transaction
At the tmsh batch mode prompt, type:
delete transaction
tmsh deletes all the commands in the transaction and returns you to the tmsh prompt.
About tmsh behavior controls
tmsh includes a set of commands that you can use to change the behavior of tmsh, and to congure the
BIG-IP system. For more information about the tmsh commands, see the manual about tmsh Global
Commands, or use the help command within tmsh.
About tmsh options
You invoke tmsh from the shell prompt, just after you connect to the BIG-IP system with SSH. There are
several options you can use when invoking tmsh, described in this table:
Table 7: tmsh invocation options
ActionOption
tmsh does not write commands to the command glob le. For more information
about the command glob le, see About the glob feature.
Note that if auditing is enabled, tmsh continues to write commands to the audit
log. For more information, see About the command audit feature.
-a
This option is useful when writing scripts, because it stops the scripts from lling
up the command glob le. This option applies to the non-interactive mode only.
Disables video highlighting in tmsh.-c
Connects to the specied blade in a clustered system.-d [ip address |
hostname]
53
Traffic Management Shell (tmsh) Reference Guide
ActionOption
Displays options you can use when accessing tmsh from the system shell.-n
Generates a tmsh debug log le name tmsh.out in the current directory. Note that
when you run a tmsh script, the shell generates a debug log le for the script named
tmsh.out.[script name].
Using this option causes tmsh to run signicantly slower.
-m
Prevents tmsh from responding to user actions with questions. This option is useful
when writing non-interactive shell scripts from the system shell.
-q
About using special characters in tmsh
You can use special characters when running tmsh commands. This table lists these special characters,
describes how to use them, and provides examples of their usage.
54
Using tmsh
Table 8: Special character usage in tmsh
ExamplesUsageCharacter
create partition A description "Admin’s
partition"
Use quotation marks around
strings that contain a space, a
backslash (\) that is not being used
to escape another character, or an
apostrophe (’).
" "
create partition A description ’Admins
partition’
Use apostrophes around
arguments, a string with a space,
a string with a backslash (\), or a
string with a double-quote (").
’ ’
list gtm wideip "\*siterequest.com"
list gtm wideip "\*site\?.com"
list gtm wideip \\*siterequest.com
list gtm wideip \\*site\\?.com
Use a backslash to escape the
following: quotation marks (" "),
another backslash (\), an asterisk
(*), a question mark (?), a left
bracket ([), or a space.
Inside a pair of apostrophes or
double quotes, you do not need to
escape the backslash (\).
\
list gtm wideip "\*siterequest.com"
When escaping glob and regex
special characters, use an asterisk
(not between brackets) in a search
*
string to match any string
including an empty string.
Use a backslash (\) to escape an
asterisk.
list gtm wideip "\*site\?.com"
When escaping glob and regex
special characters, use a question
mark (not between brackets) in a
?
search string to match a single
character.
Use a backslash (\) to escape a
question mark.
list gtm datacenter \[site]
When escaping glob and regex
special characters, use brackets to
enclose any characters that you
[]
want to include in a search string
to match a single character.
Use a backslash to escape square
brackets.
create gtm pool my\ http\ pool create gtm
pool "my http pool"
You must escape the space
character or put quotation marks
around it.
space
show ltm pool | grep 10.2.3.4 list ltm
pool | grep 10.2.3.4
Use the vertical bar to lter output
from the commands show or list.
|
55
Traffic Management Shell (tmsh) Reference Guide
Global
cd
Change the current working folder.
Syntax
Use the command cd to change the current working folder.
cd [folder name]
cd /[folder name]
Description
The command cd [folder name] changes the current working folder to allow the user navigation around the
folder system (see sys folder). The command pwd displays the current working directory.
The current working folder may be listed in the tmos command prompt while in tmsh interactive mode (see
cli preference).
Folder names are separated by a forward slash /.
There are two built-in folders:
/ is the root folder
/Common is the default folder for creating new congurations objects.
Additionally, the following directory entries:
. is the current folder
.. is the parent folder
Examples
cd /Common
Change the current working folder to /Common.
cd resources
Change the current working folder to resources. In this example the resources folder is relative to the current
working folder. As an example, if the current working folder was /Common, the new working folder will
be /Common/resources.
cd resources/proles/udp
Multiple folders may be specied. Tab complete assists lling the command line with folder names.
cd /
Make the current working folder the root folder.
cd ../Alpha
Change the working directory by rst going to the parent, and then switch to the sub-folder Alpha.
See Also
help, pwd, sys folder, tmsh
cp
Creates a copy of a TMOS(tm) conguration object.
Syntax
Use the command cp within a tmsh module to create a copy of the component that resides in that module.
To create a copy component that resides in another module, use the full path to the component.
cp [component] [source] [destination]
cp / [module...module] [component] [source] [destination]
Description
You must provide a unique name for each component destination of the copy operation.
Examples
cp template mytemplate newtemplate
From within the sys application module, creates a new Application Template named newtemplate with
the same properties as mytemplate .
cp / cli script my_script1 my_script2
From within the sys application module, copies the my_script1 script to my_script2 within the cli module.
Options
• component
Species the type of the component that you want to copy.
• module
Species the module within which the component that you want to copy resides.
• source
Species the component to be copied.
• destination
Species a unique name for the component that will be created as part of the copy.
See Also
tmsh
58
Global
create
Creates a TMOS(tm) conguration component.
Syntax
Use the command create within a tmsh module to create a component that resides in that module. To create
a component that resides in another module, use the full path to the component.
create [component] [name] [property [value]...]
create / [module...module] [component] [name] [property [value]...]
Description
You must provide a unique name for each component that you create.
Examples
create pool pool1
From within the gtm module, creates a Global Trafc Manager pool named pool1.
create / ltm pool my_pool
From within the gtm module, creates a Local Trafc Manager pool named my_pool.
Options
• component
Species the type of the component that you want to create.
• module
Species the module within which the component that you want to create resides.
• name
Species a unique name for the component.
• property [value]...
Species properties for the component and their values.
See Also
tmsh
delete
Deletes a tmsh component.
59
Traffic Management Shell (tmsh) Reference Guide
Syntax
Use the command delete within a tmsh module to delete a component that resides in that module. To delete
a component that resides in another module, use the full path to the component.
delete [component] [name]
delete / [module...module] [component] [name]
Description
You must provide the name of the component that you want to delete.
Examples
delete pool pool1
From within the gtm module, deletes the Global Trafc Manager pool named pool1.
delete / ltm pool my_pool
From within the gtm module, deletes the Local Trafc Manager pool named my_pool.
Options
• component
Species the type of the component that you want to delete.
• module
Species the module within which the component that you want to delete resides.
• name
Species the name of the component that you want to delete. All may be used as an identier for most
component types.
• recursive
Deletes all items in the current folder and all sub-folders that match the module, component and the
name specied. all may be used as the name identier with this command.
Note: When using recursive and all together, you will be prompted to verify this action. If you wish to
disable this prompt, you may run tmsh using the -q command-line option. This is very useful when
writing scripts that use this command.
See Also
tmsh
edit
Modules
All tmsh modules.
Opens the specied components in an editor.
60
Global
Syntax
Use the command edit to create components or modify the conguration of components using a text editor.
To edit a component that resides in another module, use the full path to the component.
edit [component] [name ... name | all]
edit / [module...module] [component] [name ... name | all]
Description
You can use the command edit to create or modify components in the auth, cli, gtm, ltm, net, sys and wom
modules, and iRules(r).
If you are assigned the role of Administrator, when you use the command edit, the system starts the vi
editor. If you are assigned any other role, the system starts the pico/nano editor.
The system saves, in a temporary directory, the text le, named data, that you are editing. When you save
the le and close the editor, the system checks for errors, and then prompts you with an opportunity to
continue editing and resolve any errors.
When you edit an existing component that can have associations, such as a Global Trafc Manager wide
IP that can have pool member associations. but the component does not currently have associations, to
create the new associations, you must use the full command syntax in the text le. For the full command
syntax for each component, see the associated man page.
When you edit a component that has associations with components that are children of the component you
are editing, the text le contains a line for the conguration of the child components that begins with the
command modify, for example: pools modify { [existing pool members congurations] }. In this case, if
you want to add or delete pool members, you must add additional lines to the text le, for example: pools
delete { [pool members to delete] }.
If you want the text le that opens to contain all of the editable properties of the component that you want
to edit, you must use the all-properties option at the end of the edit command sequence; otherwise, only
the non-default properties display in the text le.
Examples
edit / gtm pool a*
From the root module, opens a le in an editor in which you can modify the conguration of all Global
Trafc Manager pools with names that start with the letter a using the template that displays in the editor.
edit datacenter new_dc
From the gtm module, opens a le in an editor in which you can create the Data Center named new_dc
using the template that displays in the editor.
edit datacenter a*
From the gtm module, opens a le in an editor in which you can edit all existing datacenters with names
that begin with the letter a.
edit datacenter new_datacenter existing_datacenter
From the gtm module, opens a le in an editor in which you can create a new datacenter and edit an existing
datacenter. Note that when the le opens, a template displays that you can use to create a new datacenter
followed by the conguration of the existing datacenter.
edit rule rule_1
From the gtm module, opens a le in an editor in which you can create an iRule named rule_1 using the
template that displays in the editor.
61
Traffic Management Shell (tmsh) Reference Guide
When the editor opens, and you are creating or editing an iRule, you must enclose the iRule syntax in
brackets, for example, [ ...iRule... ]. Note that the template includes the brackets.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• component
Species the type of component that you want to create or modify.
• module
Species the module within which the component resides.
• name
Species a unique name of each component that you want to create or modify.
See Also
tmsh
exit
Exits a tmsh module or component.
Syntax
Use the command exit within a tmsh module or component to leave that module or component and return
to the higher level of the shell structure.
exit
Note that to exit tmsh and return to the BIG-IP(r) system prompt, use the command quit.
See Also
tmsh
generate
Description
Use the generate command to generate signed scripts for components. Currently two algorithms are
supported: checksum and signature.
generate <script_name> checksum
generate <script_name> signature signing-key <key_name>
62
Global
See Also
ltm rule, sys application template
help
Displays context-sensitive help text.
Syntax
Use the command help within a tmsh module to display information about the components that reside
within that module, or at the component level to display help about the component. To display help for a
component that resides in one module from within another module, use the full path to the component.
Type the question mark (?) character anywhere in tmsh to display a list of modules, components, and
commands that are available within the module in which you are currently working.
?
help
help [module...module]
help [component]
help / [module...module] [component]
help search [text]
Description
You can display tmsh man pages using the command help.
Examples
?
From within the gtm module, displays a list of modules, components, and commands that are available.
help pool
From within the gtm module, displays help about Global Trafc Manager pools.
help / ltm pool
From within the gtm module, displays help about Local Trafc Manager pools.
Options
• component
Species the type of the component for which you want to display help.
• search
Use the search option to nd help topics that contain the specied text. The search is case insensitive.
Text that contains a space or special tmsh characters must be quoted. Note that the search will not always
nd text that spans multiple lines.
• module
Species the module within which the component for which you want to display help resides.
63
Traffic Management Shell (tmsh) Reference Guide
See Also
tmsh
install
Description
Use the command install to install or update the following components. For the description and syntax see
the help page for each component.
sys license
sys software block-device-hotfix
sys software block-device-image
sys software hotfix
sys software image
See Also
sys license, sys software block-device-hotx, sys software block-device-image, sys software hotx, sys
software image, tmsh
list
Displays components that you have permission to view.
Syntax
Use the list command within a tmsh module to display the properties of the components in that module.
To display the properties of the components in one module from within another module, use the full path
to the component.
list [component]
list [component] [name]
list [component] [name] [property]
list / [module...module] [component] [name] [property]
all-properties
current-module
non-default-properties
one-line
partition
recursive
Description
When the default Read partition is All, use the list command to display all of the components that you have
permission to view within a tmsh module. When you specify a Read partition, the list command displays:
• Only the components that you have permission to view in the current partition
• All of the components that are not in partitions
64
Global
• All of the components in partition Common
Examples
list / ltm
From within the gtm module, displays the properties of all of the components in the ltm module, including
the components in the ltm monitor, ltm persistence, and ltm prole modules.
list / ltm current-module
From within the gtm module, displays the properties of all of the components in the ltm module, not
including the components in the ltm monitor, ltm persistence, and ltm prole modules.
list pool
From within the gtm module, displays the properties of all of the Global Trafc Manager pools.
list pool all-properties
From within the gtm module, displays all of the properties of all of the Global Trafc Manager pools.
list pool monitor
From within the gtm module, displays the monitor associated with each Global Trafc Manager pool.
list / ltm pool
From within the gtm module, displays the properties of all of the Local Trafc Manager pools.
Options
• all-properties
Displays the values of all of the properties of the specied component.
• component
Species the component that you want to display.
• current-module
Species to display only the components that reside in the specied module, not the components that
reside in the sub-modules of that module.
For example, from within the ltm module to display only the components in the gtm module, and not
the components in the gtm monitor and gtm settings sub-modules, use the following command sequence:
list / gtm current-module.
• module
Species the module within which the component that you want to display resides.
Note: When you use the command list at the module level, by default, the system does not display all
of the components that reside in the specied module. To display the properties of some components
you must explicitly specify the component. For example, from the ltm module, to display the virtual
addresses for the Local Trafc Manager, use this command sequence:
list virtual-address
For more information about displaying the properties of a component, see the man page for the component.
• name
Species the unique name of the component.
• non-default-properties
65
Traffic Management Shell (tmsh) Reference Guide
Displays the values of all of the properties for which a user changed the value from the default value
for the specied component.
• one-line
Displays the conguration for each object on one line. Conguration that consists of scripts will not be
formatted on to a single line. This include ltm and gtm iRules and tmsh scripts.
• partition
Displays the administrative partition within which the specied component exists.
• property
Species the property of the component that you want to display.
• recursive
Species to display the components not only from the current folder but also from all sub-folders
recursively.
See Also
tmsh
load
See Also
save, tmsh, asm policy, ltm dns dns-express db, sys cong, sys geoip, sys ucs
modify
Modies a tmsh component.
Syntax
Use the command modify within a tmsh module to modify a component that resides in that module. To
modify a component in one module from within another module, use the full path to the component.
modify [component] [name] [property [value] ]...
modify / [module...module] [component] [name] [property [value] ]...
Description
You must provide the name of the component that you want to modify.
You can apply one or more property settings to multiple components using a single command sequence.
For example, to associate the Local Trafc Manager pool named pool-1 with the virtual servers named
virtual-1 and virtual-2, use this command sequence: modify ltm virtual virtual-1 virtual-2 pool pool-1
66
Global
Examples
modify pool pool1 disabled
From within the gtm module, disables the Global Trafc Manager pool named pool1.
modify / ltm pool my_pool disabled
From within the gtm module, disables the Local Trafc Manager pool named my_pool.
Options
• component
Species the type of the component that you want to modify.
• module
Species the module within which the component that you want to modify resides.
• name
Species the unique name of the component that you want to modify.
• property [value]...
Species the properties of the component that you want to modify and their new values.
See Also
tmsh
mv
Renames or moves a TMOS(tm) conguration object.
Syntax
Use the mv command within a tmsh module to move or rename the component that resides in that module.
To move a component that resides in another module, use the full path to the component.
mv [component] [source] [destination]
mv / [module...module] [component] [source] [destination]
Description
You must provide a unique name for the source and destination of the move operation.
WARNING Currently MV is an experimental feature. By using this feature, you may be subject to loss of
statistics and disruption in GTM service. If you plan to move or rename a Virtual Server, please contact
your GTM administrator before doing so. You may enable this feature by setting the appropriate db variable.
This can be done by issuing the command:
modify /sys db mcpd.mvenabled value true
This will turn on the feature and allow moving and rename of select objects through TMSH only. Once you
have nished using the feature, we recommend disabling it once again. You may do this by issuing the
following command:
modify /sys db mcpd.mvenabled value false
67
Traffic Management Shell (tmsh) Reference Guide
Please use responsibly.
Examples
mv cm device bigip seattle32
Renames the device named bigip to seattle32.
mv ltm pool mypool myotherpool
Renames the LTM Pool named mypool to myotherpool.
mv ltm pool /Common/by/mypool /Common/myotherpool /Common/sub/mythirdpool to-folder
/Partition2/sub1
Moves the 3 pools in 3 different locations named mypool, myotherpool and mythirdpool into a single folder
in another partition.
Options
• to-folder
Species the folder to move the item or items into.
• component
Species the type of the component that you want to move.
• destination
Species a unique name for the component.
• module
Species the module within which the component that you want to move resides.
• source
Species the component to be moved.
See Also
tmsh
publish
Description
Use the command publish to make wam policies available for usage in wam applications. You can also
use this command to apply asm policies. For the description and syntax see the help page for wam policy
or asm policy.
See Also
asm policy, wam policy, tmsh
68
Global
pwd
Display the current working folder.
Syntax
Use the command pwd to display the current working folder.
pwd
Description
Display the current working folder
Examples
pwd
See Also
cd, help, sys folder, tmsh
quit
Exits tmsh.
Syntax
Use the following command at the tmsh prompt to close tmsh and return to the BIG-IP(r) system prompt.
quit
Note that to exit a tmsh module or component, you use the command exit.
See Also
tmsh
reboot
Reboots the system or boots the system into a different volume.
69
Traffic Management Shell (tmsh) Reference Guide
Syntax
reboot
slot [ [slot number] | all ]
volume [name]
Description
You can use the command reboot to reboot the system or cluster. If you do not specify an option, the local
system reboots.
You can use the volume option to reboot a system into a specic volume. For a cluster, you can use the
volume option to reboot all slots into the specied volume.
Additionally, for a cluster, you can use the slot option to reboot either a specic slot or all slots. Note that
the slot option does not modify the active volume.
Examples
reboot
Immediately reboots the running image.
reboot volume HD1.2
If the volume HD1.2 has a complete image on it, the system (or cluster) reboots into that image immediately.
However, if a software installation is in progress on the volume the system reboots as soon as the installation
is complete.
Options
• slot [ [slot number] | all ]
Reboots either a specic slot or all slots in a cluster, without changing the active volume of the slot(s).
This option is only available in a clustered environment.
Note: The slot and volume options are mutually exclusive.
• volume
Species the volume that you want to boot. The volume you specify becomes the default boot volume.
You cannot specify the active volume. In a clustered environment all slots reboot into the same volume.
Note: The slot and volume options are mutually exclusive.
See Also
install, sys software hotx, sys software image, sys software status, sys software volume, tmsh
reset-stats
Resets statistics for the specied components.
70
Global
Syntax
Use the command reset-stats within a tmsh module to reset the statistics for the specied component to
zero. To reset the statistics for the specied component in one module from within another module, use the
full path to the component.
reset-stats [component]
reset-stats [component] [name]
reset-stats / [module...module] [component]
reset-stats / [module...module] [component] [name]
Description
You can reset statistics for a group of components, or you can reset statistics for a specic component.
After you reset statistics, when you run the command show, you may see a value of nan. This stands for
not a number, which indicates that no data is currently available. Wait a few moments and run the command
show again, and in most cases the nan value will be replaced by an integer value.
It is important to note the following when you reset statistics:
• For a data center, the system also resets the statistics for the servers in that data center.
• For a Global Trafc Manager server, the system also resets the statistics for the virtual servers on that
server.
• For a Global Trafc Manager pool, the system also resets the statistics for the pool members.
• For a Local Trafc Manager pool, the system also resets the statistics for the pool members.
• For a VLAN, you must reset the statistics for the trunks and interfaces associated with the VLAN.
• You cannot reset statistics for system-supplied proles.
Examples
reset-stats pool
From within the gtm module, resets the statistics for all of the Global Trafc Manager pools.
reset-stats pool pool1
From within the ltm module, resets the statistics for the Local Trafc Manager pool named pool1.
reset-stats / ltm pool my_pool
From within the gtm module, resets the statistics for the Local Trafc Manager pool named my_pool.
reset-stats all-stats
From within the sys performance module, resets all performance statistics for the system.
Options
• component
Species the type of the component for which you want to reset statistics.
• module
Species the module within which the component for which you want to reset statistics resides.
• name
Species the unique name of the component for which you want to reset statistics.
71
Traffic Management Shell (tmsh) Reference Guide
See Also
tmsh
restart
Restarts a service on the BIG-IP(r) system.
Syntax
Use the command restart within tmsh to restart a specied service.
restart
/sys service [service name]
Description
You can use the command restart to restart a specied service.
Examples
restart /sys service mcpd
Restarts the mcpd daemon.
restart /sys service snmpd
Restarts the snmpd daemon.
Options
Tip: Use the tab completion feature to see a list of available services.
See Also
start, stop, sys service, tmsh
run
Runs the specied program.
Syntax
Use the run command within tmsh to run a specied utility.
run
/cli script [arguments]
/cm add-to-trust
/cm config-sync
/cm remove-from-trust
/cm sniff-updates
72
Global
/cm watch-devicegroup-device
/cm watch-sys-device
/cm watch-trafficgroup-device
/gtm big3d_install [arguments]
/gtm bigip_add [arguments]
/gtm gtm_add [arguments]
/security anti-fraud engine-update
/security anti-fraud signatures-update [arguments]
/util bash [arguments]
/util dig [arguments]
/util dnat [arguments]
/util get-dossier [arguments]
/util get_ccn_dossier
/util lsndb [arguments]
/util sipdb [arguments]
/util diadb [arguments]
/util netstat [arguments]
/util ping [arguments]
/util ping6 [arguments]
/util qkview [arguments]
/util racoonctl [arguments]
/util sys-icheck [arguments]
/util tcpdump [arguments]
/util tracepath [arguments]
/util tracepath6 [arguments]
/util traceroute [arguments]
/util traceroute6 [arguments]
/wom diagnose-conn
/wom verify-config
Description
You can use the run command to run the specied program, utility or process.
You can read about the arguments that are available for the utilities in the cm module using the following
command sequence:
help /cm [utility name]
You can read about the arguments that are available for the utilities in the gtm module using the following
command sequence:
help /gtm [big3d_install | bigip_add | gtm_add]
You can read about the arguments that are available for the utilities in the util module using the following
command sequence:
help /util [utility name]
Note: Some tmsh features, such as tab completion, context-sensitive help, paging, and grep, are not available
for utilities.
When you are building a batch mode transaction in tmsh, if you type the run command, the system runs
the specied program immediately. It does not add the run command to the transaction that you are building.
Examples
help /util ping
Displays the help page for the ping utility.
Options
• big3d_install
Species to install the big3d daemon.
73
Traffic Management Shell (tmsh) Reference Guide
• bigip_add
Species the BIG-IP systems that you want to add to the Global Trafc Manager conguration.
• bash
Accesses the system shell.
• add-to-trust
Add a device to a trust domain.
• cong-sync
Synchronize the conguration between devices.
• remote-from-trust
Remove a device from a trust domain.
• sniff-updates
Display the commit ID updates that occur over the CMI communications channel. When you troubleshoot
a CongSync issue, it is helpful to determine which device group member has the latest commit ID
update and contains the most recent conguration. You can then decide whether to replicate the newer
conguration to the group, or perform a CongSync operation that replicates an older conguration to
the group, thus overwriting a newer conguration.
• watch-devicegroup-device
Display information about the devices in the device group to which the local device belongs.
• watch-sys-device
Display information about the local device.
• watch-trafcgroup-device
Display information about the trafc groups associated with devices in a device group.
• diagnose-conn
Runs the specied diagnose-conn script, which detects the sources of network connection and
performance problems in a WAN optimization conguration.
• dig
Runs the specied dig command. The dig utility queries DNS name servers.
• dnat
Runs the specied dnat command for the purpose of doing forward/reverse mapping of addresses for
DNAT.
• sipdb
Displays SIP persistence entries. The sipdb utility displays specic persistence entries and delete a
particular persistence record.
• diadb
Displays Diameter persistence entries. The diadb utility displays diameter persistence entries or delete
a particular persistence entry.
• get-dossier
Runs the get_dossier utility for the purpose of displaying system license dossier information.
• get-ccn-dossier
Runs the get_ccn_dossier utility for the purpose of displaying system information for dossier creation.
• gtm_add
74
Global
Species the Global Trafc Manager systems that you want to add to the Global Trafc Manager
conguration.
• netstat
Displays network connections, routing tables, interface statistics, masquerade connections, and multicast
memberships.
• ping
Runs the specied ping command. The ping utility sends ICMP echo requests to network hosts.
• ping6
Runs the specied ping6 command. The ping6 utility sends ICMPv6 echo requests to network hosts.
• qkview
Runs the specied qkview command. The qkview utility gathers diagnostic information from a BIG-IP
system.
• racoonctl
Runs the specied racoonctl command. The racoonctl utility is used to control operation of the racoon
daemon.
• ssh-keyswap
Runs the keyswap.sh script for managing SSH keys on the BIG-IP.
• sys-icheck
Runs the specied sys-icheck command. The sys-icheck utility veries all RPM packages and les.
• tcpdump
Runs the specied tcpdump command. The tcpdump utility prints headers and content of network
trafc.
• tracepath
Displays the route packets take to a network host.
• tracepath6
Displays the route packets take to an IPv6 network host.
• traceroute
Displays the route packets take to a network host.
• traceroute6
Displays the route packets take to an IPv6 network host.
• verify-cong
Runs the specied verify-cong script, which detects errors in the conguration of the WAN Optimization
Manager.
• engine-update
For the description and syntax see the help page for security anti-fraud engine-update.
• signatures-update
For the description and syntax see the help page for security anti-fraud signatures-update.
See Also
cli script, gtm big3d_install, gtm bigip_add, gtm gtm_add, security anti-fraud engine-update, security
anti-fraud signatures-update, cm cong-sync, tmsh, util bash, util dig, util dnat, util netstat, util ping, util
ping6, util qkview, util racoonctl, util tcpdump
75
Traffic Management Shell (tmsh) Reference Guide
save
Description
You can use the save command to write changes that you make to the running conguration of the BIG-IP
system to the specied le. You can also use this command to save an analytics report to a le on the
BIG-IP(r) system or to export an ASM policy to a le / standard output.
See Also
analytics report, asm policy, load, sys cong, sys ucs, tmsh
send-mail
Description
You can use the send-mail command to send an analytics report from the BIG-IP system to a list of e-mail
recipients.
See Also
analytics report, tmsh
show
Displays statistics for and the status of specied components.
Syntax
Use the show command within a tmsh module to display statistics for and the status of components in that
module. To display statistics for and the status of components in another module, use the full path to the
component.
show
show [component]
show [component] [name]
show / [module] [component] [name]
all-stats
current-module
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(detail | global | historical)
field-fmt
running-config
recursive
76
Global
Description
You can use the show command to specify the unit value in which the system displays statistics and the
type of statistics that you want the system to display.
After you reset statistics, when you run the command show, you may see a value of nan. This stands for
not a number, which indicates that no data is currently available. Wait a few moments and run the show
command again, and in most cases the nan value is replaced by an integer value. For more information, see
help reset-stats.
Examples
show / ltm current-module
From within the gtm module, displays statistics and status for all the components within the ltm module,
but not the components in the ltm monitor, ltm persistence, and ltm prole modules.
show pool
From within the gtm module, displays statistics and status for all Global Trafc Manager pools.
show pool pool1
From within the gtm module, displays statistics and status for the Global Trafc Manager pool named
pool1.
show / ltm pool
From within the gtm module, displays statistics and status for all Local Trafc Manager pools.
show / ltm prole tcp global
From within the gtm module, displays global statistics and status for all Local Trafc Manager TCP proles
in the system default unit.
Options
• all-stats
Displays all of the available system performance statistics.
• component
Species the type of the component for which you want to show statistics and status.
• current-module
Species to display only the components that reside in the specied module, not the components that
reside in the sub-modules of that module.
For example, from within the ltm module to display only the components in the gtm module, and not
the components in the gtm monitor and gtm settings sub-modules, use this command sequence: show
/ gtm current-module.
• default
Displays data in the simplest units. For example, if the value of the data is 1,200,001, the system displays
1.20M; however, if the value of the data is 1,200, the system displays 1.2K.
• detail
Displays detailed data for the specied component and associated components. Note that this option is
available for only a partial set of tmsh components.
You can use the tab completion and context-sensitive help features to determine if this option is available.
For more information about these features, see help.
• eld-fmt
77
Traffic Management Shell (tmsh) Reference Guide
Displays data as a list of options and their values. The option names can be used to retrieve statistics
and status values in a shell script, see cli script.
• gig
Displays data in parts per billion.
• global
Displays global statistics for the specied component that includes statistics for all components of the
specied type. Note that this option is available for only a partial set of tmsh components. You can use
the tab completion and context-sensitive help features to determine if this option is available.
• historical
Displays historical statistics for the specied component. Note that this option is available only for a
partial set of tmsh components. You can use the tab completion and context-sensitive help features to
determine if this option is available.
• kil
Displays data in parts per thousand.
• lines
Species how many lines of the log that you want the system to display.
• meg
Displays data in parts per million.
• module
Species the module within which the component for which you want to show statistics and status
resides.
Note: When you use the command show at the module level, by default, the system does not display all
of the components that reside in the module. To display some components you must explicitly specify
the component. For example, from the ltm module, to display the statistics for and status of the virtual
addresses of the Local Trafc Manager, use the following command sequence:
show virtual-address
For more information about displaying statistics for and status of a component, see the man page for
the component.
• name
Species the unique name of the component for which you want to show statistics and status.
• range
Species a date range for the logs that you want the system to display, for example:
• 2d-4d
Species 2 - 4 days ago.
• 3d
Species 3 days ago to now.
• epoch--7/25:12:00:00
Species everything older than July 25th at noon.
• 2008-07-25--2008-07-28:13:30
Species between July 25th and 28th at 1:30 p.m.
• raw
78
Global
Displays raw data.
• recursive
Species to display the components not only from the current folder, but also from all sub-folders
recursively.
• running-cong
Displays the running conguration of the components that you have permission to view within a tmsh
module, if the default Read partition is All. If you specify a Read partition, this option displays only the
components that you have permission to view in the current partition, all of the components that are not
in partitions, and all of the components in partition Common. Note that this option is valid only for tmsh
components you can congure.
The running-cong option must be specied immediately after the show command, for example:
show running-cong ltm pool
See Also
cli script, tmsh
shutdown
Shuts down the system.
Syntax
shutdown
slot [ [slot number] | all ]
Description
You can use the command shutdown to power down the system or cluster. If you do not specify an option,
the local system shuts down.
For a cluster, you can use the slot option to shut down either a specic slot or all slots.
Examples
shutdown
Immediately shuts down the running system.
Options
• slot [ [slot number] | all ]
Shuts down either a specic slot or all slots in the cluster. This option is only available in a clustered
environment.
See Also
reboot, install
79
Traffic Management Shell (tmsh) Reference Guide
start
Starts a service on the BIG-IP(r) system.
Syntax
Use the start command within tmsh to restart a specied service.
start
/sys service [service name]
Description
You can use the start command to start a specied service.
Examples
start /sys service mcpd
Starts the mcpd daemon.
start /sys service snmpd
Starts the snmpd daemon.
Options
Tip: Use the tab completion feature to see a list of available services.
See Also
restart, stop, sys service, tmsh
stop
Stops a service that is running on the BIG-IP(r) system.
Syntax
Use the command stop within tmsh to stop a running service.
stop
/sys service [service name]
Description
You can use the command stop to stop a running service.
80
Global
Examples
stop /sys service mcpd
Stops the mcpd daemon.
stop /sys service snmpd
Stops the snmpd daemon.
Options
Tip: Use the tab completion feature to see a list of available services.
See Also
restart, start, sys service, tmsh
submit
Runs the transaction that you are creating.
Syntax
Use the submit command to run a transaction that you are creating.
submit transaction
Description
You can use the submit command to run a transaction, which is a series of commands that you enter in
transaction mode.
For more information about creating transactions, see cli transaction.
See Also
cli transaction, tmsh
time
Date and Time formats.
Syntax
Date/Time Syntax
now[ [ + | - ] <integer> [ d | h | w | m ] ]
yyyy-mm-dd[ : | T ]hh:mm[:ss]
81
Traffic Management Shell (tmsh) Reference Guide
mm-dd[-yyyy][ : | T ]hh:mm[:ss]
mm/dd[/yyyy][ : | T ]hh:mm[:ss]
Date Range Syntax
now[ [ + | - ] <integer> [ d | h | w | m ] ]--now[ [ + | - ] <integer> [ d |
h | w | m ] ]
yyyy-mm-dd[ : | T ]hh:mm[:ss]--yyyy-mm-dd[ : | T ]hh:mm[:ss]
mm-dd[-yyyy][ : | T ]hh:mm[:ss]--indefinite
epoch--mm/dd[/yyyy][ : | T ]hh:mm[:ss]
now[ [ + | - ] <integer> [ d | h | w | m ] ]
Description
The date or time format is found in tmsh as an attribute or parameter for many conguration items. Below
are the various formats supported for both Date / Time and Date Range. Please see the examples for further
assistance in using the required formats.
Date:Time Formats
• nowX
This date format starts with now (the current time) and is optionally followed by + or - some time span.
The format will look like the following: now[ [ + | - ] integer [ d | h | w | m ] ], where the user picks
either before (-) or after (+) the current time and then species integer number of minutes (m), hours
(h), days (d) or weeks (w). This format is case-insensitive.
• Examples:
Input Date Description
now-3d 3 days ago.
now+3h 3 hours from now.
now-3m 3 minutes ago.
now+3w 3 weeks from now.
• yyyy-mm-dd:hh:mm:ss
This format requires a year, month, day separated by - characters. A time is also required, which is
specied as hour: minute: second, where the seconds are optional. The date and time must be separated
by a : colon. Note: This is the default time format for output from tmsh.
• Examples:
Input Date Description
2013-05-29:13:30 May 29th, 2013 at 1:30pm.
2000-01-04:12:22:30 January 4th, 2000 at 12:22pm and 30 seconds.
• mm-dd-yyyy:hh:mm:ss
82
Global
This format requires at least a month (m) and day (d) specied and optionally a year (y). If no year is
specied, tmsh will auto-ll the year with the current year. A time is also required in the format of
hour: minute: second, where the seconds are optional.
• Examples:
Input Date Description
3-12-2015:12:01:00 March 12th, 2015 at 12:01 pm.
4-15:22:10:30 April 15th of this year at 10:10 pm and 30 seconds.
• mm/dd/yyyy:hh:mm:ss
This format requires at least a month (m) and day (d) specied and optionally a year (y). If no year is
specied, tmsh will auto-ll the year with the current year. A time is also required in the format of
hour: minute: second, where the seconds are optional.
• Examples:
Input Date Description
3/12/2015:12:01:00 March 12th, 2015 at 12:01 pm.
4/15:22:10:30 April 15th of this year at 10:10 pm and 30 seconds.
• T Delimiter
Any of the above time formats may optionally use a capital letter T (as in the word Time) to separate
the date from the time, instead of using a colon (:).
• Examples:
Input Date Description
9/16/2005T12:01:01 September 16th, 2005 at 12:01pm and 1 second.
2011-11-12T00:03:30 November 12th, 2011 at 12:03am and 30 seconds.
• Special Dates
There are two special dates that may be used in tmsh. They are indenite and epoch. Below is an
explanation of those dates.
• indenite
The date will be marked as being innitely in the future (end of time).
• epoch
The date will be marked as being innitely in the past (beginning of time).
83
Traffic Management Shell (tmsh) Reference Guide
Date Ranges
• DateX--DateZ
A Date Range is 2 dates in a valid Date Format separated by a -- (double hyphen). The dates may be
any of the Date Formats specied above. See examples below on how to use this notation.
• Examples:
Input Date Description
now-2d--now-4d 2 to 4 days ago.
now--now-3m From 3 minutes ago to now.
epoch--3/12/2011:12:00:00 Everything older than March 12th, 2011 at
noon.
2008-03-12--indefinite Everything after midnight on March 12th, 2008.
• DateX
When specifying a date range, the second date may be left out. This will cause the system to assume the
second date in the range to be now. Using this format for a date range may make it confusing when
using the NowX date format listed above. The following examples will help clarify how to use this
format with any supported Date Format.
• Examples:
Input Date Description
now-3d From 3 days ago to now.
now+3w From now to 3 weeks from now.
epoch Everything before the current date and time.
indefinite Everything after the current date and time.
See Also
tmsh, create, modify
tmsh
Description
You can use tmsh to congure and manage the BIG-IP system in conjunction with the Conguration utility,
which is the browser-based BIG-IP system and network management tool.
84
Global
Modules
The structure of tmsh is hierarchical and modular. The highest level is the root module, which contains
subordinate modules: auth, cli, gtm, ltm, net, sys and wom. Use the command help with no arguments to
display the module hierarchy relative to the current module.
The gtm, ltm, net, sys, and wom modules also contain subordinate modules. All modules and subordinate
modules contain components. To display the list of modules and components that are available in the current
module type Tab or ? at the tmsh prompt.
Commands operate on components. To display the list of available commands type Tab or ? at the beginning
of the command line. To display a list of components on which a command can operate type the command
followed by a space followed by Tab or ?.
The following examples illustrate how to navigate the tmsh hierarchy.
To enter a module, type the name of the module at the tmsh prompt.
(tmos)# ltm
The prompt displays the current module location.
(tmos.ltm)#
You can display the components in a module using the commands list (conguration) and show (statistics
and runtime status). The following command sequence displays the virtual server conguration of the
BIG-IP system.
(tmos.ltm)# list virtual
In the following examples, the commands list and show display information about only ltm components.
(tmos.ltm)# list
(tmos.ltm)# show
You can access any component in any module from any other module by specifying a complete path to the
component. For example, from the ltm module, the following command displays all of the properties of
the VLANs on the system. The forward slash / species that what follows is relative to the root module.
(tmos.ltm)# list /net vlan all-properties
The forward slash is optional if the root module is the current module. For example, the following command
sequences display proles.
(tmos)# list ltm profile
(tmos)# list /ltm profile
(tmos)# list / ltm profile
85
Traffic Management Shell (tmsh) Reference Guide
Most components also support component mode. You can navigate to a single component and run commands
to manage that component. For example, from the ltm module, to navigate to the node component, use the
following command.
(tmos.ltm)# node
To display the properties of all nodes, use the following command.
(tmos.ltm.node)# list
You can also navigate to a specic object (object mode). For example, from the node component, to enter
object mode for a specic node, enter the command modify followed by the IP address of the node.
(tmos.ltm.node)# modify 10.1.1.10
In object mode, you can congure property settings directly. For example, to set the connection limit for
10.1.1.10 to 10000, use the following command.
(tmos.ltm.node.10.1.1.10)# connection-limit 10000
To exit a module enter the command exit at the tmsh prompt, as shown below.
(tmos.ltm)# exit
(tmos)#
Product Provisioning
You must provision a BIG-IP system module before you can use tmsh to congure that product, for example,
the Global Trafc Manager. The command sequence list sys provision displays the BIG-IP system modules
that can be provisioned. For more information about provisioning, see the TMOS(r) Management Guide
for BIG-IP Systems and help sys provision.
Loading/Saving The System Configuration
The system applies all conguration changes that you make from within tmsh to the running conguration
of the system.
You can save a portion of the running conguration known as the base conguration. You can also load
the base conguration from the stored conguration les.
• To save the base conguration to the stored conguration les, use the command sequence: save sys
base-cong.
• To replace the running base conguration with the conguration in the stored conguration les, use
the command sequence: load /sys base-cong.
Additionally, you can save the entire running conguration or load all of the stored conguration les.
• To save the entire running conguration to the stored conguration les, use the command sequence:
save /sys cong.
86
Global
• To replace the entire running conguration with the conguration in the stored conguration les using
the command sequence: load /sys cong.
Help
tmsh tmsh includes man pages for each of the commands and components that are available within tmsh.
You access the man pages using the following command syntax: help [ [command] | [full path to
component] ].
For example, to access the man page for the vlan component from the root module, use this command
sequence: help / net vlan.
You can also search the man pages for information on a specic topic. To do this you use the command
syntax: help search [topic]. You can perform a help search from within any module in the tmsh hierarchy.
For example, to nd the man pages that contain a reference to VLANs, use this command sequence: help
search vlan
To display a list of topics that are available in a module use this command sequence: help [full path to
module].
For example, to display the topics that are available in the current module use this command: help. To
display the topics that are available in the net module use this command sequence: help / net.
Context-Sensitive Help
tmsh includes a context-sensitive help feature that provides help as you type commands. At any time, you
can type a question mark (?) on the command line, and tmsh returns information to assist you in completing
the command. Based on when you type the question mark, you get the following results.
• When you type a question mark immediately following any portion of a command, tmsh returns possible
completions for the command, but does not complete the command as the command completion feature
does.
• When you type a space before the question mark, tmsh returns descriptive text that explains the
commands, components, or properties that you can congure.
• When you type a question mark in the middle of a command, tmsh returns help on the command to the
left of the cursor.
Note: To use a question mark in a Glob or regular expression, you must escape the question mark using
quotation marks, apostrophes, or a backslash.
Additionally, you can request context-sensitive help for the last command in a series of commands. For
more information, see ENTERING MULTIPLE COMMANDS, following.
Command Completion
At any point while typing or editing a command in tmsh, you can press the Tab key. tmsh either completes
the current or next word, or displays possible completions for the current or next word. If tmsh displays
nothing after you press the Tab key, no options exist to complete the word. If you move the cursor anywhere
on the command line and press the Tab key, tmsh completes what is to the left of the cursor.
Command completion also reduces the amount of typing that is required to run commands. When you press
the Tab key, the system automatically completes the current command-line element to as many unique
characters as possible. If there is more than one possible completion the list of possible completions displays.
Command completion also completes conguration object identiers.
87
Traffic Management Shell (tmsh) Reference Guide
Entering Multiple Commands
You can enter multiple commands on the command line by separating the commands with semi-colons (;).
For example, to display the properties of the self IP addresses and VLANs of the system, use this command
sequence:
list / net self ; list / net vlan
When you enter multiple commands in this way, all of the commands are added to the command history in
a single line item, regardless of whether any of the commands were successful. However, if one of the
commands that you enter fails to parse, tmsh does not run the remaining commands you entered. tmsh audits
commands as the commands run; therefore, if a command fails to parse, tmsh does not audit the remaining
commands. For more information about the command history, see COMMAND HISTORY, following.
You can also specify multiple commands in a command alias by separating the commands with semi-colons.
For example, to create an alias that displays the properties of the VLANs and VLAN groups on the system,
use this command sequence:
create / cli alias vlans command "list / net vlan ; list / net vlan-group"
You can request context-sensitive help and utilize the command completion feature on the last command
in a series of commands. For example, the following command sequence displays help for the vlan-group
component.
list / net vlan ; list / net vlan-group ?
Command History
tmsh saves in the command history le each command that you enter. The command history persists when
you log off of the system. The next time you log on to the system, you can search for, display, and then
edit, the tmsh commands that you entered in previous sessions. The command history persists even through
a restart of the BIG-IP system. For more information about the command history feature, see help history.
The following examples show how to use the command history feature.
To display the commands in the history list, enter either the command sequence show history or an
exclamation point (!). tmsh displays a list of commands each preceded by a numeric ID.
To run a command from the history list, enter an exclamation point followed by the numeric ID of the
command.
To run the previous command, enter !!.
Filtering Output
You can lter the output generated by the commands list (conguration settings) and show (statistics and
runtime status) using the UNIX grep utility. You must type the character | before the grep specication.
You can use multiple lters chained together.
The following examples show how to use the grep utility in tmsh.
list ltm node | grep "^10\.2"
list ltm virtual | grep -i seattle
list ltm virtual | grep -i abc | grep -i ab | grep -i a
88
Global
Keyboard Bindings
tmsh supports vi, emacs and default keyboard bindings. You can set the binding using the keymap preference.
For more information, see help cli preference.
Note that all mappings provide command-line editing and the capability to search the command history.
Wildcard Object Identifiers
You can specify conguration object identiers using glob and regular expression syntax.
For glob and regular expression syntax rules, see help glob and help regex. Note that you can escape the
glob and regular expression special characters using a back slash.
The following examples show how to use glob and regular expressions in tmsh.
Uses a glob expression to display the conguration of all nodes that begin with 10.1..
list ltm node 10.1.*
Uses a regular expression to display the conguration of all nodes that begin with 10. and contain .44.. Note
that a regular expression must begin with an @ symbol. This identies to tmsh that the identier should
be treated as a regular expression and not a glob or standard object identier. The leading @ is not part of
the regular expression.
list ltm node @^10\..*\.44\.
Preferences
You can customize the behavior of tmsh. For more information, see help cli preference.
Files
tmsh manages several les in a user's home directory.
• $HOME/.tmsh-history-<user> contains command history.
Statistics
You can use tmsh to display statistics, including historical performance statistics. You can select the format
in which the statistics display, as well as reset the statistics for some of the tmsh components. To determine
if statistics are available for a component, see the man page for the specic component.
The following examples show how to display and reset statistics for the net interface component from the
root module.
show net interface
reset-stats net interface
The following examples show how to display and reset statistics for the net interface component from the
net module.
show interface
reset-stats interface
89
Traffic Management Shell (tmsh) Reference Guide
Automating Tmsh
You can use tmsh to build TCL scripts to automate management of the BIG-IP. See the cli script help page.
Command Line Options
The following options can be specied when tmsh is started from the system shell.
• -a
tmsh does not write commands to the command history le.
Note that if auditing is enabled, tmsh continues to write commands to the audit log. This option is useful
when writing scripts from the system shell, because it stops the scripts from lling up the command
history le. This option applies to the non-interactive mode only.
• -c
Run the specied command. A command that contains multiple arguments must be in quotes. No other
options may be specied after -c
• -d [ip address | host name]
Connects to the specied blade in a clustered system.
• -e
Disables video highlighting in tmsh.
• -h
Displays options you can use when accessing tmsh from the system shell.
• -m
Generates a tmsh debug log named tmsh.out in the current directory.
Note that when you run a tmsh script, the shell generates a debug log le for the script named
tmsh.out.[script name].
Using this option causes tmsh to run signicantly slower.
• -q
Prevents tmsh from responding to user actions with questions. This option is useful when writing
non-interactive shell scripts from the system shell.
• -r <version>
This option allows the user to run TMSH the specied version. This is used to provide backwards
compatibility for older TMSH syntax only. The version must be specied in the format maj.min.pt,
for example 11.5.0
See Also
Detailed information on the following topics is available through the help command: cli preference, cli
script, glob, help, regex, and sys provision.
90
Global
Analytics
report
Displays an HTTP/L7-DoS analytics report.
Syntax
Show, save or send an analytics report using the syntax shown in the following sections.
Display
show report view-by [ application | virtual | pool-member | url |
client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | dosl7-profile | transaction-outcome
|
dosl7-bot-signature | dosl7-bot-signature-category ]
drilldown {
{
entity [ application | virtual | pool-member | url |
client-ip | country | response-code | method |
user-agent | client-subnet | dosl7-attack-id |
dosl7-profile | transaction-outcome | dosl7-bot-signature |
dosl7-bot-signature-category ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | virtual | pool-member | url |
client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | dosl7-profile | transaction-outcome
|
dosl7-bot-signature | dosl7-bot-signature-category ]
drilldown {
{
entity [ application | virtual | pool-member | url |
client-ip | country | response-code | method |
user-agent | client-subnet | dosl7-attack-id |
dosl7-profile | transaction-outcome | dosl7-bot-signature |
dosl7-bot-signature-category ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | virtual | pool-member |
url | client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | dosl7-profile | transaction-outcome
|
dosl7-bot-signature | dosl7-bot-signature-category
]
drilldown {
{
entity [ application | virtual | pool-member | url | client-ip |
country | response-code | method | user-agent | client-subnet
|
dosl7-attack-id | dosl7-profile | transaction-outcome |
dosl7-bot-signature | dosl7-bot-signature-category ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
92
Analytics
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate HTTP analytics reports. You can generate an HTTP analytics report for the
following entities:
• application - Application services.
• virtual - Virtual servers.
• pool-member - Pool members.
• url - A URL accessed by HTTP or HTTPs.
• client-ip - A single client identied by an IP address.
• country - A country from which HTTP/HTTPs trafc was sent to each of the virtual servers.
• response-code - An HTTP response code that was sent back to the client.
• method - An HTTP method used by the client (GET, CREATE, POST, DELETE, etc.).
• user-agent - A browser identier sent by the client's browser as part of the request for URL.
• subnet - Client IP addresses classied into subnets.
• dosl7-attack-id - Application/L7 DoS Attack ID.
• dosl7-prole - DoS Layer 7 (Application) Prole.
• transaction-outcome - Transaction outcomes (Blocked/Dropped/Passthrough/etc.)
• dosl7-bot-signature - DoS Layer 7 bot signature.
• dosl7-bot-signature-category - DoS Layer 7 bot category.
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics report view-by virtual measures {average-tps} limit 20
Gets the average tps of 20 virtual servers (unordered).
show analytics report view-by virtual measures {average-tps} limit 20 order-by { { measure average-tps
sort-type desc } }
Gets the average tps of the top 20 virtual servers.
show analytics report view-by virtual measures {average-tps} limit 20 order-by { { measure average-tps
sort-type desc } } range now-3d--now
Gets the average tps of the top 20 virtual servers from the last three days.
show analytics report view-by virtual drilldown { { entity application values { app } } { entity
pool-member values { p1 p2 } } } range now-4d--now-2d measures {average-tps} limit 10 order-by {
{ measure average-tps sort-type DESC } }
Gets the average tps of the top 10 virtual servers (ordered by average tps) on app iApp (out of several
monitored) on pool members p1 and p2 (out of ve monitored p1-p5) in the interval ranging from two to
four days ago.
show analytics report view-by response-code drilldown { { entity virtual values { v1 } } } measures {
transactions }
Gets a distribution of requests per response code on virtual v1.
93
Traffic Management Shell (tmsh) Reference Guide
show analytics report view-by country drilldown { { entity application values { app } } } measures {
average-concurrent-sessions average-sessions } order-by { { measure average-sessions sort-type DESC
} } limit 5
Gets the new sessions and average concurrent sessions of the top ve countries, ordered by the average
concurrent sessions on the application app.
show analytics report view-by client-ip drilldown { { entity virtual values { v1 } } } measures {
max-page-load-time } limit 1
Gets the client IP address with the worst page load time.
show analytics report view-by application drilldown { { entity pool-member values { p1 p2 } } }
measures { transactions } order-by { { measure transactions } } range now-7d--now
Gets the distribution of requests per application on pool members p1 and p2 ordered by the number of
requests during the last week.
save analytics report view-by virtual measures {average-tps} limit 20 order-by { { measure average-tps
sort-type desc } } format pdf le report.pdf
Gets the average tps of the top 20 virtual servers and exports to a PDF le on the BIG-IP system.
save analytics report view-by virtual measures {average-tps} limit 20 order-by { { measure average-tps
sort-type desc } } format csv-aggregated le report.csv
Gets the average tps of the top 20 virtual servers and exports to a CSV le on the BIG-IP system.
save analytics report view-by virtual measures {average-tps} limit 20 order-by { { measure average-tps
sort-type desc } } format csv-time-series le report.csv
Gets the average tps over time of the top 10 virtual servers and exports to a CSV le on the BIG-IP system.
send-mail analytics report view-by virtual measures {average-tps} limit 20 order-by { { measure
Gets the average tps over time of the top 10 virtual servers and sends out an email containing the report as
a PDF.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
94
Analytics
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The default value is transactions.
The options are:
• average-concurrent-sessions
The average number of concurrent sessions for each entity.
• average-new-sessions
The average number of new sessions for each entity.
• average-page-load-time
The average client page load time for each entity.
• average-request-throughput
The average request throughput for each entity.
• average-response-throughput
The average response throughput for each entity.
• average-server-latency
The average server latency for each entity.
• average-tps
The average number of transactions per second for each entity.
• client-side-sampled-transactions
The number of transactions sampled for client side page load time.
• max-page-load-time
The maximum client page load time for each entity.
• max-request-throughput
The maximum request throughput for each entity.
• max-response-throughput
The maximum response throughput for each entity.
• max-server-latency
The maximum server latency for each entity.
• max-tps
The maximum number of transactions per second for each entity.
• transactions
The absolute number of transactions for each entity.
• order-by
95
Traffic Management Shell (tmsh) Reference Guide
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The default value for measures is previously chosen measures. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics http report
96
Analytics
Analytics Application Security
report
Displays an application-security analytics report.
Syntax
Show, save or send an analytics application-security report using the syntax shown in the following
sections.
Display
show report view-by [ application | virtual | request-type | severity | rating
| username | attack-type | ip-address-intelligence | policy
response-code | ip | violation | country | method |
protocol | session-id | url | virus ]
drilldown {
{
entity [ application | virtual | request-type | severity | rating |
username | attack-type | ip-address-intelligence | policy
response-code | ip | violation | country | method | protocol
| session-id | url | virus ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | virtual | request-type | severity | rating
| username | attack-type | ip-address-intelligence | policy
response-code | ip | violation | country | method |
protocol | session-id | url | virus ]
drilldown {
{
entity [ application | virtual | request-type | severity | rating |
username | attack-type | ip-address-intelligence | policy
response-code | ip | violation | country | method | protocol
| session-id | url | virus ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | virtual | request-type | severity |
rating | username | attack-type | ip-address-intelligence | policy
response-code | ip | violation | country | method
| protocol | session-id | url | virus ]
drilldown {
{
entity [ application | virtual | request-type | severity | rating |
username | attack-type | ip-address-intelligence | policy
response-code | ip | violation | country | method | protocol
| session-id | url | virus ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate application-security analytics reports. You can generate an application-security
analytics report for the following entities:
98
Analytics Application Security
• application - Application services.
• virtual - Virtual servers.
• request-type - Request types (Legal/Alarmed/Blocked).
• severity - Violation severities.
• rating - Violation ratings.
• username - User names.
• attack-type - Attack type of the illegal request.
• ip-address-intelligence - IP Address reputation categories.
• policy - Security policy.
• response-code - Response codes.
• ip - Source IP addresses.
• violation - Violation types.
• country - Countries of the source IP address.
• method - HTTP methods.
• protocol - Protocols (HTTP/HTTPS).
• session-id - IDs of sessions.
• url - Requested URLs.
• virus - Viruses that were detected by the system.
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics application-security report view-by violation
show analytics application-security report view-by violation drilldown { { entity severity values {
Error } } }
send-mail analytics application-security report view-by ip measures {requests} limit 20 order-by { {
For more syntactical examples see manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
99
Traffic Management Shell (tmsh) Reference Guide
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• requests
The total number of requests for the selected lter (entity).
• occurrences
Number of occurrences for the selected lter (relevant for attack-type, violation and
ip-address-intelligence entities)
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
scheduled-report
Congure scheduled reports for application security (ASM).
Syntax
Congure the scheduled-report component within the analytics application-security module using the
syntax shown in the following sections.
100
Analytics Application Security
Create/Modify
create scheduled-report [name]
modify scheduled-report [name]
email-addresses [none | add | delete | modify |
replace-all-with] { email-address [string] }
first-time [date]
frequency [every-6-hours | every-12-hours | every-24-hours | every-week
| every-month]
include-total [enabled | disabled]
multi-leveled-report {
chart-path [none | add | delete | modify | replace-all-with] { entity
name [string] }
limit [number of rows]
time-diff [last-hour | last-day | last-week | last-month | last-year]
view-by { entity name [string] }
}
predefined-report-name [name]
smtp-config [name]
Display
list scheduled-report
list scheduled-report [ [ [name] | [glob] | [regex] ] ... ]
show running-config scheduled-report
show running-config scheduled-report [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete scheduled-report [name]
Description
Use the scheduled-report component to create, modify or delete scheduled reports for the application
security module.
Examples
create scheduled-report myScheduledReport rst-time now predened-report-name "Top blocked
asm_smtp_conf
Creates a scheduled report, starting from the next hour and executing every 6 hours. The report contains a
conguration dened in asm_smtp_conf.
modify scheduled-report myScheduledReport smtp-cong none
Set smtp conguration of the scheduled report "myScheduledReport" to none, thus effectively disabling
the scheduled report from begin generated and sent over eMail.
create scheduled-report myCustomScheduledReport rst-time now email-addresses add {
view-by url time-diff last-hour limit 5 chart-path add { policy violation } }
101
Traffic Management Shell (tmsh) Reference Guide
Creates a scheduled report, starting from the next hour and executing every 6 hours. The report contains a
PDF showing statistics for the top 5 violated URLs after drilling-down to the top policy followed by the
top violation. The report is sent to [email protected] using the smtp conguration dened in asm_smtp_conf.
list scheduled-report
Displays all of the application security scheduled reports.
Options
• email-addresses
A list of the email addresses of the recipients that receive the scheduled report.
• rst-time
First scheduled report time. Must be after current time and rounded up to the next round hour.
• frequency
The scheduled report frequency. Example: every-6-hours means that the report will be generated and
sent every 6 hours.
• include-total
Enables or disables including a summary (Overall result) entity in results.
• multi-leveled-report
Denes a custom multi-leveled report. Mutually exclusive with predened-report-name. The
multi-leveled-report denition contains the following parameters:
• chart-path
A list of entities that dene the scope in which the report will be displayed. For example: a chart
path { violation url } means: Use the top violation list and generate a top URL list from it. These top
URLs will be then used to display the view-by entity. For a list of valid entities see the help manual
for analytics application-security report.
• limit
The number of view-by entities displayed in the scheduled report.
• time-diff
The time range for the report.
• view-by
The main entity that the report is viewed by. For a list of valid entities see the help manual for
analytics application-security report.
• predened-report-name
Denes which predened report (AKA predened lter) will be used to generate the report. This keyword
is mutually exclusive with multi-leveled-report.
• smtp-cong
Denes which SMTP conguration will be used to send the scheduled report. If set to none, the scheduled
report will be disabled.
See Also
list, modify, show, tmsh, analytics application-security report, sys smtp-server
102
Analytics Application Security
Analytics Application Security Anomalies
report
Displays an application-security-anomalies analytics report.
Syntax
Show, save or send an analytics application-security-anomalies report using the syntax shown in the
following sections.
Display
show report view-by [ anomaly-type | application | policy | virtual ]
drilldown {
{
entity [ anomaly-type | application | policy | virtual ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ anomaly-type | application | policy | virtual ]
drilldown {
{
entity [ anomaly-type | application | policy | virtual ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ anomaly-type | application | policy | virtual ]
drilldown {
{
entity [ anomaly-type | application | policy | virtual ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate application-security-anomalies analytics reports. You can generate an
application-security-network analytics report for the following entities:
• anomaly-type - Anomaly type (Brute Force/Web Scraping)
• application - Application services.
• policy - Security policy.
• virtual - Virtual servers.
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics application-security-network report view-by application
show analytics application-security-network report view-by application drilldown { { entity virtual
values { my_vip } } }
104
Analytics Application Security Anomalies
send-mail analytics application-security-anomalies report view-by virtual measures { rejected-requests
} limit 20 order-by { { measure rejected-requests sort-type desc } } format pdf email-addresses {
For more syntactical examples, see the tmsh help manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• rejected-requests
The total number of rejected requests for the selected lter (entity).
• total-attacks
The total number of attacks for the selected lter (entity).
• total-violations
The total number of violations for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
105
Traffic Management Shell (tmsh) Reference Guide
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
106
Analytics Application Security Anomalies
Analytics Application Security Network
report
Displays an application-security-network analytics report.
Syntax
Show, save or send an analytics application-security report using the syntax shown in the following
sections.
Display
show report view-by [ application | virtual | request-type | policy ]
drilldown {
{
entity [ application | virtual | request-type | policy ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | virtual | request-type | policy ]
drilldown {
{
entity [ application | virtual | request-type | policy ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | virtual | request-type | policy ]
drilldown {
{
entity [ application | virtual | request-type | policy ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate application-security-network analytics reports. You can generate an
application-security-network analytics report for the following entities:
• application - Application services.
• virtual - Virtual servers.
• request-type - Request types (Legal/Alarmed/Blocked).
• policy - Security policy.
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics application-security-network report view-by violation
show analytics application-security-network report view-by violation drilldown { { entity severity
values { Error } } }
108
Analytics Application Security Network
send-mail analytics application-security-network report view-by virtual measures {events} limit 20
}
For more syntactical examples see manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• events
The total number of events (requests) for the selected lter (entity).
• throughput
The average throughput (bits/s) for the selected lter (entity).
• tps
The average number of transactions per second for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
109
Traffic Management Shell (tmsh) Reference Guide
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
110
Analytics Application Security Network
Analytics ASM Bypass
report
Displays an asm-bypass analytics report.
Syntax
Show, save or send an analytics asm-bypass report using the syntax shown in the following sections.
Display
show report view-by [ slot | memory ]
drilldown {
{
entity [ slot | memory ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ slot | memory ]
drilldown {
{
entity [ slot | memory ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ slot | memory ]
drilldown {
{
entity [ slot | memory ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate asm-bypass analytics reports. You can generate an asm-bypass analytics
report for the following entities:
• slot - Blade Number
• memory - BD memory
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics asm-bypass report view-by slot
show analytics asm-bypass report view-by slot drilldown { { entity slot values { slot_index } } }
end-mail analytics asm-bypass report view-by slot measures { backlog-messages } limit 20 order-by
{ { measure backlog-messages sort-type desc } } format pdf email-addresses {
For more syntactical examples, see the tmsh help manual for analytics report.
112
Analytics ASM Bypass
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• backlog-messages
The sum of backlog messages for the selected lter (entity).
• http-requests
The sum of HTTP requests for the selected lter (entity).
• transactions-bypass
The sum of transactions bypass for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
113
Traffic Management Shell (tmsh) Reference Guide
Analytics ASM CPU
report
Displays an asm-cpu analytics report.
Syntax
Show, save or send an analytics asm-cpu report using the syntax shown in the following sections.
Display
show report view-by [ virtual | slot ]
drilldown {
{
entity [ virtual | slot ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ virtual | slot ]
drilldown {
{
entity [ virtual | slot ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ virtual | slot ]
drilldown {
{
entity [ virtual | slot ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate asm-cpu analytics reports. You can generate an asm-cpu analytics report for
the following entities:
• virtual - Virtual servers.
• slot - Blade Number
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics asm-cpu report view-by slot
show analytics asm-cpu report view-by slot drilldown { { entity slot values { slot_index } } }
send-mail analytics asm-cpu report view-by slot measures { bd-cpu-utilization } limit 20 order-by {
{ measure bd-cpu-utilization sort-type desc } } format pdf email-addresses {
For more syntactical examples, see the tmsh help manual for analytics report.
116
Analytics ASM CPU
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• bd-cpu-utilization
The BD CPU utilization for the selected lter (entity).
• tmm-cpu-utilization
The TMM CPU utilization for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
117
Traffic Management Shell (tmsh) Reference Guide
Analytics ASM Memory
report
Displays an asm-memory analytics report.
Syntax
Show, save or send an analytics asm-memory report using the syntax shown in the following sections.
Display
show report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate asm-memory analytics reports. You can generate a ASM memory analytics
report for the following entities:
• slot - Slot ID
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics asm-memory report view-by slot
show analytics asm-memory report view-by slot drilldown { { entity slot values { slot_index } } }
send-mail analytics asm-memory report view-by slot measures { total-swap-size } limit 20 order-by
}
For more syntactical examples, see the tmsh help manual for analytics report.
120
Analytics ASM Memory
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• bd-memory-utilization
The BD memory utilization out of total assigned to BD (in percents) for the selected lter (entity).
• tmm-memory-util
The TMM memory utilization out of total assigned to TMM (in percents) for the selected lter
(entity).
• bd-swap-size
The swap used by BD in MBs for the selected lter (entity).
• total-swap-size
The total swap used in MBs for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
121
Traffic Management Shell (tmsh) Reference Guide
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
122
Analytics ASM Memory
Analytics CPU
report
Displays an cpu analytics report.
Syntax
Show, save or send an analytics cpu report using the syntax shown in the following sections.
Display
show report view-by [ slot | cpu ]
drilldown {
{
entity [ slot | cpu ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ slot | cpu ]
drilldown {
{
entity [ slot | cpu ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ slot | cpu ]
drilldown {
{
entity [ slot | cpu ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate cpu analytics reports. You can generate a IP-layer analytics report for the
following entities:
• slot - Slot ID
• cpu - CPU number ID
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics cpu report view-by cpu
show analytics cpu report view-by cpu drilldown { { entity cpu values { 1 } } }
send-mail analytics cpu report view-by slot measures { cpu-usage } limit 20 order-by { { measure
For more syntactical examples, see the tmsh help manual for analytics report.
124
Analytics CPU
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• cpu-usage
The average time percentage of real CPU usage (user + system + nice) usage for the selected lter
(entity).
• io
The average time percentage of (iowait + irq + softirq) for the selected lter (entity).
• stolen
The average time percentage of virtual CPU waits for a real CPU while the hypervisor is servicing
another virtual processor.
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
125
Traffic Management Shell (tmsh) Reference Guide
Analytics Disk Info
report
Displays an disk-info analytics report.
Syntax
Show, save or send an analytics disk-info report using the syntax shown in the following sections.
Display
show report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate disk-info analytics reports. You can generate a disk-info analytics report for
the following entities:
• slot - Slot ID
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics disk-info report view-by slot
show analytics disk-info report view-by slot drilldown { { entity slot values { 7 } } }
send-mail analytics disk-info report view-by slot measures { total-ios } limit 20 order-by { { measure
For more syntactical examples, see the tmsh help manual for analytics report.
128
Analytics Disk Info
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• total-ios
The total number of I/O for the selected lter (entity).
• read-operations
The total number of read operations for the selected lter (entity).
• read-merged
The total number of merged reads for the selected lter (entity).
• write-operations
The total number of write operations for the selected lter (entity).
• write-merged
The total number of merged writes for the selected lter (entity).
• read-bytes
The total number of read bytes for the selected lter (entity).
• write-bytes
The total number of write bytes for the selected lter (entity).
129
Traffic Management Shell (tmsh) Reference Guide
• max-read-latency
The max value of read latency for the selected lter (entity).
• average-read-latency
The average number of average read latency for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
130
Analytics Disk Info
Analytics DNS
report
Displays a DNS analytics report.
Syntax
Show, save or send an analytics dns report using the syntax shown in the following sections.
Display
show report view-by [ application | client-ip | domain-name | query-type |
virtual | attack-id | transaction-outcome ]
drilldown {
{
entity [ application | client-ip | domain-name | query-type | virtual
| attack-id | transaction-outcome ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Save
save report view-by [ application | client-ip | domain-name | query-type |
virtual | attack-id | transaction-outcome ]
drilldown {
{
entity [ application | client-ip | domain-name | query-type | virtual
| attack-id | transaction-outcome ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | client-ip | domain-name | query-type
| virtual | attack-id | transaction-outcome ]
drilldown {
{
entity [ application | client-ip | domain-name | query-type | virtual
| attack-id | transaction-outcome ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate DNS analytics reports. You can generate a DNS analytics report for the
following entities:
• application - Application services (iApps(tm)).
• client-ip - DNS query source/client IP address.
• domain-name - Queried domain name.
• query-type - DNS query type.
• virtual - Virtual server.
• attack-id - (Only available with AFM is provisioned) DoS Attack ID.
• transaction-outcome - Request outcome.
132
Analytics DNS
Examples
show analytics dns report view-by virtual
show analytics dns report view-by query-type drilldown { { entity virtual values { /Common/v1 } } }
send-mail analytics dns report view-by client-ip limit 20 format pdf email-addresses {
For more syntactical examples see manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• packets
The total number of DNS packets for the specied view-by entity.
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
133
Traffic Management Shell (tmsh) Reference Guide
Analytics DOS L3
report
Displays a DoS (Layers 3-4) prevention analytics report.
Syntax
Show, save or send an analytics dos-l3 report using the syntax shown in the following sections.
Display
show report view-by [ action | application | attack-id | attack-type | category
| source-ip | virtual | vlan | vlan-group ]
drilldown {
{
entity [ action | application | attack-id | attack-type | category |
source-ip | virtual | vlan | vlan-group ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Save
save report view-by [ action | application | attack-id | attack-type | category
| source-ip | virtual | vlan | vlan-group ]
drilldown {
{
entity [ action | application | attack-id | attack-type | category |
source-ip | virtual | vlan | vlan-group ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ action | application | attack-id | attack-type |
category | source-ip | virtual | vlan | vlan-group ]
drilldown {
{
entity [ application | action | application | attack-id | attack-type
| category | source-ip | virtual | vlan | vlan-group ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate DoS (Layers 3-4) prevention analytics reports. You can generate a DoS
prevention analytics report for the following entities:
• action - Action taken (allowed/dropped).
• application - Application services (iApps(tm)).
• attack-id - DoS attack ID.
• attack-type - DoS attack type.
• category - Attack category.
• source-ip - Source/client IP address.
• virtual - Virtual server.
136
Analytics DOS L3
• vlan - VLAN.
• vlan-group - VLAN Group.
Examples
show analytics dos-l3 report view-by virtual
show analytics dos-l3 report view-by attack-type drilldown { { entity virtual values { /Common/v1 }
} }
send-mail analytics dos-l3 report view-by source-ip limit 20 format pdf email-addresses {
For more syntactical examples see manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• allowed-requests
The total number of packets that were received by the virtual server(/s)s
• dropped-requests
The total number of packets that were dropped by the virtual server(/s)s
• total-requests
137
Traffic Management Shell (tmsh) Reference Guide
The total number of packets that were received or dropped by the virtual server(/s)s
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, analytics, analytics report
138
Analytics DOS L3
Analytics DOS L7
report
Displays an HTTP/L7-DoS analytics report.
Syntax
Show, save or send an analytics dos-l7 report using the syntax shown in the following sections.
Display
show report view-by [ application | virtual | pool-member | url |
client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | profile | transaction-outcome ]
drilldown {
{
entity [ application | virtual | pool-member | url |
client-ip | country | response-code | method |
user-agent | client-subnet | dosl7-attack-id |
profile | transaction-outcome ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | virtual | pool-member | url |
client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | profile | transaction-outcome ]
drilldown {
{
entity [ application | virtual | pool-member | url |
client-ip | country | response-code | method |
user-agent | client-subnet | dosl7-attack-id |
profile | transaction-outcome ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | virtual | pool-member |
url | client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | profile | transaction-outcome ]
drilldown {
{
entity [ application | virtual | pool-member | url | client-ip |
country | response-code | method | user-agent | client-subnet
|
dosl7-attack-id | profile | transaction-outcome ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate HTTP analytics reports. You can generate an HTTP analytics report for the
following entities:
• application - Application services.
140
Analytics DOS L7
• virtual - Virtual servers.
• pool-member - Pool members.
• url - A URL accessed by HTTP or HTTPs.
• client-ip - A single client identied by an IP address.
• country - A country from which HTTP/HTTPs trafc was sent to each of the virtual servers.
• response-code - An HTTP response code that was sent back to the client.
• method - An HTTP method used by the client (GET, CREATE, POST, DELETE, etc.).
• user-agent - A browser identier sent by the client's browser as part of the request for URL.
• subnet - Client IP addresses classied into subnets.
• dosl7-attack-id - Application/L7 DoS Attack ID.
• prole - DoS Layer 7 (Application) Prole.
• transaction-outcome - Transaction outcomes (Blocked/Dropped/Passthrough/etc.)
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics http report view-by virtual measures {average-tps} limit 20
Gets the average tps of 20 virtual servers (unordered).
show analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } }
Gets the average tps of the top 20 virtual servers.
show analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } range now-3d--now
Gets the average tps of the top 20 virtual servers from the last three days.
show analytics http report view-by virtual drilldown { { entity application values { app } } { entity
pool-member values { p1 p2 } } } range now-4d--now-2d measures {average-tps} limit 10 order-by {
{ measure average-tps sort-type DESC } }
Gets the average tps of the top 10 virtual servers (ordered by average tps) on app iApp (out of several
monitored) on pool members p1 and p2 (out of ve monitored p1-p5) in the interval ranging from two to
four days ago.
show analytics http report view-by response-code drilldown { { entity virtual values { v1 } } } measures
{ transactions }
Gets a distribution of requests per response code on virtual v1.
show analytics http report view-by country drilldown { { entity application values { app } } } measures
{ average-concurrent-sessions average-sessions } order-by { { measure average-sessions sort-type
DESC } } limit 5
Gets the new sessions and average concurrent sessions of the top ve countries, ordered by the average
concurrent sessions on the application app.
show analytics http report view-by client-ip drilldown { { entity virtual values { v1 } } } measures {
max-page-load-time } limit 1
Gets the client IP address with the worst page load time.
show analytics http report view-by application drilldown { { entity pool-member values { p1 p2 } } }
measures { transactions } order-by { { measure transactions } } range now-7d--now
141
Traffic Management Shell (tmsh) Reference Guide
Gets the distribution of requests per application on pool members p1 and p2 ordered by the number of
requests during the last week.
save analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } format pdf le report.pdf
Gets the average tps of the top 20 virtual servers and exports to a PDF le on the BIG-IP system.
save analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } format csv-aggregated le report.csv
Gets the average tps of the top 20 virtual servers and exports to a CSV le on the BIG-IP system.
save analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } format csv-time-series le report.csv
Gets the average tps over time of the top 10 virtual servers and exports to a CSV le on the BIG-IP system.
send-mail analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
Gets the average tps over time of the top 10 virtual servers and sends out an email containing the report as
a PDF.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The default value is transactions.
The options are:
142
Analytics DOS L7
• average-concurrent-sessions
The average number of concurrent sessions for each entity.
• average-new-sessions
The average number of new sessions for each entity.
• average-page-load-time
The average client page load time for each entity.
• average-request-throughput
The average request throughput for each entity.
• average-response-throughput
The average response throughput for each entity.
• average-server-latency
The average server latency for each entity.
• average-tps
The average number of transactions per second for each entity.
• client-side-sampled-transactions
The number of transactions sampled for client side page load time.
• max-page-load-time
The maximum client page load time for each entity.
• max-request-throughput
The maximum request throughput for each entity.
• max-response-throughput
The maximum response throughput for each entity.
• max-server-latency
The maximum server latency for each entity.
• max-tps
The maximum number of transactions per second for each entity.
• transactions
The absolute number of transactions for each entity.
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The default value for measures is previously chosen measures. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
143
Traffic Management Shell (tmsh) Reference Guide
Analytics HTTP
report
Displays an HTTP/L7-DoS analytics report.
Syntax
Show, save or send an analytics http report using the syntax shown in the following sections.
Display
show report view-by [ application | virtual | pool-member | url |
client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | dosl7-profile | transaction-outcome
|
dosl7-bot-signature | dosl7-bot-signature-category ]
drilldown {
{
entity [ application | virtual | pool-member | url |
client-ip | country | response-code | method |
user-agent | client-subnet | dosl7-attack-id |
dosl7-profile | transaction-outcome | dosl7-bot-signature |
dosl7-bot-signature-category ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | virtual | pool-member | url |
client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | dosl7-profile | transaction-outcome
|
dosl7-bot-signature | dosl7-bot-signature-category ]
drilldown {
{
entity [ application | virtual | pool-member | url |
client-ip | country | response-code | method |
user-agent | client-subnet | dosl7-attack-id |
dosl7-profile | transaction-outcome | dosl7-bot-signature |
dosl7-bot-signature-category ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | virtual | pool-member |
url | client-ip | country | response-code |
method | user-agent | client-subnet |
dosl7-attack-id | dosl7-profile | transaction-outcome
|
dosl7-bot-signature | dosl7-bot-signature-category
]
drilldown {
{
entity [ application | virtual | pool-member | url | client-ip |
country | response-code | method | user-agent | client-subnet
|
dosl7-attack-id | dosl7-profile | transaction-outcome |
dosl7-bot-signature | dosl7-bot-signature-category ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
146
Analytics HTTP
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate HTTP analytics reports. You can generate an HTTP analytics report for the
following entities:
• application - Application services.
• virtual - Virtual servers.
• pool-member - Pool members.
• url - A URL accessed by HTTP or HTTPs.
• client-ip - A single client identied by an IP address.
• country - A country from which HTTP/HTTPs trafc was sent to each of the virtual servers.
• response-code - An HTTP response code that was sent back to the client.
• method - An HTTP method used by the client (GET, CREATE, POST, DELETE, etc.).
• user-agent - A browser identier sent by the client's browser as part of the request for URL.
• subnet - Client IP addresses classied into subnets.
• dosl7-attack-id - Application/L7 DoS Attack ID.
• dosl7-prole - DoS Layer 7 (Application) Prole.
• transaction-outcome - Transaction outcomes (Blocked/Dropped/Passthrough/etc.)
• dosl7-bot-signature - DoS Layer 7 bot signature.
• dosl7-bot-signature-category - DoS Layer 7 bot category.
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics http report view-by virtual measures {average-tps} limit 20
Gets the average tps of 20 virtual servers (unordered).
show analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } }
Gets the average tps of the top 20 virtual servers.
show analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } range now-3d--now
Gets the average tps of the top 20 virtual servers from the last three days.
show analytics http report view-by virtual drilldown { { entity application values { app } } { entity
pool-member values { p1 p2 } } } range now-4d--now-2d measures {average-tps} limit 10 order-by {
{ measure average-tps sort-type DESC } }
Gets the average tps of the top 10 virtual servers (ordered by average tps) on app iApp (out of several
monitored) on pool members p1 and p2 (out of ve monitored p1-p5) in the interval ranging from two to
four days ago.
show analytics http report view-by response-code drilldown { { entity virtual values { v1 } } } measures
{ transactions }
Gets a distribution of requests per response code on virtual v1.
147
Traffic Management Shell (tmsh) Reference Guide
show analytics http report view-by country drilldown { { entity application values { app } } } measures
{ average-concurrent-sessions average-sessions } order-by { { measure average-sessions sort-type
DESC } } limit 5
Gets the new sessions and average concurrent sessions of the top ve countries, ordered by the average
concurrent sessions on the application app.
show analytics http report view-by client-ip drilldown { { entity virtual values { v1 } } } measures {
max-page-load-time } limit 1
Gets the client IP address with the worst page load time.
show analytics http report view-by application drilldown { { entity pool-member values { p1 p2 } } }
measures { transactions } order-by { { measure transactions } } range now-7d--now
Gets the distribution of requests per application on pool members p1 and p2 ordered by the number of
requests during the last week.
save analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } format pdf le report.pdf
Gets the average tps of the top 20 virtual servers and exports to a PDF le on the BIG-IP system.
save analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } format csv-aggregated le report.csv
Gets the average tps of the top 20 virtual servers and exports to a CSV le on the BIG-IP system.
save analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
average-tps sort-type desc } } format csv-time-series le report.csv
Gets the average tps over time of the top 10 virtual servers and exports to a CSV le on the BIG-IP system.
send-mail analytics http report view-by virtual measures {average-tps} limit 20 order-by { { measure
Gets the average tps over time of the top 10 virtual servers and sends out an email containing the report as
a PDF.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
148
Analytics HTTP
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The default value is transactions.
The options are:
• average-concurrent-sessions
The average number of concurrent sessions for each entity.
• average-new-sessions
The average number of new sessions for each entity.
• average-page-load-time
The average client page load time for each entity.
• average-request-throughput
The average request throughput for each entity.
• average-response-throughput
The average response throughput for each entity.
• average-server-latency
The average server latency for each entity.
• average-tps
The average number of transactions per second for each entity.
• client-side-sampled-transactions
The number of transactions sampled for client side page load time.
• max-page-load-time
The maximum client page load time for each entity.
• max-request-throughput
The maximum request throughput for each entity.
• max-response-throughput
The maximum response throughput for each entity.
• max-server-latency
The maximum server latency for each entity.
• max-tps
The maximum number of transactions per second for each entity.
• transactions
The absolute number of transactions for each entity.
• order-by
149
Traffic Management Shell (tmsh) Reference Guide
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The default value for measures is previously chosen measures. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics report
150
Analytics HTTP
Analytics IP Layer
report
Displays an ip-layer analytics report.
Syntax
Show, save or send an analytics ip-layer report using the syntax shown in the following sections.
Display
show report view-by [ ip ]
drilldown {
{
entity [ ip ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ ip ]
drilldown {
{
entity [ ip ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ ip ]
drilldown {
{
entity [ ip ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate ip-layer analytics reports. You can generate a IP-layer analytics report for
the following entities:
• ip - IP version (IPV4 / IPV6)
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics ip-layer report view-by ip
show analytics ip-layer report view-by ip drilldown { { entity ip values { IP-V4 } } }
send-mail analytics ip-layer report view-by ip measures { dropped-pkts } limit 20 order-by { { measure
For more syntactical examples, see the tmsh help manual for analytics report.
152
Analytics IP Layer
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• transmitted-pkts
The total number of transmitted packets for the selected lter (entity).
• received-pkts
The total number of received packets for the selected lter (entity).
• dropped-pkts
The total number of dropped packets for the selected lter (entity).
• err-invalid-len
The total number of error invalid length for the selected lter (entity).
• err-memory
The total number of error memory for the selected lter (entity).
• err-retransmitted
The total number of error retransmitted for the selected lter (entity).
• err-protocol
The total number of error protocol for the selected lter (entity).
153
Traffic Management Shell (tmsh) Reference Guide
• err-options
The total number of error options for the selected lter (entity).
• err-checksum
The total number of error checksum for the selected lter (entity).
• received-frags
The total number of received fragments for the selected lter (entity).
• received_dropped_frags
The total number of received dropped fragments for the selected lter (entity).
• transmitted-frags
The total number of transmitted fragments for the selected lter (entity).
• transmitted-dropped-frags
The total number of transmitted dropped fragment for the selected lter (entity).
• reassembled-frags
The total number of reassembled fragment for the selected lter (entity).
• reassembled-dropped-frags
The total number of 'too long' reassembled dropped fragment for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
154
Analytics IP Layer
Analytics LSN Pool
report
Displays an LSN Pool analytics report.
Syntax
Show, save or send an analytics lsn-pool report using the syntax shown in the following sections.
Display
show report view-by [ lsn-pool ]
drilldown {
{
entity [ none ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ lsn-pool ]
drilldown {
{
entity [ none ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ lsn-pool ]
drilldown {
{
entity [ none ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate lsn-pool analytics reports. You can generate a LSN analytics report for the
following entities:
• lsn-pool - LSN Pool translation statistics
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics lsn-pool report view-by lsn-pool
send-mail analytics lsn-pool report view-by lsn-pool measures { active-translations } limit 20 order-by
{ { measure active-translations sort-type desc } } format pdf email-addresses {
For more syntactical examples, see the tmsh help manual for analytics report.
Options
• device
156
Analytics LSN Pool
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• active-translations
The average number of active LSN translations for the selected lter (entity).
• translation-request
The total number of LSN translation requests for the selected lter (entity).
• translation-failure
The total number of failed LSN translations for the selected lter (entity).
• translation-from-backup
The total number of LSN translations using the backup pool for selected lter (entity). Only applies
to LSN Pool in Deterministic NAT mode.
• active-pb
The average number of active port-blocks for the selected lter (entity). Only applies to LSN Pool
in PBA mode.
• pb-allocations
The total number of port-block allocations for the selected lter (entity). Only applies to LSN Pool
in PBA mode.
• pb-freed
The total number of port-block deallocations for the selected lter (entity). Only applies to LSN
Pool in PBA mode.
157
Traffic Management Shell (tmsh) Reference Guide
• zombie-block-created
The total number of zombie blocks created for the selected lter (entity). Only applies to LSN Pool
in PBA mode.
• zombie-block-deleted
The total number of zombie blocks deleted for the selected lter (entity). Only applies to LSN Pool
in PBA mode.
• active-pb-clients-reached-limit
The average number of port-block clients that have reached the port-block limit for the selected lter
(entity). Only applies to LSN Pool in PBA mode.
• pb-client-reached-limit
The total number of port-block clients that have reached the port-block limit for the selected lter
(entity). Only applies to LSN Pool in PBA mode.
• pcp-requests
The total number of PCP requests for the selected lter (entity). Only applies to LSN Pool with PCP
prole.
• pcp-responses
The total number of PCP responses for the selected lter (entity). Only applies to LSN Pool with
PCP prole.
• pcp-errors
The total number of PCP errors for the selected lter (entity). Only applies to LSN Pool with PCP
prole.
• log-attempts
The total number of logging attempts for the selected lter (entity). Only applies to LSN Pool with
Log publisher attached.
• log-failures
The total number of logging failures for the selected lter (entity). Only applies to LSN Pool with
Log publisher attached.
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
158
Analytics LSN Pool
Analytics Memory
report
Displays an memory analytics report.
Syntax
Show, save or send an analytics memory report using the syntax shown in the following sections.
Display
show report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ slot ]
drilldown {
{
entity [ slot ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate memory analytics reports. You can generate a memory analytics report for
the following entities:
• slot - Slot ID
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics memory report view-by slot
show analytics memory report view-by slot drilldown { { entity slot values { IP-V4 } } }
send-mail analytics memory report view-by slot measures { dropped-pkts } limit 20 order-by { {
For more syntactical examples, see the tmsh help manual for analytics report.
160
Analytics Memory
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• tmm-total-ram The average of total TMM memory for the selected lter (entity).
• tmm-used-ram The average of used TMM memory for the selected lter (entity).
• tmm-free-ram The average of free TMM memory for the selected lter (entity).
• other-total-ram The average of total other (daemons and kernel) memory for the selected lter
(entity).
• other-used-ram The average of used other (daemons and kernel) memory for the selected lter
(entity).
• other-free-ram The average of free other (daemons and kernel) memory for the selected lter
(entity).
• system-total-ram The average of total system memory for the selected lter (entity).
• system-used-ram The average of used system memory for the selected lter (entity).
• system-free-ram The average of free system memory for the selected lter (entity).
• swap-total-ram The average of total swap memory for the selected lter (entity).
• swap-used-ram The average of used swap memory for the selected lter (entity).
• swap-free-ram The average of free swap memory for the selected lter (entity).
161
Traffic Management Shell (tmsh) Reference Guide
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
162
Analytics Memory
Analytics Network
report
Displays a network rewall analytics report.
Syntax
Show, save or send an analytics network report using the syntax shown in the following sections.
Display
show report view-by [ l3l4-errors-error-reason | l3l4-errors-network-protocol
| l3l4-errors-action | l3l4-errors-source-ip | l3l4-errors-destination-ip |
l3l4-errors-vlan |
acl-enforced-application | acl-enforced-destination-ip
| acl-enforced-destination-port | acl-enforced-policy | acl-enforced-rule |
acl-enforced-rule-action | acl-enforced-rule-context |
acl-enforced-rule-context-type | acl-enforced-self-ip | acl-enforced-server-ip
|
acl-enforced-source-ip | acl-enforced-source-port |
acl-enforced-translation-pool | acl-enforced-translation-type |
acl-enforced-vlan |
acl-mgmt-application | acl-mgmt-destination-ip |
acl-mgmt-destination-port | acl-mgmt-rule | acl-mgmt-rule-action |
acl-mgmt-rule-context | acl-mgmt-source-ip |
acl-mgmt-source-port |
acl-staged-application | acl-staged-destination-ip |
acl-staged-destination-port | acl-staged-policy | acl-staged-rule |
acl-staged-rule-action | acl-staged-rule-context |
acl-staged-rule-context-type | acl-staged-self-ip | acl-staged-server-ip |
acl-staged-source-ip | acl-staged-source-port |
acl-staged-translation-pool | acl-staged-translation-type | acl-staged-vlan
]
drilldown {
{
entity [ l3l4-errors-error-reason | l3l4-errors-network-protocol |
l3l4-errors-action | l3l4-errors-source-ip | l3l4-errors-destination-ip |
l3l4-errors-vlan |
acl-enforced-application | acl-enforced-destination-ip |
acl-enforced-destination-port | acl-enforced-policy | acl-enforced-rule |
acl-enforced-rule-action | acl-enforced-rule-context |
acl-enforced-rule-context-type | acl-enforced-self-ip | acl-enforced-server-ip
|
acl-enforced-source-ip | acl-enforced-source-port |
acl-enforced-translation-pool | acl-enforced-translation-type |
acl-enforced-vlan |
acl-mgmt-application | acl-mgmt-destination-ip |
acl-mgmt-destination-port | acl-mgmt-rule | acl-mgmt-rule-action |
acl-mgmt-rule-context | acl-mgmt-source-ip |
acl-mgmt-source-port |
acl-staged-application | acl-staged-destination-ip |
acl-staged-destination-port | acl-staged-policy | acl-staged-rule |
acl-staged-rule-action | acl-staged-rule-context |
acl-staged-rule-context-type | acl-staged-self-ip | acl-staged-server-ip |
acl-staged-source-ip | acl-staged-source-port |
acl-staged-translation-pool | acl-staged-translation-type | acl-staged-vlan
]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Save
save report view-by [ l3l4-errors-error-reason | l3l4-errors-network-protocol
| l3l4-errors-action | l3l4-errors-source-ip | l3l4-errors-destination-ip |
l3l4-errors-vlan |
acl-enforced-application | acl-enforced-destination-ip
| acl-enforced-destination-port | acl-enforced-policy | acl-enforced-rule |
acl-enforced-rule-action | acl-enforced-rule-context |
acl-enforced-rule-context-type | acl-enforced-self-ip | acl-enforced-server-ip
|
acl-enforced-source-ip | acl-enforced-source-port |
acl-enforced-translation-pool | acl-enforced-translation-type |
acl-enforced-vlan |
acl-mgmt-application | acl-mgmt-destination-ip |
acl-mgmt-destination-port | acl-mgmt-rule | acl-mgmt-rule-action |
acl-mgmt-rule-context | acl-mgmt-source-ip |
acl-mgmt-source-port |
acl-staged-application | acl-staged-destination-ip |
acl-staged-destination-port | acl-staged-policy | acl-staged-rule |
acl-staged-rule-action | acl-staged-rule-context |
acl-staged-rule-context-type | acl-staged-self-ip | acl-staged-server-ip |
acl-staged-source-ip | acl-staged-source-port |
acl-staged-translation-pool | acl-staged-translation-type | acl-staged-vlan
]
drilldown {
{
entity [ l3l4-errors-error-reason | l3l4-errors-network-protocol |
l3l4-errors-action | l3l4-errors-source-ip | l3l4-errors-destination-ip |
l3l4-errors-vlan |
acl-enforced-application | acl-enforced-destination-ip |
acl-enforced-destination-port | acl-enforced-policy | acl-enforced-rule |
acl-enforced-rule-action | acl-enforced-rule-context |
acl-enforced-rule-context-type | acl-enforced-self-ip | acl-enforced-server-ip
|
acl-enforced-source-ip | acl-enforced-source-port |
acl-enforced-stranslation-pool | acl-enforced-translation-type |
acl-enforced-vlan |
acl-mgmt-application | acl-mgmt-destination-ip |
acl-mgmt-destination-port | acl-mgmt-rule | acl-mgmt-rule-action |
acl-mgmt-rule-context | acl-mgmt-source-ip |
acl-mgmt-source-port |
acl-staged-application | acl-staged-destination-ip |
acl-staged-destination-port | acl-staged-policy | acl-staged-rule |
acl-staged-rule-action | acl-staged-rule-context |
acl-staged-rule-context-type | acl-staged-self-ip | acl-staged-server-ip |
164
Analytics Network
acl-staged-source-ip | acl-staged-source-port |
acl-staged-translation-pool | acl-staged-translation-type | acl-staged-vlan
]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ l3l4-errors-error-reason |
l3l4-errors-network-protocol | l3l4-errors-action | l3l4-errors-source-ip |
l3l4-errors-destination-ip | l3l4-errors-vlan |
acl-enforced-application |
acl-enforced-destination-ip | acl-enforced-destination-port |
acl-enforced-policy | acl-enforced-rule |
acl-enforced-rule-action | acl-enforced-rule-context
| acl-enforced-rule-context-type | acl-enforced-self-ip |
acl-enforced-server-ip |
acl-enforced-source-ip | acl-enforced-source-port
| acl-enforced-translation-pool | acl-enforced-translation-type |
acl-enforced-vlan |
acl-mgmt-application | acl-mgmt-destination-ip |
acl-mgmt-destination-port | acl-mgmt-rule | acl-mgmt-rule-action |
acl-mgmt-rule-context | acl-mgmt-source-ip |
acl-mgmt-source-port |
acl-staged-application | acl-staged-destination-ip
| acl-staged-destination-port | acl-staged-policy | acl-staged-rule |
acl-staged-rule-action | acl-staged-rule-context
| acl-staged-rule-context-type | acl-staged-self-ip | acl-staged-server-ip |
acl-staged-source-ip | acl-staged-source-port |
acl-staged-translation-pool | acl-staged-translation-type | acl-staged-vlan
]
drilldown {
{
entity [ l3l4-errors-error-reason | l3l4-errors-network-protocol |
l3l4-errors-action | l3l4-errors-source-ip | l3l4-errors-destination-ip |
l3l4-errors-vlan |
acl-enforced-application | acl-enforced-destination-ip |
acl-enforced-destination-port | acl-enforced-policy | acl-enforced-rule |
acl-enforced-rule-action | acl-enforced-rule-context |
acl-enforced-rule-context-type | acl-enforced-self-ip | acl-enforced-server-ip
|
acl-enforced-source-ip | acl-enforced-source-port |
acl-enforced-translation-pool | acl-enforced-translation-type |
acl-enforced-vlan |
acl-mgmt-application | acl-mgmt-destination-ip |
acl-mgmt-destination-port | acl-mgmt-rule | acl-mgmt-rule-action |
acl-mgmt-rule-context | acl-mgmt-source-ip |
acl-mgmt-source-port |
165
Traffic Management Shell (tmsh) Reference Guide
acl-staged-application | acl-staged-destination-ip |
acl-staged-destination-port | acl-staged-policy | acl-staged-rule |
acl-staged-rule-action | acl-staged-rule-context |
acl-staged-rule-context-type | acl-staged-self-ip | acl-staged-server-ip |
acl-staged-source-ip | acl-staged-source-port |
acl-staged-translation-pool | acl-staged-translation-type | acl-staged-vlan
]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate network rewall analytics reports. You can generate a network rewall
analytics report for the following entities:
• action - Action taken (allowed/dropped).
• acl-enforced-application - Application services (ACL - Enforced).
• acl-enforced-destination-ip - Destination IP Address (ACL - Enforced).
• acl-enforced-destination-port - Destination IP Port (ACL - Enforced).
• acl-enforced-policy - Policy (ACL - Enforced).
• acl-enforced-rule-action - Rule Action (ACL - Enforced).
• acl-enforced-rule-context - Rule Context (ACL - Enforced).
• acl-enforced-rule-context-type - Rule Context Type (ACL - Enforced).
• acl-enforced-rule - Rule (ACL - Enforced).
• acl-enforced-self-ip - Self IP Address (ACL - Enforced).
• acl-enforced-server-ip - Server IP Address (ACL - Enforced).
• acl-enforced-source-ip - Source IP Address (ACL - Enforced).
• acl-enforced-source-port - Source IP Port (ACL - Enforced).
• acl-enforced-translation-pool - Translation Pool (ACL - Enforced).
• acl-enforced-translation-type - Translation Type (ACL - Enforced).
• acl-enforced-vlan - VLAN (ACL - Enforced).
• acl-mgmt-application - Application services (ACL - Management).
• acl-mgmt-destination-ip - Destination IP Address (ACL - Management).
166
Analytics Network
• acl-mgmt-destination-port - Destination IP Port (ACL - Management).
• acl-mgmt-rule-action - Rule Action (ACL - Management).
• acl-mgmt-rule-context - Rule Context (ACL - Management).
• acl-mgmt-rule - Rule (ACL - Management).
• acl-mgmt-source-ip - Source IP Address (ACL - Management).
• acl-mgmt-source-port - Source IP Port (ACL - Management).
• acl-staged-application - Application services (ACL - Staged).
• acl-staged-destination-ip - Destination IP Address (ACL - Staged).
• acl-staged-destination-port - Destination IP Port (ACL - Staged).
• acl-staged-policy - Policy (ACL - Staged).
• acl-staged-rule-action - Rule Action (ACL - Staged).
• acl-staged-rule-context - Rule Context (ACL - Staged).
• acl-staged-rule-context-type - Rule Context Type (ACL - Staged).
• acl-staged-rule - Rule (ACL - Staged).
• acl-staged-self-ip - Self IP Address (ACL - Staged).
• acl-staged-server-ip - Server IP Address (ACL - Staged).
• acl-staged-source-ip - Source IP Address (ACL - Staged).
• acl-staged-source-port - Source IP Port (ACL - Staged).
• acl-staged-translation-pool - Translation Reason (ACL - Staged).
• acl-staged-translation-type - Translation Type (ACL - Staged).
• acl-staged-vlan - VLAN (ACL - Staged).
• l3l4-errors-action - Network rewall errors action.
• l3l4-errors-destination-ip - Destination IP address (Network rewall errors).
• l3l4-errors-error-reason - Network rewall error reason.
• l3l4-errors-network-protocol - Destination port (Network protocol).
• l3l4-errors-source-ip - Source IP address (Network rewall errors).
• l3l4-errors-vlan - VLAN (Network rewall errors).
Examples
show analytics network report view-by acl-enforced-rule
show analytics network report view-by acl-staged-vlan drilldown { { entity acl-staged-destination-port
values { 80 } } }
send-mail analytics network report view-by acl-mgmt-source-ip limit 20 format pdf email-addresses
For more syntactical examples see manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
167
Traffic Management Shell (tmsh) Reference Guide
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• acl-matches
The total number of ACL rule matches. Applicable only to view-by entities starting with "acl-".
• errors
The total number of rewall errors. Applicable only to view-by entities starting with "l3l3-errors-".
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, analytics, analytics report
168
Analytics Network
stale-rules
Displays a network rewall stale rules report.
Syntax
Show an analytics network stale-rules report using the syntax shown in the following sections.
Display
show stale-rules type [ enforced | staged ]
options:
drilldown {
{
entity [ context | policy | rule-name ]
values
{
[value ...]
}
} ...
}
field-fmt
first-rule-number [ value ]
number-of-rules [ value ]
range [ date range ]
Description
Use this command to generate network rewall stale rules reports. A stale rule is one that has had not hits,
or very few hits, over a specied time period. The report is displayed in order from the least-hit rules
(including rules with no hits) to the most hit rules. You can generate a stale rules report for either enforced
or staged rules.
Examples
show analytics network stale-rules type enforced
Shows a stale rules report for enforced rules (either inline or not).
show analytics network stale-rules type staged drilldown { { entity context values {
/Common/virtual_server_1 } } }
Shows a stale rules report for staged rules in the context of the virtual server /Common/virtual_server_1
show analytics network stale-rules type enforced number-of-rules 100 range now-1w
Shows a stale rules report for enforced rules. 100 rules are shown in the report. This report is shown for the
last week (including the last day).
169
Traffic Management Shell (tmsh) Reference Guide
show analytics network stale-rules type enforced rst-rule-number 10 number-of-rules 100 range
now-1w
Shows a stale rules report for enforced rules. The rst least hit 9 rules are skipped, and 100 rules are shown
in the report. This report is shown for the last week (including the last day).
show analytics network stale-rules type enforced rst-rule-number 10 number-of-rules 100 range
now-1d--now-1w
Shows a stale rules report for enforced rules. The rst least hit 9 rules are skipped, and 100 rules are shown
in the report. This report is shown for the last week, excluding the last day.
Options
• drilldown
Species specic entities that are used as a lter.
• eld-fmt
Shows statistics in eld format for the specied items.
• rst-rule-number
Species the rst rule number being displayed (rules are ordered by hit count in an ascending order).
• number-of-rules
Species the maximum number of rewall rules being displayed in the output result set. The default
value is 10.
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
See Also
analytics, analytics report, security analytics settings, show, tmsh
170
Analytics Network
Analytics PEM
report
Displays an pem analytics report.
Syntax
Show, save or send an analytics pem report using the syntax shown in the following sections.
Display
show report view-by [ application | category | url-category | policy | service
| action | tower | subscribers | subscriber-name | ip-list | device-name |
device-os | called-station | calling-station | subscriber-type | user-name]
drilldown {
{
entity [ application | category | url-category | policy | service |
action | tower | subscribers | subscriber-name | ip-list | device-name |
device-os | called-station | calling-station | subscriber-type | user-name]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | category | url-category | policy | service
| action | tower | subscribers | subscriber-name | ip-list | device-name |
device-os | called-station | calling-station | subscriber-type | user-name]
drilldown {
{
entity [ application | category | url-category | policy | service |
action | tower | subscribers | subscriber-name | ip-list | device-name |
device-os | called-station | calling-station | subscriber-type | user-name]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | category | url-category | policy |
service | action | tower | subscribers| subscriber-name | ip-list | device-name
| device-os | called-station | calling-station | subscriber-type | user-name
]
drilldown {
{
entity [ application | category | url-category | policy | service |
action | tower | subscribers | subscriber-name | ip-list | device-name |
device-os | called-station | calling-station | subscriber-type | user-name]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate pem analytics reports. You can generate a PEM analytics report for the
following entities:
• application - Classication application
• category - Classication category
• url-category - URL category
172
Analytics PEM
• policy - Classication application policy
• service - Forwarding service (endpoint)
• action - PEM action (Gate, Forward, ICAP, Modify HTTP header, etc...)
• tower - Tower the subscriber communicates from
• subscribers - Subscriber summary statistics
• subscriber-name - Subscriber name
• ip-list - IP address list
• device-name - Device name
• device-os - Device operating system
• called-station - Called station
• calling-station - Calling station
• subscriber-type - Subscriber type
• user-name - User Name
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics pem report view-by category
show analytics pem report view-by category drilldown { { entity policy values { Some_Policy_Name
} } }
send-mail analytics pem report view-by tower measures { total_bytes_in } limit 20 order-by { { measure
For more syntactical examples, see the tmsh help manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
173
Traffic Management Shell (tmsh) Reference Guide
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• hitcount
The total number of classied ows for the selected lter (entity).
• total-bytes-in
The total number of bytes received for the selected lter (entity).
• total-bytes-out
The total number of bytes sent for the selected lter (entity).
• total-ows-opened
The total number of ows (classied and non-classied) for the selected lter (entity).
• total-ows-closed
The total number of closed ows for the selected lter (entity).
• total-subscribers-login
The total number of login events for the selected lter (entity).
• total-subscribers-logout
The total number of logout events for the selected lter (entity).
• avg-distinct-apps
The average number of distinct applications for the selected lter (entity).
• avg-distinct-categories
The average number of distinct categories for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
174
Analytics PEM
Analytics Protocol Security
report
Displays a Protocol Security analytics report.
Syntax
Show, save, or send an analytics protocol-security report using the syntax shown in the following sections.
Display
show report view-by [ application | virtual-server | ip | violation|
request-type | protocol-type ]
drilldown {
{
entity [ application | virtual-server | ip | violation| request-type
| protocol-type ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ application | virtual-server | ip | violation|
request-type | protocol-type ]
drilldown {
{
entity [ application | virtual-server | ip | violation| request-type
| protocol-type ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | virtual-server | ip | violation|
request-type | protocol-type ]
drilldown {
{
entity [ application | virtual-server | ip | violation| request-type
| protocol-type ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate protocol-security analytics reports. You can generate a protocol-security
analytics report for the following entities:
• application - Application services.
• virtual-server - Virtual servers.
• ip - Source IP addresses.
• violation - Violation types.
• protocol-type - Protocol type (HTTP/FTP/SMTP)
• request-type - PRequest type (Legal or Alarmed/Blocked/Dropped)
Different measures are collected for each of these entities and can be a part of the report request.
176
Analytics Protocol Security
Examples
show analytics protocol-security report view-by protocol-type
show analytics protocol-security report view-by request-type drilldown { { entity protocol-type values
{ HTTP } } }
send-mail analytics protocol-security report view-by protocol-type measures {transactions} limit 20
order-by { { measure transactions sort-type desc } } format pdf email-addresses {
For more syntactical examples, see the manpage for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• requests
Request count.
• occurrences
Number of occurrences for the selected lter (relevant for violation entity only)
• order-by
177
Traffic Management Shell (tmsh) Reference Guide
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
178
Analytics Protocol Security
Analytics SIP
report
Displays a SIP analytics report.
Syntax
Show, save or send an analytics sip report using the syntax shown in the following sections.
Display
show report view-by [ application | attack-id | attack-type | callee | caller
| method | src-ip | virtual | vlan | transaction-outcome ]
drilldown {
{
entity [ application | attack-id | attack-type | callee | caller |
method | src-ip | virtual | vlan | transaction-outcome ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Save
save report view-by [ application | attack-id | attack-type | callee | caller
| method | src-ip | virtual | vlan | transaction-outcome ]
drilldown {
{
entity [ application | attack-id | attack-type | callee | caller |
method | src-ip | virtual | vlan | transaction-outcome ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ application | attack-id | attack-type | callee |
caller | method | src-ip | virtual | vlan | transaction-outcome ]
drilldown {
{
entity [ application | attack-id | attack-type | callee | caller |
method | src-ip | virtual | vlan | transaction-outcome ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc | desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate SIP DoS analytics reports. You can generate a SIP DoS prevention analytics
report for the following entities:
• application - Application services (iApp).
• attack-id - DoS attack ID.
• attack-type - DoS attack type.
• callee - Callee.
• caller - Caller.
• method - Methos.
• src-ip - Source IP Address.
180
Analytics SIP
• vlan - VLAN.
• transaction-outcome - Transaction outcome.
Examples
show analytics sip report view-by attack-id
show analytics sip report view-by attack-type drilldown { { entity method values { ACK } } }
send-mail analytics sip report view-by callee limit 20 format pdf email-addresses {
For more syntactical examples see manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. This option must be used with the drilldown option. You can also use it along with include-others.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• requests-count
The total number of requests that were received by the virtual server(/s)s
• order-by
181
Traffic Management Shell (tmsh) Reference Guide
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, analytics, analytics report
182
Analytics SIP
Analytics SWG
report
Displays an swg analytics report.
Syntax
Show, save or send an analytics swg report using the syntax shown in the following sections.
Display
show report view-by [ action | ssl_bypass | username | client_ip | url |
category | url_filter | filter_policy | host-name ]
drilldown {
{
entity [ action | ssl_bypass | username | client_ip | url | category
| url_filter | filter_policy | host-name ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ action | ssl_bypass | username | client_ip | url |
category | url_filter | filter_policy | host-name ]
drilldown {
{
entity [ action | ssl_bypass | username | client_ip | url | category
| url_filter | filter_policy | host-name ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ action | ssl_bypass | username | client_ip | url
| category | url_filter | filter_policy | host-name ]
drilldown {
{
entity [ action | ssl_bypass | username | client_ip | url | category
| url_filter | filter_policy | host-name ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate swg analytics reports. You can generate an application-security-network
analytics report for the following entities:
• action - Transction's action (Blocked / Allowed / Allowed with log)
• ssl_bypass - Is HTTP/HTPPS inspection bypassed
• username - User name
• client-ip - Client IP
• host-name - Host name
• url - URL
• category - URL category
184
Analytics SWG
• url-lter - URL lter
• scheme - Scheme
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics swg report view-by client-ip
show analytics swg report view-by client-ip drilldown { { entity scheme values { my_scheme } } }
send-mail analytics swg report view-by category measures { blocked-count } limit 20 order-by { {
}
For more syntactical examples, see the tmsh help manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• request-count
The total number of requests for the selected lter (entity).
• order-by
185
Traffic Management Shell (tmsh) Reference Guide
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
186
Analytics SWG
Analytics SWG Blocked
report
Displays an swg-blocked analytics report.
Syntax
Show, save or send an analytics swg-blocked report using the syntax shown in the following sections.
Display
show report view-by [ ssl_bypass | username | client_ip | url | category |
url_filter | filter_policy | security-category | host-name ]
drilldown {
{
entity [ ssl_bypass | username | client_ip | url | category | url_filter
| filter_policy | security-category | host-name ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ ssl_bypass | username | client_ip | url | category |
url_filter | filter_policy | security-category | host-name ]
drilldown {
{
entity [ ssl_bypass | username | client_ip | url | category | url_filter
| filter_policy | security-category | host-name ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ ssl_bypass | username | client_ip | url | category
| url_filter | filter_policy | security-category | host-name ]
drilldown {
{
entity [ ssl_bypass | username | client_ip | url | category | url_filter
| filter_policy | security-category | host-name ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate swg-blocked analytics reports. You can generate an
application-security-network analytics report for the following entities:
• ssl_bypass - Is HTTP/HTPPS inspection bypassed
• username - User name
• client-ip - Client IP
• host-name - Host name
• url - URL
• category - URL category
• security-category - Categories which their parent is 'Security' category
188
Analytics SWG Blocked
• url-lter - URL lter
• scheme - Scheme
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics swg-blocked report view-by client-ip
show analytics swg-blocked report view-by client-ip drilldown { { entity scheme values { my_scheme
} } }
send-mail analytics swg-blocked report view-by category measures { blocked-count } limit 20 order-by
}
For more syntactical examples, see the tmsh help manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• blocked-count
The total number of blocked requests for the selected lter (entity).
189
Traffic Management Shell (tmsh) Reference Guide
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
190
Analytics SWG Blocked
Analytics TCP
report
Displays an tcp analytics report.
Syntax
Show, save or send an analytics tcp report using the syntax shown in the following sections.
Display
show report view-by [ virtual | tcp ]
drilldown {
{
entity [ virtual | tcp ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ virtual | tcp ]
drilldown {
{
entity [ virtual | tcp ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ virtual | tcp ]
drilldown {
{
entity [ virtual | tcp ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate tcp analytics reports. You can generate a TCP analytics report for the following
entities:
• virtual - Virtual Server
• tcp - TCP Prole
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics tcp report view-by virtual
show analytics tcp report view-by virtual drilldown { { entity virtual values { 172.12.34.56 } } }
send-mail analytics tcp report view-by tcp measures { max-active-conns } limit 20 order-by { { measure
For more syntactical examples, see the tmsh help manual for analytics report.
192
Analytics TCP
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• avg-active-conns
The average number of actice connections for the selected lter (entity).
• max-active-conns
The max number of active connections for the selected lter (entity).
• total-accepts
The total number of accepted connections for the selected lter (entity).
• total-accept_fails
The total number of denied accept connections for the selected lter (entity).
• total-new-conns
The total number of new connections for the selected lter (entity).
• total-failed-conns
The total number of failed connections for the selected lter (entity).
• total-expired-conns
The total number of expired connections for the selected lter (entity).
193
Traffic Management Shell (tmsh) Reference Guide
• total-abandoned-connections
The total number of abandoned connections for the selected lter (entity).
• total-rst-packets
The total number of RST connections for the selected lter (entity).
• total-malformed-segments
The total number of malformed connections for the selected lter (entity).
• total-oo-segs
The total number of out of ordered segments for the selected lter (entity).
• total-rx-cookie
The total number of received SYN cookies for the selected lter (entity).
• total-rxbadcookies
The total number of received bad SYN cookies for the selected lter (entity).
• total-hw-cookies
The total number of received HW SYN cookies for the selected lter (entity).
• total-syncacheover
The total number of SYN cache overow for the selected lter (entity).
• total-txrexmits
The total number of retransmitted segments for the selected lter (entity).
• total-sndpack
The total number of sent packets for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
194
Analytics TCP
Analytics UDP
report
Displays an udp analytics report.
Syntax
Show, save or send an analytics udp report using the syntax shown in the following sections.
Display
show report view-by [ virtual | udp ]
drilldown {
{
entity [ virtual | udp ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ virtual | udp ]
drilldown {
{
entity [ virtual | udp ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ virtual | udp ]
drilldown {
{
entity [ virtual | udp ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate udp analytics reports. You can generate a UDP analytics report for the
following entities:
• virtual - Virtual Server
• udp - UDP Prole
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics udp report view-by virtual
show analytics udp report view-by virtual drilldown { { entity virtual values { 172.12.34.56 } } }
send-mail analytics udp report view-by udp measures { max-active-conns } limit 20 order-by { {
}
For more syntactical examples, see the tmsh help manual for analytics report.
196
Analytics UDP
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• avg-active-conns
The average number of actice connections for the selected lter (entity).
• max-active-conns
The max number of active connections for the selected lter (entity).
• total-accepts
The total number of accepted connections for the selected lter (entity).
• total-accept_fails
The total number of denied accept connections for the selected lter (entity).
• total-new-conns
The total number of new connections for the selected lter (entity).
• total-failed-conns
The total number of failed connections for the selected lter (entity).
• total-expired-conns
The total number of expired connections for the selected lter (entity).
197
Traffic Management Shell (tmsh) Reference Guide
• total-received-datagrams
The total number of received datagrams for the selected lter (entity).
• total-malformed-datagrams
The total number of malformed datagrams for the selected lter (entity).
• total-icmp-unreachable
The total number of ICMP unreachable for the selected lter (entity).
• total-bad-sum-datagrams
The total number of bad checksum datagrams for the selected lter (entity).
• total-no-sum-datagrams
The total number of 'no checksum' datagrams for the selected lter (entity).
• total-transmitted-datagrams
The total number of transmitted datagrams for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
198
Analytics UDP
Analytics VCMP
report
Displays an vcmp analytics report.
Syntax
Show, save or send an analytics vcmp report using the syntax shown in the following sections.
Display
show report view-by [ guest | slot | interface | process-name ]
drilldown {
{
entity [ guest | slot | interface | process-name ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ guest | slot | interface | process-name ]
drilldown {
{
entity [ guest | slot | interface | process-name ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ guest | slot | interface | process-name ]
drilldown {
{
entity [ guest | slot | interface | process-name ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate vcmp analytics reports. You can generate a vCMP analytics report for the
following entities:
• slot - Slot ID
• guest - vCMP Guest name
• interface - vCMP Interface
• process-name - Process name
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics vcmp report view-by slot
show analytics vcmp report view-by slot drilldown { { entity slot values { 5 } } }
200
Analytics VCMP
send-mail analytics vcmp report view-by guest measures { network-bytes-in } limit 20 order-by { {
}
For more syntactical examples, see the tmsh help manual for analytics report.
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• network-bytes-in
The total number of external and internal bytes received for the selected lter (entity).
• network-bytes-out
The total number of external and internal bytes sent for the selected lter (entity).
• network-average-in-throughput
The average internal and external received throughput for the selected lter (entity).
• network-average-out-throughput
The average internal and external throughput sent for the selected lter (entity).
• average-guest-cpu-usage
The average number of CPU usage for the selected lter (entity) relative to host CPU.
201
Traffic Management Shell (tmsh) Reference Guide
• diskio-bytes-read
The average number of bytes read from disk for the selected lter (entity).
• diskio-bytes-written
The average number of bytes written to disk for the selected lter (entity).
• diskio-requests-read
The average number of read requests from disk for the selected lter (entity).
• diskio-requests-written
The average number of write requests from disk for the selected lter (entity).
• average-process-cpu-usage
The average number of CPU usage for the selected lter (entity) normalized relatively to guest CPU.
• trafc-client-new-connections
The total number of client-side new connections for the selected lter (entity).
• trafc-client-avg-connections
The average number of client-side connections opened for a selected lter (entity).
• trafc-client-packets-in
The total number of client-side received packets for a selected lter (entity).
• trafc-client-packets-out
The total number of client-side sent packets for a selected lter (entity).
• trafc-client-bytes-in
The total number of client-side received bytes for a selected lter (entity).
• trafc-client-bytes-out
The total number of client-side sent bytes for a selected lter (entity).
• trafc-server-new-connections
The total number of server-side new connections for the selected lter (entity).
• trafc-server-avg-connections
The average number of server-side connections opened for a selected lter (entity).
• trafc-server-packets-in
The total number of server-side received packets for a selected lter (entity).
• trafc-server-packets-out
The total number of server-side sent packets for a selected lter (entity).
• trafc-server-bytes-in
The total number of server-side received bytes for a selected lter (entity).
• trafc-server-bytes-out
The total number of server-side sent bytes for a selected lter (entity).
• total-assisted-connections
The total number of all hardware accelerated assisted connections for a selected lter (entity).
• current-assisted-connections
The average number of all hardware accelerated assisted connections for a selected lter (entity).
• hardware-syncookies-generated
202
Analytics VCMP
The total number of SYN cookies generated for a selected lter (entity).
• hardware-syncookies-detected
The total number of SYN cookies detected for a selected lter (entity).
• hw-accel-client-packets-in
The total number of hardware accelerated client-side received packets for a selected lter (entity).
• hw-accel-client-packets-out
The total number of hardware accelerated client-side received sent for a selected lter (entity).
• hw-accel-client-bytes-in
The total number of hardware accelerated client-side received bytes for a selected lter (entity).
• hw-accel-client-bytes-out
The total number of hardware accelerated client-side sent bytes for a selected lter (entity).
• hw-accel-client-max-connections
The max number of hardware accelerated client-side connections for a selected lter (entity).
• hw-accel-client-new-connections
The total number of hardware accelerated client-side new connections for a selected lter (entity).
• hw-accel-client-current-connections
The average number of hardware accelerated client-side opened connections for a selected lter
(entity).
• hw-accel-server-packets-in
The total number of hardware accelerated server-side received packets for a selected lter (entity).
• hw-accel-server-packets-out
The total number of hardware accelerated server-side received sent for a selected lter (entity).
• hw-accel-server-bytes-in
The total number of hardware accelerated server-side received bytes for a selected lter (entity).
• hw-accel-server-bytes-out
The total number of hardware accelerated server-side sent bytes for a selected lter (entity).
• hw-accel-server-max-connections
The max number of hardware accelerated server-side connections for a selected lter (entity).
• hw-accel-server-new-connections
The total number of hardware accelerated server-side new connections for a selected lter (entity).
• hw-accel-server-current-connections
The average number of hardware accelerated server-side opened connections for a selected lter
(entity).
• tmm-total-ram
The average of total TMM memory for the selected lter (entity).
• tmm-used-ram
The average of used TMM memory for the selected lter (entity).
• tmm-free-ram
The average of free TMM memory for the selected lter (entity).
• other-total-ram
203
Traffic Management Shell (tmsh) Reference Guide
The average of total other (daemons and kernel) memory for the selected lter (entity).
• other-used-ram
The average of used other (daemons and kernel) memory for the selected lter (entity).
• other-free-ram
The average of free other (daemons and kernel) memory for the selected lter (entity).
• system-total-ram
The average of total system memory for the selected lter (entity).
• system-used-ram
The average of used system memory for the selected lter (entity).
• system-free-ram
The average of free system memory for the selected lter (entity).
• swap-total-ram
The average of total swap memory for the selected lter (entity).
• swap-used-ram
The average of used swap memory for the selected lter (entity).
• swap-free-ram
The average of free swap memory for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
204
Analytics VCMP
Analytics Virtual
report
Displays an virtual analytics report.
Syntax
Show, save or send an analytics virtual report using the syntax shown in the following sections.
Display
show report view-by [ virtual ]
drilldown {
{
entity [ virtual ]
values
{
[value ...]
}
} ...
}
field-fmt
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Save
save report view-by [ virtual ]
drilldown {
{
entity [ virtual ]
values
{
[value ...]
}
} ...
}
file [ file name ]
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
Send
send-mail report view-by [ virtual ]
drilldown {
{
entity [ virtual ]
values
{
[value ...]
}
} ...
}
email-addresses {
[email address ...]
}
format [ csv-aggregated | csv-time-series | pdf ]
include-total
include-others
limit [number of rows]
measures {
[measure name ...]
}
order-by {
{
measure [ measure name ]
sort-type [ asc / desc ]
} ...
}
range [date range]
smtp-config-override [ smtp configuration object name ]
Description
Use this command to generate virtual analytics reports. You can generate a VIP analytics report for the
following entities:
• virtual - Virtual Server
Different measures are collected for each of these entities and can be a part of the report request.
Examples
show analytics virtual report view-by virtual
show analytics virtual report view-by virtual drilldown { { entity virtual values { 172.12.34.67 } } }
send-mail analytics virtual report view-by virtual measures { total-server-packets-in } limit 20 order-by
{ { measure total-server-packets-in sort-type desc } } format pdf email-addresses {
For more syntactical examples, see the tmsh help manual for analytics report.
206
Analytics Virtual
Options
• device
Species a BIG-IP device on which to generate a report. (Enterprise Manager only)
• device-list
Species a custom list of BIG-IP devices on which to generate a report. (Enterprise Manager only)
• drilldown
Species specic entities that are used as a lter.
• email-addresses
Species the list of email addresses to which the report le is sent when using the send-mail command.
• le
Species the exported le path to be saved when using the save command. The le name should be
simple (not a full path).
• format
Species the exported le format to be saved or sent. This option must be specied when using the save
or send-mail commands.
• include-others
Species that the grand total for the measure is displayed for all entities, except for those shown in the
result. It can be used along with include-total.
• include-total
Species that a total summary row should be added to the analytics report. For average measures, the
total value is also an average.
• limit
Species the maximum number of rows/entities in the output result set/le. The default value is 10, not
including the total row/entity. The maximum value is 1000.
• measures
Species a list of measures that can be used with the chosen entity type. The options are:
• total-client-packets-in
The total number of client-side received packets for the selected lter (entity).
• total-client-packets-out
The total number of client-side sent packets for the selected lter (entity).
• total-server-packets-in
The total number of server-side received packets for the selected lter (entity).
• total-server-packets-out
The total number of server-side sent packets for the selected lter (entity).
• total-client-bits-in
The total number of client-side received bits for the selected lter (entity).
• total-client-bits-out
The total number of client-side sent bits for the selected lter (entity).
• total-server-bits-in
The total number of server-side received bits for the selected lter (entity).
207
Traffic Management Shell (tmsh) Reference Guide
• total-server-bits-out
The total number of server-side sent bits for the selected lter (entity).
• total-client-conns
The total number of client-side connections for the selected lter (entity).
• avg-client-concurrent-conns
The average number of client-side concurrent connections for the selected lter (entity).
• max-client-concurrent-conns
The max value of client-side concurrent connections for the selected lter (entity).
• total-server-conns
The total number of server-side connections for the selected lter (entity).
• avg-server-concurrent-conns
The average number of server-side concurrent connections for the selected lter (entity).
• max-server-concurrent-conns
The max value of server side concurrent connections for the selected lter (entity).
• total-syncookies
The total number of syncookies for the selected lter (entity).
• total-syncookies-accepts
The total number of accepted syncookies for the selected lter (entity).
• total-syncookies-rejects
The total number of rejected syncookies for the selected lter (entity).
• total-hw-syncookies
The total number of HW syncookies for the selected lter (entity).
• total-hw-syncookies-accepts
The total number of accepted HW syncookies for the selected lter (entity).
• order-by
Species the measures and sort type (ascending or descending) that will be used to sort the nal report.
The value for each measure is a previously chosen measure. The default value for sort type is desc
(descending).
• range
Species the time/date range of the analytics information that you want to display. The given results
will reect the time range chosen here. The default value is the last hour (now--now-1h).
• smtp-cong-override
Species the SMTP conguration to use when sending reports by email. This overrides the default
SMTP settings.
See Also
show, save, send-mail, tmsh, ltm prole analytics, analytics, analytics report
208
Analytics Virtual
APM
acl
Manages an access control list (ACL).
Syntax
Congure the acl component within the apm module using the syntax shown in the following sections.
Create/Modify
create acl [name]
modify acl [name]
acl-order [integer]
app-service [[string] | none]
description [[string] | none]
entries {
{
action [allow | continue | discard | reject | unspec]
dst-end-port [[service] | none]
dst-start-port [[service] | none]
dst-subnet [[ip addr] | [[ip addr] [mask]]
host [[string] | none]
log [config | none | packet | summary | verbose]
paths [[string] | none]
protocol [integer]
scheme [any | http | https}
src-end-port [[service] | none]
src-start-port [[service] | none]
src-subnet [[ip addr] | [[ip addr] [mask]]
}
}
location-specific [true | false]
path-match-case [false | true]
type [dynamic | static]
Display
list acl
list acl [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
Delete
delete acl [name]
Description
You can use the acl component to congure a set of restrictions associated with a resource or favorite that
denes access for users and groups.
Examples
• create acl MyACL { acl-order 3 entries src-start-port ip default inet dst-end-port ip default inet
action allow }
Creates the static access control list named MyACL that is the third ACL in the list of ACLs in the
visual policy editor, and adds an access control entry that allows trafc using the default source IP
address and the default destination IP address.
• list acl all-properties
Displays a list of ACLs that includes the attributes of each ACL.
• delete acl MyACL
Deletes the MyACL access control list.
Options
• acl-order
Species the order of the access control entries in this access control list. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Describes the access control list.
• entries
Congures an entry for an access control list.
• action
Species the action that an access control list takes when this access control list entry is encountered.
This option is required. You can specify one of the following actions:
• allow
Allows trafc.
• continue
Skips checking against the remaining access control list entries in this access control list, and
continues evaluation at the next access control list.
• discard
Drops packets silently.
• reject
Drops a packet and sends TCP RST on TCP ows or proper ICMP messages on UDP ows.
Silently drops a packet on other protocols.
• dst-end-port
Species the destination IP address and network mask of the access control list entry. The default
is 0.
210
APM
• dst-start-port
Species the source port or range of ports of the access control list entry.
• dst-subnet
Species the destination subnet.
• host
Species the host name of the access control list entry.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to
the location where the BIG-IP device resides. The location-specic attribute is either true or false.
When using policy sync, mark an object as location-specic to prevent errors that can occur when
policies reference objects, such as authentication servers, that are specic to a certain location.
• log
Species the log level that is logged when actions of this type occur. Your options are:
• cong
Logs the conguration of a matched entry.
• none
Logs nothing. This is the default value.
• packet
Logs a matched packet.
• summary
Logs the name and entry number of a matched access control list and access control list entry.
• verbose
Logs everything.
• paths
Species an L7 access control list of matching URL paths.
• protocol
Species the protocol number (TCP=6, UDP=17) of the access control list entry. The default is 0.
• src-end-port
Species the source IP address and network mask of the access control list entry.
• src-start-port
Species the source port or range of ports of the access control list entry.
• src-subnet
Species the source subnet.
• [name]
Species the name of the access control list. This setting is required.
• partition
Displays the partition within which the object resides. The default is Common.
• path-match-case
Indicates whether the path is case sensitive. The default is true.
211
Traffic Management Shell (tmsh) Reference Guide
• type
Species the type of access control list. The default is static. The available types are static and dynamic.
apm-avr-config
Congures AVR overview/statistics settings for Secure Web Gateway Functionality
Syntax
Congure an apm-avr-cong component within the apm module using the syntax shown in the following
sections.
Modify
The AVR Conguration consists of the following information: boolean ag to turn off data collection by
AVR; Boolean ag to turn off sampling by AVR; Both are on by default. No create or delete function is
allowed.
modify apm-avr-config apm-avr-config {
avr-collect-data [true | false]
avr-sampling [true | false]
}
Display
list apm-avr-config
list apm-avr-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Congures AVR Conguration for SWG Statistical Reporting
Examples
modify apm-avr-cong apm-avr-cong { avr-collect-data false }
Modify apm-avr-cong by setting avr collect data to false.
Options
• avr-collect-data
Species whether data should be collected or not for statistical reporting.
• avr-sampling
Species whether sampling should be turned on or off.
212
APM
license
Shows the session information related to apm license.
Syntax
Displays the apm license information.
Display
show apm license
Description
APM module license is based on the session count depending on the platform. This module shows the total
session information for access, ccu (connectivity), swg, swg limited and the currently used sessions for
access, ccu, swg, swg limited. In addition, the statistics include the threshold percent for all the sessions.
Examples
show apm license
Displays the apm license usage information.
• total access sessions
Total access sessions for BIG-IP. This number is based on the license and platform type.
• current active sessions
The number of access sessions that are currently in use.
• current established sessions
Total number of currently established sessions.
• access sessions threshold percent
Access sessions threshold warning percent set by the user. The default is 75%.
• total connectivity sessions
Total connectivity sessions (ccu) for BIG-IP. This number is based on the license and platform type.
• current connectivity sessions
The number of connectivity sessions (ccu) that are currently in use.
• connectivity sessions threshold percent
Connectivity sessions threshold warning percent set by the user. The default is 75%.
• total swg sessions
Total swg sessions for BIG-IP. This number is based on the subscription-based swg license.
• current swg sessions
The number of swg sessions that are currently in use.
• swg sessions threshold percent
SWG sessions threshold warning percent set by the user. The default is 75%.
• total swg limited sessions
213
Traffic Management Shell (tmsh) Reference Guide
Total swg limited sessions for BIG-IP. This number is based on the license and platform type.
• current swg limited sessions
The number of swg limited sessions that are currently in use.
• swg limited sessions threshold percent
SWG limited sessions threshold warning percent set by the user. The default is 75%.
log-setting
Congures log congurations for various features in APM, such as URL Filter/Classication (URL Filter).
Syntax
Congure the log-setting component within the <apm> module using the syntax shown in the following
sections.
Create/Modify
Consider log-setting as a container for log congurations belonging to different features. At this time URL
Filter is the only feature with a log setting.
create log-setting [name]
modify log-setting [name]
description
url-filters [add | delete | modify | replace-all-with] {
[item name] {
filter { log-allowed-url [true|false] log-blocked-url [true|false] }
publisher [string]
}
}
access [add | delete | modify | replace-all-with] {
[item name] {
log-level {
access-control [emerg|alert|crit|err|warn|notice|info|debug]
access-per-request [emerg|alert|crit|err|warn|notice|info|debug]
apm-acl [emerg|alert|crit|err|warn|notice|info|debug]
eca [emerg|alert|crit|err|warn|notice|info|debug]
sso [emerg|alert|crit|err|warn|notice|info|debug]
swg [emerg|alert|crit|err|warn|notice|info|debug]
}
publisher [string]
}
Display
list log-setting
list log-setting [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Congures a container for log congurations.
214
APM
NOTE: Each container can enclose log congurations for many different features. However, each feature
can only have one log conguration in a container.
NOTE: For the log conguration to take effect, the log-setting must be associated with an access prole
(See man page for apm access prole).
NOTE: A log-setting container cannot be deleted if it is associated with an access prole.
Examples
create log-setting my-log-cfg
Creates a container without any log conguration.
create log-setting my-log-cfg url-lters add { my-urlf { lter { log-allowed-url true } publisher
my-publisher } }
Creates a container with a log conguration for the URL Filter feature. At this version, URL Filter is the
only feature with a log conguration.
modify log-setting my-log-cfg url-lters modify { my-urlf { publisher my-other-publisher } }
Modify the publisher of a log conguration.
modify log-setting my-log-cfg url-lters modify { my-urlf { lter { log-allowed-url false } } }
Modify the setting of a log lter
create log-setting my-log-cfg access add { my-access { publisher my-publisher } }
Creates a container with a log conguration for APM logging.
modify log-setting my-log-cfg access modify { my-access { log-level { access-control debug } } }
Modify the log level for module access-control.
Options
• description
Species a unique description for the log-setting container.
• url-lters
This is the list to store log congurations for the URL Filter feature.
• item name
Species the name of the log conguration to be added to the list url-lters. Currently, the list supports
only one item.
• lter
Species the value for different log lters. In particular, URL Filter log conguration has two lters:
log-allowed-url [true|false] log-blocked-url [true|false]
• publisher
Species the publisher of the log conguration. See sys log-cong publisher.
• access
This is the list to store log congurations for APM logging.
• log-level
This is the list of log level settings for different modules in the APM family.
215
Traffic Management Shell (tmsh) Reference Guide
See Also
apm prole access and sys log-cong
swg-scheme
Congures SWG Scheme
Syntax
Congure a swg-scheme component within the apm module using the syntax shown in the following
sections.
Create/Modify
Each swg-scheme consists of the following.
create swg-scheme [name]
app-service [[string] | none]
description [[string] | none]
modify swg-scheme [name]
app-service [[string] | none]
description [[string] | none]
Display
list swg-scheme
list swg-scheme [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Congures an swg-scheme object
Examples
create apm swg-scheme scheme1 { app-service none description "My SWG Scheme" }
Creates a new swg-scheme.
modify swg-scheme scheme1 { description "My SWG Scheme" }
Modify a swg-scheme by modifying its description string.
Options
• app-service
216
APM
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
Species a user-dened description for the swg scheme.
See Also
apm url-lter
url-filter
Congures URL lters for URL classication and ltering
Syntax
Congure a url-lter component within the apm module using the syntax shown in the following sections.
Create/Modify
Each url-lter consists of two url-category lists: a list of allowed URL categories and a list of blocked URL
categories. The requests for URLs contained in the allowed list are allowed to pass unfettered, whereas
requests for URLs in the blocked list will not go out into the Internet.
create url-filter [name]
allowed-categories [add | delete | modify | replace-all-with] {
[string]
}
blocked-categories [add | delete | modify | replace-all-with] {
[string]
}
modify url-filter [name]
allowed-categories [add | delete | modify | replace-all-with] {
[string]
}
blocked-categories [add | delete | modify | replace-all-with] {
[string]
}
Display
list url-filter
list url-filter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
217
Traffic Management Shell (tmsh) Reference Guide
Cp
cp url-filter [source-name] [target-name]
Description
Congures a url-lter
NOTE: A url-lter can have a large number of URL categories in each list. To facilitate the creation of
url-lter, you can create a new url-lter by copying from an existing url-lter. Then modify each list by
adding or removing url-categories to suit your needs.
Examples
create url-lter my-url-lter allowed-categories add { Business_and_Economy Education }
blocked-categories add { Adult_Content Shopping }
Creates a new url-lter.
modify url-lter my-own-lter allowed-categories delete { Education }
Modify a url-lter by deleting a URL category from the allowed list.
cp url-lter existing-lter another-lter
Create a new url-lter by copying from an existing lter.
Options
• allowed-categories
Species the URL categories that should be allowed to pass.
• description
Species a unique description for the URL lter.
• blocked-categories
Species the URL categories that should be blocked.
See Also
sys url-db download-result sys url-db download-schedule and sys url-db url-category
218
APM
APM AAA
active-directory
Manages an authentication access policy (AAA) Active Directory(r) server.
Syntax
Congure the active-directory component within the aaa module using the syntax shown in the following
sections.
Create/Modify
create active-directory [name]
modify active-directory [name]
admin-encrypted-password [[string] | none]
admin-name [[string] | none]
app-service [[string] | none]
cleanup-cache [pso | group | none]
description [[string] | none]
domain [[string] | none]
domain-controller [[string] | none]
domain-controllers [add | delete | modify | replace-all-with] {
[name] {
ip [ip address]
}
}
group-cache-ttl [integer]
domain-controllers none
location-specific [true | false]
pool [name]
pso-cache-ttl [integer]
padata [encryption type]
timeout [integer]
edit active-directory [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list active-directory
list active-directory [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete active-directory [name]
Description
You can use the active-directory component to manage an AAA Active Directory server. The Active
Directory is a network structure supported by Windows(r) 2000, or later, that provides support for tracking
and locating any object on a network.
Examples
• create active-directory MyADserver { domain-controller "server01.company.com domain
"company.com " admin-name "administrator" admin-encrypted-password "!My123Password"
}
Creates the AAA Active Directory server named MyADserver in the company.dom domain, sets the
administrator logon name to administrator and the administrator password to !My123Password, and
sets the Key Distribution Center to company.com.
• delete active-directory MyActiveDirectoryServer
Deletes the AAA Active Directory server named MyActiveDirectoryServer from the system.
Options
• admin-encrypted-password
Species the password associated with admin name. This option is required only when you are using
an Active Directory Query agent with this Active Directory server object.
• admin-name
Species the user name that has administrative permissions on an AAA Active Directory server. This
option is required only when you are using an Active Directory Query agent with this Active Directory
server object.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• cleanup-cache
Species if this is a cache cleanup request. You can cleanup Group cache or PSO cache.
• description
Species a description for the component. The default is none.
• domain
Species the Active Directory domain name. This setting is required.
• [name]
Species the name of an AAA Active Directory server. This setting is required.
• domain-controller
Species the fully qualied domain name (FQDN) of the domain contoller for the domain specied in
the domain option. The default is none.
• domain-controllers
220
APM AAA
Adds, deletes, or replaces a set of domain controllers, by specifying an FQDN for each entry. You can
congure the following options for each domain controller:
• ip
An IP address for specied domain controller entry.
• group-cache-ttl
Species group cache lifetime in days [0..1825]. The default value is 30. If you specify group cache
lifetime 0, that means cache will be updated on every request.
• pso-cache-ttl
Species password security objects (PSO) Cache lifetime in days [0..1825]. The default value is 30. If
you specify PSO cache lifetime 0, that means cache will be updated on every request.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• pool
Species the name of the pool with which the server is associated. The default is none.
• partition
Displays the partition within which the component resides. The default is Common.
• padata
Species a Kerberos preauthentication encryption type. If it is specied, the BIG-IP system includes
Kerberos preauthentication data within the rst AS-REQ. If you do not need to include preauthentication
data, set this option to "none". Supported encryption types: none, des-cbc-crc, des-cbc-md5,
aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96, rc4-hmac. The default is rc4-hmac.
• timeout
Species a timeout interval (in seconds) after which an AAA Active Directory server closes a connection.
The default is 15.
active-directory-trusted-domains
Manages authentication access policy (AAA) Active Directory(r) Trusted Domains.
Syntax
Congure the active-directory-tusted-domains component within the aaa module using the syntax shown
in the following sections.
Create/Modify
create active-directory-trusted-domains [name]
modify active-directory-trusted-domains [name]
app-service [[string] | none]
description [[string] | none]
root-domain [string]
trusted-domains [add | delete | modify | replace-all-with] {
221
Traffic Management Shell (tmsh) Reference Guide
{
active-directory [name]
}
}
edit active-directory-trusted-domains [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list active-directory-trusted-domains
list active-directory-trusted-domains [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete active-directory-trusted-domains [name]
Description
You can use the active-directory-trusted-domains component to manage AAA Active Directory Trusted
Domains. You can use this object to congure cross-domain authentication across a forest. It also allows
to congure Active Directory(r) agents to work in a Route Domains environment.
Examples
• create active-directory-trusted-domains MyTRD { trusted-domains { myDomain1 myDomain2
myDomain3 } root-domain /Common/myDomain2 }
Creates an object named MyTRD, sets domains myDomain1, myDomain2, myDomain3 as trusted and
the root-domain is set to myDomain2. To use this example you need to have Active Directory servers
myDomain1, myDomain2 and myDomain3 pre-congured.
• delete active-directory MyTRD
Deletes the AAA Active Directory Trusted Domains named MyTRD from the system.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a user-dened description for the Active Directory Trusted Domains.
• root-domain
Species an entry point to an Active Directory forest. An initial authentication request will always to
be sent to root domain rst. This setting is required.
222
APM AAA
• trusted-domains
Species a list of AAA Active Directory server components. Trust relationships should be dened for
domains you add into this list. This setting is required.
See Also
active-directory
crldp
Congure a Certicate Revocation List Distribution Point (CRDLP) server object for implementing a
CRLDP authentication module.
Syntax
Congure the crldp component within the aaa module using the syntax shown in the following sections.
Create/Modify
create crldp [name]
modify crldp [name]
address [ip addr]
allow-nullcrl [true | false]
app-service [[string] | none]
base-dn [[string> | none]
cache-expire [[integer] | none]
connection-timeout [[integer] | none]
description [[string> | none]
location-specific [true | false]
pool [name]
port [[integer] | none]
reverse-dn [true | false]
use-issuer [true | false]
use-pool [enabled | disabled]
verify-sig [true | false]
edit crldp | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list crldp
list crldp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
223
Traffic Management Shell (tmsh) Reference Guide
Delete
delete crldp [name]
Description
Congure a CRLDP authentication server, and then assign the server to the CRLDP auth agent in your
access policy.
Examples
• create crldp aaa-ldap-2027 { address 172.27.32.60 allow-nullcrl false base-dn
DC=net,DC=aina,DC=test cache-expire 1000 connection-timeout 15 description none partition
Common pool aaa-ldap-2027-pool port ldap reverse-dn true use-issuer false use-pool disabled
verify-sig true }
Creates a CRLDP server named aaa-ldap-2027.
• delete crldp server my_crldp_server
Deletes the CRLDP server named my_crldp_server.
Options
• address
Species the IP address of the server. This option is required.
• allow-nullcrl
Species whether to consider a null CRL from the CRLDP server a successful authentication. The
default is false.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• base-dn
Species the LDAP base directory name for certicates that specify the CRL distribution point in
directory name (dirName) format. Used when the value of the X509v3 attribute crlDistributionPoints
is of type dirName. In this case, the BIG-IP system attempts to match the value of the crlDistributionPoints
attribute to the Base DN value. An example of a Base DN value is cn=lxxx,dc=f5,dc=com.
• cache-expire
Species (in seconds) an update interval for CRL distribution points. The update interval for distribution
points ensures that CRL status is checked at regular intervals, regardless of the CRL timeout value. This
helps prevent CRL information from becoming outdated before the Access Policy Manager checks the
status of a certicate.
• connection-timeout
Species the number of seconds of inactivity the system allows before the connection times out. The
default is 15.
• description
Species a unique description for the server. The default is none.
• partition
Displays the partition within which the component resides.
224
APM AAA
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• pool
Species the name of the pool with which the server is associated.
• port
Species the CRLDP service port. The default is 389.
• reverse-dn
Species in which order the system is to attempt to match the Base DN value to the value of the X509v3
attribute crlDistributionPoints. Possible values are enabled and disabled. When set to enabled, the system
matches the base DN from left to right, or from the beginning of the DN string, to accomodate dirName
strings in certicates such as C=US,ST=WA,L=SEA,OU=F5,CN=xxx. The default value is false.
• use-issuer
Species whether the CRL distribution point is extracted from the certicate of the client certicate
issuer. The default is false.
• use-pool
Enables or disables high availability between CRLDP servers. When enabled, Access Policy Manager
sends CRLDP authentication requests for the associated CRLDP auth agent to the virtual server, and
standard pool behavior is used to implement high availability for CRDLP.
• verify-sig
Species whether the signature on the received CRL is veried. The default if true.
endpoint-management-system
Manages an integration with a remote Mobile Device Management (MDM) server.
Syntax
Congure the endpoint-management-system component within the aaa module using the syntax shown
in the following sections.
Create/Modify
create endpoint-management-system [name]
type [airwatch | fiberlink]
fqdn [string]
port [port]
serverssl-profile [name]
description [[string] | none]
username [string]
password [string]
mdm-token [[string] | none]
billing-id [[string] | none]
application-id [[string] | none]
access-key [[string] | none]
platform [[string] | none]
225
Traffic Management Shell (tmsh) Reference Guide
app-version [[string] | none]
sync-interval [[integer] | none]
location-specific [true | false]
modify endpoint-management-system [name]
fqdn [string]
port [port]
serverssl-profile [name]
description [[string] | none]
username [string]
password [string]
mdm-token [[string] | none]
billing-id [[string] | none]
application-id [[string] | none]
access-key [[string] | none]
platform [[string] | none]
app-version [[string] | none]
sync-interval [[integer] | none]
location-specific [true | false]
edit endpoint-management-system [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-management-system
list endpoint-management-system [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete endpoint-management-system [name]
Description
You can use the endpoint-management-system component to manage an integration with remote Mobile
Device Management (MDM) server.
Examples
• create endpoint-management-system MyEndpointManagementSystem { type airwatch fqdn
"server01.company.com" port 443 serverssl-prole serverssl username "administrator" password
"!My123Password" mdm-token "token" }
Creates the endpoint management system named MyEndpointManagementSystem with MDM API
URL server01.company.com:port, sets serverssl-prole to serverssl, sets the MDM administrator user
name to administrator and the password to !My123Password, and sets the API token to token.
• delete endpoint-management-system MyEndpointManagementSystem
Deletes the endpoint management system named MyEndpointManagementSystem from the system.
226
APM AAA
Options
• [name]
Species the name for the endpoint management system. This setting is required.
• type
Species the type of endpoint management system: airwatch or berlink. This setting is required.
• fqdn
Species the fully qualied domain name. This setting is required.
• port
Species the port number. Default is 443
• serverssl-prole
Species the server SSL prole. This setting is required.
• description
Species a description for the component. The default is none.
• username
Species the user name of the MDM administrator. This setting is required.
• password
Species the password the MDM administrator uses to log in. This setting is required.
• mdm-token
Species the API token.
• billing-id
Species the billing ID for the user's Fiberlink account.
• application-id
Species the application ID provided by Fiberlink.
• access-key
Species the access key provided by Fiberlink.
• platform
Species the platform version of the Fiberlink console.
• app-version
Species the current version number of the application that corresponds to the account.
• sync-interval
Species the length of time it takes for the synchronization to complete. The default is 240 minutes.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
227
Traffic Management Shell (tmsh) Reference Guide
http
Specify an http server conguration used for authentication.
Syntax
Congure the http component within the aaa module using the syntax shown in the following sections.
Create/Modify
create http [name]
modify http [name]
app-service [[string] | none]
auth-type [form-based | basic-ntlm | custom-post]
content-type [xml-utf8 | url-encoded-utf8 | none]
custom-body [[string] | none]
description [[string] | none]
follow-redirect [integer]
form-action [[string] | none]
form-fields [[string] | none]
form-method [get | post]
form-params [[string] | none]
form-password [[string] | none]
form-username [[string] | none]
headers [add | delete | modify | replace-all-with | none] {
[name] {
app-service [[string] | none]
hname [[string] | none]
hvalue [[string] | none]
}
}
location-specific [true | false]
start-uri [[string] | none]
success-match-type [url | cookie | string | exact-cookie]
success-match-value [[string] | none]
edit http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list http
list http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete http [name]
228
APM AAA
Description
You can use the http component to create and manage AAA HTTP servers.
Examples
• create http myHttpServer { start-uri "http://mycompany.com/" auth-type basic-ntlm }
Creates an HTTP authentication server named "myHttpServer" with a starting URI of
http://mycompany.com.
• delete http myHttpServer
Deletes the myHttpServer AAA HTTP server.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auth-type
Species the type of authentication you want to use.
• form-based
Species the authentication type to be form-based.
• basic-ntlm
Species the authentication type to be basic-ntlm.
• custom-post
Species the authentication type to be custom-post.
• content-type
Species the encoding (xml-utf8, url-encoded-utf8, or none) for an HTTP custom post. If you specify
'none', you must use the headers option to add a custom header. In addition to specifying a custom
header, you must apply your own encoding through an iRule.
• custom-body
Species the body for a HTTP Custom Post.
• description
Species a unique description for the server. The default is none.
• follow-redirect
Species the number of pages away from the landing page the request should travel before failing.
• form-action
Species the complete destination URL to process the form using HTTP form-based authentication.
This is optional. If you do not specify a form action, then Access Policy Manager will use the URI from
the request to perform HTTP form-based authentication.
• form-elds
Species the hidden form parameters that are required by the authentication server logon form at your
location. The default is none. Specify a parameter name, a space, and the parameter value, if any. Multiple
parameters can be congured with each "name value" pair in one line. Use edit to add multiple parameters.
Please note that create and modify do not allow using new line on the terminal.
229
Traffic Management Shell (tmsh) Reference Guide
• form-method
Species the form method you want to use for the form-based HTTP authentication. The value is either
Get or POST. The default is POST. However, if you specify GET, the Access Policy Manager will force
the authentication using HTTP GET rather than perform authentication using form-based POST.
• form-password
Species the parameter names used by the form you are sending the POST request to.
• form-username
Species the parameter names used by the form you are sending the POST request to.
• headers
Species the name and value of the header content to be inserted in an HTTP Post. The options are:
• app-service
Species the name of the application service to which the HTTP header belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the HTTP header. Only the application service can modify or delete the
HTTP header.
• hname
The name of the HTTP header.
• hvalue
The value of the HTTP header.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name of the aaa http server. This option is required.
• partition
Displays the partition within which the component resides. The default is Common.
• start-uri
Species a URL resource, for example, http://plum.tree.lab2.sp.companynet.com/. This resource must
respond with a challenge to a non-authenticated request.
• success-match-type
Species the method your authentication server uses and determines the option denition used for this
eld. The eld toggles according to your selection.
• cookie
Species any string in cookie is required.
• exact-cookie
Species key elds in cookie is required.
• string
Species a specic string is required.
• url
Species a URL is required.
230
APM AAA
• success-match-value
Species the URL, any string in cookie, exact cookie or specic string used for the specic success
match type you see.
kerberos
Congures a Kerberos server.
Syntax
Congure the kerberos component within the aaa module using the syntax shown in the following sections.
Create/Modify
create kerberos [name]
modify kerberos [name]
options
auth-realm [[string] | none]
app-service [[string] | none]
keytab-file-obj [[string] | none]
location-specific [true | false]
service-name [[string] | none]
edit kerberos | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list kerberos
list kerberos [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete kerberos [name]
Description
You can use the kerberos component to create and manage AAA Kerberos servers. Use the Kerberos
authentication server to congure authentication for the Access Policy Manager. A client retrieves credentials
from the domain controller and passes those credentials to the Access Policy Manager. Then Access Policy
Manager uses the value in the keytab-le-obj option of the Kerberos AAA server object to verify the
credentials. Access Policy Manager system does not have to reside in the domain.
231
Traffic Management Shell (tmsh) Reference Guide
Examples
• delete kerberos my_kerberos
Deletes the server named my_kerberos.
Options
• auth-realm
Species a Kerberos auth realm name (administrative name), such as [email protected] to establish the
boundaries within which an authentication server has the authority to authenticate a user, host, or service.
Kerberos clients manually map DNS domain names to Kerberos realm names. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• keytab-le-obj
Species a keytab le that contains the keys (derived from the Kerberos password) that the server uses
to authenticate the client. This option is required.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name of an AAA Kerberos server. This option is required.
• partition
Displays the partition within which the component resides.
• service-name
Species the Kerberos service name dened inside KDC in the format service
name/hostname@kerberosrealm. This option is required, for example, HTTP.
kerberos-keytab-file
Manages a Kerberos keytab le.
Syntax
Congure the kerberos-keytab-le component within the aaa module using the syntax shown in the
following sections.
Create/Modify
create kerberos-keytab-file [name]
modify kerberos-keytab-file [name]
232
APM AAA
app-service [[string] | none]
source-path [string]
edit kerberos-keytab-file | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list kerberos-keytab-file
list kerberos-keytab-file [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete kerberos-keytab-file [name]
Description
You can use the kerberos-keytab-le component to create and manage a Kerberos Keytab le.
Examples
• create kerberos-keytab-le my_keytab { source-path le:/root/apmkeytab }
Creates a Kerberos Keytab le name my_keytab located at root/apmkeytab.
• delete kerberos-keytab-le my_keytab
Deletes the Kerberos Keytab le name my_keytab.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• source-path
Species the location of the Kerberos Keytab le.
• partition
Displays the partition within which the component resides.
See Also
apm aaa kerberos, apm policy agent kerberos
233
Traffic Management Shell (tmsh) Reference Guide
ldap
Manages an AAA LDAP server.
Syntax
Congure the ldap component within the aaa module using the syntax shown in the following sections.
Create/Modify
create ldap [name]
modify ldap [name]
address [[ip addr] | none]
admin-dn [[string] | none]
admin-encrypted-password [[string] | none]
app-service [[string] | none]
base-dn [string]
description [[string] | none]
is-ldaps [false | true]
location-specific [true | false]
pool [name]
port [[service] | none]
schema-attr {
group-member [[string] | none]
group-member-value [[string] | none]
group-memberof [[string] | none]
group-object-class [[string]]
user-memberof [[string] | none]
user-object-class [string]
}
serverssl-profile [none | serverssl | serverssl-insecure-compatible |
wom-default-serverssl]
timeout [integer]
use-pool [enabled | disabled]
edit ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ldap
list ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete ldap [name]
234
APM AAA
Description
You can use the ldap component to create and manage an AAA LDAP server.
Examples
• create ldap MyLDAPserver { address 172.30.6.144 admin-dn
"cn=administrator,cn=users,dc=company,dc=companynet,dc=com" admin-encrypted-password
"!MyPassword" }
Creates the AAA LDAP server named MyLDAPserver that is assigned the IP address 172.30.6.144
and the cn=administrator,cn=users,dc=company,dc=companynet,dc=com admin dn with a password
of !MyPassword.
• delete ldap MyLDAPServer
Deletes the AAA LDAP server named MyLDAPServer from the system.
Options
• address
Species the IP address of an AAA LDAP server. This option is required.
• admin-dn
Species the Container Distinguished Name (DN) to use for authentication. This option is required.
• admin-encrypted-password
Species the password for admin name. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• base-dn
Species the base DN from which to search. This search DN is used to search groups across a whole
directory.
• group-cache-ttl
Species a lifetime for the group cache (days).
• cleanup-cache
Species whether cache invalidation is required. The default is none. The options are:
• none
• group
• description
Species a unique description for the server. The default is none.
• is-ldaps
Species whether to use the LDAPS protocol during authentication. If true, you must also specify the
option serverssl-prole.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
235
Traffic Management Shell (tmsh) Reference Guide
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name of the AAA server. This option is required.
• partition
Displays the partition within which the component resides.
• pool
Species the name of the pool with which the server is associated. The default is none.
• port
Species the port number of the AAA LDAP server. The default is ldap. This option is required.
• schema-attr
Species LDAP schema-specic attribute names.
• user-object-class The value of the objectClass attribute for a user object. The default is "user".
• user-memberof If the user object maintains a group membership, you should specify the membership
attribute name here. The default is "memberOf".
• group-object-class The value of the objectClass attribute for a group object. The default is "group".
• group-memberof If the group object maintains a group membership in other groups, you should
specify a membership attribute name here. The default is "memberOf".
• group-member If the group object maintains a list of users that belong to the group, you should
specify the attribute here. The default is "member".
• group-member-value If the "group-member" attribute is specied, you should specify the attribute
that is used to add users into a group. The default is "dn".
• serverssl-prole
Species the server side SSL prole. LDAPS is achieved by directing LDAP trafc over a virtual server
that uses a server side SSL to communicate with the LDAP server.
The options are:
• serverssl
• serverssl-insecure-compatible
• wom-default-serverssl
• timeout
Species a timeout interval (in seconds) for the AAA server after which the server closes a connection.
The default is 15.
• use-pool
Enables or disables high availability between pool members. When enabled, the Access Policy Manager
sends AAA requests for the associated policy item to the virtual server, and standard pool behavior is
used to implement high availability for CRDLP.
oam
Manages an AAA Oracle Access Manager server.
236
APM AAA
Syntax
Congure the oam component within the aaa module using the syntax shown in the following sections.
Create/Modify
create oam [name]
modify oam [name]
access-server-hostname [[string] | none]
access-server-name [[string] | none]
access-server-port [[integer] | none]
access-server-retries [integer]
accessgate-encrypted-password [[string] | none]
accessgates [add | delete | modify | replace-all-with] {
[name]
}
action [config-accessgate | noop]
admin-id [[string] | none]
admin-password [[string] | none]
app-service [[string] | none]
description [[string] | none]
enable [false | true]
global-access-protocol-passphrase [[string] | none]
location-specific [true | false]
transport-security-mode [cert | open | simple]
edit oam | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list oam
list oam [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete oam [name]
Description
You can use the oam component to create and manage an AAA Oracle Access Manager server.
Examples
• create oam oam10g { access-server-hostname www.localcorp.biz access-server-name accessSrv1
access-server-port 6021 access-server-retries 0 accessgates { oam10gwebgate1 { encrypted-password
[string] } } admin-id rstname.lastname admin-password "[string]"
global-access-protocol-passphrase "[string]" transport-security-mode simple }
237
Traffic Management Shell (tmsh) Reference Guide
Creates the AAA OAM server named oam10g accessing the web gate oam10gwebgate1 on the Access
Server accessSrv1 at host name www.localcorp.biz on port 6021. The server retries connections zero
times.
• delete aaa oam MyOAMServer
Deletes the AAA Oracle Access Manager server named MyOAMServer from the system.
Options
• access-server-hostname
Species the IP address or FQDN of the Oracle Access Manager server. This option is required.
• access-server-name
Species the name of the Oracle Access Manager server. This option is required.
• access-server-port
Species the port of the Oracle Access Manager server. The default is 6021.
• access-server-retries
Specify the number of times you want the access gate to attempt to connect to the Oracle Access Manager
server when the action option is set to cong-accessgate. The default is 0 (zero).
• accessgates
Species the ID of the access gate or web gate on the OAM Server. The system supports the use of
multiple access gates/web gates as long as they are from the same OAM server.
• action
Species the Oracle Access Manager action type. Actions allow you to pass user prole information or
to redirect the user's browser to another site. For more information on Actions, refer to the Access
Administration Guide provided by Oracle. The options are:
• cong-accessgate
Species that you want the system to use the congureAccessGate tool.
• noop
Species "no operation performed." This is the default.
• admin-id
Species the administrator ID required by the Oracle Access Manager server. This option is required.
• admin-password
Species the administrator password required by the Oracle Access Manager server. The default is none.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a unique description for the Oracle Access Manager server. The default is none.
• enable
Species whether you want to enable the server. The default is true.
• global-access-protocol-passphrase
Species a global passphrase for all Oracle components. The default is none.
238
APM AAA
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name of an AAA Oracle Access Manager server. This setting is required.
• transport-security-mode
Species the transport security level for the communication between Oracle components and Access
Policy Manager. The options are:
• open
Communication is not encrypted for protection. Use this mode when security is not an issue
• simple
Communication is encrypted with Oracle Access Manager's internal CA. Simple mode encrypts
communications using Transport Layer Security, RFC 2246 (TLS v1). This mode is less secure than
Cert mode. Use this mode if you have some security concerns but do not want to manage your own
CA.
• cert
Communication is encrypted with an external CA. Use cert mode if you want different certicates
on OAM servers and webgates and you have a trusted 3rd party CA. Oracle Access Manager
components use X.509 digital certicates in PEM format only.
ocsp
Congure Online Certicate System Protocol (OCSP) responder objects.
Syntax
Congure the ocsp component within the aaa module using the syntax shown in the following sections.
Create/Modify
create ocsp [name]
modify ocsp [name]
allow-certs [true | false]
app-service [[string] | none]
ca-file (<file name> | none)
ca-path (<file name> | none)
cert-id-digest (sha1 | md5)
chain [true | false]
check-certs [true | false]
explicit-ocsp [true | false]
ignore-aia [true | false]
intern [true | false]
location-specific [true | false]
nonce [true | false]
sign-digest (sha1 | md5)
sign-key (<file name> | none)
sign-key-passphrase (<string> | none)
239
Traffic Management Shell (tmsh) Reference Guide
sign-other (<file name> | none)
signer (<file name> | none)
status-age <number>
trust-other [true | false]
url (<string> | none)
va-file (<file name> | none)
validity-period <number>
verify [true | false]
verify-cert [true | false]
verify-other (<string> | none)
verif-sig [true | false]
edit ocsp | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ocsp
list ocsp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete ocsp [name]
Description
To implement the SSL OCSP authentication module, create an OCSP responder object and assign it to the
OCSP auth agent in your access policy.
Options
• allow-certs
Species whether the addition of certicates to an OCSP request is enabled. The default is true.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• ca-le
Species the name of the certicate le object containing trusted CA certicates used to verify the
signature on the OCSP response. The default is none.
• ca-path
Species the path to the trusted CA certicates used to verify the signature on the OCSP response. The
default is none.
• cert-id-digest
240
APM AAA
The cert ID digest is part of the OCSP protocol. The OCSP client (in this case, the BIG-IP system)
calculates the cert ID using a hash of the Issuer and serial number for the certicate that it is trying to
verify. The options are:
• sha1
Newer algorithm that provides a higher security level with a 160 bit hash length. This is the default.
• md5
Older algorithm with a 128 bit hash length.
• chain
Species whether the system constructs a chain from certicates in the OCSP response. The default is
true.
• check-certs
Species whether the LTM system makes additional checks to see if the signer's certicate is authorized
to provide the necessary status information. Use this option only for testing purposes. The default is
true.
• explicit-ocsp
Species whether the BIG-IP system explicitly trusts that the OCSP response signer's certicate is
authorized for OCSP response signing. If the signer's certicate does not contain the OCSP signing
extension, setting this option to true causes a response to be untrusted. The default is true.
• ignore-aia
Species whether to ignore the URL contained in the certicate's AIA elds, and to always use the URL
specied by the responder instead. The default is false.
• intern
Species whether to ignore certicates contained in an OCSP response when searching for the signer's
certicate. When you set this option to true, you must also specify the signer's certicate using either
the verify-other or va-le option. The default is true.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a unique name for the component. This option is required.
• nonce
Species whether a nonce will be sent in an OCSP request. When set to false, the request is sent without
a nonce. The default is true.
• partition
Displays the partition within which the OCSP responder object resides.
• sign-digest
Species the algorithm (md5 or sha1> used to sign a request using a signing certicate and key. The
default is sha1. If you use this option, you must also set the sign-key and sign-key-passphrase options.
• sign-key
Species the key used to sign an OCSP request. If you use this option, you must also set the sign-digest
and sign-key-passphrase options. The default is none.
• sign-key-passphrase
241
Traffic Management Shell (tmsh) Reference Guide
Species the passphrase for the signing key. If you use this option, you must also set the sign-digest
and sign-key options. The default is none.
• sign-other
Species additional certicates to add to an OCSP request. The options are default.crt and ca-bundle.crt.
The default is none.
• signer
Species the certicate used to sign an OCSP request. If the certicate is specied but the key is not
specied, then the private key is read from the same le as the certicate. If neither the certicate nor
the key is specied, then the request is not signed. If the certicate is not specied and the key is specied,
then the conguration is considered to be invalid. The default is none.
• status-age
Species the amount of time (in seconds) to compare to the notBefore value of a status response. Use
this option only when a status response does not include the notAfter eld. The default is 0 (zero).
• trust-other
Species whether the BIG-IP system trusts the certicates specied using the verify-other option. The
default is false.
• url
Species the URL used to contact the OCSP service on the responder. This option is required. The
default is none.
• va-le
Species the name of the le containing explicitly-trusted responder certicates. Use this option when
the responder is not covered by the certicates already loaded into the responder's CA store. The default
is none.
• validity-period
Species an acceptable error range in seconds. Use this option when the OCSP responder clock and a
client clock are not synchronized, which could cause a certicate status check to fail. This value must
be a positive number. This option is required. The default is 300.
• verify
Species whether verication of an OCSP response signature or the nonce values is enabled. Use this
option only for debugging purposes. The default is true.
• verify-cert
Species whether the BIG-IP system veries the certicate in the OCSP response. The default is true.
• verify-other
Species the name of the le used to search for an OCSP response signing certicate when the certicate
has been omitted from the response. The default is none.
• verify-sig
Species whether the BIG-IP system checks the signature on the OCSP response. Use this option only
for testing purposes. The default is true.
radius
Manages an AAA RADIUS server.
242
APM AAA
Syntax
Congure the radius component within the aaa module using the syntax shown in the following sections.
Create/Modify
create radius [name]
modify radius [name]
acct-port [integer]
address [[ip addr] | none]
auth-port [integer]
app-service [[string] | none]
description [[string] | none]
mode [acct | auth | both]
nas-ip-address [[ip addr] | none]
nas-ipv6-address [[ip addr] | none]
location-specific [true | false]
pool [[string] | none]
retries [integer]
secret [string]
service-type [default | login | framed | callback-login | callback-framed
| outbound | administrative | nas-prompt | authenticate-only |
callback-nas-promit | call-check | callback-administrative]
timeout [integer]
use-pool [enabled | disabled]
edit radius | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete radius [name]
Description
You can use the radius component to create and manage an AAA RADIUS server.
Examples
• create rad_auth { address 172.30.6.144 secret "test" use-pool "disabled" }
Creates the AAA RADIUS server named rad_auth that has an IP address of 172.30.6.144 and has a
shared secret of test.
• delete radius MyRadiusServer
Deletes the AAA RADIUS server named MyRadiusServer from the system.
243
Traffic Management Shell (tmsh) Reference Guide
Options
• acct-port
Species the port number of the external AAA RADIUS accounting server. The default is radius-acct.
• address
Species the IP address of the AAA RADIUS server. This option is required.
• auth-port
Species the port number for the service. The default is radius. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a unique description for the AAA RADIUS server. The default is none.
• mode
Species the conguration mode you want to use for RADIUS authentication. Note that you cannot
modify the mode once you create the server. The options are:
• acct
Congures the system to perform only RADIUS accounting. Use this option to pass accounting
information about your users to the external RADIUS accounting server.
• auth
Congures the system to perform only RADIUS authentication. Use this option to authenticate your
users through a RADIUS server.
• both
Congures the system to perform both RADIUS authentication and RADIUS accounting
simultaneously.
• [name]
Species the name of an AAA RADIUS server. This option is required.
• nas-ip-address
Species an IP address as RADIUS attribute 4 that you can congure without changing the source IP
address in the IP header of the RADIUS packets. Use this option in situations where you are using an
NAS cluster to be recognized as a single RADIUS client.
• nas-ipv6-address
Species an IPv6 address as RADIUS attribute 4 that you can congure without changing the source
IP address in the IP header of the RADIUS packets. Use this option in situations where you are using
an NAS cluster to be recognized as a single RADIUS client.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• partition
Displays the partition within which the component resides.
• pool
244
APM AAA
Species the name of the pool to which this server belongs. The default is none.
• retries
Species the number of times the BIG-IP system tries to make a connection to the RADIUS AAA server
after the rst attempt fails. The default is 3.
• secret
Species the shared secret password of the AAA RADIUS server. This option is required.
• service-type
Species the type of service used for the RADIUS server. The default is default, which behaves as
authenticate-only.
• timeout
Species a timeout interval (in seconds) for the AAA RADIUS server after which the server closes a
connection. The default is 5.
• use-pool
Enables or disables the use of the pool specied using the pool option. The default is none.
saml
Specify a SAML server conguration used for authentication.
Syntax
Congure the saml component within the aaa module using the syntax shown in the following sections.
Create/Modify
create saml [name]
modify saml [name]
app-service [[string] | none]
assertion-consumer-binding [http-artifact | http-post]
auth-context-methods {
[string]
}
description [[string] | none]
entity-id [string]
force-authn [true | false]
export-metadata [ no-signing | with-signing ]
idp-connectors [add | delete | modify | none | replace-all-with] {
[name] {
idp-matching-source [[string] | none]
idp-matching-value [[string] | none]
}
}
is-authn-request-signed [true | false]
location-specific [true | false]
metadata-cert [[string] | none]
metadata-file [[string] | none]
metadata-signkey [[string] | none]
name-id-policy-allow-create [true | false]
name-id-policy-format [[string] | none]
name-id-policy-sp-name-qualifier [[string] | none]
relay-state [[string] | none]
sp-certificate [[string] | none]
sp-host [[string] | none]
245
Traffic Management Shell (tmsh) Reference Guide
sp-scheme [http | https]
sp-signkey [[string] | none]
want-assertion-encrypted [true | false]
want-assertion-signed [true | false]
edit saml [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list saml
list saml [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml
show running-config saml [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete saml [name]
Description
You can use the saml component to create and manage saml aaa servers.
Examples
• create saml my_saml_server { entity-id "https://spvs1.mycompany.com/id" want-assertion-signed
true want-assertion-encrypted false is-authn-request-signed true sp-certicate my_company.crt
sp-signkey my_company.key}
Creates a SAML authentication server named my_saml_server with certicate my_company.crt and
key my_company.key and security options requiring signed assertion and want to send signed
authentication request.
• list saml
Displays a list of aaa saml servers.
• delete saml my_saml_server
Deletes the my_saml_server aaa saml server.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• assertion-consumer-binding
Species method this BIG-IP as SP uses to receive assertions. Default value is http-post.
246
APM AAA
• auth-context-methods
Species a list of authentication context methods this BIG-IP as SP will request from an IdP. As a
response, the IdP must return an assertion containing one of the requested authentication contexts. Each
value can be a session variable.
• description
Species a unique description for the server. The default is none.
• entity-id
Species a unique identier for BIG-IP as SP. Typically 'entity-id' is a URI that points to the BIG-IP
virtual server that is going to act as SAML SP. In case 'entity-id' is not a valid URL, the sp-host attribute
is required. Examples of valid conguration include "https://mycompany-sp", "sp:my:company", and
"sp.my.company.com".
• force-authn
If enabled, this BIG-IP as SP requests the IdP to authenticate the principal directly rather than rely on
a previous security context.
• export-metadata
You can simplify SAML conguration using metadata les. When you use BIG-IP as an SP, you can
export metadata for an SP to a le. Then you can use the le to congure SP metadata on an IdP system
by importing the le or using the information in the le to congure the SP. You can choose to sign
metadata while exporting it for better security.
For example:
1. Exporting metadata with signing. This requires metadata-cert and metadata-signkey les.
modify saml aaa_obj {export-metadata with-signing metadata-file
/shared/sp_signed_metadata.xml metadata-cert default.crt metadata-signkey
default.key}
2. Exporting metadata with no signing.
modify saml aaa_obj {export-metadata no-signing metadata-file
/shared/sp_metadata.xml}
• idp-connectors
Add one or more IdP connectors to this SP service. BIG-IP SP redirect users to associated IdPs for
authentication. If more IdP connectors associated with the SP, BIG-IP SP selects one of the IdP based
on the specied selection criteria.
For example:
1. The following command associates one IdP connect to an SP
modify saml my_saml_server idp-connectors add { my_idp_connector1 }
247
Traffic Management Shell (tmsh) Reference Guide
2. Following associates multiple IdP connectors to SP with selection criteria based on landing URI. If
the landing URI is /google, the user is sent to IdP as specied by my_idp_connector_google_app and
if the landing URI is /salesforce, the user is sent to IdP as specied by my_idp_connector_for_salesforce.
modify saml my_saml_server idp-connectors add { my_idp_connector_google_app
{ idp-matching-source "%{session.server.landinguri}" idp-matching-value
"/*google" } my_idp_connector_for_salesforce { idp-matching-source
"%{session.server.landinguri}" idp-matching-value "/salesforce"}}
• is-authn-request-signed
This property species whether the SP signs authentication requests while sending them to the IdP. Set
it to true if this BIG-IP SP should sign authentication requests. The default value for this is false.
• location-specic
Objects of this class might have location specic attributes. Admin can indicate if object is location
specic by setting it to true.
• metadata-cert
Species the certicate with public key of the key pair used in signing the metadata. See export-metadata
for more information on metadata export functionality. This is the certicate to be included in signed
metadata when we export metadata. This might or might not be SP certicate.
• metadata-le
Species the le to which metadata is saved. See export-metadata for more information on metadata
export functionality.
• metadata-signkey
Species the key that is used to sign SP's metadata. See export-metadata for more information on
metadata export functionality.
• name-id-policy-allow-create
A Boolean value used to indicate whether external IdP is allowed, when processing requests from this
BIG-IP as SP, to create a new identier to represent the principal. Default value is false
• name-id-policy-format
A URI reference representing the classication of string-based identier information. For example, if
a Service Provider (SP) initiates SSO by sending an AuthnRequest to the IDP with format
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", then the IdP response should contain
subject identity in email format. This attribute can be a session variable.
• name-id-policy-sp-name-qualier
Optionally species that the assertion subject's identier be returned in the namespace of an SP other
than the requester, or in the namespace of a SAML afliation group of SPs. This attribute can be a
session variable.
• relay-state
Species the value where the BIG-IP as SP redirects users after they are successfully authenticated and
have been allowed by access policy. When BIG-IP receives the relay state from the IdP in addition to
assertion, then it uses the value received from IdP to redirect the user to after authentication. Otherwise,
BIG-IP uses the value from this conguration.
• sp-certicate
BIG-IP includes this certicate in the SAML SP metadata that you export. After the SAML SP metadata
is imported on the IdP, the IdP can use this certicate to verify signed authentication request and to
encrypt assertion.
248
APM AAA
• sp-host
Hostname of this BIG-IP as SP. This attribute is required when "entity-id" is not a valid URL.
• sp-scheme
Scheme used by this BIG-IP as SP. This attribute is only used when sp-host is not empty. Default value
is https.
• sp-signkey
This species the private key used to sign authentication requests if "is-authn-request-signed property"
is set to true or to decrypt assertions when "want-assertion-encrypted" is set to true.
• want-assertion-encrypted
This property species whether SP requires encrypted assertions. Set it to true if this BIG-IP SP requires
encrypted assertions from the SAML IdP. The default value for this is false.
• want-assertion-signed
This property species whether SP requires signed assertions. Set it to true if this BIG-IP SP requires
signed assertions from the SAML IdP. The default value for this is true.
saml-idp-connector
Specify saml idp connector conguration used for SAML authentication.
Syntax
Congure the saml-idp-connector component within the aaa module using the syntax shown in the following
sections.
Create/Modify
create saml-idp-connector [name]
modify saml-idp-connector [name]
app-service [[string] | none]
artifact-resolution-service-addr [IP address]
artifact-resolution-service-port [integer]
artifact-resolution-service-url [[string] | none]
basic-auth-password [[string] | none]
basic-auth-username [[string] | none]
description [[string] | none]
entity-id [string]
identity-location [attribute | subject]
identity-location-attribute [[string] | none]
idp-certificate [[string] | none]
import-metadata [[metadata-file] | none]
location-specific [ true | false ]
metadata-cert [[string] | none]
serverssl-profile-name [profile name | none]
sign-artifact-resolution-rq [true | false]
single-logout-binding
single-logout-response-uri [[string] | none]
single-logout-uri [[string] | none]
sso-binding [http-post | http-redirect]
sso-uri [[string] | none]
249
Traffic Management Shell (tmsh) Reference Guide
want-authn-request-signed [true | false]
want-detached-signature [true | false]
edit saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list saml-idp-connector
list saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml-idp-connector
show running-config saml-idp-connector [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete saml-idp-connector [name]
Description
You can use the saml-idp-connector to create and manage saml idp connectors.
Examples
• create saml-idp-connector my_idp_connector { import-metadata /shared/tmp/meta_data_idp.xml}
Creates saml idp connector named my_idp_connector from metadata. In this example
"/shared/tmp/meta_data_idp.xml" is a le containing saml identity provider metadata.
• create saml-idp-connector my_idp_connector1 { entity-id "https://www.secureauth.com/dom1"
identity-location subject sso-binding http-post sso-uri "https://www.secureauth.com/dom1/acs/"
idp-certicate my_company.crt}
Creates a saml idp connector named my_idp_connector1 with certicate "my_company.crt" with
identity-location "subject".
• list saml-idp-connector
Displays a list of saml idp connectors.
• delete saml-idp-connector my_idp_connector
Deletes the my_idp_connector saml idp connector.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• artifact-resolution-service-addr
250
APM AAA
Species the IP address that this BIG-IP as SP will use to connect to the IdP artifact resolution service.
Value must be a valid IPv4 or IPv6 address.
• artifact-resolution-service-port
Species the port that this BIG-IP as SP will use to connect to the IdP artifact resolution service.
• artifact-resolution-service-url
Species the URI of the IdP artifact resolution service. The URI must include protocol, hostname, and
full path.
• basic-auth-password
Species the password for basic authentication. When congured, basic authentication is used for the
artifact resolve request sent to the IdP.
• basic-auth-username
Species username for basic authentication. When congured, basic authentication is used for the artifact
resolve request sent to the IdP.
• description
Species a unique description for the saml idp connector. The default is none.
• entity-id
Species unique URI to represent the IdP pointed by idp connector.
• identity-location
Species location of user identity inside SAML assertion. It can be either one of the attributes or the
subject.
• identity-location-attribute
If the location of user identity is set to attribute then attribute name should be specied as part of this
attribute.
• idp-certicate
This is IdP's certicate and is used by BIG-IP as SP to verify the signature of the assertion.
• import-metadata
This attribute species the metadata le from an external IdP system used for creating idp connector
object.
For example: create saml-idp-connector my_idp_connector { import-metadata
/shared/tmp/meta_data_idp.xml}
• location-specic
Objects of this class might have location specic attribute(s). Admin can indicate if object is location
specic by setting it to true.
• metadata-cert
This species the certicate to use to verify the signature of metadata imported from a le.
For example: create saml-idp-connector my_idp_connector2 {import-metadata
/shared/tmp/meta_data_signed_idp.xml metadata-cert default.crt}
• serverssl-prole-name
Species the SSL prole used when this BIG-IP as SP connects to the IdP artifact resolution service.
• sign-artifact-resolution-rq
Species whether the IdP requires artifact resolve requests to be signed. Default value is true.
• single-logout-binding
251
Traffic Management Shell (tmsh) Reference Guide
This attribute is reserved for future functionality.
• single-logout-response-uri
A URI where this BIG-IP as SP will send single logout (SLO) responses.
• single-logout-uri
A URI where this BIG-IP as SP will send single logout (SLO) requests.
• sso-binding
This species the method the IdP uses to receive authentication request from BIG-IP as SP. Default
value is http-post
• sso-uri
This species the URL of IdP's SSO service where BIG-IP as SP sends an authentication request to IdP.
• want-authn-request-signed
This property species whether IdP requires signed authentication request. Set it to true if this BIG-IP
as SP is required to send signed authentication request to IdP. Default value is false.
• want-detached-signature
This property species signature type for messages sent by BIG-IP via HTTP Redirect binding. To use
detached signatures set this property to true. Enveloped signatures are used by default.
securid
Manages an RSA SecurID authentication server.
Syntax
Congure the securid component within the aaa module using the syntax shown in the following sections.
Create/Modify
create securid [name]
modify securid [name]
app-service [[string] | none]
config-files [[string]| none]
description [[string]| none]
location-specific [true | false]
source-ip [ip addr]
edit securid | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list securid
list securid [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
252
APM AAA
non-default-properties
one-line
partition
Delete
delete securid [name]
Description
You can use the securid component to create and manage an RSA SecurID authentication server.
Examples
• create securid mySecuridServer { cong-les add { sdconf.rec { local-path /shared/tmp/1 } }
source-ip 172.31.54.138 }
Creates the mySecuridServer AAA RSA SecurID server.
• list securid all
Displays a list of AAA RSA SecurID servers on the system.
• delete securid mySecuridServer
Deletes the mySecuridServer AAA RSA SecurID server from the system.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• cong-les
Species which les to use for SecurID authentication. Upload a copy of the sdconf.rec le from your
RSA Authentication Manager server.
• description
Species a description for the conguration le you are uploading.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• source-ip
Species the source IP address of the RSA SecurID agent. This option is required when authenticating
to the RSA Authentication Manager server.
• partition
Displays the partition within which the component resides.
253
Traffic Management Shell (tmsh) Reference Guide
tacacsplus
Congure a TACACS+ server for implementing remote TACACS+-based client authentication.
Syntax
Congure the tacacsplus component within the apm aaa module using the syntax shown in the following
sections.
Create/Modify
create tacacsplus
modify tacacsplus
address [ip addr]
auth-service [arap | enable | fwproxy | login | nasi | none | ppp | pt |
rcmd | x25]
auth-type [arap | ascii | chap | mschap | pap]
app-service [[string] | none]
description [[string]| none]
encrypt [enabled | disabled]
location-specific [true | false]
pool [[string]| none]
port [[string]| none]
priv-lvl [max | min | user]
protocol [atalk | deccp | ftp | http | ip | ipx | lat | lcp | osicp | pad
| rlogin | telnet | tn3270 | unknown | vines | vpdn | xremote]
secret [[string]| none]
service [none | arap | connection | firewall | ppp | shell | slip | system
| tty-daemon]
use-pool [[string]| none]
edit tacacsplus | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tacacsplus
list tacacsplus [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete tacacsplus [name]
Description
You can use the tacacsplus component to create and manage a TACACS+ authentication server.
254
APM AAA
Examples
• create tacacsplus mytacacs auth-service enable encrypt enabled
Creates a TACACS server named mytacacs with encryption enabled.
Options
• address
Species the IP address of the TACACS+ server. This option is required.
• auth-service
Species the name of the service that the user is requesting to be authenticated to use. This enables the
TACACS+ server to behave differently for different types of authentication requests. This option is
required.
• auth-type
Species the type of authentication to be used for authenticating the user.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a unique description for the component. The default is none.
• encrypt
Enables or disables encryption of TACACS+ packets. Recommended for normal use. The default is
enabled.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name of an AAA TACACS+ server. This option is required.
• partition
Displays the partition within which the component resides.
• pool
Species the name of the pool to which this server belongs. The default is none.
• port
Species the port number of the server. The default is 49.
• priv-lvl
Species the privilege level at which the user is authenticating. The options are:
• max
• min
This is the default.
• user
255
Traffic Management Shell (tmsh) Reference Guide
• protocol
Species the protocol associated with the value specied in the service option, which is a subset of the
associated service being used for client authorization or system accounting. The default is unknown.
• secret
Sets the secret key used to encrypt and decrypt packets sent or received from the server. This option is
required.
• service
• use-pool
Enables or disables the use of the pool specied using the pool option. The default is none.
256
APM AAA
APM EPSEC
epsec-package
Manages an EPSEC package.
Syntax
Congure the epsec-package component within the apm epsec module using the syntax shown in the
following sections.
Create
create epsec-package
local-path [string]
server [[string] | none]
Display
list epsec-package
all-properties
non-default-properties
recursive
list epsec-package [name]
Install
install epsec-package [name]
device-group [string]
Delete
delete epsec-package [name]
Description
You can use the epsec-package component to create, install and manage an EPSEC package.
Examples
• create epsec-package my_epsec_package local-path /tmp/my_epsec_package
Creates an EPSEC package named my_epsec_package under the /Common/EPSEC/Upload folder.
• list epsec-package
Displays a list of EPSEC packages under the specic folder. To list all EPSEC packages use the recursive
option.
• install epsec-package my_epsec_package
Installs the EPSEC package named my_epsec_package on this device. You cannot install a package
from the /Common folder as it is a pre-installed package.
• install epsec-package my_epsec_package device-group /Common/my_epsec_dg
Installs the EPSEC package named my_epsec_package on the devices in the device group
/Common/my_epsec_dg. You cannot install a package from the /Common folder as it is a pre-installed
package.
• delete epsec-package my_epsec_package
Deletes the EPSEC package named my_epsec_package.
Options
• [name]
Species the name of the component. This option is required.
• local-path
Species the local path of the package to be uploaded. This option is valid only with CREATE command
and is a required option.
• device-group
Species the device group on which the package will be installed. This option is valid only with INSTALL
command
software-status
Displays the status of the EPSEC software installation.
Syntax
Display information about the software-status component within the apm epsec module using the following
syntax.
Display
show software-status
Description
You can use the software-status component to display the status of the EPSEC software installation,
including the version of the EPSEC package being installed and the OESIS software version.
Examples
show software-status
Displays the status of the EPSEC software installation in a table.
258
APM EPSEC
APM NTLM
machine-account
Congures an APM NTLM machine account object.
Syntax
Congure the ntlm machine account using the syntax shown in the following sections.
Create/Modify
create machine-account [name]
action [noop]
administrator-name [[string] | none]
administrator-password [[string] | none]
app-service [[string] | none]
domain-controller-fqdn [fqdn]
domain-fqdn [fqdn]
machine-account-name [[string] | none]
modify machine-account [name]
action [change-password | noop]
app-service [[string] | none]
domain-controller-fqdn [fqdn]
edit machine-account [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list machine-account
list machine-account [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete machine-account [name]
Description
You can use the machine-account component to congure a NTLM machine account.
Examples
• create machine-account myaccount { machine-account-name "my_account_name" domain-fqdn
"company.com" domain-controller-fqdn "server01.company.com" administrator-name
"administrator" administrator-password "!My123Password" }
Creates a NTLM machine account named myaccount in the company.com domain, with domain
controller server01.company.com, administrator name administrator and administrator password
!My123Password.
• list machine-account
Displays a list of all NTLM machine accounts created on the system.
• delete machine-account myaccount
Deletes the NTLM machine account named myaccount the system.
Options
• machine-account-name
Species the name of the machine account.
• domain-fqdn
Species the Fully Qualied Domain Name. This setting is required.
• domain-controller
Species the Fully Qualied Domain Name (FQDN) of the domain controller for the domain specied
in the domain-fqdn option. The default is none.
• administrator-name
Species the name of a user that has administrative permissions on an Active Directory server. This
setting is required only when a new machine account is being created.
• administrator-password
Species the password associated with administrator-name. This setting is required only when a new
machine account is being created.
• action
Species the action type. To change the machine account password, type this action: change-password
else noop
• change-password
Species that you want to change the machine account password.
• noop
Species "no operation performed". This is the default.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
See Also
ntlm-auth
262
APM NTLM
ntlm-auth
Congures an APM NTLM authentication object.
Syntax
Congure the ntlm-auth using the syntax shown in the following sections.
Create/Modify
create ntlm-auth [name]
app-service [[string] | none]
dc-fqdn-list [add | delete | modify | replace-all-with] {
[[string]]
}
machine-account-name [[string] | none]
modify ntlm-auth [name]
app-service [[string] | none]
dc-fqdn-list [add | delete | modify | replace-all-with] {
[[string]]
}
machine-account-name [[string] | none]
edit ntlm-auth [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ntlm-auth
list ntlm-auth [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete ntlm-auth [name]
Description
You can use the ntlm-auth component to congure an NTLM authentication object.
Examples
• create ntlm-auth myaccount { dc-fqdn-list add { server01.company.com } machine-account-name
"my_account" }
Creates a NTLM authentication object named myaccount with machine account my_account, and the
list of domain controllers specied by dc-fqdn-list
• list ntlm-auth
263
Traffic Management Shell (tmsh) Reference Guide
Displays a list of all NTLM authentication objects created on the system.
• delete ntlm-auth myaccount
Deletes the NTLM authentication object named myaccount from the system.
Options
• dc-fqdn-list
Species a list of Fully Qualied Domain Names (FQDNs) for the domain controllers to use for NTLM
authentication.
• machine-account-name
Species the NTLM machine account object name to use for this NTLM authentication
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
See Also
machine-account
264
APM NTLM
APM Policy
access-policy
Manages an access policy.
Syntax
Warning: F5 Networks recommends that you use the visual policy editor in the Conguration utility to
create and manage access policies.
customization-group
Manages a customization group.
Syntax
Warning: F5 Networks recommends that you use the Conguration utility to create and manage
customization groups.
See Also
apm policy agent, apm prole
image-file
Manages a le that contains an image.
Syntax
Warning: F5 Networks recommends that you use the Conguration utility to create and manage image
les.
See Also
apm policy agent, apm prole
policy-item
Manages an access policy item.
Syntax
Warning: F5 Networks recommends that you use the visual policy editor in the Conguration utility to
create and manage access policy items.
windows-group-policy-file
Manages FullArmor GPAnywhere Windows group policy les.
Syntax
Warning: This page is obsolete. Windows Group Policy is no longer supported.
Warning: F5 Networks recommends that you use the visual policy editor in the Conguration utility to
create and manage FullArmor GPAnywhere Windows group policy les.
266
APM Policy
APM Policy Agent
aaa-active-directory
Manages an AAA Active Directory(r) agent.
Syntax
Congure the aaa-active-directory component within the policy agent module using the following syntax.
Create/Modify
create aaa-active-directory [name]
modify aaa-active-directory [name]
options
app-service [[string] | none]
auth-max-logon-attempt [integer]
fetch-nested-groups [true | false]
fetch-primary-groups [true | false]
hints [true | false]
query-attrname [[string] | none]
query-filter [[string] | none]
server [[string] | none]
trusted-domains [[string | none]]
show-extended-error [true | false]
type [query | auth | last]
upn [true | false]
Display
list aaa-ldap
list aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-ldap
show running-config aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-active-directory ([name] | all)
Description
You can use the aaa-active-directory component to congure an AAA Active Directory agent.
Examples
• create aaa-active-directory MyADQueryagent {query-lter "(be
sAMAccountName=%{session.logon.last.username})" type query server "companyAD" }
Creates the query type AAA Active Directory agent named MyADQueryagent that uses the (be
sAMAccountName=%{session.logon.last.username}) lter and the companyAD AAA AD Server.
• create agent aaa active MyADAuthagent { type auth server "companyAD" }
Creates the authorization type AAA Active Directory agent named MyADAuthagent that uses the
companyAD AAA AD server.
• list aaa-active-directory all
Displays a list of AAA Active Directory agents and their properties.
• delete aaa-active-directory MyADagent
Deletes the MyADagent AAA Active Directory agent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auth-max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• fetch-nested-groups
When enabled, the system administrator can retrieve the full list of groups that user belongs to, even if
the retrieval privileges are nested through other groups to which the user belongs to directly. The default
value is false.
• fetch-primary-groups
When enabled, the system administrator can retrieve the primary group of a user, and use that name as
a group in access policy item rules. The default value is false.
• hints
When enabled, the system offers the user an option to create a hint that assists in remembering a password.
The default value is false.
• query-attrname
Species the attribute name that you are adding or deleting for the agent.
• query-lter
Species the search criteria the system uses when querying an AAA Active Directory(r) server for
authentication information. The system supports session variables as part of search query string.
• [name]
Species the name of an AAA Active Directory agent. This setting is required.
• partition
Displays the partition within which the component resides.
268
APM Policy Agent
• server
Species an AAA Active Directory server the system uses for Active Directory queries and authentication.
• server
Species an AAA Active Directory Trusted Domains object that the system uses for Active Directory
queries and authentication. This option requires upn option to be enabled
• show-extended-error
Species to display a verbose error message. The default value is false.
• type
Species the type of AAA Active Directory agent. The default value is last.
• query
Species that the agent makes a query against the AAA Active Directory Server to retrieve information
in accordance with the query-lter and query-attributes options.
• auth
Species that the agent is an authentication agent only. It uses the AAA Active Directory Server,
but only for authentication purposes. APM does not get any information from the Domain.
• last
• upn
When enabled, APM supports the user principal name (UPN) naming style and process cross-domain
and user@domain. The default value is false.
See Also
tmsh
aaa-client-cert
Manages an AAA Client Certication agent.
Syntax
Congure the aaa-client-cert component within the policy-agent module using the following syntax.
Create/Modify
modify aaa-client-cert [name]
create aaa-client-cert [name]
app-service [[string] | none]
mode [request | require]
Display
list aaa-client-cert
list aaa-client-cert [ [ [name] | [glob] | [regex] ] ... ]
269
Traffic Management Shell (tmsh) Reference Guide
show running-config aaa-client-cert
show running-config aaa-client-cert [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-client-cert [name]
Description
You can use this component to congure an AAA Client Certication agent.
Examples
• create aaa-client-cert MyCCagent
Creates the AAA Client Certication agent named MyCCagent in the Common partition.
• list aaa-client-cert all
Displays a list of AAA Client Certication agents.
• delete aaa-client-cert MyCCagent
Deletes the MyCCagent AAA Client Certication agent.
Options
• [name]
Species the name of an AAA client cert agent. This setting is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• mode
Species the mode (request/require) for this certicate. The options are:
• request
Species that the system requests a valid certicate from a client, but always authenticates the client.
• require
Species that the system requires a client to present a valid certicate.
• partition
Displays the partition within which the component resides.
See Also
tmsh
270
APM Policy Agent
aaa-crldp
Manages an AAA CRLDP (Constraint-Based Routed Label Distributed Protocol) agent.
Syntax
Congure the aaa-crldp component within the policy agent module using the following syntax.
Create/Modify
create aaa-crldp [name]
modify aaa-crldp [name]
app-service [[string] | none]
server (<string> | none)
Display
list aaa-crldp
list aaa-crldp [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-crldp
show running-config aaa-crldp [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete aaa-crldp [name]
Description
You can use the aaa-crldp component to create and manage an AAA CRLDP agent.
Examples
• create aaa-crldp MyCCagent
Creates an AAA CRLDP agent named MyCCagent in the Common partition.
• list aaa-crldp all
Displays a list of AAA CRLDP agents.
• delete aaa-crldp MyCCagent
Deletes the MyCCagent AAA CRLDP agent.
Options
• [name]
271
Traffic Management Shell (tmsh) Reference Guide
Species the name of an agent that you want to display or delete. This setting is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• server
Species the name of the server on which this agent resides. This option is required.
See Also
tmsh
aaa-http
Manages an AAA HTTP agent.
Syntax
Congure the aaa-http component within the policy agent module using the following syntax.
Create/Modify
create aaa-http [name]
modify aaa-http [name]
options
app-service [[string] | none]
max-logon-attempt [integer]
server [[string] | none]
Display
list aaa-http
list aaa-http [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-http
show running-config aaa-http [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-http [name]
272
APM Policy Agent
Description
You can use the aaa-http component to congure an AAA HTTP agent.
Examples
• create aaa-http MyCCagent
Creates the aaa-http agent named MyCCagent in the Common partition.
• list all aaa-http
Displays a list of aaa-http agents.
• delete aaa-http MyCCagent
Deletes the MyCCagent aaa-http agent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• [name]
Species the name of an AAA HTTP agent. This setting is required.
• partition
Displays the partition within which the component resides.
• server
Species which AAA HTTP server the system uses for Active Directory queries and authentication.
See Also
tmsh
aaa-ldap
Manages an AAA LDAP(r) agent.
Syntax
Congure the aaa-ldap component within the policy agent module using the following syntax.
273
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create aaa-ldap [name]
modify aaa-ldap [name]
app-service [[string] | none]
attr-name (<string list> | none) [add | delete]
filter [[string] | none]
group-member-scope [none | direct | all]
group-membership-scope [none | direct | all]
max-logon-attempt [integer]
search-dn [[string] | none]
server [[string] | none]
show-extended-error [true | false]
type [query | auth | modify | last]
user-dn [[string] | none]
modify-type [add | modify | delete | modify-last]
ldapmod-attributes (<ldapmod attribute list> | none) [add | delete]
Display
list aaa-ldap
list aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-ldap
show running-config aaa-ldap [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-ldap [name]
Description
Use this component to create, modify, display, or delete an AAA LDAP agent.
Examples
• create aaa-ldap MyLDAPagent { user-dn
"cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type auth server
"companyLDAP" } aaa-ldap MyLDAPagent { search-dn "cn=users,dc=lab,dc=fp,dc=com" lter
"(SAMAccountName=%{{session.logon.last.username})" type auth server "companyLDAP" }
Creates the authorization type AAA LDAP agent named MyLDAPagent that is associated with the
companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name,
the cn=users,dc=lab,dc=fp,dc=com search domain, and the
(SAMAccountName=%{{session.logon.last.username}) lter.
• create aaa-ldap MyLDAPagent { search-dn "cn=users,dc=lab,dc=fp,dc=com" lter
"(sAMAccountName=%{{session.logon.last.username})" type query server "companyLDAP" }
274
APM Policy Agent
Creates the query type AAA LDAP agent named MyLDAPagent that is associated with the
companyLDAP server that uses the cn=users,dc=lab,dc=fp,dc=com search domain and the
(SAMAccountName=%{{session.logon.last.username}) lter.
• create aaa-ldap MyLDAPagent { user-dn
"cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type modify modify-type
add server "companyLDAP" ldapmod-attributes add { objectClass { mod-op add mod-values add
{ top person organizationalPerson user } } cn { mod-op add mod-values add { demo } } } }
Creates the modify type AAA LDAP agent named MyLDAPagent that is associated with the
companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name,
the add modify type, and the ldapmod attributes
• create aaa-ldap MyLDAPagent { user-dn
"cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type modify modify-type
modify server "companyLDAP" ldapmod-attributes add { givenName { mod-op replace mod-values
add { demo } } } }
Creates the modify type AAA LDAP agent named MyLDAPagent that is associated with the
companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name,
the modify modify type, and the ldapmod attributes which uses givenName modify attribute replace
mod operation and the demo mod values
• create aaa-ldap MyLDAPagent { user-dn
"cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=com" type modify modify-type
delete server "companyLDAP" }
Creates the modify type AAA LDAP agent named MyLDAPagent that is associated with the
companyLDAP server that uses the
cn=%{session.logon.last.username},cn=users,dc=lab,dc=fp,dc=f5net,dc=com user domain name,
the delete modify type
• list aaa-ldap
Displays a list of AAA LDAP agents.
• delete aaa-ldap MyLDAPagent
Deletes the MyLDAPagent AAA LDAP agent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• attr-name
Adds an attribute name to the agent or deletes an attribute name from the agent.
• group-member-scope
Species the scope of user lookup for a group. When the search returns a group, this attribute species
whether to also look up the members of the group. The options are:
• none No members required.
• direct Only direct members required.
• all All members required. This includes those that derive membership in this group through
membership in other groups and those that are direct members.
275
Traffic Management Shell (tmsh) Reference Guide
• group-membership-scope
Species the scope of group lookup for a user or a group. When the search returns a user or a group,
this attribute species whether to also look up the groups to which this user or group belong. The options
are:
• none No groups required.
• direct Only the groups to which the current user or group belong directly are required.
• all All groups required. This includes the groups to which the user or the group belong directly and
the groups to which the user or group belong indirectly (through membership in another group).
• lter
Species the LDAP lter that APM uses when querying an AAA LDAP server for authentication
information. You must use the lter option with the search-dn option.
• max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• [name]
Species the name of an AAA LDAP agent. This setting is required.
• partition
Displays the partition within which the component resides.
• search-dn
Species the base domain name that APM uses for internal LDAP search operations. You must use the
search-dn option with the lter option.
• server
Species the AAA LDAP server that the system uses for LDAP queries and authentication.
• show-extended-error
Species to display a verbose error message. The default value is false.
• type
Species a type of AAA LDAP agent. This setting is required. The default is last.
• user-dn
Species the fully qualied domain name of the Access Policy Manager. F5 Networks recommends
that you specify this value in lower case and without spaces for compatibility with some specic LDAP
servers. The specic content of this string depends on your directory layout.
See Also
tmsh
aaa-ocsp
Manages an AAA OCSP (Online Certicate Status Protocol) agent.
276
APM Policy Agent
Syntax
Congure the aaa-ocsp component within the policy agent module using the following syntax.
Create/Modify
create aaa-ocsp [name]
modify aaa-ocsp [name]
app-service [[string] | none]
certificate-type <user | machine>
ocsp-responder <string>
Display
list aaa-ocsp
list aaa-ocsp [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-ocsp
show running-config aaa-ocsp [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-ocsp [name]
Description
Use this command to create, modify, display, or delete an AAA OCSP agent.
Examples
• create aaa-ocsp MyCCagent
Creates the AAA OCSP agent named MyCCagent in the Common partition.
• list aaa-ocsp all
Displays a list of AAA OCSP agents.
• delete aaa-ocsp MyCCagent
Deletes the MyCCagent AAA OCSP agent.
Options
• [name]
Species the name of an agent that you want to display or delete. This setting is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
277
Traffic Management Shell (tmsh) Reference Guide
• certicate-type
Species the type of certicate to check against OCSP responder. The value can be either user or
machine. The default value is user.
• ocsp-responder
Species which OCSP responder object to use to validate a certicate.
• partition
Displays the partition within which the object resides.
aaa-radius
Manages an AAA RADIUS agent.
Syntax
Congure the aaa-radius component within the policy agent module using the following syntax.
Create/Modify
create aaa-radius [name]
modify aaa-radius [name]
app-service [[string] | none]
max-logon-attempt <number>
server (<string> | none)
show-extended-error (true | false)
Display
list aaa-radius
list aaa-radius [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-radius
show running-config aaa-radius [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-radius [name]
Description
Use this command to create, modify, display, or delete an AAA RADIUS agent.
Examples
• create aaa-radius Myradiusagent {server "companyradius"}
278
APM Policy Agent
Creates an AAA RADIUS agent named Myradiusagent that is associated with the companyradius
server.
• list aaa-radius
Displays a list of AAA RADIUS agents.
• delete aaa-radius Myradiusagent
Deletes the Myradiusagent AAA RADIUS agent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• [name]
Species the name of an aaa radius agent. This setting is required.
• partition
Displays the partition within which the object resides.
• server
Species the AAA RADIUS server that the system uses for RADIUS queries and authentication.
• show-extended-error
Species to display a verbose error message. The default value is false.
See Also
tmsh
aaa-securid
Manages an AAA SecurID agent.
Syntax
Congure the aaa-securid component within the policy agent module using the following syntax.
Create/Modify
create aaa-securid [name]
modify aaa-securid [name]
app-service [[string] | none]
max-logon-attempt [integer]
279
Traffic Management Shell (tmsh) Reference Guide
server [[string] | none]
show-extended-error [true | false]
edit aaa-securid | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list aaa-securid
list aaa-securid [ [ [name] | [glob] | [regex] ] ... ]
show running-config aaa-securid
show running-config aaa-securid [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
Delete
delete aaa-securid [name]
Description
You can use the aaa-securid component to create and manage an AAA SecurID agent.
Examples
• create aaa-securid mySecuridAgent { server rsa1_106 }
Creates an AAA SecurID agent named mySecuridAgent that is associated to AAA RSA Server rsa1_106.
• list all aaa-securid
Displays a list of AAA SecurID agents.
• delete aaa-securid MyCCagent
Deletes the MyCCagent AAA Client Certication agent.
Options
• [name]
Species the name of an agent that you want to display or delete. This setting is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• max-logon-attempt
280
APM Policy Agent
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• server
Species the AAA RSA SecurID server that the system uses for LDAP queries and authentication.
• show-extended-error
Species to display a verbose error message. The default value is false.
See Also
tmsh
acct-radius
Manages a RADIUS Account agent.
Syntax
Congure the acct-radius component within the policy agent module using the following syntax.
Create/Modify
create acct-radius [name]
modify acct-radius [name]
app-service [[string] | none]
server [[string] | none]
edit acct-radius | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list acct-radius
list acct-radius [ [ [name] | [glob] | [regex] ] ... ]
show running-config acct-radius
show running-config acct-radius [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
one-line
app-service
partition
281
Traffic Management Shell (tmsh) Reference Guide
Delete
delete acct-radius [name]
Description
You can use the acct-radius component to create and manage an RADIUS Account agent.
Examples
• create acct-radius MyRADIUSagent { server "MyRADIUS" }
Creates the MyRADIUSagent RADIUS Account agent that is associated with the MyRADIUS server.
• list acct-radius
Displays a list of RADIUS Account agents and the servers associated with the agents.
• delete acct-radius MyRADIUSagent
Deletes the MyRADIUSagent RADIUS Account agent.
Options
• [name]
Species the name of an RADIUS Account server. This setting is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• server
Species an RADIUS Account server the system uses for RADIUS queries and authentication. This
option is required.
See Also
tmsh
acct-tacacsplus
Manages a TACACS+(r) Account agent.
Syntax
Congure the acct-tacacsplus component within the policy agent module using the following syntax.
282
APM Policy Agent
Create/Modify
create acct-tacacsplus [name]
modify acct-tacacsplus [name]
options
app-service [[string] | none]
server [[string] | none]
Display
list acct-tacacsplus
list acct-tacacsplus [ [ [name] | [glob] | [regex] ] ... ]
show running-config acct-tacacsplus
show running-config acct-tacacsplus [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
current-module
non-default-properties
app-service
partition
Delete
delete acct-tacacsplus [name]
Description
You can use the acct-tacacsplus component to congure a TACACS+ Account agent.
Examples
• create acct-tacacsplus MyADQueryagent { server "companyAD" }
Creates the agent type TACACS+ Account named MyADQueryagent that uses the companyAD server.
• list acct-tacacsplus all
Displays a list of TACACS+ Account agents and the server associated with each agent.
• delete acct-tacacsplus MyADagent
Deletes the MyADagent TACACS+ Account agent.
Options
• [name]
Species the name of an acct-tacacsplus agent. This setting is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• server
283
Traffic Management Shell (tmsh) Reference Guide
Species the TACACS+ Account server that the system uses for queries and authentication.
See Also
tmsh
decision-box
Manages a Decision Box agent.
Syntax
Congure the decision-box component within the policy agent module using the following syntax.
Create/Modify
create decision-box [name]
modify decision-box [name]
options
app-service [[string] | none]
customization-group [name]
Display
list decision-box
list decision-box [ [ [name] | [glob] | [regex] ] ... ]
show running-config decision-box
show running-config decision-box [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete decision-box ([name] | all)
Description
You can use the decision-box component to congure a Decision Box agent.
Examples
• create dynamic-acl MyADQueryagent
Creates the Decision Box agent named MyADQueryagent.
• list decision-box all
Displays a list of Decision Box agents.
284
APM Policy Agent
• delete decision-box MyADagent
Deletes the MyADagent Decision Box agent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• customization-group
Species the name of the existing customization group to which the agent belongs.
• [name]
Species the name of a Decision Box agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
tmsh
dynamic-acl
Manages a Dynamic ACL agent.
Syntax
Congure the dynamic-acl component within the policy agent module using the following syntax.
Create/Modify
create dynamic-acl [name]
modify dynamic-acl [name]
options
app-service [[string] | none]
entries [ add | delete | modify | none | replace-all-with]
Display
list dynamic-acl
list dynamic-acl [ [ [name] | [glob] | [regex] ] ... ]
show running-config dynamic-acl
show running-config dynamic-acl [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
285
Traffic Management Shell (tmsh) Reference Guide
Delete
delete dynamic-acl [name]
Description
You can use the dynamic-acl component to create and manage a Dynamic access control list (acl) agent
that parses ACL text input with a specied format from a specied session variable, assigns the parsed
entry into a Dynamic ACL object, and assigns it into a current user session. An ACL is a set of restrictions
associated with a resource or favorite that denes access for users and groups.
Examples
• create dynamic-acl <dynamic-acl-agent-name { entries <operator> { <index> { acl
<DynamicACLentry> [ format [f5 | cisco] ] source <session.variable source> } } }>
Creates the Dynamic ACL agent named MyDynamicAclAgent.
• list dynamic-acl
Displays a list of Dynamic ACL agents.
• delete dynamic-acl MyDynamicAclAgent
Deletes the Dynamic ACL agent named MyDynamicAclAgent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• entries
Species the name of the entry to assign this dynamic access control list.
• [name]
Species the name of the Dynamic Acl agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
tmsh
ending-allow
Manages an Ending Allow agent.
Syntax
Congure the ending-allow component within the policy agent module using the following syntax.
286
APM Policy Agent
Create/Modify
create ending-allow [name]
modify ending-allow [name]
app-service [[string] | none]
Display
list ending-allow
list ending-allow [ [ [name] | [glob] | [regex] ] ... ]
show running-config ending-allow
show running-config ending-allow [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete ending-allow ([name] | all)
Description
Access policy endings indicate the nal outcome of a branch of an access policy. An Allow ending is a
successful ending in which the system displays the user's home page and grants access to a webtop connection.
Examples
• create ending-allow MyEndingAllowAgent { }
Creates the Ending Allow agent named MyEndingAllowAgent.
• list ending-allow
Displays a list of Ending Allow agents.
• delete ending-allow MyEndingAllowAgent
Deletes the Ending Allow agent named MyEndingDeniedAgent.
Options
• [name]
Species the name of an Ending Allow agent. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• partition
Displays the partition within which the component resides.
287
Traffic Management Shell (tmsh) Reference Guide
See Also
tmsh
ending-deny
Manages an Ending Deny agent.
Syntax
Congure the ending-deny component within the policy agent module using the following syntax.
Create/Modify
create ending-deny [name]
modify ending-deny [name]
options
app-service [[string] | none]
customization-group [name]
Display
list ending-deny
list ending-deny [ [ [name] | [glob] | [regex] ] ... ]
show running-config ending-deny
show running-config ending-deny [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete ending-deny ([name] | all)
Description
Access policy endings indicate the nal outcome of a branch of an access policy. The Logon Deny ending
is the nal result of an unsuccessful logon attempt (the failure could be caused by an incorrect logon attempt,
a security requirement incompatibility, or the use of an unsupported device). Upon reaching a Logon Deny
ending, the user sees an error message. You can use the ending-deny component to create and manage an
Ending Deny agent.
Examples
• create ending-deny MyEndingDenyAgent customization-group MyLogOffCG
Creates the Ending Deny agent named MyEndingDenyAgent that is associated with the MyLogOffCG
customization group.
• list ending-deny
288
APM Policy Agent
Displays a list of Ending Deny agents.
• delete ending-deny MyEndingDenyAgent
Deletes the Ending Deny agent named MyEndingDenyAgent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• customization-group
Species the name of the existing customization-group to which the agent belongs. It enables you to
customizes the logon deny page. For example, you can indicate a specic reason for the denial of access.
This setting is required, and the customization group that you assign must be of the type logout.
• [name]
Species the name of an Ending Deny agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
tmsh
ending-redirect
Manages an Ending Redirect agent.
Syntax
Congure the ending-redirect component within the policy agent module using the following syntax.
Create/Modify
create ending-redirect [name]
modify ending-redirect [name]
options
app-service [[string] | none]
close-session [true | false]
url [value]
Display
list ending-redirect
list ending-redirect [ [ [name] | [glob] | [regex] ] ... ]
show running-config ending-redirect
show running-config ending-redirect [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
289
Traffic Management Shell (tmsh) Reference Guide
app-service
current-module
non-default-properties
one-line
partition
Delete
delete ending-redirect ([name] | all)
Description
The Redirect ending can be used to redirect the user, rather than allowing or denying a connection. It can
also send a user directly to an update script or to different server or landing URI. Upon reaching a Redirect
ending, the user sees a screen indicating that they are being redirected to a different URL. You can use the
ending-redirect component to create and manage an Ending Redirect agent.
Examples
• create ending-redirect MyEndingRedirectAgent { url "http://www.myweb.com" }
Creates the Ending Redirect agent named MyEndingRedirectAgent that redirects a connection to
http://www.myweb.com.
• create ending-redirect MyEndingRedirectAgent { url
"%{session.server.network.protocol}://www.myweb.com" }
Creates an agent using the current protocol and the session variable %{session.server.network.protocol}
• list ending-redirect
Displays a list of Ending Redirect agents.
• delete ending-redirect MyEndingRedirectAgent
Deletes the Ending Redirect agent named MyEndingRedirectAgent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• close-session
Redirects to the specied URI after closing the session if enabled. Otherwise, redirect to the specied
URI without closing the session. The default is enabled.
• [name]
Species the name of an Ending Redirect agent. This option is required.
• url
Species the URL to which the system redirects the original request. This option is required, and you
must specify an absolute URL.
An absolute URL species the exact location of a le or directory on the Internet.
290
APM Policy Agent
See Also
tmsh
endpoint-check-machine-cert
Manages an End-point Check Machine certicate agent.
Syntax
Congure the endpoint-check-machine-cert component within the apm policy agent module using the
following syntax.
Create/Modify
create endpoint-check-machine-cert [name]
modify endpoint-check-machine-cert [name]
allow-elevation [ true| false]
app-service [[string] | none]
ca-profile-name [value]
issuer [value]
save-cert [ true| false]
serial-number [integer]
store-location [machine | user]
store-name [value]
subject-alt-name [value]
subject-match-fqdn [value]
edit endpoint-check-machine-cert [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-check-machine-cert
list endpoint-check-machine-cert [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-check-machine-cert
show running-config endpoint-check-machine-cert [ [ [name] | [glob] | [regex]
] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-check-machine-cert [name]
291
Traffic Management Shell (tmsh) Reference Guide
Description
Endpoint security is a centrally-managed method of monitoring and maintaining client-system security.
The endpoint-check-machine-cert component checks for the presence of a valid machine certicate on
Windows/Mac client systems during access policy validation.
Examples
• create endpoint-check-machine-cert MyMCagent
Creates the Endpoint Check Machine certicate agent named MyMCagent in the Common partition.
• list endpoint-check-machine-cert
Displays a list of Endpoint Check Machine certicate agents.
• delete endpoint-check-machine-cert MyMCagent
Deletes the MyMCagent Endpoint Check Machine certicate agent.
Options
• allow-elevation
Species that User Account Control (UAC) prompts are allowed during private key checking.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• ca-prole-name
Species the name of the certicate authority prole to validate the certicate.
• issuer
Species the name used to match the issuer name in the machine certicate.
• [name]
Species the name of an external logon page agent. This option is required.
• partition
Displays the partition within which the component resides.
• save-cert
Species to store the entire machine certicate in a session variable.
• serial-number
Species the serial number used to match the serial number of the machine certicate.
• store-location
Species the location of the certicate store on the client machine.
• store-name
Species the name of the certicate store on the client machine.
• subject-alt-name
Species the name used to match the subject-alt-name in the machine certicate.
• subject-match-fqdn
Species if lookup must match fully qualied domain name (FQDN) in the machine certicate.
292
APM Policy Agent
See Also
apm policy agent endpoint-check-software, apm policy agent endpoint-linux-check-le, apm policy agent
endpoint-linux-check-process, apm policy agent endpoint-mac-check-le, apm policy agent
endpoint-mac-check-process, apm policy agent endpoint-windows-check-le, apm policy agent
endpoint-windows-browser-cache-cleaner, apm policy agent endpoint-windows-check-process, apm policy
agent endpoint-windows-check-registry, apm policy agent endpoint-windows-info-os, apm policy agent
endpoint-machine-info, apm policy agent endpoint-windows-protected-workspace
endpoint-check-software
Manages an Endpoint Software Check agent.
Syntax
Congure the endpoint-check-software component within the apm policy agent module using the following
syntax.
Create/Modify
create endpoint-check-software [name]
modify endpoint-check-software [name]
collect [ true | false ]
continuous-check [ true | false ]
type [ antivirus | firewall | patch-management | antispyware | peer-to-peer
| hard-disk-encryption | health-agent ]
check-list-type [ required | allow | deny ]
items [ vendor_id | product_id | state | version | db-age | db-version |
last-scan | missing-updates | platform ]
edit endpoint-check-software [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-check-software
list endpoint-check-software [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-check-software
show running-config endpoint-check-software [ [ [name] | [glob] | [regex] ]
... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-check-software ([name] | all)
293
Traffic Management Shell (tmsh) Reference Guide
Description
Endpoint security is a centrally-managed method of monitoring and maintaining client-system security.
You can use the endpoint-check-software component to create and manage an agent that enforces monitoring
of various client-system security third party software. Different type s of third party software supported are
described below in options.
The conguration attributes in the items option are generic and therefore for a given software type only
certain items attributes are useful, rest of the attributes are ignored even if they are congured. For example:
for type = peer-to-peer only vendor_id, product_id, state and version are considered and rest of the items
like db-age, db-version etc are ignored. Following is the list of useful attributes corresponding to the software
type:
Common to all software type: vendor_id, product_id, version, platform, state
antivirus & antispyware: db-age, db-version, last-scan
patch-management: missing-updates
Examples
• create endpoint-check-software MyEndpointWCagent items state enabled add
Creates the Endpoint Check Software agent named MyEndpointWCagent, which veries that the
specied third party software on the client is compliant with system administrators conguration, which
my just check for the installation or monitor the state of the software
• list endpoint-check-software
Displays a list of Endpoint Software Check agents.
• delete endpoint-check-software MyEndpointWCagent
Deletes the Endpoint Software Check agent named MyEndpointWCagent.
Options
• items
Adds items to or deletes items from an Endpoint Software Check agent. You can specify the following
attributes for the software:
• check-list-type Species how the list of software should be checked
required: Client is required to have at least one of the software congured in the list in order to pass
the access policy. And that software should satisfy all the conguration elds e.g. state, version etc.
allow: Client is allowed to have any of the software congured in the list but NOT any other than
that, in order to pass the access policy. List is treated as whitelist. A given client software will not
match unless it satises all the conguration elds (e.g. state, version etc). NOTE: The check will
also be successful if client has no software installed at all. List of software is treated as whitelist.
deny: Client should NOT have any software congured in the list in order to pass the access policy.
And that software should satisfy all the conguration elds (e.g. state, version etc). NOTE: The
check will also be successful if client has no software installed at all. List of software is treated as
blacklist.
• db-age
Species the maximum age of the anti-virus/anti-spyware database that you want an Endpoint
Software Check agent to verify the presence of on the client in order to allow the access policy to
pass.
• db-version
294
APM Policy Agent
Species the version of the anti-virus/anti-spyware database that you want an Endpoint Software
Check agent to verify the presence of on the client in order to allow the access policy to pass.
• product_id
Species the product ID of the software that you want an Endpoint Software Check agent to verify
the presence of on the client in order to allow the access policy to pass.
• vendor_id
Species the vendor ID of the software that you want an Endpoint Software Check agent to verify
the presence of on the client in order to allow the access policy to pass.
NOTE: If none of the vendor id or product id is dened then check is performed for any of the
software of given type If both vendor id and product id are congured then, product id is ignored
and only vendor id is considered. Vendor ID always takes precedence. A vendor can have many
products. Each product (of every vendor) has unique ID assigned to them. Similarly, every vendor
is assigned a unique ID too which is separate from product ID. If you want to check every software
from a vendor then specify vendor_id only.
• state
State means different things to different software type. The state can be enabled, disabled or
unspecied. The default is unspecied.
antivirus and antispyware: When the state is set to enabled or disabled, agent veries that the specied
antivirus/antispyware software has real time protection enabled or disabled on the client that is
attempting to connect. When state is unspecied, it ignores the state.
patch-management: When the state is set to enabled, agent veries that the specied PM software
is running on the client that is attempting to connect. When its set to unspecied, state of the software
is ignored.
rewall: When the state is enabled or disabled, agent veries that the specied rewall software
has real time protection enabled or disabled on the client that is attempting to connect. When state
is unspecied, the software state is ignored.
peer-to-peer: When the state is set to enabled agent veries that the peer-to-peer software is running
on the client that is attempting to connect. When state is unspecied, the agent only veries that the
software is installed or not.
hard-disk-encryption: When the state is set to enabled agent veries that all disk volumes are
encrypted on the client that is attempting to connect. When the state is set to disabled agent veries
that system disk volume is encrypted on the client that is attempting to connect. When state is
unspecied, the agent only veries that the software is installed or not.
health-agent: When the state is set to enabled agent veries that endpoint client is compliant with
the health policy set out by the site administrator.
• version
Species the version of the software that you want an Endpoint Software Check agent to verify the
presence of on the client in order to allow the access policy to pass.
• last-scan
Species the maximum allowed duration without the full system scan of endpoint client that software
agent can accept in order to allow the access policy to pass. It is specied in number of days.
• missingupdates
Species the maximum number of allowed missing critical updates of the PM software at the endpoint
client in order to allow the access policy to pass. Leave blank to ignore number of missing critical
updates. Specify 0 to make sure endpoint client is up-to-date
• platform
295
Traffic Management Shell (tmsh) Reference Guide
Species the platform. It could be any of the following: windows, linux, mac or any. The default is
any.
• type
Its the type of the third party software to be monitored on the client system. It could be any of the
following: antivirus, rewall, patch-management, antispyware, peer-to-peer, hard-disk-encryption,
health-agent
• collect
This setting is ignored.
• continuous-check
Continuously check the items, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Software Check agent. This option is required.
• partition
Displays the partition within which the component resides.
See Also
apm policy agent endpoint-linux-check-le, apm policy agent endpoint-linux-check-process, apm policy
agent endpoint-mac-check-le, apm policy agent endpoint-mac-check-process, apm policy agent
endpoint-windows-browser-cache-cleaner, apm policy agent endpoint-windows-check-le, apm policy
agent endpoint-check-machine-cert, apm policy agent endpoint-windows-check-process, apm policy agent
endpoint-windows-check-registry, apm policy agent endpoint-windows-group-policy, apm policy agent
endpoint-windows-info-os, apm policy agent endpoint-machine-info, apm policy agent
endpoint-windows-protected-workspace
endpoint-linux-check-file
Manages an Endpoint Linux Check File agent.
Syntax
Congure the endpoint-linux-check-le component within the policy agent module using the following
syntax.
Create/Modify
create endpoint-linux-check-file [name]
modify endpoint-linux-check-file [name]
continuous-check [ true | false ]
app-service [[string] | none]
files [ filename | md5 | modified | size ]
edit endpoint-linux-check-file [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
296
APM Policy Agent
Display
list endpoint-linux-check-file
list endpoint-linux-check-file [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-linux-check-file
show running-config endpoint-linux-check-file [ [ [name] | [glob] | [regex]
] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-linux-check-file ([name] | all)
Description
Access Policy Manager checks for the presence of one or more les on a client that is attempting to connect.
If a le with the described properties exists, the action goes to the successful branch. If the le does not
exist, or a le exists but one or more properties are not correct, the action goes to the fallback branch.
You can use the endpoint-linux-check-le component to create or manage an Endpoint Linux Check File
agent that veries the presence of specied Linux les on a client.
Examples
• create endpoint-linux-check-le Myprole_act_le_check_ag { les { lename
"/tmp/demo/demole" md5 "6b61ad518c23650b17e738e1fa2bb04e" modied 2007-06-01 10:30:10
size 12 } { lename "/tmp/demo/testle" md5 "f20d9f2072bbeb6691c0f9c5099b01f3" size 9 } }
Creates the Endpoint Linux Check File agent named Myprole_act_le_check_ag that checks that the
client contains two les located in the /tmp/demo directory: a 12 byte le named demole that was
modied no later than January 6, 2007 at 10:30 and has an MD5 checksum of
6b61ad518c23650b17e738e1fa2bb04e, and a 9-byte le named testle that has an MD5 check sum of
f20d9f2072bbeb6691c0f9c5099b01f3.
• list all endpoint-linux-check-le Company8prole_act_le_check_ag
Displays information about the Endpoint Linux Check File agent named
Company8prole_act_le_check_ag.
• delete endpoint-linux-check-le Company8prole_act_check_le { les { lename
"/tmp/demo/demole" }}
Deletes the /tmp/demo/demole le from the Endpoint Linux Check File agent named
Company8prole_act_le_check_ag.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• les
297
Traffic Management Shell (tmsh) Reference Guide
Adds les to or deletes les from an Endpoint Linux Check File agent. You can specify the following
attributes of the les that you want an Endpoint Linux Check File agent to verify the presence of on the
client in order to allow the access policy to pass.
• lename
Species the name of the le and includes the full path. The Endpoint linux Check File agent that
you are creating must be able to verify the le's presence on the client for the access policy to pass.
When you add a le to or delete a le from the agent, this setting is required.
• md5
Species the value of an MD5 checksum. The Endpoint Linux Check File agent you are creating
must be able to match the checksum on the client for the access policy to pass. The default is none.
• modied
Species the last modied date of the specied le. The Endpoint Linux Check File agent you are
creating must verify this date on the client for the access policy to pass. The default is 1970-01-01
00:00:00.
• size
Species the size, in bytes, of the specied le. The Endpoint Linux Check File agent you are creating
must verify this size on the client for the access policy to pass. The default is 0.
• continuous-check
Continuously check the les, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Linux Check File agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
endpoint-check-software, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-check-registry,
endpoint-windows-info-os, endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-linux-check-process
Manages an Endpoint Linux Check Process agent.
Syntax
Congure the endpoint-linux-check-process component within the policy agent module using the following
syntax.
Create/Modify
create endpoint-linux-check-process [name]
modify endpoint-linux-check-process [name]
options
298
APM Policy Agent
continuous-check [ true | false ]
app-service [[string] | none]
expression [ string | none ]
edit endpoint-linux-check-process [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-linux-check-process
list endpoint-linux-check-process [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-linux-check-process
show running-config endpoint-linux-check-process [ [ [name] | [glob] | [regex]
] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-linux-check-process [name]
Description
You can use the endpoint-linux-check-process component to create and manage an Endpoint Linux Check
Process agent that collects information about the Linux processes running on the client.
Examples
• create endpoint-linux-check-process MyEndpointWCPagent { (bash OR top) AND refox }
Creates the Endpoint Linux Check Process agent named MyEndpointWCPagent that checks that the
client has either bash or top, and refox launched.
• list endpoint-linux-check-process
Displays a list of Endpoint Linux Check Process agents.
• delete endpoint-linux-check-process MyEndpointWCPagent
Deletes the Endpoint Linux Check Process agent named MyEndpointWCPagent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• expression
299
Traffic Management Shell (tmsh) Reference Guide
Species the expression that you want an Endpoint Linux Check Process agent to use to verify the
processes that are running on the client to allow the access policy to pass. You can use the following
operators: AND, OR, NOT, (and). You can use wildcards in the process name, for example, navapsvc.*.
If the check is successful, the system returns 1. If the check fails, the system returns 0. If the expression
is incorrect, the system returns -1.
• continuous-check
Continuously check the expression, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Linux Check Process agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-mac-check-le, endpoint-mac-check-process,
endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le, endpoint-check-machine-cert,
endpoint-windows-check-process, endpoint-windows-check-registry, endpoint-windows-group-policy,
endpoint-windows-info-os, endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-mac-check-file
Manages an Endpoint Macintosh Check File agent.
Syntax
Congure the endpoint-mac-check-le component within the policy agent module using the following
syntax.
Create/Modify
create endpoint-mac-check-file [name]
modify endpoint-mac-check-file [name]
options
continuous-check [ true | false ]
app-service [[string] | none]
files [ filename | md5 | modified | size ]
edit endpoint-mac-check-file [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-mac-check-file
list endpoint-mac-check-file [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-mac-check-file
show running-config endpoint-mac-check-file [ [ [name] | [glob] | [regex]
300
APM Policy Agent
] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-mac-check-file ([name] | all)
Description
Access Policy Manager checks for the presence of one or more les on a client that is attempting to connect.
If a le with the described properties exists, the action goes to the successful branch. If the le does not
exist, or a le exists but one or more properties are not correct, the action goes to the fallback branch.
You can use the endpoint-mac-check-le component to create or manage an Endpoint Macintosh Check
File agent that veries the presence of specied Macintosh les on a client.
Examples
• create endpoint-mac-check-le Myprole_act_le_check_ag { les { lename "/tmp/demo/demole"
md5 "6b61ad518c23650b17e738e1fa2bb04e" modied 2007-06-01 10:30:10 size 12 } { lename
"/tmp/demo/testle" md5 "f20d9f2072bbeb6691c0f9c5099b01f3" size 9 } }
Creates the Endpoint Macintosh Check File agent named Myprole_act_le_check_ag that checks
that the client contains two les located in the /tmp/demo directory: a 12 byte le named demole that
was modied no later than January 6, 2007 at 10:30 and has an MD5 checksum of
6b61ad518c23650b17e738e1fa2bb04e, and a 9 byte le named testle that has an MD5 check sum of
f20d9f2072bbeb6691c0f9c5099b01f3.
• list all endpoint-mac-check-le Company8prole_act_le_check_ag
Displays information about the Endpoint Macintosh Check File agent named
Company8prole_act_le_check_ag.
• delete endpoint-mac-check-le Company8prole_act_check_le { les { lename
"/tmp/demo/demole" }}
Deletes the /tmp/demo/demole le from the Endpoint Macintosh Check File agent named
Company8prole_act_le_check_ag.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• les
Adds les to or deletes les from an Endpoint Macintosh Check File agent. You can specify the following
attributes of the les that you want an Endpoint Macintosh Check File agent to verify the presence of
on the client to allow the access policy to pass:
• lename
301
Traffic Management Shell (tmsh) Reference Guide
Species the name of the le and includes the full path. The Endpoint Macintosh Check File agent
that you are creating must be able to verify the le's presence on the client for the access policy to
pass. When you add a le to or delete a le from the agent, this setting is required.
• md5
Species the value of an MD5 checksum. The Endpoint Macintosh Check File agent you are creating
must be able to match the checksum on the client for the access policy to pass. The default is none.
• modied
Species the last modied date of the specied le. The Endpoint Macintosh Check File agent you
are creating must verify this date on the client for the access policy to pass. The default is 1970-01-01
00:00:00.
• size
Species the size, in bytes, of the specied le. The Endpoint Macintosh Check File agent you are
creating must verify this size on the client for the access policy to pass. The default is 0.
• continuous-check
Continuously check the les, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Macintosh Check File agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-check-registry,
endpoint-windows-group-policy, endpoint-windows-info-os, endpoint-machine-info,
endpoint-windows-protected-workspace
endpoint-mac-check-process
Manages an Endpoint Macintosh Check Process agent.
Syntax
Congure the endpoint-mac-check-process component within the policy agent module using the following
syntax.
Create/Modify
create endpoint-mac-check-process [name]
modify endpoint-mac-check-process [name]
options
continuous-check [ true | false ]
302
APM Policy Agent
app-service [[string] | none]
expression [ string | none ]
edit endpoint-mac-check-process [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-mac-check-process
list endpoint-mac-check-process [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-mac-check-process
show running-config endpoint-mac-check-process [ [ [name] | [glob] | [regex]
] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-mac-check-process ([name] | all)
Description
You can use the endpoint-mac-check-process component to create and manage an Endpoint Macintosh
Check Process agent that collects information about the Macintosh processes running on the client.
Examples
• create endpoint-mac-check-process MyEndpointWCPagent { (bash OR top) AND refox }
Creates the Endpoint Macintosh Check Process agent named MyEndpointWCPagent that checks that
the client has either bash or top, and refox launched.
• list endpoint-mac-check-process
Displays a list of Endpoint Macintosh Check Process agents.
• delete endpoint-mac-check-process MyEndpointWCPagent
Deletes the Endpoint Macintosh Check Process agent named MyEndpointWCPagent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• expression
Species the expression that you want an Endpoint Macintosh Check Process agent to use to verify the
processes that are running on the client in order to allow the access policy to pass. You can use the
303
Traffic Management Shell (tmsh) Reference Guide
following operators: AND, OR, NOT, (and). You can use wildcards in the process name, for example,
navapsvc.*.
If the check is successful, the system returns 1. If the check fails, the system returns 0. If the expression
is incorrect, the system returns -1.
• continuous-check
Continuously check the expression, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Macintosh Check Process agent. This setting is required.
• partition
Displays the partition within which the component resides.
endpoint-machine-info
Manages an Endpoint Machine Information agent.
Syntax
Congure the endpoint-machine-info component within the policy agent module using the following
syntax.
Create/Modify
create endpoint-machine-info [name]
modify endpoint-machine-info [name]
app-service [[string] | none]
edit endpoint-machine-info [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Display
list endpoint-machine-info
list endpoint-machine-info [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-machine-info
show running-config endpoint-machine-info [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
partition
show endpoint-machine-info
show endpoint-machine-info [name]
304
APM Policy Agent
Delete
delete endpoint-machine-info [name]
Description
You can use the endpoint-machine-info component to create and manage an agent that collects information
about the machine that is attempting to connect.
Options
• [name]
Species the name of the an Endpoint Check Machine Information agent. This setting is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-check-registry,
endpoint-windows-group-policy, endpoint-windows-info-os, endpoint-windows-protected-workspace
endpoint-windows-browser-cache-cleaner
Manages an Endpoint Windows Browser Cache Cleaner agent.
Syntax
Congure the endpoint-windows-browser-cache-cleaner component within the policy agent module
using the following syntax.
Create/Modify
create endpoint-windows-browser-cache-cleaner [name]
modify endpoint-windows-browser-cache-cleaner [name]
options
app-service [[string] | none]
cache-clean-type [all | all-except-css-js | all-except-img-css-js | none
]
clean-passwords [false | true ]
empty-recycle-bin [false | true ]
idle-timeout [<integer> | immediate | indefinite]
idle-timeout-screen-lock [<integer>]
monitor-webtop [enable | disable]
305
Traffic Management Shell (tmsh) Reference Guide
partition <name>
remove-connection-entry [false | true ]
edit endpoint-windows-browser-cache-cleaner [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
Display
list endpoint-windows-browser-cache-cleaner
list endpoint-windows-browser-cache-cleaner [ [ [name] | [glob] | [regex] ]
... ]
show running-config endpoint-windows-browser-cache-cleaner
show running-config endpoint-windows-browser-cache-cleaner [ [ [name] |
[glob] | [regex] ] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-windows-browser-cache-cleaner ([name] | all)
Description
Endpoint security is a centrally-managed method of monitoring and maintaining client-system security.
You can use the endpoint-windows-browser-cache-cleaner component to create and manage an Endpoint
Windows Browser Cache Cleaner agent. This agent cleans items from the client browser and computer after
logoff, and also enforces session inactivity timeouts.
Examples
• create endpoint-windows-browser-cache-cleaner MyEndpointWBCCagent idle timeout 0
Creates the Endpoint Windows Browser Cache Cleaner agent named MyEndpointWBCCagent that
does not enforce a timeout.
• create endpoint-windows-browser-cache-cleaner MyEndpointWBCCagent { idle timeout 0 clean
passwords enable }
Creates the Endpoint Windows Browser Cache Cleaner agent named MyEndpointWBCCagent that
does not enforce a timeout, but does clear saved passwords from the client after logoff.
• list endpoint-windows-browser-cache-cleaner
Displays a list of Endpoint Windows Browser Cache Cleaner agents.
• delete endpoint-windows-browser-cache-cleaner MyEndpointWBCCagent
Deletes the Endpoint Windows Browser Cache Cleaner agent named MyEndpointWBCCagent.
306
APM Policy Agent
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• cache-clean-type
Species which browser cache temporary les are removed. If set to all, the temporary les are removed.
If set to all-except-css-js, the browser cache is cleared, but all style sheets and JavaScript are left on the
browser cache. If set to all-except-img-css-js, the browser cache is cleared, but all style sheets, JavaScript,
and images are left on the browser cache. The default is all.
• clean-passwords
When true, the Endpoint Windows Browser Cache Cleaner agent ensures that saved passwords are
cleared from the client after logoff. The default is false.
• empty-recycle-bin
When true, the Endpoint Windows Browser Cache Cleaner agent empties the Recycle Bin on the client
after logoff. The default is false.
• idle-timeout
Species the number of minutes that the client session can be idle before the Endpoint Windows Browser
Cache Cleaner agent disconnects the session. The default is 0, which enforces no timeout. This is a
required setting.
• Idle-timeout-screen-lock
Species the number of minutes the system can receive no user input before the workstation is locked.
The default is 0, which species no timeout enforced.
• monitor-webtop
When true, the Endpoint Windows Browser Cache Cleaner agent forces session termination if the
browser or webtop is closed. The default is false.
• [name]
Species the name of the Endpoint Windows Browser Cache Cleaner agent. This is a required setting.
• partition
Displays the partition within which the component resides.
• remove-connection-entry
When true, the Endpoint Windows Browser Cache Cleaner agent removes the connection from the
Network Connections Dial-up Networking folder on the client. The default is false.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-check-le, endpoint-check-machine-cert,
endpoint-windows-check-process, endpoint-windows-check-registry, endpoint-windows-info-os,
endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-windows-check-file
Manages an Endpoint Windows Check File agent.
307
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the endpoint-windows-check-le component within the policy agent module using the following
syntax.
Create/Modify
create endpoint-windows-check-file [name]
modify endpoint-windows-check-file [name]
options
continuous-check [ true | false ]
app-service [[string] | none]
files [ filename | md5 | modified | operation | signer | size | version
]
edit endpoint-windows-check-file [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-windows-check-file
list endpoint-windows-check-file [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-windows-check-file
show running-config endpoint-windows-check-file [ [ [name] | [glob] | [regex]
] ... ]
all
all-properties
app-service
current-module
non-default-properties
one-line
partition
Delete
delete endpoint-windows-check-file ([name] | all)
Description
Access Policy Manager checks for the presence of one or more les on a client that is attempting to connect.
If a le with the described properties exists, the action goes to the successful branch. If the le does not
exist, or a le exists but one or more properties are not correct, the action goes to the fallback branch.
You can use the endpoint-windows-check-le component to create or manage an Endpoint Windows
Check File agent that veries the presence of specied Windows les on a client.
Examples
• create endpoint-windows-check-le Myprole_act_le_check_ag { les { lename
"C:\\demo\\demole" md5 "6b61ad518c23650b17e738e1fa2bb04e" modied 2007-06-01 10:30:10
size 12 } { lename "C:\\demo\\test.le" md5 "f20d9f2072bbeb6691c0f9c5099b01f3" size 9 } }
Creates the Endpoint Windows Check File agent named Myprole_act_le_check_ag that checks that
the client contains two les located in the C:\demo directory: a 12 byte le named demole that was
modied no later than January 6, 2007 at 10:30 and has an MD5 checksum of
308
APM Policy Agent
6b61ad518c23650b17e738e1fa2bb04e, and a 9 byte le named test.le that has an MD5 check sum
of f20d9f2072bbeb6691c0f9c5099b01f3.
• list all endpoint-windows-check-le Company8prole_act_le_check_ag
Displays information about the Endpoint Windows Check File agent named
Company8prole_act_le_check_ag.
• delete endpoint-windows-check-le Company8prole_act_check_le { les { lename
"C:\\demo\\demole" }}
Deletes the C:\demo\demole le from the Endpoint Windows Check File agent named
Company8prole_act_le_check_ag.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• les
Adds les to or deletes les from an Endpoint Windows Check File agent. You can specify the following
attributes for the les that you want an Endpoint Windows Check File agent to verify the presence of
on the client to allow the access policy to pass.
• lename
Species a le name and includes the full path. The Endpoint windows Check File agent you are
creating must be able to verify the le's presence on the client for the access policy to pass. When
you add a le to or delete a le from the agent, this setting is required.
• md5
Species the value of an MD5 checksum. The Endpoint windows Check File agent that you are
creating must match the checksum on the client for the access policy to pass. The default is none.
• modied
Species the last modied date of the specied le. The Endpoint windows Check File agent you
are creating must verify this date on the client for the access policy to pass. The default is 1970-01-01
00:00:00.
• operation
Species the operator that you want your Endpoint Windows Check File agent to use when verifying
the attributes of the specied le on the client. The default is equal.
• signer
Species that the Endpoint Windows Check File agent must verify that the specied le on the client
is signed for the access policy to pass. The default is none.
• size
Species the size, in bytes, of the specied le. The Endpoint Windows Check File agent you are
creating must verify this le size on the client for the access policy to pass. The default is 0.
• version
Species the version of the specied le that you want your Endpoint Windows Check File agent
to verify on the client for the access policy to pass. Specify the version using the following form:
x.x.x.x. The maximum value is 65535.65535.65535.65535. The default is none.
• continuous-check
309
Traffic Management Shell (tmsh) Reference Guide
Continuously check the les, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Windows Check File agent. This option is required.
• partition
Displays the partition within which the component resides.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-check-le, endpoint-windows-browser-cache-cleaner,
endpoint-windows-check-process, endpoint-windows-check-registry, endpoint-windows-group-policy,
endpoint-windows-info-os, endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-windows-check-process
Manages an Endpoint Windows Check Process agent.
Syntax
Congure the endpoint-windows-check-process component within the policy agent module using the
following syntax.
Create/Modify
create endpoint-windows-check-process [name]
modify endpoint-windows-check-process [name]
continuous-check [ true | false ]
app-service [[string] | none]
expression (<string> | none)
edit endpoint-windows-check-process [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-windows-check-process
list endpoint-windows-check-process [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-windows-check-process
show running-config endpoint-windows-check-process [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
partition
show endpoint-windows-check-process
show endpoint-windows-check-process [name]
310
APM Policy Agent
Delete
delete endpoint-windows-check-process [name]
Description
You can use the endpoint-windows-check-process component to create and manage an agent that collects
information about the Windows processes running on the client.
Examples
• create endpoint-windows-check-process MyEndpointWCPagent { (NISUM.exe OR blackd.exe)
AND navapsvc.* }
Creates the Endpoint Windows Check Process agent named MyEndpointWCPagent that checks that
the client has either NISUM.exe or blackd.exe, and navapsvc.* installed.
• list endpoint-windows-check-process
Displays a list of Endpoint Windows Check Process agents.
• delete endpoint-windows-check-process MyEndpointWCPagent delete
Deletes the Endpoint Windows Check Process agent named MyEndpointWCPagent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• expression
Species the expression that you want an Endpoint Windows Check Process agent to use to verify the
processes that are running on the client in order to allow the access policy to pass. You can use the
following operators: AND, OR, NOT, (and). You can use wildcards in the process name, for example,
navapsvc.*.
If the check is successful, the system returns 1. If the check fails, the system returns 0. If the expression
is incorrect, the system returns -1.
• continuous-check
Continuously check the expression, and end the session if the result changes. The default is false.
• [name]
Species the name of an Endpoint Windows Check Process agent. This setting is required.
• partition
Displays the partition within which the component resides.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-check-le, endpoint-check-machine-cert,
endpoint-windows-browser-cache-cleaner, endpoint-windows-check-registry, endpoint-windows-group-policy,
endpoint-windows-info-os, endpoint-machine-info, endpoint-windows-protected-workspace
311
Traffic Management Shell (tmsh) Reference Guide
endpoint-windows-check-registry
Manages an Endpoint Windows Check Registry agent.
Syntax
Congure the endpoint-windows-check-registry component within the policy agent module using the
following syntax.
Create/Modify
create endpoint-windows-check-registry [name]
modify endpoint-windows-check-registry [name]
continuous-check [ true | false ]
app-service [[string] | none]
expression [[string] | none]
edit endpoint-windows-check-registry [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-windows-check-registry
list endpoint-windows-check-registry [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-windows-check-registry
show running-config endpoint-windows-check-registry [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
partition
show endpoint-windows-check-registry
show endpoint-windows-check-registry [name]
Delete
delete endpoint-windows-check-registry [name]
Description
You can use the endpoint-windows-check-registry component to create and manage an agent that collects
information about the Windows registry keys on the client that is attempting to connect.
Examples
• create endpoint-windows-check-registry MyEndpointWCRagent
{"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet
Explorer\".\"Version\"=\"5.0.2800.0\"" }
312
APM Policy Agent
Creates the Endpoint Windows Check Registry agent named MyEndpointWCRagent that checks the
registry on the client for version 5.0.2800.0 of Internet Explorer in the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft directory.
• create endpoint-windows-check-registry MyEndpointWCRagent
{"\"HKEY_LOCAL_MACHINE64\\SOFTWARE\\Microsoft\\Internet
Explorer\".\"Version\"=\"5.0.2800.0\""
Creates the Endpoint Windows Check Registry agent named MyEndpointWCRagent that checks the
registry on the client for version 5.0.2800.0 of Internet Explorer in the
HKEY_LOCAL_MACHINE64\SOFTWARE\Microsoft directory.
Note that the registry value HKEY_LOCAL_MACHINE64 is one of the 32 and 64-bit registry keys
that you can specify on 64-bit Windows versions. On 64-bit Windows systems, you can check for registry
keys in either the 64-bit registry or the 32-bit registry. To specify the registry to check, append a number
to the registry root key name. The following key names are supported: HKEY_CURRENT_USER
HKEY_CURRENT_USER32 HKEY_CURRENT_USER64 HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE32 HKEY_LOCAL_MACHINE64 HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT32 HKEY_CLASSES_ROOT64 HKEY_USERS HKEY_USERS32
HKEY_USERS64 HKEY values specied with a 32 allow you to check values in the 32-bit view of
64-bit registry. This is the perspective used by 32-bit applications running with on a 64-bit operating
system.
HKEY values with a 64 appended allow you to check values in the 64-bit view of the registry. This is
the perspective used by native 64-bit applications. When checking values on 32-bit Windows, the number
of bits specied in the registry key name is ignored.
• list endpoint-windows-check-registry
Displays a list of Endpoint Windows Check Registry agents.
• delete endpoint-windows-check-registry MyEndpointWCRagent delete
Deletes the Endpoint Windows Check Registry agent named MyEndpointWCRagent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• expression
Species the expression that you want an Endpoint Windows Check Registry agent to use to verify the
registry entries that are present on the client in order to allow the access policy to pass. You can use the
following operators: AND, OR, NOT, (and).
If the check is successful, the system returns 1. If the check fails, the system returns 0. If the expression
is incorrect, the system returns -1.
Important: You must use quotation marks (" ") around key and value arguments, and in data when the
content contains spaces, commas, slashes, tabs, or other delimiters. If quotation marks exist as part of
a registry path or value name, you must use quotation marks around those quotation marks.
Tip: The system treats data in the formats "d.d[.d][.d]" or "d,d[,d][,d]" (where d is a number) as a version
number. The system treats data in the format "mm/dd/yyyy" as a date.
• continuous-check
Continuously check the expression, and end the session if the result changes. The default is false.
• [name]
313
Traffic Management Shell (tmsh) Reference Guide
Species the name of the an Endpoint Windows Check Registry agent. This option is required.
• partition
Displays the partition within which the component resides.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-group-policy,
endpoint-windows-info-os, endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-windows-group-policy
Manages an Endpoint Windows Group Policy agent.
Syntax
Warning: This page is obsolete. Windows Group Policy is no longer supported.
Congure the external-logon-page component within the policy agent module using the following syntax.
Create/Modify
create endpoint-windows-group-policy [name]
modify endpoint-windows-group-policy [name]
app-service [[string] | none]
policy-file { [name] }
edit endpoint-windows-group-policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-windows-group-policy
list endpoint-windows-group-policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-windows-group-policy
show running-config endpoint-windows-group-policy [ [ [name] | [glob] | [regex]
] ... ]
all-properties
non-default-properties
partition
show endpoint-windows-group-policy
show endpoint-windows-group-policy [name]
314
APM Policy Agent
Delete
delete endpoint-windows-group-policy [name]
Description
Endpoint Windows Group Policy agents enable you to apply an Endpoint Windows Group Policy to a client
machine and create a result session variable.
Examples
• create endpoint-windows-group-policy { Firewall_Settings_Template }
Creates a policy for the Access Policy using the Firewall Settings template.
• edit endpoint-windows-group-policy Firewall_Settings_Template
Edits the Firewall Settings Template.
Options
• [name]
Species a name for the Endpoint Windows Group Policy agent.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• policy-le
Species the group policy template that is applied to the client. This option is required.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-check-registry,
endpoint-windows-info-os, endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-windows-info-os
Manages an Endpoint Windows Information Operating System agent.
Syntax
Congure the endpoint-windows-info-os component within the policy agent module using the following
syntax.
315
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create endpoint-windows-info-os [name]
modify endpoint-windows-info-os [name]
app-service [[string] | none]
edit endpoint-windows-info-os [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list endpoint-windows-info-os
list endpoint-windows-info-os [ [ [name] | [glob] | [regex] ] ... ]
show running-config endpoint-windows-info-os
show running-config endpoint-windows-info-os [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
partition
show endpoint-windows-info-os
show endpoint-windows-info-os [name]
Delete
delete endpoint-windows-info-os [name]
Description
You can use the endpoint-windows-info-os component to create and manage an agent that retrieves
information about the Microsoft Windows operating system from the client, such as version and hotx
number.
Examples
• create endpoint-windows-info-os MyEndpointWIOSagent { }
Creates the Endpoint Windows Operating System Information agent named MyEndpointWIOSagent.
• list endpoint-windows-info-os
Displays a list of Endpoint Windows Operating System Information agents.
• delete endpoint-windows-info-os MyEndpointWIOSagent delete
Deletes the Endpoint Windows Operating System Information agent named MyEndpointWCRagent.
Options
• [name]
Species the name of an Endpoint Windows Info OS agent. This setting is required.
316
APM Policy Agent
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-check-registry,
endpoint-windows-group-policy, endpoint-machine-info, endpoint-windows-protected-workspace
endpoint-windows-protected-workspace
Manages an Endpoint Windows Protected Workspace agent.
Syntax
Congure the endpoint-windows-protected-workspace component within the policy agent module using
the following syntax.
Create/Modify
create endpoint-windows-protected-workspace [name]
modify endpoint-windows-protected-workspace [name]
allow-burn-cid [true | false]
allow-printer-use [true | false]
allow-user-switch [true | false]
allowed-network-shares [add | delete | modify | replace-all-with] {
[[string]]
}
app-service [[string] | none]
close-google-desktop-search [true | false]
usb-flash-access [all | ironkey | none]
edit endpoint-windows-protected-workspace [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
Display
list endpoint-windows-protected-workspace
list endpoint-windows-protected-workspace [ [ [name] | [glob] | [regex] ] ...
]
show running-config endpoint-windows-protected-workspace
show running-config endpoint-windows-protected-workspace [ [ [name] | [glob]
| [regex] ] ... ]
all-properties
317
Traffic Management Shell (tmsh) Reference Guide
non-default-properties
partition
show endpoint-windows-protected-workspace
show endpoint-windows-protected-workspace [name]
Delete
delete endpoint-windows-protected-workspace [name]
Description
You can use the endpoint-windows-protected-workspace component to create and manage an agent that
enables an administrator to impose limitations on applications running on Windows client machines.
Options
• allow-burn-cid
Species that the user can burn CDs from within protected workspace. The default is false.
• allow-printer-use
Species whether a user can print inside a protected workspace. The default is true.
• allow-user-switch
Species whether a user can temporarily switch from a protected workspace. The default is true.
• allowed-network-shares
Species a list of Windows network shares to which user has Write access. The default is none.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• [name]
Species the name of the Endpoint Windows Protected Workspace agent. This option is required.
• partition
Displays the partition within which the component resides.
• usb-ash-access
Species whether a user has access to a USB port. The default is false.
See Also
endpoint-check-software, endpoint-linux-check-le, endpoint-linux-check-process, endpoint-mac-check-le,
endpoint-mac-check-process, endpoint-windows-browser-cache-cleaner, endpoint-windows-check-le,
endpoint-check-machine-cert, endpoint-windows-check-process, endpoint-windows-check-registry,
endpoint-windows-info-os, endpoint-machine-info
318
APM Policy Agent
external-logon-page
Manages an External Logon Page agent.
Syntax
Congure the external-logon-page component within the policy agent module using the following syntax.
Create/Modify
create external-logon-page [name]
modify external-logon-page [name]
app-service [[string] | none]
split-username [true | false]
uri [[string]> | none]
edit external-logon-page [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list external-logon-page
list external-logon-page [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
Delete
delete external-logon-page [name]
Description
The External Logon Page agent creates an external Logon page that redirects the client browser.
Examples
• create external-logon-page MyExternalLogonPageAgent { uri "MyExternalLogonPageServerURI"
}
Creates the External Logon Page agent named MyExternalLogonPageAgent that is associated with
the URI MyExternalLogonPageServerURI.
• create external-logon-page MyExternalLogonPageAgent { uri "%{session.my_server_uri}" }
Creates the External Logon Page agent named MyExternalLogonPageAgent with a URI of
session.my_server_uri.
• list external-logon-page
Displays a list of External Logon Page agents.
319
Traffic Management Shell (tmsh) Reference Guide
• delete external-logon-page MyExternalLogonPageAgent
Deletes the External Logon Page agent named MyExternalLogonPageAgent.
Options
• [name]
Species the name of an External Logon Page agent. This option is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• split-username
Species whether user's input is split into username and domain. This option supports UPN style logon
ID (userid@domainid) and Windows Domain User account ID (domainid\userid). The default is false.
Set this to true when you want to store the username and domain separately.
• uri
Species a predened conguration that contains several settings that you want the agent to use to
congure an External Logon page. This option is required.
See Also
logon-page
http-header-modify
HTTP header and cookie manipulation agent for per-request access policy.
Syntax
Manipulate HTTP headers or cookies within the policy agent module using the syntax shown in the following
sections.
Create/Modify
create http-header-modify [name]
modify http-header-modify [name]
app-service [[string] | none]
cookie-entries [add | delete | modify | none | replace-all-with] {
[name] {
app-service [[string] | none]
cookie-name [string]
cookie-operation [cookie-delete | cookie-update]
cookie-value [string]
}
}
header-entries [add | delete | modify | none | replace-all-with] {
[name] {
app-service [[string] | none]
320
APM Policy Agent
header-delimiter [string]
header-name [string]
header-operation [header-append | header-insert | header-remove |
header-replace]
header-value [string]
}
}
edit http-header-modify [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list http-header-modify
list http-header-modify [ [ [name] | [glob] | [regex] ] ... ]
show running-config http-header-modify
show running-config http-header-modify [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
cookie-entries
header-entries
non-default-properties
partition
Delete
delete http-header-modify [name]
Description
You can use the http-header-modify component to create and manage a http-header-modify agent that
manipulates the HTTP and Cookie headers. Operations supported for HTTP header include insert, append,
replace and remove while for cookie only update and delete operations are available. Please note that this
agent applies only to per-request access policy.
Examples
create http-header-modify MyProfile_act_http-header-modify_ag {
cookie-entries {
0 {
cookie-name PHPSESSID
cookie-value 1234
}
1 {
cookie-name mySession
cookie-operation cookie-delete
cookie-value 5678
}
}
header-entries {
0 {
header-name Cache-Control
header-value no-cache
}
1 {
321
Traffic Management Shell (tmsh) Reference Guide
header-delimiter ;
header-name User-Agent
header-operation header-append
header-value "Mozilla/5.0"
}
2 {
header-name Pragma
header-operation header-replace
header-value no-store
}
3 {
header-name Pragma
header-operation header-remove
header-value no-cache
}
}
}
In above example, http-header-modify agent named MyProle_act_http-header-modify_ag in partition
Common and adds 2 cookie and 4 HTTP header entries. cookie entry 0 updates cookie value PHPSESSID
to '1234' while entry 1 deletes when cookie value 'mySession=5678'. Header entries refer to various header
operations. Entry 0 inserts header 'Cache-Control: 5678'. Entry 1 updates value of header User-Agent to
include ';Mozilla/5.0'. Entry 2 replaces value of header Pragma by 'no-store'. Finally, 3 entry will remove
header-value matching 'Pragma: no-cache' from HTTP headers.
list http-header-modify
Displays a list of http-header-modify agents.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• name
Species the name of HTTP header modify agent. This setting is required.
• cookie-entries
Species a list of entries specifying cookie header manipulations.
• cookie-name
Species cookie name to match. This setting is required for cookie-entries.
• cookie-operation
Species operation on the cookie name specied in cookie-name. Possible values include
cookie-update and cookie-delete.
• cookie-update
Update the cookie value in the cookie-name, cookie-value pair. This is the default
cookie-operation.
• cookie-delete
Delete the cookie that matches the cookie-name, cookie-value pair.
• cookie-value
322
APM Policy Agent
Species cookie value to be operated on. This is required for cookie-entries.
• header-entries
Species a list of entries specifying HTTP header manipulations.
• header-delimiter
Species delimiter character to use when header-operation is header-append.
• header-name
Species HTTP header to match to be operated on. This setting is required for header-entries.
• header-operation
Species operation on the HTTP header specied in header-name. Options include the following:
• header-append
Append header-value to the value of HTTP header header-name delimited by header-delimiter.
• header-insert
Insert HTTP header containing header-name, header-value pair. This is the default
header-operation.
• header-remove
Remove the HTTP header, value pair that matches the header-name, header-value pair.
• header-replace
Replace value of HTTP header matching header-name by value header-value.
• header-value
Species HTTP header value to be operated on. This is required for header-entries.
• partition
Displays the partition within which the component resides.
See Also
tmsh
irule-event
Manages an iRule Event agent.
Syntax
Congure the irule-event component within the policy agent module using the syntax shown in the following
sections.
Create/Modify
create irule-event [name]
modify irule-event [name]
323
Traffic Management Shell (tmsh) Reference Guide
app-service [[string] | none]
id [[string] | none]
edit irule-event [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list irule-event
list irule-event [ [ [name] | [glob] | [regex] ] ... ]
show running-config irule-event
show running-config irule-event [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show irule-event
show irule-event [name]
Delete
delete irule-event [name]
Description
You can use the irule-event component to add a custom Access iRule event to an access policy. This agent
enables you to combine access policy execution with iRule execution.
For example, you can retrieve the current agent ID (using an iRule command ACCESS::policy agent_id )
to determine which of the iRule agents raised the event and then perform some custom logic execution.
Examples
• when ACCESS_POLICY_AGENT_EVENT { if {[ACCESS::policy agent_id] eq "lastLogon" } {
# our limit in seconds set 2weeks 1209600 # diff in 100 nanosecond increments between MS time
attribute (year 1601) and start of epoch set offset 11644473600000 set adtime "[ACCESS::session
data get session.ad.last.attr.lastLogon]" # convert adtime to milliseconds set millisecs [expr {$adtime
/ 10000}] # subtract offset set lastlogintime [expr {$millisecs - $offset}] # convert to seconds because
milliseconds for 'now' were negative (maybe vmware issue) set secs [expr {$lastlogintime / 1000}]
set now [clock seconds] # nally calculate the difference set diff [expr {$now - $secs}] log local0.
"lastLogon: $diff seconds from current time" if { $diff $2weeks } { ACCESS::session data set
session.custom.lastLogonWithin2Weeks 0 } else { ACCESS::session data set
session.custom.lastLogonWithin2Weeks 1 } } } >
In this example, ACCESS_POLICY_AGENT_EVENT gathers data containing the users whose last
logon was within the last two weeks. Note that you can access session variables and create new session
variables inside this event.
• list irule-event all
Displays a list of OAM agents.
• delete irule-event my_irule_agent
324
APM Policy Agent
Deletes the iRule Event agent named my_irule_agent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• id
Species the ID of the iRule event. The default is none. You can use the ID to determine which agent
caused the ACCESS_POLICY_AGENT_EVENT. You can also use the ID to perform different processing
inside iRule for different agents.
• [name]
Species the name of the component. This option is required.
• partition
Displays the partition within which the component resides.
kerberos
Manages a Kerberos agent.
Syntax
Congure the kerberos component within the policy agent module using the syntax shown in the following
sections.
Create/Modify
create kerberos [name]
modify kerberos [name]
app-service [[string] | none]
max-logon-attempt [integer]
server [string]
edit kerberos [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list kerberos
list kerberos [ [ [name] | [glob] | [regex] ] ... ]
show running-config kerberos
show running-config kerberos [ [ [name] | [glob] | [regex] ] ... ]
all-properties
325
Traffic Management Shell (tmsh) Reference Guide
non-default-properties
partition
show kerberos
show kerberos [name]
Delete
delete kerberos [name]
Description
You can use the kerberos component to create and manage a Kerberos agent.
Examples
• create kerberos my_kerberos_agent
Creates a Kerberos agent named my_kerberos_agent.
• list kerberos all
Displays a list of Kerberos agents.
• delete kerberos my_kerberos_agent
Deletes the Kerberos agent named my_kerberos_agent.
Options
• [name]
Species the name of the component. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• partition
Displays the partition within which the component resides.
• server
Species the name of the Kerberos server. This option is required.
326
APM Policy Agent
logging
Manages a Logging agent.
Syntax
Congure the logging component within the policy agent module using the syntax shown in the following
sections.
Create/Modify
create logging [name]
modify logging [name]
app-service [[string] | none]
log-message [[string] | none]
variables [[string] | none]
edit logging [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list logging
list logging [ [ [name] | [glob] | [regex] ] ... ]
show running-config logging
show running-config logging [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
log-message
non-default-properties
partition
variables
Delete
delete logging [name]
Description
You can use the logging component to create and manage a logging agent that monitors the value of session
variables and identies the path taken by access policy execution. A logging agent can also be used to create
and monitor custom or predened session variables. Note that a session variable may or may not exist
depending on the result of the access policy execution.
Examples
create logging MyProfile_act_logging_ag {
variables
327
Traffic Management Shell (tmsh) Reference Guide
{
{session-var "session.logon.*"}
{session-var
"session.windows_check_file.Company8profile_act_file_check_ag.item_x.filename"}
}
}
Creates the logging agent named MyProle_act_logging_ag in partition Common and adds two session
variables that dene actions that the agent logs: session.logon.* indicates to log application logon attempts
and session.windows_check_le.Company8prole_act_le_check_ag.item_x.lename indicates to log
the outcome of the le check on the client. The x in item_x indicates the order of the les in the list congured
for the le checker. The list starts with index 0 (zero).
create logging MyProfile_act_logging_ag {
log-message "Logon Name: %{session.logon.last.username}."
}
Above example applies only to logging agent tied to per-request access policy. Here logging agent named
MyProle_act_logging_ag in partition Common will print log messages containing logon name. This
removes the requirement to congure variables separately for per-request access policy. list logging
Displays a list of logging agents.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• log-message
Species the log message to display. This option is required. For per-request access policy only, this
option can contain session or per-request variables. However, session variables containing wildcard (*)
are not supported.
• name
Species the name of a logging agent. This option is required.
• partition
Displays the partition within which the component resides.
• variables
Adds a variable to or deletes a variable from a logging agent. You use the sessionvar option to specify
a session variable that indicates which actions the system logs. This option does not apply to per-request
access policy agent.
logon-page
Manages a Logon Page agent.
328
APM Policy Agent
Syntax
Congure the logon-page component within the policy agent module using the following syntax.
Create/Modify
create logon-page [name]
modify logon-page [name]
app-service [[string] | none]
basic-auth-realm [[string] | none]
customization-group [[string] | none]
field-modifiable1 [true | false]
field-modifiable2 [true | false]
field-modifiable3 [true | false]
field-modifiable4 [true | false]
field-modifiable5 [true | false]
field-type1 [checkbox | none | password | text]
field-type2 [checkbox | none | password | text]
field-type3 [checkbox | none | password | text]
field-type4 [checkbox | none | password | text]
field-type5 [checkbox | none | password | text]
http-401-auth-level [basic | basic-negotiate | negotiate | none]
post-var-name1 [[integer] | none]
post-var-name2 [[integer] | none]
post-var-name3 [[integer] | none]
post-var-name4 [[integer] | none]
post-var-name5 [[integer] | none]
session-var-name1 [[integer] | none]
session-var-name2 [[integer] | none]
session-var-name3 [[integer] | none]
session-var-name4 [[integer] | none]
session-var-name5 [[integer] | none]
split-username [true | false]
type [401 | form-based]
edit logon-page [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list logon-page
list logon-page [ [ [name] | [glob] | [regex] ] ... ]
show running-config logon-page
show running-config logon-page [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show logon-page
show logon-page [name]
Delete
delete logon-page [name]
329
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the logon-page component to create and manage a Logon Page agent. This agent creates a
logon page that includes the form in which users input the credentials required by an access policy. You
can use the customization-group option to customize the logon page.
Examples
• create logon-page MyLogonPageAgent my { type 401 basic-auth-realm myrealm split-username
false http-401-auth-level none }
Creates a basic authentication Logon Page agent named MyLogonPageAgent that results in a 401
response.
• list logon-page
Displays a list of Logon Page agents.
• delete logon-page MyLogonPageAgent
Deletes the Logon Page agent named MyLogonPageAgent.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• basic-auth-realm
Species the system being accessed for HTTP basic authentication. This value is shown in the 401
response. Use this option only for basic authentication Logon pages.
• customization-group
Species a predened conguration that contains several settings that you want the agent to use to
congure a logon page. This setting is required, and the customization group that you assign must be
of the type logon. Use this option only for basic authentication Logon pages.
• eld-modiable1 - eld-modiable5
Species whether the user can modify the contents of the eld on a form-based Logon page. The default
is true. You can use this option to display read-only information. A Logon page contains can have a
maximum of ve elds. Use this option only for form-based Logon pages.
• eld-type1 - eld-type5
Species the type of elds on a form-based Logon page. The default is text. Use this option only for
form-based Logon pages. The options are:
• checkbox
• none
• password
• text
• http-401-auth-level
Use this option only for basic authentication Logon pages. The options are:
• basic
• basic-negotiate
• negotiate
330
APM Policy Agent
• none
• [name]
Species the name of a Logon Page agent. This setting is required.
• partition
Displays the partition within which the component resides.
• post-var-name1 - post-var-name5
Species the name of the variable that is sent with POST request. Use this option only for form-based
Logon pages.
• sess-var-name1 - sess-var-name5
Species the session variable from which the initial value is taken. Use this option only for form-based
Logon pages.
• split-username
Species whether the user's input is split into username and domain. This option supports UPN style
logon ID (userid@domainid) and Windows Domain User account ID (domainid\userid). The default is
false. Set this to true when you want to store the username and domain separately.
Use this option only for basic authentication Logon pages.
• type
Species the type of logon page that appears. The options are:
• 401
Displays a basic HTTP authentication form.
• form-based
Displays a logon page.
See Also
external-logon-page
message-box
Manages a Message Box agent.
Syntax
Congure the message-box component within the policy agent module using the syntax shown in the
following sections.
Create/Modify
create message-box [name]
modify message-box [name]
331
Traffic Management Shell (tmsh) Reference Guide
app-service [[string] | none]
customization-group [string]
edit message-box [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list message-box
list message-box [ [ [name] | [glob] | [regex] ] ... ]
show running-config message-box
show running-config message-box [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show message-box
show message-box [name]
Delete
delete message-box [name]
Description
You can use the message-box agent to create, display, or delete a Message Box agent. You cannot use the
command line interface to create or modify the messages that display in a message box. You can also edit
customizable messages using the visual policy editor.
Examples
• create message-box MyMessageBoxAgent { customization group "MyMessageBoxCG" }
Creates the Message Box agent named MyMessageBoxAgent that is associated with the customization
group named MyMessageBoxCG.
• list message-box
Displays a list of Message Box agents.
• delete message-box MyMessageBoxAgent
Deletes the Message Box agent named MyMessage BoxAgent.
Options
• [name]
Species the name of a Message Box agent. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
332
APM Policy Agent
• customization-group
Species the name of the customization group that contains the messages you want to apply to an access
policy. This option is required.
• partition
Displays the partition within which the component resides.
oam
Manages an OAM agent.
Syntax
Warning: This page is obsolete. AAA OAM agent is no longer supported.
Congure the oam component within the policy agent module using the syntax shown in the following
sections.
Create/Modify
create oam [name]
modify oam [name]
app-service [[string] | none]
max-logon-attempt [integer]
server [[string] | none]
show-extended-error [true | false]
url [[string] | none]
edit oam [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list oam
list oam [ [ [name] | [glob] | [regex] ] ... ]
show running-config oam
show running-config oam [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show oam
show oam [name]
333
Traffic Management Shell (tmsh) Reference Guide
Delete
delete oam [name]
Description
You can use the oam component to create and manage an OAM agent.
Examples
• create oam oam_agent1 { server oam10g max-logon-attempt 3 show-extended-error false url
"http://www.mydomain.com/protected/" }
Creates an OAM agent named oam_agent1 that uses authentication server oam10g and prompts a user
for credentials three times before denying access to http://www.mydomain.com/protected/.
• modify oam oam_agent1 max-logon-attempt 4
• list oam all
Displays a list of OAM agents.
• delete oam my_oam_agent
Deletes the OAM agent named my_tacacsplus_agent.
Options
• [name]
Species the name of the component. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• partition
Displays the partition within which the component resides.
• server
Species the name of the OAM server used for user authentication. This option is required.
• url
Species the URL of the resource that is protected by the OAM server. It is used to authenticate the
user using the specied user credentials. This option is required, and you must specify an absolute URL.
An absolute URL species the exact location of a le or directory on the Internet.
• show-extended-error
Species to display a verbose error message on the retry logon page. The default value is false.
334
APM Policy Agent
resource-assign
Manages a Resource Assign agent.
Syntax
Congure the resource-assign component within the policy agent module using the syntax shown in the
following sections.
Create/Modify
create resource-assign [name]
modify resource-assign [name]
app-service [[string] | none]
rules (<string> | none)
type [acls | general | resources | webtop-and-webtop-links]
edit resource-assign [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list resource-assign
list resource-assign [ [ [name] | [glob] | [regex] ] ... ]
show running-config resource-assign
show running-config resource-assign [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show resource-assign
show resource-assign [name]
Delete
delete resource-assign [name]
Description
You can use the resource-assign component to create and manage an agent that assigns an ACL, a resource
group, or both to an access policy. A resource group is a collection of resources, access control lists, and
protection criteria, which includes your company intranet servers, applications, and network shares. An
ACL is a set of restrictions associated with a resource or favorite that denes access for users and groups.
Examples
• create resource-assign MyAssignResourceAgent my rules { { expression "expr { [mcget
{session.ad.last.authresult}] == 1 }" webtop-links add { google } } }
335
Traffic Management Shell (tmsh) Reference Guide
Creates the Resource Assign agent named MyAssignResourceAgent and assigns webtop-link google
when authentication is passed.
• list resource-assign all
Displays a list of Resource Assign agents.
• delete resource-assign MyAssignResourceAgent
Deletes the Resource Assign agent named MyAssignResourceAgent.
Options
• [name]
Species the name of the Resource Assign agent. This option is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• rules
Adds a rule to or deletes a rule from the Resource Assign agent. You can use the following attributes
to dene a rule:
• acl
Species an access control list that this rule assigns to users.
• connectivity-resource-group
Species the name of the connectivity resource group to which this rule applies.
• expression
Species the expression that indicates which resource groups this rule assigns to users.
• type
Species the type of Resource Assign agent. The default is general.
route-domain-selection
Manages a Route Domain Selection agent.
Syntax
Congure the route-domain-selection component within the policy agent module using the syntax shown
in the following sections.
Create/Modify
create route-domain-selection [name]
modify route-domain-selection [name]
app-service [[string] | none]
336
APM Policy Agent
location-specific [true | false]
route-domain [[integer] | none]
snat [automap | none]
snatpool [[string] | none]
edit route-domain-selection [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list route-domain-selection
list route-domain-selection [ [ [name] | [glob] | [regex] ] ... ]
show running-config route-domain-selection
show running-config route-domain-selection [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
partition
show route-domain-selection
show route-domain-selection [name]
Delete
delete route-domain-selection [name]
Description
You can use the route-domain-selection component to create a Route Domain Selection agent.
Examples
• create route-domain-selection my_rds_ag route-domain 0 snat automap
Creates the my_rds_ag Route Domain Selection agent.
• show route-domain-selection
Displays a list of Route Domain Selection agents.
• delete route-domain-selection my_rd_selection_agent
Deletes the Route Domain Selection agent named my_rd_selection_agent.
Options
• [name]
Species the name of a Variable Assignment agent. This option is required.
• partition
Displays the partition within which the component resides.
• app-service
337
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• route-domain
Species the route domain. The default is 0 (zero).
• snat
• automap
• none
Snat is not used.
• snatpool
tacacsplus
Manages a TACACS+ agent.
Syntax
Congure the tacacsplus component within the policy agent module using the syntax shown in the following
sections.
Create/Modify
create tacacsplus
modify tacacsplus
app-service [[string] | none]
max-logon-attempt [integer]
server [[string] | none]
edit tacacsplus [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tacacsplus
list tacacsplus [ [ [name] | [glob] | [regex] ] ... ]
show running-config tacacsplus
show running-config tacacsplus [ [ [name] | [glob] | [regex] ] ... ]
all-properties
338
APM Policy Agent
non-default-properties
partition
show tacacsplus
show tacacsplus [name]
Delete
delete tacacsplus [name]
Description
You can use the tacacsplus component to create and manage a TACACS+ agent.
Examples
• list tacacsplus all
Displays a list of TACACS+ agents.
• delete tacacsplus my_tacacsplus_agent
Deletes the TACACS+ agent named my_tacacsplus_agent.
Options
• [name]
Species the name of the component. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• max-logon-attempt
Species the maximum number of opportunities that users have to re-enter credentials after their rst
attempt to log in fails. If you set this value to a number from 2 to 5 inclusive, the system allows users
the specied number of opportunities to log in after the rst attempt to log in fails. If you set the value
to 1, the system does not allow a second log in opportunity after a rst log in attempt fails. The default
value is 3.
• partition
Displays the partition within which the component resides.
• server
Species the name of the TACACS+ server. This option is required.
variable-assign
Manages a Variable Assignment agent.
339
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the variable-assign component within the policy agent module using the syntax shown in the
following sections.
Create/Modify
create variable-assign [name]
modify variable-assign [name]
app-service [[string] | none]
type [citrix-smart-access | general | intranet-webtop | sso-cred-mapping
| virtual-keyboard]
variables { [varname [name] expression {[string] }}
edit variable-assign [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list variable-assign
list variable-assign [ [ [name] | [glob] | [regex] ] ... ]
show running-config variable-assign
show running-config variable-assign [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show variable-assign
show variable-assign [name]
Delete
delete variable-assign [name]
Description
You can use the variable-assign component to create and manage an agent that assigns one or more variables
to an access policy. F5 Networks recommends that you use the visual policy editor to create complex variable
assignments.
Examples
• create variable-assign username_variable_assign_ag { variables { varname
"session.logon.last.username" expression "{[mcget {session.ssl.cert.cn}]}" } }
Creates the username_variable_assign_ag Variable Assignment agent that automatically assigns the
value of the common name eld in the client certicate to the username eld of the logon page. This is
useful when an access policy contains the Variable Assignment agent between the client certication
and the AAA Active Directory server query actions.
340
APM Policy Agent
• create variable-assign acl_variable_assign_ag { variables { varname
"cong.connectivity_resource_network_access.MyproleNR2.acl_name" expression "expr
{\"MY_ACL1\"}" } }
Creates a Variable Assignment agent that carries out a congured ACL when a particular branch in the
access policy is followed, using the Variable Assignment agent to populate the appropriate variables
with the ACL name.
• show variable-assign
Displays a list of Variable Assignment agents.
• delete variable-assign MyAssignVariableAgent delete
Deletes the Variable Assignment agent named MyAssignVariableAgent.
Options
• [name]
Species the name of a Variable Assignment agent. This setting is required.
• partition
Displays the partition within which the component resides.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• type
Species the type of agent. The default is general.
• variables
Adds a variable to or deletes a variable from the Variable Assignment agent. You must specify the
following attributes for each variable:
• expression
A Tcl expression that the system evaluates, and then assigns the value of the expression to a specic
property of the assigned Network Access resource or to a newly created session variable.
• varname
A variable that forms the left-hand side of the expression. You can use the name of an existing
variable or a new session variable.
341
Traffic Management Shell (tmsh) Reference Guide
APM Profile
access
Congures an access prole.
Syntax
Congure the access component within the prole module using the syntax shown in the following sections.
Create/Modify
create access [name]
modify access [name]
accept-languages [add | delete | modify | replace-all-with] {
[name]
}
access-policy [[string] | none]
access-policy-timeout [integer]
app-service [[string] | none]
cache-generation [integer]
customization-group [[string] | none]
default-language [[string] | none]
defaults-from [[string] | none]
domain-cookie [[string] | none]
domain-groups [add | delete | modify | replace-all-with] {
[name]
}
domain-mode [single-domain | multi-domain]
user-identity-method [http | ip-address]
eps-group [[string] | none]
errormap-group [[string] | none]
framework-installation-group [[string] | none]
general-ui-group [[string] | none]
generation-action [increment | noop]
httponly-cookie [true | false]
inactivity-timeout [integer]
logout-uri-include [add | delete | modify | replace-all-with] {
[name]
}
logout-uri-timeout [integer]
log-settings [add | delete | modify | replace-all-with] {
[name]
}
max-concurrent-sessions [[integer] | none]
max-concurrent-users [[integer] | none]
max-failure-delay [integer]
max-in-progress-sessions [[integer] | none]
max-session-timeout [integer]
min-failure-delay [integer]
persistent-cookie [true | false]
primary-auth-service [[string] | none]
restrict-to-single-client-ip [true | false]
sandboxes [add | delete | modify | replace-all-with] {
[name] { retain-public-access [true|false] }
}
scope [profile | virtual-server | global]
secure-cookie [true | false]
sso-name [[string] | none]
edit access [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list access
list access [ [ [name] | [glob] | [regex] ] ... ]
show running-config access
show running-config access [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show access
show access [name]
Delete
delete access [name]
Description
You can use the access component to congure an access prole. An access prole is a pre-congured
group of settings that you can use to congure secure Network Access for an application.
Examples
• create access MyAccessProle { defaults-from access access-policy "my_access_policy"
accepted-languages "my_accepted_languages" default-language "en" customization-group
"company_logout" eps-group 'myepsgroup' framework-installation-group "company_header"
"company_footer" errormap-group "company_errormap" }
Creates an access prole named MyAccessProle that is based on the default access prole named
access, uses the access policy named my_access-policy, accepts the languages in the
my_accepted_languages class, uses English as the default language, and uses these groups to customize
the application pages and messages: company_logout, company_header, company_footer, and
company_errormap.
• list access all all-properties
Displays a list of access proles, including parameter values.
• delete access MyAccessProle
Deletes the access prole named MyAccessProle.
Options
• accept-languages
Species the name of a class that denes the languages supported by the access prole. The default
languages are en (English), ja (Japanese), zh-cn (simplied Chinese (PRC)), and zh tw (traditional
Chinese (Taiwan)). This option is required.
344
APM Profile
• access-policy
Species the access policy that you want to enforce using this access prole. An access policy contains
various security checks that a client must pass before the BIG-IP Access Policy Manager grants access
to a protected application. This option is required.
• access-policy-timeout
Species, for this access prole, the number of seconds within which a user must complete the steps to
gain access to an application. The default is 300 seconds. This option is designed to quickly release
session resources when a user does not complete the access process, for example, when the user closes
the browser before completing the access process.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• customization-group
Species the customization group that denes the appearance of the logout and error pages. This option
is required.
• default-language
Species the default language for the BIG-IP Access Policy Manager that you want to implement with
this access prole. The default is en (English). If the client requests a language that is not supported,
the BIG-IP Access Policy Manager uses the default value. This option is required.
• defaults-from
Species the default access policy from which this prole is created. This option is required.
• domain-cookie
Species a domain cookie to use with an application access control connection. If you specify a domain
cookie, then the line domain=specied_domain is added to the MRHsession cookie. The default is
none.
• domain-groups
Species a group of multiple domains or multiple hosts in multiple domains to which a single user
session has access. For example, you can use this option to congure a single user session to have access
to three domains: www.a.com, www.b.com, and www.c.com. When a user logs in to any of these
domains, that user can access the other domains without logging in again. This option is required when
you set the domain-mode option to multi-domain.
For each domain in the domain group, you can specify the following settings:
• cookie-host
Species the host name for which to create the user's session cookie.
• cookie-domain
Species the domain for which to create the user's session cookie.
• secure-cookie
Adds a security attribute to the user's session cookie.
• persistent-cookie
Adds a persistence attribute to the user's session.
• sso-name
Species the SSO method to use when accessing a backend application.
345
Traffic Management Shell (tmsh) Reference Guide
• domain-mode
Species how the SSO conguration is applied. The options are:
• single-domain
Applies the SSO conguration to a single domain. This is the default.
When you set domain-mode to single-domain, you must also set the sso-name option.
• multi-domain
Applies the SSO conguration across multiple domains. This option allows users a single APM
login/session and applies the credentials across multiple Local Trafc Manager or Access Policy
Manager virtual servers in front of different domains. Note that to apply SSO congurations across
multiple domains, all virtual servers must be on one BIG-IP system.
When you set domain-mode to multi-domain, you must also congure the domain-group option,
and provide a URI for the primary-auth-service option.
• user-identity-method
Species how access will bind a session to a request.
• http
Use http information such as cookies and URI query string to identify user.
• ip-address
Use IP address to identify a user. Do not use this setting if clients may be behind a NAT.
• eps-group
This option is required.
• errormap-group
Species the customization settings for the error map that you want to implement with this access prole.
This setting is required.
• framework-installation-group
Species the customization settings for the header and footer that you want to implement with this access
prole. This setting is required.
• generation-ui-group
Species the generation of the user interface group for the new generation access conguration. This
option is required.
• generation-timeout
Species the timeout, in seconds, for the new generation access conguration.
• generation-action
• increment
Activates the current access policy conguration for an access prole. For example, the following
command activates current access policy conguration for prole myAccessProle: tmsh modify
apm prole access myAccessProle generation-action increment
• noop
Species "no operation to be performed". This is the default.
• sync
Species that the policy is being modied due to APM policy sync operation. This is an internal
action; you should not set it.
346
APM Profile
• httponly-cookie
Species whether HttpOnly directive should be inserted in HTTP response from BIG-IP. The client
browser should prevent script from accessing cookie, if this ag is set in the response. The default is
false.
• inactivity-timeout
Species, for this access prole, the number of seconds that the session on the client can be idle before
the server disconnects the VPN tunnel. The default is 900 seconds.
• logout-uri-include
Species a list of URIs to include in the access prole for initiating session logout.
• logout-uri-timeout
Species the timeout used to delay logout for the customized logout URIs dened in the logout uri
include list
• log-settings
Species one or more log-setting containers to associate with this prole
• max-concurrent-sessions
Species, for this access prole, the number of concurrent sessions allowed. The default is 0 (zero),
which represents unlimited sessions. Users assigned an administrative role of Application Editor can
view the value of this option. Users assigned any other administrative role can modify this option.
• max-concurrent-users
Species, for this access prole, the number of concurrent sessions allowed. The default is 0 (zero),
which represents unlimited sessions. This eld is Read-only for Application Editors. Users assigned
any other administrative role can modify this eld.
• max-failure-delay
Species the maximum random delay after authentication failure during the access policy. It is the
maximum number of seconds before the user is shown an error message on the logon page and prompted
to re-enter credentials. The default is 5 seconds. 0 (zero) represents no delay. Note: Set max-failure-delay
to no more than one-half the access-policy-timeout value and no more than 65 seconds greater than
min-failure-delay.
• max-in-progress-sessions
Species the maximum number of in-progress concurrent sessions a user can have. The in-progress
sessions are the sessions for which an access policy has not completed. The default is 0, which represents
an unlimited number of such sessions.
• max-session-timeout
Species the maximum lifetime of one session. The maximum lifetime is the number of seconds between
session creation and session termination.
• min-failure-delay
Species the minimum random delay after authentication failure during the access policy. It is the
minimum number of seconds before the user is prompted for credentials again or shown an error message
on the logon page. The default is 2 seconds.
• [name]
Species the name of the access prole. This option is required.
• persistent-cookie
Species to retain the cookie for a user session, even when the user session is terminated, when set to
true. Although this is an insecure method, this setting is useful and required in cases where you have a
third-party application, such as Sharepoint, and need to store the cookie in a local database so that any
347
Traffic Management Shell (tmsh) Reference Guide
attempt to access backend server applications through Access Policy Manager succeeds. The default is
false.
• primary-auth-service
Species the address of your primary authentication URI. This setting is required when you set the
domain-mode option to multi-domain.
For example, when you set this option to https://logon.yourcompany.com, the user session is stored
on this primary domain, and the user can access multiple backend applications from multiple domains
and hosts without re-entering credentials.
• restrict-to-single-client-ip
Species whether a user session is tied to a single client IP. If during session's lifetime, the user's client
IP address changes, the current session is terminated. The user needs to re-login to create a new session
from the new client IP address. The default is false.
• sandboxes
Species the association between the access prole and the sandbox. If retain-public-access is set to
true, this association is retained even if there is no resource that uses sandbox les in the access policy
that corresponds to this access prole.
• scope
Species the conning scope for sessions created by the prole. Set this option to prole (which is also
the default-value) to conne the validity of a session to the prole from which it was created. Set this
option to virtual-server to further conne the validity of a session to the virtual server from which it
was created. Setting this option to global allows the session to be valid on any virtual server with any
access prole that also species global scope.
• secure-cookie
Set this option to true, if you want to add a secure keyword to the session cookie. Set this option to
false, if you want to congure an application access control scenario that uses an HTTPS virtual server
to authenticate the user, and then sends the user to an existing HTTP virtual server to use applications.
The default is true.
• sso-name
Species the SSO conguration that you want BIG-IP Access Policy Manager to use to submit the user's
credentials to the backend application. This allows the user to log in once to the Access Policy Manager
and then gain access to backend applications without logging in again.
See Also
apm sso, apm policy
connectivity
Congures a connectivity prole.
Syntax
Congure the connectivity component within the prole module using the syntax shown in the following
sections.
348
APM Profile
Create/Modify
create connectivity [name]
modify connectivity [name]
adaptive-compression [enabled | disabled]
app-service [[string] | none]
citrix-client-bundle [[name] | default-citrix-client-bundle]
client-policy [add | delete | modify | replace-all-with] {
[name] {
android-ec {
device-lock-method [alphabetic | alphanumeric | any | numeric
]
enable-mobilesafe [true | false]
enforce-device-lock [true | false]
enforce-logon-mode [true | false]
logon-mode [native | web]
max-inactivity-time [integer]
min-passcode-length [integer]
save-password [true | false]
save-password-method [disk | memory]
save-password-timeout [integer]
}
android-ep {
device-lock-method [alphabetic | alphanumeric | any | numeric
]
enable-mobilesafe [true | false]
enforce-device-lock [true | false]
enforce-logon-mode [true | false]
logon-mode [native | web]
max-inactivity-time [integer]
min-passcode-length [integer]
save-password [true | false]
save-password-method [disk | memory]
save-password-timeout [integer]
}
chromeos-ec {
enforce-logon-mode [true | false]
logon-mode [native | web]
save-password [true | false]
save-password-method [disk | memory]
save-password-timeout [integer]
}
ec {
component-update [yes | prompt | no]
location-dns [add | delete | modify | replace-all-with] {
[name]
}
reuse-winlogon-creds [true | false]
reuse-winlogon-session [true | false]
save-password [true | false]
save-password-method [disk | memory]
save-password-timeout [integer]
save-servers-on-exit [true | false]
}
ios-ec {
enable-mobilesafe [true | false]
enforce-logon-mode [true | false]
logon-mode [native | web]
require-device-auth [true | false]
save-password [true | false]
save-password-method [disk | memory]
save-password-timeout [integer]
vod-disconnect-timeout [integer]
}
ios-ep {
enable-mobilesafe [true | false]
enforce-logon-mode [true | false]
logon-mode [native | web]
349
Traffic Management Shell (tmsh) Reference Guide
enforce-pin-lock [true | false]
max-grace-period [integer]
save-password [true | false]
save-password-method [disk | memory]
save-password-timeout [integer]
}
servers {
{
alias [[string] | none]
host [string]
}
...
}
}
}
compress-buffer-size [integer]
compress-cpu-saver [true | false]
compress-cpu-saver-high [integer]
compress-cpu-saver-low [integer]
compress-gzip-level [integer]
compress-gzip-memlevel [integer]
compress-gzip-window-size [integer]
compress-ingress [true | false]
compress-preferred-method [[string] | none]
compression [enabled | disabled]
compression-codecs [[string] | none]
customization-group [[string] | none]
defaults from [[name] | none]
deflate-compression-level [integer]
description [[string] | none]
location-specific [true | false]
tunnel-name [[string] | none]
edit connectivity [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list connectivity
list connectivity [ [ [name] | [glob] | [regex] ] ... ]
show running-config connectivity
show running-config connectivity [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show connectivity
show connectivity [name]
Delete
delete connectivity [name]
350
APM Profile
Description
You can use the connectivity component to congure a connectivity prole. By using the connectivity
prole, you can congure L2 and L4 tunnels, compression, Windows and mobile client settings, and client
component downloads from F5 Networks and Citrix.
Examples
create connectivity myconnectivityprole { }
Creates a connectivity prole named myconnectivityprole that inherits its settings from the system default
connectivity prole.
Options
• adaptive-compression
Enables or disables adaptive compression. Use this option to congure compression settings for
application tunnels and to optimize applications and RDP trafc. The default is enabled.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• citrix-client-bundle
Species the Citrix client bundle used by this connectivity prole. The default is
default-citrix-client-bundle.
• client-policy
Adds, deletes, or modies the client policy for any of the following clients:
• android-ec
Android Edge Client
• android-ep
Android Edge Portal
• chromeos-ec
Chrome OS Edge Client
• ec
Windows/OSX Edge Client
• ios-ec
iOS Edge Client
• ios-ep
iOS Edge Portal
Options (please refer to the SYNTAX section to see if a certain option is supported for a particular
client):
• component-update
Species how the client handles automatic updates. The options are:
• yes
Automatically installs a client update when one is available.
• prompt
351
Traffic Management Shell (tmsh) Reference Guide
Prompts the user about installing a client update.
• No
Disables the client from receiving automatic updates.
• device-lock-method
Species the device lock quality that the client should enforce on the device. The options are:
• alphabetic
Device passcode must contain at least alphabetic (or other symbol) characters.
• alphanumeric
Device passcode must contain at least both numeric and alphabetic (or other symbol) characters.
• any
A device passcode must be set but does not matter what it is.
• numeric
Device passcode must contain at least numeric characters.
• enable-mobilesafe
Enables or disable MobileSafe checks. Use this option to congure whether client should execute
the MobileSafe security checks as part of the logon. The default is false.
• enforce-device-lock
Species whether client should enforce a device passcode policy on the device. The default is true.
• enforce-logon-mode
Species whether client should enforce a logon mode on the device. The default is false. Set to true
if external logon page is used.
• logon-mode
Species logon mode to be enforced on the device. The default is native. Set to web if external
logon page is used.
• enforce-pin-lock
Species whether client should enforce an app-level PIN before allowing access to the app. The
default is true.
• location-dns
Species a list of DNS sufxes used by the Network Location Awareness feature of the client. This
list represents the internal network where local resources are available without the need of a Network
Access connection. The default is none.
• max-grace-period
Species the length of time (in minutes) the app was taken to the background before the user will
be asked for a PIN. With the option set to 0, user will be asked for the PIN every time the app is
taken from the background. The default is 2.
• max-inactivity-time
Sets the length of time (in minutes) since the user last touched the screen or pressed a button before
the device locks the screen. The default is 5.
• min-passcode-length
Species the minimum required number of characters for the device passcode. The default is 4.
• require-device-auth
352
APM Profile
Species whether device authentication is needed before accessing cached credentials. The default
is false.
• reuse-winlogon-creds
Species whether client can reuse logon credentials entered by a user for a subsequent log in. The
default is false.
• reuse-winlogon-session
Species whether client should attempt to use the same Windows logon session. The default is false.
• save-password
Species whether client allows user password caching. The default is false.
• save-password-method
Species whether client saves encrypted passwords on disk or caches passwords in memory only.
The default is disk.
• save-password-timeout
Species the number of minutes that a cached password remains valid (applies only to in-memory
password caching). The default is 240.
• save-servers-on-exit
Species whether client maintains a list of Access Policy Manager systems that the client accessed.
The default is true.
• servers
Species a list of server and alias pairs in the client's server list.
• compress-buffer-size
Species the size of compressed data for Network Access tunnels. The default is 4096.
• compress-cpu-saver
Species whether the system monitors the percentage of CPU usage and adjusts compression rates
automatically when CPU usage reaches either the CPU saver high threshold or the CPU saver low
threshold. The default is true.
• compress-cpu-saver-high
Species the percentage of CPU usage at which the system starts automatically decreasing the amount
of content being compressed, as well as the amount of compression which the system is applying. The
default is 90 percent.
• compress-cpu-saver-low
Species the percentage of CPU usage at which the system resumes content compression at the
user-dened rates. The default is 75 percent.
• compress-gzip-level
Species the degree to which the system compresses the content. Higher compression levels slow down
the compression process. The default is 6, which provides a higher amount of compression at the expense
of more CPU processing time. 1 is the lowest level and 9 is the highest level. 0 disables compression.
• compress-gzip-memlevel
Species the number of kilobytes of memory that the system uses for internal compression buffers when
compressing data. You can select a value between 1 and 256. The default is 8192.
• compress-gzip-window-size
Species the number of kilobytes in the window size that the system uses when compressing data. You
can select a value between 1 and 128. The default is 16384.
353
Traffic Management Shell (tmsh) Reference Guide
• compress-ingress
Species whether incoming data is compressed. The default is false.
• compress-preferred-method
Species the preferred method of data compression. The default is zlib.
• compression
Enables or disables compression between the client and the server. The default is enabled.
• compression-codecs
Species the available compression codecs for server-to-client connections. The server compares the
available compression types you congure with the available compression types on the client, and then
chooses the most effective mutual compression setting. Compression for the client is congured separately.
The default includes all three available codecs:
• lzo
Offers a balance between CPU resources and compression ratio, compressing more than deate, but
with less CPU resources than bzip2.
• deate
Uses the least CPU resources, but compresses the least effectively.
• bzip2
Uses the most CPU resources, but compresses the most effectively.
• customization-group
Species which customization groups are applied. This option is required.
• defaults-from
Species the prole from which this prole inherits properties that are not specied explicitly. The
default is connectivity.
• deate-compression-level
Species the level of compression performed by the deate codec. The default is 1.
• description
Species a user-dened description for the connectivity prole.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the prole that you want to use as the parent prole. The new prole inherits all settings and
values from the parent prole.
• tunnel-name
Species the name of the tunnel through which data passes. The default is none.
See Also
apm prole, ltm virtual
354
APM Profile
exchange
Congures an exchange prole.
Syntax
Congure the exchange component within the prole module using the syntax shown in the following
sections.
Create/Modify
create exchange [name]
modify exchange [name]
ntlm-auth-name [[string] | none]
active-sync-url [[string] | none]
active-sync-auth-type [basic | ntlm | basic-ntlm]
active-sync-sso-config [[string] | none]
auto-discover-url [[string] | none]
auto-discover-auth-type [basic | ntlm | basic-ntlm]
auto-discover-sso-config [[string] | none]
description [[string] | none]
offline-address-book-url [[string] | none]
offline-address-book-auth-type [basic | ntlm | basic-ntlm]
offline-address-book-sso-config [[string] | none]
rpc-over-http-url [[string] | none]
rpc-over-http-auth-type [basic | ntlm | basic-ntlm]
rpc-over-http-sso-config [[string] | none]
user-agent-pattern-for-utf8 [[string] | none]
web-service-url [[string] | none]
web-service-auth-type [basic | ntlm | basic-ntlm]
web-service-sso-config [[string] | none]
edit exchange [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list exchange
list exchange [ [ [name] | [glob] | [regex] ] ... ]
show running-config exchange
show running-config exchange [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show exchange
show exchange [name]
355
Traffic Management Shell (tmsh) Reference Guide
Delete
delete exchange [name]
Description
You can use the exchange component to congure an exchange prole. An exchange prole is a
precongured group of settings that you can use to congure authentication for exchange services such as
Outlook Anywhere, ActiveSync, Autodiscover and Ofine Address Book, so that those work with BIG-IP.
Examples
create exchange MyExchangeProfile {
ntlm-auth-name "MyNTLMAuth"
rpc-over-http-url "/rpc/rpcproxy.dll"
rpc-over-http-auth-type ntlm
rpc-over-http-sso-config "MyKerberosSSOConfig"
}>
Creates an exchange prole named MyExchangeProle that is based on the general settings such as NTLM
Authentication conguration MyNTLMAuth. The prole is congured for Outlook Anywhere (RPC over
HTTP) service with url "/rpc/rpcproxy.dll*, client authentication type ntlm and SSO conguration type
MyKerberosSSOCong
• list exchange all all-properties
Displays a list of exchange proles, including parameter values.
• delete access MyExchangeProle
Deletes the exchange prole named MyExchangeProle.
Options
• ntlm-auth-name
Species the NTLM conguration object that clients can use to authenticate on the front-end. Backend
SSO type must be Kerberos for ntlm or basic-ntlm front end.
• active-sync-auth-type
Species the client-side authentication type for ActiveSync exchange service. The valid value is basic.
• active-sync-sso-cong
Species the back end SSO cong for ActiveSync exchange service. This is optional.
• active-sync-url
Species the URL for ActiveSync exchange service. URL is required for ActiveSync service to be
enabled through BIG-IP.
• auto-discover-auth-type
Species the client-side authentication type for Autodiscover exchange service. The valid values are
basic, ntlm and basic-ntlm.
• auto-discover-sso-cong
Species the back end SSO cong for Autodiscover exchange service. This is optional.
• description
356
APM Profile
Species a user-dened description for the exchange prole.
• auto-discover-url
Species the URL for Autodiscover exchange service. URL is required for Autodiscover service to be
enabled through BIG-IP.
• ofine-address-book-auth-type
Species the client-side authentication type for Ofine Address Book exchange service. The valid values
are basic, ntlm and basic-ntlm.
• ofine-address-book-sso-cong
Species the back end SSO cong for Ofine Address Book exchange service. This is optional.
• ofine-address-book-url
Species the URL for Ofine Address Book exchange service. URL is required for Ofine Address
Book service to be enabled through BIG-IP.
• rpc-over-http-auth-type
Species the client-side authentication type for Outlook Anywhere (RPC over HTTP) exchange service.
The valid values are basic, ntlm and basic-ntlm.
• rpc-over-http-sso-cong
Species the back end SSO cong for Outlook Anywhere (RPC over HTTP) exchange service. This is
optional.
• rpc-over-http-url
Species the URL for Outlook Anywhere (RPC over HTTP) exchange service. URL is required for
Outlook Anywhere (RPC over HTTP) service to be enabled through BIG-IP.
• user-agent-pattern-for-utf8
Species the user agent pattern for UTF8.
• web-service-auth-type
Species the client-side authentication type for Web Exchange service. The valid values are basic, ntlm
and basic-ntlm.
• web-service-sso-cong
Species the back end SSO cong for Web Exchange service. This is optional.
• web-service-sync-url
Species the URL for Web Exchange service. URL is required for Web Service to be enabled through
BIG-IP.
See Also
apm sso, apm prole access
remote-desktop
Displays information about a default prole that supports a Citrix remote desktop resource.
Syntax
Displays the properties of the remote-desktop component within the prole module.
357
Traffic Management Shell (tmsh) Reference Guide
Display
list remote-desktop
list remote-desktop [ [ [name] | [glob] | [regex] ] ... ]
show running-config remote-desktop
show running-config remote-desktop [ [glob] | [regex] ] ... ]
all-properties
location-specific [true | false]
non-default-properties
one-line
Description
You can use the remote-desktop component to display the properties of the default remote desktop prole.
A remote desktop prole is for internal use only. You should not create or modify a remote desktop prole.
Examples
list remotedesktop all-properties
Displays all of the properties of the default remote desktop prole.
Options
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
See Also
ltm_virtual
vdi
Congures a VDI prole.
Syntax
Congure the vdi component within the prole module using the syntax shown in the following sections.
Create/Modify
create vdi [name]
modify vdi [name]
msrdp-ntlm-auth-name [[string] | none]
edit vdi [ [ [name] | [glob] | [regex] ] ... ]
358
APM Profile
all-properties
non-default-properties
Display
list vdi
list vdi [ [ [name] | [glob] | [regex] ] ... ]
show running-config vdi
show running-config vdi [ [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete vdi [name]
Description
You can use the vdi component to congure a VDI prole. A VDI prole is a group of settings that you
can use to enable and congure VDI services such as Citrix, VMware View and MSRDP, so that those
work with the BIG-IP system.
Examples
create vdi MyVdiProfile {
msrdp-ntlm-auth-name "MyNTLMAuth"
}
Creates a VDI prole named MyVdiProle with NTLM Authentication conguration MyNTLMAuth to
be used for MSRDP clients authentication.
• list vdi all-properties
Displays a list of VDI proles, including parameter values.
• delete vdi MyVdiProle
Deletes the VDI prole named MyVdiProle.
Options
• msrdp-ntlm-auth-name
Species the NTLM auth conguration object to be used by this VDI prole for MSRDP client
authentication.
See Also
ltm_virtual
359
Traffic Management Shell (tmsh) Reference Guide
APM Resource
app-tunnel
Congures an application tunnel.
Syntax
Congure the app-tunnel component within the resource module using the syntax shown in the following
sections.
Create/Modify
create app-tunnel [name]
modify app-tunnel [name]
acl-order [integer]
app-service [[string] | none]
application-launch-warning [true | false]
apps [add | delete | modify | replace-all-with] {
[name]
}
customization-group [add | delete | modify | replace-all-with] {
[name]
}
description [[string] | none]
location-specific [true | false]
type [app-tunnel | last | network-access | remote-desktop | web-application]
edit app-tunnel [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list app-tunnel
list app-tunnel [ [ [name] | [glob] | [regex] ] ... ]
show running-config app-tunnel
show running-config app-tunnel [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show app-tunnel
show app-tunnel [name]
Delete
delete app-tunnel [name]
Description
You can use the app-tunnel component to congure an application tunnel to provide secure access to a
network, remote desktop, or specic applications.
Examples
item create app-tunnel myapptunnel customization-group myapptunnelcg
Creates an application tunnel named myapptunnel that uses the policies in the customization group
myapptunnelcg.
item delete app-tunnel myapptunnel
Deletes the application tunnel named myapptunnel.
Options
• acl-order
Species the location of this app tunnel in the ACL hierarchy in Access Policy Manager ACL lists. The
default is 0 (zero).
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• application-launch-warning
Species whether to display a warning before launching an application. The options are:
• true
The system displays security warnings before launching an application, regardless of whether the
site is considered a Trusted site. This is the default value.
• false
The system displays security warnings before launching an application, only if the site is not in the
Trusted Sites list.
• apps
Species the applications that a user can access using this application tunnel. The default is none.
• customization-group
Species whether customizations are applied to the application tunnel. You can add, modify, delete, or
replace all customization groups. This option is required.
• description
Species a description for the application tunnel. The default is none.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
362
APM Resource
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a name for the component.
• partition
Displays the partition within which the app-tunnel component resides. The default is common.
• type
Species the type of application tunnel. The options are:
• app-tunnel
This is the default.
• network-access
Provides access to a network.
• remote-desktop
Provides access to a remote desktop.
• web-application
Provides access to a Web application.
client-rate-class
Congures a client rate class resource.
Syntax
Congure the client-rate-class component within the resource module using the syntax shown in the
following sections.
Create/Modify
create client-rate-class [name]
modify client-rate-class [name]
app-service [[string] | none]
burst [integer]
ceiling [integer]
description [[string] | none]
dscp [integer]
location-specific [true | false]
mode [borrow | discard | shape]
rate [integer]
type [best-effort | controlled-load | guaranteed]
edit client-rate-class [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
363
Traffic Management Shell (tmsh) Reference Guide
Display
list client-rate-class
list client-rate-class [ [ [name] | [glob] | [regex] ] ... ]
show running-config client-rate-class
show running-config client-rate-class [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show client-rate-class
show client-rate-class [name]
Delete
delete client-rate-class [name]
Description
You can use the client-rate-class component to congure a client rate class resource, which is used in trafc
control.
Examples
• create client-rate-class sf1{ dscp 40 rate 60000 ceiling 80000 mode shape }
Creates a client rate class resource named sf1 used in trafc control. Sets the dscp to 40 and the rate to
60000, sets the ceiling to 80000, and sets the mode to shape.
• list client-rate-class all
Displays a list of all client rate class on the system.
• delete client-rate-class sf1
Deletes the client rate class named sf1 from the system.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• burst
Species in bytes the maximum amount of data that can reach the ceiling rate at one time. The default
is 0 (zero).
• ceiling
Species how far, beyond the value specied for the rate option, that trafc can ow when bursting.
This number sets an absolute limit. No trafc can exceed this rate. The rate class might limit trafc
throughput to the value of the rate option when there is high contention among siblings of a parent-child
class hierarchy. The default value is the value of the rate option. The minimum value is 296 bp.
• description
Species a description for the client rate class. The default is none.
364
APM Resource
• dscp
Species six bits of DS eld used as a codepoint to select the PHB (Per Hope Behavior) for a packet in
each network node. The default is -1.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a unique name to identify the client rate class.
• mode
Species the mode to use for this client rate class. The options are:
• borrow
Allows trafc on the client rate class to borrow resources from other ows that are temporarily idle.
Trafc that borrows resources is marked as nonconforming and receives a lower priority. This is the
default.
• discard
Discards packets that do not conform to the specied trafc control descriptor.
• shape
Delays packets submitted for transmission until the packets conform to the specied ow parameters
• partition
Displays the partition within which this component resides. The default is common.
• rate
Species the guaranteed throughput rate of the trafc handled by this rate class. You can congure the
rate in bits per second (bps), kilobits per second (Kbps), megabits per second (Mbps), or gigabits per
second (Gbps).
• type
Species the service type in use for the client rate class. The options are:
• best-effort
Windows trafc control creates a ow for this client trafc class, and trafc on the ow is handled
with the same priority as other Best Effort trafc. This is the default.
• controlled-load
Trafc control transmits a very high percentage of packets to the intended receivers. Packet loss for
this type closely approximates the basic packet error rate of the transmission medium. Transmission
delay for a very high percentage of the delivered packets does not greatly exceed the minimum transit
delay experienced by any successfully delivered packet.
• guaranteed
Guarantees that datagrams arrive within a specied delivery time and will not be discarded due to
queue overows, provided that the ow of trafc stays within specied trafc parameters. This type
is intended for applications that require guaranteed packet delivery.
See Also
tmsh
365
Traffic Management Shell (tmsh) Reference Guide
client-traffic-classifier
Congures client trafc classier entries.
Syntax
Congure the client-trafc-classier component within the resource module using the syntax shown in
the following sections.
Create/Modify
create client-traffic-classifier [name]
modify client-traffic-classifier [name]
app-service [[string] | none]
entries [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
client-rate-class [[string] | none]
dst-ip [[ipv4 address] | none]
dst-mask [[integer] | none]
dst-port [[integer] | none]
protocol [[integer] | none]
src-ip [[ipv4 address ] | none]
src-mask [[integer] | none]
src-port [[integer] | none]
}
location-specific [true | false]
}
edit client-traffic-classifier [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list client-traffic-classifier
list client-traffic-classifier [ [ [name] | [glob] | [regex] ] ... ]
show running-config client-traffic-classifier
show running-config client-traffic-classifier [ [ [name] | [glob] | [regex]
] ... ]
all-properties
app-service
non-default-properties
one-line
partition
show client-traffic-classifier
show client-traffic-classifier [name]
366
APM Resource
Delete
delete client-traffic-classifier [name]
Description
You can use the client-trafc-classier component to congure a client trafc classier, which is used by
trafc control agent.
Examples
• create client-trafc-classier tf1{ entries entry1 { protocol "6" dst-ip "192.168.0.0" dst-mask
"255.255.0.0" dst-port "0" client-rate-class "sf1" }
entry2{protocol "6"
src-ip "10.10.0.0"
src-mask "255.255.255.0"
client-rate-class "sf2"}}
Creates a client trafc classier named tf1, sets the entry to entry1, the protocol to 6, the DST IP to
192.168.0.0, the DST mask to 255.255.0.0, the DST port to 0 (zero), and the client rate class to sf1.
• list client-trafc-classier all
Displays a list of all client trafc classiers on the system.
• modify client-trafc-classier tf1 entries entry1 protocol 17
Modies the client trafc classier named tf1.
• delete client-trafc-classier tf1
Deletes the client trafc classier named tf1 from the system.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• dst-ip
Species the IP address of the receiver of the packet.
• dst-mask
Species the subnet mask for the destination address.
• dst-port
Species the 16-bit number to identify the sending port for either UDP or TCP network application.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
367
Traffic Management Shell (tmsh) Reference Guide
Species the name of the component.
• partition
Displays the partition within which the component resides. The default is Common.
• protocol
Species which trafc protocol to use in the ltering rule.
• src-ip
Species the address from which the packet is being sent.
• src-mask
Species the subnet mask for the source address.
• src port
Species a 16-bit number to identify the sending port for either UDP or TCP network application.
See Also
tmsh
ipv6-leasepool
Congures a lease pool.
Syntax
Congure the ipv6-leasepool component within the resource module using the syntax shown in the following
sections.
Create/Modify
create ipv6-leasepool [name]
modify ipv6-leasepool [name]
options
app-service [[string] | none]
description [[string] | none]
location-specific [true | false]
members [add | delete | modify | replace-all-with] {
[[first ip address in range] - [last ip address in range]]
}
Display
list ipv6-leasepool
list ipv6-leasepool [ [ [name] | [glob] | [regex] ] ... ]
show running-config ipv6-leasepool
show running-config ipv6-leasepool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
368
APM Resource
one-line
partition
show ipv6-leasepool
show ipv6-leasepool [name]
Delete
delete ipv6-leasepool [name]
Description
Congures an IPv6 lease pool to create a collection of IPv6 addresses grouped as a single object. You can
use a lease pool to associate that collection of IP addresses with a network access resource.
Examples
create ipv6-leasepool myipv6-leasepool {fd1f::1-fd1f::64}
Creates a ipv6-leasepool named myipv6-leasepool that contains the IPv6 addresses in the range fd1f::1 -
fd1f::64.
Note: No spaces are allowed between the rst IPv6 address, hyphen, and second IPv6 address.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a unique description of the lease pool.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a unique name for the lease pool.
• members
Species a range of IPv6 addresses separated by a hyphen.
• partition
Displays the partition within which the component resides. The default is Common.
See Also
apm prole, ltm virtual
369
Traffic Management Shell (tmsh) Reference Guide
leasepool
Congures a lease pool.
Syntax
Congure the leasepool component within the resource module using the syntax shown in the following
sections.
Create/Modify
create leasepool [name]
modify leasepool [name]
options
app-service [[string] | none]
description [[string] | none]
location-specific [true | false]
members [add | delete | modify | replace-all-with] {
[[first ip address in range] - [last ip address in range]]
}
Display
list leasepool
list leasepool [ [ [name] | [glob] | [regex] ] ... ]
show running-config leasepool
show running-config leasepool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show leasepool
show leasepool [name]
Delete
delete leasepool [name]
Description
Congures a lease pool to create a collection of IPv4 addresses grouped as a single object. You can use a
lease pool to associate that collection of IPv4 addresses with a network access resource.
Examples
create leasepool myleasepool {10.10.10.1-10.10.10.10}
Creates a leasepool named myleasepool that contains the IPv4 addresses in the range 10.10.10.1 - 10.10.10.10.
Note: No spaces are allowed between the rst IPv4 address, hyphen, and second IPv4 address.
370
APM Resource
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a unique description of the lease pool.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a unique name for the lease pool.
• members
Species a range of IP addresses separated by a hyphen.
• partition
Displays the partition within which the component resides. The default is Common.
See Also
apm prole, ltm virtual
network-access
Congures general settings for a network access connection.
Syntax
Congure the network-access component within the resource module using the syntax shown in the
following sections.
Create/Modify
create network-access [name]
modify network-access [name]
app-service [[string] | none]
address-space-dhcp-requests-excluded [true | false]
address-space-exclude-subnet [[string] | none]
ipv6-address-space-exclude-subnet [[string] | none]
address-space-include-dns-name [[string] | none]
address-space-exclude-dns-name [[string] | none]
address-space-include-subnet [[string] | none]
ipv6-address-space-include-subnet [[string] | none]
address-space-local-subnets-excluded [true | false]
address-space-loc-dns-servers-excluded [true | false]
address-space-protect [true | false]
application-launch [[string] | none]
application-launch-warning [true | false]
371
Traffic Management Shell (tmsh) Reference Guide
auto-launch [true | false]
client-interface-speed [[integer] | none]
client-ip-filter-engine [true | false]
client-power-management [ignore | prevent | terminate]
client-proxy [true | false]
client-proxy-address [ip addr]
client-proxy-enforce-subnets [true | false]
client-proxy-exclusion-list [[string] | none]
client-proxy-local-bypass [true | false]
client-proxy-port [[integer] | none]
client-proxy-script [[string] | none]
client-proxy-use-http-pac [true | false]
client-proxy-use-local-proxy [true | false]
client-traffic-classifier [[string] | none]
compression [gzip | none]
customization-group [[string] | none]
description [[string] | none]
dns-primary [ip addr]
ipv6-dns-primary [ip addr]
dns-secondary [ip addr]
ipv6-dns-secondary [ip addr]
dns-suffix [[string] | none]
drive-mapping [[string] | none]
dtls [true | false]
dtls-port [[integer] | none]
execute-logoff-scripts [true | false]
idle-timeout-threshold [[integer] | none]
idle-timeout-window [[integer] | none]
leasepool-name [[string] | none]
location-specific [true | false]
ipv6-leasepool-name [[string] | none]
microsoft-network-client [true | false]
microsoft-network-server [true | false]
network-tunnel [enabled | disabled]
optimized-app [add | delete | modify | none | replace-all-with ]
provide-client-cert [true | false]
proxy-arp [true | false]
split-tunneling [true | false]
static-host [[string] | none]
supported-ip-version [ipv4 | ipv4-ipv6]
sync-with-active-directory [true | false]
type [app-tunnel | last | network-access | remote-desktop | web-application]
wins-primary [ip addr]
wins-secondary [ip addr]
edit network-access [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list network-access
list network-access [ [ [name] | [glob] | [regex] ] ... ]
show running-config network-access
show running-config network-access [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
372
APM Resource
one-line
partition
show network-access
show network-access [name]
Delete
delete network-access [name]
Description
You can use the network-access component to congure the general settings for a network access connection.
Examples
• create network-access mynetwork-access customization-group mynetaccess
Creates a network access connection conguration object named mynetwork-access that uses the
policies in the customization group named mynetaccess.
• delete network-access mynetwork-access
Deletes the network access connection conguration object named mynetwork-access.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• address-space-dhcp-requests-excluded
Species whether requests from IP addresses using DHCP are excluded from accessing the network.
The default is true.
• address-space-exclude-subnet
Species the IPv4 address spaces whose trafc you want to exclude from access to a subnet on the
network. The default is none.
• ipv6-address-space-exclude-subnet
Species the IPv6 address spaces whose trafc you want to exclude from access to a subnet on the
network. The default is none.
• address-space-include-dns-name
Species a list of domain names describing the target LAN DNS addresses for split tunneling only. You
can add multiple address spaces to the list. For each address space, type the domain name, in the form
site.siterequest.com or *.siterequest.com. The default is none.
• address-space-exclude-dns-name
Species the DNS address spaces whose trafc you want to exclude from access to a subnet on the
network. You can add multiple address spaces to the list. For each address space, type the domain name,
in the form site.siterequest.com or *.siterequest.com. The default is none.
• address-space-include-subnet
373
Traffic Management Shell (tmsh) Reference Guide
Species a list of IPv4 addresses or address/mask pairs describing the target LAN. When using split
tunneling, only the trafc to these addresses and network segments goes through the tunnel congured
for Network Access. You can add multiple address spaces to the list. For each address space, type the
IPv4 address and network mask. The default is none.
• ipv6-address-space-include-subnet
Species a list of IPv6 addresses or address/mask pairs describing the target LAN. When using split
tunneling, only the trafc to these addresses and network segments goes through the tunnel congured
for Network Access. You can add multiple address spaces to the list. For each address space, type the
IPv6 address and network mask. The default is none.
• address-space-local-subnets-excluded
Species whether to exclude local access to any host or subnet in routes that you have specied in the
client routing table. The default is false. When you set this option to true, the system does not support
integrated IP ltering.
• address-space-loc-dns-servers-excluded
Species whether to exclude local access to DNS servers congured on client prior to establishing
network access connection. The default is false.
• address-space-protect
Species whether the IP address spaces whose trafc is forced through the tunnel are protected. The
default is false.
• app-service
The default is none.
• application-launch
Species the applications to launch when the client accesses the network. The default is none.
• application-launch-warning
Species whether the user is warned that an application is being launched. The default is true.
• auto-launch
Species whether NA resource is to be launched automatically from full webtop. The default is false.
• client-interface-speed
Species the baud rate of the client interface with the network. The default is 100000000.
• client-ip-lter-engine
Species whether the client IP address is ltered. The default is <false>.
• client-power-management
Species how to interact with Windows power management features.
• prevent
Prevents Windows from entering standby/hibernate during connection.
• terminate
Terminate network access connection if Windows is entering standby/hibernate
• ignore
Do nothing. Ignore power management events. This is the default value.
• client-proxy
Species whether this resource handles a client proxy. The default is false.
• client-proxy-address
374
APM Resource
Species the IP address of the proxy client. The default is any6.
• client-proxy-enforce-subnets
Species whether address space subnets must be enforced in proxy auto-conguration. The default is
true.
• client-proxy-exclusion-list
Species the Web addresses that do not need to be accessed through your proxy server. You can use
wild cards to match domain and host names or addresses, for example, www.*.com, 128.*, 240.8, 8.,
mygroup.*, and *.*. The default is none.
• client-proxy-local-bypass
Species whether you want to allow local (intranet) addresses to bypass the proxy server. The default
is false.
• client-proxy-port
Species the port number of the proxy server you want Network Access clients to use to connect to the
Internet. The default is 0 (zero).
• client-proxy-script
Species the URL for a proxy auto-conguration script, if one is used with this connection. The default
is none.
• client-proxy-use-http-pac
Species whether the browser uses http:// to locate the proxy the autocong le, instead of le://. Set
this to true for applications, like Citrix MetaFrame, that cannot use the client proxy autocong script
when the browser attempts to use the prex le:// to locate the script. The default is false.
• client-proxy-use-local-proxy
Species whether the browser uses the proxy congured on client prior to establishing network access
connection. The default is false.
• client-trafc-classier
Species a client trafc classier to use with this network access connection. The default is none.
• compression
Species whether you want to compress all trafc between the Network Access client and the controller.
The default is none.
• customization-group
Species the customization group that denes the policies that apply to network access. This option is
required.
• description
Species a unique description of the network access conguration object. The default is none.
• dns-primary
For split tunneling, species the IPv4 address of the primary name server that is conveyed to the remote
access point for IPv4 trafc. The default is any6.
• ipv6-dns-primary
For split tunneling, species the IPv6 address of the primary name server that is conveyed to the remote
access point for IPv6 trafc. The default is any6.
• dns-secondary
For split tunneling, species the IPv4 address of the secondary name server that is conveyed to the
remote access point for IPv4 trafc. The default is any6.
375
Traffic Management Shell (tmsh) Reference Guide
• ipv6-dns-secondary
For split tunneling, species the IPv6 address of the secondary name server that is conveyed to the
remote access point for IPv6 trafc. The default is any6.
• dns-sufx
Type in a DNS sufx to send to the client. If this eld is left blank, the controller sends its own DNS
sufx. You can specify multiple default domain sufxes separated with commas. The default is none.
• drive-mapping
For split tunneling, species the drive to which this resource provides a network access connection. The
default is none.
• dtls
Species whether the network access connection uses Datagram Transport Level Security (DTLS).
DTLS uses UDP instead of TCP, to provides better throughput for high demand applications like VoIP
or streaming video, especially with lossy connections. The default is false.
• dtls-port
Species the port number that the network access resource uses for secure UDP trafc with DTLS. The
default is 4433.
• execute-logoff-scripts
Species whether the system to executes logoff scripts (congured on the Active Directory domain)
when the connection is terminated. The default is false.
• idle-timeout-threshold
Denes the average byte rate that either ingress or egress tunnel trafc must exceed for the tunnel to
update a session. If the average byte rate falls below the specied threshold, the system applies the
inactivity timeout, which is dened in the session's Access Prole. The default is 0 (zero).
• idle-timeout-window
Denes the value that the system uses to calculate the Exponential Moving Average (EMA) byte rate
of ingress and egress tunnel trafc. The default is 0 (zero).
• leasepool-name
Species the IPv4 lease pools that the user can access with this network access connection. The default
is none.
• ipv6-leasepool-name
Species the IPv6 lease pools that the user can access with this network access connection. The default
is none.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• microsoft-network-client
Species whether the client PC can access remote resources over a VPN connection. The default is true.
• microsoft-network-server
Species whether the server can access remote resources over a VPN connection. The default is false.
• network-tunnel
Enables or disables the network tunnel. The default is enabled.
• optimized-app
376
APM Resource
Species the optimized applications that you want to users to access using this network access connection
resource. You can add, delete, modify, or replace the current optimized applications. The default is none.
• partition
Displays the partition within which this network access connection component resides. The default is
Common.
• provide-client-cert
Species whether client certicates are required to establish an SSL connection. You can set this option
to false if the client certicates are only requested in an SSL connection. In this case, the client is
congured to not send client certicates. The default is true.
• proxy-arp
Select Enable to enable Proxy ARP for this network access resource. When you implement Proxy ARP
for a network access resource, remote VPN tunnel clients can use IP addresses from the LAN IP subnet
without additional network infrastructure changes. Ranges of IP addresses from the LAN subnet can be
congured in the lease pools and assigned to tunnel clients. When a host on the LAN sends trafc to a
tunnel client, an ARP query is sent to request the client address. Access Policy Manager then responds
with its own MAC address. Trafc is then sent to network access and forwarded to the client over the
network access tunnel. No conguration changes are required on devices other than the Access Policy
Manager.
See your Network Access documentation for more information about Proxy ARP conguration. The
default is false.
• split-tunneling
Species whether only trafc targeted to a specied address space is sent over the network access tunnel.
With split tunneling, all other trafc bypasses the tunnel. The default is false. When you set this option
to true, all trafc passing over the network access connection uses this setting.
• static-host
Species the static hosts to which this resource provides a network access connection. The default is
none.
• supported-ip-version
Species the supported IP protocol version. The default is ipv4.
• sync-with-active-directory
Species whether you want the network access connection to emulate the Windows logon process for
a client on an Active Directory domain. The default is false.
When this option is set to true, network policies are synchronized when the connection is established,
or at logoff. The following items are synchronized:
• Logon scripts are started as specied in the user prole.
• Drives are mapped as specied in the user prole.
• Group policies are synchronized as specied in the user prole. Group Policy logon scripts are started
when the connection is established, and Group Policy logoff scripts are run when the network access
connection is stopped.
• type
Species the type of network access connection this component provides. The default is network-access.
• wins-primary
Species the primary IP address to which this resource provides a network access connection. The
default is any6.
• wins-secondary
377
Traffic Management Shell (tmsh) Reference Guide
Species the secondary IP address to which this resource provides a network access connection. The
default is any6.
See Also
tmsh
portal-access
Congures a portal access resource.
Syntax
Congure the portal-access component within the resource module using the syntax shown in the following
sections.
Create/Modify
create portal-access [name]
modify portal-access [name]
acl-order [integer]
application-uri [string] | none]
app-service [[string] | none]
css-patching [true | false]
customization-group [string] | none]
description [string] | none]
flash-patching [true | false]
host-replace-string [string] | none]
host-search-strings [string] | none]
html-patching [true | false]
items [add | delete | modify | replace-all-with] {
[string]
}
javascript-patching [true | false]
location-specific [true | false]
patching-type [full-patch | min-patch]
path-match-case [true | false]
proxy-host [string] | none]
proxy-port [string] | none]
publish-on-webtop [true | false]
scheme-patching [true | false]
edit portal-access [ all-properties | non-default-properties ]
all-properties
non-default-properties
Display
list portal-access
list portal-access [ [ [name] | [glob] | [regex] ] ... ]
show running-config portal-access
show running-config portal-access [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
378
APM Resource
one-line
partition
show portal-access
show portal-access [name]
Delete
delete portal-access [name]
Description
You can use the portal-access component to specify a portal access resource.
Examples
item create portal-access myportalaccess acl-order 14 patching-type full-patch items add { item1 {
host www.mywebsite.com paths /* }}
Creates a portal access resource named myportalaccess.
item delete portal-access myportalaccess
Deletes the portal access resource named myportalaccess.
Options
• acl-order
Species the order of this portal access in Access Policy Manager ACL lists. This option is required.
• application-uri
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• css-patching
Species whether the response content type CSS is patched. The default is true.
• customization-group
The customization group is created automatically if not specied.
• description
Species a description of the resource. The default is none.
• ash-patching
Species whether the system patches Flash content. The default is true.
• host-replace-string
Species the replacement host string, when you specify minimal for the patching-type option.
• host-search-strings
Species the host string to replace, when you specify minimal for the patching-type option.
• html-patching
379
Traffic Management Shell (tmsh) Reference Guide
Species whether the system patches HTML content. The default is true.
• items
Congures the host name or IP address, the network mask (if the resource is a network), the port, and
any paths specied for a portal access resource. The default is none.
• javascript-patching
Species whether the system patches JavaScript content. The default is true.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a unique name for the component.
• patching-type
Species whether this resource provides minimal or full path patching.
• path-match-case
Species whether the application URI is case-sensitive. The default is true.
• proxy-host
Species the proxy host that the portal access uses. The default is none. If you congure this option,
you must also congure the option proxy-port.
• proxy-port
Species the port that the portal access proxy uses. The default is none. Congure this option, only
when you congure the option proxy-host.
• publish-on-webtop
Species whether to publish this resource on the webtop. The default is false. If you set this option to
true, you must also specify the Application URI using the application-uri option.
• scheme-patching
Species whether this resource replaces all HTTP scheme addresses with HTTPS scheme addresses.
This option is effective only when minimal patching is selected for patching-type. The default is false.
See Also
tmsh
sandbox
Congures a sandbox.
Syntax
Congure the sandbox component within the resource module using the syntax shown in the following
sections.
Create
380
APM Resource
The CREATE command is currently not available. However, a number of sandboxes have already been
created. Use these to upload les.
Modify
modify sandbox [name]
options
base-uri [string]
description [[string] | none]
files [add | delete | modify | replace-all-with] {
[item name] {
content-type [string]
filename [string]
file-type [citrix-bundle | customization | unknown]
folder [string]
local-path [string]
name [string]
}
}
Display
list sandbox
list sandbox [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Congures a sandbox and its les. A sandbox is a container for les stored on the BIG-IP, to which you
want to provide client access.
Examples
modify sandbox hosted-content les add { BIGIPEdgeClient.exe { folder /client local-path
/tmp/BIGIPEdgeClient.exe } }
Adds a le called BIGIPEdgeClient.exe to sandbox named hosted-content. The virtual path to this le
consists of the sandbox's base-uri, the le's folder, and the name of the le. Putting these components
together, the virtual path for the uploaded le is /public/share/client/BIGIPEdgeClient.exe, where /public/share
is the base-uri, /client is the folder, and BIGIPEdgeClient.exe is the lename. The local-path indicates the
location of the le on the disk drive to be added into the sandbox.
Note: The le you add must already be on the BIG-IP system.
Options
• base-uri
Species the rst component of the virtual path to the sandbox le. The base-uri for sandbox
"hosted-content" is /public/share. The virtual path to a sandbox box le is made up of three components:
base-uri/folder/lename
All les in a sandbox share the same base-uri, but the folder can be different for each le.
• description
Species a unique description about the sandbox.
381
Traffic Management Shell (tmsh) Reference Guide
• les
Species the list of les in the sandbox.
• item name
Species the name of an item in the list of les. You can use the original lename as the item name.
Each item name in a sandbox must be unique.
• content-type
Species the content-type eld in a HTTP header such as "image/gif" or "text/plain". If none is provided,
tmsh will try its best to provide this value.
• lename
Species the last component of the virtual path to the sandbox le. We recommend that you use the
lename of the original le for this name.
• le-type
Species the F5 le type. Currently there are only three types: unknown, citrix-bundle, and customization.
No value is required if a le is uploaded to sandbox for "citrix-client-bundle", since this sandbox is the
repositories for F5 specic type of le. However, for les uploaded to sandbox "hosted-content" if no
value is provided, the le type defaults to "unknown".
• folder
Species the second component of the virtual path to the sandbox le.
• local-path
Species the location of the le to be inserted into the sandbox. This le must be on the BIG-IP already.
• name
Species a value for the underlying le object. Use this only if you are trying to add more than one
sandbox le in a modify command. Otherwise, don't specify a value for this attribute. The value must
be specied as follows: full path of sandbox name:item name. For example, if the sandbox name is
'/Common/hosted-content' and the item name is 'index.html', the value should be
'/Common/hosted-content:index.html'.
See Also
webtop, webtop-link
webtop
Congures a webtop resource.
Syntax
Congure the webtop component within the resource module using the syntax shown in the following
sections.
Create/Modify
create webtop [name]
modify webtop [name]
app-service [[string] | none]
customization-group [string]
382
APM Resource
description [[string] | none]
location-specific [true | false]
minimize-to-tray [false | true]
portal-access-start-uri [[string] | none]
webtop-type [full | last | network-access | portal-access]
warn-when-closed [false | true]
edit webtop [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list webtop
list webtop [ [ [name] | [glob] | [regex] ] ... ]
show running-config webtop
show running-config webtop [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show webtop
show webtop [name]
Delete
delete webtop [name]
Description
Congures the settings necessary to dene the webtop assigned to the end-user as part of the access policy
execution.
Examples
• create webtop mynawebtop { customization-group mywebtopcg1 minimize-to-tray false }
Creates a webtop named mynawebtop with the customization group mywebtopcg1 and the network
access minimize-to-tray option set to false.
• create webtop mywawebtop { customization-group mywebtopcg1 portal-access-start-uri
'"http://www.siterequest.com"' }
Creates a webtop named mywawebtop with the customization group mywebtopcg1 and the starting
URI for the portal access of http://www.siterequest.com.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• customization-group
383
Traffic Management Shell (tmsh) Reference Guide
Species the customization settings for the webtop.
Note: You must create a customization group of type webtop before you can create a webtop resource.
This option is required.
• description
Species a description of the resource. The default is none.
• portal-access-start-uri
Species the URI that the webtop starts. You can only congure this option if you have congured the
webtop-type option for portal-access.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• minimize-to-tray
Species whether the network access window (launched from the full webtop) is minimized to the
system tray automatically after the network access connection starts. The default is true.
You can congure this option only if you congured the webtop-type option as network-access or
full. With a network access webtop, the webtop automatically minimizes to the tray. With a full webtop,
the webtop minimizes to the system tray only after the network access connection is started.
• warn-when-closed
Species whether the network access window (launched from the full webtop) should display a warning
message when the webtop closes.
You can congure this option only if you congured the webtop-type option as full.
• webtop-type
Species the type of webtop this resource creates. The options are:
• full
A webtop to which you assign a single network access resource, multiple portal access resources,
and multiple application access app tunnel resources, or any combination of the three types. This is
the default.
• last
• network-access
A webtop to which you assign only a single network access resource.
• portal-access
A webtop to which you assign only portal access resources.
See Also
tmsh
384
APM Resource
webtop-link
Congures a webtop link resource.
Syntax
Congure the webtop-link component within the resource module using the syntax shown in the following
sections.
Create/Modify
create webtop-link [name]
modify webtop-link [name]
application-uri [string]
app-service [[string] | none]
customization-group [string]
description [[string] | none]
location-specific [true | false]
edit webtop-link [ [ [name] | [glob] | [regex] ] ... ]
all
Display
list webtop-link
list webtop-link [ [ [name] | [glob] | [regex] ] ... ]
show running-config webtop-link
show running-config webtop-link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show webtop-link
show webtop-link [name]
Delete
delete webtop-link [name]
Description
Congures the settings necessary to dene a link to a webtop that is displayed to the end-user as part of the
access policy execution.
Examples
• create webtop-link mywebtoplinkcg1 application-uri "http://www.externalsite.com/"
Creates a webtop named mywebtoplinkcg1 with the application-uri of http://www.externalsite.com/.
385
Traffic Management Shell (tmsh) Reference Guide
Options
• application-uri
Species the application URI of the external portal to which this resource provides access for this webtop
link. This is a required setting.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• customization-group
Species the customization settings for the webtop.
Note: You must create a customization group of type webtop before you can create a webtop resource.
If you do not specify a customization group, a group will be created automatically.
• description
Species a description of the resource. The default is none.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
See Also
tmsh
386
APM Resource
APM Resource Remote Desktop
citrix
Congures a Citrix remote desktop resource conguration object.
Syntax
Congure the citrix component within the resource remote desktop module using the syntax shown in
the following sections.
Create/Modify
create citrix [name]
modify citrix [name]
app-service [[string] | none]
auto-logon [enabled | disabled]
customization-group [add | delete | modify | replace-all-with] {
[name] {
caption [[string] | none]
detailed-description [[string] | none]
}
}
description [[string] | none]
domain-source [session.logon.last.domain | none]
enable-serverside-ssl [enabled | disabled]
pool [pool name]
host [fqdn]
ip [ip address]
location-specific [true | false]
password-source [session.logon.last.password | none]
port [[string] | none]
username-source [session.logon.last.username | none]
edit citrix [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list citrix
list citrix [ [ [name] | [glob] | [regex] ] ... ]
show running-config citrix
show running-config citrix [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show citrix
show citrix [name]
Delete
delete citrix [name]
Description
You can use the B<citrix> component to configure a Citrix remote desktop
resource.
Examples
• create citrix mycitrix { ip 172.29.67.130 }
Creates a Citrix remote desktop resource named mycitrix with Citrix XML Broker server specied as
IP address 172.29.67.130.
• create citrix mycitrix { host mycitrix.mycompany.com auto-logon enabled }
Creates a Citrix resource with Citrix XML Broker server specied as hostname
mycitrix.mycompany.com and auto-logon enabled with APM credentials (that user types on Logon
Page).
• create citrix mycitrix { pool /Common/mycitrix-pool enable-serverside-ssl enabled }
Creates a Citrix resource with Citrix XML Broker server(s) specied in pool named
/Common/mycitrix-pool and SSL communication enabled to the server(s) (SSL should also be enabled
on the servers and APM virtual should have serverssl prole).
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auto-logon
Enables or disables automatic log on to the Citrix server. If you enable this option, you must also provide
values for the username-source, password-source, and domain-source options. The default is disabled.
• customization-group
Species whether customization groups are applied to the Citrix remote desktop. You can add, modify,
or delete customization groups. You can also replace all current customization groups with new
customization groups. The default is none.
• description
Species a description for your Citrix remote desktop. The default is none.
• domain-source
Species the Session variable used as a source for the auto-logon user password. The default is
session.logon.last.domain.
• enable-serverside-ssl
Enables or disables SSL capabilities between the BIG-IP system and the Citrix server. When enabled,
the port number automatically changes to 443. The default is disabled.
• pool
388
APM Resource Remote Desktop
Species the pool name that contains your Citrix XML Broker server(s). You must use one of these
options to specify the server address: pool, host, or ip.
• host
Species the hostname of your Citrix XML Broker server. You must use one of these options to specify
the server address: pool, host, or ip.
• ip
Species the IP address of your Citrix XML Broker server. You must use one of these options to specify
the server address: pool, host, or ip.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species an object name. This option is required; however, the parameter name is implicit and must
not be typed in the syntax.
• password-source
Species the session variable that is used as a source for the auto-logon password. The default is
session.logon.last.password.
• port
Species the port for your Citrix server. The default is 80.
• username-source
Species the session variable that is used as a source for the auto-logon user name. The default is
session.logon.last.username.
See Also
citrix-client-bundle, citrix-client-package-le, rdp, vmware-view, quest
citrix-client-bundle
Congures a Citrix Client Bundle remote desktop resource conguration object.
Syntax
Congure the citrix-client-bundle component within the resource remote desktop module using the
syntax shown in the following sections.
Create/Modify
create citrix-client-bundle [name]
modify citrix-client-bundle [name]
app-service [[string] | none]
download-url [[url] | none]
packages [[string] | none]
windows-download-url [[url] | none]
389
Traffic Management Shell (tmsh) Reference Guide
windows-min-version [[string] | none]
windows-package [[string] | none]
edit citrix-client-bundle [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list citrix-client-bundle
list citrix-client-bundle [ [ [name] | [glob] | [regex] ] ... ]
show running-config citrix-client-bundle
show running-config citrix-client-bundle [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
one-line
partition
show citrix-client-bundle
show citrix-client-bundle [name]
Delete
delete citrix-client-bundle [name]
Description
You can use the citrix-client-bundle component to congure a Citrix Client Bundle remote desktop resource.
Examples
create citrix-client_bundle myccb { windows-min-version xp }
Creates a Citrix Client Bundle remote desktop resource named myccb that can be downloaded from
receiver.citrix.com (the default value), where the client must have at least Windows XP installed.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• download-url
Species the default location receiver.citrix.com from which to download the Citrix installation package.
• packages
Species the location from which to download client installer package. The default is none.
390
APM Resource Remote Desktop
• [name]
Species an object name. This option is required; however, the parameter name is implicit and must
not be typed in the syntax.
• windows-download-url
Species the location from which to download the Windows version. You can provide a value for either
the windows-download-url or windows-package option, but not both. The default is none.
• windows-min-version
Species the oldest version of the Citrix client that can be used with this remote desktop resource. The
default is none.
• windows-package
Species the location from which to download the Windows package. You can provide a value for either
the windows-package or windows-download-url option, but not for both. The default is none.
See Also
citrix, citrix-client-package-le, rdp
citrix-client-package-file
Congures a Citrix client package le conguration object.
Syntax
Congure the citrix-client-package-le component within the resource remote desktop module using
the syntax shown in the following sections.
Create/Modify
create citrix-client-package-file [name]
modify citrix-client-package-file [name]
app-service [[string] | none]
location-specific [true | false]
original-file-name [[string] | none]
source-path [[string] | none]
edit citrix-client-package-file [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list citrix-client-package-file
list citrix-client-package-file [ [ [name] | [glob] | [regex] ] ... ]
show running-config citrix-client-package-file
show running-config citrix-client-package-file [ [ [name] | [glob] | [regex]
] ... ]
all-properties
non-default-properties
391
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
Delete
delete citrix-client-package-file [name]
Description
You can use the citrix-client-package-le component to congure access to a Citrix client package le.
Examples
• create citrix-client-package myccpackage { source-path www.siterequest.citrix_download.com }
Creates a Citrix client package remote desktop resource named myccpackage that is available from
www.siterequest.citrix_download.com.
Options
• [name]
Species an object name. This option is required; however, the parameter name is implicit and must
not be typed in the syntax.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• original-le-name
Species the original le name of the Citrix Installation package le name to download. The default is
none.
• source-path
Species the location from which to download the Citrix client package le. This option is required.
See Also
citrix, citrix-client-bundle, rdp
quest
Congures a Quest vWorkspace remote desktop resource conguration object.
392
APM Resource Remote Desktop
Syntax
Congure the quest component within the resource remote desktop module using the syntax shown in
the following sections.
Create/Modify
create quest [name]
modify quest [name]
app-service [[string] | none]
auto-logon [enabled | disabled]
customization-group [add | delete | modify | replace-all-with] {
[name] {
caption [[string] | none]
detailed-description [[string] | none]
}
}
description [[string] | none]
domain-source [session.logon.last.domain | none]
enable-serverside-ssl [enabled | disabled]
pool [pool name]
host [fqdn]
ip [ip address]
location-specific [true | false]
password-source [session.logon.last.password | none]
port [[string] | none]
username-source [session.logon.last.username | none]
edit quest [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list quest
list quest [ [ [name] | [glob] | [regex] ] ... ]
show running-config quest
show running-config quest [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show quest
show quest [name]
Delete
delete quest [name]
Description
You can use the B<quest> component to configure a Quest vWorkspace remote
desktop resource.
393
Traffic Management Shell (tmsh) Reference Guide
Examples
• create quest myquest { ip 172.29.67.130 }
Creates a Quest vWorkspace remote desktop resource named myquest with the Quest vWorkspace
connection broker server specied as IP address 172.29.67.130.
• create quest myquest { host myquest.mycompany.com auto-logon enabled }
Creates a Quest vWorkspace resource with the Quest vWorkspace connection broker server specied
as hostname myquest.mycompany.com and with auto-logon enabled using the credentials that the user
types into the access policy Logon Page.
• create quest myquest { pool /Common/myquest-pool enable-serverside-ssl enabled }
Creates a Quest vWorkspace resource with the Quest vWorkspace connection broker servers specied
in a pool named /Common/myquest-pool and with SSL communication enabled to the servers. Note:
SSL should also be enabled on the servers themselves and the APM virtual server should specify a server
SSL prole.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auto-logon
Enables or disables automatic log on to the Quest vWorkspace connection broker server. If you enable
this option, you must also provide values for the username-source, password-source, and
domain-source options. The default is disabled.
• customization-group
Species whether customization groups are applied to the Quest vWorkspace resource. You can add,
modify, or delete customization groups. You can also replace all current customization groups with new
customization groups. The default is none.
• description
Species a description for your Quest vWorkspace remote desktop. The default is none.
• domain-source
Species the session variable to use as a source for the auto-logon user password. The default is
session.logon.last.domain.
• enable-serverside-ssl
Enables or disables SSL capabilities between the BIG-IP system and the Quest vWorkspace connection
broker server. When enabled, the port number automatically changes to 443. The default is disabled.
• pool
Species the pool name that contains your Quest vWorkspace connection broker servers. (You must
specify the server address using one of these options: pool, host, or ip.)
• host
Species the hostname of your Quest vWorkspace connection broker server. (You must specify the
server address using one of these options: pool, host, or ip.)
• ip
Species the IP address of your Quest vWorkspace connection broker server. (You must specify the
server address using one of these options: pool, host, or ip.)
394
APM Resource Remote Desktop
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species an object name. This option is required. Note: The parameter name is implicit. Do not type
name in the syntax.
• password-source
Species the session variable to use as a source for the auto-logon password. The default is
session.logon.last.password.
• port
Species the port for your Quest vWorkspace connection broker server. The default is 8080.
• username-source
Species the session variable to use as a source for the auto-logon user name. The default is
session.logon.last.username.
See Also
citrix, rdp, vmware-view
rdp
Congures a Microsoft Remote Desktop Protocol (MSRDP) conguration object.
Syntax
Congure the rdp component within the resource remote desktop module using the syntax shown in the
following sections.
Create/Modify
create rdp [name]
modify rdp [name]
acl-order [[integer] | none]
application [[string] | none]
app-service [[string] | none]
auto-logon [enabled | disabled]
color-depth [4 | 8 | 16 | 24]
customization-group [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
caption [[string] | none]
detailed-description [[string] | none]
}
}
description [[string] | none]
domain-source [session.logon.last.domain | none]
host [fqdn]
ip [ip address]
java-client [enabled | disabled]
395
Traffic Management Shell (tmsh) Reference Guide
location-specific [true | false]
log [config | none | packet | summary | verbose]
password-source [session.logon.last.password | none]
port [[integer] | none]
rdp-cache-bitmaps [true | false]
rdp-show-contents-while-dragging [true | false]
rdp-show-desktop-wallpaper [true | false]
rdp-show-themes [true | false]
rdp-window-animations [true | false]
redirect-com-parts [true | false]
redirect-drives [true | false]
redirect-keyboard-commands [true | false]
redirect-printers [true | false]
redirect-sound [true | false]
username-source [session.logon.last.username | none]
window-height [[integer] | none]
window-percent-of-desktop [[integer] | none]
window-size [custom-size | full-screen | percent-of-desktop | seamless]
window-width [[integer] | none]
work-dir [[string] | none]
edit rdp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list rdp
list rdp [ [ [name] | [glob] | [regex] ] ... ]
show running-config rdp
show running-config rdp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show rdp
show rdp [name]
Delete
delete rdp [name]
Description
You can use the rdp component to congure an MSRDP resource.
Examples
• create rdp myrdp { host 172.29.67.130 }
Creates a MSRDP remote desktop resource named myrdp with an MSRDP server with an IP address
of 172.29.67.130.
• create rdp myrdp { host 172.29.67.130 rdp-cache-bitmaps true }
Creates a MSRDP remote desktop resource named myrdp with an MSRDP server with an IP address
of 172.29.67.130 where bitmaps are cached on the client PC.
396
APM Resource Remote Desktop
Options
• acl-order
Species the order in which you want the RDP server to appear in the ACL Order list. The default is 0
(zero).
• application
Species the executable name of the application, for example notepad.exe. You can include the full
path to the application, for example "C:\my\mybinary.exe".
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auto-logon
Species if automatic log on to the Microsoft RDP server is used. If you enable this option, you must
also provide values for the username-source, password-source, and domain-source options. The
default is disabled.
• color-depth
Species the requested remote session color depth. The default is 32. The options are:
• 24-bit
• 16-bit
• 8-bit
• 4-bit
• customization-group
Species whether customization-groups are applied to the remote desktop. You can add, modify, delete,
or replace all customization-groups. The default is none.
• description
Species a description of an MSRDP resource. The default is none.
• domain-source
Species the session variable used as a source for the auto-logon user password. The default is
session.logon.last.domain.
• host
Species the hostname of your Microsoft RDP server. Either the host or ip option is required; however,
you cannot specify both options.
• ip
Species the IP address of your Microsoft RDP server. Either the host or ip option is required; however,
you cannot specify both options.
• java-client
Species if JavaScript is enabled or disabled on the client. The default is enabled.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• log
397
Traffic Management Shell (tmsh) Reference Guide
Species the log format. The default is none. The options are:
• cong
• none
The system does not log packets sent to and from the Microsoft RDP server.
• packet
The system logs packets sent to and from the Microsoft DP server.
• summary
The system provides a short summary of the communications between the BIG-IP system and the
Microsoft RDP server.
• verbose
The system provides an extensive summary of the communications between the BIG-IP system and
the Microsoft RDP server.
• [name]
Species an object name. This option is required; however, the parameter name is implicit and must
not be typed in the syntax.
• password-source
Species the session variable used as a source for the auto-logon password. The default is
session.logon.last.password.
• port
Specify port 3389 for your Microsoft RDP server. The default is 0 (zero).
• rdp-cache-bitmaps
Species whether to cache bitmap les on the client. The default is true.
• rdp-show-contents-while-dragging
Species whether to show the contents of a window when the user is dragging the window. The default
is false.
• rdp-show-desktop-wallpaper
Species whether to display the desktop background. The default is false.
• rdp-show-themes
Species whether to display the desktop theme. The default is false.
• rdp-window-animations
Species whether to display Window animations. The default is false.
• redirect-com-ports
Species whether to connect to your communication ports. The default is false.
• redirect-drives
Species whether to connect to your local drives. The default is false.
• redirect-keyboard-commands
Species when to redirect keyboard commands to a remote session. When enabled, commands such as
Alt-tab and Ctrl-Alt-Del are available in remote sessions. The default is in-full-screen. The options
are:
• enable
The keyboard commands for the remote desktop are available to the user.
398
APM Resource Remote Desktop
• disable
The keyboard commands for the remote desktop are not available to the user.
• in-full-screen
The keyboard commands for the remote desktop are available to the user only when the value of the
window-size option is full-screen.
• redirect-printers
Enables or disables connection to a local printer. The default is disabled.
• redirect-sound
Enables or disables sounds playing in a remote session. The default is disabled.
• username-source
Species the session variable used as a source for the auto-logon user name. The default is
session.logon.last.username.
• window-height
Species the height, in pixels, of the remote desktop window. Set this option only when you set the
value of the window-size option to custom. The default is 600 pixels.
• window-percent-of-desktop
Species the width and height of the remote session window as a percentage of the user's desktop.
• window-size
Species the type of window sizing to use on the client desktop. The default is custom-size.
The options are:
• full-screen
The remote desktop window lls the entire screen.
• percent-of-desktop
The value you congure represents a percentage of the screen that the remote desktop lls.
• custom
When you use this option, you must also set the window-height and window-width options.
• seamless
• window-width
Species the width, in pixels, of the remote desktop window. The default is 800 pixels.
• workdir
Species the directory you want the user to access on the target server. The default is none.
See Also
citrix, citrix-client-bundle, citrix-client-package-le, vmware-view, quest
vmware-view
Congures a VMware View remote desktop resource conguration object.
399
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the vmware-view component within the resource remote desktop module using the syntax
shown in the following sections.
Create/Modify
create vmware-view [name]
modify vmware-view [name]
app-service [[string] | none]
auto-logon [enabled | disabled]
customization-group [add | delete | modify | replace-all-with] {
[name] {
caption [[string] | none]
detailed-description [[string] | none]
}
}
description [[string] | none]
domain-source [session.logon.last.domain | none]
enable-serverside-ssl [enabled | disabled]
pool [pool name]
host [fqdn]
ip [ip address]
location-specific [true | false]
password-source [session.logon.last.password | none]
port [[string] | none]
username-source [session.logon.last.username | none]
edit vmware-view [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list vmware-view
list vmware-view [ [ [name] | [glob] | [regex] ] ... ]
show running-config vmware-view
show running-config vmware-view [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show vmware-view
show vmware-view [name]
Delete
delete vmware-view [name]
Description
You can use the B<vmware-view> component to configure a VMware View remote
desktop resource.
400
APM Resource Remote Desktop
Examples
• create vmware-view myview { ip 172.29.67.130 }
Creates a VMware View remote desktop resource named myview with the VMware View Connection
server specied as IP address 172.29.67.130.
• create vmware-view myview { host myview.mycompany.com auto-logon enabled }
Creates a VMware View resource with the VMware View Connection server specied as hostname
myview.mycompany.com and auto-logon enabled with APM credentials (that user types on Logon
Page).
• create vmware-view mview { pool /Common/myview-pool enable-serverside-ssl enabled }
Creates a VMware View resource with the VMware View Connection server(s) specied in pool named
/Common/myview-pool and SSL communication enabled to the server(s) (SSL should also be enabled
on the servers and APM virtual should have serverssl prole).
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auto-logon
Enables or disables automatic log on to the VMware View Connection Server server. If you enable this
option, you must also provide values for the username-source, password-source, and domain-source
options. The default is disabled.
• customization-group
Species whether customization groups are applied to the VMware View resource. You can add, modify,
or delete customization groups. You can also replace all current customization groups with new
customization groups. The default is none.
• description
Species a description for your VMware View remote desktop. The default is none.
• domain-source
Species the Session variable used as a source for the auto-logon user password. The default is
session.logon.last.domain.
• enable-serverside-ssl
Enables or disables SSL capabilities between the BIG-IP system and the VMware View Connection
server. When enabled, the port number automatically changes to 443. The default is disabled.
• pool
Species the pool name that contains your VMware View Connection server(s). You must use one of
these options to specify the server address: pool, host, or ip.
• host
Species the hostname of your VMware View Connection server. You must use one of these options
to specify the server address: pool, host, or ip.
• ip
Species the IP address of your VMware View Connection server. You must use one of these options
to specify the server address: pool, host, or ip.
• location-specic
401
Traffic Management Shell (tmsh) Reference Guide
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species an object name. This option is required; however, the parameter name is implicit and must
not be typed in the syntax.
• password-source
Species the session variable that is used as a source for the auto-logon password. The default is
session.logon.last.password.
• port
Species the port for your VMware View Connection server. The default is 80.
• username-source
Species the session variable that is used as a source for the auto-logon user name. The default is
session.logon.last.username.
See Also
citrix, rdp, quest
402
APM Resource Remote Desktop
APM SAML
artifact-resolution-service
Specify service used to resolve SAML artifacts
Syntax
Congure the artifact-resolution-service component within the saml module using the syntax shown in
the following sections.
Create/Modify
create artifact-resolution-service [name]
modify artifact-resolution-service [name]
app-service [[string] | none]
artifact-resolution-service-host [[string] | none]
artifact-resolution-service-port [integer]
artifact-send-method [http-post | http-redirect]
artifact-validity [integer]
basic-auth-password [[string] | none]
basic-auth-username [[string] | none]
description [[string] | none]
location-specific [ true | false ]
virtual-server-name [name]
want-artifact-resolution-rq-signed [true | false]
edit artifact-resolution-service [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list artifact-resolution-service
list artifact-resolution-service [ [ [name] | [glob] | [regex] ] ... ]
show running-config artifact-resolution-service
show running-config artifact-resolution-service [ [ [name] | [glob] | [regex]
] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete artifact-resolution-service [name]
Description
You can use the artifact-resolution-service to create and manage artifact resolution services.
Examples
• create artifact-resolution-service my_ars {virtual-server-name my_virt}
Creates a SAML artifact resolution service named my_ars. In this example, the virtual server my_virt
will be used to receive artifact resolve requests and send artifact responses.
• create artifact-resolution-service my_ars1 {virtual-server-name my_virt1
artifact-resolution-service-host bigip.mycompany.com basic-auth-username user
basic-auth-password password artifact-send-method http-redirect }
Creates a SAML artifact resolution service named my_ars1. The service requires that artifact resolve
requests be sent using the http-redirect method with an authorization header that contains the specied
credentials.
• list artifact-resolution-service
Displays a list of artifact resolution services.
• delete artifact-resolution-service my_ars
Deletes the my_ars artifact resolution service.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• artifact-resolution-service-host
Species the hostname of the artifact resolution service.
• artifact-resolution-service-port
Species the port that artifact resolution service will be listening on.
• artifact-send-method
Species method resolver will use when sending artifact resolve requests. Default value is http-redirect.
• artifact-validity
Species in seconds how long an artifact remains valid. Default value is 60 seconds.
• basic-auth-password
Species the basic authentication password to send with an artifact resolve request to this BIG-IP.
• basic-auth-username
Species the basic authentication username to send with an artifact resolve request to this BIG-IP.
• description
Species a unique description for the artifact resolution service. Default is none.
• location-specic
Objects of this class might have location-specic attributes. If the object is location-specic, set to true.
• virtual-server-name
Species the virtual server to be used by the artifact resolution service.
• want-artifact-resolution-rq-signed
404
APM SAML
Species whether this BIG-IP requires artifact resolution requests to be signed. Default value is true.
405
Traffic Management Shell (tmsh) Reference Guide
APM SSO
basic
Congures a single sign-on HTTP basic authentication conguration object.
Syntax
Congure the basic component within the sso module using the syntax shown in the following sections.
Create/Modify
create basic [name]
modify basic [name]
app-service [[string] | none]
headers [add | delete | modify | | replace-all-with] {
location-specific [true | false]
[name] {
app-service [[string] | none]
hname [[URL] | none]
hvalue [[integer] | none]
}
}
password-source [session.sso.token.last.password | none]
username-conversion [enabled | disabled]
username-source [session.sso.token.last.username | none
edit basic [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list basic
list basic [ [ [name] | [glob] | [regex] ] ... ]
show running-config basic
show running-config basic [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show basic
show basic [name]
Delete
delete basic [name]
Description
You can use the basic component to create, modify, display, or delete an SSO HTTP basic authentication
conguration object.
Examples
create basic mybasic
Creates an SSO basic conguration object named mybasic.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• headers
Species the name and value of the HTTP header content to be inserted in an HTTP Request that passes
through the APM SSO module. The default is none. The options are:
• app-service
Species the name of the application service to which the HTTP header belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the HTTP header. Only the application service can modify or delete the
HTTP header.
• hname
The name of the HTTP header.
• hvalue
The value of the HTTP header.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a name for the SSO conguration. This option is required.
• partition
Displays the partition in which the object resides.
• oam-server
Species the name of your Oracle Access Manager server. The default value is none.
• password source
Species the source from which you want SSO to retrieve the password to use to authenticate applications.
408
APM SSO
• username-conversion
Enables or disables conversion of PREWIN2k/UPN username input format to the format for SSO to
use. The default value is disabled.
• username-source
Species the source from which you want SSO to retrieve the username to use to authenticate applications.
form-based
Congures a single sign-on form-based conguration object.
Syntax
Congure the form-based component within the sso module using the syntax shown in the following
sections.
Create/Modify
create form-based [name]
modify form-based [name]
app-service [[string] | none]
external-access-management [oam | none]
form-action [[URL] | none]
form-field [string]
form-method [get | post]
form-password [string]
form-username [string]
headers [add | delete | modify | | replace-all-with] {
[name] {
app-service [[string] | none]
hname [[URL] | none]
hvalue [[integer] | none]
}
}
password-source [session.sso.token.last.password | none]
start-uri [[URLs] | none]
success-match-type [cookie | none | url]
success-match-value [string]
username-source [session.sso.token.last.username | none
edit form-based [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list form-based
list form-based [ [ [name] | [glob] | [regex] ] ... ]
show running-config form-based
show running-config form-based [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
409
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
show form-based
show form-based [name]
Delete
delete form-based [name]
Description
You can use the form-based component to congure an SSO form-based conguration object.
Examples
create form-based fb_2011_sso { start-uri
"/fb/auth/logon.aspxurl=https://exch2011.mv1.fp.com/fp/&reason=0" form-action "/fp/auth/fpauth.dll"
form-username "username" form-password "password" form-eld "destination
https://exch2011.mv1.fp.com/fp/" }
Creates an SSO form-based conguration object named fb_2011_sso.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• external-access-management
• form-action
Species the form action URL that is used for HTTP form-based authentication. This is optional. If you
do not specify a form action, then Access Policy Manager uses the URI from the request to perform
HTTP form-based authentication. The default is none.
• form-eld
Species the hidden form parameters that are required by the authentication server logon form at your
location. The default is none. Specify a parameter name, a space, and the parameter value, if any. Multiple
parameters can be congured with each "name value" pair in one line. Use edit to add multiple parameters.
Please note that create and modify do not allow using new line on the terminal.
• form-method
Species the form method to use for form-based HTTP authentication. The value is either get or post.
The default is post.
If you specify get, Access Policy Manager forces the authentication using HTTP GET rather than
authenticating using form-based POST.
• form-password
Species the parameter names used by the form that is sent the POST request.
• form-username
Species the parameter names used by the form that is sent the POST request.
410
APM SSO
• headers
Species the name and value of the HTTP header content to be inserted in an HTTP Request that passes
through the APM SSO module. The default is none.
The options are:
• app-service
Species the name of the application service to which the HTTP header belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the HTTP header. Only the application service can modify or delete the
HTTP header.
• hname
Species the name of the HTTP header.
• hvalue
Species the value of the HTTP header.
• [name]
Species a name for the component.
• password-source
Species the password you want cached for single sign-on.
The default is session.sso.token.last.password.
• start-uri
Species a URL resource. For example, for FB, it would be /fb/auth/logon.aspx*. For Citrix,
/Citrix/XenApp/auth/logon.aspx. This resource must respond with a challenge to a non-authenticated
request.
The default is none.
• success-match-type
Species the method your authentication server uses. If you specify a value for this option, you must
also specify a value for success-match-value. The default is none. The options are:
• url
One or more URLs. The system supports only the wildcard character (*).
• cookie
A cookie name.
• success-match-value
Species the value used to specify either the URL(s) or cookie for the success-match-type option. The
default is none.
• username-source
Specify the username you want cached for single sign-on. The default is session.sso.token.last.username.
See Also
basic, kerberos, ntlmv1, ntlmv2
411
Traffic Management Shell (tmsh) Reference Guide
form-basedv2
Congures a single sign-on form-basedv2 conguration object.
Syntax
Congure the form-basedv2 component within the sso module using the syntax shown in the following
sections.
Create/Modify
create form-basedv2 [name]
app-service [[string] | none]
forms [add | replace-all-with] {
[name] {
request-value [URIs]
controls [add | replace-all-with] {
[name] {
value [string]
}
}
}
}
modify form-basedv2 [name]
app-service [[string] | none]
forms [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
attribute-value [[string] | none]
controls [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
secure [true | false]
value [string]
}
}
description [[string] | none]
form-order [integer]
id-type [action | id | inputs | name | order]
request-method [get | post]
request-name [[string] | none]
request-negative [true | false]
request-prefix [true | false]
request-type [cookie | header | uri]
request-value [[string] | none]
submit-autodetect [true | false]
submit-javascript [[string] | none]
submit-javascript-type [auto | custom | extra]
submit-method post
submit-name [[string] | none]
submit-negative [true | false]
submit-prefix [true | false]
submit-type [cookie | header | uri]
submit-value [[string] | none]
success-match-type [cookie | none | url]
success-match-value [[string] | none]
}
}
headers [add | delete | modify | none | replace-all-with] {
412
APM SSO
[name] {
app-service [[string] | none]
description [[string] | none]
name [string]
value [string]
}
}
log-level [alert | crit | debug | emerg | err | info | notice | warn]
edit form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats
reset-stats [ [ [name] | [glob] | [regex] ] ... ]
Display
list form-basedv2
list form-basedv2 [ [ [name] | [glob] | [regex] ] ... ]
show running-config form-basedv2
show running-config form-basedv2 [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show form-basedv2
show form-basedv2 [name]
Delete
delete form-basedv2 [name]
Description
You can use the form-basedv2 component to congure an SSO form-basedv2 conguration object. When
creating a new SSO form-based v2 conguration object, you must add at least one forms item and within
it at least one controls item. You must also provide a value for the request-value option in the forms item.
The SSOv2 module identies and processes two types of application HTTP requests - logon page requests
and credentials submit requests. Logon page requests are identied using the request- set of options.
Credentials submit requests, in most cases, are identied automatically. When this fails, you can set the
submit-autodetect option to false and use the submit- set of options to identify these requests.
When the SSOv2 module identies a logon page request, it scans the response trying to nd the logon form.
If the logon form is found, SSOv2 inserts a JavaScript code that will cause the logon form to be submitted
automatically by the browser. The client must support JavaScript.
When the SSOv2 module identies a credentials submit request, it compares POST data parameter names
with form controls dened in the conguration. For a POST data parameter name that has a corresponding
413
Traffic Management Shell (tmsh) Reference Guide
form control, the SSOv2 module replaces its value with the control value from the conguration. Control
values are usually supplied through session variables, such as session.sso.token.last.username and
session.sso.token.last.password. POST data parameters that have no corresponding controls in the
conguration are not changed.
The majority of web applications have a single logon page with one logon form. You will need to dene a
single forms item for these applications. In rare cases when an application has multiple logon pages with
different logon forms, you will need to create multiple forms items, one for each logon page/form. If multiple
logon pages use the same form, you will need only one forms item with a list of URIs for all logon pages.
Every forms item must include at least one controls item, and can include up to 32 controls items. Each
controls item represents an input element of an HTML logon form, such as form elds for entering username
and password, and, optionally, any hidden form parameters. The name of the controls item must match the
name attribute of the corresponding input tag of the form. For example, if the form has the following HTML
tag for entering the username:
<input id="Bugzilla_login_top"
class="bz_login"
name="Bugzilla_login"
onfocus="mini_login_on_focus('_top')"
>
the forms item must include a controls item with the name Bugzilla_login. The controls item used for
entering the user's password must have the secure option set to true. The value of a control item should
usually be the name of a session variable, starting with the percent (%) sign and enclosed in curly braces
({}); for example, the value for the username control item: %{session.sso.token.last.username}. The value
can also be a string, or a combination of strings and session variable names.
Examples
create form-basedv2 fbssov2-owa2010 { forms add { owa2010 { controls add { password { secure true
value %\{session.sso.token.last.password\} } username { value %\{session.sso.token.last.username\}
} } request-value /owa/auth/logon.aspx\?replaceCurrent=1 submit-javascript clkLgn()
submit-javascript-type extra success-match-type cookie success-match-value sessionid } } }
Creates an SSO form-basedv2 conguration object named fbssov2-owa2010.
delete fbsso-owa2010
Deletes an SSO form-basedv2 conguration object named fbssov2-owa2010.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• forms
Species one or more items, each dening SSO processing of a separate application logon form.
• [name]
Species the name of the form item. It does not have to match the actual name of the HTML form and
can be arbitrary.
The options are:
• app-service
414
APM SSO
Species the name of the application service to which the form item belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the form item. Only the application service can modify or delete the
form item.
• attribute-value
Species the value of the HTML <form> tag attribute used to identify the logon form. The attribute
could be id, name, or action, and is specied by the id-type option. For other values of the id-type
option, this is not used and should be set to none.
• controls
Species one or more form control items (up to 32) that you want to be processed by SSOv2.
• [name]
Species the name of the HTML form control item. It must match the name attribute value of the HTML
form's input tag.
The options are:
• app-service
Species the name of the application service to which the control item belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the control item. Only the application service can modify or delete the
control item.
• secure
Species whether the control item represents the HTML input tag of type "password". The default
is false.
• value
Species the value of the control item. This is usually the name of a session variable. If the session
variable is not found when the SSO request is processed, the value of the corresponding POST
parameter will be empty. The value could also be a literal string or a combination of strings and
session variable names.
• description
User-dened description.
• form-order
Species the order of the HTML logon form on the logon page when the id-type option is set to order.
Starts with 1.
• id-type
Species how the HTML logon form is found in the HTML body of the logon page. If there is more
than one form on the logon page matching the criteria, the rst match is used. The default is inputs.
The options are:
• action
The logon form is identied by the value of the <form> tag in the action attribute. The value is
specied in the attribute-value option.
• id
The logon form is identied by the id attribute's value of the <form> tag. The value is specied in
the attribute-value option.
• name
415
Traffic Management Shell (tmsh) Reference Guide
The logon form is identied by the name attribute's value of the <form> tag. The value is specied
in the attribute-value option.
• order
The logon form is identied by its relative order on the logon page (starting from 1). The order is
specied in the form-order option.
• inputs
The logon form is identied by a combination of controls items. The controls in the conguration
must have corresponding <input> elements in the form.
• request-method
Species the HTTP method of the application's request returning logon page. Default is get.
• request-name
Species the name of the HTTP cookie or the name of the HTTP header used to identify application's
request for logon page. The cookie or header is selected by the request-type option. The value of the
cookie or header is specied by the request-value option. When the request-type option is set to uri,
this option is not used and should be set to none.
• request-negative
When set to true, the application's request for logon page will be identied by the absence of the specied
cookie or header, or by a failed match against the list of specied URIs. The default is false.
• request-prex
Species how the value of the request-value option will be used to match one of the HTTP request
cookie, header, or URI. The default is true and species a partial match; false species an exact match.
• request-type
Species which element of the HTTP request headers is used to identify the application's request for
logon page. The default is uri.
The options are:
• cookie
The request is identied by the presence (or absence) of a cookie. The name and value of the cookie
are specied by the request-name and request-value options.
• header
The request is identied by the presence (or absence) of the HTTP header. The name and value of
the header are specied by the request-name and request-value options.
• uri
The request is identied by a successful (or failed) match against a list of URIs specied by the
request-value option, and the request-name option is not used.
• request-value
Species the value of the HTTP request element that must be matched to identify the request as the
application's request for the logon page. This is one of: the cookie value, the header value, or a list of
URIs (one per line) as specied by the request-type option. Cookie or header value could be set to
none, in which case only the presence of the named cookie or header is checked and the value is not
checked. When checking for URI, the value must be specied.
• submit-autodetect
When set to true, the application's HTTP request that submits the user's credentials will be identied
automatically and other submit- options should not be used. When false, the form submit will be
identied using a combination of other submit- options. The default is true.
416
APM SSO
• submit-javascript
Species user-provided JavaScript code to be inserted into the logon page to perform automatic form
submission when the submit-javascript-type option is set to custom. The custom JavaScript code
replaces the code automatically generated by the SSOv2 module. When the submit-javascript-type
option is set to extra, it species the application's JavaScript functions to call from the automatically
generated JavaScript code prior to submitting a logon form. When the submit-javascript-type option
is set to auto, this option should be set to none.
• submit-javascript-type
Species the type of JavaScript code to be inserted into the logon page by the SSOv2 module to perform
automatic logon form submission.
The options are:
• auto
JavaScript code is automatically generated by the SSOv2 module.
• custom
JavaScript code is provided by the user in the submit-javascript option.
• extra
JavaScript code is automatically generated by the SSOv2 module, and additional JavaScript code
provided by the user in the submit-javascript option is inserted before the form submit statement.
• submit-method
Species the HTTP method of credentials submit request for the application. This must be set to post.
This option is not used when submit-autodetect is true.
• submit-name
Species the name of the HTTP cookie or the name of HTTP header used to identify credentials submit
request for the application. The cookie or header is selected by the submit-type option. The value of
the cookie or header is specied by the submit-value option. When the submit-type option is set to
uri, this option is not used and should be set to none. This option is not used when submit-autodetect
is true.
• submit-negative
When set to true, the credentials submit request for the application is identied by the absence of a
specied cookie or header, or by a failed match against the list of specied URIs. The default is false.
This option is not used when submit-autodetect is true.
• submit-prex
Species how the value of the submit-value option will be used to match the HTTP request cookie,
header, or URI. The default is true and species partial match; false species exact match. This option
is not used when submit-autodetect is true.
• submit-type
Species which element of HTTP request headers is used to identify the credentials submit request for
the application. The default is uri. This option is not used when submit-autodetect is true.
The options are:
• cookie
The request is identied by the presence (or absence) of a cookie. The name and value of the cookie
are specied by the submit-name and submit-value options.
• header
417
Traffic Management Shell (tmsh) Reference Guide
The request is identied by the presence (or absence) of the HTTP header. The name and value of
the header are specied by the submit-name and submit-value options.
• uri
The request is identied by a successful (or failed) match against a list of URIs specied by the
submit-value option and the submit-name option is not used.
• submit-value
Species the value of the HTTP request element that must be matched to identify the request as a
credentials submit request for the application. This is one of: the cookie value, the header value, or a
list of URIs (one per line) as specied by the submit-type option. Cookie or header value could be set
to none, in which case only the presence of the named cookie or header is checked and the value is not
checked. When checking for URI, the value must be specied. This option is not used when
submit-autodetect is true.
• success-match-type
Species how the SSOv2 module detects whether the credentials submit request was successful. When
the SSOv2 module detects that the credentials submission failed, the SSOv2 conguration used for this
HTTP transaction is disabled for the user session. If you specify a value for this option, you must also
specify a value for success-match-value. The default is none. The options are:
• url
Credentials submission was successful if the response contains the HTTP Location header with a
value matching one of the URLs specied by the success-match-value option.
• cookie
Credentials submission was successful if the response contains the HTTP cookie with the name
specied by the success-match-value option.
• none
No check is performed. If SSO logon fails and the application server redirects back to the logon page
that matches the criteria of the logon page request, SSO will be retried, possibly causing authentication
loop.
• success-match-value
Species the value used to detect the success or failure of the SSO logon. When the success-match-type
option is set to url, this is a list of URLs. Each URL in the list can contain a single wildcard character
(*). When the success-match-type option is set to cookie, this option species the name of the cookie.
The default is none.
• headers
Species the name and value of the HTTP header to be inserted in an HTTP Request that passes through
the APM SSOv2 module.
• [name]
Species the name of the headers item.
The options are:
• app-service
Species the name of the application service to which the HTTP header belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the HTTP header. Only the application service can modify or delete the
HTTP header.
• name
Species the name of the HTTP header.
418
APM SSO
• value
Species the value of the HTTP header.
• log-level
Species the log level. Valid values are alert, crit, debug, emerg, err, info, notice, warn. The default
is notice.
See Also
basic, kerberos, ntlmv1, ntlmv2, form-based
kerberos
Congures a Kerberos conguration object.
Syntax
Congure the kerberos component within the sso module using the syntax shown in the following sections.
Create/Modify
create kerberos [name]
modify kerberos [name]
account-name [string]
account-password [string]
app-service [[string] | none]
headers [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
hname [[string] | none]
hvalue [[integer] | none]
}
}
kdc [[string] | none]
location-specific [true | false]
realm [string]
send-authorization [401 | always]
spn-pattern [[string] | none]
ticket-lifetime [[integer] | none]
edit kerberos [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list kerberos
list kerberos [ [ [name] | [glob] | [regex] ] ... ]
show running-config kerberos
show running-config kerberos [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
419
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
show kerberos
show kerberos [name]
Delete
delete kerberos [name]
Description
You can use the kerberos component to congure an SSO Kerberos conguration object. Kerberos is an
authentication protocol, where both the user and the server verify the other's identity.
Examples
• create mykerberos { realm MYREALM.COM account-name apmaccount account-password ****
}
Creates an SSO kerberos conguration object named mykerberos for the realm myrealm.com, where
the account name is apmaccount and the password is ****.
Options
• account-name
Species the name of the Active Directory account congured for delegation. This account must be
congured in the server's Kerberos realm (AD Domain). If servers are from multiple realms, each realm
(AD Domain) must have its own delegation account. This option is required.
• account-password
Species the password for the delegation account specied in account-name. This option is required.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• headers
Species custom HTTP headers to insert into a request. The default value is none. The options are:
• app-service
Species the name of the application service to which the header belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the header. Only the application service can modify or delete the header.
• hname
Species the name of a header to add to a request.
• hvalue
Species the value of a header to add to a request.
• kdc
420
APM SSO
Species the IP Address or host name of the Kerberos Key Distribution Center (KDC) for the server's
realm. This is normally an Active Directory domain controller. If you leave this empty, the KDC must
be discoverable through DNS, for example, BIG-IP system must be able to fetch SRV records for the
server realm's domain. If the server realm's domain name is different from the server's realm name, you
must specify the server realm's domain name in the /etc/krb5.conf le. Kerberos SSO processing is
fastest when KDC is specied by its IP address, slower when specied by host name, and even slower
(due to additional DNS queries) when left empty. When a user's realm is different from server's realm,
the KDC value must be empty. This is true in cases of cross-realm SSO. The default is none.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name for the SSO Kerberos conguration object. This option is required.
• realm
Species the realm of application server(s), for example, pool members or portal access resource hosts.
If the servers are located in multiple realms, each realm requires a separate SSO conguration. You
must specify the realm in uppercase letters. The user's realm can be specied through the
session.logon.last.domain session variable, and if this variable is not set, then the user's realm is assumed
to be the same as the server's realm. This option is required.
• send-authorization
Species when to submit a Kerberos ticket to the application server(s). The ticket is submitted in an
HTTP Authorization header. The header value starts with the word Negotiate, followed by one space
and a base64-encoded GSSIAPI token containing the Kerberos ticket. If a request contains an
Authorization header from the user's browser, it is deleted. The default is always. The options are:
• 401
The BIG-IP system rst forwards the user's HTTP request to the web server without inserting a new
Authorization header; however, the browser's Authorization header is deleted. If the server requests
authentication by responding with a 401 status code, BIG-IP retries the request with the Authorization
header. The Kerberos ticket GSSAPI representation uses the SPNEGO mechanism type (OID
1.3.6.1.5.5.2).
Specifying 401 results in additional BIG-IP/server request round trips in case authentication is
required for the request.
• always
The BIG-IP system inserts an Authorization header, including the Kerberos ticket, into every HTTP
request, whether the request requires authentication or not. The Kerberos ticket GSSAPI representation
uses the KRB5 Kerberos 5 mechanism type (OID 1.2.840.113554.1.2.2).
Specifying Always results in the additional overhead of generating a Kerberos token for every
request. This is the default value.
• spn-pattern
Species how the Service Principal Name (SPN) for the server is constructed. For example,
HTTP/%s@[server realm name congured in the realm option], where %s will be substituted with
the hostname of your server discovered through reverse DNS lookup using the server IP address. Only
specify this option when you need non-standard SPN format. The default is none.
• ticket-lifetime
421
Traffic Management Shell (tmsh) Reference Guide
Species the lifetime of Kerberos tickets obtained for the user. The value represents the maximum ticket
lifetime. The actual ticket lifetime may be less by up to 1 hour, because a user's ticket lifetime is the
same as the Kerberos Ticket Granting Ticket (TGT) lifetime. A TGT is obtained for the delegation
account specied in this conguration. A new TGT is fetched every time the current TGT is older than
one hour. The new TGT can only be fetched when an SSO request is processed.
The minimum ticket lifetime is 10 minutes. There is no maximum, however, the ticket lifetime of most
AD domains is 10 hours (600 minutes). F5 Networks recommends that you set the ticket lifetime in an
SSO conguration above what is specied in an AD domain. The default is 600 minutes.
See Also
basic, form-based, ntlmv1, ntlmv2
ntlmv1
Congures a single sign-on (SSO) NT LAN Manager, version 1 (ntlmv1) conguration object.
Syntax
Congure the ntlmv1 component within the sso module using the syntax shown in the following sections.
Create/Modify
create ntlmv1 [name]
modify ntlmv1 [name]
app-service [[string] | none]
domain-source [session.logon.last.domain | none]
headers [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
hname [[string] | none]
hvalue [[integer] | none]
}
}
location-specific [true | false]
ntlm-domain [[string] | none]
password-source [session.sso.token.last.password | none]
username-conversion [enabled | disabled]
username-source [session.sso.token.last.username | none]
edit ntlmv1 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ntlmv1
list ntlmv1 [ [ [name] | [glob] | [regex] ] ... ]
show running-config ntlmv1
show running-config ntlmv1 [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
422
APM SSO
one-line
partition
show ntlmv1
show ntlmv1 [name]
Delete
delete ntlmv1 [name]
Description
You can use this ntlmv1 component to congure a single sign-on NT LAN Manager, version 1 conguration
object.
Examples
• create ntlmv1 myntlmv1
Creates an SSO ntlmv1 conguration object named myntlmv1.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• domain-source
Species the Session variable used as a source for the single sign-on user domain. The default is
session.logon.last.domain.
• headers
Species the name and value of the HTTP header content to be inserted in an HTTP Request that passes
through the APM SSO module. The default is none.
The options are:
• app-service
Species the name of the application service to which the HTTP header belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the HTTP header. Only the application service can modify or delete the
HTTP header.
• hname
Species the name of the HTTP header.
• hvalue
Species the value of the HTTP header.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
423
Traffic Management Shell (tmsh) Reference Guide
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species the name for the SSO ntlmv1 conguration object. This option is required.
• ntlm-domain
Species the static domain setting. If the domain is not retrieved successfully from the source specied
in the domain-source option, the system uses this value for the source.
• password source
Species the source from which you want SSO to retrieve the password to use to authenticate applications.
The default is session.sso.token.last.password.
• username-conversion
Enables or disables conversion of PREWIN2k/UPN username input format to the format you want to
use for SSO. The default is disabled.
• username-source
Species the source from which you want SSO to retrieve the username used to authenticate applications.
See Also
basic, form-based, kerberos, ntlmv2
ntlmv2
Congures a single sign-on (SSO) NT LAN Manager, version 2 (ntlmv2) conguration object.
Syntax
Congure the ntlmv2 component within the sso module using the syntax shown in the following sections.
Create/Modify
create ntlmv2 [name]
modify ntlmv2 [name]
app-service [[string] | none]
domain-source [session.logon.last.domain | none]
headers [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
hname [[string] | none]
hvalue [[integer] | none]
}
}
location-specific [true | false]
ntlm-domain [[string] | none]
password-source [session.sso.token.last.password | none]
username-conversion [enabled | disabled]
username-source [session.sso.token.last.username | none]
edit ntlmv2 [ [ [name] | [glob] | [regex] ] ... ]
424
APM SSO
all-properties
non-default-properties
Display
list ntlmv2
list ntlmv2 [ [ [name] | [glob] | [regex] ] ... ]
show running-config ntlmv2
show running-config ntlmv2 [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show ntlmv2
show ntlmv2 [name]
Delete
delete ntlmv2 [name]
Description
You can use the ntlmv2 component to congure a single sign-on NT LAN Manager, version 2 conguration
object.
Examples
• create ntlmv2 myntlmv2
Creates an SSO ntlmv2 conguration object named myntlmv2.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• domain-source
Species the Session variable used as a source for the single sign-on user domain. The default is
session.logon.last.domain.
• headers
Species the name and value of the HTTP header content to be inserted in an HTTP Request that passes
through the APM SSO module. The default is none.
The options are:
• app-service
Species the name of the application service to which the HTTP header belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
425
Traffic Management Shell (tmsh) Reference Guide
you cannot modify or delete the HTTP header. Only the application service can modify or delete the
HTTP header.
• hname
Species the name of the HTTP header.
• hvalue
Species the value of the HTTP header.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• [name]
Species a name for the sso ntlmv2 conguration object. This option is required.
• ntlm-domain
Species the static domain setting. If the domain is not retrieved successfully from the source specied
in the domain-source option, the system uses this value for the source.
• password source
Species the source from which you want SSO to retrieve the password to use to authenticate applications.
The default is session.sso.token.last.password.
• username-conversion
Enables or disables conversion of PREWIN2k/UPN username input format to the format you want to
use for SSO. The default is disabled.
• username-source
Species the source from which you want SSO to retrieve the username used to authenticate applications.
See Also
basic, form-based, kerberos, ntlmv1
saml
Specify SAML SSO conguration.
Syntax
Congure the saml within the sso module using the syntax shown in the following sections.
Create/Modify
create saml [name]
modify saml [name]
app-service [[string] | none]
artifact-resolution-service-name [name | none]
assertion-validity [integer]
attributes [none | {
426
APM SSO
{
name [[string] | none],
multi-values {
[string]
},
encrypt [true | false],
encryption-type [aes128 | aes192 | aes256]
}
} ]
auth-context-method [string | none]
description [[string] | none]
encrypt-subject [true | false]
encryption-type-subject [aes128 | aes192 | aes256]
entity-id [string]
export-metadata [no-signing | with-signing]
idp-certificate [string | none]
idp-host [string | none]
idp-scheme [http | https]
idp-signkey [string | none]
log-level [alert | crit | debug | emerg | err | info | notice | warn]
location-specific [true | false]
metadata-cert [[string] | none]
metadata-file [[string] | none]
metadata-signkey [string | none]
saml-profiles [add | delete | modify | none | replace-all-with] {
[ecp | web-browser-sso]
}
sp-connectors [add | delete | modify | none | replace-all-with] {
[string]
}
subject-type [email-address | kerberos | transient |
win-domain-qualified-name | entity | persistent | unspecified | x509-subject]
subject-value [ string | none ]
edit saml [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list saml
list saml [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml
show running-config saml [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete saml [name]
Description
You can use the saml component to create and manage SAML SSO objects.
427
Traffic Management Shell (tmsh) Reference Guide
Examples
• create saml my_saml_sso_obj { entity-id "https://myidpvs.big-ip.com/idp" subject-type
email-address subject-value test@mycompany.com idp-certicate default.crt idp-signkey default.key
sp-connectors add { google_apps salesforce }}
Creates a SAML SSO object named my_saml_sso_obj with SP connectors "google_apps" and "salesforce"
• create saml my_saml_sso_obj1 { entity-id "https://myidpvs.big-ip.com/idp" subject-type
email-address subject-value test@mycompany.com idp-certicate default.crt idp-signkey default.key
sp-connectors add { google_apps sp_salesforce } attributes {{name "group" multi-values { "PD"
"Admin" }} {name "title" multi-values { "engineer1" }}} }
Creates a SAML SSO object named my_saml_sso_obj1 with attributes "group" and "title".
• list saml
Displays list of SAML SSO objects.
• delete saml my_saml_sso_obj
Deletes the my_saml_sso_obj SAML SSO object.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• assertion-validity
Species assertion validity period in seconds.
• artifact-resolution-service-name
Species the artifact resolution service to be used by this BIG-IP as IdP to receive artifacts and resolve
them for assertions.
• attributes
Species list of attributes as part of assertion. Both attribute name and values can be session variables.
Property 'value' is DEPRECATED; "multi-values" must be used instead.
create saml my_saml_sso_obj1 { entity-id "https://myidpvs.big-ip.com/idp" subject-type
email-address subject-value test@mycompany.com idp-certicate default.crt idp-signkey default.key
sp-connectors add { google_apps sp_salesforce } attributes {{name "group" multi-values {
"%{session.ldap.last.attr.primarygroup}"}} {name "name" multi-values { "rstName" "lastName"
}}} }
Creates a SAML SSO object named my_saml_sso_obj1 with attributes "group" and "name".
• auth-context-method
Species an authentication context method used by this BIG-IP as IdP when creating assertions. This
attribute can be a session variable.
• description
Species a unique description for SAML SSO object. The default is none.
• encrypt-subject
Set to true if assertion 'Subject' must be encrypted. Default value is false.
• encryption-type-subject
Encryption algorithm used to encrypt 'Subject' element in assertion. Default value is aes128.
428
APM SSO
• entity-id
Species unique identier for BIG-IP as IdP. Typically, 'entity-id' is a URI that points to the BIG-IP
virtual server that is going to act as a SAML IdP. In case 'entity-id' is not a valid URL, the idp-host
attribute is required. Examples of valid conguration include "https://mycompany-idp",
"idp:my:company", and "idp.my.company.com"
• export-metadata
You can simplify SAML conguration using metadata les. When you use APM as an IdP, you can
export metadata for IdP. You can save metadata to a le and give it to the SP to enable SP to import
SP's SAML conguration or enable SP to use information from the metadata le to congure the IdP.
You can choose to sign metadata while exporting it for better security.
For example:
1. Exporting metadata with signing. This requires metadata-signkey and metadata-cert les.
modify saml my_saml_sso_obj {export-metadata with-signing metadata-file
/shared/idp_signed_metadata.xml metadata-cert default.crt metadata-signkey
default.key}
2. Exporting metadata with no signing.
modify saml my_saml_sso_obj {export-metadata no-signing metadata-file
/shared/idp_metadata.xml}
• idp-certicate
BIG-IP includes this certicate in the SAML IdP metadata that you export. After the SAML IdP metadata
is imported on the SP, the SP can use this certicate to verify the signature of assertion sent by this
BIG-IP as IdP.
• idp-host
Hostname of this BIG-IP as IdP. This attribute is required when "entity-id" is not a valid URL.
• idp-scheme
Scheme used by this BIG-IP as IdP. This attribute is only used when idp-host is not empty. Default
value is https.
• idp-signkey
Species the private key used for signing assertion by BIG-IP as IdP.
• location-specic
Objects of this class might have location specic attribute(s). Admin can indicate if object is location
specic by setting it to true.
• log-level
Species log level for this SAML SSO object.
• metadata-cert
Species the certicate with public key of the key pair used in signing the metadata. See export-metadata
for more information on metadata export functionality. This is the certicate to includ in signed metadata
when we export metadata. This might or might not be IdP certicate.
• metadata-le
Species the le to which metadata is saved. See export-metadata for more information on metadata
export functionality.
429
Traffic Management Shell (tmsh) Reference Guide
• metadata-signkey
This species the key that is used to sign IdP's metadata. See export-metadata for more information on
metadata export functionality.
• saml-proles
List of SAML proles enabled on this BIG-IP as IdP. Default value is web-browser-sso.
• sp-connectors
Species list of SP connectors associated with this SAML SSO object. When this SSO object is assigned
to SAML resource then only one entry is allowed for SP connectors. If SAML SSO object is assigned
to access prole then you can add multiple SAML SP connectors.
• subject-type
Species type of the subject to be used while creating SAML assertion.
• subject-value
Species the value of the subject to be included inside SAML assertion. This can be a session variable.
For example: %{session.last.logonname}, %{session.ad.last.attr.userEmail}
saml-resource
Congures saml resource.
Syntax
Congure a saml-resource using the syntax shown in the following sections.
Create/Modify
create saml-resource [name]
modify saml-resource [name]
app-service [[string] | none]
customization-group [[string] | none]
description [[string] | none]
location-specific [true | false]
publish-on-webtop [true | false]
sso-config-saml [[string] | none]
edit saml-resource [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list saml-resource
list saml-resource [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml-resource
show running-config saml-resource [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
430
APM SSO
Delete
delete saml-resource [name]
Description
You can use saml-resource component to congure saml resource.
Examples
• create saml-resource my_saml_resource { sso-cong-saml my_saml_sso_obj publish-on-webtop
true }
Creates a saml resource named my_saml_resource with saml sso object 'my_saml_sso_obj' and with
option to display this resource on full webtop.
• delete saml-resource my_saml_resource
Deletes the saml resource named my_saml_resource.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• customization-group
Species the customization group associated with saml resource.
• description
Species a description for the saml resource. The default is none.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location.
• publish-on-webtop
Species whether to display the SAML resource on the full webtop or not. Default value is true.
• sso-cong-saml
Species saml sso cong object associated with this saml resource. This saml sso object should only
have one saml sp connector associated with it.
saml-sp-connector
Specify saml sp connector conguration.
Syntax
Congure a saml-sp-connector within the sso module using the syntax shown in the following sections.
431
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create saml-sp-connector [name]
modify saml-sp-connector [name]
app-service [[string] | none]
assertion-consumer-services [ {
binding [http-artifact | http-post | paos]
index [0 - 65535]
is-default [true | false]
uri [string]
} ]
description [[string] | none]
encryption-type [aes128 | aes192 | aes256]
entity-id [string]
import-metadata [ string | none ]
is-authn-request-signed [ true | false ]
location-specific [ true | false ]
metadata-cert [[string] | none]
relay-state [[string] | none]
signature-type [rsa-sha1 | rsa-sha256 | rsa-sha384 | rsa-sha512]
single-logout-binding
single-logout-response-uri [string]
single-logout-uri [string]
sp-certificate [[string] | none]
want-assertion-encrypted [ true | false ]
want-assertion-signed [ true | false ]
want-response-signed [ true | false ]
edit saml-sp-connector [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list saml-sp-connector
list saml-sp-connector [ [ [name] | [glob] | [regex] ] ... ]
show running-config saml-sp-connector
show running-config saml-sp-connector [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete saml-sp-connector [name]
Description
You can use the saml-sp-connector component to create and manage saml sp connectors
432
APM SSO
Examples
• create saml-sp-connector my_saml_sp_connector { entity-id "https://companyx.sp.com/sp"
assertion-consumer-services { { uri "https://companyx.sp.com/acs/" is-default true } }
want-assertion-signed true want-response-signed true want-assertion-encrypted true
encryption-type aes256 is-authn-request-signed false sp-certicate default.crt }
Creates a SAML sp-connector named my_saml_sp_connector with security options to encrypt and
sign the assertion as well as SAML response.
• create saml-sp-connector my_saml_sp_connector1 { import-metadata /shared/tmp/sp_metadata.xml}
Creates a SAML sp-connector named my_saml_sp_connector1 from metadata le
"/shared/tmp/sp_metadata.xml"
• list saml-sp-connector
Displays a list of SAML sp connectors.
• delete saml-sp-connector my_saml_sp_connector
Deletes the my_saml_sp_connector SAML sp connector.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• assertion-consumer-services
List of assertion consumer services (ACS) used by external SP. Each ACS entry contains attributes
'binding', 'index', 'is-default', and 'url'. Each ACS must contain a valid URL, and a unique 'index'. One
ACS entry must be set as default.
• assertion-consumer-binding
This attribute is DEPRECATED. Use assertion-consumer-services instead.
• assertion-consumer-uri
This attribute is DEPRECATED. Use assertion-consumer-services instead.
• description
Species a unique description for saml sp connector. The default is none.
• encryption-type
Species the type of encryption BIG-IP as IdP should use to encrypt the assertion. Default is aes128.
• entity-id
Species a unique ID to identify SP pointed by sp connector.
• import-metadata
Species the metadata le to be used to create sp connector object. For example: create
saml-sp-connector my_saml_sp_connector1 { import-metadata /shared/tmp/sp_metadata.xml}
• is-authn-request-signed
Species whether SP signs authentication requests while sending them to BIG-IP as IdP. The default
value for this is false.
• location-specic
Objects of this class might have location specic attribute(s). Admin can indicate if object is location
specic by setting it to true.
433
Traffic Management Shell (tmsh) Reference Guide
• metadata-cert
Species the certicate to be used to verify the signature of metadata imported from a le.
• relay-state
Species the value sent to the SP by BIG-IP as IdP as part of the response. This value is only used if
the SP did not send RelayState as part of the authentication request.
• signature-type
Signature algorithms to be used for digital signing of SAML messages. Default value is rsa-sha1.
• single-logout-binding
This attribute is reserved for future functionality.
• single-logout-response-uri
A URI where this BIG-IP as IdP will send single logout (SLO) responses.
• single-logout-uri
A URI where this BIG-IP as IdP will send single logout (SLO) requests.
• sp-certicate
Species SP certicate used by BIG-IP as IdP to verify the signature of authentication request.
• want-assertion-encrypted
Species whether SP requires encrypted assertions. The default value for this attribute is false
• want-assertion-signed
Species whether SP requires signed assertions. The default value for this attribute is true
• want-response-signed
Species whether SP requires signed SAML responses. The default value for this attribute is false
434
APM SSO
ASM
device-sync
Contains the ASM timestamp for each device in the group.
Syntax
Retrieve the list of the device-sync values using the syntax shown in the following section.
Display
list device-sync
list device-sync [ [ [name] | [glob] | [regex] ] ... ]
Description
Use this command to display the current values of the device-sync object, i.e. ASM change times for all
devices in the group. This object is designed for internal purposes only (incremented on every ASM change),
so do not try to create, modify, or delete it manually.
Examples
list device-sync
Displays all last ASM change times of the device group.
See Also
tmsh, list, glob, regex
http-method
Lists the available HTTP request methods that can be used in the context of the Application Security
Manager(TM).
Syntax
Retrieve the list of the http-method values using the syntax shown in the following sections.
Display
list http-method
list http-method [ [ [name] | [glob] | [regex] ] ... ]
all
app-service
default-act-as
one-line
partition
recursive
Description
Use this command to display the possible values of the http-method object to be used in the context of the
Application Security Manager. These possible values include predened and user-dened allowed methods
for all security policies, and also are intended to be used in lters of Application Security Logging and in
HTTP security proles.
Examples
list http-method
Displays all the HTTP methods supported by the ASM.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• default-act-as
Displays the HTTP request method, either GET or POST, based on how you have instructed the system
to treat the listed method name; a predened method has its system default and a user-dened allowed
method is congured in the security policy.
• partition
Displays the administrative partition within which the component resides.
See Also
glob, list, regex, security http prole, security log prole, tmsh
httpclass-asm
congure initial ASM settings for applications. This component has been deprecated as of BIG-IP v11.3.0,
please use the policy component in the asm module instead.
Syntax
Congure the httpclass-asm component within the asm module using the syntax shown in the following
sections.
Create/Modify
create httpclass-asm [name]
modify httpclass-asm [name]
active-policy-name [string]
app-service [[string] | none]
436
ASM
language [language]
predefined-policy [predefined-policy]
Display
list httpclass-asm
list httpclass-asm [ [ [name] | [glob] | [regex] ] ... ]
show running-config httpclass-asm
show running-config httpclass-asm [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
Delete
delete httpclass-asm [name]
Description
Use this command to create, modify, display, or delete an httpclass-asm prole that congures ASM security
policies. Changing/setting attributes for an httpclass-asm prole affects the ASM security policy with the
same name. Note that modifying the language of an existing prole recongures the ASM security policy
and deletes the congurations, log entries and statistics of the security policy. This is for advanced usage -
this command is intended to be used by the application templates system (iApps(tm)).
Examples
create asm httpclass-asm my_class active-policy-name my_class_policy language utf-8 predened-policy
POLICY_TEMPLATE_RAPID_DEPLOYMENT_HTTP
Creates a custom httpclass-asm prole named my_class that causes ASM to congure a security policy
that uses the utf-8 application language and the Rapid Deployment security policy.
list httpclass-asm
Displays the properties of all httpclass-asm proles.
Options
• active-policy-name
Species the name of the active security policy. This property has been deprecated. As of BIG-IP v11.1.0,
the active security policy name is identical to the HTTP class prole's name.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• language
Species the language of the web application that the ASM security policy is protecting. Use autocomplete
or list /asm webapp-language to get the list of supported languages.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
437
Traffic Management Shell (tmsh) Reference Guide
• predened-policy
Species a predened security policy for a web application. This security policy was prebuilt to provide
out of the box security for a known application. Use autocomplete to get a list of applications for which
ASM has predened policies.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
policy
Congures an application security policy.
Syntax
Congure the policy component within the asm module using the syntax shown in the following sections.
Create/Modify
create policy [name]
modify policy [name]
[active | inactive]
app-service [[string] | none]
blocking-mode [enabled | disabled]
description [[string] | none]
encoding [[name] | none]
policy-builder [enabled | disabled]
policy-template [name]
Display
list policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
one-line
partition
virtual-servers
Delete
delete policy [name]
Save
save policy [name]
overwrite
bin-file [filename]
min-xml-file [filename]
xml-file [filename]
438
ASM
Load
load policy [name]
overwrite
file [filename]
xml-string [string]
Publish
publish policy [name]
Description
You can use the policy component to create, modify, display, delete, save, load, or publish an application
security policy for use with Application Security Manager functionality.
Note: To display all policy properties available in tmsh, including initial settings used by iApp and advanced
conguration accessible in ASM GUI, specify the all-properties option or the detailed properties. By default,
only initial properties are displayed: encoding, policy-template and [active | inactive].
Note: The modify command with the properties encoding and/or policy-template causes ASM to recongure
the security policy and clear all its former data.
Examples
create policy my_asm_policy encoding utf-8
Creates a new policy named my_asm_policy with the default language encoding.
modify policy my_asm_policy active
Activates the inactive policy named my_asm_policy.
list policy
Displays the properties of all application security policies.
save policy my_asm_policy xml-le my_asm_policy.xml
Exports the policy named my_asm_policy to the XML le /var/tmp/my_asm_policy.xml.
load policy my_asm_policy overwrite le /tmp/my_asm_policy.plc
Imports the policy named my_asm_policy from the le /tmp/my_asm_policy.plc and overwrites the policy
if it already exists.
publish policy my_asm_policy
Applies the active policy named my_asm_policy.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• [active | inactive]
439
Traffic Management Shell (tmsh) Reference Guide
Activates or deactivates the policy for later association with L7 policies and virtual servers. The default
value is inactive.
• bin-le
Species the exported le name to be saved in binary format when using the save command. The le
name should be simple (not a full path); it is saved to the /var/tmp directory on the system.
• blocking-mode
Species whether the system blocks a request that triggers a security policy violation or only logs the
violation event (transparent mode).
• description
Species an optional description of the security policy.
• encoding
Species the language encoding, which determines how the security policy processes the character sets.
This property corresponds to the language property of the httpclass-asm component.
• le
Species the le name from which the policy is going to be imported when using the load command.
A full path should be specied.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• min-xml-le
Species the exported le name to be saved in compact XML format when using the save command.
The le name should be simple (not a full path); it is saved to the /var/tmp directory on the system. To
display the XML output immediately, omit this property, the properties xml-le and bin-le.
• name
Species a unique name for the component. This option is required for the commands create, delete,
modify, save, and publish. If it is not specied for the load command, the policy name will be taken
from the imported settings.
• overwrite
Species that the policy le for the save command or the policy component for the load command can
be overwritten if it exists.
• partition
Displays the administrative partition within which the component resides.
• policy-builder
Enables or disables automatic policy building.
• policy-template
Species whether the security policy is based on a predened security policy template, and if so, which
one. If you create or modify a security policy based on a template, the system automatically congures
the new security policy according to the conditions of the template. This property corresponds to the
predened-policy property of the httpclass-asm component.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
440
ASM
Note: This component supports matching by the regex expression only when displaying the initial policy
properties.
• virtual-servers
Displays the name of the protected virtual server, or virtual servers, which have attached to them the
security policy via L7 policies.
• xml-le
Species the exported le name to be saved in XML format when using the save command. The le
name should be simple (not a full path); it is saved to the /var/tmp directory on the system. To display
the XML output immediately, omit this property, the properties min-xml-le and bin-le.
• xml-string
Species the XML document from which the policy is going to be imported when using the load
command.
See Also
asm predened-policy, asm webapp-language, create, delete, glob, list, load, ltm policy, ltm virtual, modify,
publish, regex, save, tmsh
predefined-policy
Lists the available predened policies that can be used in the context of the httpclass-asm prole.
Syntax
Retrieve the list of the predened-policy values using the syntax shown in the following sections.
Display
list predefined-policy
list predefined-policy [ [ [name] | [glob] | [regex] ] ... ]
all
one-line
Description
Use this command to display the possible values of the predened-policy object to be used in the context
of the httpclass-asm prole. This is for advanced usage; this command is intended for use by the application
templates system (iApps).
Examples
list predened-policy
Displays all the predened policies supported by the ASM.
See Also
asm httpclass-asm, glob, list, regex, tmsh
441
Traffic Management Shell (tmsh) Reference Guide
response-code
Lists the available HTTP response status codes that can be used in the context of the Application Security
Manager.
Syntax
Retrieve the list of the response-code values using the syntax shown in the following sections.
Display
list response-code
list response-code [ [ [number] | [glob] | [regex] ] ... ]
all
app-service
name
one-line
Description
Use this command to display the possible values of the response-code object to be used in the context of
the Application Security Manager. These possible values are predened and intended to be used in lters
of Application Security Logging.
Examples
list response-code
Displays all the response codes supported by the ASM.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• name
Displays a well-known textual meaning of the HTTP response code.
See Also
glob, list, regex, security log prole, tmsh
webapp-language
Lists the available languages that can be used in the context of the httpclass-asm prole.
Syntax
Retrieve the list of the webapp-language values using the syntax shown in the following sections.
442
ASM
Display
list webapp-language
list webapp-language [ [ [name] | [glob] ... ]
all
one-line
Description
Use this command to display the possible values of the webapp-language object to be used in the context
of the httpclass-asm prole. This is for advanced usage - this command is intended to be used by the
application templates system.
Examples
list webapp-language
Displays all the languages supported by the ASM.
See Also
asm httpclass-asm, glob, list, tmsh
443
Traffic Management Shell (tmsh) Reference Guide
Auth
apm-auth
Congures an APM-based authentication object for implementing access policy execution-based
authentication of BIG-IP(r) system users.
Syntax
Congure the apm-auth component within the auth module using the syntax shown in the following
sections.
Create/Modify
create apm-auth [name]
modify apm-auth [name]
profile-access [string]
edit apm-auth [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list apm-auth
list apm-auth [ [ [name] | [glob] | [regex] ] ...]
show running-config apm-auth
show running-config apm-auth [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
partition
Delete
delete apm-auth [name]
Description
You can congure APM-based authentication to execute an access policy for BIG-IP system users to
authenticate and authorize them.
APM authentication methods like HTTP, AD/LDAP, TACACS+ authentication can be used in box
authentication To authenticate BIG-IP system users.To do this, create an access prole, create APM
conguration object with the above access prole, and then activate the object.
The following steps describe how to congure APM-based authentication for BIG-IP system users:
1. Use the prole-access component in the apm module to create a access prole.
2. Use the apm-auth component in the auth module to map an access prole to an APM-based authentication
object.
3. To activate APM-based authentication for BIG-IP system users, run the command sequence modify /
auth source type apm-auth
Examples
create apm-auth system-auth {prole-access apm-prole}
Creates an APM-based authentication object named system-auth
delete apm-auth system-auth
Deletes the APM-based authentication object named system-auth.
Options
• description
User-dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the component resides.
• prole-access
Species the access prole that the system must use for APM-based authentication. You must specify
an access prole when you create an APM-based conguration object.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
auth user, create, delete, glob, list, modify, regex, run, show, tmsh
cert-ldap
Congures an LDAP conguration object for implementing Single Sign On based on a valid client certicate
for BIG-IP(r) system users. The user is required to properly congure the Certicate Authority so that
unique identifying attributes appear in the subjectName or subjectAltName elds of signed client certicates;
the OCSP responder so that it is available to the BIG-IP at the time a client certicate is presented; and the
LDAP server so that it includes the required attributes from the client certicate and the corresponding user
name.
446
Auth
Syntax
Congure the cert-ldap component within the auth module using the syntax shown in the following sections.
Create/Modify
create cert-ldap [name]
modify cert-ldap [name]
bind-dn [ [account dn] | none]
bind-pw [none | [password] ]
bind-timeout [integer]
check-host-attr [disabled | enabled]
check-roles-group [disabled | enabled]
debug [disabled | enabled]
description [string]
filter [ [filter name] | none]
idle-timeout [integer]
ignore-auth-info-unavail [no | yes]
ignore-unknown-user [disabled | enabled]
login-attribute [ [account name] | none]
login-filter [ [string] | none]
login-name [ [ldap attribute] | none]
port [ [name] | [integer]]
scope [base | one | sub]
search-base-dn [[search base dn] | none]
search-timeout [integer]
servers [add | delete | replace-all-with] {
[ [ip address] | [server name] ...] }
servers none
ssl [disabled | enabled]
ssl-ca-cert-file [ [file name] | none)
ssl-check-peer [disabled | enabled]
ssl-ciphers [ [string] | none]
ssl-client-cert [ [string] | none]
ssl-client-key [ [string] | none]
ssl-cname-field [ subjectname-cn | san-other | san-email
san-dns | san-x400 | san-dirname | san-ediparty
san-uri | san-ipadd | san-rid ]
ssl-cname-otheroid [ [OID in dotted-decimal] | none]
sso [on | off]
version [integer]
warnings [disabled | enabled]
edit cert-ldap [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list cert-ldap
list cert-ldap [ [ [name] | [glob] | [regex] ] ...]
show running-config cert-ldap
show running-config cert-ldap [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
partition
447
Traffic Management Shell (tmsh) Reference Guide
Delete
delete cert-ldap [name]
Description
The CERT-LDAP authentication mode is required to provide Single Sign On capability to the control plane
based on a valid client certicate. This mode involves conguring an Apache server to initiate a client
certicate request, perform certicate validation against an OCSP server, and then authenticate/authorize
certicate credentials against a congured remote LDAP server or a Microsoft(r) Windows(r) Active
Directory(r). The mode is not based on basic HTTP authentication (that is, user name and password).
CERT-LDAP mode is equivalent to LDAP mode with custom attributes.
To authenticate BIG-IP system users when their authentication data is stored on a remote LDAP server,
you create an LDAP conguration object, and then activate the object. Make sure that Apache is congured
to support the client certicate validation.
To congure CERT-LDAP authentication for BIG-IP system users:
1. Use the cert-ldap component in the auth module to congure an LDAP conguration object.
2. To activate LDAP authentication for BIG-IP system users, run the command sequence modify / auth
source type cert-ldap
Examples
create cert-ldap bigip_cert_ldap_auth servers add {my_ldap_server}
Creates a conguration object named bigip_cert_ldap_auth.
delete cert-ldap bigip_cert_ldap_auth
Deletes the conguration object named bigip_cert_ldap_auth.
Options
• bind-dn
Species the distinguished name of an account to which to bind to perform searches. This search account
is a Read-only account. You can also use the admin account as the search account. If an administrative
distinguished name is not specied, then a bind is not attempted. The default value is none.
Note: If the remote server is a Microsoft Windows Active Directory server, the distinguished name must
be in the form of an email address.
• bind-pw
Species the password for the search account created on the LDAP server. This option is required if
you enter a value for the bind-dn option. The default value is none.
• bind-timeout
Species a bind timeout limit, in seconds. The default value is 30.
• check-host-attr
Conrms the password for the bind distinguished name. This option is optional. The default value is
disabled.
• check-roles-group
Species whether to verify a user's group membership given in the remote-role denitions, formatted
as *member*of="group-dn". The default value is disabled.
448
Auth
• debug
Enables or disables syslog-ng debugging information at the LOG DEBUG level. The default value is
disabled. F5 Networks does not recommend using this option for normal conguration.
• description
User dened description.
• lter
Species a lter. Use this option for authorizing client trafc. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• group-dn
Species the group distinguished name. The system uses this option for authorizing client trafc. The
default value is none.
• group-member-attribute
Species a group member attribute. The system uses this option for authorizing client trafc. The default
value is none.
• idle-timeout
Species the idle timeout, in seconds, for connections. The default value is 3600 seconds.
• ignore-auth-info-unavail
Species whether the system ignores authentication information if it is not available. The default value
is no.
• ignore-unknown-user
Species whether the system ignores a user that is unknown. The default value is disabled.
• login-attribute
Species a logon attribute. Normally, the value for this option is uid; however, if the server is a Microsoft
Windows Active Directory server, the value must be the account name samaccountname (not
case-insensitive). The default value is none.
• login-lter
Species the lter to be applied on the CN of the client certicate. This lter is a regular expression to
extract required information from CN of client certicate which will be used to match against LDAP
search results. The default is disabled.
• login-name
Species the LDAP attribute holding the client name. (The client name is extracted from the client
certicate as specied by ssl-cname-eld.) The default is disabled.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species the port number or name for the LDAP service. Port 389 is typically used for non-SSL and
port 636 is used for an SSL-enabled LDAP service. The default value is ldap.
• regex
449
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• scope
Species the search scope. The default value is sub. The possible values are:
• base
The search scope is base object. The base value is almost never useful for name service lookups.
• one
The search scope is one level.
• sub
The search scope is a subtree.
• search-base-dn
Species the search base distinguished name. The default value is none.
• search-timeout
Species the search timeout, in seconds. The default value is 30.
• servers
Species the LDAP servers that the system must use to obtain authentication information. You must
specify a server when you create an LDAP conguration object.
• ssl
Enables or disables SSL functionality. The default is disabled.
Note that when you use tmsh to enable SSL for an LDAP service, the system does not change the port
number from 389 to 636, as is required. To change the port number from the command line, use the
port option, for example, ldap [name] ssl enabled port 636.
• ssl-ca-cert-le
Species the name of an SSL CA certicate using the full path to the le. The default value is none.
• ssl-check-peer
Species whether the system checks an SSL peer. The default value is disabled.
• ssl-ciphers
Species SSL ciphers. The default value is none.
• ssl-client-cert
Species the name of an SSL client certicate. The default value is none.
• ssl-client-key
Species the name of an SSL client key. The default value is none.
• ssl-cname-eld
Species the value from the client certicate that provides the client name. The client name must appear
in either the subjectName or subjectAltName (SAN) elds in the X.509v3 certicate. If it appears in
the subjectName eld, the client name must be the commonName (CN). If the client name appears in
the SAN, it will have the specied type. If san-other is specied, the ssl-cname-otheroid must provide
the OID of the UTF8 string containing the client name. The choices are: subjectname-cn, san-other,
san-email, san-dns, san-x400, san-dirname, san-ediparty, san-uri, san-ipadd, or san-rid. The default
value is subjectname-cn.
• ssl-cname-otheroid
450
Auth
Species the OID in dotted-decimal format of the UTF8 string in the client's X.509v3 subjectAltName
"other" attribute. This value is required when ssl-cname-eld is san-other. The default value is none.
• sso
Enables or disables Single Sign On (SSO) functionality. SSO eliminates the need to administer and
maintain multiple user logons and eliminates the need for users to enter their credentials multiple times.
When SSO is disabled, the user will be prompted to authenticate into the BIG-IP. The default is off.
• user-template
Species a user template for the LDAP application to use for authentication. The default value is none.
• version
Species the version number of the LDAP application. The default value is 3.
• warnings
Enables or disables warning messages. The default value is enabled.
See Also
auth user, create, delete, glob, list, modify, regex, run, show, tmsh
ldap
Congures an LDAP conguration object for implementing remote LDAP-based authentication of BIG-IP(r)
system users.
Syntax
Congure the ldap component within the auth module using the syntax shown in the following sections.
Create/Modify
create ldap [name]
modify ldap [name]
bind-dn [ [account dn] | none]
bind-pw [none | [password] ]
bind-timeout [integer]
check-host-attr [disabled | enabled]
check-roles-group [disabled | enabled]
debug [disabled | enabled]
description [string]
filter [ [filter name] | none]
group-dn [ [group dn] | none]
group-member-attr [ [attribute] | none]
idle-timeout [integer]
ignore-auth-info-unavail [no | yes]
ignore-unknown-user [disabled | enabled]
login-attribute [ [account name] | none]
port [ [name] | [integer]]
scope [base | one | sub]
search-base-dn [[search base dn] | none]
search-timeout [integer]
servers [add | delete | replace-all-with] {
[ [ip address] | [server name] ...] }
servers none
ssl [disabled | enabled]
ssl-ca-cert-file [ [file name] | none)
451
Traffic Management Shell (tmsh) Reference Guide
ssl-check-peer [disabled | enabled]
ssl-ciphers [ [string] | none]
ssl-client-cert [ [string] | none]
ssl-client-key [ [string] | none]
user-template [ [string] | none]
version [integer]
warnings [disabled | enabled]
edit ldap [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list ldap
list ldap [ [ [name] | [glob] | [regex] ] ...]
show running-config ldap
show running-config ldap [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
partition
Delete
delete ldap [name]
Description
LDAP authentication is useful when the BIG-IP system users authentication or authorization data is stored
on a remote LDAP server or a Microsoft(r) Windows(r) Active Directory(r) server, and you want the user
credentials to be based on basic HTTP authentication (that is, user name and password).
To authenticate BIG-IP system users when their authentication data is stored on a remote LDAP server,
you create an LDAP conguration object, and then activate the object.
The following steps describe how to congure LDAP authentication for BIG-IP system users:
1. Use the ldap component in the auth module to congure an LDAP conguration object.
2. To activate LDAP authentication for BIG-IP system users, run the command sequence modify / auth
source type ldap
Examples
create ldap bigip_ldap_auth servers add {my_ldap_server}
Creates a conguration object named bigip_ldap_auth
delete ldap bigip_ldap_auth
Deletes the conguration object named bigip_ldap_auth.
Options
• bind-dn
452
Auth
Species the distinguished name of an account to which to bind to perform searches. This search account
is a Read-only account. You can also use the admin account as the search account. If an administrative
distinguished name is not specied, then a bind is not attempted. The default value is none.
Note that if the remote server is a Microsoft Windows Active Directory server, the distinguished name
must be in the form of an email address.
• bind-pw
Species the password for the search account created on the LDAP server. This option is required if
you enter a value for the bind-dn option. The default value is none.
• bind-timeout
Species a bind timeout limit, in seconds. The default value is 30.
• check-host-attr
Conrms the password for the bind distinguished name. This option is optional. The default value is
disabled.
• check-roles-group
Species whether to verify a user's group membership given in the remote-role denitions, formatted
as *member*of="group-dn". The default value is disabled.
• debug
Enables or disables syslog-ng debugging information at the LOG DEBUG level. The default value is
disabled. F5 Networks does not recommend using this option for normal conguration.
• description
User dened description.
• lter
Species a lter. Use this option for authorizing client trafc. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• group-dn
Species the group distinguished name. The system uses this option for authorizing client trafc. The
default value is none.
• group-member-attribute
Species a group member attribute. The system uses this option for authorizing client trafc. The default
value is none.
• idle-timeout
Species the idle timeout, in seconds, for connections. The default value is 3600 seconds.
• ignore-auth-info-unavail
Species whether the system ignores authentication information if it is not available. The default value
is no.
• ignore-unknown-user
Species whether the system ignores a user that is unknown. The default value is disabled.
• login-attribute
Species a logon attribute. Normally, the value for this option is uid; however, if the server is a Microsoft
Windows Active Directory server, the value must be the account name samaccountname (not
case-insensitive). The default value is none.
453
Traffic Management Shell (tmsh) Reference Guide
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species the port number or name for the LDAP service. Port 389 is typically used for non-SSL and
port 636 is used for an SSL-enabled LDAP service. The default value is ldap.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• scope
Species the search scope. The default value is sub. The possible values are:
• base
The search scope is base object. The base value is almost never useful for name service lookups.
• one
The search scope is one level.
• sub
The search scope is a subtree.
• search-base-dn
Species the search base distinguished name. The default value is none.
• search-timeout
Species the search timeout, in seconds. The default value is 30.
• servers
Species the LDAP servers that the system must use to obtain authentication information. You must
specify a server when you create an LDAP conguration object.
• ssl
Enables or disables SSL functionality. The default is disabled.
Note that when you use tmsh to enable SSL for an LDAP service, the system does not change the port
number from 389 to 636, as is required. To change the port number from the command line, use the
port option, for example, ldap [name] ssl enabled port 636.
• ssl-ca-cert-le
Species the name of an SSL CA certicate using the full path to the le. The default value is none.
• ssl-check-peer
Species whether the system checks an SSL peer. The default value is disabled.
• ssl-ciphers
Species SSL ciphers. The default value is none.
• ssl-client-cert
Species the name of an SSL client certicate. The default value is none.
• ssl-client-key
454
Auth
Species the name of an SSL client key. The default value is none.
• user-template
Species a user template for the LDAP application to use for authentication. The default value is none.
• version
Species the version number of the LDAP application. The default value is 3.
• warnings
Enables or disables warning messages. The default value is enabled.
See Also
auth user, create, delete, glob, list, modify, regex, run, show, tmsh
login-failures
Displays or resets the status of the accounts of users whose attempts to log in to the BIG-IP(r) system have
failed.
Syntax
Congure the login-failures component within the auth module using the following syntax.
Modify
reset-stats login-failures
username
Display
show login-failures
field-fmt
username
Description
Users assigned a role of Administrator can reset the status of a user who is locked out of the BIG-IP system
due to enforcement of a company's security requirements. Users assigned other roles can only view login
failures.
Examples
show login-failures
Displays the login failure status of all users.
show login-failures joe
Displays login failure status for the user joe.
reset-stats login-failures
Resets the failed login counters for all users to zero and unlocks all users.
455
Traffic Management Shell (tmsh) Reference Guide
reset-stats login-failures joe
Resets the failed login counter for the user joe to zero and unlocks the user joe.
Options
• show
For information about the options that you can use with the show command, see help show.
• username
Species a user account to display or reset.
See Also
auth user, reset-stats, show, tmsh
partition
Congures administrative partitions that implement access control for BIG-IP(r) system users.
Syntax
Congure the partition component within the auth module using the syntax shown in the following sections.
Create/Modify
create partition [name]
modify partition [name]
default-route-domain [ID]
description [string]
Display
list partition
list partition [ [ [name] | [glob] | [regex] ] ...]
show running-config partition
show running-config partition [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
Delete
delete partition [name]
all
Description
An administrative partition is a logical container that you create, containing a dened set of BIG-IP system
objects, such as virtual servers, pools, and proles. When a specic set of objects resides in a partition, you
456
Auth
can then give certain users the authority to view and manage the objects in that partition only, rather than
all objects on the BIG-IP system. This gives a ner degree of administrative control.
You can congure administrative partitions, only if the Administrator user role is assigned to your user
account.
Examples
create partition partition_A description "Repository for application_A objects"
Creates a partition named partition_A that contains objects related to application_A.
delete partition partition_B
Deletes the partition named partition_B.
Options
• description
Describes the contents of the partition. If you use spaces in the description, you must put quotation marks
around the descriptive text, for example, "This partition contains local trafc management objects for
managing HTTP trafc."
• default-route-domain
Species the ID of the route domain that is associated with the IP addresses that reside in the partition.
For more information, see help net route-domain.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
auth user, create, delete, glob, list, modify, net route-domain, regex, show, tmsh
password
Prompts for modication of a password, and asks for a conrmation of the new password.
Syntax
Congure the password component within the auth module using the syntax shown in the following
sections.
457
Traffic Management Shell (tmsh) Reference Guide
Usage
modify password
Description
If you are assigned the user role of Administrator or User Manager, you can change another user's
password.
For example, from within the auth module, run the following command sequence: modify password [user
name].
The system prompts you for a new password for the specied user, and then to conrm the new password.
If you are assigned any other user role, the system prompts you to change your own password, and then
conrm the new password.
To change a password from within another module, use the full path to the password.
Examples
(tmos.auth)# modify password
From within the auth module, displays the new password: prompt.
(tmos.gtm)# modify / auth password
From within the gtm module, displays the new password: prompt.
See Also
auth user, modify, tmsh
password-policy
Species the parameters of the valid passwords for the BIG-IP(r) system.
Syntax
Congure the password-policy component within the auth module using the syntax shown in the following
sections.
Modify
modify password-policy
expiration-warning [integer]
max-duration [integer]
max-login-failures [integer]
min-duration [integer]
minimum-length [integer]
password-memory [integer]
policy-enforcement [disabled | enabled]
required-lowercase [integer]
required-numeric [integer]
required-special [integer]
required-uppercase [integer]
458
Auth
Display
list password-policy
list password-policy
show running-config password-policy
show running-config password-policy
all-properties
non-default-properties
one-line
Description
Users assigned a role of Administrator or Resource Administrator can modify a password policy for the
BIG-IP system to enforce a company's security requirements by dening the parameters for valid passwords.
Users assigned other roles can view password policies.
Examples
password-policy max-duration 90 min-duration 30 minimum-length 6 required-lowercase 2
required-uppercase 2 required-special 1 required-numeric 1 expiration-warning 5
Creates a password policy that species that passwords are valid for a maximum of 90 days and a minimum
of 30 days. Also species that to be valid, a password must contain at least 6 characters, but not more than
10 characters, including 2 lowercase alpha characters, 2 uppercase alpha characters, and 1 number.
Additionally, this policy species that the system automatically warns users ve days before their passwords
expire.
list password-policy
Displays the password policy.
Options
• expiration-warning
Species the number of days before a password expires. Based on this value, the BIG-IP system
automatically warns users when their password is about to expire. The default value is 7 days.
• max-duration
Species the maximum number of days a password is valid. The default value is 99999.
• max-login-failures
Species the number of consecutive unsuccessful login attempts that the system allows before locking
out the user. The default value is 0 (zero - disabled).
• min-duration
Species the minimum number of days a password is valid. The default value is 0 (zero).
• minimum-length
Species the minimum number of characters in a valid password. The default value is 6.
• password-memory
Species whether the user has congured the BIG-IP system to remember a password on a specic
computer. The default value is 0 (zero).
• policy-enforcement
Enables or disables the password policy on the BIG-IP system. The default value is disabled.
• required-lowercase
459
Traffic Management Shell (tmsh) Reference Guide
Species the number of lowercase alpha characters that must be present in a password for the password
to be valid. The default value is 0 (zero).
• required-numeric
Species the number of numeric characters that must be present in a password for the password to be
valid. The default value is 0 (zero).
• required-special
Species the number of special characters that must be present in a password for the password to be
valid. The default value is 0 (zero).
• required-uppercase
Species the number of uppercase alpha characters that must be present in a password for the password
to be valid. The default value is 0 (zero).
See Also
auth user, modify, tmsh
radius
Congures a RADIUS conguration object for implementing remote RADIUS-based authentication of
BIG-IP(r) system users.
Syntax
Congure the radius component within the auth module using the syntax shown in the following sections.
Create/Modify
create radius [name]
modify radius [name]
accounting-bug [disabled | enabled]
app-service [[string] | none]
client-id [none | [string] ]
debug [disabled | enabled]
description [string]
retries [integer]
servers [add | delete | replace-all-with]
{ [ [hostname] | [ip address] ... ] }
servers [default | none]
service-type [default | login | framed | callback-login |
callback-framed | outbound | administrative |
nas-prompt | authenticate-only |
callback-nas-promit | call-check |
callback-administrative]
edit radius [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
460
Auth
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ...]
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
partition
Delete
delete radius [name]
Description
To authenticate BIG-IP system users when their authentication data is stored on a remote RADIUS server,
you congure a RADIUS server, congure a RADIUS conguration object that references that RADIUS
server, and then activate RADIUS authentication for the BIG-IP system. In this case, client credentials are
based on basic HTTP authentication (that is, user name and password).
To congure RADIUS authentication for the BIG-IP system:
1. Use the radius-server component in the auth module to congure a RADIUS server. For more information
about creating a RADIUS server, see help radius-server.
2. Use the radius component in the auth module to create a RADIUS conguration object that references
the RADIUS server you created in Step 1.
3. To activate RADIUS authentication for BIG-IP system users, type the following command sequence:
modify / auth source type radius
Examples
create radius bigip_radius_auth servers add {myradiusserver}
Creates a RADIUS conguration object named bigip_radius_auth.
delete radius bigip_radius_auth
Deletes the RADIUS conguration component named bigip_radius_auth.
Options
• accounting-bug
Enables or disables validation of the accounting response vector. This option is necessary only on older
servers. The default value is disabled.
• app-service
Species the name of the application service to which the RADIUS conguration object belongs. The
default value is none. Note: If the strict-updates option is enabled on the application service that owns
the object, you cannot modify or delete the RADIUS conguration object. Only the application service
can modify or delete the RADIUS conguration object.
• client-id
461
Traffic Management Shell (tmsh) Reference Guide
Sends a NAS-Identier RADIUS attribute with string bar. If you do not specify a value for this option,
the system uses the pluggable authentication module (PAM) service type. You can disable this feature
by specifying a blank client ID.
• debug
Enables or disables syslog-ng debugging information at the LOG DEBUG level. F5 Networks does not
recommend this option for normal use. The default value is disabled.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• retries
Species the number of authentication retries that the BIG-IP local trafc management system allows
before authentication fails. The default value is 3.
• service-type
Species the type of service used for the RADIUS server. The default is default, which behaves as
authenticate-only.
• servers
Species the host names or IP addresses of existing RADIUS servers that the BIG-IP system uses to
obtain authentication data.
See Also
auth radius-server, auth user, create, delete, glob, list, modify, regex, run, show, tmsh
radius-server
Congures a RADIUS server for implementing remote RADIUS-based authentication of BIG-IP(r) system
users.
Syntax
Congure the radius-server component within the auth module using the syntax shown in the following
sections.
462
Auth
Create/Modify
create radius-server [name]
modify radius-server [name]
app-service [[string] | none]
description [string]
port [ [name] | [number] ]
secret [none | ["string"] ]
server [ [hostname] | [IP address] | none]
timeout [integer]
edit radius-server [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list radius-server
list radius-server [ [ [name] | [glob] | [regex] ] ...]
show running-config radius-server
show running-config radius-server [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
partition
Delete
delete radius-server [name]
Description
To authenticate BIG-IP system users when their authentication data is stored on a remote RADIUS server,
you congure a RADIUS server, congure a RADIUS conguration object that references that RADIUS
server, and then activate RADIUS authentication for the BIG-IP system. In this case, client credentials are
based on basic HTTP authentication (that is, user name and password).
To congure RADIUS authentication for the BIG-IP system:
1. Use the radius-server component in the auth module to congure a RADIUS server.
2. Use the radius component in the auth module to create a RADIUS conguration object that references
the RADIUS server you created in the Step 1. For more information about creating a RADIUS conguration
object, see help radius.
3. To activate RADIUS authentication for BIG-IP system users, type the following command sequence:
modify / auth source type radius
Examples
create radius-server bigip_auth_radius_server secret "This is the secret." server 10.1.1.1
Creates a RADIUS server component named bigip_auth_radius_server.
delete radius-server bigip_auth_radius_server
Deletes the RADIUS server component named bigip_auth_radius_server.
463
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the RADIUS server belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the RADIUS server. Only the application service can modify or delete the
RADIUS server.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the partition in which the radius server resides.
• port
Species the port for RADIUS authentication trafc. The default value is 1812.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the secret key the system uses to encrypt and decrypt packets sent from or received by the
server. This option is required.
• server
Species the host name or IP address of the RADIUS server. This option is required.
• timeout
Species the timeout value in seconds. The default value is 3.
See Also
auth radius, auth user, create, delete, glob, list, modify, regex, run, show, tmsh
remote-role
Creates remote role information in a le that an LDAP, Active Directory(r), RADIUS, or TACACS+ server
reads to determine the specic access rights to grant to groups of remotely-authenticated users.
Syntax
Congure the remote-role component within the auth module using the syntax shown in the following
sections.
464
Auth
Modify
modify remote-role
description [string]
role-info [add | delete | modify | replace-all-with] {
[group-name] {
attribute [string]
console [disabled | tmsh]
description [string]
deny [enabled | disabled]
line-order [integer]
role [acceleration-policy-editor | admin | fraud-protection-manager |
application-editor | auditor | certificate-manager |
firewall-manager | guest | irule-manager | manager |
no-access | operator | resource-admin | user-manager |
web-application-security-administrator |
web-application-security-editor]
user-partition [all | Common | [name] ]
user-partition [%string]
}
}
role-info none
Display
list remote-role
show running-config remote-role
all-properties
non-default-properties
one-line
Delete
You cannot delete the remote-role defaults, you can only modify the values of the options.
Description
You can use the remote-role component to grant access to a specic group of remotely-authenticated users
without creating a local user account on the BIG-IP(r) system for each user in the group.
Users assigned the role of Administrator or Resource Administrator can modify remote roles. Users
assigned all other roles can view remote roles.
You can use the variable substitution feature to assign access rights for a group of remote users by specifying
a text string variable that is preceded by a leading % character for the options attribute, console, role and
user-partition. For example, if you dene the remote role for the groups DC1 and DC2 as follows:
remote-role {
role info {
dc1 {
attribute "F5-LTM-User-Info-1=DC1"
console %F5-LTM-User-Console
line-order 1
role %F5-LTM-User-Role
user-partition %F5-LTM-User-Partition
}
dc2 {
attribute "F5-LTM-User-Info-1=DC2"
line-order 2
}
465
Traffic Management Shell (tmsh) Reference Guide
}
}
The BIG-IP(r) system attempts to match the value of the attribute option, F5-LTM-User-Info-1=DC1,
and then pulls the value of the console, role and user-partition options from the other variables.
Note: If a variable includes an incorrect value, the system does not authorize the user. Additionally, if you
have not dened the variables, as with the group DC2 above, the system authenticates the user with the
following access rights:
• console = disabled
• role = none
• user-partition = none
Examples
modify remote-role role-info add { my_managers { attribute
"memberOF=cn=BigIPmanagerGroup,cn=users,dc=mydept,dc=mycompany,dc=com" console disabled
line-order 1000 role 100 user-partition all } }
Congures a remote role, named my_managers, for LDAP authentication, by creating the 1000th line of
the /cong/bigip/auth/remoterole le, and granting the Manager role (100) in all partitions to the remote
users assigned this role.
modify remote-role role-info add { my_admins { attribute "NS-Admin-Privilege" console tmsh
line-order 1000 role 0 user-partition all } }
Congures a remote role, named my_admins, for LDAP authentication, by creating the 2000th line of the
/cong/bigip/auth/remoterole le, and granting the Administrator role (0) in all partitions to the remote
users assigned this role.
modify remote-role role-info add { my_managers { attribute "manager_group=manager" console
tmsh line-order 3000 user-partition all } }
Congures a remote role, named my_managers, for RADIUS or TACACS+ authentication, by creating
the 3000th line of the /cong/bigip/auth/remoterole le, and granting the Administrator role (0) in all
partitions to the remote users assigned this role:
Options
• description
Species a user-dened description.
• role-info
Congures the access rights for a specic group of remotely-authenticated users. You can congure the
following information for a role:
• attribute
Species an attribute-value pair that an authentication server supplies to the BIG-IP system to match
against entries in /cong/bigip/auth/remoterole. The specied pair typically identies users with
access rights in common. This option is required.
Alternatively, you can use the variable substitution feature (described in the Description section
above), and specify a text string variable that is preceded by a leading % character.
• console
Enables or disables console access for the specied group of remotely-authenticated users. The
default value is disabled.
466
Auth
When using variable substitution, as described in the Description section of this man page, the
variable for the role option must be: tmsh. If it does not the console option is disabled.
• deny
Enables or disables remote access for the specied group of remotely-authenticated users. The default
value is disabled.
• description
Species a user-dened description.
• group-name
Species the name of the remote role that you are conguring. This option is required.
• line-order
Species the number of the rst populated line in the le, /cong/bigip/auth/remoterole. The
LDAP, Active Directory, RADIUS, and TACACS+ servers read this le line by line. The order of
the information is important; therefore, F5 Networks recommends that you set the rst line at 1000.
This allows you, in the future, to insert lines before the rst line. This option is required.
• role
Species the role that you want to grant to the specied group of remotely-authenticated users. The
default value is no-access. The available roles are:
admin
fraud-protection-manager
application-editor
• user-partition
Species the user partition to which you are assigning access to the specied group of
remotely-authenticated users. The default value is Common. This option is required.
Alternatively, you can use the variable substitution feature (described in the Description section
above) and specify a text string variable that is preceded by a leading % character.
See Also
auth remote-user, auth user, list, modify, show, tmsh
remote-user
Congures the default role, partition access, and console access for all remotely authenticated user accounts
that have not been added as local user accounts on the BIG-IP(r) system.
Syntax
Congure the remote-user component within the auth module using the syntax shown in the following
sections.
Modify
modify remote-user
default-partition [all | Common | [partition name] ]
467
Traffic Management Shell (tmsh) Reference Guide
default-role [acceleration-policy-editor | admin |
fraud-protection-manager | application-editor |
auditor | firewall-manager | guest |
irule-manager | manager | no-access |
operator | resource-admin | user-manager |
web-application-security-administrator |
web-application-security-editor ]
description [string]
remote-console-access [disabled | tmsh]
Display
list remote-user
show running-config remote-user
all-properties
non-default-properties
one-line
Delete
You cannot delete the remote-user defaults, you can only modify the values of the options.
Description
You can use the remote-user component to congure the default parameters for all the remote user accounts
on the BIG-IP system as a group. To assign a different access level to a specic remote user, you must
create a local user account for that user on the BIG-IP system. See the auth user man page for more
information.
Users assigned the role of Administrator or Resource Administrator can modify the parameters of the
remote-user component. Users assigned all other roles can view the parameters of the remote-user
component.
Examples
modify remote-user default-partition Common default-role no access remote-console-access disabled
For all remote users, sets the default partition access to partition Common, the default role to no-access,
and the default remote console access to disabled.
modify remote-user default-partition all default-role no access remote-console-access disabled
For all remote users, sets the default partition access to all partitions, the default role to no-access, and the
default remote console access to disabled.
Options
• default-partition
Species the default partition for all remote user accounts. The default value is all.
• default-role
Species the default role for all remote user accounts. The default value is no-access.
• description
Species a user-dened description.
• remote-console-access
Species whether you are granting this user access to tmsh or disabling remote console access for this
user. The default value is disabled.
468
Auth
See Also
auth remote-role, auth user, list, modify, show, tmsh
source
Congures the authorization source type for a BIG-IP(r) system.
Syntax
Congure the source component within the auth module using the syntax in the following sections.
Modify
modify source
type [active-directory | ldap | local | radius | tacacs | cert-ldap |
apm-auth]
Display
list source
list source [option]
all-properties
non-default-properties
one-line
Description
You can use the source component to set up the authorization source type for the BIG-IP system.
Examples
modify auth source type tacacs
Sets up the authorization source type as tacacs.
list auth source type
Displays the authorization source type.
Options
• type
Species the default user authorization source. The default value is local. When user accounts that access
the system reside on a remote server, the value of the this option is the type of server that you are using
for authentication, for example, ldap.
See Also
list, modify, tmsh
469
Traffic Management Shell (tmsh) Reference Guide
tacacs
Congures a TACACS+ conguration object for implementing remote authentication of BIG-IP(r) system
users based on TACACS+.
Syntax
Congure the tacacs component within the auth module using the syntax shown in the following sections.
Create/Modify
create tacacs [name]
modify tacacs [name]
accounting [send-to-first-server | send-to-all-servers]
app-service [[string] | none]
authentication [use-first-server | use-all-servers]
debug [disabled | enabled]
description [string]
encryption [disabled | enabled]
protocol [none | [protocol] ]
secret [ "[string]" ]
servers
[add | delete | replace-all-with] {
[ [ [hostname[:port]] | [ip address[:port]] ] ... ]
}
service [ [name] | none]
edit tacacs [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list tacacs
list tacacs [ [ [name] | [glob] | [regex] ] ...]
show running-config tacacs
show running-config tacacs [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
one-line
partition
Delete
delete tacacs [name]
Description
To authenticate BIG-IP system users when their authentication data is stored on a remote TACACS+ server,
you create a TACACS+ conguration object, and then activate the object.
To congure TACACS+ authentication for BIG-IP system users:
470
Auth
1. Use the tacacs component in the auth module to congure a TACACS+ conguration object.
2. To activate TACACS+ authentication for BIG-IP system users, run the following command sequence:
modify / auth source type tacacs
Examples
create tacacs bigip_tacacs_auth servers add {my_tacacs_server}
Creates a TACACS+ conguration object named bigip_tacacs_auth.
delete tacacs bigip_tacacs_auth
Deletes the TACACS+ conguration object named bigip_tacacs_auth.
Options
• accounting
If multiple TACACS+ servers are dened and pluggable authentication module (PAM) session accounting
is enabled, sends accounting start and stop packets to the rst available server or to all servers. The
default value is send-to-rst-server.
Possible values are:
• send-to-all-servers
The system sends accounting start and stop packets to all servers.
• send-to-rst-server
The system sends accounting start and stop packets to the rst available server.
• app-service
Species the name of the application service to which the TACACS+ conguration object belongs. The
default value is none. Note: If the strict-updates option is enabled on the application service that owns
the object, you cannot modify or delete the TACACS+ conguration object. Only the application service
can modify or delete the TACACS+ conguration object.
• authentication
Species the process the system employs when sending authentication requests. The default value is
use-rst-server.
Possible values are:
• use-all-servers
The system sends an authentication request to each server until authentication succeeds, or until the
system has sent a request to all servers in the list.
• use-rst-server
The system sends authentication requests to only the rst server in the list.
• debug
Enables syslog-ng debugging information at the LOG DEBUG level. F5 Networks does not recommend
this option for normal use. The default value is disabled.
• description
User dened description.
• encryption
Enables or disables encryption of TACACS+ packets. F5 Networks recommends this option for normal
use. The default value is enabled.
471
Traffic Management Shell (tmsh) Reference Guide
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the component resides.
• protocol
Species the protocol associated with the value specied in the service option, which is a subset of the
associated service being used for client authorization or system accounting.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Sets the secret key used to encrypt and decrypt packets sent or received from the server. This option is
required.
• servers
Species the host name or IPv4 address of the TACACS+ server. For each server, a port may optionally
be specied in the format hostname: port or IPv4: port. If no port is specied, the default port 49 is
used. This option is required.
• service
Species the name of the service that the user is requesting to be authenticated to use. Identifying the
service enables the TACACS+ server to behave differently for different types of authentication requests.
This option is required.
See Also
auth user, create, delete, edit, glob, list, modify, regex, run, show, tmsh
user
Congures user accounts for the BIG-IP(r) system.
Syntax
Modify the user component within the auth module using the syntax shown in the following sections.
Create/Modify
create user [name]
modify user [name]
description [text...]
partition-access [add | modify | delete |replace-all-with { [partition-name]
{ role [role-name] } } ]
password [text]
472
Auth
prompt-for-password
shell [name]
where [role-name]: [acceleration-policy-editor | admin | fraud-protection-manager | application-editor |
auditor | certicate-manager | rewall-manager | guest | irule-manager | manager | no-access | operator |
resource-admin | user-manager | web-application-security-administrator | web-application-security-editor]
Display
list user
list user [ [ [name] | [glob] | [regex] ] ... ]
show running-config user
show running-config user [ [ [name] | [glob] | [regex] ] ... ]
encrypted-password
one-line
partition
show user
field-fmt
Delete
delete user [name]
Description
You can create user accounts where the user names differ only by case-sensitivity (for example, david and
DAVID).
You can congure the partition-access property to grant a user access to more than one partition on the
system. In the case where you do not grant the user access to all partitions, you can assign the user a different
user role for each partition. A user can have only one role per partition. Any user with a role of
Administrator, Resource Administrator, Web Application Security Administrator, or Auditor always
has access to all partitions and can have no other role on the system.
Only users with the Administrator or User Manager roles are allowed to create or modify user accounts.
Additionally, only users with the Administrator, Resource Administrator, or User Manager user role
can view all of the user accounts in all of the partitions to which the user has access. Therefore, if you have
a user role other than one of these roles, you can only view your own user account.
Examples
create user nwinters partition-access add { all-partitions { role guest } }
Creates a new user named nwinters with a role of Guest in all partitions.
create user tknox password aBcD007 partition-access add { partition1 { role operator } }
Creates a new user named tknox with a role of operator in partition named partition1 and sets the user's
login password.
list user
Displays the viewable properties of all user accounts.
show user
Displays each user role and the corresponding partition access that is currently assigned to the user.
473
Traffic Management Shell (tmsh) Reference Guide
Options
• description
Describes the user account in free form text.
• encrypted-password
Displays the encrypted password for the user account.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
Note: User account names are case-sensitive.
• partition
Displays the name of the administrative partition in which the user account resides.
• partition-access
Species the administrative partitions to which the user currently has access. Note that in addition to
these partitions, the user also has read access to the shared partitions Common and Root. An exception
to this is any user with the role No Access.
• role
Species the user role that pertains to the partition specied by the partition-access property. If you do
not want to assign a user role to the user account, specify the value no-access. This prevents the user
from accessing the system.
• password
Sets the user password during creation or modication of a user account without prompting or
conrmation. May not be used with prompt-for-password. Passwords are hidden in log and history les.
• prompt-for-password
Indicates that when the account is created or modied, the BIG-IP system prompts the administrator or
user manager for both a password and a password conrmation for the account.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• shell
Species the shell to which the user has access. Valid values are:
• bash
Provides an unrestricted system prompt. You can assign access to the bash shell only to users with
the Administrator or Resource Administrator role. However, F5 Networks recommends that you
do not give bash shell access to users with the Resource Administrator user role unless they use
the tcpdump, ssldump, or qkview utilities, or if they manage certicate and key les using the
console. Instead, F5 Networks recommends that you give these users tmsh access.
• none
Species no shell access. The user must use the Conguration utility.
• tmsh
474
Auth
CLI
admin-partitions
Set the administrative partition for a BIG-IP(r) conguration le.
Syntax
Congure the admin-partitions component within the cli module using the syntax in the following sections.
Modify
admin-partitions
update-partition [name]
Description
You can use the admin-partitions component to set the administrative partition in which conguration
will be loaded when a conguration le is being loaded.
This component is only available from a conguration le that is being loaded via the sys cong component
with the le option.
Examples
cli admin-partitions { update-partition partition_A }
Sets the administrative partition in which conguration will be loaded. Conguration that follows this
directive will be place in partition_A.
Options
• update-partition
Sets the administrative partition in which you can congure objects.
See Also
load, sys cong, tmsh
global-settings
Congures settings for tmsh
Syntax
Congure the global-settings component within the cli module using the syntax shown in the following
sections.
Modify
edit global-settings
all-properties
non-default-properties
modify global-settings
audit [disabled | enabled]
description [string]
idle-timeout [disabled | integer]
scf-backup-number [integer]
service [number | name]
Display
list global-settings
list global-settings [option]
all-properties
non-default-properties
one-line
Delete
You cannot delete the default global settings.
Description
You can use the global-settings component to congure multiple settings for tmsh.
Examples
modify global-settings audit enabled
Enables auditing for tmsh.
modify global-settings idle-timeout 15
Sets the user idle timeout from tmsh to 15 minutes.
Options
• audit
Species the global audit level for tmsh. The audited commands are stored in /var/log/audit. The default
value is enabled. The audit levels are:
• disabled
tmsh does not log commands that users enter.
• enabled
tmsh audits only commands that users enter. Note that the system does not audit the commands that
the command load runs.
• description
User dened description.
• idle-timeout
478
CLI
If not disabled, log a user in tmsh interactive mode out automatically after a specied set of minutes.
An administrator may change the timeout value at any time and the new policy will take place
immediately.
• scf-backup-number
Species the number of backup single conguration les that the system stores when you enter the
following command sequence in tmsh:
load sys cong le
When you run the command, the system saves the single conguration le. By default, the system saves
two backup single conguration les. For example, if you set the scf-backup-number option to 3, after
you run the command sequence tmsh load sys cong le for the third time, the system has three versions
of the single conguration le: /var/local/scf/backup.scf, /var/local/scf/backup-1.scf, and
/var/local/scf/backup-2.scf. The newest le is /var/local/scf/backup.scf.
• service
Species the format in which tmsh displays a service. The default value is name. The options are:
• name
Displays a service using a protocol name, for example, http.
• number
Displays a service using a numeric value, for example, 192.168.10.20:80, where 80 indicates http.
See Also
edit, list, modify, run, tmsh
history
Displays a list of commands in the order in which you ran the commands.
Syntax
Use the history component within the cli module to display a numbered list of commands in the order the
commands were issued.
Display
show history
!
!!
![string]
Description
You can use the history component to display a numbered list of the commands that you have run in tmsh.
The commands display in the order in which you ran the commands, and each command is identied by an
entry ID. The larger the entry ID of the command, the more recently you ran the command.
To rerun a command from the history list, type q to close the list and return to the tmsh prompt, and then
enter an exclamation point (!) followed by the entry ID of the command that you want to run.
479
Traffic Management Shell (tmsh) Reference Guide
Examples
!
show history
Either of the two previous commands, displays the command history list.
!5
Runs the fth command in the command history list.
!!
Runs the previously issued command.
!create
Runs the last command that begins with create.
See Also
show, tmsh
preference
Congures tmsh preferences.
Syntax
Congure the preference component within the cli module using the syntax shown in the following sections.
Modify
edit preference
modify preference [option]
alias-path [string list]
app-service [[string] | none]
confirm-edit [disabled | enabled]
display-threshold [integer]
editor [nano | vi]
history-date-time [disabled | enabled]
history-file-size [integer]
history-size [integer]
keymap [default | emacs | vi]
list-all-properties [disabled | enabled]
pager [disabled | enabled]
prompt { [avc-count config-sync-status current-folder
fully-qualified-host host mcp-load-status
mcp-state multi-line status user user-role] | none }
show-aliases [disabled | enabled]
stat-units [default | exa | gig | kil | meg | peta | raw |
tera | yotta | zetta]
suppress-warnings [ all | config-version | none ]
table-indent-width [integer]
tcl-syntax-highlighting [disabled | enabled]
480
CLI
video [disabled | enabled]
warn [bell | disabled | visual-bell]
edit preference
all-properties
Display
list preference
list preference [option]
show running-config preference
show running-config preference [option]
all-properties
one-line
Description
You can use the preference component to congure tmsh to meet your specic needs.
Examples
modify preference display-threshold 500
Congures tmsh to retrieve up to 500 objects before requiring a user response to the question, "Display
all items? (y/n)."
modify preference history-le-size 80
Congures the maximum number of commands that a user can view in the command history list to be 80.
modify preference history-size 1000
Congures the maximum number of commands that tmsh saves in a user's .tmsh_history le to be 1000
commands.
modify preference suppress-warnings cong-version
Congures tmsh to suppress warning messages for conguration version related (for backward compatibility
of conguration).
Options
• alias-path
Species the search paths for shared aliases. The shared aliases could be in multiple locations, only ones
on the search paths can be used. If a folder is deleted from the system it will be automatically remove
from the alias-path.
• app-service
Species the name of the application service to which the preference belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the preference. Only the application service can modify or delete the preference.
• conrm-edit
Species whether the command edit prompts for conrmation before saving changes. The default value
is enabled.
481
Traffic Management Shell (tmsh) Reference Guide
Note that the value of this option does not affect the behavior of the editor if the changes made in the
editor result in a failed update. In this case, tmsh always prompts the user to either re-edit the le or
discard the changes. The options are:
• enabled
tmsh prompts a user to either submit (y), discard (n), or edit (e) the changes made to a component
within the editor.
• disabled
tmsh does not prompt the user, but instead, immediately submits the changes made in the editor.
• display-threshold
Species the maximum number of objects that tmsh displays without requiring a user response to the
question, "Display all [number] items? (y/n)." You can specify from 0 (zero) through 4,294,967,265
objects. If you set this option to 0 (zero), tmsh displays an unlimited number of objects without requesting
a response.
• editor
Species the editor that the command edit invokes. Users assigned the user role of Administrator can
select nano or vi. Users assigned other user roles must use nano.
• history-date-time
Species whether tmsh displays in the command history the date and time that each command was
issued. The default value is disabled.
Note that the command history le, ~/.tmsh-history-[user], always contains the date and time that a
command was issued.
• history-le-size
Species the maximum number of tmsh commands that the system saves in each user's .tmsh_history
le. If you set this option to 0 (zero), the system does not save tmsh commands in the le. The maximum
value is 100,000. For performance reasons, the system does not truncate the le after a user enters a
command. Instead, the system truncates the le after a user exits tmsh.
• history-size
Species the number of commands that a user can view or search in the command history list. The
maximum number of commands is 100,000. The default value is 500.
If you set this option to 0 (zero), the system does not add commands to the list of commands in memory;
however, the system does write commands to the .tmsh_history le, unless the history-le-size option
is set to 0 (zero).
When you change the value of this option, the system renumbers the commands listed in memory;
however, the commands remain in the same order.
• keymap
Species the keyboard bindings that you want tmsh to use. The default value is default. The options
are default, emacs, and vi.
• list-all-properties
Species whether the system displays all of the properties of a component by default when you run the
command list. The default value is disabled.
• pager
Species whether the system sends the output of the tmsh commands list and show to less. The default
value is enabled.
• prompt
482
CLI
Species the information that you want to display in the tmsh prompt. By default the prompt displays
user_name@host_name(tmos-current_module)#. The options are:
• avc-count
Displays the current SELinux Access Vector Cache in the tmsh prompt. The value displayed in the
prompt indicates the number of times SELinux has denied access to a protected resource. The default
is to not display this information.
• cong-sync-status
Displays global sync status in the tmsh prompt. The status displayed in the prompt indicates the
rolled-up sync status of all the device groups where the local device resides. The default is to display
this information.
• current-folder
Displays the current working folder in the tmsh prompt. The default is to not display this information.
• fully-qualied-host
Displays the fully qualied host name in the tmsh prompt. The default is to not display this
information.
• host
Displays the host name in the tmsh prompt. The default is to display the host name in the prompt.
• mcp-load-status
Displays the conguration le load status in the tmsh prompt. This information is also available in
the Last Conguration Load Status of the show sys mcp command output. The default is to not
display this information.
• mcp-state
Displays the running phase of the mcpd service in the tmsh prompt. This information is also available
in the Running Phase of the show sys mcp command output. The default is to not display this
information.
• multi-line
Displays the tmsh prompt on multiple lines, with information on the rst line, and a pound sign (#)
on the second line, for example:
(Common:all) operator1@6400(tmos.cli)
#
The multi-line option is disabled by default.
• none
Sets the tmsh prompt to display (tmos.current_module)#, where the system replaces current_module
with the name of the module within which you are working.
• status
Displays the system status in the tmsh prompt. The default is to display system status in the prompt.
• user
Displays the user name in the tmsh prompt. The default value is to display the user name in the
prompt.
• user-role
Display the user's current role in the tmsh prompt. By default the user role is not displayed in the
prompt.
• show-aliases
483
Traffic Management Shell (tmsh) Reference Guide
Species whether the system displays aliases in the results of the command completion and
context-sensitive help features. The default value is enabled.
• suppress-warnings
Species the type of warning messages which needs to be suppressed. The default value is none.
• stat-units
Species the default unit in which the system displays statistics. The options are:
• default
Displays data in the simplest units. For example, if the value of the data is 1,200,001, the system
displays 1.20M; however, if the value of the data is 1,200, the system displays 1.2K.
• exa
Display data in parts per quintillion.
• gig
Displays data in parts per billion.
• kil
Displays data in parts per thousand.
• meg
Displays data in parts per million.
• peta
Displays data in parts per quadrillion.
• raw
Displays raw data.
• tera
Displays data in parts per trillion.
• yotta
Displays data in parts per septillion.
• zetta
Displays data in parts per sextillion.
• table-indent-width
Species the indent width when tmsh displays the child object tables in a show command. You can
specify from 0 (zero) through 10. If you set this option to 0 (zero), tmsh displays child object tables
without any indent.
• tcl-syntax-highlighting
Species whether Tcl syntax highlighting will be enabled in the editor. This setting only applies if your
editor preference is set to vi. The default value is disabled.
• video
Enables or disables any video features used to highlight text. The default value is enabled.
• warn
Species how the system warns you when you make an incorrect keystroke. The default value is bell.
The options are:
• bell
484
CLI
Sounds a bell.
• disabled
Disables the warning function.
• visual-bell
Displays a visual warning.
See Also
edit, list, modify, show, sys mcp-state, tmsh
script
Automates tmsh using Tool Command Language (Tcl).
Syntax
Congure the script component within the cli module using the syntax shown in the following sections.
Edit
create script [name]
modify script [name]
app-service [[string] | none]
description [string]
ignore-verification [true | false]
script-checksum [[string] | none]
script-signature [[string] | none]
edit script [ [ [name] | [glob] | [regex] ] ... ]
all-properties
Display
list script
list script [ [ [name] | [glob] | [regex] ] ... ]
show running-config script
show running-config script [ [ [name] | [glob] | [regex] ] ... ]
all-properties
Delete
delete script [name]
Generate
485
Traffic Management Shell (tmsh) Reference Guide
Note: generate cryptographic signature or checksum based on cli script text.
generate cli script [name]
checksum
signature
Run
run script [name] [options ...]
file [file name] [options ...]
verbatim-arguments [file option] [file name] [options ...]
The options that are available depend on which script you are running.
The le option is limited to users with the role of administrator.
Description
You can use the script component to build Tcl scripts to automate management of the BIG-IP(r) system.
By combining command aliases with scripts, you can extend tmsh to build commands that are customized
to your environment.
To do this, place the content of the script inside one or more Tcl procedures. The content of a script cannot
exceed 65,000 bytes. However, a script can include other scripts. For more information about including
scripts in other scripts, see tmsh::include following.
Starting with BIGIP 11.5.0, tmsh commands are versioned. the tmsh active version should be specied in
scripts. This will avoid breaking scripts due to changes in tmsh syntax in the different versions. See examples
below for how to use it in a script. Without tmsh active version specied, scripts will run on the current
active version. By default, the active version will be the latest cli version.
You can use the following procedures in the manner specied:
• script::run
tmsh invokes the procedure script::run when you issue the command sequence run / cli script [name].
A script is run relative to the module in which the run command is invoked.
The script::run procedure must be dened in the script named by the run command. Scripts that are
included by tmsh::include are not required to implement the procedure script::run.
• script::help
Provides context sensitive help. A script is not required to implement script::help.
• script::tabc
Provides context sensitive help. A script is not required to implement script::tabc.
• script::init
tmsh calls the procedure script::init before calling one of the following procedures: script::run,
script::help, or script::tabc. The script::init procedure can use the Tcl variable tmsh::csh to determine
which one of these three procedures tmsh invokes after tmsh:init.
Additionally, you can use the procedure script::init to initialize global variables. A script is not required
to implement script::init.
Examples
edit script myscript
486
CLI
Creates or modies the script myscript.
edit script myscript yourscript
Creates or modies the scripts myscript and yourscript at the same time.
list script myscript
Displays the contents of the script myscript.
delete script [name]
Deletes the script myscript from the system.
run script myscript [arguments ...]
Runs the script myscript. The system passes arguments to the script in the following Tcl variables:
• tmsh::argc contains the number of arguments including the name of the script.
• tmsh::argv contains the list of argument values. The rst item in tmsh::argv is always the name of the
script.
Tip: You can create an alias for the command sequence run / cli script [name] using the cli alias component.
For more information, see help cli alias.
run script verbatim-arguments myscript [arguments ...]
Runs the same commands as run script myscript [arguments...] above, except the system passes all
arguments specied in the command as one argument to the script. Note that you do not need to enclose
the argument list in double quotes, and you do not need to escape special characters.
generate my_script checksum
Generate a checksum for the script text and add the checksum as a property.
generate my_script signature signing-key my_key
Generate a signature for the script text using the specied private key and add the signature as a property.
Note: For a script which includes a checksum or signature to successfully load, the script text contents must
match the stored checksum or signature. To temporarily stop the verication of signature or checksum and
still retain the checksum or signature, the ignore-verication attribute must be set to true. This is done by
editing the script and adding the ignore-verication attribute.
To completely clear the signature or checksum, simply set the attribute script-signature or script-checksum
to empty string "". By doing so, the script will be processed as if it was never signed or checksumed.
modify script /Common/my_script { proc script::init {} { }
proc script::run {} { }
proc script::help {} { }
proc script::tabc {} { } ignore-verication true script-checksum 74778e7b13016e0b9329a17f8d2da601
total-signing-status checksum verication-status checksum-veried }
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• checksum
Generate a checksum for the script text and add the checksum to the script as a property. Only for use
with the generate command.
487
Traffic Management Shell (tmsh) Reference Guide
• description
A user dened description.
• le
Species that the script to be run should come from a le located on the le system rather than a script
from the conguration.
• glob
Displays the scripts that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the script. This option is required for the edit and delete commands.
• regex
Displays the scripts that match the regular expression. The regular expression must be preceded by an
at sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for
a description of regular expression syntax.
• signature
Generate a signature for the script text using the specied private key and add the signature to the script
as a property. Only for use with the generate command.
• signing-key
The private key to use for signing the script. Only for use with the signature option.
• verbatim-arguments
Species that the arguments at the end of the command should not be tokenized by tmsh prior to being
sent to the script. This is useful when the script is wrapping another utility that takes arguments.
Configuration And Status Accessors
The following Tcl commands mirror tmsh commands. For example, the Tcl tmsh::create command accepts
the same components, object identiers, and properties that the tmsh create command accepts.
• tmsh::cd [args...]
Runs the cd command using the specied arguments.
• tmsh::cp [args...]
Runs the cp command using the specied arguments.
• tmsh::create [args...]
Runs the create command using the specied arguments.
• tmsh::delete [args...]
Runs the delete command using the specied arguments.
• tmsh::install [args...]
Runs the install command using the specied arguments.
• tmsh::generate [args...]
Runs the generate command using the specied arguments.
• tmsh::list [args...]
Runs the list command using the specied arguments. The system returns the results as a string.
• tmsh::load [args...]
488
CLI
Runs the load command using the specied arguments.
• tmsh::modify [args...]
Runs the modify command using the specied arguments.
• tmsh::publish [args...]
Runs the publish command using the specied arguments.
• tmsh::pwd
Runs the pwd command.
• tmsh::reset-stats [args...]
Runs the reset-stats command using the specied arguments.
• tmsh::restart [args...]
Runs the command restart using the specied arguments.
• tmsh::run [args...]
Runs the run command using the specied arguments.
• tmsh::save [args...]
Runs the save command using the specied arguments.
• tmsh::show [args...]
Runs the show command using the specied arguments. The system returns the results as a string.
• tmsh::start [args...]
Runs the command start using the specied arguments.
• tmsh::stop [args...]
Runs the command stop using the specied arguments.
The following Tcl commands provide structured access for retrieving conguration, statistics, and status
information.
• tmsh::get_cong [args...]
Returns a list of Tcl objects. Each of these objects can be passed to the commands that accept an $obj
argument. The arguments for this command are the same as for the tmsh list command.
• tmsh::get_status [component] [args...]
Returns a list of Tcl objects that can be passed to the following commands that accept an $obj argument.
The arguments to this command are the same as the tmsh show command.
This command can only be used on components that accept the eld-fmt option. The eld-fmt option
is automatically appended to the argument list. The tmsh help pages identify if a component supports
the eld-fmt option.
That there are very few components that have status and statistics that do not support the eld-fmt
option, and in those cases you can use the Tcl tmsh::show command to retrieve the object in the form
of a Tcl string object.
A component must be specied, for example, tmsh::get_status ltm pool.
• tmsh::get_type $obj
Returns the type identier associated with the object. The $obj argument must be an object that was
returned by either of the Tcl tmsh::get_cong or tmsh::get_status commands.
• tmsh::get_name $obj
489
Traffic Management Shell (tmsh) Reference Guide
Returns the object identier associated with the object. The $obj argument must be an object that was
returned by either of the Tcl commands tmsh::get_cong or tmsh::get_status.
• tmsh::get_eld_names [value | nested] $obj
Returns a list of eld names (not the value associated with a eld) that are present in an object. The
value elds are simple values or lists (for example, an integer or a string). The nested elds are a
collection of zero or more nested objects, where the nested objects have their own elds (for example,
pool members, and virtual server proles).
The $obj argument must be an object that was returned by the Tcl tmsh::get_cong or tmsh::get_status
commands. If the object was retrieved using the Tcl tmsh::get_cong command, the eld names are
identical to those that are displayed by the tmsh list command. If the object was retrieved using the Tcl
tmsh::get_status command, the elds are identical to those that the system displays using the tmsh
show command with the eld-fmt option.
• tmsh::get_eld_value $obj [eld name] [Tcl variable]
Retrieves the value of eld name.
The Tcl variable is optional. The behavior of this command depends on whether eld name is present
in $obj and a Tcl variable is present in the command.
• If eld name is present in $obj, and a Tcl variable is present, the Tcl variable is set to the value
of eld name and the command returns 1.
• If eld name is not present in $obj, and a Tcl variable is present, the command returns 0 (zero).
• If eld name is present in $obj, and a Tcl variable is not present, the command returns the eld
value.
• If eld name is not present in $obj, and a Tcl variable is not present, the command raises an error
that causes the script to stop. You can use the Tcl command catch to recognize the error and continue
to run the script.
The $obj argument must be an object that was returned by the Tcl tmsh::get_cong or tmsh::get_status
commands, or a nested object obtained from the Tcl tmsh::get_eld_value command.
Transaction Control
The following Tcl commands are specic to the tmsh Tcl API. There are no corresponding commands
available in tmsh.
• tmsh::begin_transaction
Begins an update transaction. The Tcl tmsh::create, tmsh::delete, and tmsh::modify commands that
are issued before the next Tcl tmsh::commit_transaction command are submitted as a single update.
The system rolls back all of the commands if any of the commands fail.
• tmsh::commit_transaction
Runs the commands that have been issued since the last Tcl tmsh::begin_transaction command. The
system validates all of the commands against the running conguration. If any one of the commands
fail, the system does not apply any of the commands to the running conguration.
• tmsh::cancel_transaction
Cancels all commands that you have issued since the last Tcl tmsh::begin_transaction command.
Important: You cannot use these Tcl commands inside an active transaction:
• tmsh::list
• tmsh::show
• tmsh::get_cong
490
CLI
• tmsh::get_status
Logging
You can use the following Tcl commands to generate log events. These commands affect the behavior of
the script and do not affect tmsh. These commands are available only to users who have been assigned
either the Administrator or Resource Administrator role.
• tmsh::log_dest [screen | le]
Species whether the system sends events to the screen or to log les. If le is selected, log messages
will be directed to /var/log/ltm.
• tmsh::log_level [level]
Species the default severity level. The system does not log events below the specied level. The options,
listed in decreasing order of severity, are:
• emerg
• alert
• crit
• err
• warning
• notice
• info
• debug
• tmsh::log [level] "message..."
Logs the specied message. The level parameter is optional. The level can be one of those described in
the Tcl tmsh::log_level command.
Custom Istats
Custom counter, gauge, and string elds may be created, modied, and retrieved using iRules or tmsh
scripts. These custom elds are created on rst write and do not need to be declared separately.
Each custom eld has a "key" that can be associated with a tmsh conguration object. This key is composed
of a tmsh component dotted path, a specic object name or ID, the eld type, and the eld name. The entire
key must be enclosed in quotes.
For example, "ltm.pool /Common/my_pool counter num_hits" refers to the num_hits counter associated
with the LTM pool named my_pool, located in the Common folder.
These custom elds are displayed with the tmsh show command on the associated object.
• istats::incr [key] [amount]
Increments a custom counter by amount.
• istats::set [key] [value]
Sets a custom gauge or string to value. Setting a counter to an exact value will only set it in the local
segment, but istats::get will always read the aggregated (not local) value.
• istats::get [key]
Returns the latest aggregated value of the custom eld or 0 (zero) if it does not exist ("" for string elds).
• istats::remove [key]
Removes the custom eld from all segments on all blades. Effectively resets a counter to 0.
491
Traffic Management Shell (tmsh) Reference Guide
Utilities
The following commands are TCL utility commands.
• tmsh::clear_screen
Clears the screen and places the cursor at the upper left of the screen.
• tmsh::display [variable | command output]
Provides access to the tmsh pager. Output generated with the Tcl puts command is not paged.
• tmsh::display_threshold [integer]
When a script is run, the system disables the option cli preference display-threshold.
You can use the Tcl tmsh::display_threshold command to re-enable the threshold. Re-enabling the
threshold in this way causes the script to generate a prompt if you issue the tmsh::list, tmsh::show,
tmsh::get_cong, or tmsh::get_status commands, and the output that is generated exceeds the threshold.
See help cli preference for a description of this option and valid ranges for its value.
• tmsh::expand_macro [macro_text] options...
Expands a macro and returns the resulting string. A macro is a string containing macro syntax which
can be used for parameter substitution, script and iRule templatization, etc. The Macro Syntax includes
the following delimiters:
<% The beginning of an expansion code block.
<%= The beginning of an expansion code block. Spool the output after evaluating.
<%D[0-9][0-9] The beginning of a debug/logging code block with the debug threshold set to 0 thru 99.
<%D[0-9][0-9]= The beginning of a debug/logging code block with the debug threshold set to 0 thru
99. Spool the output after evaluating.
% > The end of the current block (works for all types).
Typically, the result of the expand_macro command is used as the input to another command (eg. ltm
rule create). The command can be called multiple times within an iApp implementation to expand
multiple macros.
macro_text is the blob of text to expand. If not specied, the command will expand the Macro section
of the iApp. If no macro_text argument is specied and no Macro section exists for the iApp, an error
will be issued.
-vars name_value_pair_list
Species a list of additional variables (name/value pairs) which can be referenced within the macro and
expanded by the command. All APL variables are automatically available from within the macro, so
the -vars option allows a way to specify additional variables from the iApp Implementation section.
Since the variables are dened within a Tcl list the format is: { name1 value1 name2 ... nameN valueN
}
-debug debug_levels
Species a single debug level or list of debug levels for controlling which debug messages get rendered
in the expanded output.
-debuginclusive debug_level
Species a debug level for controlling which debug messages get rendered in the expanded output. Since
it's "inclusive" all messages with a level at the specied level and below will get rendered in the expanded
output.
The following example expands the macro dened in the Macro section of the iApp, and sets the debug
level to render all debug messages with a level of 11, 33 or 66:
tmsh::expand_macro -debug {11 33 66}
492
CLI
The following example expands the macro dened via a Tcl variable (mac), adds two variables (foo and
enable_mything), and sets the debug level to render all messages of level 66 and below:
tmsh::expand_macro $mac -vars {foo bar enable_mything true} -debuginclusive 66
• tmsh::get_ile_text [iFile name]
Retrieve the text contained in the specied text iFile. When used on an iFile containing characters which
are non-ascii or are not printable/space, an error will be returned.
• tmsh::include [script name]
Runs the Tcl eval command on the specied script. The system evaluates the script at a global level,
and all procedures in the included script are available to any other procedure. You must have previously
created the script that is being included using the tmsh edit / cli script [name] command. If a full path
is not given for the script name, tmsh will attempt to rst locate the script from the same folder as the
including script, then the root partition folder of the including script, and nally the /Common folder.
• tmsh::run_proc [script_name:proc_name] options...]
Runs the Tcl eval command on the specied script and process. The script script_name is loaded as if
tmsh::include was called. After the script is loaded, the Tcl eval command is run on the specied Tcl
process. Any options that were specied are passed to the Tcl process. This is essentially a short form
of running tmsh::include script_name, followed by running one of the Tcl processes contained in the
script that was included.
The following example invokes the display_pool_status proc that is contained in the pool_utils script:
tmsh::run_proc pool_utils:display_pool_status
• tmsh::stateless [disabled | enabled]
Modies the behavior of tmsh::create and tmsh::delete.
When stateless mode is disabled, an attempt to create an object that already exists in the conguration
results in an error, and an attempt to delete an object that does not exist in the conguration is an error.
When stateless mode is enabled, an attempt to create an object that already exists in the conguration
does not result in an error, and an attempt to delete an object that does not exist in the conguration
does not result in an error.
Enabling stateless mode enables scripts to successfully run multiple times with the same input.
The default value is disabled.
• tmsh::version
Returns the version number of the BIG-IP system as a Tcl string. The version consists of three digits: a
major, minor, and maintenance version, separated by periods. For example, 10.1.0 indicates minor
version 1 of major version 10.
Context Sensitive Help
Use the following commands to create a script that provides context sensitive help when a user types Tab
or question mark (?).
• script::help
Scripts can provide the script::help procedure. tmsh invokes the procedure when a user types a question
mark (?) while entering the command sequence run / cli script [name]. If the specied script includes
the script::init procedure, tmsh invokes it before the script::help procedure. The script can add context
sensitive help by calling the tmsh::add_help and tmsh::builtin_help procedures. tmsh formats the
help and displays it.
• script::tabc
493
Traffic Management Shell (tmsh) Reference Guide
Scripts can provide the script::tabc procedure. The system invokes this procedure when the user types
Tab while entering the command sequence run / cli script. If the script::init procedure is included in
the script, that procedure is invoked before the script::tabc procedure. The script can add tab completion
datasets to the script by calling the tmsh::add_tabc and tmsh::builtin_tabc procedures. tmsh either
formats and displays the tab completion datasets, or if possible, completes the current argument.
• tmsh::csh
tmsh::csh is a Tcl string variable that can be used in the script::init procedure to determine the context
in which the script::init procedure was invoked.
tmsh::csh is set to one of the following:
• question mark (?)
Indicates that the user typed a question mark (?).
• TABC
Indicates the user pressed the Tab key.
• an empty string ""
Indicates the script is being run.
• tmsh::add_help [ [category item description] | [description] ]
Displays context sensitive help when the user types a question mark (?). If you supply one argument,
that argument displays as-is with no formatting applied to the description.
If you supply three arguments, one or more datasets are constructed. The rst argument is the name of
the dataset. The second argument is an item in the dataset. The third argument is a description of the
item. This command has an effect only if the Tcl tmsh::csh variable is set to question mark (?).
• tmsh::builtin_help ["tmsh command" args...]
Presents the same results as typing a question mark (?) while entering a tmsh command. The system
stores a set of possible completions and displays the possibilities when the script::help procedure returns.
This command has an effect only if the Tcl tmsh::csh variable is set to question mark (?).
• tmsh::add_tabc [ [category item] | [item] ]
Adds tab completion datasets. If you supply one argument, the system adds that argument to an anonymous
dataset. If you supply two arguments, the system constructs one or more datasets. The rst argument is
the name of the dataset. The second argument is an item in the dataset. Potential completions are displayed
in groups based on category. This command has an effect only if the Tcl $tmsh::csh variable is set to
TABC.
• tmsh::builtin_tabc ["tmsh command" args...]
Many of the tmsh commands that are available for scripting are also available in the interactive shell.
A script can use the tmsh::builtin_tabc command to present the same tab completion results as a built-in
command. The command does not return a value. The set of possible completions are stored internally
and displayed when the script::tabc procedure returns. This command has an effect only if the Tcl
$tmsh::csh variable is set to TABC.
Third Party Tcl Library Usage
A selection of third party libraries have been tested to work within the CLI script environment, including
MD5, BASE64, SHA1/SHA256, HTTP, TLS, TCL Perl, LDAP client, and XML parser. The TCL packages
can only reside in the directory of /usr/share/compat-tcl8.4.
Important: Only these tested packages are supported currently.
494
CLI
This example demonstrates the use of a Tcl package command to make use of tls/https. The TLS package
is installed in the directory /usr/share/compat-tcl8.4/tls in the form of two les: tls.tcl and libtls1.6.1.so.
Modify script /Common/use_tls {
proc script::run {} {
set pkg_name tls
set pkg_version 1.6
package require http
if {[catch {package require $pkg_name pkg_version}]} {
puts "No package found: $pkg_name!\n"
} else {
puts "Found package: $pkg_name!\n"
http::register https 443 tls::socket
set token [http::geturl https://172.27.42.161/]
upvar #0 $token state
puts $state(http)
puts $state(body)
}
}
}
This example uses the callback function to handle http data.
cli script /Common/use_http2 {
proc script::httpCallback {token} {
upvar #0 $token state
puts $state(http)
puts $state(body)
incr ::got_something
}
proc script::run {} {
namespace eval :: {
set got_something 0
}
set pkg_name http
set pkg_version 2.4.5
if {[catch {package require $pkg_name $pkg_version}]} {
puts "No package found: $pkg_name!\n"
} else {
puts "Found package: $pkg_name!\n"
http::geturl http://172.27.42.22/index.htm -command script::httpCallback
vwait ::got_something
}
}
}
This example uses the LDAP client package to query data.
cli script /Common/use_ldap {
proc script::run {} {
set pkg_name ldap
if {[catch {package require $pkg_name 1.8}]} {
puts "No package found: $pkg_name!\n"
} else {
puts "Found package: $pkg_name!\n"
set handle [ldap::connect 172.27.1.2]
ldap::bind $handle
495
Traffic Management Shell (tmsh) Reference Guide
set results [ldap::search $handle "dc=f5,dc=com" "(uid=test)" {}]
foreach result $results {
puts $result
}
ldap::unbind $handle
ldap::disconnect $handle
}
}
}
Here are some additional examples:
cli script /Common/use_parray {
proc script::run {} {
puts [info patch]
namespace eval :: {
set pkg_location /usr/share/compat-tcl8.4/
source [file join $pkg_location package.tcl]
}
puts "NS: [namespace current]"
set pkg_location $::pkg_location
source [file join $pkg_location parray.tcl]
parray ::tcl_platform
}
}
cli script /Common/use_sha2 {
proc script::run {} {
set pkg_name sha256
if {[catch {package require $pkg_name}]} {
puts "No package found: $pkg_name!\n"
} else {
puts "Found package: $pkg_name!\n"
puts "TCL does SHA2 now:"
puts [sha2::sha256 "TCL does SHA2"]
}
}
}
cli script /Common/use_tclperl {
proc script::run {} {
set pkg_name tclperl
if {[catch {package require $pkg_name}]} {
puts "No package found: $pkg_name!\n"
} else {
puts "Found package: $pkg_name!\n"
set interpreter [perl::interp new]
$interpreter eval {print "Hello World\n"}
perl::interp delete $interpreter
}
}
}
Special Characters
There are several characters that are part of both Tcl and tmsh syntax. You must escape these characters in
a shell script so that Tcl passes them to tmsh. You can use standard Tcl escape characters, such as quotes
and back slashes. You must escape curly braces ({ }), for example, "{" "}".
• tmsh::create ltm pool my_pool members add "{ 10.1.2.3:80 }"
496
CLI
Creates a Local Trafc Manager pool named my_pool.
Disabled Commands
The following commands are disabled for users that have not been assigned a user role of Administrator
or Resource Administrator:
• auto_execok
• auto_import
• auto_load
• auto_mkindex
• auto_mkindex_old
• auto_qualify
• auto_reset
• bgerror
• cd
• close
• eof
• exec
• fblocked
• fcongure
• fcopy
• le
• levent
• lename
• ush
• glob
• http
• interp
• load
• memory
• open
• package
• pid
• pkg:create
• pkg_mkindex
• pwd
• seek
• socket
• source
• tcl_ndLibrary
• tell
• unknown
497
Traffic Management Shell (tmsh) Reference Guide
• updates
• vwait
Examples
The following example demonstrates the use of all tmsh Tcl commands. The script displays all conguration
property values or all status and statistic values for the specied component, depending on the specied
arguments. The system displays all conguration settings if you replace [tmsh::get_cong $comp
all-properties] with [tmsh::get_cong / all-properties]. The use of the all-properties option ensures that
all options are displayed.
This command sequence is an example of how to run the following script: run / cli script example.tcl
cong ltm pool.
cli script example.tcl {
proc script::init { } {
set ::field_fmt "%-25s %s"
set ::usage_string "usage: [lindex $tmsh::argv 0] \
<config | status> <component path... name>"
}
proc script::help { } {
if { $tmsh::argc < 2 } {
tmsh::add_help Options: config "Display configuration"
tmsh::add_help Options: status \
"Display status and statistics"
}
else {
build_csh tmsh::builtin_help
}
}
proc script::tabc { } {
if { $tmsh::argc < 2 } {
tmsh::add_tabc config
tmsh::add_tabc status
}
else {
build_csh tmsh::builtin_tabc
}
}
proc script::run { } {
if { $tmsh::argc < 3 } {
usage
}
set opt [lindex $tmsh::argv 1]
if { $opt != "config" && $opt != "status" } {
usage
}
set comp ""
for {set idx 2} {$idx < $tmsh::argc} {incr idx} {
498
CLI
append comp "[lindex $tmsh::argv $idx] "
}
if { $opt == "config" } {
set objs [tmsh::get_config $comp all-properties]
}
else {
set objs [tmsh::get_status $comp]
}
set idx 0
set total [llength $objs]
while { $idx < $total } {
set obj [lindex $objs $idx]
print_object obj
puts ""
incr idx;
}
}
proc print_fields { objVar } {
upvar $objVar obj
set fdx 0
set fields [tmsh::get_field_names value $obj]
set field_count [llength $fields]
while { $fdx < $field_count } {
set field [lindex $fields $fdx]
puts [format $::field_fmt $field \
[tmsh::get_field_value $obj $field]]
incr fdx
}
}
proc print_object { objVar } {
upvar $objVar obj
puts "[tmsh::get_type $obj] [tmsh::get_name $obj]"
# name/value pairs
print_fields obj
# nested objects
set fdx 0
set fields [tmsh::get_field_names nested $obj]
set count [llength $fields]
while { $fdx < $count } {
set field [lindex $fields $fdx]
set nested_objects [tmsh::get_field_value $obj $field]
set ndx 0
set n_count [llength $nested_objects]
499
Traffic Management Shell (tmsh) Reference Guide
while { $ndx < $n_count } {
set nobj [lindex $nested_objects $ndx]
print_object nobj
incr ndx
}
if {$n_count == 0 } {
puts [format $::field_fmt $field "none"]
}
incr fdx
}
}
proc build_csh { command } {
# generate context sensitive help, tab completion or "?"
set args ""
for {set idx 2} {$idx < $tmsh::argc} {incr idx} {
lappend args [lindex $tmsh::argv $idx]
}
set opt [lindex $tmsh::argv 1]
if { $opt == "config" } {
$command list $args
}
elseif { $opt == "status" } {
$command show $args
}
else {
puts "\nunexpected argument: $opt"
}
return $args
}
proc usage { } {
puts $::usage_string
exit
}
}
Examples
The following example demonstrates the scripts using 11.6.0 tmsh syntax.
cli script example_ver.tcl {
...
proc script::run {} {
tmsh::modify cli version active 11.6.0
# the tmsh command in the section below should contain 11.6.0 tmsh
syntax
puts stdout [tmsh::list ltm pool mypool]
...
}
}
The following example demonstrates the scripts that are using multiple tmsh syntaxes.
cli script example_multi_ver.tcl {
....
proc script::run {} {
500
CLI
tmsh::modify cli version active 11.5.0
# the tmsh command in the section below should contain 11.5.0 tmsh
syntax
puts stdout [tmsh::list ltm pool mypool]
...
tmsh::modify cli version active 11.6.0
# the tmsh command in the section below should contain 11.6.0 tmsh syntax
puts stdout [tmsh::list ltm pool mypool]
...
}
}
See Also
cli alias, create, delete, edit, glob, list, modify, regex, reset-stats, show, tmsh and generate.
For information about Tcl, see www.tcl.tk.
transaction
Opens batch mode within which you can submit a set of commands as a single transaction.
Syntax
Use the transaction component within the cli module to open batch mode, enter a series of commands, and
then submit the commands as a single transaction.
Create/Modify
create transaction
modify transaction
delete [entry_id]
submit transaction [validate-only]
Display
list transaction
Delete
delete transaction
501
Traffic Management Shell (tmsh) Reference Guide
Description
tmsh parses each command that you enter in batch mode. If the command passes a syntax check, tmsh
saves it as part of the transaction you are creating and returns a conrmation. After you nish adding
commands, you submit the transaction to change the running conguration of the system. You must run
the save cong command to save the changes to the stored conguration les.
If, while creating a transaction, you decide you do not want to change the running conguration, you can
delete the transaction rather than submit it. However, you can recreate a transaction that you have deleted
by using the cli history component.
There are a few commands that you can enter on the command line that the system immediately runs, rather
than adding the commands to a transaction. These commands are list and show. Additionally, tmsh
immediately runs the command sequence run bigpipe, but does not add it to the transaction.
Examples
The following example shows the commands that you enter from within the ltm module to create and submit
a transaction that creates a Local Trafc Manager pool and virtual server, and then associates the two.
• Open tmsh batch mode:
create /cli transaction
• Add a command to the transaction that creates pool1 for the Local Trafc Manager using the default
values for a pool:
create pool pool1
• Add a command to the transaction that creates the virtual server virtual1 for the Local Trafc Manager
using the default values for a virtual server, and associates it with pool1.
create virtual virtual1 pool pool1
• Display, in a numbered list, the current set of commands in the transaction:
list /cli transaction
Note: You can use the preceding command to determine the entry ID of a command. Then, you can use
this ID to remove or replace a command in the transaction, or to identify a command before which you
want to insert another command.
• Submit the transaction:
submit /cli transaction
Options
• command
Species, in quotation marks, the full path to a command to add to or delete from the transaction that
you are creating. You can also replace an existing command with another command or insert a command
before a command in the transaction.
• create
Opens batch mode.
• delete
Deletes the transaction that you are creating and closes batch mode.
• list
Displays, in a numbered list, the current set of commands in the transaction that you are creating.
• modify
502
CLI
Species a previously entered line in the transaction that you want to change. The options are:
• delete
Deletes the specied entries from the transaction that you are creating.
• entry_id
Species the number of a command in the list of commands in the transaction that you want to delete.
• submit [validate-only]
Submits the transaction that you are entering and closes batch mode. The transaction is submitted in the
context of the cli admin-partitions settings that are active when the submit command is issued.
• validate-only
Validates the conguration changes without putting them in production.
See Also
cli admin-partitions, create, delete, list, modify, submit, tmsh
version
Displays and Congures tmsh versions.
Syntax
Congure the version component within the cli module using the syntax shown in the following sections.
Modify
modify version [option]
active [string ]
Display
show version
Description
You can use the version component to congure tmsh to run the specied version.
Examples
modify cli version active 11.5.0
Congures tmsh run 11.5.0 version.
show cli version
Displays the latest, active and supported versions of TMSH.
503
Traffic Management Shell (tmsh) Reference Guide
Options
• active
Species the active version of TMSH.
• latest
Displays TMSH the latest version. This is used as the default version.
• supported
Displays the current supported TMSH versions on the system.
• imported
Displays the imported TMSH versions on the system. An imported TMSH version will be imported
from a UCS created from TMSH version which is not supported in the current system - a very rare case.
Be aware, for an imported TMSH version, only syntax is supported, if it requires other handling other
than syntax change, it will not supported. So, for an imported TMSH version, it is not fully supported.
By default, this entry will not be displayed unless preference is set.
See Also
show, modify, sys ucs, tmsh
504
CLI
CLI Alias
private
Congures a user private alias.
Syntax
Congure the alias component within the cli alias module using the syntax in the following sections.
Create/Modify
create private [name]
command [commandSyntax]
command ["command syntax"]
command "[command syntax]; [command syntax]; ..."
app-service [[string] | none]
description [string]
edit private [name]
all
modify alias [name]
command [commandSyntax]
command ["command syntax"]
command "[command syntax]; [command syntax]; ..."
Display
list private
list alias [ [ [name] | [glob] | [regex] ] ...]
show running-config private
show running-config private [ [ [name] | [glob] | [regex] ] ...]
all-properties
one-line
non-default-properties
Delete
delete private [all | [name ... name] ]
Description
You can use the private component to create a shortcut that runs a tmsh command sequence. The name of
the private alias is what you type on the command line to run the command. If the command sequence for
which you are creating an alias contains spaces, it must be enclosed in quotation marks. Command aliases
are not case-sensitive.
You can create a private alias that runs multiple commands by entering the command sequences separated
by semi-colons.
Private aliases can be used only by the user who created them.
When a batch mode transaction is active, commands that operate on the private component are run
immediately and are not added to the transaction.
Examples
create private save command "save cong"
Creates an alias that saves the running conguration in the stored conguration les from anywhere within
tmsh.
create private stats command "show /sys trafc"
Creates an alias that displays trafc statistics from anywhere within tmsh.
create private nodemonitor command "list /ltm node; list /ltm monitor"
Creates an alias that displays the Local Trafc Manager nodes and monitors.
create private myalias command "show /sys provision ; show /sys license"
Creates an alias that displays license and provisioning information.
create private ltmpool command "list /ltm pool"
Creates an alias that displays the Local Trafc Manager pools from anywhere within tmsh.
Options
• command syntax
Species the command for which you are creating an alias. To create an alias that runs multiple
commands, enter the command sequences separated by semi-colons.
• app-service
Species the name of the application service to which the alias belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the alias. Only the application service can modify or delete the alias.
• description
Species the purpose of the alias. If you enable cli preference show-aliases, tmsh displays the description
in context-sensitive help (?).
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a name for the alias. This is what you type in tmsh to run the command for which you are
creating an alias.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
506
CLI Alias
See Also
create, delete, edit, glob, list, modify, regex, show, shared, tmsh
shared
Congures a shared alias.
Syntax
Congure the shared alias component within the cli alias module using the syntax in the following sections.
Create/Modify
create shared [name]
command [commandSyntax]
command ["command syntax"]
command "[command syntax]; [command syntax]; ..."
app-service [[string] | none]
description [string]
edit shared [name]
all
modify alias [name]
command [commandSyntax]
command ["command syntax"]
command "[command syntax]; [command syntax]; ..."
Display
list shared
list alias [ [ [name] | [glob] | [regex] ] ...]
show running-config shared
show running-config shared [ [ [name] | [glob] | [regex] ] ...]
all-properties
one-line
non-default-properties
Delete
delete shared [all | [name ... name] ]
Description
You can use the shared component to create a shortcut to run a tmsh command sequence. The name of the
shared alias is what you type on the command line to run the command. If the command sequence for which
you are creating an alias contains spaces, it must be enclosed in quotation marks. Command aliases are not
case-sensitive.
507
Traffic Management Shell (tmsh) Reference Guide
You can create a shared alias that runs multiple commands by entering the command sequences separated
by semi-colons.
Shared aliases can be used by all users.
When a batch mode transaction is active, commands that operate on the shared component are run
immediately and are not added to the transaction.
Examples
create shared save command "save cong"
Creates an alias that saves the running conguration in the stored conguration les from anywhere within
tmsh.
create shared stats command "show /sys trafc"
Creates an alias that displays trafc statistics from anywhere within tmsh.
create shared nodemonitor command "list /ltm node; list /ltm monitor"
Creates an alias that displays the Local Trafc Manager nodes and monitors.
create shared myalias command "show /sys provision ; show /sys license"
Creates an alias that displays license and provisioning information.
create shared ltmpool command "list /ltm pool"
Creates an alias that displays the Local Trafc Manager pools from anywhere within tmsh.
Options
• command syntax
Species the command for which you are creating an alias. To create an alias that runs multiple
commands, enter the command sequences separated by semi-colons.
• app-service
Species the name of the application service to which the alias belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the alias. Only the application service can modify or delete the alias.
• description
Species the purpose of the alias. If you enable cli preference show-aliase, tmsh displays the description
in context-sensitive help (?).
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a name for the alias. This is what you type in tmsh to run the command for which you are
creating an alias.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, regex, show, shared, tmsh
508
CLI Alias
CM
add-to-trust
Add a device to a trust domain.
Syntax
Run the add-to-trust program within the cm module using the syntax in the following section.
Modify
run add-to-trust Root
[ca-device | non-ca-device]
device [string]
device-name [string]
md5-fingerprint [string]
password [string]
serial [string]
sha1-fingerprint [string]
signature [string]
username [string]
Description
You can use the add-to-trust command to add a device to a trust domain. There is only one trust domain
at the moment - Root, and that will have to be specied in the command. This is an alternate helper command
to the modify trust-domain Root ca-devices|non-ca-devices add ... command.
Examples
run add-to-trust Root ca-device device 10.20.30.40 device-name peer1 username homer password
illiad
Adds a device to the list of ca-devices in the trust domain Root.
Options
• ca-device
Indicates that the added device is a certicate authority device.
• device
Indicates the FQDN or the management-ip of the device being added to the trust domain
• device-name
Used to specify the name of a new device.
• md5-ngerprint
Species the SSL certicate ngerprint when verifying the identity of a new device.
• non-ca-device
Indicates that the added device is a subordinate device. This means that you will be unable to add more
devices to the trust domain from the target device.
• password
Species the password for a new device.
• serial
Species the SSL certicate serial number when verifying the identity of a new device.
• sha1-ngerprint
Species the SSL certicate ngerprint when verifying the identity of a new device.
• signature
Species the SSL certicate signature, when verifying the identity of a new device.
• username
Species the user name required to log on to a device when adding the device to the trust domain. The
user "root" is invalid, and will be disallowed. Any user that has administrator privileges and can use
iControl can be used here.
See Also
run, tmsh
cert
Manages a CM trust certicate le.
Syntax
Display the cert component within the cm module using the syntax shown in the following sections.
Display
list cert
list cert [ [ [name] | [glob] | [regex] ] ... ]
show running-config cert
show running-config cert [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
certificate-key-size
checksum
create-time
created-by
email
expiration-date
expiration-string
fingerprint
is-bundle
issuer
key-type
last-update-time
mode
non-default-properties
one-line
partition
recursive
510
CM
revision
serial-number
size
source-path
subject
subject-alternative-name
system-path
updated-by
version
Description
You can use the cert component to display CM trust certicates.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• certicate-key-size
Displays the number of bits in the key associated with this certicate.
• checksum
Displays a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• create-time
Displays the time at which the trust certicate was created.
• created-by
Displays the name of the person, who originally created the trust certicate.
• email
Displays the email of the person, who originally created the trust certicate.
• expiration-date
Displays the date at which the trust certicate expires. The date is stored as a POSIX time.
• expiration-string
Displays a string representation of the trust certicate expiration date.
• ngerprint
Species the cryptographic ngerprint of the trust certicate.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• is-bundle
Indicates whether the trust certicate le is a bundle (that is, whether it contains more than one certicate).
• issuer
Displays the X.509 information for the issuer of the trust certicate. If the trust certicate is a bundle,
then this displays the issuer information for the primary (rst) trust certicate in the bundle.
• key-type
Displays the type of cryptographic key associated with this trust certicate.
511
Traffic Management Shell (tmsh) Reference Guide
• last-update-time
Displays the last time the trust certicate was modied.
• mode
Displays the UNIX(r) le permissions mode for the le associated with this trust certicate as a numerical
value.
• partition
Displays the partition within which the trust certicate le resides.
• recursive
Displays all objects of the specied type and the folder that contains the object.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• revision
Displays the number of the latest revision of the trust certicate. The revision starts with 1 and increments
on each update.
• serial-number
Displays the serial number of the trust certicate.
• size
Displays the size (in bytes) of the le associated with the trust certicate.
• source-path [URL]
Displays the path to the source of the trust certicate as a URL, for example:
source-path http://cert-server/cert_store/certs/vs_132.key
source-path https://cert-server/cert_store/certs/vs_132.key
source-path ftp://username:password@server/cert_store/certs/vs_132.key
• subject
Displays X.509 information about the subject of the trust certicate. If the certicate is a bundle, then
the subject information for the primary (rst) trust certicate in the bundle displays.
• subject-alternative-name
Displays a standard X.509 extension as shown in RFC 2459.
• system-path
Displays the path to the trust certicate.
• updated-by
Displays the name of the person, who last updated the trust certicate.
• version
Displays the X.509 version of the trust certicate.
See Also
glob, list, regex, tmsh
512
CM
config-sync
Manually synchronizes the conguration between devices.
Syntax
Run the cong-sync program within the cm module using the syntax in the following section.
Modify
run config-sync
from-group <name>
recover-sync
to-group <name>
Description
You must use only one of the options when you run conguration synchronization. The three options are
mutually exclusive.
Examples
run cong-sync from-group /Common/my_dg
Updates the conguration on the local device with the conguration from the remote device in the device
group /Common/my_dg with the newest conguration. If the local device already has the newest
conguration, then the conguration synchronization does nothing.
run cong-sync to-group /Common/my_dg
Updates the congurations on the remote devices in the device group /Common/my_dg with the conguration
on the local device. If the local device does not have the newest conguration, then the conguration
synchronization does nothing.
run cong-sync recover-sync
Resets the local device conguration and restores the trust domain, device, and device-group information
to default settings.
Options
• from-group
Updates the conguration of the local device with the conguration of the remote device in the specied
device group that has the newest conguration. If the local device already has the newest conguration,
then the conguration synchronization does nothing. This option is mutually exclusive of the to-group
and recover-sync options.
• recover-sync
Resets the local device conguration and restores the trust domain, device, and device-group information
to default settings. After this recovery, you can sync the local device with its peers by running cong-sync
on a peer device and specifying the device group in which the local device is a member. This option is
mutually exclusive of the from-group and to-group options.
• to-group
513
Traffic Management Shell (tmsh) Reference Guide
Updates the congurations of the remote devices in the specied device group with the conguration
of the local device. If the local device does not have the newest conguration, then the conguration
synchronization does nothing. This option is mutually exclusive of the from-group and recover-sync
options.
See Also
run, tmsh
device
Manages a device.
Syntax
Manage the device component within the cm module using the syntax shown in the following sections.
Create/Modify
create device [name]
modify device [name]
comment [string]
configsync-ip [ip address | none]
contact [string]
description [string]
ha-capacity [integer]
hostname [string]
location [string]
mirror-ip [ip address | any6]
mirror-secondary-ip [ip address | any6]
multicast-interface [string]
multicast-ip [ip address]
multicast-port [integer]
unicast-address [add | delete | modify | replace-all-with] {
[unicast address]
}
edit device [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list device
list device [ [ [name] | [glob] | [regex] ] ... ]
show running-config device
show running-config device [ [ [name] | [glob] | [regex] ] ... ]
active-modules
all-properties
app-service
base-mac
build
cert
chassis-id
514
CM
chassis-type
failover-stats
inactive-modules
key
location
management-ip
marketing-name
non-default-properties
one-line
optional-modules
partition
platform-id
product
recursive
self-device
time-limited-modules
time-zone
version
show device-group
show device-group [name]
all
field-fmt
Delete
delete device [name]
Description
You can use the device component to manage devices.
Warning: F5 Networks recommends that you do not create or delete devices. Instead, to add or remove
devices on the BIG-IP system, modify the Root trust domain. For more information, see help trust-domain.
Options
• active-modules
Displays the licensed modules that are currently active on the device.
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• base-mac
Displays the base MAC address for the device.
• build
Displays the software build number.
• cert
Displays the identity certicate used for device trust.
• chassis-id
Displays the chassis identier.
515
Traffic Management Shell (tmsh) Reference Guide
• chassis-type
Displays the chassis type. The possible values are individual and viprion.
• comment
Species user comments about the device.
• congsync-ip
Species the IP address used for conguration synchronization. If you specify a self IP address, the self
IP address object must be located in the Common folder.
• contact
Species administrator contact information.
• description
Species a user-dened description of the device.
• edition
Displays the software edition.
• failover-state
Displays the device failover state.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ha-capacity
Species a number that represents the relative capacity of the device to be active for a number of trafc
groups. This value along with the trafc group's ha-load-factor is used by the failover daemon to make
trafc groups active amongst the available devices. The value is zero by default which means the device
may run any number of trafc groups. The value must be within a valid range: 0 - 100000 inclusive.
• hostname
Species a hostname for the device.
• inactive-modules
Displays the licensed modules that are currently inactive on the device.
• key
Displays the identity key used for device trust.
• location
Species the physical location of the device.
• marketing-name
Displays the marketing name of the device platform.
• mirror-ip
Species the IP address used for state mirroring. If you specify a self IP address, the self IP address
object must be located in the Common folder.
• mirror-secondary-ip
Species the secondary IP address used for state mirroring. If you specify a self IP address, the self IP
address object must be located in the Common folder.
• multicast-interface
Species the interface name used for the failover multicast IP address.
516
CM
• multicast-ip
Species the multicast IP address used for failover.
• multicast-port
Species the multicast port used for failover.
• optional-modules
Displays the modules that are available for the current platform, but are not currently licensed.
• platform-id
Displays the device platform identier.
• product
Displays the software product name.
• recursive
Displays all objects of the specied type and the folder that contains the object.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• self-device
Displays true, when the device is the self device.
• time-limited-modules
Displays the licensed modules that are time-limited.
• time-zone
Displays the time zone congured on the device.
• unicast-address
Displays the set of unicast IP addresses used for failover. If you specify a self IP address, the self IP
address object must be located in the Common folder.
• version
Displays the software version number.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh, trust-domain
device-group
Congures device groups.
Syntax
Modify the device-group component within the cm module using the syntax shown in the following sections.
517
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create device-group [name]
modify device-group [name]
app-service [[string] | none]
asm-sync [ enabled | disabled ]
auto-sync [ enabled | disabled ]
description [string]
devices [add | delete | modify | replace-all-with] {
[ device_name ]
}
full-load-on-sync [true | false]
incremental-config-sync-size-max [integer]
network-failover [ enabled | disabled ]
save-on-auto-sync [true | false]
type [ sync-only | sync-failover ]
clear-incremental-config-sync-cache
edit device-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list device-group
list device-group [ [ [name] | [glob] | [regex] ] ... ]
show running-config device-group
show running-config device-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
partition
recursive
show device-group
show device-group [name]
field-fmt
Delete
delete device-group [name]
Note: The device group must be empty, and you must remove all references to the device group, before
you can delete the device group.
Description
You can use the device-group component to manage sets of devices used for conguration synchronization
and failover.
Examples
create device-group my_device_group devices add { /Common/device1 /Common/device2 }
518
CM
Creates a sync-only device group named my_device_group with two devices, device1 and device2.
delete device-group my_device_group
Deletes the device group named my_device_group.
list device-group my_device_group
Displays properties of the device group named my_device_group.
modify device-group my_device_group clear-incremental-cong-sync-cache
Warning: Do not use this option without assistance from the F5 Technical Support team.
Clears the incremental conguration synchronization cache. The next conguration synchronization for
my_device_group that pulls conguration from this device will be a full load.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• asm-sync
Species whether to synchronize ASM congurations of device group members. The default value is
disabled. A device can be a member of only one ASM-enabled device group.
• auto-sync
Species whether the device group automatically synchronizes conguration data to its members. The
default value is disabled. Conguration will be saved on remote devices after receiving conguration
updates if save-on-auto-sync is enabled.
• clear-incremental-cong-sync-cache
Warning: Do not use this option without assistance from the F5 Technical Support team.
The incremental conguration synchronization mechanism keeps a cache of transactions in each device
group. Specifying this option will remove all transactions from the cache for the given device groups.
This will not remove conguration from the device group, but will cause the next load in that group
from the current device to be a full load.
• description
Species a user-dened description of the device group.
• devices
Adds, deletes, or replaces a set of devices to a device group by specifying the device name(s). When
the local device is removed from a device group then all of the sys folder s that are associated with the
device group are reset to have no device group and the name of each folder that was updated is logged
to /var/log/ltm.
• full-load-on-sync
Species that the entire conguration for a device group is sent when conguration synchronization is
performed. The default value is false.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• incremental-cong-sync-size-max
519
Traffic Management Shell (tmsh) Reference Guide
Species the maximum size (in KB) to devote to incremental cong sync cached transactions. The
default is 1024 KB."
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• network-failover
When the device group type is failover, species whether network failover is used.
• partition
Displays the administrative partition within which the device group resides.
• recursive
Displays all objects of the specied type and the folder that contains the object.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• save-on-auto-sync
Species whether to save the conguration on the remote devices following an automatic conguration
synchronization. A device group congured for manual synchronization will always save on the remote
devices regardless of this setting.
• type
Species the type of device group. You can use this option only when you create a device group. You
cannot modify the type of a device group. The default value is sync-only.
See Also
create, delete, device, edit, glob, list, modify, regex, tmsh
failover-status
Display the failover status of the local device.
Syntax
Display failover-status component within the cm module using the syntax in the following section.
Display
show failover-status
field-fmt
Description
You can use the failover-status component to display the failover status of the local device.
For information about the options that you can use with the command show, see help show.
520
CM
Example
show failover-status
Displays the failover status of the local device.
See Also
show, tmsh
key
Manages a CM trust certicate private key le.
Syntax
Display or delete a key component within the cm module using the syntax shown in the following sections.
Display
list key
list key [ [ [name] | [glob] | [regex] ] ... ]
show running-config key
show running-config key [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
checksum
create-time
created-by
key-size
key-type
last-update-time
mode
non-default-properties
one-line
partition
recursive
revision
security-type
size
source-path
system-path
updated-by
Display
delete key [name]
=head1 DESCRIPTION
You can use the following options with the key component.
Options
• app-service
521
Traffic Management Shell (tmsh) Reference Guide
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• checksum
Displays a cryptographic hash or checksum of the key for use in verication of key integrity.
• create-time
Displays the time at which the key was created.
• created-by
Displays the user who originally created the key.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• key-size
Displays the size of the cryptographic key, in bits.
• key-type
Displays the cryptographic algorithm that this key is compatible with. A key can be one of two types:
• rsa-private
The key is an RSA private key.
• dsa-private
The key is a DSA based private key.
• last-update-time
Displays the time at which the key was last modied.
• mode
Displays the UNIX le permissions mode for the le associated with this key. The mode is expressed
in numerical form.
• name
Species the name of the key you want to delete.
• partition
Displays the partition within which the key resides.
• recursive
Displays all objects of the specied type and the folder that contains the object.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• revision
Displays the latest revision of the key. The revision starts with 1 increments on each update.
• security-type
Displays the type of security used to handle or store the key. There are four mutually exclusive options:
• normal
522
CM
Indicate the key resides in a standard form on the le-system. This is the default security type.
• ps
Indicates that the key is protected by a FIPS device on the system, and is only applicable to devices
with FIPS support.
• password
Indicates that the key is protected by a passphrase and stored in encrypted form.
• nethsm
Indicates that the key is protected by a FIPS device outside the system.
• size
Displays the size (in bytes) of the le associated with this le object.
• source-path [URL]
Displays the path to the source of the key. This option takes a URL, for example:
source-path http://cert-server/cert_store/certs/vs_132.key
source-path https://cert-server/cert_store/certs/vs_132.key
source-path ftp://user_name:user_password@user_server/cert_store/certs/vs_132.key
• system-path
Displays the location where the key is stored on the system.
• updated-by
Displays the name of the user who last updated the key.
See Also
delete, glob, list, regex, tmsh
remove-from-trust
Remove a device from a trust domain.
Syntax
Run the remove-from-trust program within the cm module using the syntax in the following section.
Modify
run remove-from-trust Root
[ca-device | non-ca-device]
device-name [string]
Description
You can use the remove-from-trust command to remove a device from a trust domain. There is only one
trust domain at the moment - Root, and that will have to be specied in the command. This is an alternate
helper command to the modify trust-domain Root ca-devices|non-ca-devices delete ... command.
523
Traffic Management Shell (tmsh) Reference Guide
Examples
run remove-from-trust Root ca-device device-name peer1
Removes a device from the list of ca-devices in the trust domain Root.
Options
• ca-device
Indicates that the added device is a certicate authority device.
• device-name
Used to specify the name of a new device.
• non-ca-device
Indicates that the added device is a subordinate device.
See Also
run, tmsh
sniff-updates
Displays the commit ID updates that occur over the CMI communications channel
Syntax
run cm sniff-updates
[-v]
Description
You can use the sniff-updates program to monitor the internal CMI communications channel for commit
ID updates. The system displays each update as it arrives, one per line.
(1) (2) (3) (4) (5) (6) (7) (8)
(9) (10)
[15:35:57] bigip1 (v0.0.0) -> device_trust_group: CID 105.105 (bigip2) at
15:34:39 FORCE_SYNC
Output elds: 1) Time that update arrived from network 2) Source device 3) Version of source device 4)
Destination devicegroup 5) CommitId ID 6) DeviceData CommitId ID 7) CommitId originator 8) CommitId
timestamp 9) FORCE_SYNC if set (nothing if not) 10) Last sync error message (nothing if last sync was
successful)
Options
You can use the following option when you run the sniff-updates program:
• -v
Formats the update output using fully-qualied device and device group names and exact time64_t
timestamps.
524
CM
See Also
run, tmsh
sync-status
Displays the conguration synchronization status of the local device.
Syntax
Run the sync-status command sequence within the cm module using the syntax in the following section.
Display
show sync-status
field-fmt
Description
You can use the sync-status component to display the conguration synchronization status of the local
device.
For information about the options that you can use with the command show, run the command sequence
help show.
Example
show sync-status
Displays the conguration synchronization status of the local device:
Options
• eld-fmt
Formats the status output in command syntax.
See Also
show, tmsh
traffic-group
Manages a CM trafc group.
Syntax
Manage the trafc-group component within the cm module using the syntax shown in the following
sections.
525
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create traffic-group [name]
modify traffic-group [name]
app-service [[string] | none]
auto-failback-enabled [ enabled | disabled ]
auto-failback-time [ integer ]
description [string ]
ha-group [string]
ha-load-factor [ integer ]
ha-order [ string ... ]
mac [mac address
edit traffic-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list traffic-group
list traffic-group [ [ [name] | [glob] | [regex] ] ... ]
show running-config traffic-group
show running-config traffic-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
is-floating
non-default-properties
one-line
partition
recursive
unit-id [integer]
show traffic-group
show traffic-group [name]
all-properties
failover-objects
field-fmt
Delete
delete traffic-group [name]
Description
You can use the trafc-group component to specify the failover behavior for devices in a failover device
group.
Examples
create trafc-group my_trafc_group
Creates a trafc group named my_trafc_group.
create trafc-group my_trafc_group ha-order { my_device }
526
CM
Creates a trafc group named my_trafc_group with a preferred device named my_device.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• auto-failback-enabled
Species whether the trafc group fails back to the default device.
• auto-failback-time
Species the time required to fail back. The value must be within a valid range: 0 - 300 inclusive.
• failover-objects
Only usable with the show command. Tells it to display all of the objects associated with that trafc
group.
• ha-group
This species the name of the HA group that the trafc group uses to decide the active device within
the trafc group. The HA group must exist rst. Note: This attribute is only specic to the local device
i.e. not sync'ed to its peers in the trafc group.
• ha-order
This list of devices species the order in which the devices will become active for the trafc group when
a failure occurs. This list may contain zero, one or more entries up to the number of devices in the
failover device group. If auto-failback enabled is set to true, this list must contain at least one entry for
the auto-failback device.
• ha-load-factor
Species a number for this trafc group that represents the load this trafc group presents to the system
relative to other trafc groups. This allows the failover daemon to load balance the active trafc groups
amongst the devices. The value is one by default. The value must be within a valid range: 1 - 1000
inclusive.
• description
Species a user-dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• is-oating
Indicates whether the trafc group can fail over to other devices in the device group.
• mac
Species a MAC address for the trafc group.
• partition
Displays the administrative partition within which the device group resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• recursive
527
Traffic Management Shell (tmsh) Reference Guide
Displays all objects of the specied type and the folder that contains the object.
• unit_id
Displays the unit ID for the trafc group. The unit ID is set automatically when you create a trafc
group. The value is between 1 and 15.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
trust-domain
Manages a CM trust domain by providing control of object failover.
Syntax
Manage the trust-domain component within the cm module using the syntax shown in the following
sections.
Create/Modify
create trust-domain [name]
modify trust-domain [name]
ca-devices [add | delete | modify | replace-all-with] {
[ device_name | ip address ]
}
md5-fingerprint [string]
name [string]
non-ca-devices [add | delete | modify | replace-all-with] {
[ device_name | ip address ]
}
password [string]
serial [string]
sha1-fingerprint [string]
username [string]
Display
list trust-domain
list trust-domain [ [ [name] | [glob] | [regex] ] ... ]
show running-config trust-domain
show running-config trust-domain [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
ca-cert
ca-cert-bundle
ca-key
non-default-properties
one-line
partition
recursive
status
trust-group
528
CM
Delete
delete trust-domain all
keep-current-certificate-authority
import-user-defined-cert [string]
import-user-defined-key [string]
Description
You can use the trust-domain component to manage the behavior of objects during fail over.
Examples
Adds a certicate authority:
modify trust-domain Root ca-devices add { 192.168.1.245 } name myDevice1 username admin password
admin
Adds a non-authoritative certicate:
modify trust-domain Root non-ca-devices add { 192.168.1.245 } name myDevice1 username admin
password admin
Removes a device from the trust domain:
modify trust-domain Root ca-devices delete { myDevice1 }
Resets the trust and makes this device standalone:
delete cm trust-domain all
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• ca-cert
Displays the certicate authority device trust certicate.
• ca-cert-bundle
Displays the bundled certicate authority device trust certicates used to authenticate incoming
connections.
• ca-devices
Species a set of certicate authority devices in the trust domain.
• ca-key
Displays the certicate authority device trust key. This key only displays for certicate authorities.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• import-user-dened-cert
Species the certicate to import and use as the trust domain's new certicate authority. You must also
use the import-user-dened-key option to specify the corresponding key. This option cannot be specied
alongside keep-current-certicate-authority.
529
Traffic Management Shell (tmsh) Reference Guide
• import-user-dened-key
Species the key to import and use as the trust domain's new certicate authority key. You must also
use the import-user-dened-cert option to specify the corresponding certicate. This option cannot
be specied alongside keep-current-certicate-authority.
• keep-current-certicate-authority
By default, resetting trust will generate a new certicate authority. Adding this option to the delete
command will instead keep the current certicate authority. This option cannot be specied alongside
import-user-dened-cert or import-user-dened-key.
• md5-ngerprint
Species the SSL certicate ngerprint when verifying the identity of a new device.
• name
Option used to specify the name of a new device.
• non-ca-devices
Species a set of subordinate devices in the trust domain.
• password
Species the password for a new device.
• recursive
Displays all objects of the specied type and the folder that contains the object.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• serial
Species the SSL certicate serial number when verifying the identity of a new device.
• sha1-ngerprint
Species the SSL certicate ngerprint when verifying the identity of a new device.
• signature
Species the SSL certicate signature, when verifying the identity of a new device.
• status
Displays the status of the trust domain.
• trust-group
Displays the device group associated with the trust domain.
• username
Species the user name required to log on to a device when adding the device to the trust domain.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
530
CM
watch-devicegroup-device
Displays information about the devices in the device group to which the local device belongs.
Syntax
Run the watch-devicegroup-device program within the cm module using the syntax shown in the following
sections.
Run
run watch-devicegroup-device
Display
By default, multiple devices with identical information are collapsed into a single row that displays in green.
The devices column identies the devices by the sufx of the conguration synchronization IP address
congured on the device. For example, if the devices in a device group have the IP addresses 10.0.0.15 and
10.0.0.16, the IDs in this column will be 15 and 16. Use the c (collapse) command to deactivate/activate
this behavior.
Description
You can use the watch-devicegroup-device program to view dynamic information about the synchronization
of the devices in the device group to which the local device belongs. You can use this information to monitor
or troubleshoot the devices.
For example, when you make a change to a device, the change is identied by a commit ID (cid.id) that
displays when you run the watch-devicegroup-device program.
Within the program, you can use the following keys:
• Press h to see a list of available commands.
• Press the back tick key (`) to exit the help page.
• Press c to toggle the view from a collapsed view to a full view. The command gathers information from
every device in the trust group. When all devices in the trust group report the same information the view
is collapsed and one line, highlighted in green, displays the information. The devices included in the
line are shown in the devices column. You can press c to see the full view, which displays each device
on a separate line.
• Press Ctrl-C to exit the program.
• Press the arrow keys to navigate across the columns or down the rows.
The content in the columns includes:
• devices
Displays the sufx of the conguration synchronization IP address congured on the device. For example,
if the devices in a device group have the cong-sync IP addresses 10.0.0.15 and 10.0.0.16, the IDs in
this column will be 15 and 16.
• devgroup
Displays the name of the device group to which the device belongs. Note: This can be a sync-only,
failover, or trust device group.
• device
531
Traffic Management Shell (tmsh) Reference Guide
Displays the device object name.
• cid.id
Displays the commit ID, which is a conguration change identier.
• cid-orig
Displays the name of the device on which the conguration change was made.
• cid.time
Displays the time the conguration change was made.
• last_sync
Displays the time the device conguration was last synchronized with the device group.
The devices in the to-group of a conguration synchronization display the same time in this column.
The local device that pushes the conguration to the other devices in the device group (to-group) has a
different value in this column.
The devices in the from-group of a conguration synchronization display the same time in this column.
The local device that receives the conguration from the other devices has a different value in this
column. You can use this information to determine a rollback strategy.
See Also
run, tmsh, watch-sys-device, watch-trafcgroup-device
watch-sys-device
Displays information about the local device.
Syntax
Run the watch-sys-device program within the cm module using the syntax shown in the following sections.
Run
run watch-sys-device
Display
By default, multiple devices with identical information are collapsed into a single row that displays in green.
The devices column identies the devices by the sufx of the conguration synchronization IP address
congured on the device. For example, if the devices in a device group have the IP addresses 10.0.0.15 and
10.0.0.16, the IDs in this column will be 15 and 16. Use the c (collapse) command to deactivate/activate
this behavior.
Description
You can use the watch-sys-device program to view dynamic information about the local device.
Within the program, you can use the following keys:
• Press h to see a list of available commands.
• Press the back tick key (`) to exit the help page.
532
CM
• Press c to toggle the view from a collapsed view to a full view. The command gathers information from
every device in the trust group. When all devices in the trust group report the same information the view
is collapsed and one line, highlighted in green, displays the information. The devices included in the
line are shown in the devices column. You can press c to see the full view, which displays each device
on a separate line.
• Press Ctrl-C to exit the program.
• Press the arrow keys to navigate across the columns or down the rows.
The content in the columns includes:
• devices
Displays the sufx of the conguration synchronization IP address congured on the device. For example,
if the devices in a device group have the IP addresses 10.0.0.15 and 10.0.0.16, the IDs in this column
will be 15 and 16.
• name
Displays the device object name.
• platform
Displays the device platform.
• build
Displays the software build installed on the device.
• failover_state
Displays the high availability state (active or standby) of the device.
• mgmt_ip
Displays the IP address of the management port on the device.
• congsync_ip
Displays the IP address on the device that is used for conguration synchronization.
• unicast_ip
Displays the unicast IP address of the device.
• multicast_ip
Displays the multicast IP address of the device.
• mirror_ip
Displays the IP address used for conguration mirroring for the device.
• mirror_secondary_ip
Displays the secondary IP address used for conguration mirroring for the device.
• desc
Displays a description of the device.
See Also
run, tmsh, watch-devicegroup-device, watch-trafcgroup-device
533
Traffic Management Shell (tmsh) Reference Guide
watch-trafficgroup-device
Displays information about the trafc groups associated with devices in a device group.
Syntax
Run the watch-trafcgroup-device program within the cm module using the syntax shown in the following
sections.
Run
run watch-trafficgroup-device
Display
By default, multiple devices with identical information are collapsed into a single row that displays in green.
The devices column identies the devices by the sufx of the conguration synchronization IP address
congured on the device. For example, if the devices in a device group have the IP addresses 10.0.0.15 and
10.0.0.16, the IDs in this column will be 15 and 16. Use the c (collapse) command to deactivate/activate
this behavior.
Description
You can use the watch-trafcgroup-device program to view dynamic information about the failover status
of the devices in a device group to which the local device belongs. You can use this information to monitor
or troubleshoot the devices in the device group.
Within the program, you can use the following keys:
• Press h to see a list of available commands.
• Press the back tick key (`) to exit the help page.
• Press c to toggle the view from a collapsed view to a full view. The command gathers information from
every device in the device group. When all devices in the device group report the same information the
view is collapsed and one line, highlighted in green, displays the information. The devices included in
the line are shown in the devices column. You can press c to see the full view, which displays each
device on a separate line.
• Press Ctrl-C to exit the program.
• Press the arrow keys to navigate across the columns or down the rows.
The content in the columns includes:
• devices
Displays the sufx of the conguration synchronization IP address congured on the device. For example,
if the devices in a device group have the IP addresses 10.0.0.15 and 10.0.0.16, the IDs in this column
will be 15 and 16.
• trafc_group
Displays the name of the trafc group associated with the device.
• device_name
Displays the device object name.
• failover_state
534
CM
Displays the high availability state (active or standby) of the device.
• next_active
Displays True for the device that becomes active if the active trafc group fails over.
• score
Displays a system-generated high availability score used to select the next active device.
See Also
run, tmsh, watch-sys-device, watch-devicegroup-device
535
Traffic Management Shell (tmsh) Reference Guide
GTM
datacenter
Congures a Global Trafc Manager(tm) data center.
Syntax
Congure the datacenter component within the gtm module using the syntax in the following sections.
Create/Modify
create datacenter [name]
modify datacenter [name]
app-service [[string] | none]
contact [ [name] | none]
description [string]
[disabled | enabled]
location [none | [physical location] ]
prober-pool [none | name]
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
edit datacenter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
reset-stats datacenter
reset-stats datacenter [ [ [name] | [glob] | [regex] ] ... ]
Display
list datacenter
list datacenter [ [ [name] | [glob] | [regex] ] ... ]
show running-config datacenter
show running-config datacenter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show datacenter
show datacenter [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete datacenter [name]
Description
You can use the datacenter component to create, modify, display, or delete a data center.
Examples
create datacenter DC1
Creates a data center named DC1 with options set to the default values.
list datacenter DC1 all-properties
Displays all properties of the data center named DC1.
Options
• app-service
Species the name of the application service to which the data center belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the data center. Only the application service can modify or delete the data center.
• contact
Species the name of the administrator or the name of the department that manages the data center. The
default value is none.
• description
User dened description.
• [disabled | enabled]
Species whether the data center and its resources are available for load balancing. The default value
is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• location
Species the physical location of the data center. The default value is none.
• metadata
Species user-dened data to associate with a server. By default the persist attribute is set to true. This
means the data is saved into the conguration le.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• prober-pool
Species a prober pool to use to monitor servers dened in this data center.
538
GTM
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, gtm link, gtm prober-pool, gtm server, list, modify, regex, reset-stats, show, tmsh
distributed-app
Congures a Global Trafc Manager(tm) distributed application.
Syntax
Congure the distributed-app component within the gtm module using the syntax in the following sections.
Create/Modify
create distributed-app [name]
modify distributed-app [name]
app-service [[string] | none]
dependency-level [datacenter | link | none | server | wideip]
description [string]
disabled-contexts
[add | delete | modify | replace-all-with] {
[datacenter | link | server] [name] ...
}
disabled-contexts none
persistence [enabled | disabled]
persist-cidr-ipv4 [integer]
persist-cidr-ipv6 [integer]
ttl-persistence [integer]
wideips
[add | delete | replace-all-with] {
[name] ...
}
wideips [default | none]
edit distributed-app
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
reset-stats distributed-app
reset-stats distributed-app
[ [ [name] | [glob] | [regex] ] ... ]
539
Traffic Management Shell (tmsh) Reference Guide
Display
list distributed-app
list distributed-app [ [ [name] | [glob] | [regex] ] ... ]
show running-config distributed-app
show running-config distributed-app
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show distributed-app
show distributed-app [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete distributed-app [name]
Description
You can use the distributed-app component to create, modify, display, or delete a distributed application.
Examples
create distributed-app DA1
Creates a distributed application named DA1 with options set to the default values.
list distributed-app DA1 all-properties
Displays all properties of the distributed application named DA1.
Options
• app-service
Species the name of the application service to which the distributed application belongs. The default
value is none. Note: If the strict-updates option is enabled on the application service that owns the
object, you cannot modify or delete the distributed application. Only the application service can modify
or delete the distributed application.
• dependency-level
Species the resources that must be in the available state before this distributed application is considered
available. The options are:
• datacenter
All of the data centers on the member list of this distributed application must be in an available state
before the system considers the distributed application available.
• link
All of the links on the member list of this distributed application must be in an available state before
the system considers the distributed application available.
• none
540
GTM
The distributed application has no dependencies. This value effectively disables this option. This is
the default value.
• server
All of the servers on the member list of this distributed application must be in an available state
before the system considers the distributed application available.
• wideip
All of the Wide IPs on the member list of this distributed application must be in an available state
before the system considers the distributed application available.
• description
User dened description.
• disabled-contexts
Species the components that you want to add to or delete from this distributed application as
disabled-contexts. You can also replace all of the components that are currently listed as disabled-contexts
for this distributed application with other components. The default value is none.
The possible values are:
• datacenter
Species the datacenters, by name, to which the system does not send trafc from this distributed
application.
• link
Species the links, by name, to which the system does not send trafc from this distributed application.
• none
There are no components to which the system does not send trafc from this distributed application.
This value effectively disables this option.
• server
Species the servers, by name, to which the system does not send trafc from this distributed
application.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this object resides.
• persistence
When enabled, if a local DNS server makes repetitive requests on behalf of a client, the system reconnects
the client to the same resource as previous requests. The default value is disabled.
• persist-cidr-ipv4
Species a mask used to group IPv4 LDNS addresses. This feature allows one persistence record to be
shared by LDNS addresses that match within this mask.
• persist-cidr-ipv6
Species a mask used to group IPv6 LDNS addresses. This feature allows one persistence record to be
shared by LDNS addresses that match within this mask.
541
Traffic Management Shell (tmsh) Reference Guide
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• ttl-persistence
Species, in seconds, the length of time for which the persistence entry is valid. The default value is
3600.
• wideips
Species the Wide IPs, by name, that you want to add to or delete from this distributed application. You
can also replace all of the Wide IPs that are currently associated with this distributed application with
other Wide IPs. The default value is none.
A Wide IP is a collection of one or more domain names that maps to one or more groups of virtual
servers managed either by BIG-IP(r) systems, or by host servers. The Global Trafc Manager load
balances name resolution requests across the virtual servers that are dened in the Wide IP that is
associated with the requested domain name.
See Also
create, delete, glob, gtm link, gtm server, create, list, modify, regex, reset-stats, show, tmsh
iquery
Displays information about iQuery.
Syntax
Display the iquery component within the gtm module using the syntax in the following sections.
Display
show iquery
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Description
You can use the iquery component to display iQuery statistics.
Examples
show iquery
Displays iQuery statistics in the system default units.
show iquery eld-fmt
Displays iQuery statistics in eld format.
Options
For information about options for the command show, see show.
542
GTM
See Also
show, tmsh
ldns
Displays local domain name system (LDNS) statistics for the Global Trafc Manager(tm).
Syntax
Display the ldns component within the gtm module using the syntax in the following section.
Display
show ldns
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the ldns component to display LDNS statistics.
Examples
show ldns
Displays LDNS statistics in the system default units.
show ldns eld-fmt
Displays LDNS statistics in eld format.
See Also
show, tmsh
link
Congures Global Trafc Manager(tm) links.
Syntax
Congure the link component within the gtm module using the syntax in the following sections.
Create/Modify
create link [name]
modify link [name]
app-service [[string] | none]
cost-segments {
{ [up-to-bps [integer] ] [dollars-per-mbps [integer] ] }...
543
Traffic Management Shell (tmsh) Reference Guide
}
datacenter [string]
description [string]
[disabled | enabled]
duplex-billing [disabled | enabled]
limit-max-inbound-bps [integer]
limit-max-inbound-bps-status [disabled | enabled]
limit-max-outbound-bps [integer]
limit-max-outbound-bps-status [disabled | enabled]
limit-max-total-bps [integer]
limit-max-total-bps-status [disabled | enabled]
link-ratio [integer]
monitor [none | [name] [and [name] ]... ]
monitor min [integer] of { [name]... }
prepaid-segment [integer]
router-addresses
[add | delete | modify | replace-all-with] {
[ip address] {
app-service [[string] | none]
translation [disabled | enabled]
device-name [name]
}
}
service-provider [name]
uplink-address [ip address]
weighting [price | ratio]
edit link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
reset-stats link
reset-stats link [ [ [name] | [glob] | [regex] ] ... ]
Display
list link
list link [ [ [name] | [glob] | [regex] ] ... ]
show running-config link
show running-config link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show link
show link [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete link [name]
544
GTM
Description
You can use the link component to create, display, modify, or delete a link.
A link is a physical device that connects the network to the rest of the Internet. You can logically attach
links to a collection of servers in order to manage access to the data sources on the network.
Examples
create link my_link datacenter DC1 router-addresses add {10.10.1.1}
Creates a link named my_link in the DC1 data center and adds the IP address of the router that uses this
link.
list link non-default-properties
Displays all non-default properties for all links.
delete link my_link
Deletes the link named my_link.
show link my_link detail
Show the servers and virtual servers associated with my_link.
show link all detail
Show the servers and virtual servers associated with each respective link in the system.
Options
• app-service
Species the name of the application service to which the link belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the link. Only the application service can modify or delete the link.
• cost-segments
Species the cost of each incremental segment of bandwidth. This option is valid only when the weighting
option is set to price. Note that you cannot modify the list, only replace all of the options in the list.
By default, the list is empty. The options are:
• dollars-per-mps
Species the cost in dollars per megabytes per second. By default this value is not specied.
• up-to-bps
Species the cost in dollars per bytes per second. By default this value is not specied.
• datacenter
Species the data center to which the link belongs.
• description
User dened description.
• detail
The detail option is used with the show display command. This shows the server IP addresses and virtual
servers associated with this link. A server can have multiple server IP addresses, however, only the
server IP addresses that use this link will be displayed. Assignment information for servers and virtuals
will not be displayed if there are not any servers or virtuals that use this link. By default, links are
automatically matched to server IP addresses and virtual servers according to their IP addresses. Explicit
links may also be dened. How this link was assigned is displayed under the Link Assignment column:
545
Traffic Management Shell (tmsh) Reference Guide
auto means that the system automatically assigned this link, and explicit means that the link was explicitly
set by the user.
• [disabled | enabled]
Species whether the link and its resources are available for load balancing. The default value is enabled.
• duplex-billing
Enables or disables duplex billing for this link. The default value is enabled. This option is valid only
when the weighting option is set to price.
• disabled
The internet service provider (ISP) that supplies this link bills for bandwidth usage based on the total
amount of inbound plus outbound trafc on the link.
• enabled
The ISP that supplies this link bills for bandwidth usage based on the maximum amount of either
inbound or outbound trafc on the link (whichever is higher), rather than billing for bandwidth usage
based on the total amount of inbound plus outbound trafc on the link.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• limit-max-inbound-bps
Species the threshold for inbound trafc on the link. The default value is 0 (zero).
• limit-max-inbound-bps-status
Enables or disables the limit-max-inbound-bps option for this link. The default value is disabled.
• limit-max-outbound-bps
Species the threshold for inbound trafc on the link. The default value is 0 (zero).
• limit-max-outbound-bps-status
Enables or disables the limit-max-outbound-bps option for this link. The default value is disabled.
• limit-max-total-bps
Species the threshold as a sum of inbound and outbound trafc on the link. The default value is 0
(zero).
• limit-max-total-bps-status
Enables or disables the limit-max-total-bps option for this link. The default value is disabled.
• link-ratio
Species the frequency at which the system sends trafc through the link. The default value is 1.
Important: When you set this option, you must also set the weighting option to ratio.
• monitor
Species the health monitors that the system uses to determine whether this link is available for load
balancing. Multiple monitors may be specied with the and keyword. The min keyword is used to
specify the minimum number of monitors that must succeed for this link to be declared up. The default
value is none.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• prepaid-segment
546
GTM
Species the amount of bandwidth for which the system is prepaid. This option is valid only when the
weighting option is set to price. The default value is 0 (zero).
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• router-addresses
Species the IP addresses of the routers that use this link. A router address can be associated with only
one link. You can use the following options:
• app-service
Species the name of the application service to which the link belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the link. Only the application service can modify or delete the link.
• translation
Species the address that the link uses for translation when communicating between the network
and the Internet. The default value is any6.
• device-name
Species the name of this system in a redundant system. The default value is the link name.
• service-provider
Species the Internet Service Provider (ISP) or vendor that supplies this link. This allows you to provide
a name or description that helps identify this link out of your data center. This is an optional eld.
• uplink-address
Species the IP address the system uses to gather Simple Network Management Protocol (SNMP)
metrics from the router interface. When you congure an uplink address, the system sends SNMP
requests to the IP addresses congured using the router-addresses option for this link.
• weighting
Species the weighting methodology the system uses to select a link to which to send trafc. The default
value is ratio. The options are:
• price
The system continuously checks the performance of each link, and sends trafc through the link
with the best performance data.
• ratio
The system uses the value that you set in the link-ratio option to determine the link to which to send
trafc.
See Also
create, delete, edit, glob, gtm datacenter, gtm server, list, modify, regex, reset-stats, show, tmsh
listener
Congures a Global Trafc Manager(tm) listener.
547
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the listener component within the gtm module using the syntax in the following sections.
Create/Modify
create listener [name]
modify listener [name]
address [ip address]
advertise [yes | no]
app-service [[string] | none]
auto-lasthop [default | enabled | disabled ]
description [string]
[disabled | enabled]
fallback-persistence [none | [profile name] ]
ip-protocol [tcp | udp]
last-hop-pool [ [pool_name] | none]
mask { [ipv4] | [ipv6] }
persist [replace-all-with] {
[profile_name ... ] {
default [no | yes]
}
}
persist none
pool [ [pool_name] | none]
port [service port]
profiles [add | delete | replace-all-with] {
[profile name ...] {
context [all | clientside | serverside]
}
}
rules { [none | [rule_name ... ] }
source-address-translation {
pool [ [pool_name] | none]
type [ automap | snat | none ]
}
source-port [change | preserve | preserve-strict]
translate-address [enabled | disabled]
translate-port [enabled | disabled]
vlans none
vlans
[ add | delete | replace-all-with ] {
[vlan name]...
}
vlans-disabled
vlans-enabled
edit listener [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
reset-stats listener
reset-stats listener [ [ [name] | [glob] | [regex] ] ... ]
Display
list listener
list listener [name]
548
GTM
show running-config listener
show running-config listener [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show listener
show listener [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete listener [name]
Description
You can use the listener component to create, display, modify, or delete a listener.
A listener is an object that listens for DNS queries. Listeners are dened for specic IP addresses, and are
always associated with port 53.
Important: When you create, modify, or delete a listener, the system saves the running conguration in
the stored conguration les.
Examples
create listener my_listener address 10.10.1.1 persist replace-all-with { source_addr }
Creates a listener named my_listener with an IP address of 10.10.1.1, which uses the source address
persistence method.
modify listener my_listener proles replace-all-with { dns }
Replaces the proles associated with the listener my_listener.
Note: To replace the prole associated with a listener, you must enclose the name of the new prole in
curly brackets.
list listener non-default-properties
Displays all non-default properties for all listeners.
delete listener my_listener
Deletes the listener named my_listener.
Options
• address
Species the IP address on which the system listens. The system receives trafc sent to this IP address
and processes it as needed. This option is required.
• advertise
Species whether to advertise the listener address to surrounding routers. The options are yes or no.
The default value is no.
• app-service
549
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the listener belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the listener. Only the application service can modify or delete the listener.
• context
Species that the protocol prole is either a clientside or serverside prole. If not specied, the default
value is all for both sides.
• description
User dened description.
• (enabled | disabled)
Species the state of the listener. The default value is enabled.
Note: When you disable a listener, the listener no longer accepts new connection requests. However,
it allows current connections to nish processing before going to a down state.
• fallback-persistence
Species a fallback persistence prole for the listener to use when the default persistence prole is not
available. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ip-protocol
Species the protocol on which this listener receives network trafc. The options are udp or tcp. The
default value is udp.
• last-hop-pool
Species the name of the last hop pool that you want the listener to use to direct reply trafc to the last
hop router. The default value is none.
• mask
Species the netmask for a network listener only. This setting is required for a network listener.
The netmask claries whether the host bit is an actual zero or a wildcard representation. The default
value is 255.255.255.255 for IPv4 or ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff for IPv6.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the listener resides.
• persist
Species a list of proles separated by spaces that the listener uses to manage connection persistence.
The default value is none.
To enable persistence, typically you specify a single prole. However, you can specify multiple proles
in conjunction with iRules(r) that dene a persistence strategy based on incoming trafc. In the case of
multiple proles, the default option species which prole you want the listener to use if an iRule does
not specify a persistence method. When you specify multiple proles, the default value of the default
property is no. You can set the value of the default property to yes for only one of the proles.
• pool
Species a default pool to which you want the listener to automatically direct trafc. The default value
is none.
550
GTM
• port
Species the service port on which the listener listens for connections. When you create a listener, the
default value is 53 if no port number is specied.
• proles
Species the DNS, statistics and protocol proles to use for this listener. When a listener is created, if
a DNS prole is not specied, the generic "dns" prole is added. If a protocol prole is not specied,
then the generic "tcp" prole is added for TCP and the "udp_gtm_dns" prole is added for UDP. A
listener always has DNS and protocol proles once it is created. Only a statistics prole can be added
to or deleted from a listener.
The replace-all-with command replaces the proles with the specied ones. The unspecied DNS and
protocol proles are not changed. If statistics proles are not specied, the replace-all-with command
removes the existing statistics prole from the listener. When the protocol is modied, if proles are
not specied, a default protocol prole is used. DNS and statistics proles will not change.
• rules
Species a list of iRules, separated by spaces, that customize the listener to direct and manage trafc.
The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• source-address-translation
Species the type of source address translation enabled for the listener as well as the pool that the source
address translation will use.
• pool
Species the name of a SNAT pool used by the specied listener.
• type
Species the type of source address translation associated with the specied listener.
The options are:
• automap
Species the use of self IP addresses for listener source address translation.
• none
Species no source address translation to be used by the listener.
• snat
Species the use of a SNAT pool of translation addresses for listener source address translation.
• source-port
Species whether the system preserves the source port of the connection. The default value is preserve.
The options are:
• change
Obfuscates internal network addresses.
• preserve
Preserves the source port of the connection.
• preserve-strict
551
Traffic Management Shell (tmsh) Reference Guide
Use this value only for UDP under very special circumstances, such as nPath or transparent (that is,
no translation of any other L3/L4 eld), where there is a 1:1 relationship between virtual IP addresses
and node addresses, or when clustered multi-processing (CMP) is disabled.
• translate-address
Enables or disables address translation for the listener. Disable address translation for a listener if you
want to use the listener to load balance connections to any address. This option is useful when the system
is load balancing devices that have the same IP address. The default value is disabled.
• translate-port
Enables or disables port translation. Disable port translation for a listener, if you want to use the listener
to load balance connections to any service. The default value is disabled.
• vlans
Species a list of VLANs on which trafc is either disabled or enabled, based on whether the
vlans-disabled or vlans-enabled option is specied.
• vlans-disabled
Species that trafc is not accepted by this listener on the VLANs specied in the vlans option. This
option is mutually exclusive with the vlans-enabled option.
• vlans-enabled
Species that trafc is accepted by this listener on only the VLANs specied in the vlans option. This
option is mutually exclusive with the vlans-disabled option.
See Also
create, delete, edit, glob, list, modify, net vlan, net vlan-group, regex, reset-stats, show, tmsh
path
Displays or resets path statistics for the Global Trafc Manager(tm).
Syntax
Congure the path component within the gtm module using the syntax in the following section.
Display
show path
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the path component to display path statistics for the Global Trafc Manager. You can also
reset the path statistics to zero at any time.
See Also
show, tmsh
552
GTM
persist
Displays persistence records for the Global Trafc Manager(tm).
Syntax
Display statistics for the persist component within the gtm module using the syntax in the following section.
Display
show persist
destination [ [name] | none]
key [ip address | string]
level [application | wideip]
max-results [integer]
target-name [ [name] | none]
target-type [datacenter | link | pool-member | server]
Description
You can use the persist component to display various persistence records based on the ltering options that
you use.
Examples
show persist
Displays all Global Trafc Manager persistence records.
show persist level wideip
Displays persistence records only for wideip persistence.
Options
• destination
Displays persistence records for the specied destination.
• key
Displays persistence records for the specied LDNS address or generic key.
• level
Displays persistence records for the specied level (destination type), either wideip or application.
• max-results
Species the maximum number of persistence records that you want the system to return.
• target-name
Displays persistence records for the specied target name.
• target-type
Displays persistence records for the specied type of target.
553
Traffic Management Shell (tmsh) Reference Guide
See Also
show, tmsh
prober-pool
Congures prober pools for the Global Trafc Manager(tm).
Syntax
Modify the Global Trafc Manager prober-pool component within the gtm module using the syntax shown
in the following sections.
Create/Modify
create prober-pool [name]
modify prober-pool [name]
app-service [[string] | none]
description [string]
[disabled | enabled]
load-balancing-mode [global-availability | round-robin]
members none
members
[ add | delete | modify | replace-all-with ] {
[name] {
app-service [[string] | none]
description [string]
[disabled | enabled]
order [integer]
}...
}
edit prober-pool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats prober-pool
reset-stats prober-pool [ [ [name] | [glob] | [regex] ] ... ]
Display
list prober-pool
list prober-pool [ [ [name] | [glob] | [regex] ] ... ]
show running-config prober-pool
show running-config prober-pool [ [ [name] | [glob] | [regex] ] ... ]
554
GTM
all-properties
non-default-properties
show prober-pool
show prober-pool [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete prober-pool [name]
Note: You must remove all references to a prober-pool before you can delete the prober-pool.
Description
You can use the prober-pool component to congure prober pool denitions on the Global Trafc Manager.
You use prober pools to control which BIG-IP servers on your network are utilized by GTM to monitor the
up/down state of GTM resources. Once dened, prober pools can be set to monitor whole data centers or
individual servers.
Examples
create prober-pool my_pool members add { bigip-dallas bigip-london }
Creates a Global Trafc Manager prober pool with two members bigip-dallas and bigip-london. Members
are selected using the global-availability load balancing method.
delete prober-pool my_pool
Deletes the prober pool my_pool.
show prober-pool
Displays statistics for all prober pools.
list prober-pool my_pool
Displays settings of prober pool my_pool.
Options
• app-service
Species the name of the application service to which this prober pool belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete this prober pool. Only the application service can modify or delete this prober
pool.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• load-balancing-mode
555
Traffic Management Shell (tmsh) Reference Guide
Species the load balancing mode that the system uses to select members of this pool. The default value
is global-availability.
The options are:
• global-availability
Species that the Global Trafc Manager selects the rst available pool member in the order in
which they are listed.
• round-robin
Species that the Global Trafc Manager selects members using a circular, sequential pattern among
available pool members.
• members
Species the BIG-IP server names of the pool members. The default value is none.
You can also use the following options with prober pool members:
• app-service
Species the name of the application service to which this prober pool member belongs. The default
value is none. Note: If the strict-updates option is enabled on the application service that owns the
object, you cannot modify or delete this prober pool member. Only the application service can modify
or delete this prober pool member.
• description
User dened description.
• [enabled | disabled]
Species whether this pool member is available to issue probes. The default value is enabled.
• order
Species the order number of the pool member. The system uses this number with load balancing
methods that involve prioritizing pool members by listed order.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, gtm server, gtm datacenter, list, modify, regex, reset-stats, show, tmsh
region
Congures a Global Trafc Manager(tm) region.
Syntax
Congure the region component within the gtm module using the syntax shown in the following sections.
556
GTM
Create/Modify
create region [name]
modify region [name]
app-service [[string] | none]
description [string]
[name]
region-members
app-service [[string] | none]
continent [Africa | Antarctica | Asia | Australia | Europe
| North America | South America | unknown]
country [two-letter abbreviation of country name]
datacenter [name]
geoip-isp [name]
isp [AOL | BeijingCNC | CNC | ChinaTelecom | Comcast | Earthlink
| ShanghaiCNC | ShanghaiTelecom]
not [continent | country | datacenter | isp | pool | region-name
| subnet]
pool [name]
region-name [name]
state [name]
subnet
edit region [ [ [name] | [glob] | [regex] ] ... ]
all-properties
Display
list region
list region [ [ [name] | [glob] | [regex] ] ... ]
show running-config region
show running-config region [ [ [name] | [glob] | [regex] ] ... ]
all-properties
one-line
Delete
delete region [name]
Description
You can use the region component to create, display, modify, or delete a region. A region is a customized
collection of topologies with which you can extend the topology functionality by dening specic
geographical regions that have meaning for your network.
Examples
create region my_region continent Australia
Creates a region named my_region to populate with resources on the continent of Australia.
list region
Displays properties for all regions.
delete region my_region
Deletes the region named my_region.
557
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the region belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the region. Only the application service can modify or delete the region.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• region-members
Species the members that you want to add to, delete from, replace-all-with, or modify for this region.
You can specify the following options for region members:
• app-service
Species the name of the application service to which the region member belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the region member. Only the application service can modify or delete
the region member.
• continent
Species the name of a continent.
• country
Species the two-letter abbreviation of a country. Use the command completion feature to view the
numerous options.
• datacenter
Species the name of an existing data center.
• geoip-isp
An ISP whose IP Address allocation range should be used in matching topologies. Any ISP string
may be given as long as it matches the string in the GeoIP-ISP Database. Case is irrelevent.
• isp
Species the name of an Internet service provider.
• not
Species region-members to exclude from this region.
• pool
Species the name of an existing pool.
• region-name
Species the name of an existing region.
558
GTM
• state
Species the name of an existing state.
• subnet
Species an existing subnet.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
rule
Opens an editor in which you can congure iRules(r) for trafc management system conguration.
Syntax
Congure the rule component within the gtm module using the syntax shown in the following sections.
Create/Modify
create rule [name]
modify rule [name]
option:
metadata
[add | delete | modify] {
[metadata_name] {
value [ "value content" ]
persist [ true | false ]
}
}
edit rule [ [ [name] | [glob] | [regex] ] ... ]
Display
list rule
list rule [ [ [name] | [glob] | [regex] ] ... ]
show running-config rule
show running-config rule [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show rule
show rule [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete rule [name]
559
Traffic Management Shell (tmsh) Reference Guide
Note: You can also delete metadata associated with an iRule. See the example section for detail.
Description
You can use iRules to direct trafc not only to specic pools, but also to individual pool members, including
port numbers and URI paths, either to implement persistence or to meet specic load balancing requirements.
The syntax that you use to write iRules is based on the Tools Command Language (TcL) programming
standard. Thus, you can use many of the standard TcL commands, plus a robust set of extensions that the
BIG-IP(r) local trafc management system provides to help you further increase load balancing efciency.
For information about standard TcL syntax, see http://tmml.sourceforge.net/doc/tcl/index.html. For a
list of TcL commands that have been disabled within the trafc management system and therefore cannot
be used in the trafc management system, see the Conguration Guide for BIG-IP(r) Local Trafc
Management(r). This guide is available at https://support.f5.com.
Examples
edit rule my_irule
Opens the vi editor in which you can edit the iRule named my_irule. Note that after you close the editor,
you must run the command sequence save cong to save the conguration changes to the stored conguration
les.
The following are example iRules for the Global Trafc Manager(tm).
when DNS_REQUEST { if {[IP::addr [IP::remote_addr]/24 equals 10.10.1.0/24] } {cname
cname.siterequest.com } else { host 10.20.20.20}}
Species that requests from 10.10.1.0/24 be directed to cname.siterequest.com, and all other requests be
directed to 10.20.20.20.
when DNS_REQUEST { if {[whereis [IP::remote_addr]] contains "Asia"} {pool asia_pool} else {pool
general_pool}}
Species that requests that originate in Asia be directed to the pool named asia_pool, and that all other
requests be directed to the pool named general_pool.
metadata is the user dened key/value pair
Adds new metadata to named my_meta and modies existing metadata named my_meta2 for the iRule
named my_irule.
modify rule my_irule { when DNS_REQUEST {} metadata replace-all-with { my_meta { persist false
value "hello" } my_meta2 { persist false value "hello 2" } } }
Deletes metadata named my_meta from the iRule named my_irule.
modify rule my_irule { when RULE_INIT {} denition-checksum 7c0dba9aa53e8959042c6cfe041d3d11
metadata delete { my_meta } }
Options
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• metadata
Species a user-dened key/value pair.
• name
Species a unique name for the component. This option is required.
560
GTM
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
edit, glob, list, regex, show, tmsh
server
Congures servers for the Global Trafc Manager(tm).
Syntax
Congure the server component within the gtm module using the syntax shown in the following sections.
Create/Modify
create server [name]
modify server [name]
addresses none
addresses
[add | delete | replace-all-with] {
[ip address] {
app-service [[string] | none]
device-name [none | [name] ]
translation [ip address]
explicit-link-name [none | [name] ]
}
}
app-service [[string] | none]
datacenter
datacenter [name]
description [string]
[disabled | enabled]
expose-route-domains [no | yes]
iq-allow-path [no | yes]
iq-allow-service-check [no | yes]
iq-allow-snmp [no | yes]
limit-cpu-usage [integer]
limit-cpu-usage-status [disabled | enabled]
limit-mem-avail [integer]
limit-mem-avail-status [disabled | enabled]
limit-max-bps [integer]
limit-max-bps-status [disabled | enabled]
limit-max-connections [integer]
limit-max-connections-status [disabled | enabled]
limit-max-pps [integer]
limit-max-pps-status [disabled | enabled]
link-discovery [disabled | enabled]
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
monitor [none | [name] [and [name] ]... ]
561
Traffic Management Shell (tmsh) Reference Guide
monitor min [integer] of { [name]... }
prober-pool [none | name]
product [name]
virtual-server-discovery [disabled | enabled]
virtual-servers none
virtual-servers
[add | delete | replace-all-with] {
[vs-name] {
app-service [[string] | none]
depends-on none
depends-on
[add | delete | replace-all-with] {
[server_name:vs-name]...
}
description [string]
destination [ipv4_address:port | ipv6_address.port]
[disabled | enabled]
explicit-link-name [none | [name] ]
limit-max-bps [integer]
limit-max-bps-status [disabled | enabled]
limit-max-connections [integer]
limit-max-connections-status [disabled | enabled]
limit-max-pps [integer]
limit-max-pps-status [disabled | enabled]
ltm-name [name]
monitor [none | [name] [and [name] ]... ]
monitor min [integer] of { [name]... }
translation-address [ip address]
translation-port [ [integer] | [name] ]
}
}
edit server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
reset-stats server
reset-stats server [ [ [name] | [glob] | [regex] ] ... ]
Display
list server
list server [ [ [name] | [glob] | [regex] ] ... ]
show running-config server
show running-config server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
partition
show server
show server [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete server [name]
562
GTM
Description
You can use the server component to congure a Global Trafc Manager server.
Examples
create server my_server addresses add {10.10.1.1} datacenter my_datacenter
Creates a server named my_server in my_datacenter with a self IP address of 10.10.1.1.
modify server my_server virtual-servers add {myVs { address 10.10.10.2:80 } }
Adds the virtual server myVs with an IP address of 10.10.10.2:80 as a resource to the server named
my_server.
list server non-default-properties
Displays all non-default properties for all servers.
delete server my_server
Deletes the server named my_server.
show server my_server detail
Shows the link associated with each server IP address for my_server.
show server all detail
Shows the link assignments for all servers in the system.
show server my_server virtual-servers
Shows the regular server information as well as any virtuals on my_server. The link associated with a virtual
server is displayed, or --- is shown to indicate that the virtual is not using a congured link.
Options
• addresses
Species the server IP addresses for the server. This option is required for the command create. You
can also specify the following options:
• app-service
Species the name of the application service to which the self IP address belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the self IP address. Only the application service can modify or delete
the self IP address.
• device-name
Species the name of this system in a redundant pair. The default value is the server name.
• explicit-link-name
Species the explicit link name for the server. The default value is none.
• translation
Species the internal IP address that corresponds to the external IP address of this server. The default
value is ::.
• app-service
Species the name of the application service to which the server belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the server. Only the application service can modify or delete the server.
• datacenter
563
Traffic Management Shell (tmsh) Reference Guide
Species the data center to which the server belongs. This option is required for the command create.
• description
User dened description.
• detail
The detail option is used with the show display command. This shows the link associated with each
server IP address. Only the server IP addresses that have an associated link are displayed. If this server
is not using any links, no link assignment information is printed. By default, links are automatically
matched to server IP addresses according to their IP addresses. Explicit links may also be dened. How
this link was assigned is displayed in the Link Assignment column: auto means that the system
automatically assigned this link, and explicit means that the link was explicitly set by the user.
• [disabled | enabled]
Enables or disables the server. The default value is enabled.
• expose-route-domains
Allow the GTM server to auto-discover LTM virtual servers from all route domains. The default value
is no.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• iq-allow-path
Species whether the Global Trafc Manager uses this BIG-IP(r) system to conduct a path probe before
delegating trafc to it. The default value is yes.
• iq-allow-service-check
Species whether the Global Trafc Manager uses this BIG-IP system to conduct a service check probe
before delegating trafc to it. The default value is yes.
• iq-allow-snmp
Species whether the Global Trafc Manager uses this BIG-IP system to conduct an SNMP probe before
delegating trafc to it. The default value is yes.
• limit-cpu-usage
For a server congured as a generic host, species the percent of CPU usage, otherwise has no effect.
If percent of CPU usage goes above the limit, the system marks the server as unavailable.
• limit-cpu-usage-status
Enables or disables the limit-cpu-usage option for this server. Only has an effect on a server congured
as a generic host. The default value is disabled.
• limit-mem-avail
For a server congured as a generic host, species the available memory required by the virtual servers
on the server. If available memory falls below this limit, the system marks the server as unavailable.
• limit-mem-avail-status
Enables or disables the limit-mem-avail option for this server. Only used on a server congured as a
generic host. The default value is disabled.
• limit-max-bps
Species the maximum allowable data throughput rate, in bits per second, for this server. If the network
trafc volume exceeds this limit, the system marks the server as unavailable.
• limit-max-bps-status
Enables or disables the limit-max-bps option for this server. The default value is disabled.
564
GTM
• limit-max-connections
Species the maximum number of concurrent connections, combined, for this server. If the connections
exceed this limit, the system marks the server as unavailable.
• limit-max-connections-status
Enables or disables the limit-max-connections option for this server. The default value is disabled.
• limit-max-pps
Species the maximum allowable data transfer rate, in packets per second, for this server. If the network
trafc volume exceeds this limit, the system marks the server as unavailable.
• limit-max-pps-status
Enables or disables the limit-max-pps option for this server. The default value is disabled.
• link-discovery
Species whether the system auto-discovers the links for this server. The default value is disabled. The
options are:
• disabled
Species that the system does not auto-discover the links that are available for the server.
• enabled
Species that the system auto-discovers the links that are congured on the server. With this option,
the system automatically adds, deletes, and modies link settings in the conguration.
• enabled-no-delete
Species that the system auto-discovers the links that are congured on the server. With this option,
the system automatically adds and modies link settings in the conguration, but does not delete
them. This option is useful when you regularly take links in and out of service.
• metadata
Species user-dened data to associate with a server. By default the persist attribute is set to true.
This means the data is saved into the conguration le.
• monitor
Species the health monitors that the system uses to determine whether this server is available for load
balancing. Multiple monitors may be specied with the and keyword. The min keyword is used to
specify the minimum number of monitors that must succeed for this server to be declared up.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the object resides.
• prober-pool
Species the name of a prober pool to use to monitor this server's resources. If this value is specied,
it overrides any prober pool set on this server's data center. The default value is none.
• product
Species the server type. The server type determines the metrics that the system can collect from the
server. Use the command completion feature to view the types of servers that are available.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
565
Traffic Management Shell (tmsh) Reference Guide
• virtual-server-discovery
Species whether the system auto-discovers the virtual servers for this server. The default value is
disabled. The options are:
• disabled
Species that the system does not auto-discover the virtual servers that are congured on the server.
With this option, you must congure the virtual servers for this server.
• enabled
Species that the system auto-discovers the virtual servers that are congured on the server. With
this option, the system automatically adds, deletes, and modies virtual server settings in the
conguration.
• enabled-no-delete
Species that the system auto-discovers the virtual servers that are congured on the server. With
this option, the system automatically adds and modies virtual server settings in the conguration,
but does not delete them. This option is useful when you regularly take virtual servers in and out of
service.
• virtual-servers
Species the name of the virtual servers that are resources for this server. You can include the following
options for virtual servers.
• app-service
Species the name of the application service to which the virtual server belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the virtual server. Only the application service can modify or delete the
virtual server.
• depends-on
Species the vs-name of the server on which this virtual server depends.
• description
User dened description.
• destination
Species the IP address and port of the virtual server.
• [disabled | enabled]
Species whether this virtual server is available for load balancing. The default value is enabled.
• explicit-link-name
Species the explicit link name for the virtual server. The default value is none.
• limit-max-bps
Species the maximum allowable data throughput rate, in bits per second, for this virtual server. If
the network trafc volume exceeds this value, the system marks the virtual server as unavailable.
The default value is 0 (zero).
• limit-max-bps-status
Enables or disables the limit-max-bps option for this virtual server. The default value is disabled.
• limit-max-connections
Species the number of current connections allowed for this virtual server. If the current connections
exceed this value, the system marks this virtual server as unavailable. The default value is 0 (zero).
• limit-max-connections-status
566
GTM
Enables or disables the limit-max-connections option for this virtual server. The default value is
disabled.
• limit-max-pps
Species the maximum allowable data transfer rate, in packets per second, for this virtual server. If
the network trafc volume exceeds this limit, the system marks the virtual server as unavailable.
The default value is 0 (zero).
• limit-max-pps-status
Enables or disables the limit-max-pps option for this virtual server. The default value is disabled.
• ltm-name
The virtual server name found on the LTM. Useful for differentiating between virtuals with same
IP and port, but different protocols. The ltm-name used in probe requests.
• monitor
Species the monitor you want to assign to this virtual server. Multiple monitors may be specied
with the and keyword. The min keyword is used to specify the minimum number of monitors that
must succeed for this server to be declared up. The default value is none.
• translation-address
Species the public address that this virtual server translates into when the Global Trafc Manager
communicates between the network and the Internet. The default value is ::.
• translation-port
Species the translation port number or service name for the virtual server, if necessary. The default
value is 0.
See Also
create, delete, edit, glob, gtm datacenter, gtm link, gtm prober-pool, list, modify, regex, reset-stats, show,
tmsh
topology
Congures a topology statement.
Syntax
Congure the topology component within the gtm module using the syntax shown in the following sections.
Create
create topology
app-service [[string] | none]
description [string]
ldns: [continent | country | geoip-isp | isp | not | region-name | state
| subnet]
server: [continent | country | datacenter | geoip-isp | isp | not | pool
|
567
Traffic Management Shell (tmsh) Reference Guide
region-name | state | subnet]
score [integer]
edit topology [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list topology
list topology [ [name] | [glob] | [regex] ] ... ]
show running-config topology
show running-config topology [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete topology all
delete topology
[ldns: [identifier] [value] server: [identifier] [value] ]
Description
You can use the topology component to congure a topology statement. A topology statement is a set of
characteristics that identify the origin of a given name resolution request.
Examples
create topology ldns: country US server: datacenter DC1 score 30
Creates a topology statement that species that the Global Trafc Manager routes any trafc coming from
the United States to the datacenter named DC1. Note that the weight of this topology item for load balancing
is 30.
delete topology ldns: country US server: datacenter DC1
Deletes the topology statement mentioned in the previous example.
Options
• app-service
Species the name of the application service to which the topology belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the topology. Only the application service can modify or delete the topology.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ldns:
568
GTM
Species the criteria that the Global Trafc Manager uses when matching requests from LDNS servers.
• continent
A continent whose IP address allocation range should be used in matching topologies
• country
A country whose IP address allocation range should be used in matching topologies
• datacenter
A data center to be used in matching topologies
• geoip-isp
An ISP whose IP Address allocation range should be used in matching topologies. Any ISP string
may be given as long as it matches the string in the GeoIP-ISP Database. Case is irrelevent.
• isp
An ISP whose IP address allocation range should be used in matching topologies
• not
Specify a region member to exclude from the region
• pool
A pool to be used in matching topologies
• region
Another region to be used in matching topologies
• state
A state whose IP address allocation range should be used in matching topologies
• subnet
A subnet to be used in matching topologies
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• score
Species the weight of the topology item.
• server:
Species the server to which the Global Trafc Manager routes requests.
• continent
A continent whose IP address allocation range should be used as an LDNS routing destination
• country
A country whose IP address allocation range should be used as an LDNS routing destination
• datacenter
A data center to be used as an LDNS routing destination
• geoip-isp
An ISP whose IP Address allocation range should be used in matching topologies. Any ISP string
may be given as long as it matches the string in the GeoIP-ISP Database. Case is irrelevent.
• isp
569
Traffic Management Shell (tmsh) Reference Guide
An ISP whose IP address allocation range should be used as an LDNS routing destination
• not
Specify an item to exclude from the group
• pool
A pool to be used as an LDNS routing destination
• region
Another region to be used as an LDNS routing destination
• state
A state whose IP address allocation range be used as an LDNS routing destination
• subnet
A subnet to be used as an LDNS routing destination
See Also
create, delete, edit, glob, gtm server, list, regex, show, tmsh,
traffic
Displays trafc statistics for the Global Trafc Manager(tm).
Syntax
Congure the trafc component within the gtm module using the syntax in the following section.
Display
show traffic
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the trafc component to display trafc statistics, including those for IPv4 and IPv6 requests,
current Local Domain Name System (LDNS) servers, and current paths.
See Also
show, sys tmm-trafc, tmsh
570
GTM
GTM Global Settings
general
Congures the general settings for the Global Trafc Manager.
Syntax
Modify or display the general component within the gtm global-settings module using the syntax in the
following sections.
Modify
modify general
automatic-configuration-save-timeout [integer]
auto-discovery [no | yes]
auto-discovery-interval [integer]
cache-ldns-servers [no | yes]
domain-name-check [allow-underscore | idn-compatible | none
| strict]
drain-persistent-requests [no | yes]
forward-status [enable | disable]
gtm-sets-recursion [no | yes]
heartbeat-interval [integer]
monitor-disabled-objects [no | yes]
nethsm-timeout [integer]
peer-leader [name]
send-wildcard-rrs [enable | disable]
static-persist-cidr-ipv4 [integer]
static-persist-cidr-ipv6 [integer]
synchronization [no | yes]
synchronization-group-name [name]
synchronization-time-tolerance [integer]
synchronization-timeout [integer]
synchronize-zone-files [no | yes]
synchronize-zone-files-timeout [integer]
topology-allow-zero-scores [no | yes]
virtuals-depend-on-server-state [no | yes]
edit general
all-properties
non-default-properties
one-line
Display
list
list general
show running-config general
show running-config general [option name]
all-properties
non-default-properties
Description
You can use the general component to modify or display the General Trafc Manager settings.
Examples
modify general auto-discovery no
Turns off auto-discovery for the Global Trafc Manager.
list general all-properties
Displays all properties of the general settings for the Global Trafc Manager.
Options
• automatic-conguration-save-timeout
Sets the timeout, in seconds, indicating how long to wait after a GTM conguration change before
automatically saving the GTM conguration to the bigip_gtm.conf. A timeout of -1 will cause the GTM
conguration to NEVER be saved. A value of 0 will cause the GTM conguration to be saved
immediately. The default value is 15 seconds.
• auto-discovery
Species whether the auto-discovery process is activated for this system. The default value is no.
• auto-discovery-interval
Species the frequency, in seconds, between system attempts to discover network components. The
default value is 30.
• cache-ldns-servers
Species whether the system retains, in cache, all local DNS servers that make requests. The default
value is yes.
You must enable this option if you want the system to store and use the LDNS path information.
• domain-name-check
Species the parameters for the Global Trafc Manager to use when performing domain name checking.
The default value is strict.
The possible values are:
• allow-underscore
Underscores are allowed in domain names.
• idn-compatible
International domain names are allowed.
• none
Domain names are not allowed.
• strict
The Global Trafc Manager checks domain names according to the specications in RFC 1123
Requirements for Internet Hosts - Application and Support.
• drain-persistent-requests
572
GTM Global Settings
Species, when set to yes, that when you disable a pool, load-balanced, persistent connections remain
connected until the TTL expires. The default value is yes. If you set this option to no, any persistent
connections terminate immediately when a pool is disabled.
• forward-status Species, when set to enabled, that the availability status change for GTM objects will
be shared with subscribers. This option will enable iControl clients to receive event notications when
a change occurs.
• gtm-sets-recursion
Species, when set to yes, that the system enables recursive DNS queries, regardless of whether the
requesting local DNS enabled recursive queries. The default value is no.
• heartbeat-interval
Species the frequency at which the Global Trafc Manager queries other BIG-IP(r) systems for updated
data. When conguring monitors for BIG-IP systems, F5 Networks recommends that the probe-interval
option for the monitor be equal to or greater than the this option. The default value is 10.
• monitor-disabled-objects
Species, when set to yes, that the system will continue to monitor objects even if the objects are disabled.
The default value is no.
• nethsm-timeout
Time to wait on a NetHSM key creation operation for DNSSEC before retry. Default is 20 seconds.
• peer-leader
Species the name of a GTM server to be used for executing certain features, such as creating DNSSEC
keys.
• send-wildcard-rrs
Species, when set to enable, that WideIPs or WideIP aliases that contain wildcards will autogenerate
Resource Records in the BIND database. The default value is disable.
• static-persist-cidr-ipv4
Species the number of bits of the IPv4 address that the system considers when using the Static Persist
load balancing mode. The default value is 32.
• static-persist-cidr-ipv46
Species the number of bits of the IPv6 address that the system considers when using the Static Persist
load balancing mode. The default value is 128.
• synchronization
Species whether this system is a member of a synchronization group. The default value is no.
Members of the synchronization group continuously share conguration and metrics collection
information. The synchronization group can contain Global Trafc Managers and Link Controllers.
• synchronization-group-name
Species the name of the synchronization group to which the system belongs. The default name is
default.
• synchronization-time-tolerance
Species the number of seconds that one system clock can be out of sync with another system clock, in
the synchronization group. If the variance between the clock times is higher than the value of this option,
the system resets the clock that is running behind to match the clock with the most recent time.
Possible values are 0 (zero), and 5 - 600. (Values 1 through 4 are automatically set to 5, and 0 (zero)
turns time synchronization off.) The default value is 10 seconds.
573
Traffic Management Shell (tmsh) Reference Guide
Note: If you are using NTP to synchronize the clock with a time server, select a time tolerance other
than 0 (zero). When you do this, the system uses the synchronization-time-tolerance option as a fail-over
mechanism if NTP is disabled for any reason.
• synchronization-timeout
Species the number of seconds that the system attempts to synchronize the Global Trafc Manager
conguration with a synchronization group member. If the synchronization times out, the system tries
again. The default value is 180.
• synchronize-zone-les
Species whether the system synchronizes zone les among the synchronization group members. The
default value is no.
• synchronize-zone-les-timeout
Species the number of seconds that a synchronization group member attempts to synchronize its zone
les with a synchronization group member. If the synchronization times out, the system tries again. The
default value is 300.
• topology-allow-zero-scores
Species if topology load-balancing or QoS load-balancing with topology enabled will return pool
members with zero topology scores. The default value is yes.
• virtuals-depend-on-server-state
Species whether the system marks a virtual server down when the server on which the virtual server
is congured can no longer be reached via iQuery. The default value is yes.
See Also
edit, gtm global-settings load-balancing, gtm global-settings metrics, gtm global-settings metrics-exclusions,
list, modify, show, tmsh
load-balancing
Congures the load balancing settings for the Global Trafc Manager(tm).
Syntax
Modify or display the load-balancing component within the gtm global-settings module using the syntax
in the following sections.
Modify
modify load-balancing
failure-rcode [noerror | formerr | servfail | nxdomain | notimpl | refused]
failure-rcode-ttl [integer]
failure-rcode-response [disabled | enabled]
ignore-path-ttl [no | yes]
respect-fallback-dependency [no | yes]
574
GTM Global Settings
topology-longest-match [no | yes]
verify-vs-availability [no | yes]
edit load-balancing
all-properties
non-default-properties
Display
list
list load-balancing
show running-config load-balancing
show running-config load-balancing [option]
all-properties
non-default-properties
one-line
Description
You can use the load-balancing component to modify or display the load balancing settings for the Global
Trafc Manager.
Examples
modify load-balancing ignore-path-ttl yes
Species that dynamic load balancing methods can use path data, even after the time-to-live (TTL) for the
path data expires.
list load-balancing all-properties
Displays all properties of the load balancing settings for the Global Trafc Manager.
Options
• failure-rcode
Species the DNS RCODE used when failure-rcode-response is enabled. Default is noerror. Options
include noerror (no type exists at this name), formerr (format error in query), servfail (unable to
process query), nxdomain (name does not exist), notimpl (no support for this kind of query), and
refused (refuse to process based on policy). If failure-rcode-ttl is non-zero, only the Authority section
of the noerror or nxdomain response will include a SOA record.
• failure-rcode-response
When enabled, species that the system returns a RCODE response to Wide IP requests after exhausting
all load-balancing methods. This affects all Wide IPs and may only be overridden by a more specic
enabled conguration of a Wide IP. This response is an authoritative empty answer from the system
for record requests. With this option enabled, the system responds faster to requests for which it does
not have viable answers congured. The default value is disabled.
• failure-rcode-ttl
Species the negative caching TTL of the SOA for the RCODE response. The default is 0, meaning no
SOA is included (i.e. no caching).
• ignore-path-ttl
Species, when set to yes, that dynamic load balancing methods can use path data, even after the
time-to-live (TTL) for the path data expires. The default value is no.
575
Traffic Management Shell (tmsh) Reference Guide
• respect-fallback-dependency
Species, when set to yes, that the system accepts virtual server status when the load balancing mode
changes to the mode specied by the fallback-mode option of the pool. The default value is no.
• topology-longest-match
Species, when set to yes, that the system evaluates all topology records in the topology statement, and
then selects the topology record that most specically matches the IP address in an LDNS request (in
other words, has the longest match). When this option is set to no, the system selects the rst record in
the topology statement that matches the request.
• verify-vs-availability
Species, when set to yes, that the system checks the availability of virtual servers before sending a
connection to those virtual servers. The default value is no.
See Also
edit, gtm global-settings general, gtm global-settings metrics, gtm global-settings metrics-exclusions, list,
modify, show, tmsh
metrics
Congures metrics for the Global Trafc Manager(tm).
Syntax
Modify or display the metrics component within the gtm global-settings module using the syntax in the
following sections.
Modify
modify metrics
default-probe-limit [integer]
hops-ttl [integer]
hops-packet-length [integer]
hops-sample-count [integer]
hops-timeout [integer]
inactive-ldns-ttl [integer]
ldns-update-interval [integer]
inactive-paths-ttl [integer]
max-synchronous-monitor-requests [integer]
metrics-caching [integer]
metrics-collection-protocols none
metrics-collection-protocols
[add | delete | replace-all-with] {
[dns-dot | dns-rev | icmp | tcp | udp] ...
}
path-ttl [integer]
paths-retry [integer]
edit metrics
all-properties
non-default-properties
one-line
576
GTM Global Settings
Display
list
list metrics
show running-config metrics
show running-config metrics [option]
all-properties
non-default-properties
Description
You can use the metrics component to modify or display the Global Trafc Manager metrics settings.
Examples
modify metrics default-probe-limit 10
Sets the default probe limit for the Global Trafc Manager to 10.
list metrics all-properties
Displays all properties of the metrics settings for the Global Trafc Manager.
Options
• default-probe-limit
Species the number of probe attempts that the system performs before removing the path from the
metrics. The default value is 12.
• hops-ttl
Species the number of seconds that the system considers traceroute utility data to be valid for name
resolution and load balancing. The default value is 604800. Note that this option must be greater than
the hops-timeout option.
• hops-packet-length
Species the length of packets, in bytes, that the system sends to a local DNS server to determine the
path information between the two systems. Valid values are 64 - 500. The default value is 64.
• hops-sample-count
Species the number of packets that the system sends to a local DNS server to determine the path
information between those two systems. Valid values are 1 - 10. The default value is 3.
• hops-timeout
Species the number of seconds that the big3d daemon waits for a probe. Valid values are 1 - 10. The
default value is 3.
• inactive-ldns-ttl
Species the number of seconds that an inactive LDNS remains in the cache. Each time an LDNS makes
a request, the clock starts again. Valid values are 60 - 31536000 (1 year). The default value is 2419200
(28 days).
• ldns-update-interval
Species the number of seconds that a tmm will wait before sending an update for a LDNS which has
been accessed. The default value is 20 seconds.
• inactive-paths-ttl
Species the number of seconds that a path remains in the cache after its last access. Valid values are
60 - 31536000 (1 year). The default value is 604800 (7 days).
577
Traffic Management Shell (tmsh) Reference Guide
• max-synchronous-monitor-requests
Species how many monitors can attempt to verify the availability of a given resource at the same time.
The default value is 20.
• metrics-caching
Species the interval (in seconds) at which the system dumps path and other metrics data. Valid values
are 0 through 604800. The default value is 3600; 0 (zero) turns this feature off.
• metrics-collection-protocols
Species the protocols that the system uses to collect metrics information relevant to LDNS servers.
• path-ttl
Species the number of seconds that the system considers path data to be valid for name resolution and
load balancing purposes. The default value is 2400. Note that this option must be greater than the
paths-retry option and less than or equal to 2419200 (28 days).
• paths-retry
Species the interval (in seconds) at which the system retries the path data. Valid values are 1 - 600 (10
minutes). The default value is 120.
See Also
edit, gtm global-settings general, gtm global-settings load-balancing, gtm global-settings metrics-exclusions,
list, modify, show, tmsh
metrics-exclusions
Congures the IP addresses that you want to exclude from the Global Trafc Manager(tm) metrics.
Syntax
Modify or display the metrics-exclusions within the gtm global-settings module using the syntax in the
following sections.
Modify
modify metrics-exclusions
addresses [add | delete | none | replace-all-with] {
[ip address]...
}
edit metrics-exclusions
all-properties
Display
list
list metrics-exclusions
show running-config metrics-exclusions
addresses
578
GTM Global Settings
all-properties
one-line
Description
You can use the metrics-exclusions component to exclude IP addresses from the Global Trafc Manager
metrics.
Examples
modify metrics-exclusions addresses add {10.10.10.1}
Excludes the IP address 10.10.10.1 from inclusion in the Global Trafc Manager metrics.
list metrics-exclusions
Displays the IP addresses that are excluded from the Global Trafc Manager metrics.
Options
• ip address
Species the IP addresses that you want to add to or delete from the exclusion list, or with which you
want to replace all existing IP addresses that are currently on the exclusion list.
See Also
edit, gtm global-settings general, gtm global-settings load-balancing, gtm global-settings metrics, list,
modify, show, tmsh
579
Traffic Management Shell (tmsh) Reference Guide
GTM Monitor
bigip
Congures a BIG-IP(r) monitor.
Syntax
Congure the bigip component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create bigip [name]
modify bigip [name]
aggregate-dynamic-ratios [average-members | average-nodes | none |
sum-members | sum-nodes]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
timeout [integer]
edit bigip [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default properties
Display
list bigip
list bigip [ [name] | [glob] | [regex] ] ... ]
show running-config bigip
show running-config bigip [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete bigip [name]
Note: You cannot delete default monitors.
Description
You can use the bigip component in the gtm monitor module to congure a custom monitor, or you can
use the default BIG-IP(r) monitor that the Global Trafc Manager(tm) provides. The BIG-IP monitor is
both a health and performance monitor. This type of monitor acquires data captured through monitors
managed by a BIG-IP Local Trafc Manager(tm).
You can monitor only the following components with a BIG-IP monitor:
• Global Trafc Manager server
• Global Trafc Manager virtual server
• Local Trafc Manager server
• Local Trafc Manager virtual server
Examples
create bigip my_bigip defaults-from bigip
Creates a monitor named my_bigip that inherits properties from the default BIG-IP monitor.
list bigip
Displays the properties of all of the BIG-IP monitors.
Options
• aggregate-dynamic-ratios
Species the monitor's response to a query. By default, the BIG-IP monitor uses the gtm_score value
as the vs_score for a Local Trafc Manager virtual server.
You can use this option to override the default behavior using the following values:
• average-members
Species that the monitor uses the average of the dynamic ratio values of the pool members associated
with the pools that are associated with the virtual server as a response to a query.
• average-nodes
Species that the monitor uses the average value of all of the nodes associated with the pool members
that are associated with the pools that are associated with the virtual server as a response to a query.
• none
This is the default value.
• sum-members
Species that the monitor uses the sum of the pool members as a response to a query.
• sum-nodes
Species that the monitor uses the sum of the dynamic ratios of all of the nodes as a response to a
query.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is bigip.
582
GTM Monitor
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a virtual server.
• *:port
Species to perform a health check on the virtual server with the IP address supplied by the virtual
server and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the virtual server at the IP
address and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 90 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, gtm pool, gtm server, list, modify, regex, show, tmsh
583
Traffic Management Shell (tmsh) Reference Guide
bigip-link
Congures a BIG-IP(r) Link monitor.
Syntax
Congure the bigip-link component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create bigip-link [name]
modify bigip-link [name]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address]
ignore-down-response [enabled | disabled]
interval [integer]
timeout [integer]
edit bigip-link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list bigip-link
list bigip-link [ [ [name] | [glob] | [regex] ] ... ]
show running-config bigip-link
show running-config bigip-link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete bigip-link [name]
Note: You cannot delete default monitors.
Description
You can use the bigip-link component to congure a custom monitor, or you can use the default BIG-IP
Link monitor that the Global Trafc Manager provides. This type of monitor acquires data captured through
monitors managed by a BIG-IP Link Controller.
Examples
create bigip-link my_bigip-link defaults-from bigip_link
584
GTM Monitor
Creates a monitor named my_bigip-link that inherits properties from the default BIG-IP Link monitor.
list bigip-link
Displays the properties of all of the BIG-IP Link monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is bigip_link.
• description
User dened description.
• destination
Species the IP address of the resource that is the destination of this monitor. The default value is *.
Possible values are:
• *
Species to perform a health check on the IP address of the node.
• IP address
Species to perform a health check on the IP address that you specify, route the check through the
IP address of the associated node, and mark the IP address of the associated node up or down
accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
585
Traffic Management Shell (tmsh) Reference Guide
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 30 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, gtm link, list, ltm node, modify, regex, show, tmsh,
external
Congures an external monitor.
Syntax
Congure the external component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create external [name]
modify external [name]
args [ [arguments] | none]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
probe-timeout [integer]
run [none | [path] ]
timeout [integer]
user-defined [ [name] [value] | [name] none ]
edit external [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list external
list external [ [ [name] | [glob] | [regex] ] ... ]
show running-config external
show running-config external [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
586
GTM Monitor
Delete
delete external [name]
Note: You cannot delete default monitors.
Description
You can use the external component to congure a custom monitor, or you can use the default external
monitor that the Global Trafc Manager provides. You can use this type of monitor to monitor services
using your own programs.
Examples
create external my_external defaults-from external
Creates a monitor named my_external that inherits properties from the default external monitor.
list external
Displays the properties of all of the external monitors.
Options
• args
Species any command-line arguments that the external program requires. The default value is none.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is external.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
587
Traffic Management Shell (tmsh) Reference Guide
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• run
Species the path and le name of a program to run as the external monitor, for example
/cong/monitors/myMonitor. The default value is none.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• user-dened
Species any user-dened command-line arguments and variables that the external program requires.
Use the following syntax to specify a user dened parameter.
modify external my_external user-dened my_param_name my_param_value
Use the following syntax to remove a user dened parameter.
modify external my_external user-dened my_param_name none
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh,
firepass
Congures a FirePass(r) monitor.
Syntax
Congure the repass component within the gtm monitor module using the syntax in the following sections.
588
GTM Monitor
Create/Modify
create firepass [name]
modify firepass [name]
app-service [[string] | none]
cipherlist [list]
concurrency-limit [integer]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
max-load-average [floating point value]
password [none | [password] ]
probe-timeout [integer]
timeout [integer]
username [name]
edit firepass [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list firepass
list firepass [ [ [name] | [glob] | [regex] ] ... ]
show running-config firepass
show running-config firepass [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete firepass [name]
Note: You cannot delete default monitors.
Description
You can use the repass component to congure a custom monitor, or you can use the default FirePass
monitor that the BIG-IP(r) Global Trafc Manager(tm) provides. The FirePass monitor is both a health and
performance monitor.
For more information about conguring monitors, refer to the Conguration Guide for BIG-IP(r) Global
Trafc Management.
Examples
create repass my_repass defaults-from repass_gtm
Creates a monitor named my_repass that inherits properties from the default FirePass monitor.
list repass
589
Traffic Management Shell (tmsh) Reference Guide
Displays the properties of all of the FirePass monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• cipherlist
Species the list of ciphers for this monitor. The default value is HIGH:!ADH.
• concurrency-limit
Species the maximum percentage of licensed connections currently in use under which the monitor
marks the FirePass system up. The default value is 95.
For example, a value of 95 percent means that the monitor marks the FirePass system up until 95 percent
of licensed connections are in use. When the number of in-use licensed connections exceeds 95 percent,
the monitor marks the FirePass system down.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is repass_gtm.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the address you
supply.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• max-load-average
Species the number that the monitor uses to mark the FirePass system up or down. The system compares
value of this option against a one-minute average of the FirePass system load. When the FirePass
590
GTM Monitor
system-load average falls within the specied value, the monitor marks the FirePass system up. When
the average exceeds the setting, the monitor marks the system down.
The default value is 12.0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password, if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 90 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is gtmuser.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
ftp
Congures a File Transfer Protocol (FTP) monitor.
Syntax
Congure the ftp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create ftp [name]
modify ftp [name]
debug [no | yes]
defaults-from [name]
description [string]
591
Traffic Management Shell (tmsh) Reference Guide
destination [ip address][port]
filename [ [filename] | none]
ignore-down-response [enabled | disabled]
interval [integer]
mode [passive | port]
password [none | [password] ]
probe-timeout [integer]
timeout [integer]
username [name]
edit ftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ftp
list ftp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ftp
show running-config ftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ftp [name]
Note: You cannot delete default monitors.
Description
You can use the ftp component to congure a custom monitor, or you can use the default FTP monitor that
the Global Trafc Manager provides. This type of monitor veries the FTP service by attempting to download
a specic le to the /var/tmp directory on the system. Once downloaded successfully, the le is not saved.
Examples
create ftp my_ftp defaults-from ftp
Creates a monitor named my_ftp that inherits properties from the default FTP monitor.
list ftp
Displays the properties of all of the FTP monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
592
GTM Monitor
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is ftp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lename
Species the full path and le name of the le that the system attempts to download. The health check
is successful if the system can download the le. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• mode
Species the data transfer process (DTP) mode. The default value is passive. The options are:
• passive
Species that the monitor sends a data transfer request to the FTP server. When the FTP server
receives the request, the FTP server then starts and establishes the data connection.
• port
Species that the monitor starts and establishes the data connection with the FTP server.
593
Traffic Management Shell (tmsh) Reference Guide
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• password
Species the password, if the monitored target requires authentication. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
gateway-icmp
Congures a Gateway Internet Control Message Protocol (ICMP) monitor.
Syntax
Congure the gateway-icmp component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create gateway-icmp [name]
modify gateway-icmp [name]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
probe-attempts [integer]
probe-interval [integer]
594
GTM Monitor
probe-timeout [integer]
timeout [integer]
transparent [enabled | disabled]
edit gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list gateway-icmp
list gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
show running-config gateway-icmp
show running-config gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete gateway-icmp [name]
Note: You cannot delete default monitors.
Description
You can use the gateway-icmp component to congure a custom monitor, or you can use the default
Gateway ICMP monitor that the Global Trafc Manager provides. You can use a Gateway ICMP type of
monitor for a virtual server, a server (that is, all of the virtuals on a specied server), a pool member, a pool
(that is, all of the pool members of a specied pool), or a link.
Examples
create gateway-icmp my_imcp defaults-from gateway_icmp
Creates a monitor named my_icmp that inherits properties from the default Gateway ICMP monitor.
list gateway-icmp
Displays the properties of all of the Gateway ICMP monitors.
Options
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is gateway_icmp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
595
Traffic Management Shell (tmsh) Reference Guide
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port specied in the monitor,
routing the check through the IP address and port supplied by the pool member. The pool member
(the gateway) is marked up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-attempts
Species the number of times the BIG-IP(r) system attempts to probe the host server, after which the
BIG-IP system considers the host server down or unavailable. The default value is 3 attempts.
• probe-interval
Species the frequency at which the BIG-IP system probes the host server. The default value is 1 second.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
596
GTM Monitor
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
See Also
create, delete, edit, glob, gtm link, gtm pool, gtm server, list, modify, regex, show, tmsh
gtp
Congures a GPRS Tunneling Protocol (GTP) monitor. This monitor operates over UDP.
Syntax
Congure the gtp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create gtp [name]
modify gtp [name]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
probe-attempts [integer]
probe-interval [integer]
probe-timeout [integer]
protocol-version [integer]
timeout [integer]
edit gtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list gtp
list gtp [ [ [name] | [glob] | [regex] ] ... ]
show running-config gtp
show running-config gtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
597
Traffic Management Shell (tmsh) Reference Guide
Delete
delete gtp [name]
Note: You cannot delete default monitors.
Description
You can use the gtp component to congure a custom monitor, or you can use the default GTP monitor
that the Global Trafc Manager provides. This type of monitor veries the GPRS tunneling service by
attempting to send GTP Echo Requests to a pool, pool member, or virtual server, and verifying the receipt
of a well-formed Echo Response packet. This monitor supports GTP version 1 and version 2 over UDP.
For more information about conguring monitors, refer to the Conguration Guide for BIG-IP(r) Global
Trafc Management.
Examples
create gtp my_gtp defaults-from gtp
Creates a monitor named my_gtp that inherits properties from the default GTP monitor.
list gtp
Displays the properties of all of the GTP monitors.
Options
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is gtp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. Possible
values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
598
GTM Monitor
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-attempts
Species the number of times the BIG-IP system attempts to probe the host server, after which the
BIG-IP system considers the host server down or unavailable. The default value is 3.
• probe-interval
Species the frequency at which the BIG-IP system probes the host server. The default value is 1.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• protocol-version
Species the GTP protocol version used to perform the exchange. GTP version 1 and GTP version 2
are supported. The default is version 1.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds. If the target responds within the set time period, it is considered up. If the target
does not respond within the set time period, it is considered down. Also, if the target responds with a
non-conforming Echo Reply, the system immediately ags the target as down without waiting for the
timeout interval to expire.
See Also
create, delete, edit, glob, gtm pool, gtm server, list, modify, regex, show, tmsh
http
Congures a Hypertext Transfer Protocol (HTTP) monitor.
Syntax
Congure the http component within the gtm monitor module using the syntax in the following sections.
599
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create http [name]
modify http [name]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
recv [none | [string] ]
reverse [enabled | disabled]
send [none | [string] ]
timeout [integer]
transparent [enabled | disabled]
username [ [name] | none]
edit http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list http
list http [ [ [name] | [glob] | [regex] ] ... ]
show running-config http
show running-config http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete http [name]
Note: You cannot delete default monitors.
Description
You can use the http component to congure a custom monitor, or you can use the default HTTP monitor
that the Global Trafc Manager provides. This type of monitor veries the HTTP service by attempting to
receive specic content from a Web page.
Examples
create http my_http defaults-from http
Creates a monitor named my_http that inherits properties from the default HTTP monitor.
list http
Displays the properties of all of the HTTP monitors.
600
GTM Monitor
Options
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is http.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port specied in the monitor,
routing the check through the IP address and port supplied by the pool member. The pool member
(the gateway) is marked up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
601
Traffic Management Shell (tmsh) Reference Guide
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in an HTML le on your
site. The text string can be regular text, HTML tags, or image names, and the associated operation is
not case-sensitive. If you do not specify a value for both the send and recv options, the monitor performs
a simple service check and connect only.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object.
The default setting is GET /, which retrieves a default HTML le for a web site. To retrieve a specic
page from a web site, specify a fully-qualied path name, for example, GET /www/company/index.html.
Since the string may have special characters, the system may require that the string be enclosed with
single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, gtm pool, gtm server, list, modify, show, tmsh
https
Congures a Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) monitor.
602
GTM Monitor
Syntax
Congure the https component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create https [name]
modify https [name]
cert [ [cert list] | none]
cipherlist [string]
compatibility [enabled | disabled]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
key [ [key] | none]
password [none | [password] ]
probe-timeout [integer]
recv [none | [string] ]
reverse [enabled | disabled]
send [none | [string] ]
timeout [integer]
transparent [enabled | disabled]
username [ [name] | none]
edit https [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list https
list https [ [ [name] | [glob] | [regex] ] ... ]
show running-config https
show running-config https [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete https [name]
Note: You cannot delete default monitors.
Description
You can use the http component to congure a custom monitor, or you can use the default HTTPS monitor
that the Global Trafc Manager provides. This type of monitor veries the HTTPS service by attempting
to receive specic content from a Web page protected by Secure Socket Layer (SSL) security.
Examples
create https my_https defaults-from https
603
Traffic Management Shell (tmsh) Reference Guide
Creates a monitor named my_https that inherits properties from the default HTTPS monitor.
list https
Displays the properties of all of the HTTPS monitors.
Options
• cert
Species a fully-qualied path for a client certicate that the monitor sends to the target SSL server.
The default value is none.
• cipherlist
Species the list of ciphers for this monitor. The default list DEFAULT:+SHA:+3DES:+kEDH is
located in the le base_monitors.conf.
• compatibility
Species, when enabled, that the SSL options setting (in OpenSSL) is set to ALL. The default value is
enabled.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is https.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port specied in the monitor,
routing the check through the IP address and port supplied by the pool member. The pool member
(the gateway) is marked up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
604
GTM Monitor
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• key
Species the RSA private key if the monitored target requires authentication. The key must be surrounded
by quotation marks, for example, key \"client.key\". Note that if you specify a key, you must also
specify a value for the cert option. The default value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in an HTML le on your
site. The text string can be regular text, HTML tags, or image names, and the associated operation is
not case-sensitive. If you do not specify a value for both the send and recv options, the monitor performs
a simple service check and connect only.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object. The default value is GET /, which
retrieves a default HTML le for a web site.
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
605
Traffic Management Shell (tmsh) Reference Guide
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
imap
Congures an Internet Message Access Protocol (IMAP) monitor.
Syntax
Congure the imap component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create imap [name]
modify imap [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
folder [ [name] | none]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
timeout [integer]
transparent [enabled | disabled]
username [ [name] | none]
edit imap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list imap
list imap [ [ [name] | [glob] | [regex] ] ... ]
show running-config imap
show running-config imap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
606
GTM Monitor
Delete
delete imap [name]
Note: You cannot delete default monitors.
Description
You can use the imap component to congure a custom monitor, or you can use the default IMAP monitor
that the Global Trafc Manager provides. This type of monitor veries IMAP by attempting to open a
specied mail folder on a server. This monitor is similar to the POP3 monitor.
Examples
create imap my_imap defaults-from imap
Creates a monitor named my_imap that inherits properties from the default IMAP monitor.
list imap
Displays the properties of all of the IMAP monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is imap.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
607
Traffic Management Shell (tmsh) Reference Guide
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• folder
Species the name of the folder on the IMAP server that the monitor tries to open. The default value is
INBOX.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• username
Species the username, if the monitored target requires authentication. The default value is none.
608
GTM Monitor
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
ldap
Congures a Lightweight Directory Access Protocol (LDAP) monitor.
Syntax
Congure the ldap component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create ldap [name]
modify ldap [name]
base [none | [string] ]
chase-referrals [ no | yes ]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
filter [ [LDAP key] | none]
ignore-down-response [enabled | disabled]
interval [integer]
mandatory-attributes [no | yes]
password [none | [password] ]
probe-timeout [integer]
security [none | ssl | tls]
timeout [integer]
username [ [name] | none]
edit ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ldap
list ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config ldap
show running-config ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ldap [name]
Note: You cannot delete default monitors.
609
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the ldap component to congure a custom monitor, or you can use the default LDAP monitor
that the Global Trafc Manager provides. This type of monitor veries the LDAP service by attempting to
authenticate the specied user.
Examples
create ldap my_ldap defaults-from ldap
Creates a monitor named my_ldap that inherits properties from the default LDAP monitor.
list ldap
Displays the properties of all of the LDAP monitors.
Options
• base
Species the location in the LDAP tree from which the monitor starts the health check. A sample value
is dc=bigip-test,dc=net. The default value is none.
• chase-referrals
Species whether the monitor upon receipt of an LDAP referral entry chases that referral. The default
value is yes.
The options are:
• no
Species that the system will treat a referral entry as a normal entry and refrain from querying the
remote LDAP server(s) pointed to by the referral entry.
• yes
Species that the system upon receiving any referral entry from the monitored LDAP server query,
the system will then query the corresponding LDAP server(s) pointed to by the LDAP query. If the
query for the referral is unsuccessful the system will mark the monitored LDAP server down.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is ldap.
• description
User dened description.
610
GTM Monitor
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lter
Species an LDAP key for which the monitor searches. A sample value is objectclass=*. The default
value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• mandatory-attributes
Species whether the target must include attributes in its response to be considered up. The default
value is no. The options are:
• no
Species that the system performs only a one-level search (based on the value of the lter option),
and does not require that the target returns any attributes.
• yes
Species that the system performs a sub-tree search, and if the target returns no attributes, the target
is considered down.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
611
Traffic Management Shell (tmsh) Reference Guide
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• security
Species the secure communications protocol that the monitor uses to communicate with the target. The
default value is none.
The options are:
• none
Species that the system does not use a security protocol for communications with the target.
• ssl
Species that the system uses the SSL protocol for communications with the target.
• tls
Species that the system uses the TLS protocol for communications with the target.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
mssql
Congures a Microsoft(r) Windows(r) Structured Query Language (MSSQL) monitor.
Syntax
Congure the mssql component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create mssql [name]
modify mssql [name]
count [0 | 1]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
612
GTM Monitor
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
timeout [integer]
username [ [name] | none]
edit mssql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list mssql
list mssql [ [ [name] | [glob] | [regex] ] ... ]
show running-config mssql
show running-config mssql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete mssql [name]
Note: You cannot delete default monitors.
Description
You can use the mssql component to congure a custom monitor, or you can use the default MSSQL monitor
that the Global Trafc Manager provides. This type of monitor veries Microsoft Windows SQL-based
services.
Examples
create mssql my_mssql defaults-from mssql
Creates a monitor named my_mssql that inherits properties from the default MSSQL monitor.
list mssql
Displays the properties of all of the MSSQL monitors.
Options
• count
Species the number of instances for which the system keeps a connection open. By default, when you
assign instances of this monitor to a resource, the system keeps the connection to the database open.
613
Traffic Management Shell (tmsh) Reference Guide
With this option you can assign multiple instances to the database while reducing the overhead that
multiple open connections can cause.
A value of 0 (zero), the default, keeps the connection open for all instances. A value of 1 opens a new
connection for each instance. Any other positive value keeps the connection open for that many instances;
for example, a value of 5 keeps the connection open for ve instances of this monitor.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is mssql.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
614
GTM Monitor
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
615
Traffic Management Shell (tmsh) Reference Guide
mysql
Congures a MySQL(r) monitor.
Syntax
Congure the mysql component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create mysql [name]
modify mysql [name]
count [0 | 1]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
timeout [integer]
username [ [name] | none]
edit mysql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list mysql
list mysql [ [ [name] | [glob] | [regex] ] ... ]
show running-config mysql
show running-config mysql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete mysql [name]
Note: You cannot delete default monitors.
616
GTM Monitor
Description
You can use the mysql component to congure a custom monitor, or you can use the default MySQL
monitor that the Global Trafc Manager provides. This type of monitor veries Microsoft(r) Windows(r)
SQL-based services.
Examples
create mysql my_mysql defaults-from mysql
Creates a monitor named my_mysql that inherits properties from the default MySQL monitor.
list mysql
Displays the properties of all of the MySQL monitors.
Options
• count
Species the number of instances for which the system keeps a connection open. By default, when you
assign instances of this monitor to a resource, the system keeps the connection to the database open.
With this option you can assign multiple instances to the database while reducing the overhead that
multiple open connections can cause.
A value of 0 (zero), the default, keeps the connection open for all instances. A value of 1 opens a new
connection for each instance. Any other positive value keeps the connection open for that many instances;
for example, a value of 5 keeps the connection open for ve instances of this monitor.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is mysql.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
617
Traffic Management Shell (tmsh) Reference Guide
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
618
GTM Monitor
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
nntp
Congures a Network News Transfer Protocol (NNTP) monitor.
Syntax
Congure the nntp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create nntp [name]
modify nntp [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
newsgroup [ [name] | none]
password [none | [password] ]
probe-timeout [integer]
timeout [integer]
username [ [name] | none]
edit nntp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list nntp
list nntp [ [ [name] | [glob] | [regex] ] ... ]
619
Traffic Management Shell (tmsh) Reference Guide
show running-config nntp
show running-config nntp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete nntp [name]
Note: You cannot delete default monitors.
Description
You can use the nntp component to congure a custom monitor, or you can use the default NNTP monitor
that the Global Trafc Manager provides. This type of monitor veries the Usenet News protocol service
by attempting to retrieve a newsgroup identication string from the server.
Examples
create nntp my_nntp defaults-from nntp
Creates a monitor named my_nntp that inherits properties from the default NNTP monitor.
list nntp
Displays the properties of all of the NNTP monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is nntp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
620
GTM Monitor
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• newsgroup
Species the name of the newsgroup that you are monitoring, for example alt.car.mercedes. The default
value is none.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
621
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
oracle
Congures an Oracle(r) monitor.
Syntax
Congure the oracle component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create oracle [name]
modify oracle [name]
count [0 | 1]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
timeout [integer]
username [ [name] | none]
edit oracle [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list oracle
list oracle [ [ [name] | [glob] | [regex] ] ... ]
show running-config oracle
show running-config oracle [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete oracle [name]
622
GTM Monitor
Note: You cannot delete default monitors.
Description
You can use the oracle component to congure a custom monitor, or you can use the default Oracle monitor
that the Global Trafc Manager provides. This type of monitor veries services based on Oracle by attempting
to perform an Oracle login to a service.
Examples
create oracle my_oracle defaults-from oracle
Creates a monitor named my_oracle that inherits properties from the default Oracle monitor.
list oracle
Displays the properties of all of the Oracle monitors.
Options
• count
Species the number of instances for which the system keeps a connection open. By default, when you
assign instances of this monitor to a resource, the system keeps the connection to the database open.
With this option you can assign multiple instances to the database while reducing the overhead that
multiple open connections can cause.
A value of 0 (zero), the default, keeps the connection open for all instances. A value of 1 opens a new
connection for each instance. Any other positive value keeps the connection open for that many instances;
for example, a value of 5 keeps the connection open for ve instances of this monitor.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is oracle.
• description
User dened description.
• destination
623
Traffic Management Shell (tmsh) Reference Guide
Species the IP address and service port of the resource that is the destination of this monitor. The default
value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
624
GTM Monitor
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
pop3
Congures a Post Ofce Protocol version 3 (POP3) monitor.
Syntax
Congure the pop3 component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create pop3 [name]
modify pop3 [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
timeout [integer]
username [ [name] | none]
edit pop3 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
625
Traffic Management Shell (tmsh) Reference Guide
Display
list pop3
list pop3 [ [ [name] | [glob] | [regex] ] ... ]
show running-config pop3
show running-config pop3 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete pop3 [name]
Note: You cannot delete default monitors.
Description
You can use the pop3 component to congure a custom monitor, or you can use the default POP3 monitor
that the Global Trafc Manager provides. This type of monitor veries the POP3 service by attempting to
connect to a pool, pool member, or virtual server, log on as the specied user, and log off.
Examples
create pop3 my_pop3 defaults-from pop3
Creates a monitor named my_pop3 that inherits properties from the default POP3 monitor.
list pop3
Displays the properties of all of the POP3 monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is pop3.
• description
User dened description.
626
GTM Monitor
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
627
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
postgresql
Congures a PostgreSQL(r) monitor.
Syntax
Congure the postgresql component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create postgresql [name]
modify postgresql [name]
count [0 | 1]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
password [none | [password] ]
probe-timeout [integer]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
timeout [integer]
username [ [name] | none]
edit postgresql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list postgresql
list postgresql [ [ [name] | [glob] | [regex] ] ... ]
show running-config postgresql
show running-config postgresql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete postgresql [name]
628
GTM Monitor
Note: You cannot delete default monitors.
Description
You can use the postgresql component to congure a custom monitor, or you can use the default PostgreSQL
monitor that the Global Trafc Manager provides. This type of monitor veries Microsoft(r) Windows(r)
SQL-based services.
Examples
create postgresql my_postgresql defaults-from postgresql
Creates a monitor named my_postgresql that inherits properties from the default PostgreSQL monitor.
list postgresql
Displays the properties of all of the PostgreSQL monitors.
Options
• count
Species the number of instances for which the system keeps a connection open. By default, when you
assign instances of this monitor to a resource, the system keeps the connection to the database open.
With this option you can assign multiple instances to the database while reducing the overhead that
multiple open connections can cause.
A value of 0 (zero), the default, keeps the connection open for all instances. A value of 1 opens a new
connection for each instance. Any other positive value keeps the connection open for that many instances;
for example, a value of 5 keeps the connection open for ve instances of this monitor.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is postgresql.
• description
User dened description.
• destination
629
Traffic Management Shell (tmsh) Reference Guide
Species the IP address and service port of the resource that is the destination of this monitor. The default
value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
630
GTM Monitor
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
radius
Congures a Remote Access Dial-in User Service (RADIUS) monitor.
Syntax
Congure the radius component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create radius [name]
modify radius [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
nas-ip-address [ [ip address] | none]
password [none | [password] ]
probe-timeout [integer]
secret [none | [secret] ]
timeout [integer]
username [ [name] | none]
edit radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
631
Traffic Management Shell (tmsh) Reference Guide
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ... ]
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete radius [name]
Note: You cannot delete default monitors.
Description
You can use the radius component to congure a custom monitor, or you can use the default RADIUS
monitor that the Global Trafc Manager provides. This type of monitor veries the RADIUS service by
attempting to authenticate the specied user.
Examples
create radius my_radius defaults-from radius
Creates a monitor named my_radius that inherits properties from the default RADIUS monitor.
list radius
Displays the properties of all of the RADIUS monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is radius.
• description
User dened description.
632
GTM Monitor
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nas-ip-address
Species the network access server IP address that the system uses to identify itself to the RADIUS
server. Using this option, multiple BIG-IP(r) systems can appear as a single network access device to
the RADIUS server. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the secret the monitor needs to communicate with the resource. The default value is none.
• timeout
633
Traffic Management Shell (tmsh) Reference Guide
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
radius-accounting
Congures a RADIUS accounting monitor for the BIG-IP(r) Global Trafc Manager.
Syntax
Congure the radius-accounting component within the gtm monitor module using the syntax shown in
the following sections.
Create/Modify
create radius-accounting [name]
modify radius [name]
check-until-up [disabled | enabled]
debug [no | yes]
defaults-from [ [name] | none]
description [string]
destination [ip address]
interval [integer]
manual-resume [disabled | enabled]
nas-ip-address [ip address]
secret [string]
time-until-up [integer]
timeout [integer]
username [none | [string] ]
edit radius-accounting [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list radius-accounting
list radius-accounting [ [ [name] | [glob] | [regex] ] ...]
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
634
GTM Monitor
one-line
partition
Delete
delete radius-accounting [name]
Note: You cannot delete default monitors.
Description
You can use the radius-accounting component to congure a custom monitor, or you can use the default
RADIUS accounting monitor that the Global Trafc Manager provides. This type of monitor provides
information about the usage of the RADIUS service for accounting purposes.
Examples
create radius-accounting my_radius_acct defaults-from radius_accounting
Creates a monitor named my_radius_acct that inherits properties from the default RADIUS accounting
monitor.
list radius-accounting
Displays the properties of all of the RADIUS accounting monitors.
Options
• check-until-up
When enabled, species that when an active and passive (inband) monitor are combined in an AND
type of rule, the active monitor performs health checks only when the pool member is down, or until
the pool member is marked as up. When the passive monitor marks the pool member down, the active
monitor resumes health checks.
The default value is disabled.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is radius.
• description
635
Traffic Management Shell (tmsh) Reference Guide
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nas-ip-address
Species the network access server IP address that the system uses to identify itself to the RADIUS
server. Using this option, multiple BIG-IP(r) systems can appear as a single network access device to
the RADIUS server. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the secret the monitor needs to communicate with the resource. The default value is none.
• time-until-up
Species the amount of time in seconds after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
636
GTM Monitor
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
real-server
Congures a RealServer(r) monitor.
Syntax
Congure the real-server component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create real-server [name]
modify real-server [name]
defaults-from [name]
description [string]
ignore-down-response [enabled | disabled]
interval [integer]
metrics [ [metrics] | none]
probe-timeout [integer]
timeout [integer]
edit real-server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list real-server
list real-server [ [ [name] | [glob] | [regex] ] ... ]
show running-config real-server
show running-config real-server [ [ [name] | [glob] | [regex] ] ... ]
agent
all-properties
command
method
non-default-properties
one-line
partition
637
Traffic Management Shell (tmsh) Reference Guide
Delete
delete real-server [name]
Note: You cannot delete default monitors.
Description
You can use the real-server component to congure a custom monitor, or you can use the default RealServer
monitor that the Global Trafc Manager provides. This type of monitor checks the performance of a pool,
pool member, or virtual server that is running the RealServer data collection agent, and then dynamically
load balances trafc accordingly.
Examples
create real-server my_real-server defaults-from real_server
Creates a monitor named my_real-server that inherits properties from the default RealServer monitor.
list real-server
Displays the properties of all of the RealServer monitors.
Options
• agent
Displays the agent for the monitor. The default agent is Mozilla/4.0 (compatible: MSIE 5.0; Windows
NT). You cannot modify the agent.
• command
Displays the command that the system uses to obtain the metrics from the resource. See the documentation
for this resource for information on available commands. You cannot modify the command.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is real_server.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• method
638
GTM Monitor
Displays the GET method. You cannot modify the method.
• metrics
Species the performance metrics that the commands collect from the target. The default value is
ServerBandwidth:1.5, CPUPercentUsage, MemoryUsage, TotalClientCount.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, gtm pool, gtm server, list, ltm node, modify, regex, show, tmsh
scripted
Congures a Scripted monitor.
Syntax
Congure the scripted component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create scripted [name]
modify scripted [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
filename [ [filename] | none]
ignore-down-response [enabled | disabled]
interval [integer]
639
Traffic Management Shell (tmsh) Reference Guide
probe-timeout [integer]
timeout [integer]
edit scripted [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list scripted
list scripted [ [ [name] | [glob] | [regex] ] ... ]
show running-config scripted
show running-config scripted [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete scripted [name]
Note: You cannot delete default monitors.
Description
You can use the scripted component to congure a custom monitor, or you can use the default scripted
monitor that the Global Trafc Manager provides.
Examples
create scripted my_scripted defaults-from scripted
Creates a monitor named my_scripted that inherits properties from the default Scripted monitor.
list scripted
Displays the properties of all of the scripted monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
640
GTM Monitor
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is scripted.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lename
Species the name of a le in the /cong/eav/ directory on the system. The user-created le contains
the send and expect data that the monitor uses for the monitor check. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
641
Traffic Management Shell (tmsh) Reference Guide
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
sip
Congures a Session Initiation Protocol (SIP) monitor.
Syntax
Congure the sip component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create sip [name]
modify sip [name]
cert [ [cert list] | none]
cipherlist [list]
compatibility [enabled | disabled]
debug [ no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
filter [any | none | status]
filter-neg [any | none | status]
headers [ [new line separated headers] | none]
ignore-down-response [enabled | disabled]
interval [integer]
key [ [key] | none]
mode [sips | tcp | tls | udp]
probe-timeout [integer]
request [none | [string] ]
username [ [name] | none]
edit sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list sip
list sip [ [ [name] | [glob] | [regex] ] ... ]
show running-config sip
show running-config sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
642
GTM Monitor
non-default-properties
one-line
partition
Delete
delete sip [name]
Note: You cannot delete default monitors.
Description
You can use the sip component to congure a custom monitor, or you can use the default SIP monitor that
the Global Trafc Manager provides. This type of monitor checks the status of SIP Call-ID services on a
device. The SIP protocol enables real-time messaging, voice, data, and video.
Examples
create sip my_sip defaults-from sip
Creates a monitor named my_sip that inherits properties from the default SIP monitor.
list sip
Displays the properties of all of the SIP monitors.
Options
• cert
Species a fully-qualied path for a client certicate that the monitor sends to the target SSL server.
The default value is none.
• cipherlist
Species the list of ciphers for this monitor. The default value is none.
• compatibility
Species, when enabled, that the SSL options setting (in OpenSSL) is set to ALL. The default value is
enabled.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
643
Traffic Management Shell (tmsh) Reference Guide
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is sip.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lter
Species the SIP status codes that the target can return to be considered up. By default the system always
accepts status codes whose value is in the 100s, 200s, or 300s.
The options are:
• any
Species that the monitor accepts any SIP status codes.
• none
Species that the monitor does not accept any other SIP status codes. This is the default value.
• status
Species one or more status codes that you want to add to the monitor.
• lter-neg
Species the SIP status codes that the target can return to be considered down. By default the system
always accepts status codes according to sip-monitor.lter. After checking that, the status code is
checked against this key. If a code is also in sip-monitor.lter, the node is marked up.
The options are:
• any
Species that the monitor rejects all SIP status codes that are not in sip-monitor.lter.
• none
Species that the monitor does not specically reject any other SIP status codes. This is the default
value.
• status
Species one or more status codes that you want to add to the monitor.
• glob
644
GTM Monitor
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• headers
Species the set of SIP headers in the SIP message that is sent to the target. Separate each header with
a new line. The default value is none.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• key
Species the key if the monitored target requires authentication. The default value is none.
• mode
Species the protocol that the monitor uses to communicate with the target. The options are:
• sips
Species that the monitor uses SIPS to communicate with the target.
• tcp
Species that the monitor uses TCP to communicate with the target.
• tls
Species that the monitor uses TLS to communicate with the target, and the SIP URI is SIPS.
• udp
Species that the monitor uses UDP to communicate with the target.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• request
Species the SIP request line in the SIP message that is sent to the target. The default value is none.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
645
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
smtp
Congures a Simple Mail Transport Protocol (SMTP) monitor.
Syntax
Congure the smtp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create smtp [name]
modify smtp [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
domain [ [name] | none]
ignore-down-response [enabled | disabled]
interval [integer]
probe-timeout [integer]
timeout [integer]
edit smtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list smtp
list smtp [ [ [name] | [glob] | [regex] ] ... ]
show running-config smtp
show running-config smtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete smtp [name]
Note: You cannot delete default monitors.
646
GTM Monitor
Description
You can use the smtp component to congure a custom monitor, or you can use the default SMTP monitor
that the Global Trafc Manager provides. This type of monitor checks the status of a pool, pool member,
or virtual server by issuing standard SMTP commands.
Examples
create smtp my_smtp defaults-from smtp
Creates a monitor named my_smtp that inherits properties from the default SMTP monitor.
list smtp
Displays the properties of all of the SMTP monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is smtp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• domain
Species the domain name to check, for example, bigipinternal.com. The default value is none.
647
Traffic Management Shell (tmsh) Reference Guide
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
snmp
Congures a Simple Network Management Protocol (SNMP) monitor.
Syntax
Congure the snmp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create snmp [name]
modify snmp [name]
app-service [[string] | none]
community [ [name] | none]
648
GTM Monitor
defaults-from [name]
description [string]
destination [ip address] [port]
ignore-down-response [enabled | disabled]
interval [integer]
port [integer]
probe attempts [integer]
probe-interval [integer]
probe-timeout [integer]
timeout [integer]
version [ [integer] | none]
edit snmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list snmp
list snmp [ [ [name] | [glob] | [regex] ] ... ]
show running-config snmp
show running-config snmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete snmp [name]
Note: You cannot delete default monitors.
Description
You can use the snmp component to congure a custom monitor, or you can use the default SNMP monitor
that the Global Trafc Manager provides. The SNMP monitor is both a health and performance monitor.
This type of monitor checks the performance of a server running an SNMP agent such as UC Davis, for the
purpose of load balancing trafc to that server.
Examples
create snmp my_snmp defaults-from snmp_gtm
Creates a monitor named my_snmp that inherits properties from the default SNMP monitor.
list snmp
Displays the properties of all of the SNMP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
649
Traffic Management Shell (tmsh) Reference Guide
• community
Species the community name that the BIG-IP(r) system must use to authenticate with the host server
through SNMP. The default value is public.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is snmp_gtm.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 90 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species the port number to which this monitor sends SNMP traps. The default value is 161.
• probe-attempts
Species the number of times the BIG-IP system attempts to probe the host server, after which the
BIG-IP system considers the host server down or unavailable. The default value is 1.
• probe-interval
Species the frequency at which the BIG-IP system probes the host server. The default value is 1.
• probe-timeout
650
GTM Monitor
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 180 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• version
Species the SNMP version the monitor uses. The default value is v1.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
snmp-link
Congures a Simple Network Management Protocol (SNMP) link monitor.
Syntax
Congure the snmp-link component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create snmp-link [name]
modify snmp-link [name]
app-service [[string] | none]
community [[name] | none]
defaults-from [name]
description [string]
destination [ip address]
ignore-down-response [enabled | disabled]
interval [integer]
port [ [integer] | none]
probe attempts [integer]
probe-interval [integer]
probe-timeout [integer]
timeout [integer]
version [ [integer] | none]
edit snmp-link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
651
Traffic Management Shell (tmsh) Reference Guide
Display
list snmp-link
list snmp-link [ [ [name] | [glob] | [regex] ] ... ]
show running-config snmp-link
show running-config snmp-link [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete snmp-link [name]
Note: You cannot delete default monitors.
Description
You can use the snmp-link component to congure a custom monitor, or you can use the default SNMP
Link monitor that the Global Trafc Manager provides. This type of monitor checks the current CPU,
memory, and disk usage of a pool, pool member, or virtual server that is running an SNMP data collection
agent, and then dynamically load balances trafc accordingly.
Examples
create snmp-link my_snmp-link defaults-from snmp_link
Creates a monitor named my_snmp-link that inherits properties from the default SNMP Link monitor.
list snmp-link
Displays the properties of all of the SNMP Link monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• community
Species the community name that the BIG-IP(r) system must use to authenticate with the host server
through SNMP. The default value is public.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is snmp_link.
• description
User dened description.
• destination
Species the IP address of the resource that is the destination of this monitor. The default value is *.
Possible values are:
652
GTM Monitor
• *
Species to perform a health check on the IP address of the node.
• IP address
Species to perform a health check on the IP address that you specify, route the check through the
IP address of the associated node, and mark the IP address of the associated node up or down
accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species the port number to which this monitor sends SNMP traps. The default value is 161.
• probe-attempts
Species the number of times the BIG-IP system attempts to probe the host server, after which the
BIG-IP system considers the host server down or unavailable. The default value is 3.
• probe-interval
Species the frequency at which the BIG-IP system probes the host server. The default value is 0.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 30 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• version
Species the SNMP version the monitor uses. The default value is none.
653
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, ltm node, modify, regex, show, tmsh
soap
Congures a Simple Object Access Protocol (SOAP) monitor.
Syntax
Congure the soap component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create soap [name]
modify soap [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
expect-fault [no | yes]
ignore-down-response [enabled | disabled]
interval [integer]
method [string]
namespace [ [name] | none]
parameter-name [ [name] | none]
parameter-type [bool | int | long | [string] ]
parameter-value [none | [integer] | [string] ]
password [none | [password] ]
probe-timeout [integer]
protocol [[none] | [protocol] ]
return-type [bool | char | double | int | long | short | [string] ]
return-value [none | [integer] | [string] ]
soap-action [string]
timeout [integer]
url-path [none | [string] ]
username [ [name] | none]
edit soap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list soap
list soap [ [ [name] | [glob] | [regex] ] ... ]
show running-config soap
show running-config soap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
654
GTM Monitor
Delete
delete soap [name]
Note: You cannot delete default monitors.
Description
You can use the soap component to congure a custom monitor, or you can use the default SOAP monitor
that the Global Trafc Manager provides. This type of monitor tests a Web service based on SOAP.
Examples
create soap my_soap defaults-from soap
Creates a monitor named my_soap that inherits values from the system default SOAP monitor.
list soap
Displays the properties of all of the SOAP monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the type of monitor you want to use to create the new monitor. The default value is soap.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. Possible
values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
655
Traffic Management Shell (tmsh) Reference Guide
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• expect-fault
Species whether the value of the method option causes the monitor to expect a SOAP fault message.
The default value is no.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• method
Species the method by which the monitor contacts the resource.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• namespace
Species the name space for the Web service you are monitoring, for example, http://example.com/.
The default value is none.
• parameter-name
If the method has a parameter, species the name of that parameter. The default value is bool.
• parameter-type
Species the parameter type. The default value is none.
• parameter-value
Species the value for the parameter. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• protocol
Species the protocol that the monitor uses to communicate with the target. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• return-type
656
GTM Monitor
Species the type for the returned parameter. The default value is bool.
• return-value
Species the value for the returned parameter. The default value is none.
• soap-action
Species the value for the SOAPAction header. The default value is the empty string.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds. If the target responds within the set time period, it is considered up. If the target
does not respond within the set time period, it is considered down. Also, if the target responds with a
RESET packet, the system immediately ags the target as down without waiting for the timeout interval
to expire.
• url-path
Species the URL for the Web service that you are monitoring, for example, /services/myservice.aspx.
The default value is none.
• username
Species the user name if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
tcp
Congures a Transmission Control Protocol (TCP) monitor.
Syntax
Congure the tcp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create tcp [name]
modify tcp [name]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
probe-timeout [integer]
recv [none | [string] ]
reverse [enabled | disabled]
send [none | [string] ]
timeout [integer]
transparent [disabled | enabled]
edit tcp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
657
Traffic Management Shell (tmsh) Reference Guide
Display
list tcp
list tcp [ [ [name] | [glob] | [regex] ] ... ]
show running-config tcp
show running-config tcp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tcp [name]
Note: You cannot delete default monitors.
Description
You can use the tcp component to congure a custom monitor, or you can use the default TCP monitor that
the Global Trafc Manager provides.
Examples
create tcp my_tcp defaults-from tcp
Creates a monitor named my_tcp that inherits properties from the default TCP monitor.
list tcp
Displays the properties of all of the TCP monitors.
Options
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is tcp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
658
GTM Monitor
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in an HTML le on your
site. The text string can be regular text, HTML tags, or image names. If you do not specify a value for
both the send and recv options, the monitor performs a simple service check and connect only.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object. The default setting is GET /, which
retrieves a default HTML le for a web site.
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
659
Traffic Management Shell (tmsh) Reference Guide
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
See Also
create, delete, edit, glob, gtm pool, gtm server, list, modify, regex, show, tmsh
tcp-half-open
Congures a Transmission Control Protocol (TCP) Half Open monitor.
Syntax
Congure the tcp-half-open component within the gtm monitor module using the syntax in the following
sections.
Create/Modify
create tcp-half-open [name]
modify tcp-half-open [name]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
probe-attempts [integer])
probe-interval [integer])
probe-timeout [integer]
timeout [integer]
transparent [disabled | enabled]
edit tcp-half-open [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tcp-half-open
list tcp-half-open [ [ [name] | [glob] | [regex] ] ... ]
show running-config tcp-half-open
660
GTM Monitor
show running-config tcp-half-open [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tcp-half-open [name]
Note: You cannot delete default monitors.
Description
You can use the tcp-half-open component to congure a custom monitor, or you can use the default TCP
Half Open monitor that the Global Trafc Manager provides.
For more information about conguring monitors, refer to the Conguration Guide for BIG-IP(r) Global
Trafc Management.
Examples
create tcp-half-open my_tcp-half-open defaults-from tcp_half_open
Creates a monitor named my_tcp-half-open that inherits properties from the default TCP Half Open monitor.
list tcp-half-open
Displays the properties of all of the TCP Half Open monitors.
Options
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is tcp_half_open.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
661
Traffic Management Shell (tmsh) Reference Guide
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-attempts
Species the number of times the BIG-IP system attempts to probe the host server, after which the
BIG-IP system considers the host server down or unavailable. The default value is 3.
• probe-interval
Species the frequency at which the BIG-IP system probes the host server. The default value is 1.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
See Also
create, delete, edit, glob, gtm pool, gtm server, list, modify, regex, show, tmsh
662
GTM Monitor
udp
Congures a User Datagram Protocol (UDP) monitor.
Syntax
Congure the udp component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create udp [name]
modify udp [name]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
ignore-down-response [enabled | disabled]
interval [integer]
probe-attempts [integer]
probe-interval [integer]
probe-timeout [integer]
reverse [enabled | disabled]
send [none | [string] ]
timeout [integer]
transparent [disabled | enabled]
edit udp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list udp
list udp [ [ [name] | [glob] | [regex] ] ... ]
show running-config udp
show running-config udp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete udp [name]
Note: You cannot delete default monitors.
Description
You can use the udp component to congure a custom monitor, or you can use the default UDP monitor
that the Global Trafc Manager provides. This type of monitor veries the UDP service by attempting to
send UDP packets to a pool, pool member, or virtual server, and receiving a reply.
663
Traffic Management Shell (tmsh) Reference Guide
For more information about conguring monitors, refer to the Conguration Guide for BIG-IP(r) Global
Trafc Management.
Examples
create udp my_udp defaults-from udp
Creates a monitor named my_udp that inherits properties from the default UDP monitor.
list udp
Displays the properties of all of the UDP monitors.
Options
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is udp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. Possible
values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
664
GTM Monitor
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-attempts
Species the number of times the BIG-IP system attempts to probe the host server, after which the
BIG-IP system considers the host server down or unavailable. The default value is 3.
• probe-interval
Species the frequency at which the BIG-IP system probes the host server. The default value is 1.
• probe-timeout
Species the number of seconds after which the BIG-IP system times out the probe request to the BIG-IP
system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object. The default value is "default send
string".
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the value of the recv option and ignores the option even if not null.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds. If the target responds within the set time period, it is considered up. If the target
does not respond within the set time period, it is considered down. Also, if the target responds with a
RESET packet, the system immediately ags the target as down without waiting for the timeout interval
to expire.
• transparent
665
Traffic Management Shell (tmsh) Reference Guide
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
See Also
create, delete, edit, glob, gtm pool, gtm server, list, modify, regex, show, tmsh
wap
Congures a Wireless Application Protocol (WAP) monitor.
Syntax
Congure the wap component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create wap [name]
modify wap [name]
accounting-node [none | [RADIUS server name] ]
accounting-port [ [integer] | none]
call-id [none | [RADIUS server 11 digit phone number] ]
check-until-up [enabled | disabled]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
framed-address [none | [RADIUS framed IP address] ]
ignore-down-response [enabled | disabled]
interval [integer]
probe-timeout [integer]
recv [none | [string] ]
secret [none | [password] ]
send [none | [string] ]
server-id [none | [RADIUS NAS-ID] ]
session-id [none | [RADIUS session ID] ]
timeout [integer]
edit wap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list wap
list wap[ [ [name] | [glob] | [regex] ] ... ]
show running-config wap
show running-config wap[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
666
GTM Monitor
Delete
delete wap [name]
Note: You cannot delete default monitors.
Description
You can use the wap component to congure a custom monitor, or you can use the default WAP monitor
that the Global Trafc Manager provides. This type of monitor requests the URL specied in the send
option, and nds the string specied in the recv option somewhere in the data returned by the URL response.
Examples
create wap my_wap defaults-from wap
Creates a monitor named my_wap that inherits properties from the default WAP monitor.
list wap
Displays the properties of all of the WAP monitors.
Options
• accounting-node
Species the RADIUS server that provides authentication for the WAP target. Note that if you congure
the accounting-port option, but you do not congure the this option, the system assumes that the
RADIUS server and the WAP server are the same system.
• accounting-port
Species the port that the monitor uses for RADIUS accounting. The default value is none. A value of
0 (zero) disables RADIUS accounting.
• call-id
Species the 11-digit phone number for the RADIUS server. The default value is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is wap.
• description
667
Traffic Management Shell (tmsh) Reference Guide
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• framed-address
Species the RADIUS framed IP address. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• recv
Species the text string that the monitor looks for in the returned resource. The most common receive
expressions contain a text string that is included in an HTML le on your site. The text string can be
regular text, HTML tags, or image names. If you do not specify both a value for both the send and recv
options, the monitor performs a simple service check and connect only. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the password the monitor needs to communicate with the resource. The default value is none.
668
GTM Monitor
• send
Species the text string that the monitor sends to the target object. The default setting is GET /, which
retrieves a default HTML le for a web site.
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if it is not null. The default value is
none.
• server-id
Species the RADIUS NAS-ID for this system when conguring a RADIUS server. The default value
is none.
• session-id
Species the RADIUS session identication number when conguring a RADIUS server. The default
value is none.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, gtm pool, list, modify, regex, show, tmsh
wmi
Congures a Windows(r) Management Instrumentation (WMI) monitor.
Syntax
Congure the wmi component within the gtm monitor module using the syntax in the following sections.
Create/Modify
create wmi [name]
modify wmi [name]
command [[command] | none]
defaults-from [name]
description [string]
ignore-down-response [enabled | disabled]
interval [integer]
metrics [ [integer] | none]
password [none | [password] ]
probe-timeout [integer]
timeout [integer]
669
Traffic Management Shell (tmsh) Reference Guide
url [none | [URL]]
username [ [name] | none]
edit wmi [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list wmi
list wmi [ [ [name] | [glob] | [regex] ] ... ]
show running-config wmi
show running-config wmi [ [ [name] | [glob] | [regex] ] ... ]
agent
all-properties
method
non-default-properties
one-line
partition
post
Delete
delete wmi [name]
Note: You cannot delete default monitors.
Description
You can use the wmi component to congure a custom monitor, or you can use the default WMI monitor
that the Global Trafc Manager provides. This type of monitor checks the performance of a pool, pool
member, or virtual server that is running the WMI data collection agent, and then dynamically load balances
trafc accordingly.
Examples
create wmi my_wmi defaults-from wmi
Creates a monitor named my_wmi that inherits properties from the default WMI monitor.
list wmi
Displays the properties of all of the WMI monitors.
Options
• agent
Displays the agent for the monitor. The default agent is Mozilla/4.0 (compatible: MSIE 5.0; Windows
NT). You cannot modify the agent.
• command
Species the command that the system uses to obtain the metrics from the resource. See the documentation
for this resource for information on available commands.
• defaults-from
670
GTM Monitor
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is wmi.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-down-response
Species whether the monitor ignores a down response from the system it is monitoring. The default
value is disabled.
• interval
Species the frequency at which the system issues the monitor check. The default value is 30 seconds.
• method
Displays the GET method. You cannot modify the method.
• metrics
Species the performance metrics that the commands collect from the target. The default value is
LoadPercentage, DiskUsage, PhysicalMemoryUsage:1.5, VirtualMemoryUsage:2.0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• post
Species the mechanism that the monitor uses for posting. The default value is RespFormat=HTML.
You cannot change the post format for WMI monitors.
• probe-timeout
Species the number of seconds after which the BIG-IP(r) system times out the probe request to the
BIG-IP system. The default value is 5 seconds.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 120 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• url
Species the URL that the monitor uses. The default value is /scripts/f5Isapi.dll.
• username
671
Traffic Management Shell (tmsh) Reference Guide
Species the user name if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, gtm pool, list, ltm node, modify, regex, show, tmsh
672
GTM Monitor
LTM
alg-log-profile
Congures an Application-Level Gateway logging prole.
Syntax
Create/Modify
create alg-log-profile [name]
modify alg-log-profile [name | all]
app-service [[string] | none]
start-control-channel {
action [disabled | enabled | backup-allocation-only]
elements [add | delete | replace-all-with] {
destination
}
}
end-control-channel {
action [disabled | enabled | backup-allocation-only]
elements [add | delete | replace-all-with] {
destination
}
}
start-data-channel {
action [disabled | enabled | backup-allocation-only]
elements [add | delete | replace-all-with] {
destination
}
}
end-data-channel {
action [disabled | enabled | backup-allocation-only]
elements [add | delete | replace-all-with] {
destination
}
}
inbound-transaction {
action [disabled | enabled]
}
edit alg-log-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats alg-log-profile
reset-stats alg-log-profile [ [ [name] | [glob] | [regex] ] ... ]
Display
list alg-log-profile
list alg-log-profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config alg-log-profile
show running-config alg-log-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete alg-log-profile [name | all]
Description
A ALG log prole allows ne grain control of the logging for ALG events. When attached to an supported
ALG prole - currently FTP, RTSP, SIP, you can control the events to log as well as optional elements in
the log entry.
Examples
create ltm alg-log-prole my_alg_log_prole end-control-channel { action backup-allocation-only }
end-data-channel { action backup-allocation-only }
Creates the ALG log prolemy_alg_log_prole that generates log entries for both inbound and data-channel
when translation is from backup members only.
delete alg-log-prole my_lsn_log_prole
Deletes the ALG log prole named my_lsn_log_prole.
Options
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• events
The type of ALG events available for logging control.
• start-control-channel
Event for start of control channel connection.
• end-control-channel
Event for end of control channel connection.
• start-data-channel
Event for start of data channel connection.
• end-data-channel
Event for end of data channel connection.
• inbound-transaction
674
LTM
Event for inbound transaction event to an ALG end-point. Inbound transaction log entry could contain
both incoming and outgoing messages.
• action
Specify the logging action to be taken when a particular event is encountered.
• enabled
Logging is enable for the event, regardless of how the ow is created.
• backup-allocation-only
Logging is enable for the event, when the ALG is proxy with a LSN, and translation is take from
backup pool member only.
• disabled
Logging is disable for the event.
• elements
Optional elements that can be added to the log message.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
ltm prole ftp, ltm prole sip, ltm prole rtsp, create, delete, edit, glob, list, ltm, modify, regex, tmsh
default-node-monitor
Congures the default node monitor for the Local Trafc Manager.
Syntax
Congure the default-node-monitor component within the ltm module using the syntax shown in the
following sections.
Create/Modify
modify default-node-monitor
rule [rule syntax]
edit default-node-monitor
all-properties
Display
list default-node-monitor
show running-config default-node-monitor
675
Traffic Management Shell (tmsh) Reference Guide
one-line
all-properties
Description
You can use the default-node-monitor component to modify the default monitor that the system applies
to any node address to which a monitor is not explicitly assigned.
Examples
modify default-node-monitor rule icmp
Modies the global default node monitor to use the rule ICMP.
list default-node-monitor
Displays the properties of the global default node monitor.
Options
• rule
Species the rule that the system applies to any node that has not been assigned a monitor rule. The
default value is none.
You can specify:
• A single monitor, for example, modify default-node-monitor rule icmp.
• Multiple monitors, for example, modify default-node-monitor rule icmp and tcp_echo.
• A minimum number of monitors, for example, modify default-node-monitor rule min 1 of { icmp
and tcp_echo }.
See Also
list, ltm node, modify, show, tmsh
eviction-policy
Congures eviction policies to determine when and how to terminate connections.
Syntax
Congure the eviction-policy component within the ltm module using the syntax shown in the following
sections.
Create/Modify
create eviction-policy [name]
modify eviction-policy [name]
description [string]
app-service [[string] | none]
low-water [integer]
high-water [integer]
slow-flow {
enabled [true | false]
676
LTM
eviction-type [count | percent]
grace-period [integer]
maximum [integer]
threshold-bps [integer]
throttling [enabled | disabled]
}
strategies {
bias-bytes {
delay [integer]
enabled [true | false]
}
bias-idle {
enabled [true | false]
}
bias-oldest {
enabled [true | false]
}
low-priority-geographies {
countries [add | delete | modify | replace-all-with] {
[country-code] ...
}
enabled [true | false]
}
low-priority-port {
enabled [true | false]
ports [add | delete | modify | replace-all-with] {
[ [name] ] {
app-service [[string] | none]
port-number [name | integer]
protocol [any | sctp | tcp | udp]
} ...
}
}
low-priority-route-domain {
enabled [true | false]
names [add | delete | modify | replace-all-with] {
[ [route domain name] ] ...
}
}
low-priority-virtual-server {
enabled [true | false]
names [add | delete | modify | replace-all-with] {
[ [virtual server name] ] ...
}
}
}
Display
list eviction-policy
list eviction-policy [ [ [name] | [glob] | [regex] ] ...]
all-properties
partition
show eviction-policy
show eviction-policy [ [ [name] | [glob] | [regex] ] ...]
all-properties
default
677
Traffic Management Shell (tmsh) Reference Guide
Delete
delete eviction-policy [name]
Description
You use the eviction policy to specify which ows to terminate when the connection limits for the box are
approached. The eviction policy contains strategies which select the ows to terminate. Additionally, the
eviction policy denes parameters used to determine when ows are considered to be slow. Slow ows are
terminated according to the policy, even when the Big-IP is not under duress and the connection limits are
not approached.
When applied to the global context, the eviction policy low-water and high-water limits are with respect
to memory available on the Big-IP. When applied to a virtual server or a route domain, the limits are with
respect to the connection limit on the virtual server or route domain, respectively.
It is possible to monitor slow ows, accumulating metrics on the number of ows under the designated
slow ow transfer limit. To do so, enable slow-ows, but disable throttling on the slow ow.
Note: Monitoring or killing slow ows will incur a performance penalty.
Note: The strategies applied here work on a cyclic sweep of all connections on the Big-IP. These do not
run at the granularity to guarantee eviction of a particular ow or type of ow, but are statistical and
opportunistic.
The bias-bytes algorithm attempts to select the ows that have sent and received the fewest bytes on the
connection.
The bias-idle algorithm attempts to select the ows that have been idle the longest.
The bias-oldest algorithm attempts to select the oldest ows.
The low-priority-geographies algorithm selects ows that are in low-priority geographies according to
the GeoIP database loaded onto the box.
The low-priority-port algorithm selects ows that are in the provided list of low-priority ports and protocols.
The low-priority-route-domain algorithm selects ows that are in the provided list of low-priority route
domains.
The low-priority-virtual-server algorithm selects ows that are in the provided list of low-priority virtual
servers.
Examples
create eviction-policy my_eviction_policy { low-water 70 high-water 80 slow-ow { enabled true
threshold-bps 50 throttling disabled } strategies { bias-idle { enabled true } } }
Creates an eviction policy named my_eviction_policy, which accumulates statistics on the current number
of slow ows but does not terminate any ows that are considered slow. The bias-idle algorithm is used
to kill ows when the limits on the context are approached. The aggressive sweeper will activate at 80
percent of capacity, and deactivate when load is reduced to 70 percent of capacity.
modify eviction-policy my_eviction_policy { strategies { low-priority-geographies { enabled true
countries replace-all-with { AZ BZ } } } }
Modies the eviction policy named my_eviction_policy, enabling the low-priority geography strategy and
dropping ows from Azerbaijan (AZ) and Belize (BZ).
delete eviction-policy my_eviction_policy
678
LTM
Deletes the eviction policy named my_eviction_policy.
Options
• description
Provides a user-dened description for the policy.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• low-water
Species the aggressive sweeper activation threshold as a percentage of total capacity. The allowable
range is 50 - 100, and the low-water value must be lower than or equal to the high-water value. To
disable killing ows when limits are met or exceeded, set the low-water and high-water to 100 percent.
Default value is 85 percent.
• high-water
Species the target maximum load on the context. The adaptive reaper will be more aggressive as this
limit is approached. The allowable range is 50 - 100, and the high-water value must be higher than or
equal to the low-water value. To disable killing ows when limits are met or exceeded, set the low-water
and high-water to 100 percent. Defaults to 95 percent.
• slow-ow
Species whether to monitor and possibly remove ows considered to be slow.
• enabled
If true, the slow-ow monitoring and possible removal are activated. If false, the remaining slow-ow
attributes are unused. The default value is false.
• eviction-type
Indicates whether the threshold is based on an absolute count of slow ows, or a percentage of the
total ows on the context where the eviction policy is applied. There is no default value.
• grace-period
Species the minimum age of a slow ow before the ow is killed.
• maximum
Provides the count or percentage at which slow ows will be killed. If eviction-type is count, this
value is the absolute number of slow ows allowed; if eviction-type is percent, this is the percentage
of ows on the context that are allowed to fall under the threshold-bps before being killed.
• threshold-bps
Provides the threshold under which ows are considered to be slow, in bytes per second.
• throttling
Indicates whether to kill ows that are considered slow. If set to enabled, ows that fall under the
threshold-bps are subject to being killed according to the dened maximum number of ows.
• strategies
Denes the strategies to be used to select ows for eviction in the eviction policy.
• bias-bytes
Denes how to use the bias-bytes eviction strategy.
• delay
679
Traffic Management Shell (tmsh) Reference Guide
The delay allowed for new ows to transfer content, to prevent killing infant ows.
• enabled
Species whether to use the bias-bytes algorithm. If false, the bias-bytes algorithm is not used.
The default value is false.
• bias-idle
Denes how to use the bias-idle eviction strategy.
• enabled
Species whether to use the bias-idle algorithm. If false, the bias-idle algorithm is not used. The
default value is false.
• bias-oldest
Denes how to use the bias-oldest eviction strategy.
• enabled
Species whether to use the bias-oldest algorithm. If false, the bias-oldest algorithm is not used.
The default value is false.
• low-priority-geographies
Denes how to use the low-priority geographies eviction strategy.
• countries
Provides a list of country codes considered low-priority candidates to evict, based on GeoIP
information.
• enabled
Species whether to use the low-priority-geographies algorithm. If false, the
low-priority-geographies algorithm is not used. The default value is false.
• low-priority-port
Denes how to use the low-priority-port eviction strategy.
• enabled
Species whether to use the low-priority-port algorithm. If false, the low-priority-port algorithm
is not used. The default value is false.
• ports
Provides a list of ports considered low-priority candidates to evict.
• app-service
Species the name of the application service to which the object belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns
the object, you cannot modify or delete the object. Only the application service can modify
or delete the object.
• port-number
Species the port number considered low-priority. The number provided can be either a
number (e.g., 80) or a name (e.g., http).
• protocol
Species the protocol considered low-priority. The default value is any.
• low-priority-route-domain
680
LTM
Denes how to use the low-priority-route-domain eviction strategy.
• enabled
Species whether to use the low-priority-route-domain algorithm. If false, the
low-priority-route-domain algorithm is not used. The default value is false.
• names
Species a list of route domain names considered to be low-priority candidates to evict.
• low-priority-virtual-server
Denes how to use the low-priority-virtual-server eviction strategy.
• enabled
Species whether to use the low-priority-virtual-server algorithm. If false, the
low-priority-virtual-server algorithm is not used. The default value is false.
• names
Species a list of virtual server names considered to be low-priority candidates to evict.
See Also
create, delete, edit, list, modify, show, tmsh, regex, sys geoip
ifile
Congures an iFile.
Syntax
Congure the iFile component within the ltm module using the syntax shown in the following sections.
Create/Modify
create ifile [name]
modify ifile [name]
options:
app-service [[string] | none]
description [string]
file-name [ifile file object name]
edit ifile [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Display
list ifile
list ifile [ [ [name] | [glob] | [regex] ] ... ]
681
Traffic Management Shell (tmsh) Reference Guide
show running-config ifile
show running-config ifile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete ifile [name]
Description
You can use the ile component to congure an iFile. The iFile can then be referenced from an iRule, to
allow loading an external le into an iRule.
Examples
create ile my_ile le-name ile_le_object_name
Creates an iFile named my_ile, that gets its contents from the le object ile_le_object_name.
list ile all-properties
Displays all of the properties of all of the iFiles.
delete ile my_ile
Deletes the iFile named my_ile.
Options
• app-service
Species the name of the application service to which the iFile belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the iFile. Only the application service can modify or delete the iFile.
• description
User dened description.
• le-name
The name of the iFile File Object that this iFile uses.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
lsn-log-profile
Congures a Large-Scale Network Address Translation logging prole.
682
LTM
Syntax
Create/Modify
create lsn-log-profile [name]
modify lsn-log-profile [name | all]
app-service [[string] | none]
start-outbound-session {
action [disabled | enabled | backup-allocation-only]
elements [add | delete | replace-all-with] {
destination
}
}
end-outbound-session {
action [disabled | enabled | backup-allocation-only]
elements [add | delete | replace-all-with] {
destination
}
}
start-inbound-session {
action [disabled | enabled | backup-allocation-only]
}
end-inbound-session {
action [disabled | enabled | backup-allocation-only]
}
quota-exceeded {
action [disabled | enabled ]
}
errors {
action [disabled | enabled ]
}
edit lsn-log-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats lsn-log-profile
reset-stats lsn-log-profile [ [ [name] | [glob] | [regex] ] ... ]
Display
list lsn-log-profile
list lsn-log-profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config lsn-log-profile
show running-config lsn-log-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete lsn-log-profile [name | all]
683
Traffic Management Shell (tmsh) Reference Guide
Description
A LSN log prole allows ne grain control of the logging for LSN translation events. When attached to an
LSN pool, you can control the events to enable logging, and the elements in the log entry.
Examples
create ltm lsn-log-prole my_lsn_log_prole end-inbound-session { action enabled }
end-outbound-session { action enabled }
Creates the LSN log prole my_lsn_log_prole that generates log entries for both inbound and session
when the translation session ends.
delete lsn-log-prole my_lsn_log_prole
Deletes the LSN log prole named my_lsn_log_prole.
Options
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• events
The type of LSN translation events available for logging control.
• start-outbound-session
Event for start of outbound translation session, when the outbound ow is created.
• end-outbound-session
Event for end of outbound translation session, when the outbound ow is deleted.
• start-inbound-session
Event for start of incoming connection to a translated address.
• end-inbound-session
Event for end of incoming connection to a translated address.
• quota-exceeded
Event for when client exceeded allocated resource limit.
• errors
Event for when LSN encountered errors while attempting translation for clients.
• action
Specify the logging action to be taken when a particular event is encountered.
• enabled
Logging is enable for the event, whether translation is from the primary pool member or backup
pool member.
• backup-allocation-only
Logging is enable for the event, when translation is take from backup pool member only.
• disabled
Logging is disable for the event.
684
LTM
• elements
Optional elements that can be added to the log message.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
ltm lsn-pool, create, delete, edit, glob, list, ltm, modify, regex, show, tmsh
lsn-pool
Congures a Large-Scale Network Address Translation (or Carrier-Grade Network Address Translation)
pool.
Syntax
Create/Modify
create lsn-pool [name]
modify lsn-pool [name | all]
app-service [[string] | none]
backup-members
[add | delete | replace-all-with] {
[ip address/prefix length] ...
}
client-connection-limit [integer value]
description [string]
egress-interfaces
[add | delete | replace-all-with] {
[interface name] ...
}
egress-interfaces-disabled
egress-interfaces-enabled
hairpin-mode [enabled | disabled]
icmp-echo [enabled | disabled]
inbound-connections [automatic | explicit | disabled]
log-publisher [log publisher name | none]
log-profile [log profile name | none]
members
[add | delete | replace-all-with] {
[ip address/prefix length] ...
}
mode [deterministic | napt | pba]
persistence {
mode [none | address | address-port]
timeout [integer]
}
pcp {
profile [ name | none ]
selfip [ name | none]
dslite_tunnel [ name | none ]
}
port-block-allocation {
block-idle-timeout [integer]
block-lifetime [integer]
685
Traffic Management Shell (tmsh) Reference Guide
block-size [integer]
client-block-limit [integer]
zombie-timeout [integer]
}
route-advertisement [enabled | disabled]
translation-port-range [integer low:integer high | integer]
edit lsn-pool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats lsn-pool
reset-stats lsn-pool [ [ [name] | [glob] | [regex] ] ... ]
Display
list lsn-pool
list lsn-pool [ [ [name] | [glob] | [regex] ] ... ]
show running-config lsn-pool
show running-config lsn-pool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show lsn-pool
show lsn-pool [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete lsn-pool [name | all]
Description
A large-scale NAT (LSN) pool is a set of networks and port numbers that the BIG-IP system uses as
public-side addresses and ports. When you assign an LSN pool to a virtual server, the virtual server's clients
have their private addresses (and/or ports) translated to a public address and/or port from the LSN pool.
The public-side addresses and ports in the LSN pool are called translation addresses and ports.
Examples
create lsn-pool my_lsn_pool1 mode napt persistence { mode address-port timeout 600 } members add
{ 10.10.10.0/24 10.10.20.0/24 } translation-port-range 4000:5000 client-connection-limit 100
Creates the LSN pool my_lsn_pool1 that contains the translation addresses in the range of (members)
10.10.10.0/24 and 10.10.20.0/24, translation port range 4000-5000, with a client connection limit of 100
connections per client. The translated address and port are persisted for 600 seconds. This LSN pool operates
in NAPT mode (Network Address and Port Translation mode), which is the default mode if not specied.
delete lsn-pool my_lsn_pool1
686
LTM
Deletes the LSN pool named my_lsn_pool1.
Options
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• backup-members
Species translation IP addresses available in the backup pool which is used by DNAT translation mode
if DNAT mode translation fails and falls back to NAPT mode. This is a collection of IP prexes with
their prex lengths.
• client-connection-limit
The maximum number of simultaneous translated connections a client or subscriber is allowed to have.
• description
User dened description.
• egress-interfaces
The set of interfaces on which the source address translation is allowed or disallowed. If
egress-interfaces-enabled is specied, the source address translation is allowed only on the specied
set of interfaces. If egress-interfaces-disabled is specied, source address translation is disabled on
specied interfaces.
• egress-interfaces-disabled
Source address translation is not allowed on the interfaces specied in the egress-interfaces set.
• egress-interfaces-enabled
Source address translation is allowed on the interfaces specied in the egress-interfaces set.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hairpin-mode
Enable or disable hairpinning for incoming connections.
When a client sends a packet to another client in the same private network, hairpin mode sends the
packet directly to the destination client's private address; the BIG-IP system immediately translates the
packet's public-side destination address. Rather than going out to the public network and coming back
later for translation, the packet takes a hairpin turn at the BIG-IP device.
• icmp-echo
Enable or disable ICMP echo on translated addresses.
• inbound-connections
Modies the inbound-connection mode for incoming connections to translation endpoints. A translation
endpoint is the public-side address and port (X':x') for a private-side address (X:x). You can allow one
of three algorithms for managing inbound connections:
• Automatic
creates inbound mappings automatically from outbound trafc and allows inbound connections.
Consider an outbound mapping from X:x to X':x'. If a connection comes from X:x through X':x', the
BIG-IP system automatically creates a reverse mapping from X':x' back to X:x. A public-side station
687
Traffic Management Shell (tmsh) Reference Guide
can respond through the X':x' address. This allows the BIG-IP system to provide Endpoint Independent
Filtering (EIF) as dened in section 5 of RFC 4787 (http://tools.ietf.org/html/rfc4787#section-5).
• Explicit
only allows inbound connections for mappings that are explicitly created by another party, such as
iRules or a PCP request. For example, if a PCP request creates a mapping of X:x to X':x' and the
client at X:x uses it, an external caller can respond to the client through X':x'. However, if a client
at M:m automatically makes a NAT'ed connection through M':m', the BIG-IP does not support an
inbound connection from M':m' back to M:m.
• Disabled
disables inbound connections to translation end-points (X':x'). If there is a mapping of X (a private-side
IP address) to X' (a public-side IP), connections can only go out from X through X'. If a public-side
recipient tries to answer at the client's public-side X' address, the BIG-IP system does not map X'
back to X. The inbound connection never happens.
Port Control Protocol (PCP) is not supported if you use this setting.
• log-publisher
Specify the name of the log publisher which logs translation events. See help sys log-cong for more
details on the logging sub-system. Use the sys log-cong publisher component to set up a log publisher.
• log-prole
Specify the name of the LSN log prole which controls the logging of translation events. See help ltm
lsn-log-prole for more details on the logging prole sub-system. Use the ltm lsn-log-prole prole
component to set up a LSN log prole.
• members
Species the set of translation IP addresses available in the pool. This is a collection of IP prexes with
their prex lengths. All public-side addresses come from the subnets you enter in this property.
• mode
Species which kind of translation address mapping is performed when an address is translated. Available
options are NAPT, Deterministic, and PBA.
• NAPT
(Network Address Port Translation) assigns translation addresses and ports in round-robin fashion.
The algorithm rst cycles through translation addresses and then through translation ports.
• Deterministic
(DNAT) is a reversible translation method. A given client address and port always translates to a
particular public address and port from the LSN pool. This method has the following restrictions:
• it is only available for NAT44 translations,
• it does not support connections through DS-Lite tunnels,
• subscriber connections must be received over a VLAN with the property, cmp-hash, set to "source
ip,"
• the egress to the Internet must be over a VLAN with the property, cmp-hash, set to "dest ip,"
•
any virtual server (ltm virtual) that uses this LSN pool must have a source property set to an IP
prex containing fewer than 231 addresses. For example, the source cannot be 0.0.0.0/0.
• PBA
(Port Block Allocation) assigns 'blocks' of the translation addresses and ports to individual clients.
All client connections are restricted to the allocated port blocks. Only block allocations and
deallocations are logged in order to reduce the volume of logs.
688
LTM
• subscriber connections must be received over a VLAN with the property, cmp-hash, set to "source
ip,"
• the egress to the Internet must be over a VLAN with the property, cmp-hash, set to "dest ip,"
You can access your VLAN congurations through the net vlan component. You can nd the VLANs
used by your virtual server by showing or listing the ltm virtual component.
• name
Species a unique name for the lsn-pool component. This option is required for the commands create,
delete, and modify.
• persistence
Congure the persistence settings for LSN translation entries. Persistence is the preservation of a
public-side IP address for a client from session to session.
• persistence.mode
Congure the persistence mode for LSN translation entries. You can enter address, address-port, or
none.
• address
causes the BIG IP software to attempt to keep the IP address persistent but not necessarily the port.
If a client's private IP address:port combination is X:x, it's public-side address may be X':a in one
session, X':b in the next session, X':c in a third session, and so on.
• address-port
causes the BIG IP software to attempt to keep the IP address and port persistent. If a client's private
IP address:port combination is X:x, and it's public-side address is X':x' in the rst session, it remains
X':x' in all future sessions.
This is called "Endpoint Independent Mapping" in RFC 4787 (http://www.ietf.org/rfc/rfc4787.txt).
This is the only supported setting for PCP, which you congure with the pcp property.
• none
prevents the BIG IP software from attempting any IP address or port persistence. An address:port
combination of X:x is never guaranteed to have the same public-side address or port in two sessions.
• persistence.timeout
After the most-recent session where address:port X:x translated to X':x' on the public side, a timer begins.
If the timer expires before X:x has another session, X' or x' may be used as the public side of another
address:port. Use this parameter to set the timeout (in seconds) for address and port persistence.
• pcp
A Port Control Protocol (PCP) client can set (or at least learn) its own translation (public-side) IP address
and/or port. It can also set the address and/or port of a third-party client. PCP is dened in RFC 6887
(see http://www.ietf.org/rfc/rfc6887.txt).
• pcp.prole
Species the PCP prole to use for this LSN pool. This PCP prole denes the settings to use for
communication with PCP clients. Use the create ltm prole pcp command to create a new PCP prole.
PCP requires a prole (dened with this property) and either a pcp.selp or a pcp.dslite tunnel where
clients can send their PCP requests.
If you remove this prole option, you must specically remove any pcp.selp or pcp.dslite tunnel, too.
• pcp.selp
689
Traffic Management Shell (tmsh) Reference Guide
Species the PCP Server self-IP address for this LSN pool. The virtual server's clients send their PCP
packets to this address. Use the create net self command to create a self-IP address, then use that address
for this parameter. Choose a self-IP address in a VLAN that is reachable by the virtual server's clients.
• pcp.dslite
Species a DS-LITE tunnel for PCP packets. Whenever a client sends a PCP packet through this tunnel,
the BIG-IP device uses the PCP prole you choose with the pcp.prole property.
A DS-LITE tunnel places each IPv4 packet into the payload of an IPv6 packet. The IPv6 packet carries
the IPv4 packet between customer equipment and the BIG-IP system, which then removes the IPv4
packet, uses NAT to translate its IPv4 addresses, and sends it to its destination.
You cannot use this property if the mode property is set to Deterministic.
• port-block-allocation
Congures the port block settings for PBA mode.
• port-block-allocation.block-idle-timeout
Congures the time after the last connection using the block is freed that the block assignment expires.
The default value is 3600 seconds.
• port-block-allocation.block-lifetime
Congures the timeout after which the block is no longer used for new port allocations. The block
becomes a zombie block. The default is 0 which corresponds to an innite timeout.
• port-block-allocation.block-size
Congures the number of ports in a block. The default value is 64.
• port-block-allocation.client-block-limit
Congures the number of blocks that can be assigned to a single subscriber IP address. The default value
is 1.
• port-block-allocation.zombie-timeout
Congures the timeout after which connections using the zombie block are killed. After connections
are killed zombie block is freed after port-block-allocation.block-idle-timeout. This parameter is unused
unless the port-block-allocation.block-lifetime is set. The default value is 0 which corresponds to innite
timeout.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• route-advertisement
Species whether route advertisement is enabled or disabled for translated IP addresses.
• translation-port-range
Species the range of port numbers available for use with translation IP addresses.
See Also
ltm prole pcp, ltm virtual, net self, net vlan, create, delete, edit, glob, list, ltm, modify, regex, reset-stats,
show, tmsh
690
LTM
nat
Congures network address translation (NAT) for the Local Trafc Manager.
Syntax
Congure the nat component within the ltm module using the syntax in the following sections.
Create/Modify
create nat [name]
modify nat [name]
app-service [[string] | none]
arp
auto-lasthop [default | enabled | disabled ]
description [string]
[enabled | disabled]
originating-address [ip address]
translation-address [ip address]
traffic-group [[string] | default | non-default | none]
vlans [enabled | disabled]
vlans-disabled
vlans-enabled
reset-stats nat
reset-stats nat [ [ [name] | [glob] | [regex] ] ... ]
edit nat [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list nat
list nat [ [ [name] | [glob] | [regex] ] ... ]
show running-config nat
show running-config nat [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show nat
show nat [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete nat [name]
691
Traffic Management Shell (tmsh) Reference Guide
Description
A network address translation (NAT) denes a mapping between an originating IP address and an IP address
that you specify.
A primary reason for dening a NAT is to allow one of the servers in the server array behind the trafc
management system to start communication with a computer in front of, or external to, the system.
Examples
create nat new_nat translation-address 10.0.140.100 originating-address 11.0.0.100
The node behind the system with the IP address 10.0.140.100 has a presence in front of the BIG-IP(r) System
as IP address 11.0.0.100.
delete nat new_nat
Permanently deletes the NAT from the system conguration.
Additional Restrictions
The nat component has the following additional restrictions:
• A virtual server cannot use the IP address specied in the NAT.
• A NAT should not use an IP address of a BIG-IP system.
• A NAT cannot use an originating or translated IP address dened for and used by a SNAT or another
NAT.
• You must delete a NAT before you can redene it.
Options
• app-service
Species the name of the application service to which the NAT belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the NAT. Only the application service can modify or delete the NAT.
• arp
Enables or disables Address Resolution Protocol (ARP).
• description
User dened description.
• [enabled | disabled]
Enables or disables the NAT. The default value is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• inherited-trafc-group
Indicates if the trafc-group is inherited from the parent folder. This property is read only.
• originating-address
Species the IP address from which trafc is being initiated.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
692
LTM
• trafc-group
Species the trafc group of the failover device group on which the NAT is active. The default trafc
group is inherited from the containing folder.
• translation-address
Species the IP address that is translated or mapped, and the IP address to which it is translated or
mapped. This option is required when creating a NAT. This option may not be changed after the nat
has been created.
• unit
Species the unit in a redundant system. Derived from trafc-group. This property is read only.
• vlans
Species a list of existing VLANs on which access to the NAT is enabled or disabled. A NAT is accessible
on all VLANs by default.
• vlans-disabled
Indicates the NAT is disabled on the list of VLANs.
• vlans-enabled
Indicates the NAT is enabled on the list of VLANs.
See Also
create, delete, edit, glob, list, ltm snat, ltm snat-translation, modify, regex, reset-stats, show, tmsh
node
Congures node addresses and services.
Syntax
Congure the node component within the ltm module using the syntax in the following sections.
Create/Modify
create node [name]
modify node [name]
address [ip address]
app-service [[string] | none]
connection-limit [integer]
description [string]
[down | up]
dynamic-ratio [integer]
fqdn {
name [string]
address-family [ipv4 | ipv6]
autopopulate [enabled | disabled]
down-interval [integer]
interval [integer]
}
logging [enabled | disabled]
monitor [ [name] | none]
rate-limit [integer]
ratio [integer]
session [user-enabled | user-disabled]
693
Traffic Management Shell (tmsh) Reference Guide
state [user-down | user-up]
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
reset-stats node
reset-stats node [ [ [ip address] | [glob] | [regex] ] ... ]
edit node [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv node [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list node
list node [ [ [name] | [glob] | [regex] ] ... ]
show running-config node
show running-config node [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show node
show node [name]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete node [name]
Description
Displays information about nodes, and sets attributes of nodes and node IP addresses.
Examples
list node all-properties
Displays all of the properties of all of the nodes.
modify node all monitor none
Removes all monitor associations from nodes.
694
LTM
create node myNode address 10.10.10.15
Creates a node named myNode with an IP address of 10.10.10.15.
modify node myNode monitor none
Removes all monitor associations from the node, myNode.
show node
Displays statistics and status for all nodes in the system conguration.
show node all-properties
Displays statistics and status for all nodes in the system conguration. If the system includes Packet
Velocity(r) ASIC (PVA) and PVA Assist capabilities, this command displays status and statistics for that
feature.
mv /ltm node /Common/10.10.10.15 to-folder /Common/all_nodes
Moves the node 10.10.10.15 to a folder named all_nodes, where all_nodes has already been created under
/Common.
Note: If you wish to change the name of the node, you must use the nodes same IP Address or a name that
does not represent an IP Address that does not match the address congured on the node.
Please refer to the mv manual page for additional examples on how to use the mv command.
Options
• address
Species the IP address of the node.
• app-service
Species the name of the application service to which the node belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the node. Only the application service can modify or delete the node.
• connection-limit
Species the maximum number of connections that a node or node address can handle. The default
value is 0 (zero).
• description
Species a user-dened description.
• [down | up]
Marks the node up or down. The default value is down.
• dynamic ratio
Sets the dynamic ratio number for the node. The ratio weights are based on continuous monitoring of
the servers and are therefore continually changing. The default value is 1.
Dynamic Ratio load balancing can currently be implemented on RealNetworks RealServer platforms,
on Windows platforms equipped with Windows Management Instrumentation (WMI), or on a server
equipped with either the UC Davis SNMP agent or Windows 2000 Server SNMP agent.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• metadata
695
Traffic Management Shell (tmsh) Reference Guide
Associates user dened data, each of which has a name and value pair and persistence. The default value
is persistent, which saves the data to the cong le.
• fqdn
Species the attributes for dening a fully qualied domain name for the node.
• name
Species the fully-qualied domain name of the node.
• address-family
Species whether the fqdn should consider IPv4, IPv6, or IP-agnostic address family.
• autopopulate
Species whether a node dened by a fully-qualied domain name should automatically scale to
the set of IP addresses returned by the DNS query. If disabled, only one ephemeral node is generated
from the rst IP address returned by DNS. The default is disabled.
• interval
Species the interval to instantiate DNS queries on a fully-qualied domain name. The default is
the TTL.
• down-interval
Species the interval for the domain name resolution operation when a DNS query fails.
• logging
Species whether the monitor applied should log its actions. Logs are stored in /var/log/monitors/ and
are regularily rotated and compressed. The default value is disabled. This option isn't a part of
conguration and will reset to disabled on load. This option doesn't sync.
• monitor
Species the name of the monitor that you want to associate with the node. The default value is none.
• partition
Displays the administrative partition in which the node object resides.
• rate-limit
Species the maximum number of connections per second allowed for a node or node address. The
default value is 'disabled'.
• ratio
Species the xed ratio value used for a node during Ratio load balancing. The default value is 1.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• session
Establishing a session with a node is establishing the ability of the client to persist to the node when
making new connections. When a node is session disabled, clients that have already established sessions
with the node may create new connections, but a client that has not already established a session may
not create a new one (or make a connection which would create a new session). This feature is used to
gently drain connections from a node, typically as part of a maintenance operation. The default value
is user-enabled.
• state
696
LTM
Species the current state of the node. Use user-down to indicate that the node may not handle any new
connections. Use user-up, after using user-down, to indicate that the node may accept new connections.
• to-folder
This is used with the mv command to specify a folder in which to move the node to.
Note: nodes can be moved to any folder under /Common, but dependencies upon it may restrict moving
it out of /Common.
See Also
create, delete, edit, glob, list, ltm pool, modify, mv, regex, reset-stats, show, tmsh
policy
Congures a policy for Centralized Policy Manager.
Syntax
Modify the policy component within the ltm module using the syntax shown in the following sections.
For additional details, refer to Local Trafc Policy documentation on the AskF5 knowledge base at
http://support.f5.com.
Create/Modify
create policy [name]
modify policy [name]
controls [add | delete | modify | replace-all-with] {
none | forwarding | caching | compression | acceleration | asm |
avr | l7dos | classification | request-adaptation |
response-adaptation | server-ssl
}
requires [add | delete | modify | replace-all-with] {
none | http | tcp | client-ssl
}
rules [add | delete | modify | replace-all-with] {
[ [string] ] {
ordinal [ integer ] | app-service [ string ] |
conditions [add | delete | modify | replace-all-with] {
[ integer ] {
app-service | request | response | all | name | value | header |
scheme | host | port | path | query-string | extension |
path-segment | query-parameter | unnamed-query-parameter | major
|
minor | code | text | domain | expiry | version | username |
password | protocol | cipher | cipher-bits | rtt | mss | vlan |
vlan-id | route-domain | geoip | tcp | client-ssl | http-method
|
http-uri | http-version | http-status | http-host | http-header
| http-user-agent |
http-referer | http-cookie | http-set-cookie | http-basic-auth |
cpu-usage |
case-insensitive | case-sensitive | external | index | internal
|
local | missing | not | present | remote | values | equals |
starts-with | ends-with | contains | less | greater |
less-or-equal | greater-or-equal
697
Traffic Management Shell (tmsh) Reference Guide
} |
actions [add | delete | modify | replace-all-with] {
[ integer ] {
request | response | all | name | value | header | scheme | host
|
port | path | query-string | extension | path-segment |
query-parameter | unnamed-query-parameter | major | minor | code
|
text | domain | expiry | version | username | password | protocol
|
cipher | cipher-bits | rtt | mss | vlan | vlan-id | route-domain
|
tcp | client-ssl | http-method | http-uri | http-version |
http-status | http-host | http-header | http-referer | http-cookie
|
http-set-cookie | http-basic-auth
}
}
strategy [[string] | none]
Display
list policy
list policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show policy
show policy [name]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete policy [name]
Note: You must remove all references to a policy before you can delete it.
Description
You can use this policy component to congure the policy denitions on the Local Trafc Manager. A
load balancing policy is a logical set of rules that you group together to process and direct trafc.
Examples
create policy my_policy controls add { request-adaptation } requires add { http } strategy my_strategy
Creates a Local Trafc Manager policy named my_policy which controls request-adaptation of connections
to a virtual which is required to have an http policy. The strategy determining policy actions is my_strategy.
delete policy my_policy
Deletes the policy named my_policy.
698
LTM
show policy
Displays statistics and status for all Local Trafc Manager policies in the system conguration.
show policy all-properties
Displays statistics and status for all Local Trafc Manager policies in the system conguration.
Note that if the system includes Packet Velocity(r) ASIC (PVA) and PVA Assist capabilities, this command
displays status and statistics for that feature.
list policy my_policy
Displays properties of the policy named my_policy.
Options
• app-service
Species the name of the application service to which the policy belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the policy. Only the application service can modify or delete the policy.
• controls
Species the set of features the policy controls. Controls settings aid validation and help determine
choices for operands, conditions and actions you can use to dene the associated rules. Controls settings
also help detect/prevent conicts between multiple policies on the same virtual server.
• none
No features are controlled by this policy.
• forwarding
Forwarding is controlled by this policy.
• caching
Caching is controlled by this policy.
• compression
Compression is controlled by this policy.
• acceleration
Acceleration is controlled by this policy.
• asm
Application Security Management is controlled by this policy.
• avr
Application Visibility Reporting is controlled by this policy.
• l7dos
Layer 7 Dos Protection is controlled by this policy.
• classication
Classication is controlled by this policy.
• request-adaptation
Request Adaptation is controlled by this policy.
• response-adaptation
Response Adaptation is controlled by this policy.
• server-ssl
699
Traffic Management Shell (tmsh) Reference Guide
Server SSL behavior is controlled by this policy.
• description
User dened description.
• requires
Species the required prole types. A policy is applicable to certain types of virtual servers. The Requires
settings validate that policy can be applied to a virtual server (for example, the virtual server has the set
of required proles needed to execute this policy). In addition, the Requires settings govern the choices
for operands, conditions and actions you can use to dene the associated rules.
• none
No proles need to be attached to a virtual with this policy.
• http
An HTTP prole needs to be attached to a virtual with this policy.
• tcp
A TCP prole needs to be attached to a virtual with this policy.
• client-ssl
A Client-SSL prole needs to be attached to a virtual with this policy.
• rules
In the case where multiple rules match a strategy, determines which actions get executed, in what order.
• ordinal
The number used to rank the rules according to precedence.
• conditions
The conditions under which the rule applies. Specify the conditions you want to include in the
Conditions list. You can also edit and delete existing condition denitions.
• app-service
Species the name of the application service to which the condition belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the condition. Only the application service can modify or delete the
condition.
• request
The condition is matched on a request to the Virtual Server.
• response
The condition is matched on a response to the Virtual Server.
• geoip
Specify a condition based upon properties of the geographical location of the IP address, such as
continent code, country code, city, region, or organization. Parameters are available to identify which
interface (external[default] or internal) and address (remote[default] or local) to use.
• cpu-usage
Specify a condition based upon CPU usage percentage for the past 15 seconds, 1 minute or 5 minutes
intervals.
• http-user-agent
Specify a condition based upon User Agent sub-string, i.e. version, browser type, or mobile device
make and model.
700
LTM
• all
Species that all items should be selected.
• name
Species that the name should be selected.
• value
Species that a value should be selected.
• header
Species that a header should be selected.
• scheme
Species that a scheme should be selected.
• host
Species that a host should be selected.
• port
Species that a port should be selected.
• path
Species that a path should be selected.
• query-string
Species that a query string should be selected.
• extension
Species that an extension should be selected.
• path-segment
Species that a path segment should be selected.
• query-parameter
Species that a query parameter should be selected.
• unnamed-query-parameter
Species that an unnamed query parameter should be selected.
• major
Species that a major should be selected.
• minor
Species that a minor should be selected.
• code
Species that code should be selected.
• text
Species that text should be selected.
• domain
Species that a domain should be selected.
• expiry
Species that an expiry should be selected.
• version
701
Traffic Management Shell (tmsh) Reference Guide
Species that a version should be selected.
• username
Species that a username should be selected.
• password
Species that a password should be selected.
• protocol
Species that a protocol should be selected.
• cipher
Species that a cipher should be selected.
• cipher-bits
Species that cipher bits should be selected.
• rtt
Species that the round trip time should be selected.
• mss
Species that the maximum segment size should be selected.
• vlan
Species that the Vlan should be selected.
• vlan-id
Species that the Vlan ID should be selected.
• route-domain
Species that the route domain should be selected.
• tcp
Species that tcp connections should be examined.
• client-ssl
Species that tcp connections should be examined.
• http-method
Species that HTTP methods should be examined.
• http-uri
Species that HTTP URIs should be examined.
• http-version
Species that HTTP versions should be examined.
• http-status
Species that HTTP statuses should be examined.
• http-host
Species that HTTP hosts should be examined.
• http-header
Species that HTTP headers should be examined.
• http-referer
Species that HTTP referers should be examined.
702
LTM
• http-cookie
Species that HTTP cookies should be examined.
• http-set-cookie
Species that HTTP set cookies should be examined.
• http-basic-auth
Species that HTTP basic authorization should be examined.
• actions
Indicates the actions specied for the rule.
• response
Species that the action should be taken on a response from the Virtual Server in a connection.
• request
Species that the action should be taken on a request from the Virtual Server in a connection.
• insert
Species that a value should be inserted.
• replace
Species that a value should be replaced.
• apply
Species that an feature should be applied.
• add
Species that a value should be added.
• classify
Species that a value should be classied.
• remove
Species that a value should be removed.
• select
Species that a value should be selected.
• enable
Species that a feature should be enabled.
• disable
Species that a feature should be disabled.
• redirect
Species that a connection should be redirected.
• write
Species that a value should be written.
• reset
Species that a connection should be reset.
• event
Species that an event should occur.
• set-variable
703
Traffic Management Shell (tmsh) Reference Guide
Species that an variable should be set.
• policy
Species that a policy should be applied.
• rule
Species that a rule should be applied.
• action-id
Species that an action with a particular id should be applied.
• name
Species that a name should be given.
• index
Species that an indexed value in a list should be changed.
• all
Species that the action should be applied to every value selected.
• default
Species that a default action should be taken.
• next
Species that the next value should be modied.
• pin
Species that a connection should be pinned.
• value
Species that a value should be set.
• path
Species that a path should be set.
• extension
Species that an extension should be used.
• scheme
Species that a scheme should be adopted.
• host
Species that a host should be set.
• domain
Species that a domain should be set.
• expiry
Species that an expiry should be set.
• location
Species that a location should be set.
• query-string
Species that a query string should be set.
• port
Species that a port should be set.
704
LTM
• status
Species that a status should be set.
• content
Species that content should be set.
• ile
Species that an ile should be run.
• code
Species that a code should be set.
• text
Species that text should be set.
• username
Species that a username should be set.
• password
Species that a password should be set.
• prole
Species that a prole should be set.
• from-prole
Species that a from prole should be set.
• internal-virtual
Species that the connection should be sent through an internal virtual server.
• policy
Species that a policy should be invoked.
• script
Species that a script should be invoked.
• cookie
Species that a cookie should be set.
• expression
Species that an expression should be set.
• message
Species that a message should be set.
• pool
Species that the connection should go to a specic pool.
• clone-pool
Species that the connection should cloned and simultaneously sent to another pool.
• node
Species that a node should be set.
• member
Species that a member should be set.
• snat
705
Traffic Management Shell (tmsh) Reference Guide
Species that snatting policy should be set.
• snatpool
Species that a snat pool should be set.
• vlan
Species that a Vlan should be set.
• vlan-id
Species that a Vlan ID should be set.
• virtual
Species that a Virtual should be set.
• rateclass
Species that a rateclass should be applied.
• nexthop
Species that a nexthop should be set.
• query-parameter
Species that a query parameter should be set.
• unnamed-query-parameter
Species that an unnamed query parameter should be set.
• version
Species that a version should be set.
• application
Species that an application should be set.
• category
Species that a category should be set.
• protocol
Species that a protocol should be set.
• defer
Species that a connection should be deferred.
• local
Species that a local action should be taken.
• internal
Species that an internal action should be taken.
• http
Species that HTTP connections should be modied.
• http-uri
Species that HTTP URIs should be modied.
• http-host
Species that HTTP hosts should be modied.
• http-header
Species that HTTP headers should be modied.
706
LTM
• http-referer
Species that HTTP referers should be modied.
• http-cookie
Species that HTTP cookies should be modied.
• http-set-cookie
Species that HTTP set cookies should be modied.
• http-reply
Species that HTTP replies should be modied.
• log
Species that a log should be generated.
• pem
Species that the Policy Enforcement Manager should be applied.
• cache
Species that the cache should be modied.
• compress
Species that compression should be modied.
• decompress
Species that decompression should be modied.
• forward
Species that forwarding should be modied.
• tcp-nagle
Species that TCP nagling rules should be modied.
• wam
Species that the Acceleration Module should be invoked.
• asm
Species that the Application Security Manager should be invoked.
• l7dos
Species that a Layer 7 DOS protection policy should be invoked.
• avr
Species that Application Visibility Reporting should be invoked.
• tcl
Species that a TCL script should be invoked.
• response-adapt
Species that response adaptation should be invoked.
• request-adapt
Species that request adaptation should be invoked.
• server-ssl
Species that a Server SSL prole should be invoked.
• strategy
707
Traffic Management Shell (tmsh) Reference Guide
Species the match strategy to use for this policy. May either be a system provided strategy or a user
created one.
See Also
create, delete, edit, glob, list, modify, ltm policy-strategy, regex, reset-stats, show, tmsh
policy-strategy
Congures a policy-strategy for Centralized Policy Manager.
Syntax
Modify the policy-strategy component within the ltm module using the syntax shown in the following
sections.
For additional it's details, refer to Local Trafc Policy documentation on the AskF5 knowledge base at
http://support.f5.com.
Create/Modify
create policy-strategy [name]
modify policy-strategy [name]
[ strategy | [ all-match | best-match | first-match ] ]
operands [add | delete | modify | replace-all-with] {
[ [integer] ] {
all | http-header | password | tcp | app-service | http-host |
pathtext | cipher | http-method | path-segment |
unnamed-query-parameter | cipher-bits | http-referer | port |
username | client-ssl | http-set-cookie | protocol | value | code
|
http-status | query-parameter | version | domain | http-uri |
query-string | vlan | expiry | http-version | request | vlan-id |
extension | major | response | host | minor | route-domain |
http-basic-auth | mss | rtt | http-cookie | name | scheme
}
}
Display
list policy-strategy
list policy-strategy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete policy-strategy [name]
708
LTM
Description
You can use this policy-strategy component to congure a user dened matching strategy for centralized
policies.
Examples
create policy-strategy my_strategy strategy rst-match
Creates the policy strategy my_strategy which matches the rst rule selected.
Options
• app-service
Species the name of the application service to which the policy strategy belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the policy strategy. Only the application service can modify or delete the policy
strategy.
• description
User dened description.
• operands
Species the attribute for the rule to match. Sometimes this represents a specic value (for example,
http-method or http-status), but frequently the operand needs a specic Selector to identify an instance
(for example, http-header needs a Selector name parameter). Note: This option is only valid if best-match
is selected as the strategy to use.
• all
Select all attributes.
• http-header
Species to select when an HTTP header is processed.
• password
Species to select when a password is discovered.
• tcp
Species to select when a TCP connection is processed.
• app-service
Species the name of the application service to which the operand belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the operand. Only the application service can modify or delete the
operand.
• http-host
Species to select when an HTTP host is processed.
• path
Species to select when a path is matched.
• text
Species to select when text is matched.
• cipher
Species to select when a cipher is matched.
• http-method
709
Traffic Management Shell (tmsh) Reference Guide
Species to select when an HTTP method is processed.
• path-segment
Species to select when a path segment is matched.
• unnamed-query-parameter
Species to select when a unnamed query parameter is matched.
• cipher-bits
Species to select when cipher bits are matched.
• http-referer
Species to select when an HTTP referer is processed.
• port
Species to select when cipher bits are matched.
• username
Species to select when a username is matched.
• client-ssl
Species to select when a client SSL is matched.
• http-set-cookie
Species to select when an HTTP set cookie is processed.
• protocol
Species to select when a protocol is matched.
• value
Species to select when a value is matched.
• code
Species to select when a code is matched.
• http-status
Species to select when an HTTP status cookie is processed.
• query-parameter
Species to select when a query parameter is matched.
• version
Species to select when a version is matched.
• domain
Species to select when a domain is matched.
• http-uri
Species to select when an HTTP URI is processed.
• query-string
Species to select when a query string is matched.
• vlan
Species to select when a VLan is matched.
• expiry
Species to select when an expiry is matched.
710
LTM
• http-version
Species to select when an HTTP Version is processed.
• request
Species to select when the value selected is on request.
• vlan-id
Species to select when a VLan ID is matched.
• extension
Species to select when a VLan ID is matched.
• major
Species to select when a major is matched.
• response
Species to select when the value selected is on response.
• host
Species to select when a host is matched.
• minor
Species to select when a minor is matched.
• route-domain
Species to select when a route domain is matched.
• http-basic-auth
Species to select when an HTTP Basic Authorization is processed.
• mss
Species to select when a maximum segment size is matched.
• rtt
Species to select when a round trip time is matched.
• http-cookie
Species to select when an HTTP Basic Cookie is processed.
• name
Species to select when a name is matched.
• scheme
Species to select when a scheme is matched.
• strategy
Species the match method: all-match, best-match, or rst-match. On all-match, all matched rules are
returned to be processed. When best-match is selected, the best match as determined by the operands
determines the the value selected. When rst-match is selected, the value selected from the rst matched
rule (by precedence) is matched.
See Also
create, delete, edit, glob, list, modify, ltm policy, regex, reset-stats, show, tmsh
711
Traffic Management Shell (tmsh) Reference Guide
pool
Congures load balancing pools for the Local Trafc Manager.
Syntax
Modify the pool component within the ltm module using the syntax shown in the following sections.
Create/Modify
create pool [name]
modify pool [name]
all
allow-nat [yes | no]
allow-snat [yes | no]
app-service [[string] | none]
autoscale-group-id [[string] | none]
description [string]
gateway-failsafe-device [string]
ignore-persisted-weight [yes | no]
ip-tos-to-client [pass-through | [integer] ]
ip-tos-to-server [pass-through | [integer] ]
link-qos-to-client [pass-through | [integer] ]
link-qos-to-server [pass-through | [integer] ]
load-balancing-mode [dynamic-ratio-member | dynamic-ratio-node |
fastest-app-response | fastest-node |
least-connections-members |
least-connections-node |
least-sessions |
observed-member | observed-node |
predictive-member | predictive-node |
ratio-least-connections-member |
ratio-least-connections-node |
ratio-member | ratio-node | ratio-session |
round-robin | weighted-least-connections-member |
weighted-least-connections-node]
members [add | delete | modify | replace-all-with] {
[ [node_name:port] ] {
address [ip address]
app-service [[string] | none]
connection-limit [integer]
description [string]
dynamic-ratio [integer]
inherit-profile [enabled | disabled]
logging [enabled | disabled]
monitor [name]
priority-group [integer]
profiles [none | profile_name]
rate-limit [integer]
ratio [integer]
session [user-enabled | user-disabled]
state [ user-up | user-down ]
fqdn {
name [string]
address-family [ipv4 | ipv6]
autopopulate [enabled | disabled]
down-interval [integer]
interval [integer]
}
}
}
members none
metadata
712
LTM
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
min-active-members [integer]
min-up-members [integer]
min-up-members-action [failover | reboot | restart-all]
min-up-members-checking [enabled | disabled]
monitor [name]
profiles [none | profile_name]
queue-on-connection-limit [enabled | disabled]
queue-depth-limit [integer]
queue-time-limit [integer]
reselect-tries [integer]
service-down-action [drop | none | reselect | reset]
slow-ramp-time [integer]
edit pool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats pool
reset-stats pool [ [ [name] | [glob] | [regex] ] ... ]
mv pool [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list pool
list pool [ [ [name] | [glob] | [regex] ] ... ]
show running-config pool
show running-config pool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show pool
show pool [name]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete pool [name]
713
Traffic Management Shell (tmsh) Reference Guide
Note: You must remove all references to a pool before you can delete the pool.
Description
You can use this pool component to congure the pool denitions on the Local Trafc Manager. A load
balancing pool is a logical set of devices, such as Web servers, that you group together to receive and process
trafc.
Examples
create pool my_pool members add { member 10.2.3.11:http member 10.2.3.12:http }
Creates a Local Trafc Manager pool named my_pool with two members, 10.2.3.11 and 10.2.3.12, using
the default values for the pool and pool members.
delete pool my_pool
Deletes the pool named my_pool.
show pool
Displays statistics and status for all Local Trafc Manager pools in the system conguration.
show pool all-properties
Displays statistics and status for all Local Trafc Manager pools in the system conguration.
Note that if the system includes Packet Velocity(r) ASIC (PVA) and PVA Assist capabilities, this command
displays status and statistics for that feature.
list pool my_pool
Displays properties of the pool named my_pool.
mv /ltm pool /Common/my_pool to-folder /Common/some_folder
Moves an LTM pool named my_pool and all of its Pool Members to the folder named some_folder, where
some_folder has already been created under /Common.
Please refer to the mv manual page for additional examples on how to use the mv command.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• allow-nat
Species whether the pool can load balance network address translation (NAT) connections. The default
value is yes.
• allow-snat
Species whether the pool can load balance secure network address translation (SNAT) connections.
The default value is yes.
• app-service
Species the name of the application service to which the pool belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the pool. Only the application service can modify or delete the pool.
• autoscale-group-id
Species the autoscale-group id as reported by Amazon Web Services(AWS).
• description
714
LTM
User dened description.
• gateway-failsafe-device
Species that the pool is a gateway failsafe pool in a redundant conguration. The gateway-failsafe-device
identies the device that depends on the gateway. If the monitor associated with the pool reports that
the gateway is down, the device goes to the standby state. The default value for this string is empty, the
feature is not congured.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-persisted-weight
Discounts the weight of connections made to pool members selected through persistence, rather than as
a result of the algorithm congured on the pool. If the connection's weight is ignored, then it is not
treated as a 'pick' for that pool member, and does not inuence subsequent pool member load balancing
decisions.
This option only impacts pools congured with one of the following load balancing modes:
observed-member, observed-node, predictive-member, predictive-node,
ratio-least-connections-member, ratio-least-connections-node, ratio-member, or ratio-node.
The default value is no, which results in persisted pool member connections being accounted for during
load balancing calculations.
• ip-tos-to-client
Species the Type of Service (ToS) level to use when sending packets to a client. The default value is
65535 (pass-through).
• ip-tos-to-server
Species the ToS level to use when sending packets to a server. The default value is 65535 (pass-through).
• link-qos-to-client
Species the Link Quality of Service (QoS) level to use when sending packets to a client. The default
value is 65535 (pass-through).
• link-qos-to-server
Species the Link QoS level to use when sending packets to a server. The default value is 65535
(pass-through).
• load-balancing-mode
Species the modes that the system uses to load balance name resolution requests among the members
of this pool. The default value is round-robin.
The options are:
• dynamic-ratio-member
Species that the system distributes connections based on various aspects of real-time server
performance analysis, such as the number of current connections per node or the fastest node response
time.
This mode is similar to the dynamic-ratio-node mode, except that weights are based on continuous
monitoring of the servers and are therefore continually changing.
• dynamic-ratio-node
Species that the system distributes connections based on various aspects of real-time server
performance analysis, such as the number of current connections per node or the fastest node response
time.
715
Traffic Management Shell (tmsh) Reference Guide
This mode is similar to the dynamic-ratio-member mode, except that weights are based on continuous
monitoring of the servers and are therefore continually changing.
• fastest-app-response
Species that the system passes a new connection based on the fastest response of all currently active
nodes in a pool. This mode might be particularly useful in environments where nodes are distributed
across different logical networks.
• fastest-node
Species that the system passes a new connection based on the fastest response of all pools of which
a server is a member. This mode might be particularly useful in environments where nodes are
distributed across different logical networks.
• least-connections-member
Species that the system passes a new connection to the node that has the least number of current
connections in the pool. This mode works best in environments where the servers or other equipment
you are load balancing have similar capabilities.
This dynamic load balancing mode distributes connections based on various aspects of real-time
server performance analysis, such as the current number of connections per node or the fastest node
response time.
• least-connections-node
Species that the system passes a new connection to the node that has the least number of current
connections out of all pools of which a node is a member. This mode works best in environments
where the servers or other equipment you are load balancing have similar capabilities.
This dynamic load balancing mode distributes connections based on various aspects of real-time
server performance analysis, such as the number of current connections per node, or the fastest node
response time.
• least-sessions
Species that the system passes a new connection to the node that has the least number of current
sessions. This mode works best in environments where the servers or other equipment you are load
balancing have similar capabilities.
This dynamic load balancing mode distributes connections based on various aspects of real-time
server performance analysis, such as the number of current sessions.
• observed-member
Species that the system ranks nodes based on the number of connections. Nodes that have a better
balance of fewest connections receive a greater proportion of the connections.
This mode differs from the least-connections-member mode, which measures connections only at
the moment of load balancing, while the observed-member mode tracks the number of Layer 4
connections to each node over time and creates a ratio for load balancing.
This dynamic load balancing mode works well in any environment, but may be particularly useful
in environments where node performance varies signicantly.
• observed-node
Species that the system ranks nodes based on the number of connections. Nodes that have a better
balance of fewest connections receive a greater proportion of the connections.
This mode differs from least-connections-node mode, which measures connections only at the
moment of load balancing, while the observed-node mode tracks the number of Layer 4 connections
to each node over time and creates a ratio for load balancing.
This dynamic load balancing method works well in any environment, but may be particularly useful
in environments where node performance varies signicantly.
716
LTM
• predictive-member
Uses the ranking method used by the observed-member mode, except that the system analyzes the
trend of the ranking over time, determining whether a node's performance is improving or declining.
The nodes in the pool with better performance rankings that are currently improving, rather than
declining, receive a higher proportion of the connections. This dynamic load balancing mode works
well in any environment.
• predictive-node
Uses the ranking method used by the observed-node mode, except that the system analyzes the trend
of the ranking over time, determining whether a node's performance is improving or declining. The
nodes in the pool with better performance rankings that are currently improving, rather than declining,
receive a higher proportion of the connections. This dynamic load balancing mode works well in
any environment.
• queue-depth-limit
Species the maximum number of connections that may simultaneously be queued to go to any
member of this pool. The default is zero which indicates there is no limit.
• queue-on-connection-limit
Enable or disable queuing connections when pool member or node connection limits are reached.
When queuing is not enabled, new connections are reset when connection limits are met. The default
value is disabled.
• queue-time-limit
Species the maximum time, in milliseconds, a connection will remain enqueued. The default is
zero which indicates there is no limit.
• ratio-least-connections-member
Species that the system weights connections to each pool member based on the value of the ratio
weight dened for each pool member. If a ratio weight is unspecied, it will be treated as a default
value of '1'.
• ratio-least-connections-node
Species that the system weights connections to each pool member based on the value of the ratio
weight dened for the pool member's node. If a ratio weight is unspecied, it will be treated as a
default value of '1'.
• ratio-member
Species that the number of connections that each machine receives over time is proportionate to a
ratio weight you dene for each machine within the pool.
• ratio-node
Species that the number of connections that each machine receives over time is proportionate to a
ratio weight you dene for each machine across all pools of which the server is a member.
• ratio-session
Species that the number of sessions that each machine receives over time is proportionate to a ratio
weight that you dene for each machine within the pool.
• round-robin
Species that the system passes each new connection request to the next server in line, eventually
distributing connections evenly across the array of machines being load balanced. This mode works
well in most congurations, especially if the equipment that you are load balancing is roughly equal
in processing speed and memory.
• weighted-least-connections-member
717
Traffic Management Shell (tmsh) Reference Guide
Species that the system passes a new connection to the pool member that is handling the lowest
percentage of the specied maximum number of concurrent connections allowed. This mode works
best in environments where the servers or other equipment you are load balancing have different but
quantied capability limits.
This mode requires that you specify a value for the connection-limit option for all members of the
pool, but does not require all servers or other equipment you are load balancing to have similar
capabilities.
• weighted-least-connections-node
Species that the system passes a new connection to the node that is handling the lowest percentage
of the specied connection limit. This mode works best in environments where the servers or other
equipment you are load balancing have different but quantied capability limits.
This mode requires that you specify a value for the connection-limit option for all nodes, but does
not require all servers or other equipment you are load balancing to have similar capabilities.
• members
Adds, deletes, or replaces a set of pool members, by specifying a node name and service port in the
format [node name/port]. If a node by the specied name does not exist, it will be created. You can
congure the following options for a pool member:
• address
Species the IP address of a pool member if a node by the name specied does not already exist.
• app-service
Species the name of the application service to which the pool member belongs. The default value
is none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the pool member. Only the application service can modify or delete the
pool member.
• connection-limit
Species the maximum number of concurrent connections allowed for a pool member. The default
value is 0 (zero).
• description
User dened description.
• dynamic-ratio
Species a range of numbers that you want the system to use in conjunction with the ratio load
balancing method. The default value is 1.
• fqdn
Species the attributes for dening a fully qualied domain name for the node.
• name
Species the fully-qualied domain name of the node.
• address-family
Species whether the fqdn should consider IPv4, IPv6, or IP-agnostic address family.
• autopopulate
Species whether a node dened by a fully-qualied domain name should automatically scale
to the set of IP addresses returned by the DNS query. If disabled, only one ephemeral node is
generated from the rst IP address returned by DNS. The default is disabled.
• interval
718
LTM
Species the interval to instantiate DNS queries on a fully-qualied domain name. The default
is the TTL.
• down-interval
Species the interval for the domain name resolution operation when a DNS query fails.
• inherit-prole
Species whether the pool member inherits the encapsulation prole from the parent pool. The
default value is enabled. If you disable inheritance, no encapsulation takes place, unless you specify
another encapsulation prole for the pool member using the proles attribute.
• logging
Species whether the monitor applied should log its actions. Logs are stored in /var/log/monitors/
and are regularily rotated and compressed. The default value is disabled. This option isn't a part of
conguration and will reset to disabled on load. This option doesn't sync.
• monitor
Species the health monitors that are congured to monitor the pool member. The default value is
default, the system monitors the pool member using the monitors specied for the pool.
You can specify:
• A single monitor, for example, modify pool mypool members modify { pool_member_1:80 {
monitor http } }.
• Multiple monitors, for example, modify pool mypool members modify { pool_member_1:80
{ monitor http and https } }.
• A minimum number of monitors, for example, modify pool mypool members modify {
pool_member_1:80 { monitor min 1 of { http https } } }.
• No monitor rule or remove a monitor rule, for example, modify pool mypool members modify
{ pool_member_1:80 { monitor none } }.
• proles
Species the encapsulation prole to use for the pool member, when the inherit-prole attribute is
disabled. The default value is none.
• priority-group
Species the priority group within the pool for this pool member. Valid values are 0 through 65535.
The system sends trafc to groups in order of priority. The default value is 0.
• rate-limit
Species the maximum number of connections per second allowed for a pool member. The default
value is 'disabled'.
• ratio
Species the weight of the pool member for load balancing purposes. The default value is 1.
• session
Establishing a session with a pool member is establishing the ability of the client to persist to the
pool member when making new connections. When a pool member is session disabled, clients that
have already established sessions with the pool member may create new connections, but a client
that has not already established a session may not create a new one (or make a connection which
would create a new session). This feature is used to gently drain connections from a node, typically
as part of a maintenance operation. The default value is user-enabled.
719
Traffic Management Shell (tmsh) Reference Guide
The value of this property can be set by system or by user. If the value is set by system, the property
will not be displayed in "Edit" command. But, users can add this eld in if they need to modify this
property. The values which user can set for this property are user-enabled and user-disabled.
• state
user-down forces the pool member ofine, overriding monitors. user-up reverts the user-down.
When user-up, this displays the monitor state.
• metadata
Associates user-dened data, each of which has name and value pair and persistence. The default value
is persistent, which saves the data to the cong le.
• min-active-members
Species the minimum number of members that must be up for trafc to be conned to a priority group
when using priority-based activation. The default value is 0 (zero). An active member is a member that
is up (not marked down) and is handling fewer connections than its connection limit.
• min-up-members
Species the minimum number of pool members that must be up; otherwise, the system takes the action
specied in the min-up-members-action option.
Use this option for gateway pools in a redundant system where a unit number is applied to the pool.
This indicates that the pool is congured only on the specied unit.
• min-up-members-action
Species the action to take if min-up-members-checking is enabled, and the number of active pool
members falls below the number specied in the min-up-members option. The default value is failover.
The options are:
• reboot
Species that when the min-up-members-checking option is enabled, and the number of active
pool members is less than the number specied in the min-up-members option, the system restarts.
• restart-all
Species that when the min-up-members-checking option is enabled, and the number of active
pool members is less than the number specied in the min-up-members option, the system restarts.
• failover
Species, for a redundant system, that when the min-up-members-checking option is enabled, and
the number of active pool members is less than the number specied in the min-up-members option,
the system fails over.
• min-up-members-checking
Enables or disables the min-up-members feature. If you enable this feature, you must also specify a
value for both the min-up-members and min-up-members-action options.
• monitor
Species the health monitors that the system uses to determine whether it can use this pool for load
balancing. The monitor marks the pool up or down based on whether the monitor is successful. The
default value is none.
You can specify:
• A single monitor, for example, modify pool mypool monitor http.
• Multiple monitors, for example, modify pool mypool monitor http and https.
• A minimum number of monitors, for example, modify pool mypool monitor min 1 of {http and
https}.
720
LTM
• No monitor rule or remove a monitor rule, for example, modify pool mypool monitor none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the pool resides.
• proles
Species the prole to use for encapsulation. The default value is none, which indicates no encapsulation.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reselect-tries
When set to the default value of 0 (zero) the system does not attempt to load balance to another pool
member after a passive failure. A passive failure is a pool member connection failure.
When set to any other value, the system attempts to load balance to another pool member after a passive
failure, and if that attempt also results in a passive failure, the system repeats the process until the
specied number of reselection tries is reached.
• reset-stats
Resets the statistics for the specied component to 0 (zero).
• service-down-action
Species the action to take if the service specied in the pool is marked down. The options are:
• drop
Species that the system drops connections when a the service is marked down.
• none
Species that the system takes no action when a the service is marked down. This is the default
value.
• reselect
Species that the system reselects a node for the next packet that comes in on a Layer 4 connection,
if the service of the existing connection is marked down.
• reset
Species that the system resets when a the service is marked down.
• slow-ramp-time
Species, in seconds, the ramp time for the pool. This provides the ability to cause a pool member that
has just been enabled, or marked up, to receive proportionally less trafc than other members in the
pool. The proportion of trafc the member accepts is determined by how long the member has been up
in comparison to the value of the slow-ramp-time option for the pool.
For example, if the load-balancing-mode of a pool is round-robin and it has a slow-ramp-time of 60
seconds, when a pool member has been up for only 30 seconds, the pool member receives approximately
half the amount of new trafc as other pool members that have been up for more than 60 seconds. After
the pool member has been up for 45 seconds, it receives approximately three quarters of the new trafc.
The slow-ramp-time option is particularly useful when used with the least-connections-member load
balancing mode. The default value is 10.
721
Traffic Management Shell (tmsh) Reference Guide
• to-folder
This is used with the mv command to specify a folder in which to move the pool and its members to.
Note: pools can be moved to any folder under /Common, but dependencies upon it may restrict moving
it out of /Common.
See Also
create, delete, edit, glob, list, modify, mv, ltm virtual, regex, reset-stats, show, tmsh
rule
Congures an iRule for trafc management system conguration.
Syntax
Congure the rule component within the ltm module using the syntax shown in the following sections.
Create/Modify
create rule [name]
edit rule [name]
modify rule [ [ [name] | [glob] | [regex] ] ... ]
Note: When using tmsh, you can only create iRules using the editor, which starts when you use the create
or edit commands. You cannot create an iRule directly on the command line. The vim editor applies the
autoindent and smartindent options. You can toggle on/off paste mode using the F12 key.
Note: You can also edit user metadata associated with an iRule. See the example section for more
information.
Display
list rule
list rule [ [ [name] | [glob] | [regex] ] ... ]
show running-config rule
show running-config rule [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show rule
show rule [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
mv rule [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
722
LTM
| [[name...name] to-folder [folder-name]] ]
to-folder
Delete
delete rule [name]
Generate
generate rule [name]
checksum
signature
Description
You cannot edit the system rules that come with the BIG-IP system. However, you can open a system rule
in the editor and use it as a template to create a new rule.
To create a new rule using a system rule as a template:
• Enter the command sequence edit rule [system rule name].
tmsh opens the system rule in an editor.
• Change the name of the rule in the editor.
• Edit the rule and exit the editor.
tmsh checks for syntax errors, and if there are none, it saves the new rule.
For more information about iRules(r), see http://devcentral.f5.com/.
Examples
list rule
Displays all iRules.
delete rule my_irule
Deletes the iRule named my_irule.
rule my_irule { when RULE_INIT { } priority 1
when SERVER_CONNECTED {
}
timing on
check strict
}
Creates an iRule named my_irule.
generate rule my_irule checksum
Generates a checksum for the rule denition and adds the checksum to the rule.
generate rule my_irule signature signing-key my_key
Generates a signature for the rule denition using the specied private key and adds the signature to the
rule.
723
Traffic Management Shell (tmsh) Reference Guide
Note: For a rule that includes a checksum or signature to successfully load, the rule denition contents must
match the stored checksum or signature. To modify the rule denition and still retain the checksum or
signature, the ignore-verication attribute must be set to true. This is done by editing the rule and adding
the ignore-verication attribute, which allows the modied rule to load and changes the verication status
to Not Veried:
rule my_irule { when RULE_INIT {} denition-checksum 7c0dba9aa53e8959042c6cfe041d3d11
ignore-verication true }
Modies an existing iRule named my_irule by adding a new metadata and modifying an existing metadata:
modify rule my_irule { when RULE_INIT {} denition-checksum 7c0dba9aa53e8959042c6cfe041d3d11
metadata replace-all-with { my_meta { persist false value "hello" } my_meta2 { persist false value "hello
2" } } }
The metadata attribute is the user dened key/value pair. Metadata has the following format:
metadata [add | delete | modify] { [metadata_name] { value [ "value content" ] persist [ true | false ] } }>
Deletes a metadata from an iRule:
modify rule my_irule { when RULE_INIT {} denition-checksum 7c0dba9aa53e8959042c6cfe041d3d11
metadata delete { my_meta } }
mv /ltm rule /Common/my_rule to-folder /Common/some_folder
Moves an iRule named my_rule to the folder named some_folder, where some_folder has already been
created under /Common.
Note: Please note that you may not move an iRule that has an explicit usage of a conguration object, such
as a pool.
Options
• checksum
Generates a checksum for the rule denition and adds the checksum to the rule. This option is used only
with the generate command.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the create, delete, and modify
commands.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• signature
Generates a signature for the rule denition using the specied private key and adds the signature to the
rule as a property. This option is used only with the generate command.
• signing-key
Species the private key to use for signing the rule. This is used only with the signature option.
• meta-data
724
LTM
Species the user-dened key/value pair associated with the rule. See the example section for usage
format.
• app-project
Species the dev plugin this rule belongs to. This is a read-only attribute.
See Also
create, delete, edit, generate, glob, list, modify, mv, regex, show, tmsh
snat
Congures secure network address translation (SNAT).
Syntax
Congure the snat component within the ltm module using the syntax shown in the following sections.
Create/Modify
create snat [name]
modify snat [name]
(automap | none)
auto-lasthop [default | enabled | disabled ]
app-service [[string] | none]
description [string]
mirror { [disabled | enabled | none] }
origins
[add | delete | replace-all-with] {
[address ... | address/mask ... ]
}
snatpool [ name ]
source-port [change | preserve | preserve-strict ]
translation [translation name ... ]
vlans
[add | delete | replace-all-with] {
[vlan name ... ]
}
vlans [ default | none]
[vlans-disabled | vlans-enabled ]
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
edit snat [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
725
Traffic Management Shell (tmsh) Reference Guide
Display
list snat
list snat [ [ [name] | [glob] | [regex] ] ... ]
show running-config snat
show running-config snat [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show snat
show snat [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete snat [name]
Description
You can use the snat component to congure a SNAT. A SNAT denes the relationship between an
externally visible IP address, SNAT IP address, or translated address, and a group of internal IP addresses,
or originating addresses, of individual servers at your site.
Examples
create snat my_snat origins add { 10.1.1.3 } translation mySnatTranslation
Creates the SNAT my_snat that translates the address of connections that originate from the address 10.1.1.3
to the translation address mySnatTranslation.
list snat all-properties
Displays all properties for all SNATs.
Options
• automap
Species that the system translates the source IP address to an available self IP address when establishing
connections through the virtual server. You can use this option only if you do not use the snatpool and
translation options.
Note that when you use the edit command to create a new snat, by default automap is enabled. If you
do not want to use automap, you must turn this feature off by using the none option.
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• description
User dened description.
• glob
726
LTM
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• mirror
Enables or disables mirroring of SNAT connections. The default value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• origins
Species a set of IP addresses and subnets from which connections originate. This option is required.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• snatpool
Species the name of a SNAT pool. You can only use this option if you do not use the automap and
translation options.
• source-port
Species whether the system preserves the source port of the connection. The default value is preserve.
The options are:
• change
Use this setting to obfuscate internal network addresses.
• preserve
Species to preserve the source port of the connection.
• preserve-strict
Use this value only for UDP under very special circumstances such as nPath or transparent (that is,
no translation of any other L3/L4 eld), where there is a 1:1 relationship between virtual IP addresses
and node addresses, or when clustered multi-processing (CMP) is disabled.
• translation
Species the name of a translated IP address. Note that translated addresses are outside the trafc
management system. You can use this option only if you do not use the automap and snatpool options.
• vlans
Species the name of the VLAN to which you want to assign the SNAT. The default value is none.
• vlans-disabled
Disables the SNAT for all specied VLANs. When the "vlans" value is set to "none", the "vlans-disabled"
option enables the SNAT on all VLANs.
• vlans-enabled
Enables the SNAT for all specied VLANs. When the "vlans" value is set to "none", the "vlans-enabled"
option disables the SNAT on all VLANs.
• metadata
Associates user dened data, each of which has name and value pair and persistence. Persistent(default)
means the data will be saved into cong le.
727
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, ltm snat-translation, ltm snatpool, modify, regex, show, tmsh
snat-translation
Congures an explicit secure network address translation (SNAT) translation address.
Syntax
Congure the snat-translation component within the ltm module using the syntax shown in the following
sections.
Create/Modify
create snat-translation [all | [name] ]
modify snat-translation [all | [name] ]
address [ip address]
arp [disabled | enabled]
app-service [[string] | none]
connection-limit [integer]
description [string]
[disabled | enabled]
ip-idle-timeout [indefinite | [integer] ]
tcp-idle-timeout [indefinite | [integer] ]
udp-idle-timeout [indefinite | [integer] ]
traffic-group [[string] | default | non-default | none]
edit snat-translation [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list snat-translation
list snat-translation [ [ [name] | [glob] | [regex] ] ... ]
show running-config snat-translation
show running-config snat-translation [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show snat-translation
show snat-translation [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete snat-translation [all | [name] ]
728
LTM
Description
Explicitly denes the properties of a SNAT translation address.
Examples
modify snat-translation all arp disabled
Disables Address Resolution Protocol (ARP) on all SNAT translation addresses.
list snat-translation all-properties
Displays all properties of all SNAT translation addresses.
Options
• address
The translation IP address.
• arp
Indicates whether the system responds to ARP requests or sends gratuitous ARPs. The default value is
enabled.
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• connection-limit
Species the number of connections a translation address must reach before it no longer initiates a
connection. The default value of 0 (zero) indicates that the option is disabled.
• description
User dened description.
• disabled
Disables SNAT translation.
• enabled
Enables SNAT translation. The default value is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ip-idle-timeout
Species the number of seconds that IP connections initiated using a SNAT address are allowed to
remain idle before being automatically disconnected. The default value is indenite.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• tcp-idle-timeout
Species the number of seconds that TCP connections initiated using a SNAT address are allowed to
remain idle before being automatically disconnected. The default value is indenite.
• udp-idle-timeout
729
Traffic Management Shell (tmsh) Reference Guide
Species the number of seconds that UDP connections initiated using a SNAT address are allowed to
remain idle before being automatically disconnected. The default value is indenite.
• unit
Read-only property that species the unit in a redundant system. Derived from trafc-group.
• trafc-group
Species the trafc group of the failover device group on which the SNAT is active. The default trafc
group is inherited from the containing folder.
• inherited-trafc-group
Read-only property that indicates if the trafc-group is inherited from the parent folder.
See Also
create, delete, edit, glob, list, modify, ltm snat, ltm snatpool, regex, show, tmsh
snatpool
Congures a secure network address translation (SNAT) pool.
Syntax
Congure the snatpool component within the ltm module using the syntax shown in the following sections.
Create/Modify
create snatpool [name]
modify snatpool [name]
app-service [[string] | none]
description [string]
members
[add | delete | replace-all-with] {
[ip address ... ]
}
members [default | none]
edit snatpool [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats snatpool
reset-stats snatpool [ [ [name] | [glob] | [regex] ] ... ]
Display
list snatpool
list snatpool [ [ [name] | [glob] | [regex] ] ... ]
show running-config snatpool
show running-config snatpool [ [ [name] | [glob] | [regex] ] ... ]
730
LTM
all-properties
non-default-properties
one-line
show snatpool
show snatpool [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete snatpool [name]
Description
A SNAT pool is a pool of translation addresses that you can map to one or more original IP addresses.
Translation addresses in a SNAT pool are not self-IP addresses. You can simply create a SNAT pool and
then assign it as a resource directly to a virtual server. This eliminates the need for you to explicitly dene
original IP addresses to which to map translation addresses.
Examples
create snatpool my_snat_pool1 members add { 11.12.11.24 11.12.11.25 }
Creates the SNAT pool my_snat_pool1 that contains the translation addresses (members) 11.12.11.24 and
11.12.11.25.
delete snatpool my_snat_pool1
Deletes the SNAT pool named my_snat_pool1.
Options
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• members
Species translation IP addresses of the pools in the SNAT pool.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
731
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, ltm snat, ltm snat-translation, modify, regex, reset-stats, show, tmsh
traffic-class
Congures a trafc class.
Syntax
Congure the trafc-class component within the ltm module using the syntax shown in the following
sections.
Create/Modify
create traffic-class [name]
modify traffic-class [name]
options:
app-service [[string] | none]
classification [string]
description [string]
destination-address [ [ip address] | none]
destination-mask [ [ip address] | none]
destination-port [ [integer] | [port name] ]
protocol [any | [protocol] ]
source-address [ [ip address] | none]
source-mask [ [ip address] | none]
source-port [ [integer] | [port name] ]
edit traffic-class [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Display
list traffic-class
list traffic-class [ [ [name] | [glob] | [regex] ] ... ]
show running-config traffic-class
show running-config traffic-class [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete traffic-class [name]
732
LTM
Description
You can use the trafc-class component to congure a trafc class, which is a named group of ports,
machines, and subnets. You can then assign this trafc class to a virtual server in order to congure the
virtual server to achieve specic Quality of Service (QoS) standards.
Examples
create trafc-class my_trafc_class classication "My trafc class."
Creates a trafc class named my_trafc_class, which tags matching ows with the tag My trafc class.
list trafc-class all-properties
Displays all of the properties of all of the trafc classes.
delete trafc-class my_trafc_class
Deletes the trafc class named my_trafc_class.
Options
• app-service
Species the name of the application service to which the trafc class belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the trafc class. Only the application service can modify or delete the trafc
class.
• classication
Species the actual textual tag to be associated with the ow if the trafc class is matched. This option
is required.
• description
User dened description.
• destination-address
Species destination IP addresses for the system to use when evaluating trafc ow. If trafc ow
matches this value, it is tagged with the value in the classication option. The default value is none.
• destination-mask
Species a destination IP address mask for the system to use when evaluating trafc ow. If trafc ow
matches this value, it is tagged with the value in the classication option. The default value is none.
• destination-port
Species a destination port for the system to use when evaluating trafc ow. If trafc ow matches
this value, it is tagged with the value in the classication option. The default value is 0 (zero).
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• protocol
Species a protocol for the system to use when evaluating trafc ow. If trafc ow matches this value,
it is tagged with the value in the classication option. The default value is any.
• regex
733
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• source-address
Species source IP addresses for the system to use when evaluating trafc ow. If trafc ow matches
this value, it is tagged with the value in the classication option. The default value is none.
• source-mask
Species a source IP address mask for the system to use when evaluating trafc ow. If trafc ow
matches this value, it is tagged with the value in the classication option. The default value is none.
• source-port
Species a source port for the system to use when evaluating trafc ow. If trafc ow matches this
value, it is tagged with the value in the classication option. The default value is 0 (zero).
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, tmsh
urlcat-query
Displays the category to which a url belongs
Syntax
Use the urlcat-query component within the ltm module to query the category the url belongs to.
Display
show ltm urlcat-query [string]
Description
You can use the urlcat-query component to query the category a url belongs to
Examples
show ltm urlcat-query www.google.com
Displays the category "www.google.com" belongs to.
Options
• string
Specify the urlname.
See Also
show, tmsh
734
LTM
virtual
Congures a virtual server.
Syntax
Congure the virtual component within the ltm module using the syntax shown in the following sections.
Create/Modify
create virtual [name]
modify virtual [name]
all
address-status [yes | no]
app-service [[string] | none]
auth [add | delete | replace-all-with] {
[profile_name ... ]
}
auth [default | none]
auto-lasthop [default | enabled | disabled ]
clone-pools [add | delete | replace-all-with] {
[pool_name ... ] {
context [clientside | serverside]
}
}
clone-pools none
cmp-enabled [yes | no]
connection-limit [integer]
dhcp-relay
description [string]
destination [ [virtual_address_name:port] | [ipv4:port] | [ipv6.port] ]
[disabled | enabled]
fallback-persistence [none | [profile name] ]
flow-eviction-policy [none | [eviction policy name] ]
fw-enforced-policy [ [policy_name] | none ]
fw-staged-policy [ [policy_name] | none ]
gtm-score [integer]
http-class none
http-class {
[profile_name ...]
}
ip-forward
ip-protocol [any | [protocol]
internal
l2-forward
last-hop-pool [ [pool_name] | none]
mask { [ipv4] | [ipv6] }
mirror { [disabled | enabled | none] }
nat64 [enabled | disabled]
persist [replace-all-with] {
[profile_name ... ] {
default [no | yes]
}
}
persist none
pool [ [pool_name] | none]
profiles [add | delete | replace-all-with] {
[profile_name ...] {
context [all | clientside | serverside]
}
}
profiles [default | none]
rate-class [name]
735
Traffic Management Shell (tmsh) Reference Guide
rate-limit [integer]
rate-limit-mode [destination | object | object-destination |
object-source | object-source-destination | source |
source-destination]
rate-limit-dst [integer]
rate-limit-src [integer]
related-rules { none | [rule_name ...] }
reject
rules { [none | [rule_name ... ] }
service-down-immediate-action [none | drop | reset]
service-policy [ [policy_name] | none ]
snat [automap | none] DEPRECATED - see source-address-translation
snatpool [snatpool_name] DEPRECATED - see source-address-translation
source { [ipv4[/prefixlen]] | [ipv6[/prefixlen]] }
source-address-translation {
pool [ [pool_name] | none]
type [ automap | lsn | snat | none ]
}
source-port [change | preserve | preserve-strict]
traffic-classes [add | delete | replace-all-with] {
[traffic_class_name ...]
}
traffic-classes [default | none]
translate-address [enabled | disabled]
translate-port [enabled | disabled]
vlans [add | delete | replace-all-with] {
[vlan_name ... ]
}
vlans [default | none]
vlans-disabled
vlans-enabled
metadata [add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
reset-stats virtual [ [ [name] | [glob] | [regex] ] ... ]
fw-enforced-policy-rules { [rule name] }
fw-staged-policy-rules { [rule name] }
profiles { [profile name] }
options:
ip-intelligence-categories
port-misuse
Display
list virtual
list virtual [ [ [name] | [glob] | [regex] ] ...]
show running-config virtual
show running-config virtual [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show virtual
show virtual [ [ [name] | [glob] | [regex] ] ... ]
736
LTM
all-properties (default | exa | gig | kil | meg | peta | raw | tera |
yotta | zetta)
detail
field-fmt
ip-intelligence-categories
port-misuse
mv virtual [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Delete
delete virtual [name]
Description
You can use the virtual component to create, delete, modify properties on, and display information about
virtual servers. Virtual servers are externally visible IP addresses that receive client requests. Rather than
sending the requests directly to the destination IP address specied in the packet header, it sends the requests
to any of several content servers that make up a load balancing pool. Virtual servers also apply various
behavioral settings to multiple trafc types, enable persistence for multiple trafc types, and direct trafc
according to user-written iRules(r).
Note: After you congure a Global Trafc Manager listener, when you use the tab completion feature
within the ltm module, the listener displays as one of the virtual servers in the Conguration Items section.
Examples
create virtual myV2 { destination 11.11.11.12:any persist replace-all-with { source_addr } } pool
myPool}
Creates a virtual server named myV2, which uses the source address persistence method.
modify virtual vs_4_http4 proles replace-all-with { prole-udp }
Replaces the prole associated with the virtual server vs_f14_http4.
Note: To replace the prole associated with a virtual server, you must enclose the name of the new prole
in curly brackets.
delete virtual myV4 myV5 myV6
Deletes the virtual servers named myV4, myV5, and myV6.
show virtual myV4
Displays statistics and status for the virtual named myV4.
show virtual myV4 all-properties
Displays statistics and status for the virtual named myV4.
Note: If the system includes Packet Velocity(r) ASIC (PVA) and PVA Assist capabilities, this command
displays status and statistics for that feature.
mv /ltm virtual /Common/my_vip to-folder /Common/some_folder
737
Traffic Management Shell (tmsh) Reference Guide
Moves a virtual server named my_vip to the folder named some_folder, where some_folder has already
been created under /Common.
Note: Please note that you may not move a virtual server that is associated with CGNAT conguration
items, such as LSN pools.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• address-status
Species whether the virtual will contribute to the operational status of the associated virtual-address.
The default value is 'yes'.
• app-service
Species the name of the application service to which the virtual server belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the virtual server. Only the application service can modify or delete the virtual
server.
• auth
Species a list of authentication prole names, separated by spaces, that the virtual server uses to manage
authentication.
• clone-pools
Species a pool or list of pools that the virtual server uses to replicate either client or server trafc. You
must specify a value of either clientside or serverside for the context option for each clone pool.
Typically, this option is used for intrusion detection.
• cmp-enabled
Enables or disables clustered multi-processor (CMP) acceleration. This feature applies to certain platforms
only. The default value is yes.
• connection-limit
Species the maximum number of concurrent connections you want to allow for the virtual server. The
default value of 0 (zero) allows for an unlimited number of concurrent connections.
• context
Species that the pool is either a clientside or serverside clone pool.
Note: Because validation occurs outside of TMSH, you will receive an error when you modify the
context for proles in a virtual server.
• dhcp-relay
Species a virtual server that relays all received dhcp requests to all pool members. If there is no pool,
the received request get dropped. If you specify the dhcp-relay option, you cannot use the ip-forward
or l2-forward or reject options.
• description
User dened description.
• destination
Species the name of the virtual address and service on which the virtual server listens for connections.
The format for "ipv4" is a. b. c. d [: port ]. The format for an "ipv6" address is a: b: c: d: e: f: g: h [. port
].
738
LTM
The default value is any:any.
• (enabled | disabled)
Species the state of the virtual server. The default value is enabled.
Note: When you disable a virtual server, the virtual server no longer accepts new connection requests.
However, it allows current connections to nish processing before going to a down state.
• fallback-persistence
Species a fallback persistence prole for the virtual server to use when the default persistence prole
is not available. The default value is none.
• ow-eviction-policy
Species a ow eviction policy for the virtual server to use, to select which ows to terminate when
the number of connections approaches the connection limit on the virtual server. The default value is
none.
• fw-enforced-policy
Species an enforced rewall policy. fw-enforced-policy rules are enforced on a virtual server.
• fw-enforced-policy-rules
Species rewall rules enforced on ltm virtual via referenced fw-enforced-policy.
• fw-staged-policy
Species a staged rewall policy. fw-staged-policy rules are not enforced while all the visibility aspects
namely statistics, reporting and logging function as if the fw-staged-policy rules were enforced on a
virtual server.
• fw-staged-policy-rules
Species rewall rules staged on ltm virtual via referenced fw-staged-policy.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• gtm-score
Species a score that is associated with the virtual server. Global Trafc Manager (GTM) can rely on
this value to load balance trafc in a proportional manner.
• http-class
Species a list of HTTP class proles, separated by spaces, with which the virtual server works to
increase the speed at which the virtual server processes HTTP requests. The default value is none. The
order in which the proles are entered sets the priority of each prole, in ascending order, specic to
this virtual server.
• ip-forward
Species a virtual server that has no pool members to load balance, but instead, forwards the packet
directly to the destination IP address specied in the client request. If you specify the ip-forward option,
you cannot use the l2-forward or reject options.
• ip-protocol
Species the IP protocol for which you want the virtual server to direct trafc. Sample protocol names
are TCP and UDP. The default value is any.
Note: You do not use this setting when creating an HTTP class virtual server.
• internal
739
Traffic Management Shell (tmsh) Reference Guide
Species an internal virtual server that handles requests for a parent virtual server, such as content
adaptation. Internal virtual servers do not receive external connections, instead they are specied by
name by proles in the parent virtual server (see ltm prole request-adapt and ltm prole
response-adapt). Since internal virtual servers do not listen for external connections, not all attributes
are used for internal virtual servers. The destination, mask, translate-address, translate-port, vlans,
vlans-disabled and vlans-enabled attributes are set by the system, any attempt to change them will
have no effect.
• l2-forward
Species a virtual server that shares the same IP address as a node in an associated VLAN. You create
this type of virtual server when you want to create a VLAN group. If you specify the l2-forward option,
you cannot use the ip-forward or reject options.
• last-hop-pool
Species the name of the last hop pool that you want the virtual server to use to direct reply trafc to
the last hop router. The default value is none.
• mask
Species the netmask for a network virtual server only. This setting is required for a network virtual
server.
The netmask claries whether the host bit is an actual zero or a wildcard representation. The default
value is 255.255.255.255 for IPv4 or ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff for IPv6.
• mirror
Enables or disables mirroring. You can use mirroring to maintain the same state information in the
standby unit that is in the active unit, allowing transactions such as FTP le transfers to continue as
though uninterrupted. The default value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nat64
Enable or disable NAT64. The default value is disabled. NAT64 is a service that automatically translate
IPv6 trafc into IPv4.
• partition
Displays the name of the administrative partition within which the virtual server resides.
• persist
Species a list of proles separated by spaces that the virtual server uses to manage connection
persistence. The default value is none.
To enable persistence, typically you specify a single prole. However, you can specify multiple proles
in conjunction with iRules(r) that dene a persistence strategy based on incoming trafc. In the case of
multiple proles, the default option species which prole you want the virtual server to use if an iRule
does not specify a persistence method. When you specify multiple proles, the default value of the
default property is no. You can set the value of the default property to yes for only one of the proles.
• pool
Species a default pool to which you want the virtual server to automatically direct trafc. The default
value is none.
• port-misuse
Used to show or reset port misuse policy statistics for the virtual server.
• proles
740
LTM
Species a list of proles for the virtual server to use to direct and manage trafc. The default value is
fastL4.
• rate-class
Species the name of an existing rate class that you want the virtual server to use to enforce a throughput
policy for incoming network trafc. The default value is none.
• rate-limit
Species the maximum number of connections per second allowed for a virtual server. The default value
is 'disabled'.
• rate-limit-mode
Indicates whether the rate limit is applied per virtual object, per source address, per destination address,
or some combination thereof. The default value is 'object', which does not use the source or destination
address as part of the key.
• rate-limit-dst-mask
Species a mask, in bits, to be applied to the destination address as part of the rate limiting. The default
value is '0', which is equivalent to using the entire address - '32' in IPv4, or '128' in IPv6.
• rate-limit-src-mask
Species a mask, in bits, to be applied to the source address as part of the rate limiting. The default
value is '0', which is equivalent to using the entire address - '32' in IPv4, or '128' in IPv6.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• related-rules
Species a list of iRules, separated by spaces, that customize the behavior of secondary channels (for
instance the data channel on FTP) opened on behalf of the virtual server. The default value is none.
• reject
Species that the BIG-IP(r) system rejects any trafc destined for the virtual server IP address. If you
specify the reject option, you cannot use the ip-forward or l2-forward options.
• rules
Species a list of iRules, separated by spaces, that customize the virtual server to direct and manage
trafc. The default value is none.
• service-down-immediate-action
Species the immediate action the BIG-IP system should respond with upon the receipt of the initial
client's SYN packet if the availability status of the virtual server is Ofine or Unavailable. This is
supported for the virtual server of Standard type and TCP protocol. The default value is none.
• service-policy
Species a service policy for the virtual server. If set, it will enforce the service policy for incoming
network trafc. The service policy can be used to validate if incoming trafc conforms to a set of
application protocols.
• snat
Species whether SNAT automap is enabled for the virtual server. The default value is none. This
attribute is DEPRECATED. Use source-address-translation { type ( automap / none ) }
• snatpool
741
Traffic Management Shell (tmsh) Reference Guide
Species the name of an existing SNAT pool that you want the virtual server to use to implement selective
and intelligent SNATs. This attribute is DEPRECATED. Use source-address-translation { type
snatpool pool pool_name }
• source
Species an IP address or network from which the virtual server will accept trafc.
The format for an "ipv4" address is a. b. c. d [/ prexlen ]. The format for an "ipv6" address is a: b: c:
d: e: f: g: h [/ prexlen ].
• source-address-translation
Species the type of source address translation enabled for the virtual server as well as the pool that the
source address translation will use.
• pool
Species the name of a LSN or SNAT pool used by the specied virtual server.
• type
Species the type of source address translation associated with the specied virtual server.
The options are:
• automap
Species the use of self IP addresses for virtual server source address translation.
• lsn
Species the use of a LSN pool of translation addresses for virtual server source address
translation.
• none
Species no source address translation to be used by the virtual server.
• snat
Species the use of a SNAT pool of translation addresses for virtual server source address
translation.
• source-port
Species whether the system preserves the source port of the connection. The default value is preserve.
The options are:
• change
Obfuscates internal network addresses.
• preserve
Preserves the source port of the connection.
• preserve-strict
Use this value only for UDP under very special circumstances, such as nPath or transparent (that is,
no translation of any other L3/L4 eld), where there is a 1:1 relationship between virtual IP addresses
and node addresses, or when clustered multi-processing (CMP) is disabled.
• trafc-classes
Species a list of trafc classes that are associated with the virtual server. The default value is none.
• translate-address
742
LTM
Enables or disables address translation for the virtual server. Disable address translation for a virtual
server if you want to use the virtual server to load balance connections to any address. This option is
useful when the system is load balancing devices that have the same IP address. The default value is
disabled.
• translate-port
Enables or disables port translation. Disable port translation for a virtual server, if you want to use the
virtual server to load balance connections to any service. The default value is disabled.
• vlans
Species a list of VLANs on which the virtual server is either enabled or disabled. The default value is
none. The options vlans-disabled and vlans-enabled indicate whether the virtual server is disabled or
enabled on the list of specied VLANs.
• vlans-disabled
Disables the virtual server on the VLANs specied in the vlans option. This is the default setting.
• vlans-enabled
Enables the virtual server on the VLANs specied in the vlans option.
• vs-index
Displays a unique index assigned to this virtual server.
• metadata
Associates user dened data, each of which has name and value pair and persistence. Persistent(default)
means the data will be saved into cong le.
• ip-intelligence-categories
Used to show/ reset statistics on IP intelligence white/ black lists categories.
See Also
create, delete, edit, glob, list, ltm persistence, ltm pool, modify, mv, net service-policy, net vlan, net
vlan-group, security rewall schedule, security rewall rule-list, regex, reset-stats, rule, show, tmsh
virtual-address
Congures virtual addresses.
Syntax
Congure the virtual-address component within the ltm module using the syntax shown in the following
sections.
Create/Modify
create virtual address [name]
modify virtual address [name]
address [ip address]
app-service [[string] | none]
arp [enabled | disabled]
auto-delete [true | false]
connection-limit [integer]
description [string]
743
Traffic Management Shell (tmsh) Reference Guide
enabled [yes | no]
icmp-echo [enabled | disabled]
mask [netmask]
route-advertisement [enabled | disabled]
server-scope [all | any | none]
traffic-group [[string] | default | non-default | none]
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
edit virtual-address [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats virtual-address
reset-stats virtual-address [ [ [name] | [glob] | [regex] ] ... ]
mv virtual-address [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Display
list virtual-address
list virtual-address [ [ [name] | [glob] | [regex] ] ... ]
show running-config virtual-address
show running-config virtual-address
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show virtual-address
show virtual-address [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete virtual-address [all | [name]]
744
LTM
Description
You can use the virtual-address component to enable, disable, display, and delete virtual addresses. You
can also list the virtual address conguration, and view statistics for a specic virtual address.
Note that tmsh only displays virtual addresses when you explicitly request them. For example:
To display the properties of virtual addresses or a specic virtual address from the ltm module, use the
command sequences list virtual-address and list virtual-address [name], respectively.
To display statistics for virtual addresses or a specic virtual address from the ltm module, use the command
sequence show virtual-address and show virtual-address [name], respectively.
Examples
create virtual-address myVirtualAddr address 10.10.10.20 enabled yes
Creates a virtual address 10.10.10.20, with a name of myVirtualAddr.
create virtual-address myVirtualAddr address 10.10.10.20 enabled yes trafc-group
/Common/trafc-group-1
Creates a virtual address 10.10.10.20, with a name of myVirtualAddr, that is assigned to trafc-group-1.
modify virtual-address myVirtualAddr enabled no
Disables the virtual address myVirtualAddr.
delete virtual-address myVirtualAddr
Deletes the virtual address myVirtualAddr.
list virtual-address myVirtualAddr all-properties
Lists the conguration information for the virtual address, myVirtualAddr.
show virtual-address myVirtualAddr
Displays statistics and status for the virtual-address myVirtualAddr.
show virtual-address myVirtualAddr all-properties
Displays statistics and status for the virtual named myVirtualAddr.
Note that if the system includes Packet Velocity(r) ASIC (PVA) and PVA Assist capabilities, this command
displays status and statistics for that feature.
mv /ltm virtual-address /Common/10.10.10.20 to-folder /Common/all_virtual_addresses
Moves the virtual-address 10.10.10.20 to a folder named all_virtual_addresses.
Note: If you wish to change the name of the virtual-address, you must use the congured IP Address or a
name that does not represent a different IP Address than the one congured.
Please refer to the mv manual page for additional examples on how to use the mv command.
Options
• address
The virtual IP address.
• arp
Enables or disables ARP for the specied virtual address. The default value is enabled.
• app-service
745
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the virtual address belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the virtual address. Only the application service can modify or delete the virtual
address.
• auto-delete
Indicates if the virtual address will be deleted automatically on deletion of the last associated virtual
server or not. The default value is true.
• connection-limit
Sets a concurrent connection limit for one or more virtual servers. The default value is 0, meaning "no
limit."
• description
User dened description.
• enabled
Species whether the specied virtual address is enabled. The default value is yes.
• oating
Read-only property derived from trafc-group. A oating virtual address is a virtual address for a
VLAN that serves as a shared address by all devices of a BIG-IP trafc-group.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• icmp-echo
Enables or disables ICMP echo replies for the specied virtual address. The default value is enabled.
• mask
Sets the netmask for one or more network virtual servers only. This setting is required for network virtual
servers. The default value is 255.255.255.255.
• partition
Displays the administrative partition within which the virtual address resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• route advertisement
Enables or disables route advertisement for the specied virtual address. The default value is disabled.
• server-scope
Species the server that uses the specied virtual address. The default value is any.
• unit
Read-only property that species the unit in a redundant system. Based on trafc-group.
• trafc-group
Species the trafc group on which the virtual address is active. The default trafc group is inherited
from the containing folder.
• inherited-trafc-group
Read-only property that indicates if the trafc-group is inherited from the parent folder.
746
LTM
• metadata
Associates user dened data, each of which has name and value pair and persistence. Persistent(default)
means the data will be saved into cong le.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
747
Traffic Management Shell (tmsh) Reference Guide
LTM Auth
crldp-server
Creates a Certicate Revocation List Distribution Point (CRDLP) server for implementing a CRLDP
authentication module.
Syntax
Congure the crldp-server component within the ltm auth module using the syntax in the following
sections.
Create/Modify
create crldp-server [name]
modify crldp-server [name]
app-service [[string] | none]
base-dn [ [LDAP base directory name] | none]
description [string]
host [ [ip address] | none]
port [ [name] | [number] ]
reverse-dn [disabled | enabled]
edit crldp-server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list crldp-server
list crldp-server [ [ [name] | [glob] | [regex] ] ... ]
show running-config crldp-server
show running-config crldp-server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete crldp-server [name]
Description
CRLDP authentication is a mechanism for checking certicate revocation status for client connections
passing through the BIG-IP(r) system. This module is useful when your authentication data is stored on a
remote CRLDP server.
To implement a CRLDP authentication module and create a CRLDP server:
• Use the crldp-server component in the ltm auth module to create a CRLDP server.
• Use the ssl-crldp component in the ltm auth module to congure a CRLDP conguration object and
associate it with the server you created in Step 1.
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the SSL CRLDP conguration object that you created in Step
2.
• For the defaults-from option, specify a parent prole (either the default prole named ssl_crldp or
another custom prole that you created).
Examples
create crldp-server my_crldp_server
Creates a CRLDP server named my_crldp_server.
delete crldp-server my_crldp_server
Deletes a CRLDP server named my_crldp_server.
Options
• app-service
Species the name of the application service to which the CRLDP server belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the CRLDP server. Only the application service can modify or delete the CRLDP
server.
• base-dn
Species the LDAP base directory name for certicates that specify the CRL distribution point in
directory name format (dirName). The default value is none.
Use this option when the value of the X509v3 attribute crlDistributionPoints is of type dirName. In
this case, the BIG-IP system attempts to match the value of the crlDistributionPoints attribute to the
value of the base-dn option. An example of a base-dn value is cn=lxxx,dc=f5,dc=com.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• host
Species an IP address for the CRLDP server. This option is required. The default value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species the port for CRLDP authentication trafc. The default value is 389.
750
LTM Auth
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse-dn
Species in which order the system attempts to match the value of the base-dn option to the value of
the X509v3 attribute crlDistributionPoints. When enabled, the system matches the value of the base-dn
option from left to right, or from the beginning of the DN string, to accommodate dirName strings in
certicates such as C=US,ST=WA,L=SEA,OU=F5,CN=xxx. The default value is disabled.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm auth ssl-crldp, ltm virtual, modify, reset-stats, regex,
reset-stats, show, tmsh
kerberos-delegation
Congures a Kerberos delegation prole.
Syntax
Congure the kerberos-delegation component within the ltm auth module using the syntax shown in the
following sections.
Create/Modify
create kerberos-delegation [name]
modify kerberos-delegation [name]
app-service [[string] | none]
client-principal [string]
debug-logging [disabled | enabled]
description [string]
protocol-transition [disabled | enabled]
server-principal [string]
edit kerberos-delegation [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats kerberos-delegation
reset-stats kerberos-delegation
[ [ [name] | [glob] | [regex] ] ... ]
Display
list kerberos-delegation
list kerberos-delegation [ [ [name] | [glob] | [regex] ] ... ]
show running-config kerberos-delegation
751
Traffic Management Shell (tmsh) Reference Guide
show running-config kerberos-delegation
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show kerberos-delegation
show kerberos-delegation [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete kerberos-delegation [name]
Description
The Kerberos delegation conguration acts like a proxy for Kerberos credentials. When connecting to a
server that is inside its domain, the browser client fetches Kerberos credentials known as delegated credentials.
These credentials are passed on to the system. Once the system has these credentials, it retrieves credentials
for the RealServer(r) that is on the back end, and passes those credentials back.
Each user is assigned a unique cookie that describes a session on the system. This cookie is encrypted in a
cookie key.
To congure a Kerberos authentication module and create a Kerberos conguration object:
• Use the kerberos-delegation component in the ltm auth module to create a Kerberos conguration
object.
• Use the prole component, in the ltm auth module, to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the Kerberos conguration object that you created in Step 1.
• For the defaults-from option, specify a parent prole (either the default Kerberos prole named
krbdelegate or another custom Kerberos prole that you created).
Examples
create kerberos-delegation my_kerberos-delegation_cong client-principal client.net server-principal
server.net
Creates a Kerberos delegation prole named my_kerberos-delegation_cong.
list kerberos-delegation all-properties
Displays all properties for all Kerberos delegation proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• client-principal
752
LTM Auth
Species the principal that the client sees. This is usually a value such as HTTP/<fqdn>. This principal
may be in a different domain from the server principal. This option is required. There is no default value.
• debug-logging
Species whether the system logs debugging actions. The default value is disabled.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which this prole resides.
• protocol-transition
Species whether associated virtual should transition client certicate authentication into Kerberos
credentials.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• server-principal
Species the principal of the back-end web server. This is usually a value such as HTTP/<fqdn of
server>. This may be in a different domain from the server principal. This setting is required. There is
no default value.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
ldap
Congures an LDAP conguration object for implementing remote LDAP-based client authentication.
Syntax
Congure the ldap component within the ltm auth module using the syntax shown in the following sections.
Create/Modify
create ldap [name]
modify ldap [name]
bind-dn [ [account dn] | none]
bind-pw [ [string] | none]
bind-timeout [integer]
check-host-attr [disabled | enabled]
753
Traffic Management Shell (tmsh) Reference Guide
debug [disabled | enabled]
description [string]
filter [ [string] | none]
group-dn [ [group dn] | none]
group-member-attr [ [string] | none]
idle-timeout [integer]
ignore-auth-info-unavail [no | yes]
ignore-unknown-user [disabled | enabled]
login-attribute [ [account name] | none]
port [ [name] | [integer]]
scope [base | one | sub]
search-base-dn [ [search base dn] | none]
search-timeout [number]
servers
[add | delete | replace-all-with] {
[ip address ... ]
}
servers none
ssl [disabled | enabled]
ssl-ca-cert-file [ [name] | none)
ssl-check-peer [disabled | enabled]
ssl-ciphers [ [string] | none]
ssl-client-cert [ [string] | none]
ssl-client-key [ [string] | none]
user-template [ [string] | none]
version [number]
warnings [disabled | enabled]
edit ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ldap
list ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config ldap
show running-config ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ldap [name]
Description
LDAP authentication is a mechanism for authenticating or authorizing client connections passing through
the system. LDAP authentication is useful when your authentication or authorization data is stored on a
remote LDAP server or a Microsoft(r) Windows Active Directory(r) server, and you want the client credentials
to be based on basic HTTP authentication (that is, user name and password).
To congure an LDAP authentication module and create an LDAP conguration object:
• Use the ldap component in the ltm auth module to create an LDAP conguration object.
• Use the prole component, in the ltm auth module, to create an authentication prole in which you
specify the following options:
754
LTM Auth
• For the conguration option, specify the LDAP conguration object that you created in Step 1.
• For the defaults-from option, specify a parent prole (either the default LDAP prole named ldap
or another custom prole that you created).
Examples
create ldap my_auth_ldap servers add {my_ldap_auth_server}
Creates a conguration object named my_auth_ldap
delete ldap my_auth_ldap
Deletes the conguration object named my_auth_ldap.
Options
• bind-dn
Species the distinguished name of an account to which to bind, to perform searches. This search account
is a Read-only account used to do searches. You can use the admin account as the search account. If
no admin DN is specied, then no bind is attempted. The default value is none.
This option is required only when a site does not allow anonymous searches. If the remote server is a
Microsoft(r) Windows(r) Active Directory(r) server, the distinguished name must be in the form of an
email address.
• bind-pw
Species the password for the search account created on the LDAP server. This option is required if
you specify a value for the bind-dn option. The default value is none.
• bind-timeout
Species a bind timeout limit. The default value is 30 seconds.
• check-host-attr
Conrms the password for the bind distinguished name. This option is optional. The default value is
disabled.
• debug
Enables or disables syslog-ng debugging information at LOG DEBUG level. The default value is
disabled. F5 Networks does not recommend using this option for normal conguration.
• description
User dened description.
• lter
Species a lter. Use this option for authorizing client trafc. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• group-dn
Species the group distinguished name. The system uses this option for authorizing client trafc. The
default value is none.
• group-member-attribute
Species a group member attribute. The system uses this option for authorizing client trafc. The default
value is none.
755
Traffic Management Shell (tmsh) Reference Guide
• idle-timeout
Species the idle timeout, in seconds, for connections. The default value is 3600 seconds.
• ignore-auth-info-unavail
Species whether the system ignores authentication information, if it is not available. The default value
is no.
• ignore-unknown-user
Species whether the system ignores a user that is unknown. The default value is disabled.
• login-attribute
Species a logon attribute. Normally, the value for this option is uid; however, if the server is a Microsoft
Windows Active Directory server, the value must be the account name samaccountname (not
case-sensitive). The default value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species the port number or name for the LDAP service. Port 389 is typically used for non-SSL and
port 636 is used for an SSL-enabled LDAP service. The default value is ldap.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• scope
Species the search scope. The default value is sub. The options are:
• base
Species the search scope is base object. The base value is almost never useful for nameservice
lookups.
• one
Species the search scope is one level.
• sub
Species the search scope is subtree.
• search-base-dn
Species the search base distinguished name. The default value is none.
• search-timeout
Species the search timeout. The default value is 30 seconds.
• servers
Species the LDAP servers that the system must use to obtain authentication information. You must
specify a server when you create an LDAP conguration object.
• ssl
Enables or disables SSL functionality. The default is disabled.
756
LTM Auth
Note that when you use the command line interface to enable SSL for an LDAP service, the system does
not change the service port number from 389 to 636, as is required. To change the port number from
the command line, use the service option of this command (see above), for example, ldap [name] ssl
enabled service 636.
• ssl-ca-cert-le
Species the name of an SSL CA certicate using the full path to the le. The default value is none.
• ssl-check-peer
Species whether the system checks an SSL peer. The default value is disabled.
• ssl-ciphers
Species SSL ciphers. The default value is none.
• ssl-client-cert
Species the name of an SSL client certicate. The default value is none.
• ssl-client-key
Species the name of an SSL client key. The default value is none.
• user-template
Species a user template for the LDAP application to use for authentication. The default value is none.
• version
Species the version number of the LDAP application. The default value is 3.
• warnings
Enables or disables warning messages. The default value is enabled.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm virtual, modify, regex, reset-stats, show, tmsh
ocsp-responder
Congures Online Certicate System Protocol (OCSP) responder objects.
Syntax
Congure the ocsp-responder component within the ltm auth module using the syntax shown in the
following sections.
Create/Modify
create ocsp-responder [name]
modify ocsp-responder [name]
allow-certs [disabled | enabled]
app-service [[string] | none]
ca-file [ [file name] | none]
ca-path [ [file name] | none]
cert-id-digest [md5 | sha1]
chain [disabled | enabled]
check-certs [disabled | enabled]
description [string]
explicit [disabled | enabled]
757
Traffic Management Shell (tmsh) Reference Guide
ignore-aia [disabled | enabled]
intern [disabled | enabled]
nonce [disabled | enabled]
sign-digest [md5 | sha1]
sign-key [ [key] | none)
sign-key-pass-phrase [ [pass phrase] | none]
sign-other [ [list of certs] | none]
signer [ [certificate] | none]
status-age [integer]
trust-other [disabled | enabled]
url [none | [url] ]
va-file [ [file name] | none]
validity-period [integer]
verify [disabled | enabled]
verify-cert [disabled | enabled]
verify-other [ [file name] | none]
verify-sig [disabled | enabled]
edit ocsp-responder [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ocsp-responder
list ocsp-responder [ [ [name] | [glob] | [regex] ] ... ]
show running-config ocsp-responder
show running-config ocsp-responder [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ocsp-responder [name]
Description
To implement the SSL OCSP authentication module, you must create the following objects: one or more
OCSP responder objects, an SSL OCSP conguration object, and an SSL OCSP prole.
To implement an SSL OCSP authentication module and create an OCSP responder object:
• Use the ocsp-responder component in the ltm auth module to congure an OCSP responder object.
• Use the ssl-ocsp component in the ltm auth module to congure an SSL OCSP conguration object to
which you add the OCSP responder object that you created in Step 1.
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the SSL OCSP conguration object that you created in Step
2.
• For the defaults-from option, specify a parent prole (either the default OCSP Responder prole
named ssl_ocsp or another custom prole that you created).
758
LTM Auth
Options
• allow-certs
Enables or disables the addition of certicates to an OCSP request. The default value is enabled.
• app-service
Species the name of the application service to which the OCSP responder object belongs. The default
value is none. Note: If the strict-updates option is enabled on the application service that owns the
object, you cannot modify or delete the OCSP responder object. Only the application service can modify
or delete the OCSP responder object.
• ca-le
Species the name of the le containing trusted CA certicates used to verify the signature on the OCSP
response. The default value is none.
• ca-path
Species the name of the path containing trusted CA certicates used to verify the signature on the
OCSP response. The default value is none.
• cert-id-digest
Species a specic algorithm identier, either sha1 or md5. The default value is sha1. The options are:
• sha1 is newer and provides more security with a 160-bit hash length.
• md5 is older and has only a 128-bit hash length.
The cert ID is part of the OCSP protocol. The OCSP client (in this case, the BIG-IP system) calculates
the cert ID using a hash of the Issuer and serial number for the certicate that it is trying to verify.
• chain
Species whether the system constructs a chain from certicates in the OCSP response. The default
value is enabled.
• check-certs
Enables or disables verication of an OCSP response certicate. Use this option for debugging purposes
only. The default value is enabled.
• description
User dened description.
• explicit
Species that the Local Trafc Manager explicitly trusts that the OCSP response signer's certicate is
authorized for OCSP response signing. If the signer's certicate does not contain the OCSP signing
extension, specication of this option causes a response to be untrusted. The default value is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-aia
Species whether the system ignores the URL contained in the certicate's AIA elds, and always uses
the URL specied by the responder instead. The default value is disabled.
• intern
Species whether the system ignores certicates contained in an OCSP response when searching for
the signer's certicate. To use this option, the signer's certicate must be specied with either the
verify-other or va-le option. The default value is enabled.
• name
759
Traffic Management Shell (tmsh) Reference Guide
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nonce
Species whether the system veries an OCSP response signature or the nonce values. The default value
is enabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• sign-digest
Species the algorithm for signing the request, using the signing certicate and key. This parameter has
no meaning, if request signing is not in effect (that is, both the request signing certicate and request
signing key parameters are empty). This parameter is required only when request signing is in effect.
The default value is sha1.
• sign-key
Species the key that the system uses to sign an OCSP request. The default value is none.
• sign-key-pass-phrase
Species the passphrase that the system uses to encrypt the sign key. The default value is none.
• sign-other
Adds a list of additional certicates to an OCSP request. The default value is none.
• signer
Species a certicate used to sign an OCSP request. If the certicate is specied, but the key is not
specied, then the private key is read from the same le as the certicate. If neither the certicate nor
the key is specied, then the request is not signed. If the certicate is not specied and the key is specied,
then the conguration is considered to be invalid. The default value is none.
• status-age
Species the age of the status of the OCSP responder. The default value is 0 (zero).
• trust-other
Instructs the BIG-IP local trafc management system to trust the certicates specied with the
verify-other option. The default is value disabled.
• url
Species the URL used to contact the OCSP service on the responder. This option is required. The
default value is none.
• va-le
Species the name of the le containing explicitly trusted responder certicates. This parameter is
needed in the event that the responder is not covered by the certicates already loaded into the responder's
CA store. The default value is none.
• validity period
Species the number of seconds used to specify an acceptable error range. Use this option when the
OCSP responder clock and a client clock are not synchronized, which can cause a certicate status check
to fail. This value must be a positive number. The default value is 300 seconds.
• verify
760
LTM Auth
Enables or disables verication of an OCSP response signature or the nonce values. Used for debugging
purposes only. The default value is enabled.
• verify-cert
Species that the system makes additional checks to see if the signer's certicate is authorized to provide
the necessary status information. Use this option for testing purposes only. The default value is enabled.
• verify-other
Species the name of the le used to search for an OCSP response signing certicate when the certicate
has been omitted from the response. The default value is none.
• verify-sig
Species that the system checks the signature on the OCSP response. Use this option for testing purposes
only. The default value is enabled.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm auth ssl-ocsp, ltm virtual, modify, regex, show, tmsh
profile
Congures an authentication prole.
Syntax
Congure the prole component within the ltm auth module using the syntax shown in the following
sections.
Create/Modify
create profile [name]
modify profile [name]
app-service [[string] | none]
configuration [ [name] | none]
cookie-key [string]
cookie-name [string]
credential-source [http-basic-auth]
defaults-from [name]
description [string]
enabled [yes | no]
idle-timeout [integer]
rule [iRule name]
edit profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats profile
reset-stats profile [ [ [name] | [glob] | [regex] ] ... ]
761
Traffic Management Shell (tmsh) Reference Guide
Display
list profile
list profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config profile
show running-config profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show profile
show profile [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete profile [name]
Note: You cannot delete default proles.
Description
You can use the prole component to congure a custom authentication prole, or you can use the default
prole that the BIG-IP(r) Local Trafc Manager system provides for each type of authentication module.
An authentication prole requires one of the following conguration objects: ltm auth kerberos-delegation,
ltm auth ldap, ltm auth radius, ltm auth ssl-cc-ldap, ltm auth ssl-crldp, ltm auth ssl-ocsp or ltm auth
tacacs. The type of prole specied by the defaults-from option must match the type of conguration
object.
Examples
create prole my_authentication_prole { conguration tacacs defaults-from tacacs credential-source
http-basic-auth enabled yes idle-timeout 30 rule _sys_auth_tacacs }
Creates a prole named my_authentication_prole for TACACS+ authentication.
list prole
Displays the properties of all of the auth prole components.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• conguration
Species the name of an authentication conguration object. This option is required.
• cookie-key
762
LTM Auth
Species the key that the system uses to encrypt the session cookie assigned to each user using the
cookie-name option. The default value is f5auth. This option applies only to KRB Delegate proles.
• cookie-name
Species a session cookie that the system assigns to each user. F5 Networks recommends that each
virtual server use a different cookie name. The system encrypts the cookie using the value of the
cookie-key option. The default value is abc123. This option applies only to KRB Delegate proles.
• credential-source
Species the credential source.
• defaults-from
Species the name of the authentication prole from which you want your custom prole to inherit
settings. This option is required.
• description
User dened description.
• enabled
Species whether this authentication prole is enabled. The default value is yes.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• idle-timeout
Species the idle timeout for the authentication prole. The default value is 300 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rule
Species the name of the rule that corresponds to the authentication method you want to use.
See Also
create, delete, edit, glob, ltm auth crldp-server, ltm auth kerberos-delegation, ltm auth ldap, ltm auth
ocsp-responder, ltm auth radius, ltm auth radius-server, ltm auth ssl-cc-ldap, ltm auth ssl-crldp, ltm auth
ssl-ocsp, ltm auth tacacs, list, ltm virtual, modify, regex, reset-stats, show, tmsh
radius
Congures a RADIUS conguration object for implementing remote RADIUS-based authentication of
BIG-IP(r) system users.
763
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the radius component within the ltm auth module using the syntax shown in the following
sections.
Create/Modify
create radius [name]
modify radius [name]
accounting-bug [disabled | enabled]
client-id [none | [string]]
debug [disabled | enabled]
description [string]
retries [integer]
service-type [default | login | framed | callback-login | callback-framed
| outbound | administrative | nas-prompt | authenticate-only |
callback-nas-prompt | call-check | callback-administrative]
servers
[add | delete | replace-all-with] {
[ [hostname ... ] | [ip address ... ] ]
}
servers [default | none]
edit radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ... ]
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete radius [name]
Description
You use a RADIUS authentication module when your authentication data is stored on a remote RADIUS
server. In this case, client credentials are based on basic HTTP authentication (that is, username and
password).
To implement a RADIUS authentication module and create a RADIUS conguration object:
• Use the radius-server component in the ltm auth module to congure a RADIUS server.
• Use the radius component in the ltm auth module to create a RADIUS conguration object that
references the RADIUS server you created in Step 1.
764
LTM Auth
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the RADIUS conguration object that you created in Step 2.
• For the defaults-from option, specify a parent prole (either the default RADIUS prole named
radius or another custom prole that you created).
Examples
create radius my_radius_auth servers add { myradiusserver }
Creates a RADIUS conguration object named my_radius_auth.
delete radius my_radius_auth
Deletes the RADIUS conguration object named my_radius_auth.
Options
• accounting-bug
Enables or disables validation of the accounting response vector. This option is necessary only on older
servers. The default value is disabled.
• client-id
Sends a NAS-Identier RADIUS attribute with string bar. If you do not specify a value for the client-id
option, the system uses the pluggable authentication module (PAM) service type. You can disable this
feature by specifying a blank client ID.
• debug
Enables or disables syslog-ng debugging information at LOG DEBUG level. F5 Networks does not
recommend this option for normal use. The default value is disabled.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• retries
Species the number of authentication retries that the Local Trafc Manager allows before authentication
fails. The default value is 3.
• service-type
Species the type of service used for the RADIUS server. The default is default, which behaves as
authenticate-only.
765
Traffic Management Shell (tmsh) Reference Guide
• servers
Species the hostnames or IP addresses of the RADIUS servers that the BIG-IP Local Trafc Manager
uses to obtain authentication data.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm auth radius-server, ltm virtual, modify, regex, show, tmsh
radius-server
Congures a RADIUS server for implementing remote RADIUS-based client authentication.
Syntax
Congure the radius-server component within the ltm auth module using the syntax shown in the following
sections.
Create/Modify
create radius-server [name]
modify radius-server [name]
description [string]
port [ [name] | [number]]
secret [none | ["string"] ]
server [ [hostname] | [ip address] | none ]
timeout [integer]
edit radius-server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius-server
list radius-server [ [ [name] | [glob] | [regex] ] ... ]
show running-config radius-server
show running-config radius-server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete radius-server [name]
766
LTM Auth
Description
You use a RADIUS authentication module when your authentication data is stored on a remote RADIUS
server. In this case, client credentials are based on basic HTTP authentication (that is, user name and
password).
To congure a RADIUS authentication module and create a RADIUS server:
• Use the radius-server component in the ltm auth module to congure a RADIUS server.
• Use the radius component in the ltm auth module to create a RADIUS conguration object that
references the RADIUS server you created in Step 1.
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the radius component that you created in Step 2.
• For the defaults-from option, specify a parent prole (either the default RADIUS prole named
radius or another custom prole that you created).
Examples
create radius-server bigip_auth_radius_server secret "This is the secret." server 10.1.1.1
Creates a RADIUS server named my_radius_server.
delete radius-server my_radius_server
Deletes the RADIUS server named my_radius_server.
Options
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition in which the component resides.
• port
Species the port for RADIUS authentication trafc. The default value is 1812.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the secret key the system uses to encrypt and decrypt packets sent or received from the server.
This option is required.
• server
Species the host name or IP address of the RADIUS server. This option is required.
767
Traffic Management Shell (tmsh) Reference Guide
• timeout
Species the timeout value. The default value is 3 seconds.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm auth radius, ltm virtual, modify, regex, show, tmsh
ssl-cc-ldap
Congures an SSL client certicate conguration object for remote SSL-based LDAP authorization for
client trafc passing through the trafc management system.
Syntax
Congure the ssl-cc-ldap component within the ltm auth module using the syntax shown in the following
sections.
Create/Modify
create ssl-cc-ldap [name]
modify ssl-cc-ldap [name]
admin-dn [ [name] | none]
admin-password [none | [password] ]
cache-size [integer]
cache-timeout [integer]
certmap-base [none | [search base] ]
certmap-key [ [name] | none)
certmap-user-serial [no | yes]
description [string]
group-base [none | [search base] ]
group-key [ [name] | none]
group-member-key [[name] | none]
role-key [ [name] | none]
search-type [cert | certmap | user]
secure [no | yes]
servers
[add | delete | none | replace-all-with] {
[ip address ... ]
}
user-base [none | [search base] ]
user-class [ [class] | none]
user-key [ [key] | none]
valid-groups
[add | delete | replace-all-with] {
[group ... ]
}
valid-groups none
valid-roles
[add | delete | replace-all-with] {
[role ... ]
}
valid-roles none
edit ssl-cc-ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
768
LTM Auth
Display
list ssl-cc-ldap
list ssl-cc-ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config ssl-cc-ldap
show running-config ssl-cc-ldap
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ssl-cc-ldap [name]
Description
You can use the ssl-cc-ldap component to congure SSL client certicate-based remote LDAP authorization
for client trafc passing through the trafc management system.
To congure this type of authentication module and create a conguration object:
• Use the ssl-cc-ldap component in the ltm auth module to create an SSL client certicate LDAP
conguration object.
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the conguration object that you created in Step 1.
• For the defaults-from option, specify a parent prole (either the default prole named ssl_cc_ldap
or another custom prole that you created).
Options
• admin-dn
Species the distinguished name of an account to which to bind to perform searches. This search account
is a read-only account used to do searches. The admin account can also be used as the search account.
If no admin DN is specied, then no bind is attempted.
This option is required only when an LDAP database does not allow anonymous searches. The default
value is none.
• admin-password
Species the password for the admin account. See admin-dn above. The default value is none.
• cache-size
Species the maximum size, in bytes, allowed for the SSL session cache. Setting this option to 0 (zero)
disallows SSL session caching. The default value is 20000 bytes (20KB).
• cache-timeout
Species the number of usable lifetime seconds of negotiable SSL session IDs. When this time expires,
a client must negotiate a new session. The default value is 300 seconds.
• certmap-base
769
Traffic Management Shell (tmsh) Reference Guide
Species the search base for the subtree used by the certmap search method. A typical search base is:
ou=people,dc=company,dc=com. The default value is none.
• certmap-key
Species the name of the certicate map that the certmap search method uses. This name is found in
the LDAP database. The default value is none.
• certmap-user-serial
Species whether the system uses the client certicate's subject or serial number (in conjunction with
the certicate's issuer) when trying to match an entry in the certicate map subtree.
A value of yes uses the serial number. A value of no uses the subject. The default value is no.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• group-base
Species the search base for the subtree used by group searches. Use this option only when specifying
the valid-groups option. The typical search base is similar to: ou=groups,dc=company,dc=com. The
default value is none.
• group-key
Species the name of the attribute in the LDAP database that species the group name in the group
subtree. An example of a typical key is cn (common name for the group). The default value is none.
• group-member-key
Species the name of the attribute in the LDAP database that species members (DNs) of a group. A
typical key is member. The default value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• role-key
Species the name of the attribute in the LDAP database that species a user's authorization roles. Use
this option only when specifying the valid-roles option. A typical role key is authorizationRole. The
default value is none.
• search
Species the type of LDAP search that is performed based on the client's certicate. Possible values
are:
• cert
Searches for the exact certicate.
• certmap
770
LTM Auth
Searches for a user by matching the certicate issuer and the certicate serial number or certicate.
• user
Searches for a user based on the common name found in the certicate. This is the default value.
• secure
Species whether the system attempts to use secure LDAP (LDAP over SSL). The alternative to using
secure LDAP is to use insecure (clear text) LDAP. Secure LDAP is a consideration when the connection
between the BIG-IP system and the LDAP server cannot be trusted. The default value is no.
• servers
Species a list of LDAP servers you want to search. You must specify a server when you create an SSL
client certicate conguration object.
• user-base
Species the search base for the subtree used when you select for the search option either of the values
user or cert. A typical search base is: ou=people,dc=company,dc=com. You must specify a user base
when you create an SSL client certicate conguration object. The default value is none.
• user-class
Species the object class in the LDAP database to which the user must belong to be authenticated. The
default value is none.
• user-key
Species the key that denotes a user ID in the LDAP database (for example, the common key for the
user option is uid). You must specify a user key when you create an SSL client certicate conguration
object.
• valid-groups
Species a space-delimited list of the names of groups to which the client must belong in order to be
authorized (matches against the group key in the group subtree). The client needs to be a member of
only one of the groups in the list. The default value is none.
• valid-roles
Species a space-delimited list of the valid roles that clients must have to be authorized. The default
value is none.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm virtual, modify, regex, show, tmsh
ssl-crldp
Congures a Secure Socket Layer (SSL) Certicate Revocation List Distribution Point (CRLDP)
conguration object for implementing SSL CRLDP to manage certicate revocation.
Syntax
Congure the ssl-crldp component within the ltm auth module using the syntax shown in the following
sections.
771
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create ssl-crldp [name]
modify ssl-crldp [name]
cache-timeout [integer]
connection-timeout [integer]
description [string]
servers
[add | delete | replace-all-with] {
[ip address ... ]
}
servers [default | none]
update-interval [integer]
use-issuer [disabled | enabled]
edit ssl-crldp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ssl-crldp
list ssl-crldp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ssl-crldp
show running-config ssl-crldp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ssl-crldp [name]
Description
CRLDP authentication is a mechanism for checking certicate revocation status for client connections
passing through the system. This module is useful when your authentication data is stored on a remote
CRLDP server.
To implement a CRLDP authentication module and create an SSL CRLDP conguration object:
• Use the crldp-server component, in the ltm auth module, to create a CRLDP server.
• Use the ssl-crldp component in the ltm auth module to congure a CRLDP conguration object that
references the server you created in Step 1.
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the SSL CRLDP conguration object that you created in Step
2.
• For the defaults-from option, specify a parent prole (either the default prole named ssl_crldp or
another custom prole that you created).
772
LTM Auth
Examples
create ssl-crldp my_auth_ssl-crldp
Creates an SSL CRLDP conguration object named my_auth_ssl-crldp.
delete ssl-crldp my_auth_ssl-crldp
Deletes the SSL CRLDP conguration object named my_auth_ssl-crldp.
Options
• cache-timeout
Species the number of seconds that CRLs are cached. The default value is 86400 (24 hours).
• connection-timeout
Species the number of seconds before the connection times out. The default value is 15.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• servers
Species a host name or IP address for the secure CRLDP server. This option is required. The default
value is none.
• update-interval
Species an update interval for CRL distribution points that ensures that CRL status is checked at regular
intervals, regardless of the CRL timeout value. This helps to prevent CRL information from becoming
outdated before the BIG-IP system checks the status of a certicate. The default value is 0 (zero), which
indicates an internal default value is active.
• use-issuer
Species whether the system extracts the CRL distribution point from the client certicate. The default
value is disabled.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm auth crldp-server, ltm virtual, modify, regex, show, tmsh
773
Traffic Management Shell (tmsh) Reference Guide
ssl-ocsp
Congures OCSP authentication for client trafc passing through the trafc management system.
Syntax
Congure the ssl-ocsp component within the ltm auth module using the syntax shown in the following
sections.
Create/Modify
create ssl-ocsp [name]
modify ssl-ocsp [name]
description [string]
responders
[add | delete | replace-all-with] {
[name]...
}
responders [default | none]
edit ssl-ocsp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ssl-ocsp
list ssl-ocsp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ssl-ocsp
show running-config ssl-ocsp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ssl-ocsp [name]
Description
Online Certicate Status Protocol (OCSP) is an industry-standard protocol that offers an alternative to a
certicate revocation list when using public-key technology. To implement an SSL OCSP authentication
module, you must create the following objects: one or more OCSP responder objects, an SSL OCSP
conguration object, and an SSL OCSP prole.
To implement an SSL OCSP authentication module and create an SSL OCSP conguration object:
• Use the ocsp-responder component in the ltm auth module to congure an OCSP responder object.
• Use the ssl-ocsp component in the ltm auth module to congure an SSL OCSP conguration object to
which you add the OCSP responder object that you created in Step 1.
774
LTM Auth
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
• For the conguration option, specify the SSL OCSP conguration object that you created in Step
2.
• For the defaults-from option, specify a parent prole (either the default OCSP Responder prole
named ssl_ocsp or another custom prole that you created).
Examples
create ssl-ocsp my_auth_ssl-ocsp
Creates an SSL OCSP conguration object named my_auth_ssl-ocsp.
delete ssl-ocsp my_auth_ssl-ocsp
Deletes the SSL OCSP conguration object named my_auth_ssl-ocsp.
Options
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• responders
Species a list of OCSP responders that you congured using the ocsp-responder component in the
ltm auth module.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm auth ocsp-responder, ltm virtual, modify, regex, show,
tmsh
tacacs
Congures a TACACS+ conguration component for implementing remote TACACS+-based client
authentication.
775
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the tacacs component within the ltm auth module using the syntax shown in the following
sections.
Create/Modify
create tacacs [name]
modify tacacs [name]
accounting [send-to-all-servers | send-to-first-server]
authentication [use-all-servers | use-first-server]
debug [disabled | enabled]
description [string]
encryption [disabled | enabled]
protocol [none | [protocol] ]
secret [ "[string]" ]
servers
[add | delete | replace-all-with] {
[ [ [hostname[:port]] | [ip address[:port]] ] ... ]
}
service [ [name] | none] ]
edit tacacs [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tacacs
list tacacs [ [ [name] | [glob] | [regex] ] ... ]
show running-config tacacs
show running-config tacacs [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tacacs [name]
Description
Using a TACACS+ conguration object and prole, you can implement the TACACS+ authentication
module as the mechanism for authenticating client connections passing through the BIG-IP Local Trafc
Manager system. You use this module when your authentication data is stored on a remote TACACS+
server. In this case, client credentials are based on basic HTTP authentication (that is, user name and
password).
To implement a TACACS+ authentication module and create a TACACS conguration object:
• Use the tacacs component in the ltm auth module to congure a TACACS+ conguration object.
• Use the prole component in the ltm auth module to create an authentication prole in which you
specify the following options:
776
LTM Auth
• For the conguration option, specify the TACACS+ conguration object that you created in Step
1.
• For the defaults-from option, specify a parent prole (either the default TACACS+ prole named
tacacs or another custom prole that you created).
Examples
create tacacs my_tacacs_auth secret "This is the secret" servers add {my_tacacs_server} encryption
enabled
Enables encryption for TACACS+ packets.
create tacacs my_tacacs_auth secret "This is the secret" servers add { my_tacacs_server1
my_tacacs_server2 } accounting send-to-all-servers
Provides the ability to send accounting start and stop packets to all servers
Options
• accounting
If multiple TACACS+ servers are dened and pluggable authentication module (PAM) session accounting
is available, species where the system sends accounting start and stop packets. Possible values are:
• send-to-all-servers
Sends to all servers.
• send-to-rst-server
Sends to the rst available server.
• authentication
Species when to use the secret key supplied for the secret option. This option is required. The options
are:
• use-all-servers
Use the secret key with all servers.
• use-rst-server
Use the secret key with the rst available server.
• debug
Enables syslog-ng debugging information at LOG DEBUG level. F5 Networks does not recommend
this option for normal use. The default value is disabled.
• description
User dened description.
• encryption
Enables or disables encryption of TACACS+ packets. F5 Networks recommends this option for normal
use. The default value is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
777
Traffic Management Shell (tmsh) Reference Guide
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• protocol
Species the protocol associated with the value specied in the service option, which is a subset of the
associated service being used for client authorization or system accounting.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Sets the secret key used to encrypt and decrypt packets sent or received from the server. This option is
required.
• servers
Species the host name or IPv4 address of the TACACS+ server. For each server, a port may optionally
be specied in the format hostname: port or IPv4: port. If no port is specied, the default port 49 is
used. This option is required.
• service
Species the name of the service that the user is requesting to be authenticated to use. Identifying the
service enables the TACACS+ server to behave differently for different types of authentication requests.
This option is required.
See Also
create, delete, edit, glob, list, ltm auth prole, ltm virtual, modify, regex, show, tmsh,
778
LTM Auth
LTM Classification
application
Congures a custom classication application.
Syntax
Congure the application within the ltm classication module using the syntax shown in the following
sections.
Create/Modify
create application [name]
app-service [[string] | none]
description [string]
application-id [integer]
status [enabled | disabled]
category [name]
modify application [name]
app-service [[string] | none]
description [string]
status [enabled | disabled]
category [name]
edit application [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list application
list application [ [all] | [name] ]
show running-config application
show running-config application [ [all] | [name] ]
all-properties
non-default-properties
one-line
partition
Delete
delete application [name]
Note: All referring classication-lters (to this application) need to be deleted rst; otherwise an error
will be reported. Predened applications cannot be deleted.
Description
You can use the application component to create, modify, delete, and display classication application.
Examples
create application my_app { application-id 8192 status enabled category my_cat }
Creates a new application named my_app.
modify application my_app { status disabled category Web description "My description." }
Modify an application named my_app.
list application
Displays all created applications.
delete application my_app
Deletes the application named my_app.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• application-id
Identies the application. This is set during creation and cannot be changed. Identiers must be unique
across predened and user-dened applications. Predened application-ids must be in numeric range
[0, 8192), and user dened application-ids must be in numeric range [8192, 16384).
• status
Indicates if this application is enabled or disabled in result of the classication engine.
• category
Refers to classication category. The referred category [name] should exist already; otherwise an error
will be reported.
See Also
create, modify, delete, list, show, tmsh, ltm classication, pem policy
category
Congures a custom classication category.
780
LTM Classification
Syntax
Congure the category within the ltm classication module using the syntax shown in the following
sections.
Create/Modify
create category [name]
app-service [[string] | none]
description [string]
category-id [integer]
state [enabled | disabled]
irule-event [enabled | disabled]
modify category [name]
app-service [[string] | none]
description [string]
state [enabled | disabled]
irule-event [enabled | disabled]
edit category [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list category
list category [ [all] | [name] ]
show running-config category
show running-config category [ [all] | [name] ]
all-properties
non-default-properties
one-line
partition
Delete
delete category [name]
Note: All referring applications/classication-lters (to this category) need to be deleted rst; otherwise
an error will be reported. Predened categories cannot be deleted.
Description
You can use the category component to create, modify, delete, and display classication category.
Examples
create category my_cat { category-id 20480 state enabled irule-event disabled }
Creates a new category named my_cat.
modify category my_cat { state disabled irule-event enabled description "My description." }
781
Traffic Management Shell (tmsh) Reference Guide
Modify a category named my_cat.
list category
Displays all created categories.
delete category my_cat
Deletes the category named my_cat.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• category-id
Identies the category. This is set during creation and cannot be changed. Identiers must be unique
across predened and user-dened categories. Predened category-ids must be in numeric range [16384,
20480), and user dened category-ids must be in numeric range [20480, 24576).
• state
Indicates if this category is enabled or disabled in result of the classication engine.
• irule-event
Indicates if the irule is enabled or disabled in result of the classication engine.
See Also
create, modify, delete, list, show, tmsh, ltm classication, pem policy
signature-definition
Congure status for classication signature updates.
Syntax
Congure the signature-denition component within the ltm classication module using the syntax in
the following sections.
Display
list signature-definition
list signature-definition [ [name] | [glob] | [regex] ]
all-properties
non-default-properties
one-line
recursive
last-attempt-automatic-mode [enabled | disabled]
last-attempt-datetime [date]
last-attempt-user [string]
last-update-automatic-mode [enabled | disabled]
782
LTM Classification
last-update-datetime [date]
last-update-user [string]
message [string]
progress-status [none | success | failure | in-progress]
Description
You can use the signature-denition component to congure the status for classication signature updates.
Examples
list signature-denition
Displays classication signature update status conguration.
Options
• last-attempt-automatic-mode
Indicates whether the last attempt to update the signature le was done manually or automatically by
the system.
• last-attempt-datetime
Indicates the date and time of the last attempt to update the signature le.
• last-attempt-user
Indicates the user who is the last one to attempt to update the signature le.
• last-update-automatic-mode
Indicates whether the last successful signature le update was done manually or automatically by the
system. The value of the last-update-automatic-mode may be different from the value of the
last-attempt-automatic-mode if the last update attempt fails.
• last-update-datetime
Indicates the date and time of the last successful signature le update. The value of the
last-update-datetime is different from the value of the last-attempt-datetime if the last update attempt
fails.
• last-update-user
Indicates the user who did the last successful signature le update. The value of the last-update-user
may be different from the value of the last-attempt-user if the last update attempt fails.
• message
Indicates the error message when it fails to attempt to update the signature le.
• progress-status
Indicates the progress status when attempting to update the signature le. The options are none, success,
failure, and in-progress.
See Also
list, tmsh
783
Traffic Management Shell (tmsh) Reference Guide
signature-update-schedule
Congure schedule for classication signature updates.
Syntax
Congure the signature-update-schedule component within the ltm classication module using the syntax
in the following sections.
Modify
modify signature-update-schedule [name]
[auto-update-enabled | auto-update-disabled]
auto-update-interval [daily | weekly | monthly]
edit signature-update-schedule [name]
all-properties
non-default-properties
Display
list signature-update-schedule
list signature-update-schedule [ [name] | [glob] | [regex] ]
all-properties
non-default-properties
one-line
recursive
Description
You can use the signature-update-schedule component to congure schedule for classication signature
updates.
Examples
list signature-update-schedule
Displays classication signature update schedule conguration.
modify signature-update-schedule auto-update-enabled auto-update-interval daily
Updates the scheduler for classication signature updates to run once a day.
modify signature-update-schedule auto-update-disabled
Disables the scheduler and allows signatures to update via the browser-based Conguration utility only.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
784
LTM Classification
• auto-update-disabled
Species that the updates scheduler is disabled. The user can update the classication signatures using
the browser-based BIG-IP Conguration utility.
• auto-update-enabled
Species that the updates scheduler is enabled.
• auto-update-interval
Species the auto-update frequency for classication signatures. This attribute will only apply in case
auto update is enabled. The default value is weekly.
See Also
list, modify, tmsh
signature-version
Display classication signature version.
Syntax
Display the signature-version component within the ltm classication module using the syntax in the
following sections.
Display
list signature-version
all-properties
non-default-properties
one-line
recursive
Description
You can use the signature-version component to display versions in classication signature updates.
Examples
list signature-version
Displays classication signature version conguration.
Options
• cec-lename
Indicates the cec library lename in the last updated classication signature.
• cec-version
Indicates the cec library version in the last updated classication signature.
• classication-version
Indicates the classication version in the last updated classication signature.
• conf-lename
785
Traffic Management Shell (tmsh) Reference Guide
Indicates the conguration lename in the last updated classication signature.
• conf-version
Indicates the conguration version in the last updated classication signature.
• im-version
Indicates the im version in the last updated classication signature.
• qm-protocols-lename
Indicates the qosmos protocols lename in the last updated classication signature.
• qm-protocols-version
Indicates the qosmos protocols version in the last updated classication signature.
• update-time
Indicates the update time in the last updated classication signature.
See Also
list, tmsh
signatures
Manages classication engine signatures.
Syntax
load signatures le [lename]
Loads classication signatures from a signature update le.
load signatures default
Resets classication engine and signatures to the factory defaults.
Description
You can use the signatures component to load the classication signatures from a le. Only admins can
run this command.
You can obtain the latest signature update le (*.im) (if one is available) from http://downloads.f5.com.
For the lename, if no absolute path is specied, the default path /var/libdata/dpi/im/ is used.
Use load signatures default to discard and remove any installed upgrades and reset the classication engine
and signatures to factory defaults. No user-created signatures will be deleted. By keeping the *.im le, you
will be able to re-apply the update any time later using the load signatures le command.
Examples
load signatures le my_sig_le.im
Loads signatures from le "my_sig_le.im" under the folder: /var/libdata/dpi/im/.
load signatures le /var/tmp/new_sig_le.im
Loads signatures from le "new_sig_le.im" under the folder: /var/tmp/.
786
LTM Classification
See Also
ltm classication signature-update-schedule, load, tmsh
update-signatures
Run automatic update for classication signatures.
Syntax
Run the update-signatures component within the ltm classication module using the syntax in the following
sections:
Run
run update-signatures
Description
You can use the update-signatures component to update the classication signatures from F5 download
server. Only admins can run this command.
See Also
ltm classication signature-update-schedule, run, tmsh
url-cat-policy
Congures an ltm classication url-cat policy. It's comprised of list of urldb feed lists,
Syntax
Congure the url-cat-policy component within the ltm classication module using the syntax in the
following sections.
Create/Modify
create url-cat-policy [name]
modify url-cat-policy [name]
app-service [name]
description [string]
feed-lists [add | delete ] { [name] }
edit url-cat-policy
all-properties
non-default-properties
787
Traffic Management Shell (tmsh) Reference Guide
Display
list url-cat-policy [ [ [name] ]
show running-config url-cat-policy
show running-config url-cat-policy [ [ [name] ]
all-properties
non-default-properties
one-line
partition
recursive
Display
delete url-cat-policy [name]
Description
You can use the url-cat-policy component to congure a shareable and reusable url categorization database
feed coming from local les or download feeds. The url-cat-policy can then be enforced on the conguration
object of the type: ltm virtual.
Examples
create ltm classication url-cat-policy POL1 feed-lists add { FL1 } description none }
Creates a url-cat-policy POL1 with urldb feeds from FL1 feed lists.
list url-cat-policy
Displays the current list of url-categorization policies contents.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description.
• partition
Displays the administrative partition within which the component resides.
• feed-lists
Adds, deletes, or replaces a feed list. Species a list of feed lists (see ltm classication urldb-feed-list)
against which the packet will be compared.
See Also
create, edit, list, modify, ltm classication urldb-feed-list, tmsh
788
LTM Classification
url-category
Congures a custom URL category.
Syntax
Congure the url-category within the ltm classication module using the syntax shown in the following
sections.
Create/Modify
create url-category [name]
app-service [[string] | none]
description [string]
url-category-id [integer]
irule-event [enabled | disabled]
modify url-category [name]
app-service [[string] | none]
description [string]
irule-event [enabled | disabled]
edit url-category [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list url-category
list url-category [ [all] | [name] ]
show running-config url-category
show running-config url-category [ [all] | [name] ]
all-properties
non-default-properties
one-line
partition
Delete
delete url-category [name]
Note: All referring url-categorization-lters (to this url-category) need to be deleted rst; otherwise an
error will be reported. Predened url-categories cannot be deleted.
Description
You can use the url-category component to create, modify, delete, and display classication url-category.
789
Traffic Management Shell (tmsh) Reference Guide
Examples
create url-category my_urlcat { url-category-id 28672 irule-event disabled }
Creates a new url-category named my_urlcat.
modify url-category my_urlcat { irule-event enabled description "My description." }
Modify a url-category named my_urlcat.
list url-category
Displays all created categories.
delete url-category my_urlcat
Deletes the url-category named my_urlcat.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• url-category-id
Identies the url-category. This is set during creation and cannot be changed. Identiers must be unique
across predened and user-dened categories. Predened url-category-ids must be in numeric range
[24576, 28671), and user dened url-category-ids must be in numeric range [28672-32768).
• irule-event
Indicates if the irule is enabled or disabled in result of the classication engine.
See Also
create, modify, delete, list, show, tmsh, ltm classication, pem policy
urldb-feed-list
Congures a feed-list to be used for URLDB le loads. A urldb-feed-list is a list of URL feeds (including
local le paths) from where URLDB les are downloaded. These les contain URL categorization
information.
Syntax
Congure the urldb-feed-list component within the ltm classication module using the syntax in the
following sections.
Create/Modify
create urldb-feed-list [name]
modify urldb-feed-list [[name] | all]
default-url-category [name]
790
LTM Classification
url [string]
poll-interval [integer]
user [string]
password [string]
app-service [name]
description [string]
load urldb-feed-list [[name] | all]
Display
list urldb-feed-list [[name] | all | [property]]
show running-config urldb-feed-list [[name] | all | [property]]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete urldb-feed-list [[name] | all]
Description
You can use the urldb-feed-list component to dene reusable lists of feeds. You can use a feed list in an
ltm classication url-cat-policy.
Examples
create urldb-feed-list FL1 { url le:///shared/images/custom_urldb_1.txt }
Creates a new feed list, "FL1" with URL category information in the le specied by url.
Options
• create
Creates a new feed list.
• delete
Deletes the feed list that you specify next, in curly braces ({}).
• le
DEPRECATED since version 11.7.0. Specifies the file object containing the
URLDB information.
• url
Species the url to fetch the le containing the URLDB information.
• default-url-category
The URL category to be used for all the URLs specied in the URLDB le.
791
Traffic Management Shell (tmsh) Reference Guide
• poll-interval
Species the time interval in seconds at which the url needs to be polled.
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description for this feed list.
• partition
Displays the administrative partition within which the component resides.
See Also
edit, list, modify, ltm classication, tmsh
urldb-file
Manages a custom URLDB le
Syntax
List the urldb-le component within the ltm classication module using the syntax in the following sections.
Create
create urldb-file [name]
source-path [string]
app-service [name]
DEPRECATED: create command is deprecated from version 12.0.0. Though this command is visible,
this is not meant to be used by the users. The daemons use it internally.
Display
list urldb-file [[name] | all | [property]]
show running-config urldb-file [[name] | all | [property]]
all-properties
one-line
partition
Delete
delete urldb-file [[name] | all]
DEPRECATED: delete command is deprecated from version 12.0.0. Though this command is visible,
this is not meant to be used by the users. The daemons use it internally.
792
LTM Classification
Description
You can use the urldb-le component to create, the custom URLDB le in versions before 11.7.0. The
urldb-le is created internally using the URl specied in ltm classication urldb-feed-list in later versions.
Examples
create urldb-le FILE1 { source-path le:/shared/images/custom_urldb_1.txt }
Creates a new urldb le object, "FILE1" from the source le /shared/images/custom_urldb_1.txt
Create works in versions before 11.7.0. Has been deprecated in later versions
list urldb-le [leobj-name]
Lists the attributes of urldb le object, "FILE1" from the source le /shared/images/custom_urldb_1.txt
Options
• create
Creates a new le object for custom urlcat db.
• delete
Deletes the le object that you specify next, in curly braces ({}).
• source-path
Species the location from where the URLDB le object sources the le.
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description for this feed list.
• partition
Displays the administrative partition within which the component resides.
See Also
edit, list, ltm classication, tmsh
793
Traffic Management Shell (tmsh) Reference Guide
LTM Classification Stats
application
Displays and resets classied application statistics.
Syntax
Display statistics for the application component within the ltm classication stats module using the syntax
in the following section.
Display
show application
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the application component to display classication application statistics. The statistics details
are described below:
• Name
Species the number of the classied application.
• Count
Species a number of classied ows or transactions (in transaction mode) to specic application.
• LTM Policy
Species the number of classication decisions by LTM Policy (cpm).
• Classication Engine
Species the number of classication decisions by classication engine (CEC).
• Qosmos iXengine
Species the number of classication decisions by Qosmos iXengine (ixe).
• Cache
Species the number of classication decisions by Cache (srDB).
• URI Parameter
Species the number of classication decisions by evaluating HTTP URI query string classication
parameter.
• HTTP Header
Species the number of classication decisions by using HTTP classication header.
• iRule
Species the number of classication decisions by iRule.
• Bytes in
Species the bytes in of the classied application.
• Bytes out
Species the bytes out of the classied application.
• Packets in
Species the packets in of the classied application.
• Packets out
Species the packets out of the classied application.
You can reset the classication application statistics using reset-stats command.
Examples
show application
Displays the classied application statistics.
reset-stats application
Resets the classied application statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
reset-stats, show, tmsh
url-category
Displays and resets classied url-category statistics.
Syntax
Display statistics for the url-category component within the ltm classication stats module using the
syntax in the following section.
Display
show url-category option: (default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the url-category component to display classication url-category statistics. The statistics
details are described below:
• Name
Species the number of the classied url-category.
• Count
Species a number of classied ows or transactions (in transaction mode) to specic url-category.
• iRule
796
LTM Classification Stats
Species the number of url-categorization decision by iRule.
• Customdb
Species the number of url-categorization decision by custom url database.
• wrdb
Species the number of url-categorization decision by webroot database.
• Bytes in
Species the bytes in of the classied url-category.
• Bytes out
Species the bytes out of the classied url-category.
• Packets in
Species the packets in of the classied url-category.
• Packets out
Species the packets out of the classied url-category.
You can reset the classication url-category statistics using reset-stats command.
Examples
show url-category
Displays the classied url-category statistics.
reset-stats url-category
Resets the classied url-category statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
reset-stats, show, tmsh
797
Traffic Management Shell (tmsh) Reference Guide
LTM ClientSSL
ocsp-stapling-responses
Deletes the cached OCSP responses on the BIG-IP(r) system.
Syntax
Use the ocsp-stapling-responses component within the ltm.clientssl module to manage connections using
the following syntax.
Delete
delete ocsp-stapling-responses
virtual [name]
clientssl-profile [name]
Description
You can use the ocsp-stapling-responses component to delete the cached OCSP responses based on a
specied clientssl prole.
Options
• virtual
Species the name of the virtual server that you want to display or delete cached certicates from.
• clientssl-prole
Species the name of the clientssl prole that belongs to the virtual selected.
See Also
delete, tmsh
LTM ClientSSL Proxy
cached-certs
Displays and deletes SSL Forward Proxy cached certicates on the BIG-IP(r) system.
Syntax
Use the cached-certs component within the ltm.clientssl-proxy module to manage connections using the
following syntax.
Display
show cached-certs
virtual [name]
clientssl-profile [name]
Delete
delete cached-certs
virtual [name]
clientssl-profile [name]
Description
You can use the cached-certs component to display or delete SSL Forward Proxy cached certicates based
on a specied clientssl prole.
Options
• virtual
Species the name of the virtual server that you want to display or delete cached certicates from.
• clientssl-prole
Species the name of the clientssl prole that belongs to the virtual selected.
See Also
delete, show, tmsh
LTM Data Group
external
Congures an external class.
Syntax
Congure the external data-group within the ltm data-group module using the syntax shown in the
following sections.
Create/Modify
create external [name]
modify external [name]
app-service [[string] | none]
description [string]
external-file-name [ [file name] | none]
separator [string]
source-path [URL]
type [integer | ip | string ]
edit external [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list external
list external [ [ [name] | [glob] | [regex] ] ... ]
show running-config external
show running-config external [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete external [name]
Description
Data groups are lists of data that you dene and use with iRules(r) operators. External data group records
are stored in external les that you manage through the sys le data-group component. Note that external
data groups can be very large, which is one reason why the groups are saved to external les. For example,
a phone company may store a list of thousands of phone numbers in an external data group.
You should consider using an internal data group when the number of records is expected to be small.
An external data group acquires its type from the associated data-group le, which can be a list of IP
addresses, strings, or integers.
External data groups are lists that specify:
• A data-group le where records are stored
• A description of the class
There are two ways to congure the external data-group object:
• Create external data-group object, and then specify the source-path and type of the external-le. In one
step the external-le will be created within the sys le data-group module and external data-group
within the ltm data-group module.
• Create an external-le within the sys le data-group module, and then create external data-group
within the ltm data-group module. See help sys le data-group for information on creating the
data-group le.
Examples
• create external ext-dg1 external-le-name string.dat description "created for rule xyz"
Creates an external data group named ext-dg1, with the given description. The records for the data group
are loaded from the data-group le string.dat previously created in the sys le data-group component.
• create external ext-dg1 description "created for rule xyz" source-path
http:/le-server/data-groups/ip.class type ip
Downloads the data-group le from the given URL into le-store and creates a data-group le named
ext-dg1 within the sys le data-group module. Creates an external data group named ext-dg1, with the
given description. The records for the data group are loaded from the data-group le ext-dg1.
• create external ext-dg2 source-path le:/shared/save/Test.dat type string
Creates a data-group le named ext-dg2 within the sys le data-group module. Creates an external
data group named ext-dg2. The records for the data group are loaded from the data-group le ext-dg2.
• modify external ext-dg2 description "created for rule abc" source-path le:/shared/save/Test2.dat
Downloads the le from the given URL into le-store and updates the source-path of data-group le
referenced by external data group ext-dg2. Modies the description of external data group ext-dg2.
• delete external ext-dg1
Deletes the external data group named ext-dg1. Note: the data-group le referenced by ext-dg1 is not
deleted at this time. If needed, it should be deleted under sys le data-group component.
Options
• app-service
Species the name of the application service to which the data group belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the data group. Only the application service can modify or delete the data group.
• description
User dened description.
• external-le-name
Species the data-group le where the records are stored.
804
LTM Data Group
Note: Only source-path or external-le-name may be specied for external data-group conguration
item.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• separator
Species a separator to use when dening the data group. The default value is :=.
• source-path [URL]
This optional attribute takes a URL.
Note: Only source-path or external-le-name may be specied for external data-group conguration
item, for example:
source-path http://le-server/data-groups/AUL_1.cls
source-path https://le-server/data-groups/CNN.x
source-path ftp://username:password@server/data-groups/latest.class
• type
Species the kind of data in the group. This option is acquired from the data group le. If the external
data group is created with external-le that was previously created within the sys le data-group module,
then type option cannot be modied. If the external data group is created with source-path option, then
type should be specied. The value for type could be integer or ip or string.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
internal
Congures an internal class.
Syntax
Congure the internal data-group within the ltm data-group module using the syntax shown in the following
sections.
Create/Modify
create internal [name]
app-service [[string] | none]
description [string]
records [add | delete | modify | replace-all-with] {
[record key] {
data [value]
}
}
805
Traffic Management Shell (tmsh) Reference Guide
records none
type [integer | ip | [string] ]
modify internal [name]
app-service [[string] | none]
description [string]
records [add | delete | modify | replace-all-with] {
[record key] {
data [value]
}
}
records none
edit internal [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list internal
list internal [ [ [name] | [glob] | [regex] ] ... ]
show running-config internal
show running-config internal [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Data groups are lists of data that you dene and use with iRules(r) operators. Consider using an external
data group if the number of records is expected to be large.
The BIG-IP(r) system includes a number of predened lists that you can use. They are:
• aol
• default_accept_language
• images
• private_net
The above lists are located in the le /cong/prole_base.conf. When you run the load command, the
system loads these lists; however, unless you have modied the lists, the system does not save the lists to
the bigip.conf le.
The internal data groups are stored in the bigip.conf le.
Internal data groups can be one of three types:
• A list of IP addresses
• A list of strings
• A list of integers
Strings must be surrounded by quotation marks. Numbers can be either positive or negative. These groups
dene the type of data in the class, which can be IP addresses, strings, or integers>
806
LTM Data Group
Examples
create internal MyDG records add { 10.0.0.0 } type ip
Creates an internal data group named MyDG that contains a single IP address.
create internal DG2 records add { 192.1.1.255 192.2.1.255 192.3.1.255 } type ip
Creates an internal data group named DG2 that contains a list of three network addresses: 192.1.1.0/24,
192.2.1.1/24, and 192.3.1.1/24.
create internal MyDG records add { my_key { data my_value } } type string
Creates an internal data group named MyDG that contains a single name/value pair.
Options
• app-service
Species the name of the application service to which the data group belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the data group. Only the application service can modify or delete the data group.
• description
User dened description.
• records
Congures the data in the group.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• type
Species the kind of data in the group. The default value is ip. This option is required by the command
create.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
807
Traffic Management Shell (tmsh) Reference Guide
LTM DNS
dns-express-db
Loads the DNS Express data le.
Syntax
load dns-express-db
Description
The dns-express-db component within the ltm dns module is used to load the DNS Express data le
/var/db/tmmdns.bin. The le is only loaded if it has been modied.
Examples
load dns-express-db
Loads the DNS Express le from disk into the running conguration.
See Also
load, tmsh
nameserver
Congures DNS nameservers on the BIG-IP(r) system.
Syntax
Congure the nameserver component within the ltm dns module using the syntax in the following sections.
Create/Modify
create nameserver [name]
modify nameserver [name]
address [ip address]
app-service [[string] | none]
port [unsigned integer]
route-domain [route-domain name | none]
tsig-key [tsig-key name | none]
edit nameserver [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats nameserver
reset-stats nameserver [ [ [name] | [glob] | [regex] ] ... ]
Display
list nameserver
list nameserver [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show nameserver
show nameserver [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
field-fmt
Delete
delete nameserver [name]
Description
You can use the nameserver component to congure nameservers and to view information about the
nameservers.
Examples
create nameserver myNameserver address 127.0.0.1 port 53
Creates the nameserver, myNameserver, given the address and port.
list nameserver myNameserver
Displays the properties of the nameserver myNameserver.
Options
• address
Species the IP address of the nameserver. The default value is 127.0.0.1.
• app-service
Species the name of the application service to which the nameserver belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the nameserver. Only the application service can modify or delete the nameserver.
• glob
810
LTM DNS
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• port
Species the service port of the nameserver. The default value is 53.
• route-domain
Species the route domain that the nameserver uses for outbound trafc. The default value is the default
route domain.
• tsig-key
Species the TSIG key used to communicate with this nameserver for zone transfers. If the nameserver
is a client, then this TSIG key is used to verify the query and sign the response. If the nameserver is a
transfer target for DNS Express nameserver, then this TSIG key should match that of the master
nameserver.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
tsig-key
Congures TSIG keys on the BIG-IP(r) system.
Syntax
Congure the tsig-key component within the ltm dns module using the syntax in the following sections.
Create/Modify
create tsig-key [name]
modify tsig-key [name]
algorithm [ hmacmd5 | hmacsha1 | hmacsha256 ]
app-service [[string] | none]
secret [string]
edit tsig-key [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
811
Traffic Management Shell (tmsh) Reference Guide
Display
list tsig-key
list tsig-key [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete tsig-key [name]
Description
You can use the tsig-key component to congure TSIG keys and to view information about the keys.
Examples
create tsig-key myKey algorithm hmacmd5 secret ABCDEFG
Creates the TSIG key, myKey, given the algorithm and secret (both required).
list tsig-key myKey
Displays the properties of the TSIG key myKey.
Options
• algorithm
Species the algorithm to use to generate the key.
• app-service
Species the name of the application service to which the TSIG key belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the TSIG key. Only the application service can modify or delete the TSIG key.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the string representation of the key's shared secret.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
812
LTM DNS
zone
Congures zones on the BIG-IP(r) system.
Syntax
Congure the zone component within the ltm dns module using the syntax in the following sections.
Create/Modify
create zone [name]
modify zone [name]
app-service [[string] | none]
dns-express-allow-notify [add | delete | none | replace-all-with] {
[IP Address]
}
dns-express-enabled [yes | no]
dns-express-notify-action [ consume | bypass | repeat ]
dns-express-notify-tsig-verify [yes | no]
dns-express-server [server name | none]
response-policy [yes | no]
server-tsig-key [tsig-key name | none]
transfer-clients [add | delete | none | replace-all-with] {
[server name]
}
edit zone [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats zone
reset-stats zone [ [ [name] | [glob] | [regex] ] ... ]
Display
list zone
list zone [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show zone [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete zone [name]
Description
You can use the zone component to congure and view information about a zone.
813
Traffic Management Shell (tmsh) Reference Guide
Examples
list zone myZone
Displays the properties of the zone named myZone.
create zone myZone transfer-clients add { nameserver1 nameserver2 }
Creates a zone named myZone, which allows zone data to be transferred to nameserver1 and nameserver2.
Options
• app-service
Species the name of the application service to which the zone belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the zone. Only the application service can modify or delete the zone.
• dns-express-allow-notify
Species a list of IP addresses, in addition to the DNS Zone's DNS-Express Server address, which are
allowed to notify the BIGIP of DNS Zone changes. A notify message coming from an IP which is neither
the address of the zone's DNS Express server nor an address in this list will be dropped by the BIGIP.
• dns-express-enabled [yes | no]
Species whether DNS Express is enabled to process queries for this zone. The default value is yes.
• dns-express-notify-action [ consume | bypass | repeat ]
Action to take when a NOTIFY query is received for a congured zone. Options are consume, bypass,
and repeat. Default is consume, meaning the NOTIFY query is seen only by DNS Express. bypass
means the query will NOT go to DNS Express, but any backend DNS resource (subject to DNS prole
unhandled-query-action). repeat means the NOTIFY will go to both DNS Express and any backend
DNS resource. If TSIG is congured, the signature is only validated for consume and repeat actions.
NOTIFY responses are assumed to be sent by the backend DNS resource, except when the action is
consume and DNS Express will generate a response.
• dns-express-notify-tsig-verify
Verify NOTIFY query TSIG for a DNS Express zone. Default is yes.
• dns-express-server
Species the server from which to retrieve zone information for DNS Express.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
Note: A successful zone transfer must occur before this zone can service DNS requests.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• response-policy
Species if this is a response policy zone. If this is set to yes, this zone may be assigned as an RPZ to
a DNS Cache. Default is no.
814
LTM DNS
• server-tsig-key
Species the server side TSIG key associated with the DNS zone. It should match the TSIG Key
associated with the master name servers.
• transfer-clients
Species the nameservers allowed to transfer the zone from BIGIP.
See Also
create, delete, edit, glob, list, show, modify, regex, tmsh
815
Traffic Management Shell (tmsh) Reference Guide
LTM DNS Analytics
global-settings
Congures the global settings of all DNS listeners on the BIG-IP(r) system.
Syntax
Congure the global-settings DNS listeners within the ltm dns analytics module using the syntax in the
following sections.
Modify
modify global-settings
collect-client-ip [enabled | disabled]
collect-query-name [enabled | disabled]
Display
list global-settings
list global-settings
all-properties
non-default-properties
one-line
Description
You can use the global-settings component to congure and view information about the global settings of
all DNS listeners.
Examples
list global-settings all-properties
Displays the global settings for the DNS listeners on the BIG-IP system.
Options
• collect-client-ip
When enabled, the client IP addresses of DNS queries will be collected and stored in analytics database.
The default value is enabled.
• collect-query-name
When enabled, the domain names of DNS queries will be collected and stored in analytics database.
The default value is enabled.
See Also
list, modify, tmsh
LTM DNS Cache
global-settings
Congures the global settings of all DNS caches on the BIG-IP(r) system.
Syntax
Congure the global-settings DNS cache component within the ltm dns cache module using the syntax
in the following sections.
Create/Modify
modify global-settings [name]
cache-maximum-ttl [integer]
cache-minimum-ttl [integer]
resolver-edns-buffer-size [integer]
edit global-settings [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list global-settings
list global-settings [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Description
You can use the global-settings component to congure and view information about the global settings of
all DNS caches.
Examples
list global-settings all-properties
Displays the global settings for the DNS caches on the BIG-IP system.
Options
• cache-maximum-ttl
Species the number of seconds after which you want the BIG-IP system to re-query for resource records.
This setting allows the BIG-IP system to re-query for resource records sooner than the owner of the
records intended.
• cache-minimum-ttl
Species the minimum number of seconds you want the BIG-IP system to cache DNS resource records.
This setting allows the BIG-IP system to cache resource records longer than the owner of the records
intended.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• resolver-edns-buffer-size [integer]
Species the number of bytes you want the BIG-IP system to advertise as the EDNS buffer size in UDP
queries.
See Also
edit, glob, list, modify, regex, tmsh
resolver
Congures a DNS cache with a resolver on the BIG-IP(r) system.
Syntax
Congure the resolver DNS cache component within the ltm dns cache module using the syntax in the
following sections.
Create/Modify
create resolver [name]
modify resolver [name]
allowed-query-time [integer]
answer-default-zones [yes | no]
app-service [[string] | none]
description [[string] | none]
forward-zones [add | delete | modify | replace-all-with] {
[ [zone-name] ] {
nameservers [add | delete | replace-all-with] {
[ [IPv4address:port] | [IPv6address.port] ]
}
nameservers none
}
forward-zones none
local-zones [ [none] |
[ { { name [dname] type [type] records [none | add { [RR string]
...} ] } ... } ] ]
max-concurrent-queries [integer]
max-concurrent-tcp [integer]
max-concurrent-udp [integer]
msg-cache-size [integer]
nameserver-cache-count [integer]
randomize-query-name-case [yes | no]
820
LTM DNS Cache
response-policy-zones [add | delete | modify] {
[zone-name] {
action [nxdomain | walled-garden]
walled-garden [local-zone]
}
}
response-policy-zones none
root-hints {
{ [IP address] ... }
}
route-domain [name]
rrset-cache-size [integer]
unwanted-query-reply-threshold [integer]
use-ipv4 [yes | no]
use-ipv6 [yes | no]
use-tcp [yes | no]
use-udp [yes | no]
Display
list resolver
list resolver [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show resolver
show resolver [name]
Delete
delete resolver [name]
Description
You can use the resolver component to congure and view information about a recursive-resolving DNS
cache. A resolver cache performs recursive resolution to ll its cache.
Important: When sizing caches, consider the total amount of memory available and how you wish to allocate
memory for DNS caching. Note that cache sizing values are per-TMM process; therefore, a platform with
eight TMMs consumes the amount of memory set for the RRset cache times eight.
Examples
list resolver myCache
Displays the properties of the recursive-resolving DNS cache myCache.
modify resolver myCache local-zones { { name lz.example.net records add { "lz.example.net 60 IN A
127.0.0.1" "www.lz.example.net 300 IN A 127.0.0.2" } } }
Modies DNS cache myCache by adding a local-zone lz.example.net with 2 resource records.
Options
• allowed-query-time
Species the time allowed for a query to stay in the queue before it is replaced by a new query when
the number of concurrent distinct queries exceeds the limit. The default value is 200 milliseconds.
• answer-default-zones
821
Traffic Management Shell (tmsh) Reference Guide
Species whether the resolver cache answers queries for default zones: localhost, reverse 127.0.0.1 and
::1, and AS112 zones. The default value is no.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• forward-zones
Adds, deletes, modies, or replaces a set of forward zones on a DNS Cache, by specifying zone name(s).
A given zone name should only use the symbols allowed for a fully qualied domain name (FQDN),
namely ASCII letters a though z, digits 0 through 9, hyphen -, and period .. For example site.example.com
would be a valid zone name.
A DNS Cache congured with a forward zone will forward any queries that result in a cache-miss (the
answer was not available in the cache) and match a congured zone name, to the nameserver specied
on the zone. If no nameservers are specied on the zone, an automatic SERVFAIL is returned. When
a forward zone's nameserver returns a valid response to the DNS Cache, that response is cached and
then returned to the requester.
• nameservers
Adds, deletes, modies, or replaces a set of nameservers in a forward zone on a DNS Cache. A
nameserver is represented by an IPaddress and port in the format [IPv4:port] or [IPv6.port], for
example 10.10.10.10:53 or 2001::1:ff.53, respectively.
If more than one nameserver is listed for a given forward zone, a matching query will be sent to the
nameserver that is currently deemed the most responsive (based on RTTs). If no response is received
within a certain window of time, the DNS Cache will resend the query to another nameserver with
an increased wait window until a response is received.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• local-zones
Zones and associated resource records for which the cache will provide Authoritative responses. Default
is empty. This is intended for small, simple authoritative data congurations.
The local-zone name must be fully qualied and should be the apex of the zone. The local-zone type
may be one of the following: deny, refuse, static, transparent, type-transparent, or redirect. Zero
or more resource records must be fully specied: name, ttl, class, type, and record data, separated by
spaces, and within double quotes. For example, "www.example.net. 300 IN A 1.2.3.4".
For all local-zones types, if the DNS query matches, it is answered Authoritatively. How a non-matching
query is handled depends on the local-zone type.
deny drops the query.
refuse sends a REFUSED response.
static sends either a NoData or NXDOMAIN response (includes SOA if present in local-zone).
transparent performs regular cache operation (i.e. transparent pass-through or iterative resolution)
except for those query names which would result in NoData. This is the default local-zone type.
type-transparent Same as transparent but does not return NoData.
redirect returns responses with zone sufx record(s) for queries beneath that sufx. For example, a
local-zone for example.com and a single A record for that name; queries for www.example.com or
abc.www.example.com would return the single A record (both have the same sufx).
• max-concurrent-queries
822
LTM DNS Cache
Species the maximum number of concurrent distinct queries used by the resolver. A query is identied
by query name, type and class. If the number of distinct queries exceeds this limit, the resolver replaces
the earliest query in the queue with the new query if it has been in the queue longer than the allowed
time. The default value is 1024.
• max-concurrent-tcp
Species the maximum number of concurrent TCP ows used by the resolver. The default value is 20.
• max-concurrent-udp
Species the maximum number of concurrent UDP ows used by the resolver. The default value is
8192.
• msg-cache-size
Species the maximum size in bytes of the DNS message cache. The default value is 1048576.
The BIG-IP system caches the messages in a DNS response in the message cache. After the maximum
size of the cache is reached, when new or refreshed content is added to the cache, the expired and older
content is removed from the cache. A higher maximum size allows more DNS responses to be cached
and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content,
but can lower the cache hit percentage.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nameserver-cache-count
Species the maximum number of DNS nameservers for which the BIG-IP system caches connection
and capability data. The default value is 16536 entries.
• randomize-query-name-case
When enabled, the resolver randomizes the case of query names. The default value is yes.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• response-policy-zones
Adds, deletes or modies the response policy zone to be used by this DNS Cache. Only a DNS Express
zone congured as a response policy zone can be added.
The query name of a recursive DNS request without DNSSEC enabled is queried against the data in the
response policy zone. If a match is found, the congured response policy action is taken.
• action
The action to take upon a match. nxdomain results in an NXDOMAIN response given to the client.
walled-garden results in a response with a CNAME to the walled-garden zone and an A or AAAA
response matching the DNS query type. The default action is nxdomain.
• walled-garden
A local zone congured in this cache that contains an A and/or AAAA record. This is typically used
to redirect a user that requests resolution of a name contained in the RPZ database to a local server.
This local server can display a message to the user and/or record the connection. Only A/AAAA/ANY
requests are redirected, a request for any other type is answered with a NoData response. If a request
is received for type A or AAAA but there are no records of that type congured, a NoData response
is returned instead.
• root-hints
823
Traffic Management Shell (tmsh) Reference Guide
Species the IP addresses of DNS servers that the BIG-IP system considers authoritative for the DNS
root nameservers.
Important: By default, the BIG-IP system uses the DNS root nameservers published by InterNIC.
Caution: When you add DNS root nameservers, the BIG-IP system no longer uses the default nameservers
published by InterNIC, but instead uses the nameservers you add as authoritative for the DNS root
nameservers.
• route-domain
Species the route domain the resolver uses for outbound trafc. The default value is the default route
domain.
• rrset-cache-size
Species the maximum size in bytes of the resource records set cache. The default value is 10485760.
The BIG-IP system caches the supporting records in a DNS response in the resource record cache. After
the maximum size of the cache is reached, when new or refreshed content is added to the cache, the
expired and older content is removed from the cache. A higher maximum size allows more DNS responses
to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of
cached content, but can lower the cache hit percentage.
• unwanted-query-reply-threshold
The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not
generate SNMP traps or log messages when rejecting unsolicited replies.
Change the default value to monitor for unsolicited replies. This alerts you to a potential security attack,
such as cache poisoning or DOS. For example, if you specify a value of 1,000,000, each time the system
receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message. The default value
is 0 (off).
• use-ipv4
When enabled, the resolver sends DNS queries to IPv4 addresses. The default value is yes.
• use-ipv6
When enabled, the resolver sends DNS queries to IPv6 addresses. The default value is yes.
• use-tcp
When enabled, the resolver can send queries over the TCP protocol. The default value is yes.
• use-udp
When enabled, the resolver can send queries over the UDP protocol. The default value is yes.
See Also
create, delete, edit, glob, list, ltm dns cache transparent, ltm dns cache validating-resolver, show, modify,
regex, tmsh
transparent
Congures a DNS cache without a resolver on the BIG-IP(r) system.
824
LTM DNS Cache
Syntax
Congure the transparent DNS cache component within the ltm dns cache module using the syntax in
the following sections.
Create/Modify
create transparent [name]
modify transparent [name]
answer-default-zones [yes | no]
app-service [[string] | none]
local-zones [ [none] |
[ { { name [dname] type [type] records [none | add { [RR string]
...} ] } ... } ] ]
msg-cache-size [integer]
response-policy-zones [add | delete | modify] {
[zone-name] {
action [nxdomain | walled-garden]
walled-garden [local-zone]
}
}
response-policy-zones none
rrset-cache-size [integer]
Display
list transparent
list transparent [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show transparent
show transparent [name]
Delete
delete transparent [name]
Description
You can use the transparent component to congure and view information about a transparent DNS cache.
A transparent cache does not perform recursive resolution, but instead relies on another DNS resource for
this functionality.
Important: When sizing caches, consider the total amount of memory available and how you wish to allocate
memory for DNS caching. Note that cache sizing values are per-TMM process; therefore, a platform with
eight TMMs consumes the amount of memory set for the RRset cache times eight.
Examples
list transparent myCache
Displays the properties of the transparent DNS cache myCache.
modify transparent myCache local-zones { { name lz.example.net records add { "lz.example.net 60
IN A 127.0.0.1" "www.lz.example.net 300 IN A 127.0.0.2" } } }
Modies DNS cache myCache by adding a local-zone lz.example.net with 2 resource records.
825
Traffic Management Shell (tmsh) Reference Guide
Options
• answer-default-zones
Species whether the resolver cache answers queries for default zones: localhost, reverse 127.0.0.1 and
::1, and AS112 zones. The default value is no.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• local-zones
Zones and associated resource records for which the cache will provide Authoritative responses. Default
is empty. This is intended for small, simple authoritative data congurations.
The local-zone name must be fully qualied and should be the apex of the zone. The local-zone type
may be one of the following: deny, refuse, static, transparent, type-transparent, or redirect. Zero
or more resource records must be fully specied: name, ttl, class, type, and record data, separated by
spaces, and within double quotes. For example, "www.example.net. 300 IN A 1.2.3.4".
For all local-zones types, if the DNS query matches, it is answered Authoritatively. How a non-matching
query is handled depends on the local-zone type.
deny drops the query.
refuse sends a REFUSED response.
static sends either a NoData or NXDOMAIN response (includes SOA if present in local-zone).
transparent performs regular cache operation (i.e. transparent pass-through or iterative resolution)
except for those query names which would result in NoData. This is the default local-zone type.
type-transparent Same as transparent but does not return NoData.
redirect returns responses with zone sufx record(s) for queries beneath that sufx. For example, a
local-zone for example.com and a single A record for that name; queries for www.example.com or
abc.www.example.com would return the single A record (both have the same sufx).
• msg-cache-size
Species the maximum size in bytes of the DNS message cache. The default value is 1048576.
The BIG-IP system caches the messages in a DNS response in the message cache. After the maximum
size of the cache is reached, when new or refreshed content is added to the cache, the expired and older
content is removed from the cache. A higher maximum size allows more DNS responses to be cached
and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content,
but can lower the cache hit percentage.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• response-policy-zones
826
LTM DNS Cache
Adds, deletes or modies the response policy zone to be used by this DNS Cache. Only a DNS Express
zone congured as a response policy zone can be added.
The query name of a recursive DNS request without DNSSEC enabled is queried against the data in the
response policy zone. If a match is found, the congured response policy action is taken.
• action
The action to take upon a match. nxdomain results in an NXDOMAIN response given to the client.
walled-garden results in a response with a CNAME to the walled-garden zone and an A or AAAA
response matching the DNS query type. The default action is nxdomain.
• walled-garden
A local zone congured in this cache that contains an A and/or AAAA record. This is typically used
to redirect a user that requests resolution of a name contained in the RPZ database to a local server.
This local server can display a message to the user and/or record the connection. Only A/AAAA/ANY
requests are redirected, a request for any other type is answered with a NoData response. If a request
is received for type A or AAAA but there are no records of that type congured, a NoData response
is returned instead.
• rrset-cache-size
Species the maximum size in bytes of the resource records set cache. The default value is 10485760.
The BIG-IP system caches the supporting records in a DNS response in the resource record cache. After
the maximum size of the cache is reached, when new or refreshed content is added to the cache, the
expired and older content is removed from the cache. A higher maximum size allows more DNS responses
to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of
cached content, but can lower the cache hit percentage.
See Also
create, delete, edit, glob, list, ltm dns cache resolver, ltm dns cache validating-resolver, show, modify,
regex, tmsh
validating-resolver
Congures a DNS cache with a resolver and validator on the BIG-IP(r) system.
Syntax
Congure the validating-resolver DNS cache component within the ltm dns cache module using the syntax
in the following sections.
Create/Modify
create validating-resolver [name]
modify validating-resolver [name]
allowed-query-time [integer]
answer-default-zones [yes | no]
app-service [[string] | none]
dlv-anchors {
{ [DNSKEY or DS RR string] ... }
}
forward-zones [add | delete | modify | replace-all-with] {
[ [zone-name] ] {
827
Traffic Management Shell (tmsh) Reference Guide
nameservers [add | delete | replace-all-with] {
[ [IPv4address:port] | [IPv6address.port] ]
}
nameservers none
}
forward-zones none
ignore-cd [yes | no]
key-cache-size [integer]
local-zones [ [none] |
[ { { name [dname] type [type] records [none | add { [RR string]
...} ] } ... } ] ]
max-concurrent-queries [integer]
max-concurrent-udp [integer]
max-concurrent-tcp [integer]
msg-cache-size [integer]
nameserver-cache-count [integer]
prefetch-key [yes | no]
randomize-query-name-case [yes | no]
response-policy-zones [add | delete | modify] {
[zone-name] {
action [nxdomain | walled-garden]
walled-garden [local-zone]
}
}
response-policy-zones none
root-hints {
{ [IP address] ... }
}
route-domain [name]
rrset-cache-size [integer]
trust-anchors {
{ [NDSKEY or DS RR string] ... }
}
unwanted-query-reply-threshold [integer]
use-ipv4 [yes | no]
use-ipv6 [yes | no]
use-tcp [yes | no]
use-udp [yes | no]
Display
list validating-resolver
list validating-resolver [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show validating-resolver [name]
Delete
delete validating-resolver [name]
Description
You can use the validating-resolver component to congure and view information about a validating
recursive-resolving DNS cache. A resolving and validating cache performs recursive resolution to ll its
cache and uses DNSSEC to ensure the integrity of the data.
Important: When sizing caches, consider the total amount of memory available and how you wish to allocate
memory for DNS caching. Note that cache sizing values are per-TMM process; therefore, a platform with
eight TMMs consumes the amount of memory set for the resource record set cache times eight.
828
LTM DNS Cache
Examples
list validating-resolver myCache
Displays the properties of the validating recursive-resolving DNS cache myCache.
modify validating-resolver myCache local-zones { { name lz.example.net records add { "lz.example.net
60 IN A 127.0.0.1" "www.lz.example.net 300 IN A 127.0.0.2" } } }
Modies DNS cache myCache by adding a local-zone lz.example.net with 2 resource records.
Options
• allowed-query-time
Species the time allowed for a query to stay in the queue before it is replaced by a new query when
the number of concurrent distinct queries exceeds the limit. The default value is 200 milliseconds.
• answer-default-zones
Species whether the validating resolver cache answers queries for default zones: localhost, reverse
127.0.0.1 and ::1, and AS112 zones. The default value is no.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• dlv-anchors
Species the DNSKEY or DS resource records the BIG-IP system uses to establish DNSSEC trust with
a DLV registry. The resource records must be specied in string format, for example, dig or drill format.
The default is none.
• forward-zones
Adds, deletes, modies, or replaces a set of forward zones on a DNS Cache, by specifying zone name(s).
A given zone name should only use the symbols allowed for a fully qualied domain name (FQDN),
namely ASCII letters a though z, digits 0 through 9, hyphen -, and period .. For example site.example.com
would be a valid zone name.
A DNS Cache congured with a forward zone will forward any queries that result in a cache-miss (the
answer was not available in the cache) and match a congured zone name, to the nameserver specied
on the zone. If no nameservers are specied on the zone, an automatic SERVFAIL is returned. When
a forward zone's nameserver returns a valid response to the DNS Cache, that response is cached and
then returned to the requester.
• nameservers
Adds, deletes, or replaces a set of nameservers in a forward zone on a DNS Cache. A nameserver is
represented by an IPaddress and port in the format [IPv4:port] or [IPv6.port], for example
10.10.10.10:53 or 2001::1:ff.53, respectively.
If more than one nameserver is listed for a given forward zone, a matching query will be sent to the
nameserver that is currently deemed the most responsive (based on RTTs). If no response is received
within a certain window of time, the DNS Cache will resend the query to another nameserver with
an increased wait window until a response is received.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ignore-cd
829
Traffic Management Shell (tmsh) Reference Guide
When enabled, the system ignores the Checking Disabled setting on client queries, performs validation,
and returns only secure answers. The default value is no.
• key-cache-size
Species the maximum size in bytes of the DNSKEY cache. The default value is 1048576.
• local-zones
Zones and associated resource records for which the cache will provide Authoritative responses. Default
is empty. This is intended for small, simple authoritative data congurations.
The local-zone name must be fully qualied and should be the apex of the zone. The local-zone type
may be one of the following: deny, refuse, static, transparent, type-transparent, or redirect. Zero
or more resource records must be fully specied: name, ttl, class, type, and record data, separated by
spaces, and within double quotes. For example, "www.example.net. 300 IN A 1.2.3.4".
For all local-zones types, if the DNS query matches, it is answered Authoritatively. How a non-matching
query is handled depends on the local-zone type.
deny drops the query.
refuse sends a REFUSED response.
static sends either a NoData or NXDOMAIN response (includes SOA if present in local-zone).
transparent performs regular cache operation (i.e. transparent pass-through or iterative resolution)
except for those query names which would result in NoData. This is the default local-zone type.
type-transparent Same as transparent but does not return NoData.
redirect returns responses with zone sufx record(s) for queries beneath that sufx. For example, a
local-zone for example.com and a single A record for that name; queries for www.example.com or
abc.www.example.com would return the single A record (both have the same sufx).
• max-concurrent-queries
Species the maximum number of concurrent distinct queries used by the resolver. A query is identied
by query name, type and class. If the number of distinct queries exceeds this limit, the resolver replaces
the earliest query in the queue with the new query if it has been in the queue longer than the allowed
time. The default value is 1024.
• max-concurrent-tcp
Species the maximum number of concurrent TCP ows used by the resolver. The default value is 20.
• max-concurrent-udp
Species the maximum number of concurrent UDP ows used by the resolver. The default value is
8192.
• msg-cache-size
Species the maximum size in bytes of the DNS message cache. The default value is 1048576.
The BIG-IP system caches the messages in a DNS response in the message cache. After the maximum
size of the cache is reached, when new or refreshed content is added to the cache, the expired and older
content is removed from the cache. A higher maximum size allows more DNS responses to be cached
and increases the cache hit percentage. A lower maximum size forces earlier eviction of cached content,
but can lower the cache hit percentage.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nameserver-cache-count
830
LTM DNS Cache
Species the maximum number of DNS nameservers for which the BIG-IP system caches connection
and capability data. The default value is 16536 entries.
• prefetch-key
When enabled, the validating resolver fetches the DNSKEY early in the validation process. Disable this
setting when you want to reduce resolver trafc, but understand that a client may have to wait for the
validating resolver to perform a key lookup. The default value is yes.
• randomize-query-name-case
When enabled, the resolver randomizes the case of query names. The default value is yes.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• response-policy-zones
Adds, deletes or modies the response policy zone to be used by this DNS Cache. Only a DNS Express
zone congured as a response policy zone can be added.
The query name of a recursive DNS request without DNSSEC enabled is queried against the data in the
response policy zone. If a match is found, the congured response policy action is taken.
• action
The action to take upon a match. nxdomain results in an NXDOMAIN response given to the client.
walled-garden results in a response with a CNAME to the walled-garden zone and an A or AAAA
response matching the DNS query type. The default action is nxdomain.
• walled-garden
A local zone congured in this cache that contains an A and/or AAAA record. This is typically used
to redirect a user that requests resolution of a name contained in the RPZ database to a local server.
This local server can display a message to the user and/or record the connection. Only A/AAAA/ANY
requests are redirected, a request for any other type is answered with a NoData response. If a request
is received for type A or AAAA but there are no records of that type congured, a NoData response
is returned instead.
• root-hints
Species the IP addresses of DNS servers that the BIG-IP system considers authoritative for the DNS
root nameservers.
Important: By default, the BIG-IP system uses the DNS root nameservers published by InterNIC.
Caution: When you add DNS root nameservers, the BIG-IP system no longer uses the default nameservers
published by InterNIC, but instead uses the nameservers you add as authoritative for the DNS root
nameservers.
• route-domain
Species the route domain the resolver uses for outbound trafc. The default value is the default route
domain.
• rrset-cache-size
Species the maximum size in bytes of the resource records set cache. The default value is 10485760.
The BIG-IP system caches the supporting records in a DNS response in the resource record cache. After
the maximum size of the cache is reached, when new or refreshed content is added to the cache, the
expired and older content is removed from the cache. A higher maximum size allows more DNS responses
to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of
cached content, but can lower the cache hit percentage.
831
Traffic Management Shell (tmsh) Reference Guide
• trust-anchors
Species the DNSKEY or DS resource records the BIG-IP system uses to establish DNSSEC trust with
a specic DNS zone. The resource records must be specied in string format, for example, dig or drill
format. The default value is none.
• unwanted-query-reply-threshold
The system always rejects unsolicited replies. The default value of 0 (off) indicates the system does not
generate SNMP traps or log messages when rejecting unsolicited replies.
Change the default value to monitor for unsolicited DNS replies. This alerts you to a potential security
attack, such as cache poisoning or DOS. For example, if you specify a value of 1,000,000, each time
the system receives 1,000,000 unsolicited replies, it generates an SNMP trap and log message. The
default value is 0 (off).
• use-ipv4
When enabled, the resolver sends DNS queries to IPv4 addresses. The default value is yes.
• use-ipv6
When enabled, the resolver sends DNS queries to IPv6 addresses. The default value is yes.
• use-tcp
When enabled, the resolver can send queries over the TCP protocol. The default value is yes.
• use-udp
When enabled, the resolver can send queries over the UDP protocol. The default value is yes.
See Also
create, delete, edit, glob, list, ltm dns cache transparent, ltm dns cache resolver, show, modify, regex, tmsh
832
LTM DNS Cache
LTM DNS Cache Records
key
Manages the DNSKEY records in the DNS caches on the BIG-IP(r) system.
Syntax
Congure the key component within the ltm dns cache records module using the following syntax.
Display
show key cache [cache name]
count-only
owner [domain name]
slot [integer]
tmm [integer]
Delete
delete key cache [cache name]
owner [domain name]
Examples
show key cache resolver_cache
Displays the DNSKEY records in the cache named resolver_cache.
delete key cache v_resolver_cache
Deletes the DNSKEY records from the cache named v_resolver_cache.
Description
You can use the following options with the key component.
Options
• cache name
Species a DNS cache name from which to display or delete DNSKEY records. This is a required eld.
• count-only
For a show command, return only a count of the number of matched records.
• owner
Species a domain name on which to lter the DNSKEY records in the specied DNS cache for a query
or deletion.
• slot
Species a slot number on a chassis that contains the specied DNS cache. This is a 1 based index.
• tmm
Species the number of the TMM that contains the specied DNS cache. Each tmm has essentially the
same entries, so which tmm you choose is arbitrary. Use this option only for debugging. This is a 0
based index. If not specied, a random tmm will be used.
See Also
delete, show, tmsh
msg
Manages message records in the DNS caches on the BIG-IP(r) system.
Syntax
Congure the msg component within the ltm dns cache records module using the following syntax.
Display
show msg cache [cache name]
count-only
qname [domain name]
rcode [integer]
slot [integer]
tmm [integer]
Delete
delete msg cache [cache name]
qname [domain name]
rcode [integer]
Description
The msg component contains full DNS messages. You can display and delete these messages.
Examples
show msg cache resolver_cache
Displays the message records in the DNS cache named resolver_cache.
delete msg cache v_resolver_cache
Deletes the message records from the DNS cache named v_resolver_cache.
Options
• cache name
Species a DNS cache name. This is a required eld.
• count-only
834
LTM DNS Cache Records
For a show command, return only a count of the number of matched records.
• qname
Species a domain name on which to lter the DNS messages in the specied DNS cache for a query
or deletion.
• rcode
Species the DNS return code on which to lter DNS messages in the specied DNS cache for a query
or deletion.
• slot
Species a slot number on a chassis that contains the specied DNS cache. This is a 1 based index.
• tmm
Species the number of the TMM that contains the specied DNS cache. Each tmm has essentially the
same entries, so which tmm you choose is arbitrary. Use this option only for debugging. This is a 0
based index. If not specied, a random tmm will be used.
See Also
delete, show, tmsh
nameserver
Manages the nameserver records in the DNS cache resolvers on the BIG-IP(r) system.
Syntax
Congure the nameserver component within the ltm dns cache records
Display
show cache [cache name]
address [ip address]
count-only
has-edns [yes | no]
has-lame [yes | no]
rtt-range [min:max]
slot [integer]
tmm [integer]
ttl-range [min:max]
zone-name [name]
Delete
delete cache [cache name]
address [ip address]
has-edns [yes | no]
has-lame [yes | no]
rtt-range [min:max]
ttl-range [min:max]
zone-name [name]
835
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the nameserver component to display or delete nameserver records from a DNS cache. The
maximum number of records returned is 1000; therefore, broad searches may not show all records in the
cache.
Examples
show cache my_cache zone-name com ttl-range 50:500
Displays the nameserver records, in the DNS cache named my_cache, with the zone name com, where the
TTLs of the records are between 50 and 500.
Options
• address
Species the nameserver records, in the specied DNS cache, to select based on the IP address of the
nameserver.
• cache name
Species a DNS cache name. This is a required eld.
• count-only
For a show command, return only a count of the matched records.
• has-edns
Species the nameserver records to select from the specied DNS cache, based on whether the nameserver
is EDNS lame. An EDNS lame nameserver does not reply to EDNS queries.
• has-lame
Species the nameserver records to select from the specied DNS cache, based on whether the nameserver
is lame for one or more items.
• rtt-range
Species the nameserver records to select from the specied DNS cache, based on RTTs within the
specied range (inclusive). A missing value (:500 or 50:) defaults to the minimum or maximum,
respectively.
• slot
Species a slot number on a chassis that contains the specied DNS cache. This is a 1 based index.
• tmm
Species the number of the TMM that contains the specied DNS cache. Each tmm has essentially the
same entries, so which tmm you choose is arbitrary. Use this option only for debugging. This is a 0
based index. If not specied, a random tmm will be used.
• ttl-range
Species the nameserver records to select from the specied DNS cache, based on TTLs within the
specied range (inclusive). A missing value (:500 or 50:) defaults to the minimum or maximum,
respectively.
• zone-name
Species the nameserver records to select from the specied DNS cache, based on the specied zone
name.
See Also
delete, show, tmsh
836
LTM DNS Cache Records
rrset
Manages the RRset records in the DNS cache resolvers on the BIG-IP(r) system.
Syntax
Congure the rrset component within the ltm dns cache records module using the syntax in the following
sections.
Display
show cache [cache name]
class [IN | CH | HS| ANY]
count-only
owner [DNS name]
slot [integer]
tmm [integer]
ttl-range [integer:integer]
type [A | AAAA | CNAME | NS | PTR | RRSIG | DNSKEY | SOA | TXT | ANY |
... ]
Delete
delete cache [cache name]
class [IN | CH | HS| ANY]
owner [DNS name]
ttl-range [integer:integer]
type [A | AAAA | CNAME | NS | PTR | RRSIG | DNSKEY | SOA | TXT | ANY |
... ]
Description
You can use the rrset component to display or delete records in the specied DNS cache. The maximum
number of records returned is 1000. Broad searches might not show all records in the cache.
Examples
show cache resCache2 class IN type A ttl-range 20:5000 owner .com
Displays RRset records of type A, class IN, with TTLs between 20 and 5000, and an owner of .com.
Options
• cache name
Species a DNS cache name. This is a required eld.
• class
Species the class of RRset records to select from the specied DNS cache.
• count-only
For a show command, return only a count of the matched records.
• owner
Species the node on which to lter the RRset records in the specied DNS cache for a query or deletion.
837
Traffic Management Shell (tmsh) Reference Guide
• slot
Species a slot number on a chassis that contains the specied DNS cache. This is a 1 based index.
• tmm
Species the number of the TMM that contains the specied DNS cache. Each tmm has essentially the
same entries, so which tmm you choose is arbitrary. Use this option only for debugging. This is a 0
based index. If not specied, a random tmm will be used.
• ttl-range
Species the RRset records to select from the specied DNS cache, based on TTLs within the specied
range (inclusive). A missing value (:500 or 50:) defaults to the minimum or maximum, respectively.
• type
Species the RRset records to select from the specied DNS cache, based on the specied type. Most
record types are supported.
See Also
show, delete, tmsh
838
LTM DNS Cache Records
LTM DNS DNSsec
generation
Congures a generation on the BIG-IP(r) system.
Syntax
Congure the generation component within the ltm dns dnssec module using the syntax in the following
sections.
Create/Modify
modify generation [name]
app-service [[string] | none]
expiration [date and time]
rollover [date and time]
edit generation [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list generation
list generation [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
pub-text
show generation
show generation [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Delete
delete generation [name]
Description
You can use the generation component to congure a generation.
Examples
list generation myrstgen
Displays the properties of the generation named myrstgen.
show generation myrstgen
Displays the status of the generation named myrstgen.
Options
• app-service
Species the name of the application service to which this generation belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this generation. Only the application service can modify or delete this generation.
• expiration
Species the date and time that this generation expires.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• pub-text
Displays public text generated by the system.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rollover
Species the date and time that this generation rolls over to a new generation.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
key
Congures DNSSEC keys on the BIG-IP(r) system.
Syntax
Congure the key component within the ltm dns dnssec module using the syntax in the following sections.
Create/Modify
create key [name]
modify key [name]
algorithm [ rsasha1 | rsasha256 | rsasha512 ]
app-service [[string] | none]
bitwidth [ 512 | 1024 | 2048 | 4096 ]
certificate-file [string]
description [string]
840
LTM DNS DNSsec
[enabled | disabled]
expiration-period [integer]
key-file [string]
key-type [ksk | zsk]
rollover-period [integer]
signature-pub-period [integer]
signature-valid-period [integer]
ttl [integer]
use-fips [external | internal | none]
edit key [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list key
list key [ [ [name] | [glob] | [regex] ] ... ]
all-properties
generation
non-default-properties
one-line
Delete
delete key [name]
Description
You can use the key component to congure DNSSEC zone signing and key signing keys, and to view
information about the keys.
Examples
create key ksk1
Creates the key signing key, ksk1, using the system default values.
create key zsk1
Creates the zone signing key, zsk1, using the system default values.
list key my_key
Displays the properties of the DNS security key my_key.
Options
• algorithm
Species the algorithm to use to generate the key. The default value is RSASHA1.
• app-service
Species the name of the application service to which the key belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the key. Only the application service can modify or delete the key.
• bitwidth
841
Traffic Management Shell (tmsh) Reference Guide
Species the length of the key you want to generate. The default value is 1024. If a key is manually
managed, MCPD will derive this value from the le and override any user dened value.
• certicate-le
Species the le containing the public key. Fields certicate-le and key-le are required for manual
DNSSEC key import.
• description
User dened description.
• [enabled | disabled]
Species whether the key is enabled or disabled.
• expiration-period
Species the life of the key in d:h:m:s, h:m:s, m:s, or seconds. At the end of the period, the system
deletes the expired generation of the key. This value must be greater than the value of the rollover-period
option. The difference between the two periods must be more than the value of the ttl option.
The default value is 0 (zero), which indicates unset, and thus the key does not expire.
• generation
Displays the generation of the key, including the following:
• creator
Hostname of BIG-IP system that created this generation.
• expiration
The date and time that this generation of the key expires.
• handle
The handle of a generation of a key that is used for interacting with the key subsystem (for example,
HSM for FIPS).
• key-tag
The hash identier of the DNSKEY.
• pub-text
The text of the randomly-generated public key.
• rollover
The date and time that this generation of the key rolls over to a new key.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• key-le
Species the le containing the private key. Fields certicate-le and key-le are required for manual
DNSSEC key import.
• key-type
Species whether the key is of type ksk or zsk. The default value is zsk.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
842
LTM DNS DNSsec
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rollover-period
Species the amount of time, in d:h:m:s, h:m:s, m:s, or seconds, before the system generates another
generation of the key. At the end of the period, the system creates a new generation of the key. Two
generations of the key exist during the time between the end of the rollover period and the end of the
expiration period.
This value must be greater than or equal to one third of the value of the expiration-period option, and
less than the value of the expiration period option. The difference between the two periods must be
must be more than the value of the ttl option.
The default value is 0 (zero), which indicates unset, and thus the key does not roll over.
• signature-pub-period
Species the amount of time, in d:h:m:s, h:m:s, m:s, or seconds, before the system publishes another
generation of the signature. At the end of the period, the system creates a new signature.
This value must be less than the value of the signature-valid-period option. The default value is 403200
seconds.
• signature-valid-period
Species the amount of time, in d:h:m:s, h:m:s, m:s, or seconds, that the signature is valid. At the end
of the period, the Global Trafc Manager no longer uses the expired signature. The default value is
604800 seconds.
• ttl
Species the amount of time, in d:h:m:s, h:m:s, m:s, or seconds, that a DNS server can cache the key.
The default value is 86400.
The value of the ttl option must be less than the difference between the values of the rollover-period
and expiration-period options.
0 seconds indicates that the key is not cached.
• use-ps
Species the type of FIPS-compliant hardware security module to use when storing, and signing with,
the private key. The default value is none. The choice of external attempts to use a network-attached
FIPS device if congured; otherwise internal uses the FIPS device within the BIG-IP.
If this option is set to internal or external and a FIPS device is not present, the system automatically
resets the value to none.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
zone
Congures DNSSEC zones on the BIG-IP(r) system.
Syntax
Congure the zone component within the ltm dns dnssec module using the syntax in the following sections.
843
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create zone [name]
modify zone [name]
app-service [[string] | none]
description [string]
[enabled | disabled]
ds-algorithm [ SHA1 | SHA256 ]
keys
[add | delete | modify | replace-all-with] {
[key name ...]
}
keys none
nsec3-algorithm [ SHA1 ]
nsec3-iterations [unsigned integer]
edit zone [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats zone
reset-stats zone [ [ [name] | [glob] | [regex] ] ... ]
Display
list zone
list zone [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
seps
show zone [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
field-fmt
Delete
delete zone [name]
Description
You can use the zone component to congure and view information about a DNSSEC zone.
Examples
list zone mySecureZone
Displays the properties of the DNSSEC zone named mySecureZone.
Options
• app-service
844
LTM DNS DNSsec
Species the name of the application service to which the zone belongs. The default value is none. Note:
If the strict-updates option is enabled on the application service that owns the object, you cannot modify
or delete the zone. Only the application service can modify or delete the zone.
• description
User dened description.
• ds-algorithm
Species the hash algorithm to use when creating the Delegation Signer (DS) resource record. The
default value is SHA1.
• [enabled | disabled]
Species whether the DNSSEC zone is enabled or disabled.
Note: You must associate both a key signing and a zone signing key with the zone before complete
signing of client requests can occur.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• keys
Species the keys that you want to congure for the zone.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nsec3-algorithm
Species the hash algorithm to use when creating the Next Secure (NSEC3) resource record. The default
value is SHA1. Other algorithms are not currently supported, so selecting SHA256 will revert to SHA1
with a warning message.
• nsec3-iterations
Species the number of times to hash the Next Secure (NSEC3) names. The default value is 1."
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• seps
Displays the Secure Entry Point(s) (DS and DNSKEY resource records used as client trust anchors) of
the zone, including the following:
• dnskey
String representation of the DNSKEY resource record.
• ds
String representation of the DS resource record.
• generation-id
ID of DNSSEC Key Generation used to create the SEP.
• key-name
Name of DNSSEC Key which was used to create the SEP.
845
Traffic Management Shell (tmsh) Reference Guide
• xfr-primary-soa-serial
The learned zone SOA serial number from the primary server.
• xfr-soa-serial
The advertised zone SOA serial number to all clients.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
846
LTM DNS DNSsec
LTM Global Settings
connection
Congures the global settings that pertain to connections for the BIG-IP(r) and VIPRION(r) local trafc
management systems.
Syntax
Congure the connection component within the ltm global-settings module using the syntax shown in the
following sections.
Modify
modify connection
adaptive-reaper-hiwater [integer]
adaptive-reaper-lowater [integer]
auto-last-hop [disabled | enabled]
global-flow-eviction-policy [name]
syncookies-threshold [integer]
vlan-keyed-conn [disabled | enabled]
Display
list connection
list connection [option name]
show running-config connection
show running-config connection [option name]
all-properties
non-default-properties
one-line
Description
You can use the connection component to modify how the system processes connections.
Examples
• modify connection auto-last-hop disabled
Species that the system does not automatically map the last hop for pools.
• list connection
Displays the global settings for how the system processes connections.
Options
• adaptive-reaper-hiwater
*IMPORTANT* This command has been deprecated (as of 11.6.0). Please use ltm eviction-policy
instead. Species, in a percentage, the memory usage at which the system stops establishing new
connections. Once the system meets the reaper high-water mark, the system does not establish new
connections until the memory usage drops below the reaper low-water mark. The adaptive reaper settings
help mitigate the effects of a denial-of-service attack.
The available range is 85 - 100. The default value is 95. To disable the adaptive reaper, set the high-water
mark to 100.
• adaptive-reaper-lowater
*IMPORTANT* This command has been deprecated (as of 11.6.0). Please use ltm eviction-policy
instead. Species, in percent, the memory usage at which the system silently purges stale connections,
without sending reset packets (RST) to the client. If the memory usage remains above the low-water
mark after the purge, then the system starts purging established connections closest to their service
timeout.
The available range is 70 - 100. The default value is 85. To disable the adaptive reaper, set the low-water
mark to 100.
• auto-last-hop
Species that the system automatically maps the last hop for pools. The default value is enabled.
• global-ow-eviction-policy
Species the ow eviction policy to use when approaching memory usage limits. The settings in the
policy determine the adaptive reaper high and low water marks, and help determine which client
connections to terminate when memory limits have exceeded the "low-water" threshold in the eviction
policy. The settings help mitigate the effects of a denial-of-service attack.
• syncookies-threshold
Species the number of new or untrusted TCP connections that can be established before the system
activates the SYN Cookies authentication method for subsequent TCP connections. The default value
is 16384.
• vlan-keyed-conn
Enables or disables VLAN-keyed connections. You use VLAN-keyed connections when trafc for the
same connection must pass through the system several times, on multiple pairs of VLANs (or in different
VLAN groups). The default value is enabled.
See Also
list, ltm node, modify, show, tmsh
general
Congures the general properties for the BIG-IP(r) and VIPRION(r) local trafc management systems.
Syntax
Congure the general component within the ltm global-settings module using the syntax shown in the
following sections.
Modify
modify general
gratuitous-arp-rate [integer value: 0 ~ 2147483647]
l2-cache-timeout [ integer value: 0 ~ 2147483647]
848
LTM Global Settings
maintenance-mode [disabled | enabled]
share-single-mac [unique | global | vmw-compat]
snat-packet-forward [ disabled | enabled]
Display
list general
list general [option name]
show running-config general
show running-config general [option name]
all-properties
non-default-properties
one-line
Description
You can use the general component to modify how the system processes local trafc.
Examples
• modify general maintenance-mode enabled
Places the Local Trafc Manager system in maintenance mode.
• list general
Displays the general properties of the local trafc management system.
Options
• gratuitous-arp-rate
Species how fast gratuitous ARPs can be sent. If it is 0, then gratuitous ARPs are sent without pause.
Otherwise, it species how many gratuitous ARPs can be sent every second. The default value is 0. The
range is 0 (zero) to 2147483647."
• l2-cache-timeout
Species, in seconds, the amount of time that records remain in the Layer 2 forwarding table, when the
MAC address of the record is no longer detected on the network.
The default value is 300 seconds. The range is 0 (zero) to 2147483647 seconds.
• maintenance-mode
Species, when enabled, that the unit is in maintenance mode. In maintenance mode, the system stops
accepting new connections and slowly nishes off existing connections.
The default value is disabled.
• share-single-mac
Species the Media Access Control address (MAC address) that the system assigns to a VLAN. The
default value is unique, which indicates that a VLAN uses a unique MAC address from the pool of mac
addresses assigned to each hardware platform. The global value indicates that all of the VLANs on the
system use the same MAC address. The vmw-compat value indicates that the MAC address of a vlan
is allocated in a manner compatible with VMware(tm) vSwitch, and restricts vlans to a single interface,
with no trunks allowed. Changing the value of this feature requires a manual restart of all TMOS daemons.
• snat-packet-forward
Enables or disables SNAT packet forwarding. The default value is enabled.
849
Traffic Management Shell (tmsh) Reference Guide
See Also
list, ltm node, modify, show, tmsh
traffic-control
Congures the global settings that pertain to trafc control for the BIG-IP(r) and VIPRION(r) local trafc
management systems.
Syntax
Congure the trafc-control component within the ltm global-settings module using the syntax shown
in the following sections.
Modify
modify traffic-control
accept-ip-options [disabled | enabled]
accept-ip-source-route [disabled | enabled]
allow-ip-source-route [ disabled | enabled]
continue-matching [ disabled | enabled]
max-icmp-rate [integer value: 0 ~ 2147483647]
max-reject-rate [ integer value: 1 ~ 1000]
min-path-mtu [ integer value: 68 ~ 1500]
path-mtu-discovery [disabled | enabled]
port-find-linear [ integer value: 0 ~ 61439]
port-find-random [ integer value: 0 ~ 1024]
port-find-threshold-warning [disabled | enabled]
port-find-threshold-trigger [integer value: 1 ~ 12]
port-find-threshold-timeout [integer value: 0 ~ 300]
reject-unmatched [ disabled | enabled]
Display
list traffic-control
list traffic-control [option name]
show running-config traffic-control
show running-config traffic-control [option name]
all-properties
non-default-properties
one-line
Description
You can use the trafc-control component to modify how the system processes local trafc.
Examples
• modify trafc-control accept-ip-options enabled
Species that the system accepts IPv4 packets with IP options.
• list trafc-control
Displays the local trafc control global settings.
850
LTM Global Settings
Options
• accept-ip-options
Species whether the system accepts IPv4 packets with IP options. The default value is disabled.
• accept-ip-source-route
Species whether the system accepts IPv4 packets with IP source route options that are destined for
Trafc Management Microkernel (TMM). The default value is disabled.
To enable this option, you must also enable the accept-ip-options option.
• allow-ip-source-route
Species whether the system allows IPv4 packets with IP source route options enabled to be routed
through Trafc Management Microkernel (TMM). The default value is disabled.
To enable this option, you must also enable the accept-ip-options option.
• continue-matching
Species whether the system matches against a less-specic virtual server when the more-specic one
is disabled. When continue-matching is disabled, the default value, the system drops connections that
request a disabled virtual server. In this case, the system rejects or drops packets depending on the value
of the reject-unmatched option.
• max-icmp-rate
Species the maximum rate per second at which the system issues Internet Control Message Protocol
(ICMP) errors. The default value is 100 errors per second. The range is from 0 (zero) to 2147483647
errors per second. This option is useful for preventing ICMP-message storms.
• max-reject-rate
Species the maximum rate per second at which the system issues reject packets (TCP RST or ICMP
port unreach). The default value is 250 per second. The range is from 1 to 1000 per second.
• min-path-mtu
Species the minimum packet size that can traverse the path without suffering fragmentation, also known
as path Maximum Transmission Unit(MTU). The default value is 296. The range is from 68 to 1500.
• path-mtu-discovery
Species, when enabled, that the system discovers the maximum transmission unit (MTU) that it can
send over a path, without fragmenting TCP packets. The default value is enabled.
• port-nd-linear
Species the maximum of ports to linearly search for outbound connections. The default value is 16.
The range is from 0 to 61439.
• port-nd-random
Species the maximum of ports to randomly search for outbound connections. The default value is 16.
The range is from 0 to 1024.
• port-nd-threshold-warning
Species if the ephemeral port-exhaustion threshold warning is to be monitored. The default is enabled.
• port-nd-threshold-trigger
Species the threshold warning's trigger which is the value of random port attempts when attempting
to nd an unused outbound port for a connection. The default is 8. The valid range is 1 - 12.
• port-nd-threshold-timeout
Species the threshold warning's timeout. This is the time in seconds since the last trigger value was hit
and will drop the tuple if not hit. The default is 30 (1/2 minute) with range from 0 - 300.
851
Traffic Management Shell (tmsh) Reference Guide
• reject-unmatched
Species, when enabled, that the system returns a TCP RESET or ICMP_UNREACH packet if no virtual
servers on the system match the destination address of the incoming packet. When this option is disabled,
the system silently drops the unmatched packet. The default value is enabled.
See Also
list, ltm node, modify, show, tmsh
852
LTM Global Settings
LTM Message Routing Diameter
peer
Congures a peer for routing Diameter protocol messages.
Syntax
Congure the peer component within the ltm message-routing diameter module using the syntax shown
in the following sections.
Create/Modify
create peer [name]
modify peer [name]
app-service [[string] | none]
connection-mode [ per-peer | per-blade | per-tmm | per-client ]
description [string]
number-connections [integer]
pool [name]
ratio [integer]
transport-config [ transport-config ]
edit peer [ [ [name] | [glob] | [regex] ] ... ]
all-properties
Display
list peer
list peer [ [ [name] | [glob] | [regex] ] ... ]
all-properties
one-line
Delete
delete peer [name]
Description
You can use the peer component to manage a named Diameter peer. A peer species the pool for the
Diameter router to use as the destination for Diameter routes. You can also use the peer component to
specify how many connections the parser creates to a remote host and what transport the parser uses to
establish the connection.
Examples
create peer my_peer { pool my_pool transport { type virtual name my_vip }
Creates a Diameter peer named my_peer which uses the settings of my_vip to establish a connection with
a pool member from pool my_pool.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• connection-mode
Species how the number of connections per host is limited. Note a host (specied in the referred pool)
may exist more than one peer object, and those peer objects may have different settings for
connection-mode and number_connections. Thus, these settings specify how messages routed through
this peer are distributed between a set of connections, not the maximum number of connections to a
specied host. The default value is per-peer.
• per-blade
Species the number of connections to a remote host per blade in the cluster.
• per-client
Species the number of connections to a remote host per client connection.
• per-peer
Species the number of connections to a remote host.
• per-tmm
Species the number of connections to a remote host per TMM in the system.
• description
User dened description.
• number-connections
Species the distribution of connections between the BIG-IP system and a remote host. The default
value is 1.
• pool
Species the name of the pool to which the Diameter parser routes messages.
• ratio
Species the ratio the Diameter router uses to select a peer from a list of peers for the ltm
message-routing diameter route. The default value is 1.
• transport-cong
Species the name of the transport conguration (ltm message-routing diameter transport-cong) the
message router uses to create an outgoing connection.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, tmsh, ltm message-routing diameter route ltm
message-routing diameter prole session
854
LTM Message Routing Diameter
route
Congures a static route for use in Diameter protocol message routing.
Syntax
Congure the route component within the ltm message-routing diameter module using the syntax shown
in the following sections.
Create/Modify
create route [name]
modify route [name]
app-service [[string] | none]
application-id [integer]
description [string]
destination-realm [[string] | none]
origin-realm [[string] | none]
peer-selection-mode [ratio | sequential]
peers { [none | [peer_name ... ] }
virtual-server [virtual-server_name]
edit route [ [ [name] | [glob] | [regex] ] ... ]
all-properties
Display
list route
list route [ [ [name] | [glob] | [regex] ] ... ]
show running-config route
show running-config route [ [ [name] | [glob] | [regex] ] ... ]
all-properties
one-line
Delete
delete route [name]
Description
You can use the route component to dene origin and destination realms, virtual server, peers, and peer
selection mode of a message routing Diameter static route.
Examples
create route my_route
Creates a route instance named my_route using the system defaults.
create route my_route peers { peer1 peer2 }
Creates a route instance named my_route that will use two peers for forwarding messages.
855
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• application-id
Species the application-id to match in the Diameter message. Default value 0 matches every
application-id.
• description
User dened description.
• destination-realm
When specied, match the Destination-Realm AVP value in the message. Default value of "" species
all destination-realms may be routed.
• origin-realm
When specied, match the Origin-Realm AVP value in the message. Default value of "" species all
origin-realms may be routed.
• peer-selection-mode
Species the mode of selecting a peer from a list of peers. The options are:
• ratio
Peers are selected based on their weights in comparison with other peers.
• sequential
Peers are selected in the order listed. All trafc will route the rst peer unless all pool members in
the peer are marked down.
• peers
Species an ordered list of peers to use for forwarding messages.
• virtual-server
Restricts routing for this route to connections originating on the specied virtual server. The default
value is none which means the route is not restricted and messages originating on any connection may
be routed to the route.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, show, tmsh, ltm message-routing diameter route
transport-config
Congures a Diameter transport-cong instance for routing Diameter message protocol messages.
Syntax
Congure the transport-cong component within the ltm message-routing diameter module using the
syntax shown in the following sections.
856
LTM Message Routing Diameter
Create/Modify
create transport-config [name]
modify transport-config [name]
app-service [[string] | none]
description [string]
source-port [integer]
profiles [add | delete | replace-all-with] {
[profile_name ...] {
context [all | clientside | serverside] read-only attribute for
v12.0.0 or greater.
}
}
rules { [none | [rule_name ... ] }
source-address-translation {
pool [ [pool_name] | none]
type [ automap | snat | none ]
}
edit transport-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list transport-config
list transport-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete transport-config [name]
Description
You can use the transport-cong component to dene the proles, rules, and source-address-translation
of an outgoing connection.
Examples
create transport-cong my_transport-cong
Creates a transport-cong instance named my_transport-cong using the system defaults.
create transport-cong my_transport-cong { proles add { my_diameter my_tcp } }
Creates a transport-cong instance named my_transport-cong that will use two proles, my_diameter
and my_tcp, to create and congure an outgoing connection. The outgoing connection is automatically
congured with the router instance that created the connection.
Options
• app-service
857
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• proles
Species a list of proles that the outgoing connection uses to use to direct and manage trafc. The
default value is none.
• rules
Species a list of iRules, separated by spaces, that customize the transport conguration to direct and
manage trafc. The default value is none.
• source-address-translation
Species the type of source address translation enabled for the transport conguration, as well as the
pool that the source address translation uses.
• pool
Species the name of a SNAT pool used by the specied transport conguration.
• type
Species the type of source address translation associated with the specied transport conguration.
The options are:
• automap
Species the use of self IP addresses for transport conguration server source address translation.
• none
Species no source address translation is used by the transport conguration.
• snat
Species the use of a SNAT pool of translation addresses for virtual server source address
translation.
• source-port
Species the source port to be used for the connection being created. If no value is specied an ephemeral
port is chosen. The default value is 0.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, tmsh, ltm message-routing diameter route
858
LTM Message Routing Diameter
LTM Message Routing Diameter Profile
router
Congures a Diameter Router prole.
Syntax
Congure the router component within the ltm message-routing diameter prole module using the syntax
shown in the following sections.
Create/Modify
create router [name]
modify router [name]
app-service [[string] | none]
defaults-from [[name] | none]
description [string]
max-pending-bytes [integer]
max-pending-messages [integer]
routes [add | default | delete | none | replace-all-with] {
[route_name] ...
}
transaction-timeout [integer]
use-local-connection [disabled | enabled]
edit router [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats router
reset-stats router [ [ [name] | [glob] | [regex] ] ... ]
Display
list router
list router [ [ [name] | [glob] | [regex] ] ... ]
show running-config router
show running-config router [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show router
show router [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete router [name]
Description
You can use the router component to manage a Diameter router prole.
Examples
create router my_router_prole defaults-from router
Creates a Diameter router prole named my_router_prole using the system defaults.
create router my_router_prole routes add { route1 route2 }
Creates a Diameter prole named my_router_prole with two static routes.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is router.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• max-pending-bytes
Species the maximum number of bytes contained within pending messages that will be held while
waiting for a connection to a peer to be created. Once reached any additional messages to the peer will
be agged as undeliverable and returned to the originator.
• max-pending-messages
Species the maximum number of pending messages that will be held while waiting for a connection
to a peer to be created. Once reached any additional messages to the peer will be agged as undeliverable
and returned to the originator.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
860
LTM Message Routing Diameter Profile
• routes
Species a list of static routes. The ordering of the route entries is insignicant.
• transaction-timeout
Species the maximum time (in seconds) between a request and its response. A provisional response
restarts the timer. The default value is 10 seconds. Note: This may not affect all transactions. The
scenarios where the system waits for response (eg. a nal response for REGISTER request), are impacted
by dropping any persistent data maintained for the request.
• use-local-connection
Enables or disables a preference for local connections established by the ingress TMM over connections
established by other TMM's when selecting the egress connection to destination peer. By default this
attribute is enabled.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
session
Congures a Diameter Session prole.
Syntax
Congure the session component within the ltm message-routing diameter prole module using the
syntax shown in the following sections.
Create/Modify
create session [name]
modify session [name]
acct-application-id [integer]
app-service [[string] | none]
auth-application-id [integer]
defaults-from [[name] | none]
description [string]
dest-host-rewrite [string]
dest-realm-rewrite [string]
handshake-timeout [integer]
max-message-size [integer]
max-watchdog-failures [integer]
origin-host [string]
origin-host-rewrite [string]
origin-realm [string]
origin-realm-rewrite [string]
persist-avp [string]
persist-timeout [integer]
persist-type [avp | custom | none]
product-name [string]
reset-on-timeout [disabled | enabled]
vendor-id [integer]
watchdog-timeout [integer]
edit session [ [ [name] | [glob] | [regex] ] ... ]
861
Traffic Management Shell (tmsh) Reference Guide
all-properties
non-default-properties
reset-stats session
reset-stats session [ [ [name] | [glob] | [regex] ] ... ]
Display
list session
list session [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show running-config session
show running-config session [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show session
show session [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete session [name]
Description
You can use the session component to manage a Diameter session prole.
Examples
create session my_session_prole defaults-from session
Creates a Diameter session prole named my_session_prole using the system defaults.
create session my_session_prole { reset-on-timeout disabled }
Creates a Diameter prole named my_session_prole that will not reset the connection when watchdog
failure exceed maximum-watchdog-failures.
Options
• acct-application-id
Species the Accounting identier for a specic application, as specied in RFC 3588.
• app-service
862
LTM Message Routing Diameter Profile
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auth-application-id
Species the Authentication and Authorization identier for a specic application, as specied in RFC
3588.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is diametersession.
• description
User dened description.
• dest-host-rewrite
Species the destination host AVP to which the specied value on the egress will be rewritten.
• dest-realm-rewrite
Species the destination realm AVP to which the specied value on the egress will be rewritten.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• handshake-timeout
Species the number of seconds before the peer handshake times out. The default is 10 seconds.
• max-message-size
Species the maximum number of bytes acceptable in a Diameter message. The default value is 0 which
indicates that there is no message size restriction for this session. Note: Messages exceeding this size
are silently discarded.
• max-watchdog-failures
Species the maximum number of device watchdog failures that the trafc management system can
take before it tears down the connection. After the system receives this number of device watchdog
failures, it closes the connection. The default value is 10.
• origin-host
Species the identier of the originating server in the form siteserver.f5.com. Must specify the
origin-host.
• origin-host-rewrite
Species the value to rewrite to the Origin-Host AVP on egress.
• origin-realm
Species the Origin-Realm AVP data. Must specify the origin-realm.
• origin-realm-rewrite
Species the value to rewrite to the Origin-Realm AVP on egress.
• persist-avp
Species the Diameter AVP that is used for persistence. The format is avp[index] for a single AVP or
a[x]:b[y]:c[z]:d[w] for a grouped AVP. There may be at most 4 AVPs in a group. The AVP name is
used as the session-key; it may be an ASCII string or numeric ID in the range 1 to 4294967295 (AVP
code can be specied instead of AVP name). Note: The default value is "SESSION-ID[0]". A grouped-avp
can be specied with the following syntax:
863
Traffic Management Shell (tmsh) Reference Guide
grouped-avp-name[index]:nested-avp1[index1]:nested-avp2[index2], where "nested-avp1" and
"nested-avp2" are the AVPs in the grouped AVP.
• persist-timeout
Species the timeout value (in seconds) for persistence entries. The default value is 180. Note: Its
recommended to have the persist-timeout to be greater than transaction timeout, specied in the Diameter
router conguration, as the lesser of the two is used when creating the persist record on receiving of the
rst Diameter request message. Upon receiving of the response for the rst Diameter request message
the persistence record is updated with the persist-timeout value. For any subsequent responses received
the persist timeout is updated for the persist record.
• persist-type Species the type of the persistence. The options are:
• avp
Persist based on avp in the message.
• custom
Persist based on a custom key set using iRule.
• none
Persistence is disabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-on-timeout
When enabled, the system resets the connection when the number of watchdog failures exceeds the
value of max-watchdog-failures. The default value is enabled.
• vendor-id
Species the vendor identication number assigned to your diameter server by the Internet Assigned
Numbers Authority (IANA). The default value is 0.
• watchdog-timeout
Species the watchdog timeout in seconds. This setting species the number of seconds that a connection
is idle before the device watchdog request is sent. The default value is 0, which means BIG-IP will not
send a device watchdog request to either client or server side.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
864
LTM Message Routing Diameter Profile
LTM Message Routing Generic
peer
Congures a peer for routing generic message protocol messages.
Syntax
Congure the peer component within the ltm message-routing generic module using the syntax shown
in the following sections.
Create/Modify
create peer [name]
modify peer [name]
connection-mode [ per-peer | per-blade | per-tmm | per-client ]
description [string]
number-connections [integer]
pool [name]
ratio [integer]
transport-config [ transport-config ]
edit peer [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list peer
list peer [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete peer [name]
Description
You can use the peer component to manage a named generic message peer. A peer species the pool for
the generic message parser to use as the destination for generic message routes. You can also use the peer
component to specify how many connections the parser creates to a remote host and what transport the
parser uses to establish the connection.
Examples
create peer my_peer { pool my_pool transport { type virtual name my_vip } }
Creates a generic message peer named my_peer which uses the settings of my_vip to establish a connection
with a pool member from pool my_pool.
Options
• connection-mode
Species how the number of connections per host is limited. Note a host (specied in the referred pool)
may exist more than one peer object, and those peer objects may have different settings for
connection-mode and number_connections. Thus, these settings specify how messages are routed
through this peer are distributed between a set of connections, not the maximum number of connections
to a specied host. The default value is per-peer.
• per-peer
Species the number of connections to a remote host.
• per-blade
Species the number of connections to a remote host per blade in the cluster.
• per-tmm
Species the number of connections to a remote host per TMM in the system.
• per-client
Species the number of connections to a remote host per client connection.
• description
User dened description.
• number-connections
Species the distribution of connections between the BIG-IP system and a remote host. The default
value is 1.
• pool
Species the name of the pool to which the generic parser routes messages.
• ratio
Species the ratio the generic message parser uses to select a peer from a list of peers for the ltm
message-routing generic route. The default value is 1.
• transport-cong
Species the name of the transport conguration (ltm message-routing generic transport-cong) the
message router uses to create an outgoing connection.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, tmsh, ltm message-routing generic route ltm
message-routing generic protocol
protocol
Congures a generic message protocol component for parsing generic messages.
866
LTM Message Routing Generic
Syntax
Congure the protocol component within the ltm message-routing generic module using the syntax shown
in the following sections.
Create/Modify
create protocol [name]
modify protocol [name]
defaults-from [ [name] | none]
description [string]
disable-parser [ yes | no ]
max-egress-buffer [integer]
max-message-size [integer]
message-terminator [string]
no-response [ yes | no ]
edit protocol [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats protocol
reset-stats protocol [ [ [name] | [glob] | [regex] ] ... ]
Display
list protocol
list protocol [ [ [name] | [glob] | [regex] ] ... ]
show running-config protocol
show running-config protocol [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show protocol
show protocol [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete protocol [name]
Description
You can use the protocol component to implement a named generic message parser for use with the message
routing framework. You can create a protocol component, and then add it to a virtual server. You do this
when you want to separate a stream of bytes, from a connection to a peer, into messages for routing. This
also enables a set of iRule commands to create, populate, and route messages.
867
Traffic Management Shell (tmsh) Reference Guide
Examples
create protocol my_protocol defaults-from genericmsg
Creates a message protocol component named my_protocol using the system defaults.
create protocol my_protocol { welcome-message hello }
Creates a protocol instance named my_protocol that sends a welcome message of "hello" to any new
connection.
Options
• defaults-from
Species the protocol that you want to use as the parent protocol. The new protocol inherits all of the
settings and values from the specied parent protocol. The default value is genericmsg.
• description
User dened description.
• disable-parser
When set to yes, the generic message parser is disabled. The parser ignores all incoming packets and
does not directly send message data. This mode supports iRule script protocol implementations that
generate messages from the incoming transport stream and send messages on the outgoing transport
stream.
• max-egress-buffer
Species the maximum size of the send buffer in bytes. If the number of bytes in the send buffer for a
connection exceeds this value, the generic message parser stops receiving outgoing messages from the
router until the size of the buffer drops below this setting. The default value is 32768.
• max-message-size
Species the maximum size of a received message. If a message exceeds this size, the connection is
reset. The default value is 32768.
• message-terminator
Species the string of characters used to terminate a message. If the message-terminator parameter is
empty, the generic message parser does not separate the input stream into messages. The default value
is \n.
• no-response
When set to yes, matching of responses to requests is disabled. The default value is no.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, ltm message-routing generic
route ltm message-routing generic protocol
route
Congures a static route the generic message parser uses to route generic message protocol messages.
868
LTM Message Routing Generic
Syntax
Congure the route component within the ltm message-routing generic module using the syntax shown
in the following sections.
Create/Modify
create route [name]
modify route [name]
app-service [[string] | none]
description [string]
destination-address [string]
peer-selection-mode [ sequential | ratio ]
peers { [peer-name] }
source-address [string]
edit route [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats route
reset-stats route [ [ [name] | [glob] | [regex] ] ... ]
Display
list route
list route [ [ [name] | [glob] | [regex] ] ... ]
show running-config route
show running-config route [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show route
show route [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete route [name]
Description
You can use the route component to manage a generic message static route.
Examples
create route my_route
869
Traffic Management Shell (tmsh) Reference Guide
Creates a static route named my_route that uses a wildcard value for the source-address and
destination-address parameters. This acts as a default route.
create route my_route { destination-address helpdesk peers add { peer1 peer2 }
Creates a static route named my_route that contains two peers, peer1 and peer2. Messages routed with a
destination-address of helpdesk are routed to a pool member contained in peer1 or peer2, based on the
specied peer-selection-mode.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• destination-address
Species the destination address of the route. If this parameter is not present, the generic message parser
considers the destination-address as a wildcard that matches all message destination addresses. The
default value is none.
• description
User dened description.
• peer-selection-mode
Species the method the generic message parser uses to select a peer from the specied list of peers.
The default value is sequential.
• sequential
Species that the generic message parser selects the rst peer in the list of peers. If the protocol
retransmits the message, the generic message parser uses another pool member in the rst peer. If
all pool members in a peer are unavailable, the generic message parser uses the next peer in the list.
• ratio
Species that the generic message parser selects a peer from a list of peers based on the relative ratio
values of each peer. For example if three peers have ratios of 1, 1, and 2, the rst 2 peers have a 25%
(1/4) probability of being selected and the third peer has a 50% (2/4) probability of being selected.
• peers
Species a list of peers.
• source-address
Species the source address of the route. If this parameter is not present, the generic message parser
considers the source-address as a wildcard that matches all message sources addresses. The default
value is none.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, ltm message-routing generic
peer ltm message-routing generic router
router
Congures a message router instance for routing generic message protocol messages.
870
LTM Message Routing Generic
Syntax
Congure the router component within the ltm message-routing generic module using the syntax shown
in the following sections.
Create/Modify
create router [name]
modify router [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
ignore-client-port [ yes | no ]
max-pending-bytes [integer]
max-pending-messages [integer]
routes { [route-name] }
traffic-group [ [name] | none]
use-local-connection [ yes | no ]
edit router [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats router
reset-stats router [ [ [name] | [glob] | [regex] ] ... ]
Display
list router
list router [ [ [name] | [glob] | [regex] ] ... ]
show running-config router
show running-config router [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show router
show router [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete router [name]
Description
You can use the router component to manage a generic message router instance. All virtual servers containing
the same router instance share the same route table and can route messages between peers.
871
Traffic Management Shell (tmsh) Reference Guide
Examples
create router my_router defaults-from messagerouter
Creates a message router instance named my_router using the system defaults.
create router my_router { routes add { route1 route2 } }
Creates a router instance named my_router that contains two static routes, route1 and route2.
Options
• app-service
Species the name of the application service to which the router belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the router. Only the application service can modify or delete the router.
• defaults-from
Species the prole that you want to use as the parent prole. The new prole inherits all of the settings
and values from the specied parent prole. The default value is messagerouter.
• description
User dened description.
• ignore-client-port
If set to yes, the system ignores the remote port on clientside connections (connections where the peer
connected to the BIG IP system) when searching for an existing connection. The default value is no.
• inherited-trafc-group
Read-only property that indicates if the trafc-group is inherited from the parent folder.
• max-pending-bytes
Species the maximum number of bytes of pending messages that the router instance holds while waiting
for a connection to a peer to be created. Once reached, any additional messages to the peer are agged
as undeliverable and returned to the originator. The default value is 32768.
• max-pending-messages
Species the maximum number of pending messages that the router instance holds while waiting for a
connection to a peer to be created. Once reached, any additional messages to the peer are agged as
undeliverable and returned to the originator. The default value is 64.
• trafc-group
Species the trafc group on which the router is active. The default trafc group is inherited from the
containing folder.
• use-local-connection
If true, the router will route a message to an existing connection on the same TMM as the message was
received on. If an existing connection is not found, it will route the message through an existing connection
based on a deterministic algorithm that may be on another TMM. If a matching existing connection is
not found, it will create a connection on the current TMM. Setting this ag may limit the number of
connections that are created to a peer.
• routes
Species a list of static routes for the router instance to use.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, ltm message-routing generic
route ltm message-routing generic protocol
872
LTM Message Routing Generic
transport-config
Congures a message transport-cong instance for routing generic message protocol messages.
Syntax
Congure the transport-cong component within the ltm message-routing generic module using the
syntax shown in the following sections.
Create/Modify
create transport-config [name]
modify transport-config [name]
app-service [[string] | none]
description [string]
source-port [integer]
profiles [add | delete | replace-all-with] {
[profile_name ...] {
context [all | clientside | serverside] read-only attribute for
v12.0.0 or greater.
}
}
rules { [none | [rule_name ... ] }
source-address-translation {
pool [ [pool_name] | none]
type [ automap | snat | none ]
}
edit transport-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list transport-config
list transport-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete transport-config [name]
Description
You can use the transport-cong component to dene the proles, rules, and source-address-translation
of an outgoing connection.
873
Traffic Management Shell (tmsh) Reference Guide
Examples
create transport-cong my_transport-cong
Creates a transport-cong instance named my_transport-cong using the system defaults.
create transport-cong my_transport-cong { proles add { my_genericmsg my_tcp } }
Creates a transport-cong instance named my_transport-cong that will use two proles, my_genericmsg
and my_tcp, to create and congure an outgoing connection. The outgoing connection is automatically
congured with the router instance that created the connection.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• source-port
Species the source port to be used for the connection being created. If no value is specied an ephemeral
port is chosen. The default value is 0.
• proles
Species a list of proles that the outgoing connection uses to direct and manage trafc. The default
value is none.
• rules
Species a list of iRules, separated by spaces, that customize the transport conguration to direct and
manage trafc. The default value is none.
• source-address-translation
Species the type of source address translation enabled for the transport conguration, as well as the
pool that the source address translation uses.
• pool
Species the name of a SNAT pool used by the specied transport conguration.
• type
Species the type of source address translation associated with the specied transport conguration.
The options are:
• automap
Species the use of self IP addresses for transport conguration server source address translation.
• none
Species no source address translation is used by the transport conguration.
• snat
Species the use of a SNAT pool of translation addresses for virtual server source address
translation.
874
LTM Message Routing Generic
LTM Message Routing SIP
peer
Congures a peer for routing SIP message protocol messages.
Syntax
Congure the peer component within the ltm message-routing sip module using the syntax shown in the
following sections.
Create/Modify
create peer [name]
modify peer [name]
app-service [[string] | none]
connection-mode [ per-peer | per-blade | per-tmm | per-client ]
description [string]
number-connections [integer]
pool [name]
ratio [integer]
transport-config [ transport-config ]
edit peer [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list peer
list peer [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete peer [name]
Description
You can use the peer component to manage a named SIP peer. A peer species the pool for the SIP router
to use as the destination for SIP routes. You can also use the peer component to specify how many
connections the parser creates to a remote host and what transport the parser uses to establish the connection.
Examples
create peer my_peer { pool my_pool transport { type virtual name my_vip } }
Creates a SIP peer named my_peer which uses the settings of my_vip to establish a connection with a pool
member from pool my_pool.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• connection-mode
Species how the number of connections per host is limited. Note a host (specied in the referred pool)
may exist more than one peer object, and those peer objects may have different settings for
connection-mode and number_connections. Thus, these settings specify how messages routed through
this peer are distributed between a set of connections, not the maximum number of connections to a
specied host. The default value is per-peer.
• per-peer
Species the number of connections to a remote host.
• per-blade
Species the number of connections to a remote host per blade in the cluster.
• per-tmm
Species the number of connections to a remote host per TMM in the system.
• per-client
Species the number of connections to a remote host per client connection.
• description
User dened description.
• number-connections
Species the distribution of connections between the BIG-IP system and a remote host. The default
value is 1.
• pool
Species the name of the pool to which the SIP parser routes messages.
• ratio
Species the ratio the SIP router uses to select a peer from a list of peers for the ltm message-routing
sip route. The default value is 1.
• transport-cong
Species the name of the transport conguration (ltm message-routing sip transport-cong) the message
router uses to create an outgoing connection.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, tmsh, ltm message-routing sip route ltm
message-routing sip prole session
878
LTM Message Routing SIP
route
Congures a static route for use in Session Initiation Protocol (SIP) message routing.
Syntax
Congure the route component within the ltm message-routing sip module using the syntax shown in the
following sections.
Create/Modify
create route [name]
modify route [name]
app-service [[string] | none]
description [string]
from-uri [string]
peer-selection-mode [ratio | sequential]
peers { [none | [peer_name ... ] }
request-uri [string]
to-uri [string]
virtual-server [virtual-server_name]
edit route [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list route
list route [ [ [name] | [glob] | [regex] ] ... ]
show running-config route
show running-config route [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show route
show route [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete route [name]
Description
You can use the route component to dene the URI's, virtual server, peers and peer selection mode of a
message routing SIP static route.
879
Traffic Management Shell (tmsh) Reference Guide
Examples
create route my_route
Creates a route instance named my_route using the system defaults.
create route my_route peers { peer1 peer2 }
Creates a route instance named my_route that will use two peers for forwarding messages.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• from-uri
Species the patterns to be matched against the From eld of a SIP message. This URI will be matched
as a case insignicant method. It should be in the form of user@domain. The "sip:" prex should
not be present. Any additional modiers (for example port or transport) should also not be present. It
may begin with a wildcard, "*". If empty, it will be treated as if the entire URI was a wildcard (matching
all From-URIs).
• peer-selection-mode
Species the mode of selecting a peer from a list of peers. The options are:
• ratio
Peers are selected based on their weights in comparison with other peers.
• sequential
Peers are selected in the order listed. All trafc will route the rst peer unless all pool members in
the peer are marked down.
• peers
Species an ordered list of peers to use for forwarding messages.
• request-uri
Species the patterns to be matched against the request-uri eld of a SIP message. This URI will be
matched as a case insensitive method. It should be in the form of user@domain. The "sip:" prex
should not be present. Any additional modiers (for example port or transport) should also not be present.
It may begin with a wildcard, * "*". If empty, it will be treated as if the entire URI was a * wildcard
(matching all Request-URIs).
• to-uri
Species the patterns to be matched against the To eld of a SIP message. This URI will be matched
as a case insensitive method. It should be in the form of user@domain. The "sip:" prex should not
be present. Any additional modiers (for example port or transport) should also not be present. It may
begin with a wildcard, "*". If empty, it will be treated as if the entire URI was a wildcard (matching all
To-URIs).
• virtual-server
Species the virtual server on which connections will be routed to this route. If the virtual server is
unset, messages originating on any connection may be routed to the route.
880
LTM Message Routing SIP
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, show, tmsh, ltm message-routing sip route
transport-config
Congures a sip transport-cong instance for routing sip message protocol messages.
Syntax
Congure the transport-cong component within the ltm message-routing sip module using the syntax
shown in the following sections.
Create/Modify
create transport-config [name]
modify transport-config [name]
app-service [[string] | none]
description [string]
source-port [integer]
profiles [add | delete | replace-all-with] {
[profile_name ...] {
context [all | clientside | serverside] read-only attribute for
v12.0.0 or greater.
}
}
rules { [none | [rule_name ... ] }
source-address-translation {
pool [ [pool_name] | none]
type [ automap | snat | none ]
}
edit transport-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list transport-config
list transport-config [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete transport-config [name]
881
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the transport-cong component to dene the proles, rules, and source-address-translation
of an outgoing connection.
Examples
create transport-cong my_transport-cong
Creates a transport-cong instance named my_transport-cong using the system defaults.
create transport-cong my_transport-cong { proles add { my_sipmsg my_tcp } }
Creates a transport-cong instance named my_transport-cong that will use two proles, my_sipmsg and
my_tcp, to create and congure an outgoing connection. The outgoing connection is automatically congured
with the router instance that created the connection.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• source-port
Species the source port to be used for the connection being created. If no value is specied an ephemeral
port is chosen. The default value is 0.
• proles
Species a list of proles that the outgoing connection uses to use to direct and manage trafc. The
default value is none.
• rules
Species a list of iRules, separated by spaces, that customize the transport conguration to direct and
manage trafc. The default value is none.
• source-address-translation
Species the type of source address translation enabled for the transport conguration, as well as the
pool that the source address translation uses.
• pool
Species the name of a SNAT pool used by the specied transport conguration.
• type
Species the type of source address translation associated with the specied transport conguration.
The options are:
• automap
Species the use of self IP addresses for transport conguration server source address translation.
• none
Species no source address translation is used by the transport conguration.
• snat
882
LTM Message Routing SIP
LTM Message Routing SIP Profile
router
Congures a Session Initiation Protocol (SIP) Router prole.
Syntax
Congure the router component within the ltm message-routing sip prole module using the syntax
shown in the following sections.
Create/Modify
create router [name]
modify router [name]
app-service [[string] | none]
defaults-from [[name] | none]
description [string]
max-pending-bytes [integer]
max-pending-messages [integer]
operation-mode [load-balancing]
routes [add | default | delete | none | replace-all-with] {
[route_name] ...
}
session {
transaction-timeout [integer]
}
use-local-connection [disabled | enabled]
edit router [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats router
reset-stats router [ [ [name] | [glob] | [regex] ] ... ]
Display
list router
list router [ [ [name] | [glob] | [regex] ] ... ]
show running-config router
show running-config router [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show router
show router [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete router [name]
Description
You can use the router component to manage a SIP router prole.
Examples
create router my_router_prole defaults-from router
Creates a SIP router prole named my_router_prole using the system defaults.
create router my_router_prole routes add { route1 route2 }
Creates a SIP prole named my_router_prole with two static routes.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is router.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• max-pending-bytes
Species the maximum number of bytes contained within pending messages that will be held while
waiting for a connection to a peer to be created. Once reached any additional messages to the peer will
be agged as undeliverable and returned to the originator.
• max-pending-messages
Species the maximum number of pending messages that will be held while waiting for a connection
to a peer to be created. Once reached any additional messages to the peer will be agged as undeliverable
and returned to the originator.
• operation-mode
886
LTM Message Routing SIP Profile
Species the behavior of the routing instance. The options are:
• load-balancing
Messages will be load balanced.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• routes
Species a list of static routes. The ordering of the route entries is insignicant.
• session.transaction-timeout
Species the maximum time (in seconds) between a request and its response. A provisional response
restarts the timer. This may not affect all transactions. The scenarios where the system waits for response
(eg. a nal response for REGISTER request), are impacted by dropping any persistent data maintained
for the request.
• use-local-connection
Enables or disables a preference for local connections established by the ingress TMM over connections
established by other TMM's when selecting the egress connection to destination peer.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
session
Congures a Session Initiation Protocol (SIP) Session prole.
Syntax
Congure the session component within the ltm message-routing sip prole module using the syntax
shown in the following sections.
Create/Modify
create session [name]
modify session [name]
app-service [[string] | none]
custom-via [[via-header] | none]
defaults-from [[name] | none]
description [string]
do-not-connect-back [disabled | enabled]
generate-response-on-failure [disabled | enabled]
honor-via [disabled | enabled]
insert-record-route-header [disabled | enabled]
insert-via-header [disabled | enabled]
loop-detection [disabled | enabled]
max-forwards-check [disabled | enabled]
887
Traffic Management Shell (tmsh) Reference Guide
max-msg-header-count [integer]
max-msg-header-size [integer]
max-msg-size [integer]
persistence {
persist-key [Call-ID | Custom | Src-Addr]
persist-timeout [integer]
persist-type [session | none]
}
enable-sip-firewall [no | yes]
edit session [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats session
reset-stats session [ [ [name] | [glob] | [regex] ] ... ]
Display
list session
list session [ [ [name] | [glob] | [regex] ] ... ]
show running-config session
show running-config session [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show session
show session [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete session [name]
Description
You can use the session component to manage a SIP session prole.
Examples
create session my_session_prole defaults-from session
Creates a SIP session prole named my_session_prole using the system defaults.
create session my_session_prole { insert-record-route-header enabled }
Creates a SIP prole named my_session_prole with insertion of record-route header in requests which
establish a dialog.
888
LTM Message Routing SIP Profile
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• custom-via Species the value the system uses for the Sent-by eld of the Via header when the Insert
Via Header setting is enabled. Note: The value that you enter must include a format of
SIP/SIP-version/protocol, followed by a Sent-By value. For example, SIP/2.0/TCP
www.siterequest.com:4343 or SIP/2.0/SCTP 10.10.4.32.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is session.
• description
User dened description.
• do-not-connect-back
Enables or disables whether a connection to a request originator is re-established (if it no longer exists)
in order to deliver a response. When disabled, responses that cannot be forwarded using an existing
connection are dropped.
• generate-response-on-failure
Enables or disables sending failure response messages such as 4xx, 5xx and 6xx, when a SIP request is
being dropped. Note: Where it is specied "silently" discarded/dropped, no error response is generated.
In any case, a dropped message (request/response) is tracked by the Messages Dropped Statistic.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• honor-via
Enables or disables honoring any via which is not inserted by the system for routing the response.
• insert-record-route-header
Enables or disables the insertion of a record-route header in requests that establish dialog. When enabled,
along with the URI, the custom parameters may be added to facilitate the routing of subsequent requests
within this call to avoid route lookup. The record route URI is the local-IP and port of ows that are
used for forwarding the message.
• insert-via-header
Enables or disables insertion of top via. When enabled, custom parameters to help route the response
back are inserted, along with sent-by eld of via. The source address:port of the ow forwarding the
request is lled as value for sent-by eld of the via unless a custom via value is specied. The custom
parameters inserted to help routing, helps improve performance as it facilitates routing without any
lookup. The via is inserted at egress side of the ow, after the SIP_REQUEST_SEND event.
• loop-detection
Enables or disables loop-detection checking. When a loop is detected, the request is discarded. An error
response is sent, if congured. A request is detected as seen before (forwarded/spiraled/looped) only if
self inserted via is found in the message and the value of its branch param plays a key role in detecting
loop versus spiral. Hence enabling via insertion becomes a requirement to do loop detection check.
• max-forwards-check
889
Traffic Management Shell (tmsh) Reference Guide
Enables or disables checking on max-forwards. The max-forwards header eld serves to limit the number
of hops a request can transit on the way to its destination. If 0, the request is discarded. An error response
is sent, if congured.
• max-msg-header-count
Indicates the maximum count of expected SIP message header elds. A message that exceeds this limit
is silently discarded.
• max-msg-header-size
Indicates the maximum SIP message header size (in bytes). A message which exceeds this size is silently
discarded.
• max-msg-size
Indicates the maximum number acceptable SIP message size (in bytes). A message which exceeds this
size is silently discarded.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• persistence
Congure the persistence settings.
• persistence.persist-key
Species the method which should be used to extract the key value that is used to persist on. The options
are:
• Call-ID
Persist based on the "Call-ID" header eld value in the message.
• Custom
Persist based on the custom key specied using an iRule.
• Src-Addr
Persist based on originating IP address in the message.
The default option is Call-ID.
• persistence.persist-timeout
Species the timeout value of persistence entries in seconds. Upon receiving of the response for the
initial SIP Request message, the persistence record is updated with the persist-timeout value.
• persistence.persist-type
Species the type of the persistence to be used for the specied "persist-key" attribute value. The options
are:
• session
Persistence is enabled guaranteeing that messages containing a given persistence key will be delivered
to the same peer.
• none
Persistence is disabled.
The default option is session.
• regex
890
LTM Message Routing SIP Profile
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• enable-sip-rewall
Indicates whether to enable the Application Firewall Security policy. When enabled, the congured
AFM security features will apply to the virtual server(s) using this SIP session prole.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
891
Traffic Management Shell (tmsh) Reference Guide
LTM Monitor
diameter
Congures a monitor for Diameter protocol resources.
Syntax
Congure the diameter component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create diameter [name]
modify diameter [name]
acct-application-id [ [integer] | none ]
app-service [[string] | none]
auth-application-id [ [integer] | none ]
defaults-from [name]
description [string]
host-ip-address [ [ip address] | none]
interval [integer]
manual-resume [enabled | disabled]
origin-host [ [ip address] | none]
origin-realm [ [hostname] | none]
product-name [name]
time-until-up [integer]
timeout [integer]
up-interval [integer]
vendor-id [integer]
vendor-specific-acct-application-id [ [integer] | none]
vendor-specific-auth-application-id [ [integer] | none]
vendor-specific-vendor-id [ [integer] | none]
edit diameter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list diameter
list diameter [ [ [name] | [glob] | [regex] ] ... ]
show diameter [ [ [name] | [glob] | [regex] ] ... ]
show running-config diameter
show running-config diameter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete diameter [name]
Note: You cannot delete default monitors.
Description
You can use the diameter component to congure a custom monitor, or you can use the default Diameter
monitor that the Local Trafc Manager provides. This type of monitor checks the health of Diameter protocol
resources.
Examples
create diameter my_diameter defaults-from diameter
Creates a monitor named my_diameter that inherits properties from the default Diameter monitor.
list diameter
Displays the properties of all of the Diameter monitors.
Options
• acct-application-id
Species the ID of the accounting portion of a Diameter application. If you specify this option, you
must also specify a value for the auth-application-id option. The default value is none.
Note that the acct-application-id and auth-application-id attribute-value-pair (AVP), and the
vendor-specic-auth-application-id and vendor-specic-acct-application-id AVP are mutually
exclusive. You can only specify one of these AVPs.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• auth-application-id
Species the ID of the authentication and authorization portion of a Diameter application. If you specify
this option, you must also specify a value for the acct-application-id option. The default value is none.
Note that the acct-application-id and auth-application-id attribute-value-pair (AVP), and the
vendor-specic-auth-application-id and vendor-specic-acct-application-id AVP are mutually
exclusive. You can only specify one set of these AVPs.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is repass.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• host-ip-address
894
LTM Monitor
Species the IP address of the sender of the Diameter message for the Diameter protocol peer discovery
feature. The default value is none.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• origin-host
Species the IP address from which the Diameter message originates. The default value is none.
• origin-realm
Species the realm in which the host from which the Diameter message originates resides. The default
value is f5.com.
• partition
Displays the administrative partition within which the component resides.
• product-name
Species the vendor-assigned name of the Diameter application. The value of this option must remain
constant across rmware revisions for the same product. The default value is F5 BIGIP Diameter
Health Monitoring.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
895
Traffic Management Shell (tmsh) Reference Guide
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• vendor-id
Species the IANA SMI Network Management Private Enterprise Code assigned to the vendor of the
Diameter application. The default value is 3375.
• vendor-specic-acct-application-id
Species the ID of the vendor-specic accounting portion of a Diameter application. If you specify this
option, you must also specify a value for the vendor-specic-auth-application-id option. The default
value is none.
Note that the acct-application-id and auth-application-id attribute-value-pair (AVP), and the
vendor-specic-auth-application-id and vendor-specic-acct-application-id AVP are mutually
exclusive. You can only specify one of these AVPs.
• vendor-specic-auth-application-id
Species the ID of the vendor-specic authentication and authorization portion of a Diameter application.
If you specify this option, you must also specify a value for the vendor-specic-acct-application-id
option. The default value is none.
Note that the acct-application-id and auth-application-id attribute-value-pair (AVP), and the
vendor-specic-auth-application-id and vendor-specic-acct-application-id AVP are mutually
exclusive. You can only specify one of these AVPs.
• vendor-specic-vendor-id
Species the ID of a vendor-specic Diameter application. The system uses this ID to advertise support
for the application. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
dns
Congures a Domain Name System (DNS) monitor.
Syntax
Congure the dns component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create dns [name]
modify dns [name]
accept-rcode [no-error | anything]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
896
LTM Monitor
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
answer-contains [query-type | any-type | anything]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
qname [string]
qtype [a | aaaa]
recv [none | [string] ]
reverse [enabled | disabled]
time-until-up [integer]
timeout [integer]
transparent [disabled | enabled]
up-interval [integer]
edit dns [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list dns
list dns [ [ [name] | [glob] | [regex] ] ... ]
show dns [ [ [name] | [glob] | [regex] ] ... ]
show running-config dns
show running-config dns [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete dns [name]
Note: You cannot delete default monitors.
Description
You can use the dns component to congure a custom monitor. This type of monitor veries the DNS
service by attempting to send DNS requests generated using the parameters provided to a pool, pool member,
or virtual server and validating the DNS response.
Examples
create dns my_dns defaults-from dns qname www.test.com
Creates a monitor named my_dns that inherits properties other than qname from the default DNS monitor.
list dns
Displays the properties of all of the DNS monitors.
897
Traffic Management Shell (tmsh) Reference Guide
Options
• accept_rcode
Species the RCODE required in the response for an 'up' status. The default value is no-error.
The options are:
• no-error
Species that the status of the node will be marked up if the received dns message has RCODE =
NOERROR.
• anything
Species that the status of the node will be marked up irrespective of the RCODE in the dns message
received.
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• answer_contains
Species the record types required in the answer section of the response in order to mark the status of
a node up. The default value is query-type.
The options are:
• query-type
Species that the response should contain at least one answer of which the resource record type
matches the qtype.
• any-type
Species that the dns message should contain at least one answer.
• anything
Species that an empty answer section is enough to mark the status of the node up.
898
LTM Monitor
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is dns.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. Possible
values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
899
Traffic Management Shell (tmsh) Reference Guide
Displays the administrative partition within which the component resides.
• qname
Species the query name that the monitor send a DNS query for. The default value is Enter a query
name.
• qtype
Species the query type of that the monitor sends a query. The default value is a.
The options are:
• a
Species that the monitor will send a DNS query of type A.
• aaaa
Species that the monitor will send a DNS query of type AAAA.
• recv
Species the ip address that the monitor looks for in the dns response's resource record sections. The ip
address should be specied in the dotted-decimal notation or ipv6 notation. The default value is none.
If no recv value is specied, then the dns message will be checked against accept_rcode and
answer_contains monitor parameters respectively.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
receive string match marks the monitored object down instead of up. You can use the this mode only
if you congure recv option.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds. If the target responds within the set time period, it is considered up. If the target
does not respond within the set time period, it is considered down. Also, if the target responds with a
RESET packet, the system immediately ags the target as down without waiting for the timeout interval
to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
900
LTM Monitor
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
external
Congures an external monitor.
Syntax
Congure the external component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create external [name]
modify external [name]
args [ [arguments] | none]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
run [none | [path] ]
time-until-up [integer]
timeout [integer]
user-defined [ [name] [value] | [name] none ]
up-interval [integer]
edit external [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list external
list external [ [ [name] | [glob] | [regex] ] ... ]
show external [ [ [name] | [glob] | [regex] ] ... ]
show running-config external
show running-config external [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
901
Traffic Management Shell (tmsh) Reference Guide
Delete
delete external [name]
Note: You cannot delete default monitors.
Description
You can use the external component to congure a custom monitor, or you can use the default external
monitor that the Local Trafc Manager provides. Using this type of monitor, you can use your own programs
to monitor services.
Examples
create external my_external defaults-from external
Creates a monitor named my_external that inherits properties from the default external monitor.
list external
Displays the properties of all of the external monitors.
Options
• args
Species any command-line arguments that the external program requires. The default value is none.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is external.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
902
LTM Monitor
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• run
Species the path and le name of a program to run as the external monitor, for example
/cong/monitors/myMonitor. The default value is none.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 zero, which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• user-dened
903
Traffic Management Shell (tmsh) Reference Guide
Species any user-dened command-line arguments and variables that the external program requires.
Use the following syntax to specify a user dened parameter.
modify external my_external user-dened my_param_name my_param_value
Use the following syntax to remove a user dened parameter.
modify external my_external user-dened my_param_name none
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
firepass
Congures a FirePass(r) monitor.
Syntax
Congure the repass component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create firepass [name]
modify firepass [name]
app-service [[string] | none]
cipherlist [list]
concurrency-limit [integer]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
max-load-average [integer]
password [password]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [ [name] | none]
edit firepass [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list firepass
list firepass [ [ [name] | [glob] | [regex] ] ... ]
show firepass [ [ [name] | [glob] | [regex] ] ... ]
show running-config firepass
show running-config firepass [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
904
LTM Monitor
Delete
delete firepass [name]
Note: You cannot delete default monitors.
Description
You can use the repass component to congure a custom monitor, or you can use the default Firepass
monitor that the Local Trafc Manager provides. This type of monitor checks the health of FirePass systems.
Examples
create repass my_repass defaults-from repass
Creates a monitor named my_repass that inherits properties from the default Firepass monitor.
list repass
Displays the properties of all of the Firepass monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• cipherlist
Species the list of ciphers for this monitor. The default value is HIGH:!ADH.
• concurrency-limit
Species the maximum percentage of licensed connections currently in use under which the monitor
marks the FirePass system up. The default value is 95.
For example, a value of 95 percent means that the monitor marks the FirePass system up until 95 percent
of licensed connections are in use. When the number of in-use licensed connections exceeds 95 percent,
the monitor marks the FirePass system down.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is repass.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
905
Traffic Management Shell (tmsh) Reference Guide
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• max-load-average
Species the number that the monitor uses to mark the FirePass system up or down. The system compares
the value of this option to a one-minute average of the FirePass system load. When the FirePass
system-load average falls within the specied value, the monitor marks the FirePass system up. When
the average exceeds the value, the monitor marks the system down.
The default value is 12.0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password, if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
906
LTM Monitor
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is gtmuser.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
ftp
Congures a File Transfer Protocol (FTP) monitor.
Syntax
Congure the ftp component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create ftp [name]
modify ftp [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
filename [ [filename] | none]
interval [integer]
manual-resume [enabled | disabled]
mode [passive | port]
password [none | [password] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [name]
edit ftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
907
Traffic Management Shell (tmsh) Reference Guide
Display
list ftp
list ftp [ [ [name] | [glob] | [regex] ] ... ]
show ftp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ftp
show running-config ftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ftp [name]
Note: You cannot delete default monitors.
Description
You can use the ftp component to congure a custom monitor, or you can use the default FTP monitor that
the Local Trafc Manager provides. This type of monitor veries the FTP service by attempting to download
a specic le to the /var/tmp directory on the system. Once downloaded successfully, the le is not saved.
Examples
create ftp my_ftp defaults-from ftp
Creates a monitor named my_ftp that inherits properties from the default FTP monitor.
list ftp
Displays the properties of all of the FTP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
908
LTM Monitor
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is ftp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lename
Species the full path and le name of the le that the system attempts to download. The health check
is successful if the system can download the le. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• mode
Species the data transfer process (DTP) mode. The default value is passive.
The options are:
• passive
Species that the monitor sends a data transfer request to the FTP server. When the FTP server
receives the request, the FTP server then starts and establishes the data connection.
• port
909
Traffic Management Shell (tmsh) Reference Guide
Species that the monitor starts and establishes the data connection with the FTP server.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• password
Species the password, if the monitored target requires authentication. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 zero, which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
gateway-icmp
Congures a Gateway Internet Control Message Protocol (ICMP) monitor.
910
LTM Monitor
Syntax
Congure the gateway-icmp component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create gateway-icmp [name]
modify gateway-icmp [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
time-until-up [integer]
timeout [integer]
transparent [enabled | disabled]
up-interval [integer]
edit gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list gateway-icmp
list gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
show gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
show running-config gateway-icmp
show running-config gateway-icmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete gateway-icmp [name]
Note: You cannot delete default monitors.
Description
You can use the gateway-icmp component to congure a custom monitor, or you can use the default
Gateway ICMP monitor that the Local Trafc Manager provides. This type of monitor monitors a pool that
implements gateway fail-safe for high availability.
Examples
create gateway-icmp my_imcp defaults-from gateway_icmp
911
Traffic Management Shell (tmsh) Reference Guide
Creates a monitor named my_icmp that inherits properties from the default Gateway ICMP monitor.
list gateway-icmp
Displays the properties of all of the Gateway ICMP monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is gateway_icmp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
912
LTM Monitor
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port specied in the monitor,
routing the check through the IP address and port supplied by the pool member. The pool member
(the gateway) is marked up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
913
Traffic Management Shell (tmsh) Reference Guide
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
http
Congures a Hypertext Transfer Protocol (HTTP) monitor.
Syntax
Congure the http component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create http [name]
modify http [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
ip-tos [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
recv [none | [string] ]
recv-disable [none | [string] ]
reverse [enabled | disabled]
ip-dscp [integer]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
transparent [enabled | disabled]
up-interval [integer]
username [ [name] | none]
edit http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
914
LTM Monitor
Display
list http
list http [ [ [name] | [glob] | [regex] ] ... ]
show http [ [ [name] | [glob] | [regex] ] ... ]
show running-config http
show running-config http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete http [name]
Note: You cannot delete default monitors.
Description
You can use the http component to congure a custom monitor, or you can use the default HTTP monitor
that the Local Trafc Manager provides. This type of monitor veries the HTTP service by attempting to
receive specic content from a Web page.
Examples
create http my_http defaults-from http
Creates a monitor named my_http that inherits properties from the default HTTP monitor.
list http
Displays the properties of all of the HTTP monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
915
Traffic Management Shell (tmsh) Reference Guide
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is http.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port specied in the monitor,
routing the check through the IP address and port supplied by the pool member. The pool member
(the gateway) is marked up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• ip-dscp
916
LTM Monitor
Species the differentiated services code point (DSCP). DSCP is a 6-bit value in the Differentiated
Services (DS) eld of the IP header. It can be used to specify the quality of service desired for the packet.
The valid range for this value is 0 to 63 (hex 0x0 to 0x3f). The default value is zero.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in an HTML le on your
site. The text string can be regular text, HTML tags, or image names, and the associated operation is
not case-sensitive. If you do not specify a value for both the send and recv options, the monitor performs
a simple service check and connect only.
• recv-disable
Species a text string that the monitor looks for in the returned resource. If the text string is matched in
the returned resource, the corresponding node or pool member is marked session disabled. The default
value is none.
You specify a recv-disable string in the same way that you specify a recv string.
If you specify a recv-disable string, you must also specify a recv string. You cannot specify a
recv-disable string, if the reverse option is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object.
The default setting is GET /, which retrieves a default HTML le for a web site. To retrieve a specic
page from a web site, specify a fully-qualied path name, for example, GET /www/company/index.html.
Since the string may have special characters, the system may require that the string be enclosed with
single quotation marks.
917
Traffic Management Shell (tmsh) Reference Guide
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
https
Congures a Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) monitor.
Syntax
Congure the https component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create https [name]
modify https [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
918
LTM Monitor
app-service [[string] | none]
cert [ [cert list] | none]
cipherlist [string]
compatibility [enabled | disabled]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
ip-dscp [integer]
key [ [key] | none]
manual-resume [enabled | disabled]
password [none | [password] ]
recv [none | [string] ]
recv-disable [none | [string] ]
reverse [enabled | disabled]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
transparent [enabled | disabled]
up-interval [integer]
username [ [name] | none]
edit https [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list https
list https [ [ [name] | [glob] | [regex] ] ... ]
show https [ [ [name] | [glob] | [regex] ] ... ]
show running-config https
show running-config https [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete https [name]
Note: You cannot delete default monitors.
Description
You can use the https component to congure a custom monitor, or you can use the default HTTPS monitor
that the Local Trafc Manager provides. This type of monitor veries the HTTPS service by attempting to
receive specic content from a Web page protected by Secure Socket Layer (SSL) security.
Note that one of the pre-congured HTTPS monitors is named https_443, which performs a health check
on a server using the IP address supplied by the pool member and port 443.
Examples
create https my_https defaults-from https
Creates a monitor named my_https that inherits properties from the default HTTPS monitor.
919
Traffic Management Shell (tmsh) Reference Guide
list https
Displays the properties of all of the HTTPS monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• cert
Species a le object for a client certicate that the monitor sends to the target SSL server. The default
value is none.
• cipherlist
Species the list of ciphers for this monitor. The default list DEFAULT:+SHA:+3DES:+kEDH is
located in the le base_monitors.conf.
• compatibility
Species, when enabled, that the SSL options setting (in OpenSSL) is set to ALL. The default value is
enabled.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is https.
• description
User dened description.
• destination
920
LTM Monitor
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port specied in the monitor,
routing the check through the IP address and port supplied by the pool member. The pool member
(the gateway) is marked up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• ip-dscp
Species the differentiated services code point (DSCP). DSCP is a 6-bit value in the Differentiated
Services (DS) eld of the IP header. It can be used to specify the quality of service desired for the packet.
The valid range for this value is 0 to 63 (hex 0x0 to 0x3f). The default value is zero.
• key
Species the RSA private key if the monitored target requires authentication. The key must be surrounded
by quotation marks, for example, key \"client.key\". Note that if you specify a key, you must also
specify a value for the cert option. The default value is none.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
921
Traffic Management Shell (tmsh) Reference Guide
Species the password if the monitored target requires authentication. The default value is none.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in an HTML le on your
site. The text string can be regular text, HTML tags, or image names, and the associated operation is
not case-sensitive. If you do not specify a value for both the send and recv options, the monitor performs
a simple service check and connect only.
• recv-disable
Species a text string that the monitor looks for in the returned resource. If the text string is matched in
the returned resource, the corresponding node or pool member is marked session disabled. The default
value is none.
You specify a recv-disable string in the same way that you specify a recv string.
If you specify a recv-disable string, you must also specify a recv string. You cannot specify a
recv-disable string, if the reverse option is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object.
The default setting is GET /, which retrieves a default HTML le for a web site. To retrieve a specic
page from a web site, specify a fully-qualied path name, for example, GET /www/company/index.html.
Since the string may have special characters, the system may require that the string be enclosed with
single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
922
LTM Monitor
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
icmp
Congures an Internet Control Message Protocol (ICMP) monitor.
Syntax
Congure the icmp component within the ltm monitor module using the syntax shown in the following
sections.
Create/Modify
create icmp [name]
modify icmp [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address]
interval [integer]
manual-resume [enabled | disabled]
time-until-up [integer]
timeout [integer]
transparent [enabled | disabled]
up-interval [integer]
edit icmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
923
Traffic Management Shell (tmsh) Reference Guide
Display
list icmp
list icmp [ [ [name] | [glob] | [regex] ] ... ]
show icmp [ [ [name] | [glob] | [regex] ] ... ]
show running-config icmp
show running-config icmp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete icmp [name]
Note: You cannot delete default monitors.
Description
You can use the icmp component to congure a custom monitor, or you can use the default ICMP monitor
that the Local Trafc Manager provides.
Examples
create icmp my_icmp defaults-from icmp
Creates a monitor named my_icmp that inherits properties from the default ICMP monitor.
list icmp
Displays the properties of all of the ICMP monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
924
LTM Monitor
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is icmp.
• description
User dened description.
• destination
Species the IP address of the resource that is the destination of this monitor. The default value is *.
Possible values are:
• *
Species to perform a health check on the IP address of the node.
• IP address
Species to perform a health check on the IP address that you specify, and mark the associated node
up or down accordingly.
• IP address (with the transparent option enabled)
Species to perform a health check on the IP address that you specify, route the check through the
IP address of the associated node, and mark the IP address of the associated node up or down
accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
925
Traffic Management Shell (tmsh) Reference Guide
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
imap
Congures an Internet Message Access Protocol (IMAP) monitor.
Syntax
Congure the imap component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create imap [name]
modify imap [name]
app-service [[string] | none]
debug [no | yes]
926
LTM Monitor
defaults-from [name]
description [string]
destination [ip address][port]
folder [ [name] | none]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [ [name] | none]
edit imap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list imap
list imap [ [ [name] | [glob] | [regex] ] ... ]
show imap [ [ [name] | [glob] | [regex] ] ... ]
show running-config imap
show running-config imap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete imap [name]
Note: You cannot delete default monitors.
Description
You can use the imap component to congure a custom monitor, or you can use the default IMAP monitor
that the Local Trafc Manager provides. This type of monitor veries IMAP by attempting to open a
specied mail folder on a server. This monitor is similar to the POP3 monitor.
Examples
create imap my_imap defaults-from imap
Creates a monitor named my_imap that inherits properties from the default IMAP monitor.
list imap
Displays the properties of all of the IMAP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
927
Traffic Management Shell (tmsh) Reference Guide
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is imap.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• folder
Species the name of the folder on the IMAP server that the monitor tries to open. The default value is
INBOX.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
928
LTM Monitor
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
inband
Congures an Inband (passive) monitor.
929
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the inband component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create inband [name]
modify inband [name]
app-service [[string] | none]
defaults-from [name]
description [string]
failure-interval [integer]
failures [integer]
response-time [integer]
retry-time [integer]
edit inband [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list inband
list inband [ [ [name] | [glob] | [regex] ] ... ]
show inband [ [ [name] | [glob] | [regex] ] ... ]
show running-config inband
show running-config inband [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete inband [name]
Note: You cannot delete default monitors.
Description
You can use the inband component to congure a custom monitor, or you can use the default Inband monitor
that the Local Trafc Manager provides. With this type of monitor the BIG-IP(r) system can perform passive
monitoring as part of client requests.
Examples
create inband my_inband defaults-from inband
Creates a monitor named my_inband that inherits properties from the default Inband monitor.
list inband
Displays the properties of all of the Inband monitors.
930
LTM Monitor
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is inband.
• description
User dened description.
• failure-interval
Species an interval, in seconds. If the number of failures specied in the failures option occurs within
this interval, the system marks the pool member as being unavailable. The default value is 30.
• failures
Species the number of failures that the system allows to occur, within the time period specied in the
failure-interval option, before marking a pool member unavailable. The default value is 3, which means
that the system marks the pool member unavailable at the fourth failure. The multiple tmm processes
use a per-process number to calculate failures, depending on the specied load. For example, for the
Round Robin load balancing method, if there are N tmm processes and M pool members, and the Failures
setting is set to L, then up to N*M*L+1 failures can occur before the system marks the node as down.
Specifying a value of 0 (zero) disables this option.
A failure can be either a failure to connect or a failure of the pool member to respond within the time
specied in the response-time option.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• response-time
Species an amount of time, in seconds. If the pool member does not respond with data after the specied
amount of time has passed, the number of failures in this interval increments by 1. Specifying a value
of 0 (zero) disables this option.
• retry-time
Species the amount of time in seconds after the pool member has been marked unavailable before the
system retries to connect to the pool member. Specifying a value of 0 (zero) disables this option.
931
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
ldap
Congures a Lightweight Directory Access Protocol (LDAP) monitor.
Syntax
Congure the ldap component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create ldap [name]
modify ldap [name]
app-service [[string] | none]
base [none | [string] ]
chase-referrals [no | yes]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
filter [ [LDAP key] | none]
interval [integer]
mandatory-attributes [no | yes]
manual-resume [enabled | disabled]
password [none | [password] ]
security [none | ssl | tls]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [ [name] | none]
edit ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ldap
list ldap [ [ [name] | [glob] | [regex] ] ... ]
show ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config ldap
show running-config ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ldap [name]
932
LTM Monitor
Note: You cannot delete default monitors.
Description
You can use the ldap component to congure a custom monitor, or you can use the default LDAP monitor
that the Local Trafc Manager provides. This type of monitor veries the LDAP service by attempting to
authenticate the specied user.
Examples
create ldap my_ldap defaults-from ldap
Creates a monitor named my_ldap that inherits properties from the default LDAP monitor.
list ldap
Displays the properties of all of the LDAP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• base
Species the location in the LDAP tree from which the monitor starts the health check. A sample value
is dc=bigip-test,dc=net. The default value is none.
• chase-referrals
Species whether the monitor upon receipt of an LDAP referral entry chases that referral. The default
value is yes.
The options are:
• no
Species that the system will treat a referral entry as a normal entry and refrain from querying the
remote LDAP server(s) pointed to by the referral entry.
• yes
Species that the system upon receiving any referral entry from the monitored LDAP server query,
the system will then query the corresponding LDAP server(s) pointed to by the LDAP query. If the
query for the referral is unsuccessful the system will mark the monitored LDAP server down.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
933
Traffic Management Shell (tmsh) Reference Guide
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is ldap.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lter
Species an LDAP key for which the monitor searches. A sample value is objectclass=*. The default
value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• mandatory-attributes
Species whether the target must include attributes in its response to be considered up. The default
value is no.
The options are:
• no
Species that the system performs only a one-level search (based on the value of the lter option),
and does not require that the target returns any attributes.
• yes
Species that the system performs a sub-tree search, and if the target returns no attributes, the target
is considered down.
• manual-resume
934
LTM Monitor
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• security
Species the secure communications protocol that the monitor uses to communicate with the target. The
default value is none. The options are:
• none
Species that the system does not use a security protocol for communications with the target.
• ssl
Species that the system uses the SSL protocol for communications with the target.
• tls
Species that the system uses the TLS protocol for communications with the target.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
935
Traffic Management Shell (tmsh) Reference Guide
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
module-score
Congures a Module Score monitor that monitors the performance of a pool or node, rather than the health
of the pool or node.
Syntax
Congure the module-score component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create module-score [name]
modify module-score [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
interval [integer]
pool [name]
snmp-community [none | [string] ]
snmp-ip-address [ [ip address] | none]
snmp-port [port]
snmp-version [string]
time-until-up [integer]
timeout [integer]
up-interval [integer]
edit module-score [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list module-score
list module-score [ [ [name] | [glob] | [regex] ] ... ]
show module-score [ [ [name] | [glob] | [regex] ] ... ]
show running-config module-score
show running-config module-score [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
936
LTM Monitor
Delete
delete module-score [name]
Note: You cannot delete default monitors.
Description
You can use the module-score component to congure a custom monitor, or you can use the default Module
Score monitor that the Local Trafc Manager provides. This type of monitor enables global and local trafc
management systems to load balance in a proportional manner to local trafc management virtual servers
associated with the Web Accelerator(tm) and Application Security Manager modules. When you congure
a Module Score type of monitor, the local trafc management system uses SNMP to pull the gtm_score
values from the downstream virtual servers and set the dynamic ratios on the associated upstream local
trafc management pool members or nodes.
More specically, the Module Score monitor retrieves the gtm_score values from the virtual server and the
gtm_vs_score values associated with the virtual server. Then, if a pool name is not specied, this monitor
sets the dynamic ratio on the node that is associated with the virtual server.
The BIG-IP(r) system uses the lowest non-zero value of the gtm_vs_score values to set the dynamic ratio.
If all gtm_vs_score values are zero, then the gtm_score value is used to set the dynamic ratios. If you specify
a pool name in the monitor denition, then the dynamic ratio is set on the pool member.
Note: If you want to distribute trafc to a cluster of WebAccelerator or Application Security Manager
virtual servers, you must create a separate custom Module Score monitor for each back-end Local Trafc
Manager system.
Examples
create module-score my_module-score defaults-from module_score
Creates a monitor named my_module-score that inherits properties from the default Module Score monitor.
list module-score
Displays the properties of all of the Module Score monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
937
Traffic Management Shell (tmsh) Reference Guide
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is module_score.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• pool
Species a Local Trafc Manager pool name. Use this option if you want the system to set dynamic
ratios on a pool member instead of on the associated node for the pool member. The default value is
none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• snmp-community
Species the identier for the SNMP community. The default value is public.
• snmp-ip-address
Species the IP address of the SNMP server. The default value is none.
• snmp-port
Species the port associated with the SNMP server. The default value is 161.
• snmp-version
Species the SNMP version in use by the system. The default value is v2c.
• time-until-up
Species the amount of time in seconds after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
938
LTM Monitor
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 30 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
mssql
Congures a Microsoft(r) Windows(r) Structured Query Language (MSSQL) monitor.
Syntax
Congure the mssql component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create mssql [name]
modify mssql [name]
app-service [[string] | none]
count [integer]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [[name] | none]
edit mssql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
939
Traffic Management Shell (tmsh) Reference Guide
Display
list mssql
list mssql [ [ [name] | [glob] | [regex] ] ... ]
show mssql [ [ [name] | [glob] | [regex] ] ... ]
show running-config mssql
show running-config mssql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete mssql [name]
Note: You cannot delete default monitors.
Description
You can use the mssql component to congure a custom monitor, or you can use the default Microsoft
Windows SQL monitor that the Local Trafc Manager provides. This type of monitor veries Microsoft
Windows SQL-based services.
Examples
create mssql my_mssql defaults-from mssql
Creates a monitor named my_mssql that inherits properties from the default MSSQL monitor.
list mssql
Displays the properties of all of the MSSQL monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• count
Species the number of monitor probes after which the connection to the database will be terminated.
Count value of zero indicates that the connection will never be terminated. The default value is zero.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
940
LTM Monitor
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is mssql.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 30 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
941
Traffic Management Shell (tmsh) Reference Guide
• password
Species the password if the monitored target requires authentication. The default value is none.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
942
LTM Monitor
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
mysql
Congures a MySQL(r) monitor.
Syntax
Congure the mysql component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create mysql [name]
modify mysql [name]
app-service [[string] | none]
count [integer]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [[name] | none]
edit mysql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list mysql
list mysql [ [ [name] | [glob] | [regex] ] ... ]
show mysql [ [ [name] | [glob] | [regex] ] ... ]
show running-config mysql
show running-config mysql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
943
Traffic Management Shell (tmsh) Reference Guide
Delete
delete mysql [name]
Note: You cannot delete default monitors.
Description
You can use the mysql component to congure a custom monitor, or you can use the default MySQL
monitor that the Local Trafc Manager provides. This type of monitor veries MySQL-based services.
Examples
create mysql my_mysql defaults-from mysql
Creates a monitor named my_mysql that inherits properties from the default MySQL monitor.
list mysql
Displays the properties of all of the MySQL monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• count
Species the number of monitor probes after which the connection to the database will be terminated.
Count value of zero indicates that the connection will never be terminated. The default value is zero.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is mysql.
• description
944
LTM Monitor
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 30 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
945
Traffic Management Shell (tmsh) Reference Guide
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
nntp
Congures a Network News Transfer Protocol (NNTP) monitor.
Syntax
Congure the nntp component within the ltm monitor module using the syntax in the following sections.
946
LTM Monitor
Create/Modify
create nntp [name]
modify nntp [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
newsgroup [ [name] | none]
password [none | [password] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [[name] | none]
edit nntp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list nntp
list nntp [ [ [name] | [glob] | [regex] ] ... ]
show nntp [ [ [name] | [glob] | [regex] ] ... ]
show running-config nntp
show running-config nntp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete nntp [name]
Note: You cannot delete default monitors.
Description
You can use the nntp component to congure a custom monitor, or you can use the default NNTP monitor
that the Local Trafc Manager provides. This type of monitor veries the Usenet News protocol service
by attempting to retrieve a newsgroup identication string from the server.
Examples
create nntp my_nntp defaults-from nntp
Creates a monitor named my_nntp that inherits properties from the default NNTP monitor.
list nntp
Displays the properties of all of the NNTP monitors.
947
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is nntp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
948
LTM Monitor
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• newsgroup
Species the name of the newsgroup that you are monitoring, for example alt.car.mercedes. The default
value is none.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
949
Traffic Management Shell (tmsh) Reference Guide
oracle
Congures an Oracle(r) monitor.
Syntax
Congure the oracle component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create oracle [name]
modify oracle [name]
app-service [[string] | none]
count [integer]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [ [name] | none]
edit oracle [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list oracle
list oracle [ [ [name] | [glob] | [regex] ] ... ]
show oracle [ [ [name] | [glob] | [regex] ] ... ]
show running-config oracle
show running-config oracle [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete oracle [name]
Note: You cannot delete default monitors.
950
LTM Monitor
Description
You can use the oracle component to congure a custom monitor, or you can use the default Oracle monitor
that the Local Trafc Manager provides. This type of monitor veries Oracle database services.
Examples
create oracle my_oracle defaults-from oracle
Creates a monitor named my_oracle that inherits properties from the default Oracle monitor.
list oracle
Displays the properties of all of the Oracle monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• count
Species the number of monitor probes after which the connection to the database will be terminated.
Count value of zero indicates that the connection will never be terminated. The default value is zero.
• database
Species the name of the database with which the monitor attempts to communicate. The proper format
for database name is <node_ip>:<node_port>:<database_name>. The default value is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is oracle.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
951
Traffic Management Shell (tmsh) Reference Guide
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 30 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
952
LTM Monitor
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
pop3
Congures a Post Ofce Protocol (POP3) monitor.
Syntax
Congure the pop3 component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create pop3 [name]
modify pop3 [name]
app-service [[string] | none]
953
Traffic Management Shell (tmsh) Reference Guide
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [ [name] | none]
edit pop3 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list pop3
list pop3 [ [ [name] | [glob] | [regex] ] ... ]
show pop3 [ [ [name] | [glob] | [regex] ] ... ]
show running-config pop3
show running-config pop3 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete pop3 [name]
Note: You cannot delete default monitors.
Description
You can use the pop3 component to congure a custom monitor, or you can use the default POP3 monitor
that the Local Trafc Manager provides. This type of monitor veries the POP3 service by attempting to
connect to a pool, pool member, or virtual server, log on as the specied user, and log off.
Examples
create pop3 my_pop3 defaults-from pop3
Creates a monitor named my_pop3 that inherits properties from the default POP3 monitor.
list pop3
Displays the properties of all of the POP3 monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
954
LTM Monitor
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is pop3.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
955
Traffic Management Shell (tmsh) Reference Guide
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
postgresql
Congures a PostgreSQL(r) monitor.
956
LTM Monitor
Syntax
Congure the postgresql component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create postgresql [name]
modify postgresql [name]
app-service [[string] | none]
count [integer]
database [ [name] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
recv [none | [string] ]
recv-column [none | [string] ]
recv-row [none | [string] ]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [[name] | none]
edit postgresql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list postgresql
list postgresql [ [ [name] | [glob] | [regex] ] ... ]
show postgresql [ [ [name] | [glob] | [regex] ] ... ]
show running-config postgresql
show running-config postgresql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete postgresql [name]
Note: You cannot delete default monitors.
Description
You can use the postgresql component to congure a custom monitor, or you can use the default PostgreSQL
monitor that the Local Trafc Manager provides. This type of monitor veries PostgreSQL-based services.
957
Traffic Management Shell (tmsh) Reference Guide
Examples
create postgresql my_postgresql defaults-from postgresql
Creates a monitor named my_postgresql that inherits properties from the default PostgreSQL monitor.
list postgresql
Displays the properties of all of the PostgreSQL monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• count
Species the number of monitor probes after which the connection to the database will be terminated.
Count value of zero indicates that the connection will never be terminated. The default value is zero.
• database
Species the name of the database with which the monitor attempts to communicate. The default value
is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is postgresql.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
958
LTM Monitor
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 30 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in a eld in your database.
If you do not specify a value for both the send and recv options, the monitor performs a simple service
check and connect only.
• recv-column
Species the column in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• recv-row
Species the row in the database where the system expects the specied Receive String to be located.
Specify this option only if you congure the send and recv options. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• send
Species the SQL query that the monitor sends to the target database, for example, SELECT count(*)
FROM mytable.
959
Traffic Management Shell (tmsh) Reference Guide
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 91 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
radius
Congures a Remote Access Dial-in User Service (RADIUS) monitor.
Syntax
Congure the radius component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create radius [name]
modify radius [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
nas-ip-address [ [ip address] | none]
password [none | [password] ]
secret [none | [secret] ]
960
LTM Monitor
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [ [name] | none]
edit radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ... ]
show radius [ [ [name] | [glob] | [regex] ] ... ]
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete radius [name]
Note: You cannot delete default monitors.
Description
You can use the radius component to congure a custom monitor, or you can use the default RADIUS
monitor that the Local Trafc Manager provides. This type of monitor veries the RADIUS service by
attempting to authenticate the specied user.
Examples
create radius my_radius defaults-from radius
Creates a monitor named my_radius that inherits properties from the default RADIUS monitor.
list radius
Displays the properties of all of the RADIUS monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
961
Traffic Management Shell (tmsh) Reference Guide
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is radius.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
962
LTM Monitor
• nas-ip-address
Species the network access server IP address that the system uses to identify itself to the RADIUS
server. With this option, multiple BIG-IP systems can appear as a single network access device to the
RADIUS server. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the secret the monitor must use when contacting the resource. The default value is none.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
radius-accounting
Congures a RADIUS accounting monitor for the BIG-IP(r) Local Trafc Manager.
963
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the radius-accounting component within the ltm monitor module using the syntax shown in
the following sections.
Create/Modify
create radius-accounting [name]
modify radius-accounting [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [ [name] | none]
description [string]
destination [ip address]
interval [integer]
manual-resume [disabled | enabled]
nas-ip-address [ip address]
secret [string]
time-until-up [integer]
timeout [integer]
up-interval [integer]
username [none | [string] ]
edit radius-accounting [ [ [name] | [glob] | [regex] ] ...]
all-properties
non-default-properties
Display
list radius-accounting
list radius-accounting [ [ [name] | [glob] | [regex] ] ...]
show radius-accounting [ [ [name] | [glob] | [regex] ] ...]
show running-config radius-accounting
show running-config radius-accounting [ [ [name] | [glob] |
[regex] ] ...]
all-properties
non-default-properties
one-line
partition
Delete
delete radius-accounting [name]
Note: You cannot delete default monitors.
Description
You can use the radius-accounting component to congure a custom monitor, or you can use the default
RADIUS accounting monitor that the Local Trafc Manager provides. This type of monitor provides
information about the usage of the RADIUS service for accounting purposes.
Examples
create radius-accounting my_radius_acct defaults-from radius_accounting
964
LTM Monitor
Creates a monitor named my_radius_acct that inherits properties from the default RADIUS accounting
monitor.
list radius-accounting
Displays the properties of all of the RADIUS accounting monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is radius.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
965
Traffic Management Shell (tmsh) Reference Guide
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• nas-ip-address
Species the network access server IP address that the system uses to identify itself to the RADIUS
server. Using this option, multiple BIG-IP(r) systems can appear as a single network access device to
the RADIUS server. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the secret the monitor needs to communicate with the resource. The default value is none.
• time-until-up
Species the amount of time in seconds after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
966
LTM Monitor
Species the username, if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, ltm pool, list, modify, regex, show, tmsh
real-server
Congures a RealServer(r) monitor.
Syntax
Congure the real-server component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create real-server [name]
modify real-server [name]
app-service [[string] | none]
defaults-from [name]
description [string]
interval [integer]
metrics [ [metrics] | none]
time-until-up [integer]
timeout [integer]
edit real-server [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list real-server
list real-server [ [ [name] | [glob] | [regex] ] ... ]
show real-server [ [ [name] | [glob] | [regex] ] ... ]
show running-config real-server
show running-config real-server [ [ [name] | [glob] | [regex] ] ... ]
agent
all-properties
command
method
non-default-properties
one-line
partition
Delete
delete real-server [name]
Note: You cannot delete default monitors.
967
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the real-server component to congure a custom monitor, or you can use the default RealServer
monitor that the Local Trafc Manager provides. This type of monitor checks the performance of a pool,
pool member, or virtual server that is running the RealServer data collection agent, and then dynamically
load balances trafc accordingly.
Examples
create real-server my_real-server defaults-from real_server
Creates a monitor named my_real-server that inherits properties from the default RealServer monitor.
list real-server
Displays the properties of all of the RealServer monitors.
Options
• agent
Displays the agent for the monitor. The default agent is Mozilla/4.0 (compatible: MSIE 5.0; Windows
NT). You cannot modify the agent.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• command
Displays the command that the system uses to obtain the metrics from the resource. See the documentation
for this resource for information on available commands. You cannot modify the command.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is real-server.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species the frequency at which the system issues the monitor check. The default value is 5 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• method
Displays the GET method. You cannot modify the method.
• metrics
Species the performance metrics that the commands collect from the target. The default value is
ServerBandwidth:1.5, CPUPercentUsage, MemoryUsage, TotalClientCount.
• partition
Displays the administrative partition within which the component resides.
968
LTM Monitor
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
rpc
Congures a Remote Procedure Call (RPC) monitor.
Syntax
Congure the rpc component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create rpc [name]
modify rpc [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address] [port]
interval [integer]
manual-resume [enabled | disabled]
mode [tcp | udp]
program-number [ [integer] | none]
time-until-up [integer]
timeout [integer]
up-interval [integer]
version-number [ [integer] | none]
edit rpc [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
969
Traffic Management Shell (tmsh) Reference Guide
Display
list rpc
list rpc [ [ [name] | [glob] | [regex] ] ... ]
show rpc [ [ [name] | [glob] | [regex] ] ... ]
show running-config rpc
show running-config rpc [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete rpc [name]
Note: You cannot delete default monitors.
Description
You can use the rpc component to congure a custom monitor, or you can use the default RPC monitor
that the Local Trafc Manager provides. This type of monitor queries the RPC server, and veries the
availability of a given program.
Examples
create rpc my_rpc defaults-from rpc
Creates a monitor named my_rpc that inherits properties from the default RPC monitor.
list rpc
Displays the properties of all of the RPC monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
970
LTM Monitor
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is rpc.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• mode
Species the protocol that the monitor uses to communicate with the target. The default value is tcp.
The options are:
• tcp
Species that the monitor uses the TCP protocol to communicate with the target object.
• udp
Species that the monitor uses the UDP protocol to communicate with the target object.
• name
971
Traffic Management Shell (tmsh) Reference Guide
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• program-number
Species the number of the program for which you want the monitor to verify availability. The default
value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• version-number
Species the number of the version for which you want the monitor to verify availability. The default
value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
sasp
Congures a Server Application State Protocol (SASP) monitor.
Syntax
Congure the sasp component within the ltm monitor module using the syntax in the following sections.
972
LTM Monitor
Create/Modify
create sasp [name]
modify sasp [name]
app-service [[string] | none]
defaults-from [name]
description [string]
interval [integer]
mode [pull | push]
primary-address [ip address]
protocol [tcp | udp]
secondary-address [ [ip address] | none]
service [none | [port] ]
time-until-up [integer]
timeout [integer]
edit sasp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list sasp
list sasp [ [ [name] | [glob] | [regex] ] ... ]
show sasp [ [ [name] | [glob] | [regex] ] ... ]
show running-config sasp
show running-config sasp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete sasp [name]
Note: You cannot delete default monitors.
Description
You can use the sasp component to congure a custom monitor, or you can use the default FTP monitor
that the Local Trafc Manager provides. This type of monitor veries the availability of IBM Group
Workload Managers network resources.
Examples
create sasp my_sasp defaults-from sasp
Creates a monitor named my_sasp that inherits properties from the default SASP monitor.
list sasp
Displays the properties of all of the SASP monitors.
973
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is sasp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species the frequency at which the system issues the monitor check. The default value is auto.
• mode
Species whether the load balancer should send Get Weight Request messages (pull) or receive Send
Weights messages (push) from the GWM. The default mode is pull.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• primary-address
Species the IP address of the primary Group Workload Manager.
• protocol
Species the protocol that the monitor uses to communicate with the target. The default value is tcp.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secondary-address
Species the IP address of the secondary Group Workload Manager.
• service
Species the port through which the SASP monitor communicates with the Group Workload Manager.
The default port is 3860.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 100 seconds.
974
LTM Monitor
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
scripted
Congures a Scripted monitor.
Syntax
Congure the scripted component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create scripted [name]
modify scripted [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address] [port]
filename [ [filename] | none]
interval [integer]
manual-resume [enabled | disabled]
time-until-up [integer]
timeout [integer]
up-interval [integer]
edit scripted [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list scripted
list scripted [ [ [name] | [glob] | [regex] ] ... ]
show scripted [ [ [name] | [glob] | [regex] ] ... ]
show running-config scripted
show running-config scripted [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete scripted [name]
975
Traffic Management Shell (tmsh) Reference Guide
Note: You cannot delete default monitors.
Description
You can use the scripted component to congure a custom monitor, or you can use the default scripted
monitor that the Local Trafc Manager provides.
Examples
create scripted my_scripted defaults-from scripted
Creates a monitor named my_scripted that inherits properties from the default scripted monitor.
list scripted
Displays the properties of all of the scripted monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is scripted.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
976
LTM Monitor
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lename
Species the name of a le in the /cong/eav/ directory on the system. The user-created le contains
the send and expect data that the monitor uses for the monitor check. The default value is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
977
Traffic Management Shell (tmsh) Reference Guide
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
sip
Congures a Session Initiation Protocol (SIP) monitor.
Syntax
Congure the sip component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create sip [name]
modify sip [name]
app-service [[string] | none]
cert [ [cert list] | none]
cipherlist [string]
compatibility [enabled | disabled]
debug [ no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
filter [any | none | status]
filter-neg [any | none | status]
headers [ [new line separated headers] | none]
interval [integer]
key [ [key] | none]
manual-resume [enabled | disabled]
mode [sips | tcp | tls | udp]
request [none | [string] ]
time-until-up [integer]
up-interval [integer]
username [ [name] | none]
edit sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list sip
list sip [ [ [name] | [glob] | [regex] ] ... ]
show sip [ [ [name] | [glob] | [regex] ] ... ]
show running-config sip
show running-config sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
978
LTM Monitor
one-line
partition
Delete
delete sip [name]
Note: You cannot delete default monitors.
Description
You can use the sip component to congure a custom monitor, or you can use the default SIP monitor that
the Local Trafc Manager provides. This type of monitor checks the status of SIP Call-ID services on a
device. The SIP protocol enables real-time messaging, voice, data, and video.
Examples
create sip my_sip defaults-from sip
Creates a monitor named my_sip that inherits properties from the default SIP monitor.
list sip
Displays the properties of all of the SIP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• cert
Species a fully-qualied path for a client certicate that the monitor sends to the target SSL server.
The default value is none.
• cipherlist
Species the list of ciphers for this monitor. The default value is DEFAULT:+SHA:+3DES:+kEDH.
• compatibility
Species, when enabled, that the SSL options setting (in OpenSSL) is set to ALL. The default value is
enabled.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks.
The default value is no. The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
979
Traffic Management Shell (tmsh) Reference Guide
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is sip.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• lter
Species the SIP status codes that the target can return to be considered up. By default the system always
accepts status codes whose value is in the 100, 200 or 300s.
The options are:
• any
Species that the monitor accepts any SIP status codes.
• none
Species that the monitor does not accept any other SIP status codes. This is the default value.
• status
Species one or more status codes that you want to add to the monitor.
• lter-neg
Species the SIP status codes that the target can return to be considered down. By default the system
always accepts status codes according to sip-monitor.lter. After checking that, the status code is
checked against this key. If a code is also in sip-monitor.lter, the node is marked up.
The options are:
• any
Species that the monitor rejects all SIP status codes that are not in sip-monitor.lter.
• none
Species that the monitor does not specically reject any other SIP status codes. This is the default
value.
• status
980
LTM Monitor
Species one or more status codes that you want to add to the monitor.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• headers
Species the set of SIP headers in the SIP message that is sent to the target. Separate each header with
a new line. The default value is none.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• key
Species the key if the monitored target requires authentication. The default value is none.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• mode
Species the protocol that the monitor uses to communicate with the target. The default mode is udp.
The options are:
• sips
Species that the monitor uses SIPS to communicate with the target.
• tcp
Species that the monitor uses TCP to communicate with the target.
• tls
Species that the monitor uses TLS to communicate with the target, and the SIP URI is SIPS.
• udp
Species that the monitor uses UDP to communicate with the target.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• request
981
Traffic Management Shell (tmsh) Reference Guide
Species the SIP request line in the SIP message that is sent to the target. The default value is none.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
smb
Congures a Server Message Bloc (SMB)/Common Internet File System (CIFS) monitor.
Syntax
Congure the smb component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create smb [name]
modify smb [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
get [none | [filename] ]
interval [integer]
manual-resume [enabled | disabled]
password [none | [password] ]
server [ [NETBIOS name] | none]
service [ [[name] | [integer]] | none]
time-until-up [integer]
timeout [integer]
982
LTM Monitor
up-interval [integer]
username [ [name] | none]
edit smb [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list smb
list smb [ [ [name] | [glob] | [regex] ] ... ]
show smb [ [ [name] | [glob] | [regex] ] ... ]
show running-config smb
show running-config smb [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete smb [name]
Note: You cannot delete default monitors.
Description
You can use the smb component to congure a custom monitor, or you can use the default SMB monitor
that the Local Trafc Manager provides. This type of monitor veries the availability of an SMB/CIFS
server. You can use this type of monitor to either check the availability of the server as a whole, the
availability of a specic service on the server, or the availability of a specic le used by a service.
Examples
create smb my_smb defaults-from smb
Creates a monitor named my_smb that inherits properties from the default SMB monitor.
list smb
Displays the properties of all of the SMB monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
983
Traffic Management Shell (tmsh) Reference Guide
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is smb.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• get
Species a le associated with a service. The default value is none.
The monitor uses the relative path to the service itself when attempting to locate the le. You are not
required to specify a value for this option; however, if you elect to use this option you must also specify
a value for the service option.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
984
LTM Monitor
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• server
Species the NetBIOS name of the SMB/CIFS server for which this monitor checks for availability.
You must specify a server for this monitor to function. The default value is none.
• service
Species a specic service on the SMB/CIFS for which you want to verify availability. The default
value is none.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the user name if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
985
Traffic Management Shell (tmsh) Reference Guide
smtp
Congures a Simple Mail Transport Protocol (SMTP) monitor.
Syntax
Congure the smtp component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create smtp [name]
modify smtp [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
domain [ [name] | none]
interval [integer]
manual-resume [enabled | disabled]
time-until-up [integer]
timeout [integer]
up-interval [integer]
edit smtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list smtp
list smtp [ [ [name] | [glob] | [regex] ] ... ]
show smtp [ [ [name] | [glob] | [regex] ] ... ]
show running-config smtp
show running-config smtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete smtp [name]
Note: You cannot delete default monitors.
Description
You can use the smtp component to congure a custom monitor, or you can use the default SMTP monitor
that the Local Trafc Manager provides. This type of monitor checks the status of a pool, pool member, or
virtual server by issuing standard SMTP commands.
986
LTM Monitor
Examples
create smtp my_smtp defaults-from smtp
Creates a monitor named my_smtp that inherits properties from the default SMTP monitor.
list smtp
Displays the properties of all of the SMTP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is smtp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• domain
Species the domain name to check, for example, bigipinternal.com. The default value is none.
987
Traffic Management Shell (tmsh) Reference Guide
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
988
LTM Monitor
snmp-dca
Congures a Simple Network Management Protocol (SNMP) Data Center Audit monitor.
Syntax
Congure the snmp component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create snmp-dca [name]
modify snmp-dca [name]
agent-type [generic | other | win2000 | ucd]
app-service [[string] | none]
community [ [name] | none]
cpu-coefficient [ [integer] | none]
cpu-threshold [none | [integer] ]
defaults-from [name]
description [string]
disk-coefficient [ [integer] | none]
disk-threshold [none | [integer] ]
interval [integer]
memory-coefficient [ [integer] | none]
memory-threshold [none | [integer] ]
time-until-up [integer]
timeout [integer]
user-defined
version [ [integer] | none]
edit snmp-dca [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list snmp-dca
list snmp-dca [ [ [name] | [glob] | [regex] ] ... ]
show snmp-dca [ [ [name] | [glob] | [regex] ] ... ]
show running-config snmp-dca
show running-config snmp-dca [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete snmp-dca [name]
Note: You cannot delete default monitors.
989
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the snmp-dca component to congure a custom monitor, or you can use the default SNMP
DCA monitor that the Local Trafc Manager provides. This type of monitor checks the performance of a
server running an SNMP agent such as UC Davis, for the purpose of load balancing trafc to that server.
Examples
create snmp-dca my_snmp-dca defaults-from snmp_dca
Creates a monitor named my_snmp-dca that inherits properties from the default SNMP DCA monitor.
list snmp-dca
Displays the properties of all of the SNMP DCA monitors.
Options
• agent-type
Species the type of agent. The default value is ucd.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• community
Species the community name that the BIG-IP system must use to authenticate with the host server
through SNMP. The default value is public.
• cpu-coefcient
Species the coefcient that the system uses to calculate the weight of the CPU threshold in the dynamic
ratio load balancing algorithm. The default value is 1.5.
• cpu-threshold
Species the maximum acceptable CPU usage on the target server. The default value is 80 percent.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is snmp_dca.
• description
User dened description.
• disk-coefcient
Species the coefcient that the system uses to calculate the weight of the disk threshold in the dynamic
ratio load balancing algorithm. The default value is 2.0.
• disk-threshold
Species the maximum acceptable disk usage on the target server. The default value is 90 percent.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• memory-coefcient
990
LTM Monitor
Species the coefcient that the system uses to calculate the weight of the memory threshold in the
dynamic ratio load balancing algorithm. The default value is 1.0.
• memory-threshold
Species the maximum acceptable memory usage on the target server. The default value is 70 percent.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 30 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• user-dened
Species attributes for a monitor that you dene. The default value is none.
• version
Species the version of SNMP that the host server uses. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
snmp-dca-base
Congures a base Simple Network Management Protocol (SNMP) Data Center Audit monitor.
Syntax
Congure the snmp-dca-base component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create snmp-dca-base [name]
991
Traffic Management Shell (tmsh) Reference Guide
modify snmp-dca-base [name]
app-service [[string] | none]
community [ [name] | none]
cpu-coefficient [ [integer] | none]
defaults-from [name]
description [string]
interval [integer]
time-until-up [integer]
timeout [integer]
user-defined [ [name] [value] | [name] none ]
version [ [integer] | none]
edit snmp-dca-base [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list snmp-dca-base
list snmp-dca-base [ [ [name] | [glob] | [regex] ] ... ]
show snmp-dca-base [ [ [name] | [glob] | [regex] ] ... ]
show running-config snmp-dca-base
show running-config snmp-dca-base [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete snmp-dca-base [name]
Note: You cannot delete default monitors.
Description
You can use the snmp-dca-base component to congure a custom monitor, or you can use the default base
SNMP DCA monitor that the Local Trafc Manager provides. This type of monitor checks the performance
of a server running an SNMP agent such as UC Davis. Use this monitor only when you want the load
balancing destination to be based solely on user data, and not CPU, memory or disk use.
Examples
create snmp-dca-base my_snmp-dca-base defaults-from snmp_dca_base
Creates a monitor named my_snmp-dca-base that inherits properties from the default base SNMP DCA
monitor.
list snmp-dca-base
Displays the properties of all of the base SNMP DCA monitors.
Options
• app-service
992
LTM Monitor
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• community
Species the community name that the BIG-IP system must use to authenticate with the host server
through SNMP. The default value is public.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is snmp_dca_base.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species the frequency at which the system issues the monitor check. The default value is 10 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 30 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• user-dened
Species any user-dened command-line arguments and variables that the external program requires.
Use the following syntax to specify a user dened parameter.
modify external my_external user-dened my_param_name my_param_value
Use the following syntax to remove a user dened parameter.
modify external my_external user-dened my_param_name none
• version
Species the version of SNMP that the host server uses. The default value is none.
993
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
soap
Congures a Simple Object Access Protocol (SOAP) monitor.
Syntax
Congure the soap component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create soap [name]
modify soap [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
expect-fault [no | yes]
interval [integer]
manual-resume [enabled | disabled]
method [string]
namespace [ [name] | none]
parameter-name [ [name] | none]
parameter-type [bool | int | long | string ]
parameter-value [none | [integer] | [string] ]
password [none | [password] ]
protocol [http | https]
return-type [bool | char | double | int | long | short | string]
return-value [none | [integer] | [string] ]
soap-action [string]
time-until-up [integer]
timeout [integer]
up-interval [integer]
url-path [none | [string] ]
username [[name] | none]
edit soap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list soap
list soap [ [ [name] | [glob] | [regex] ] ... ]
show soap [ [ [name] | [glob] | [regex] ] ... ]
show running-config soap
show running-config soap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
994
LTM Monitor
Delete
delete soap [name]
Note: You cannot delete default monitors.
Description
You can use the soap component to congure a custom monitor, or you can use the default SOAP monitor
that the Local Trafc Manager provides. This type of monitor tests a Web service based on SOAP.
Examples
create soap my_soap defaults-from soap
Creates a soap monitor that inherits values from the system default SOAP monitor.
list soap
Displays the properties of all of the SOAP monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the type of monitor you want to use to create the new monitor. The default value is soap.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. Possible
values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
995
Traffic Management Shell (tmsh) Reference Guide
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• expect-fault
Species whether the value of the method option causes the monitor to expect a SOAP fault message.
The default value is no.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• method
Species the method by which the monitor contacts the resource.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• namespace
Species the name space for the Web service you are monitoring, for example, http://example.com/.
The default value is none.
• parameter-name
If the method has a parameter, species the name of that parameter. The default value is none.
• parameter-type
Species the parameter type. The default value is bool.
• parameter-value
Species the value for the parameter. The default value is none.
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• protocol
996
LTM Monitor
Species the protocol that the monitor uses to communicate with the target, http or https. The default
value is http.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• return-type
Species the type for the returned parameter. The default value is bool.
• return-value
Species the value for the returned parameter. The default value is none.
• soap-action
Species the value for the SOAPAction header. The default value is the empty string.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds. If the target responds within the set time period, it is considered up. If the target
does not respond within the set time period, it is considered down. Also, if the target responds with a
RESET packet, the system immediately ags the target as down without waiting for the timeout interval
to expire.
• url-path
Species the URL for the Web service that you are monitoring, for example, /services/myservice.aspx.
The default value is none.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• username
Species the user name if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
tcp
Congures a Transmission Control Protocol (TCP) monitor.
997
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the tcp component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create tcp [name]
modify tcp [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
ip-dscp [integer]
manual-resume [enabled | disabled]
recv [none | [string] ]
recv-disable [none | [string] ]
reverse [enabled | disabled]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
transparent [disabled | enabled]
up-interval [integer]
edit tcp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tcp
list tcp [ [ [name] | [glob] | [regex] ] ... ]
show tcp [ [ [name] | [glob] | [regex] ] ... ]
show running-config tcp
show running-config tcp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tcp [name]
Note: You cannot delete default monitors.
Description
You can use the tcp component to congure a custom monitor, or you can use the default TCP monitor that
the Local Trafc Manager provides.
998
LTM Monitor
Examples
create tcp my_tcp defaults-from tcp
Creates a monitor named my_tcp that inherits properties from the default TCP monitor.
list tcp
Displays the properties of all of the TCP monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is tcp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
999
Traffic Management Shell (tmsh) Reference Guide
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• ip-dscp
Species the differentiated services code point (DSCP). DSCP is a 6-bit value in the Differentiated
Services (DS) eld of the IP header. It can be used to specify the quality of service desired for the packet.
The valid range for this value is 0 to 63 (hex 0x0 to 0x3f). The default value is zero.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
The most common receive expressions contain a text string that is included in an HTML le on your
site. The text string can be regular text, HTML tags, or image names. If you do not specify a value for
both the send and recv options, the monitor performs a simple service check and connect only.
• recv-disable
Species a text string that the monitor looks for in the returned resource. If the text string is matched in
the returned resource, the corresponding node or pool member is marked session disabled. The default
value is none.
You specify a recv-disable string in the same way that you specify a recv string.
1000
LTM Monitor
If you specify a recv-disable string, you must also specify a recv string. You cannot specify a
recv-disable string, if the reverse option is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object. The default setting is GET /, which
retrieves a default HTML le for a web site.
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if not null.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
1001
Traffic Management Shell (tmsh) Reference Guide
tcp-echo
Congures a Transmission Control Protocol (TCP) Echo monitor.
Syntax
Congure the tcp-echo component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create tcp-echo [name]
modify tcp-echo [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address]
interval [integer]
manual-resume [enabled | disabled]
time-until-up [integer]
timeout [integer]
transparent [disabled | enabled]
up-interval [integer]
edit tcp-echo [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tcp
list tcp [ [ [name] | [glob] | [regex] ] ... ]
show tcp [ [ [name] | [glob] | [regex] ] ... ]
show running-config tcp-echo
show running-config tcp-echo [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tcp-echo [name]
Note: You cannot delete default monitors.
1002
LTM Monitor
Description
You can use the tcp-echo component to congure a custom monitor, or you can use the default TCP Echo
monitor that the Local Trafc Manager provides. This type of monitor checks the status of a resource, using
TCP Echo.
Examples
create tcp-echo my_tcp-echo defaults-from tcp_echo
Creates a monitor named my_tcp-echo that inherits properties from the default TCP Echo monitor.
list tcp-echo
Displays the properties of all of the TCP Echo monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is tcp_echo.
• description
User dened description.
• destination
Species the IP address of the resource that is the destination of this monitor. The default value is *.
1003
Traffic Management Shell (tmsh) Reference Guide
Possible values are:
• *
Species to perform a health check on the IP address of the node.
• IP address
Species to perform a health check on the IP address that you specify, and mark the associated node
up or down accordingly.
• IP address (with the transparent option enabled)
Species to perform a health check on the IP address that you specify, route the check through the
IP address of the associated node, and mark the IP address of the associated node up or down
accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
1004
LTM Monitor
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
tcp-half-open
Congures a Transmission Control Protocol (TCP) Half Open monitor.
Syntax
Congure the tcp-half-open component within the ltm monitor module using the syntax in the following
sections.
Create/Modify
create tcp-half-open [name]
modify tcp-half-open [name]
app-service [[string] | none]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
time-until-up [integer]
timeout [integer]
transparent [disabled | enabled]
up-interval [integer]
edit tcp-half-open [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tcp-half-open
list tcp-half-open [ [ [name] | [glob] | [regex] ] ... ]
show tcp-half-open [ [ [name] | [glob] | [regex] ] ... ]
show running-config tcp-half-open
1005
Traffic Management Shell (tmsh) Reference Guide
show running-config tcp-half-open [ [ [name] | [glob] |
[regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tcp-half-open [name]
Note: You cannot delete default monitors.
Description
You can use the tcp-half-open component to congure a custom monitor, or you can use the default TCP
Half Open monitor that the Local Trafc Manager provides.
For more information about conguring monitors, refer to the Conguration Guide for BIG-IP(r) Local
Trafc Manager(r).
Examples
create tcp-half-open my_tcp-half-open defaults-from tcp_half_open
Creates a monitor named my_tcp-half-open that inherits properties from the default TCP Half Open monitor.
list tcp-half-open
Displays the properties of all of the TCP Half Open monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is tcp_half_open.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
1006
LTM Monitor
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
1007
Traffic Management Shell (tmsh) Reference Guide
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
udp
Congures a User Datagram Protocol (UDP) monitor.
Syntax
Congure the udp component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create udp [name]
modify udp [name]
adaptive [enabled | disabled]
adaptive-divergence-type [relative | absolute]
adaptive-divergence-value [integer]
adaptive-limit [integer]
adaptive-sampling-timespan [integer]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
interval [integer]
manual-resume [enabled | disabled]
recv [none | [string] ]
recv-disable [none | [string] ]
reverse [enabled | disabled]
send [none | [string] ]
time-until-up [integer]
timeout [integer]
transparent [disabled | enabled]
up-interval [integer]
edit udp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1008
LTM Monitor
Display
list udp
list udp [ [ [name] | [glob] | [regex] ] ... ]
show udp [ [ [name] | [glob] | [regex] ] ... ]
show running-config udp
show running-config udp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete udp [name]
Note: You cannot delete default monitors.
Description
You can use the udp component to congure a custom monitor, or you can use the default UDP monitor
that the Local Trafc Manager provides. This type of monitor veries the UDP service by attempting to
send UDP packets to a pool, pool member, or virtual server and receiving a reply.
Examples
create udp my_udp defaults-from udp
Creates a monitor named my_udp that inherits properties from the default UDP monitor.
list udp
Displays the properties of all of the UDP monitors.
Options
• adaptive
Species whether the adaptive feature is enabled for this monitor. Not all monitors support the adaptive
feature.
• adaptive-divergence-type
Species whether the adaptive-divergence-value is relative or absolute.
• adaptive-divergence-value
Species how far from mean latency each monitor probe is allowed to be. If adaptive-divergence-type
is relative, this value is a percentage deviation from mean (e.g. 50 would indicate the probe is allowed
to exceed the mean latency by 50%.) If adaptive-divergence-type is absolute, this value is an offset from
mean in milliseconds (e.g. 250 would indicate the probe is allowed allowed to exceed the mean latency
by 250 ms.) A probe that exceeds latency is counted the same as a probe that is not received, so in the
typical scenario, it will require three missed latencies in a row to mark a pool member or node down
(i.e. a 15-second interval with a 46-second timeout, would require three missed probes before the pool
member or node would be marked down.)
• adaptive-limit
1009
Traffic Management Shell (tmsh) Reference Guide
Species the hard limit, in milliseconds, which the probe is not allowed to exceed, regardless of the
divergence value. For example, if this value is 500, then the probe latency may not exceed 500 ms even
if that would still fall within the divergence value.
• adaptive-sampling-timespan
Species the size of the sliding window, in seconds, which records probe history. For example, if this
value is 300, then a sliding window of the last ve minutes' probe history will be used for calculating
probe mean latency and standard deviation.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is udp.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. Possible
values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• IP address:port (with the transparent option enabled)
Species to perform a health check on the server at the IP address and port you specify, route the
check through the IP address and port supplied by the pool member, and mark the pool member (the
gateway) up or down accordingly.
• glob
1010
LTM Monitor
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• recv
Species the text string that the monitor looks for in the returned resource. The default value is none.
• recv-disable
Species a text string that the monitor looks for in the returned resource. If the text string is matched in
the returned resource, the corresponding node or pool member is marked session disabled. The default
value is none.
The recv-disable string may be specied the same way a recv string may be specied.
If the recv-disable string is congured, the recv string must be non-empty. The recv-disable string may
not be congured if reverse mode is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reverse
Species whether the monitor operates in reverse mode. When the monitor is in reverse mode, a successful
check marks the monitored object down instead of up. You can use the this mode only if you congure
both the send and recv options.
The default value is disabled, which species that the monitor does not operate in reverse mode. The
enabled value species that the monitor operates in reverse mode.
• send
Species the text string that the monitor sends to the target object. The default value is GET /, which
retrieves a default HTML le for a web site.
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
1011
Traffic Management Shell (tmsh) Reference Guide
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if it is not null. The default value is
none.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds. If the target responds within the set time period, it is considered up. If the target
does not respond within the set time period, it is considered down. Also, if the target responds with a
RESET packet, the system immediately ags the target as down without waiting for the timeout interval
to expire.
• transparent
Species whether the monitor operates in transparent mode. Monitors in transparent mode can monitor
pool members through rewalls. The default value is disabled.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
virtual-location
Congures a Virtual Location monitor.
Syntax
Congure the virtual-location component within the ltm monitor module using the syntax shown in the
following sections.
Create/Modify
create virtual-location [name]
modify virtual-location [name]
app-service [[string] | none]
debug [no | yes]
defaults-from [name]
description [string]
interval [integer]
pool [name]
time-until-up [integer]
1012
LTM Monitor
timeout [integer]
up-interval [integer]
edit virtual-location [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list virtual-location
list virtual-location [ [ [name] | [glob] | [regex] ] ... ]
show virtual-location [ [ [name] | [glob] | [regex] ] ... ]
show running-config virtual-location
show running-config virtual-location
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete virtual-location [name]
Note: You cannot delete default monitors.
Description
The Virtual Location monitor will determine if a pool member which has a virtual IP is currently a local
pool member with its arp entry existing on a local VLAN, or, a remote pool member with its ARP entry
existing on a tunnel VLAN. If the pool member is local it will set the pool member's priority to 2. If the
pool member is remote it will set the priority to 1 (a lower priority). The Virtual Location will always return
up as the availability for the pool member. It is necessary to use an additional monitor to check the availability
status of the pool member.
You can use the virtual-location component to congure a custom monitor, or you can use the default
Virtual Location monitor that the Local Trafc Manager provides.
Examples
create virtual-location my_virtual-location defaults-from virtual_location pool aPool
Creates a monitor named my_virtual-location that inherits properties from the default Virtual Location
monitor.
list virtual-location
Displays the properties of all of the Virtual Location monitors.
Options
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
1013
Traffic Management Shell (tmsh) Reference Guide
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. The default setting is no. You can use the log information to help
diagnose and troubleshoot unsuccessful health checks. The options are no (species that the system
does not redirect error messages and additional information related to this monitor.) and yes (species
that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.)
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is virtual_location.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 5 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• pool
Species the pool for the target pool member. This is a required argument.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
1014
LTM Monitor
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
See Also
create, delete, edit, glob, list, ltm pool, modify, regex, tmsh
wap
Congures a Wireless Application Protocol (WAP) monitor.
Syntax
Congure the wap component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create wap [name]
modify wap [name]
accounting-node [none | [RADIUS server name] ]
accounting-port [[integer] | none]
app-service [[string] | none]
call-id [none | [RADIUS server 11 digit phone number] ]
debug [no | yes]
defaults-from [name]
description [string]
destination [ip address][port]
framed-address [none | [RADIUS framed IP address] ]
interval [integer]
manual-resume [enabled | disabled]
recv [none | [string] ]
secret [none | [password] ]
send [none | [string]]
server-id [none | [RADIUS NAS-ID] ]
session-id [none | [RADIUS session ID] ]
time-until-up [integer]
timeout [integer]
up-interval [integer]
edit wap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list wap
list wap[ [ [name] | [glob] | [regex] ] ... ]
show wap[ [ [name] | [glob] | [regex] ] ... ]
1015
Traffic Management Shell (tmsh) Reference Guide
show running-config wap
show running-config wap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete wap [name]
Note: You cannot delete default monitors.
Description
You can use the wap component to congure a custom monitor, or you can use the default WAP monitor
that the Local Trafc Manager provides. This type of monitor requests the URL specied in the send option,
and nds the string specied in the recv option somewhere in the data returned by the URL response.
Examples
create wap my_wap defaults-from wap
Creates a monitor named my_wap that inherits properties from the default WAP monitor.
list wap
Displays the properties of all of the WAP monitors.
Options
• accounting-node
Species the RADIUS server that provides authentication for the WAP target. Note that if you congure
the accounting-port option, but you do not congure the this option, the system assumes that the
RADIUS server and the WAP server are the same system.
• accounting-port
Species the port that the monitor uses for RADIUS accounting. The default value is none. A value of
0 (zero) disables RADIUS accounting.
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• call-id
Species the 11-digit phone number for the RADIUS server. The default value is none.
• debug
Species whether the monitor sends error messages and additional information to a log le created and
labeled specically for this monitor. You can use the log information to help diagnose and troubleshoot
unsuccessful health checks. The default value is no.
The options are:
• no
1016
LTM Monitor
Species that the system does not redirect error messages and additional information related to this
monitor.
• yes
Species that the system redirects error messages and additional information to the
/var/log/monitors/<monitor_name>-<node_name>-<port>.log le.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is wap.
• description
User dened description.
• destination
Species the IP address and service port of the resource that is the destination of this monitor. The
default value is *:*.
Possible values are:
• *:*
Species to perform a health check on the IP address and port supplied by a pool member.
• *:port
Species to perform a health check on the server with the IP address supplied by the pool member
and the port you specify.
• IP address:port
Species to mark a pool member up or down based on the response of the server at the IP address
and port you specify.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• framed-address
Species the RADIUS framed IP address. The default value is none.
• interval
Species, in seconds, the frequency at which the system issues the monitor check when either the resource
is down or the status of the resource is unknown. The default value is 10 seconds.
Important: F5 Networks recommends that when you congure this option and the up-interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
• manual-resume
Species whether the system automatically changes the status of a resource to up at the next successful
monitor check. The default value of the manual-resume option is disabled.
Note that if you set the manual-resume option to enabled, you must manually mark the resource as up
before the system can use it for load balancing connections.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
1017
Traffic Management Shell (tmsh) Reference Guide
• partition
Displays the administrative partition within which the component resides.
• recv
Species the text string that the monitor looks for in the returned resource. The most common receive
expressions contain a text string that is included in an HTML le on your site. The text string can be
regular text, HTML tags, or image names. If you do not specify both a value for both the send and recv
options, the monitor performs a simple service check and connect only. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• secret
Species the password the monitor needs to access the resource. The default value is none.
• send
Species the text string that the monitor sends to the target object. The default setting is GET /, which
retrieves a default HTML le for a web site.
To retrieve a specic page from a web site, specify a fully-qualied path name, for example, GET
/www/company/index.html. Since the string may have special characters, the system may require that
the string be enclosed with single quotation marks.
If this value is null, then a valid connection sufces to determine that the service is up. In this case, the
system does not need the recv option and ignores the option even if it is not null. The default value is
none.
• server-id
Species the RADIUS NAS-ID for this system when conguring a RADIUS server. The default value
is none.
• session-id
Species the RADIUS session identication number when conguring a RADIUS server. The default
value is none.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 31 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• up-interval
Species, in seconds, the frequency at which the system issues the monitor check when the resource is
up. The default value is 0 (zero), which species that the system uses the value of the interval option
whether the resource is up or down.
Important: F5 Networks recommends that when you congure this option and the interval option,
whichever value is greater be a multiple of the lesser value to allow for an even distribution of monitor
checks among all monitors.
1018
LTM Monitor
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
wmi
Congures a Windows Management Infrastructure (WMI) monitor.
Syntax
Congure the wmi component within the ltm monitor module using the syntax in the following sections.
Create/Modify
create wmi [name]
modify wmi [name]
agent [string]
app-service [[string] | none]
command [ [command] | none ]
defaults-from [name]
description [string]
interval [integer]
metrics [ [value] | none]
password [none | [password] ]
time-until-up [integer]
timeout [integer]
url [none | [URL] ]
username [ [name] | none]
edit wmi [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list wmi
list wmi [ [ [name] | [glob] | [regex] ] ... ]
show wmi [ [ [name] | [glob] | [regex] ] ... ]
show running-config wmi
show running-config wmi [ [ [name] | [glob] | [regex] ] ... ]
agent
all-properties
method
non-default-properties
one-line
partition
post
Delete
delete wmi [name]
1019
Traffic Management Shell (tmsh) Reference Guide
Note: You cannot delete default monitors.
Description
You can use the wmi component to congure a custom monitor, or you can use the default WMI monitor
that the Local Trafc Manager provides. This type of monitor checks the performance of a pool, pool
member, or virtual server that is running the WMI data collection agent, and then dynamically load balances
trafc accordingly.
Examples
create wmi my_wmi defaults-from wmi
Creates a monitor named my_wmi that inherits properties from the default WMI monitor.
list wmi
Displays the properties of all of the WMI monitors.
Options
• agent
Displays the agent for the monitor. The default agent is Mozilla/4.0 (compatible: MSIE 5.0; Windows
NT).
• app-service
Species the name of the application service to which the monitor belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the monitor. Only the application service can modify or delete the monitor.
• command
Species the command that the system uses to obtain the metrics from the resource. See the documentation
for this resource for information on available commands.
• defaults-from
Species the name of the monitor from which you want your custom monitor to inherit settings. The
default value is wmi.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interval
Species the frequency at which the system issues the monitor check. The default value is 5 seconds.
• method
Displays the GET method. You cannot modify the method.
• metrics
Species the performance metrics that the commands collect from the target. The default value is
LoadPercentage, DiskUsage, PhysicalMemoryUsage:1.5, VirtualMemoryUsage:2.0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
1020
LTM Monitor
• partition
Displays the administrative partition within which the component resides.
• password
Species the password if the monitored target requires authentication. The default value is none.
• post
Species the mechanism that the monitor uses for posting. The default value is RespFormat=HTML.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• time-until-up
Species the amount of time, in seconds, after the rst successful response before a node is marked up.
A value of 0 (zero) causes a node to be marked up immediately after a valid response is received from
the node. The default value is 0 (zero).
• timeout
Species the number of seconds the target has in which to respond to the monitor request. The default
value is 16 seconds.
If the target responds within the set time period, it is considered up. If the target does not respond within
the set time period, it is considered down. Also, if the target responds with a RESET packet, the system
immediately ags the target as down without waiting for the timeout interval to expire.
• url
Species the URL that the monitor uses. The default value is /scripts/f5Isapi.dll.
• username
Species the user name if the monitored target requires authentication. The default value is none.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
1021
Traffic Management Shell (tmsh) Reference Guide
LTM Persistence
cookie
Congures a cookie persistence prole.
Syntax
Congure the cookie component within the ltm persistence module using the syntax in the following
sections.
Modify
create cookie [name]
modify cookie [name]
all
always-send [enabled | disabled]
app-service [[string] | none]
cookie-name [ [name] | none]
cookie-encryption [required | preferred | disabled]
cookie-encryption-passphrase [string | none]
defaults-from [name]
description [string]
expiration [ [d:h:m:s] | [h:m:s] | [m:s] | [seconds]
| "session cookie"]
httponly [enabled | disabled]
secure [enabled | disabled]
hash-length [integer]
hash-offset [integer]
match-across-pools [enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
method [hash | insert | passive | rewrite]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
timeout [indefinite | [integer] ]
edit cookie [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv cookie [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Display
list cookie
list cookie [ [ [name] | [glob] | [regex] ] ... ]
show running-config cookie
show running-config cookie [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete cookie [name]
all
Description
You can use the cookie component to congure cookie persistence for the BIG-IP(r) system. Cookie
persistence uses an HTTP cookie stored on a client's computer to allow the client to connect to the same
server previously visited at a web site.
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole avoids having to write an iRule to implement a type of persistence. You can
either use the default prole, or create a custom prole based on the default.
Examples
list cookie
Displays all cookie persistence proles.
create cookie cookie_persistence defaults-from cookie
Creates a custom cookie persistence prole named cookie_persistence that inherits its settings from the
default cookie persistence prole.
mv cookie /Common/my_cookie_prole to-folder /Common/my_folder
Moves a custom cookie persistence prole named my_cookie_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• always-send
Send the cookie persistence entry on every reply, even if the entry has previously been supplied to the
client. The default value is disabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• cookie-name
Species a unique name for the cookie. This option is required.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is cookie, the system default cookie persistence prole.
• description
User dened description.
1024
LTM Persistence
• cookie-encryption
Species the way in which cookie format will be used: disabled: generate old format,unencrypted,
preferred: generate encrypted cookie but accept both encrypted and old format, and required: cookie
format must be encrypted. Default is required.
• cookie-encryption-passphrase
Species a passphrase to be used for cookie encryption.
• expiration
Species the cookie expiration date in the format d:h:m:s, h:m:s, m:s or seconds. (hours 0-23, minutes
0-59, seconds 0-59). The time period must be less than 24856 days.
You can use "session-cookie" (0 seconds) to indicate that the cookie expires when the browser closes.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• httponly
Species whether the httponly attribute should be enabled or disabled for the inserted cookies. The
default value is enabled.
• secure
Species whether the secure attribute should be enabled or disabled for the inserted cookies. The default
value is enabled.
• hash-length
Species the cookie hash length. The length is the number of bytes to use when calculating the hash
value. The default value is 0 (zero) bytes.
• hash-offset
Species the cookie hash offset. The offset is the number of bytes in the cookie to skip before calculating
the hash value. The default value is 0 (zero) bytes.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• method
Species the type of cookie processing that the system uses. The default value is insert.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. This option is
applicable only when the value of the method option is hash. The default value is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
1025
Traffic Management Shell (tmsh) Reference Guide
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the duration of the persistence entries. The default value is 0 (zero) seconds.
• to-folder
cookie persistence proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
dest-addr
Congures a destination address afnity persistence prole.
Syntax
Congure the dest-addr component within the ltm persistence module using the syntax in the following
sections.
Modify
create dest-addr [name]
modify dest-addr [name]
all
app-service [[string] | none]
defaults-from [name]
description [string]
hash-algorithm [carp | default]
mask [ [ip address] | none]
match-across-pools [ enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
timeout [integer]
edit dest-addr [ [ [name] | [glob] | [regex] ] ... ]
1026
LTM Persistence
all-properties
non-default-properties
mv dest-addr [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Display
list dest-addr
list dest-addr [ [ [name] | [glob] | [regex] ] ... ]
show running-config dest-addr
show running-config dest-addr [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete dest-addr [name]
all
Description
You can use the dest-addr component to congure a destination address afnity persistence prole for the
BIG-IP(r) system. Also known as sticky persistence, destination address afnity persistence supports TCP
and UDP protocols, and directs session requests to the same server based solely on the destination IP address
of a packet.
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have to write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
Examples
list dest-addr
Displays all destination address afnity persistence proles.
create dest-addr da_persistence defaults-from dest-addr
Creates a custom destination address afnity persistence prole named da_persistence that inherits its
settings from the default destination address afnity persistence prole.
mv dest-addr /Common/my_dest-addr_prole to-folder /Common/my_folder
Moves a custom destination address persistence prole named my_dest-addr_prole to a folder named
my_folder, where my_folder has already been created and exists within /Common.
Options
• app-service
1027
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is dest_addr, the system default destination address afnity persistence prole.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hash-algorithm
Species the system uses hash persistence load balancing. The default value is default (no hash
persistence).
The options are:
• carp
Species to use the Cache Array Routing Protocol (CARP) to select the pool member for LB. The
input to CARP is the hash value of destination address.
• default
no hash persistence.
• mask
Species an IP mask. This is the mask used by simple persistence for connections. The default value is
::.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
1028
LTM Persistence
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the duration of the persistence entries. The default value is 180 seconds.
• to-folder
dest-addr persistence proles can be moved to any folder under /Common, but conguration
dependencies may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
global-settings
Congures persistence for the BIG-IP(r) system.
Syntax
Congure the global-settings component within the ltm persistence module using the syntax in the following
sections.
Modify
modify global-settings [option name]
description [string]
dest-addr-limit-mode [timeout | maxcount]
dest-addr-max [integer]
proxy-group [string]
edit global-settings [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list global-settings
list global-settings [ [ [name] | [glob] | [regex] ] ... ]
show running-config global-settings
show running-config global-settings
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
1029
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the global-settings component within the ltm persistence module to congure persistence for
the system.
For information about conguring session persistence for a virtual server, see the man pages for the following
components: ltm persistence hash, ltm persistence msrdp, ltm persistence sip, ltm persistence
source-addr, ltm persistence ssl, and ltm persistence universal.
Examples
list global-settings
Displays the global persistence conguration.
modify global-settings dest-addr-limit-mode maxcount
Sets the value of the option dest-addr-limit-mode to maxcount, which indicates that a persistence session
is limited by the maximum number of requests to the destination address.
Options
• description
User dened description.
• dest-addr-limit-mode
Species that a persistence session is limited by either the number of seconds before the persistence
entry times out, or by a maximum number of requests to the destination address. The default value is
timeout.
• dest-addr-max
Species the maximum number of entries that the persistence table can contain at any one time, when
the value of the option dest-addr-limit-mode is maxcount. The default value is 2048 entries.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• proxy-group
Species a group of servers that are congured to process all of the requests from a single source address
during a persistence session. The default value is aol.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
list, ltm virtual, modify, regex, show, tmsh
hash
Congures a hash persistence prole.
1030
LTM Persistence
Syntax
Congure the hash component within the ltm persistence module using the syntax in the following sections.
Modify
create hash [name]
modify hash [name]
all
app-service [[string] | none]
defaults-from [name]
description [string]
hash-algorithm [carp | default]
hash-buffer-limit [integer]
hash-end-pattern [none | [string] ]
hash-length [integer]
hash-offset [integer]
hash-start-pattern [none | [string] ]
match-across-pools [enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
rule [iRule name]
timeout [integer]
edit hash [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv hash [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list hash
list hash [ [ [name] | [glob] | [regex] ] ... ]
show running-config hash
show running-config hash [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete hash [name]
all
Description
You can use the hash component to congure a hash persistence prole for the BIG-IP(r) system. Hash
persistence can also be activated from an existing iRule.
1031
Traffic Management Shell (tmsh) Reference Guide
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have to write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
Examples
list hash
Displays all hash persistence proles.
create hash hash_persistence defaults-from hash
Creates a custom hash persistence prole named hash_persistence that inherits its settings from the default
hash persistence prole.
mv hash /Common/my_hash_prole to-folder /Common/my_folder
Moves a custom hash persistence prole named my_hash_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is hash, the system default cookie persistence prole.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hash-algorithm
Species the algorithm the system uses for hash persistence load balancing. The default value is default.
The options are:
• carp
Species to use the Cache Array Routing Protocol (CARP) to select the pool member for LB.
• default
Species to use indexing of pool members to select the pool member for LB.
• hash-buffer-limit
Species the maximum buffer length the system collects to locate the hashing pattern for hash persistence
load balancing. The default value is 0 (zero).
• hash-end-pattern
Species the string that describes the ending location of the hash pattern that the system uses to perform
hash persistence load balancing. The default value is none.
• hash-length
1032
LTM Persistence
Species the length of data within the packet in bytes that the system uses to calculate the hash value
when performing hash persistence load balancing. The default value is 0 (zero) bytes.
• hash-offset
Species the start offset within the packet from which the system begins the hash when performing hash
persistence load balancing. The default value is 0 (zero).
• hash-start-pattern
Species the string that describes the start location of the hash pattern that the system uses to perform
hash persistence load balancing. The default value is none.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rule
Species a rule name, if you are using a rule for universal persistence.
• timeout
Species the duration of the persistence entries. The default value is 180 seconds.
• to-folder
hash persistence proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
1033
Traffic Management Shell (tmsh) Reference Guide
msrdp
Congures a Microsoft(r) Remote Display Protocol (MSRDP) persistence prole.
Syntax
Congure the msrdp component within the ltm persistence module using the syntax in the following
sections.
Modify
create msrdp [name]
modify msrdp [name]
all
app-service [[string] | none]
defaults-from [name]
description [string]
has-session-dir [no | yes]
match-across-pools [enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
timeout [integer]
edit msrdp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv msrdp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list msrdp
list msrdp [ [ [name] | [glob] | [regex] ] ... ]
show running-config msrdp
show running-config msrdp [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete msrdp [name]
all
1034
LTM Persistence
Description
You can use the msrdp component to congure an MSRDP persistence prole for the BIG-IP(r) system.
MSRDP persistence provides an efcient way of load balancing trafc and maintaining persistent sessions
between Windows clients and servers that are running the Microsoft Terminal Services service. The
recommended scenario for enabling the MSRDP persistence feature is to create a load balancing pool that
consists of members running Windows .NET Server 2003, Enterprise Edition, or later, where all members
belong to a Windows cluster and participate in a Windows session directory.
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
Examples
list msrdp
Displays all MSRDP persistence proles.
create msrdp msrdp_persistence defaults-from msrdp
Creates a custom MSRDP persistence prole named msrdp_persistence that inherits its settings from the
default MSRDP persistence prole
mv msrdp /Common/my_msrdp_prole to-folder /Common/my_folder
Moves a custom MSRDP persistence prole named my_msrdp_prole to a folder named my_folder,
where my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is msrdp, the system default cookie persistence prole.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• has-session-dir
Species whether the Microsoft terminal services are congured with a session directory, so the system
does not load balance the initial connection. The default value is yes.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
1035
Traffic Management Shell (tmsh) Reference Guide
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the duration of the persistence entries. The default value is 300 seconds.
• to-folder
msrdp persistence proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
persist-records
Displays or deletes persistence records.
Syntax
Congure the persist-records component within the ltm persistence module using the syntax in the
following sections.
Display
show persist-records
client-addr [ip address]
key [string]
mode [cookie | destination-address | hash | msrdp | sip |
source-address | ssl-session-id | universal]
node-addr [ip address]
node-port [integer]
pool [string]
1036
LTM Persistence
save-to-file [ filename ]
virtual [string]
Delete
delete persist-records
client-addr [ip address]
key [string]
mode [cookie | destination-address | hash | msrdp | sip |
source-address | ssl-session-id | universal]
node-addr [ip address]
node-port [integer]
pool [string]
virtual [string]
Description
You can use the persist-records component to either display or delete records of persistent connections.
Examples
show persist-records
Displays all persistent connections on the BIG-IP(r) system.
delete persist-records client-addr 172.19.255.1
Deletes all persistent connections that originate from the client IP address, 172.19.255.1.
Options
• client-addr
Species the IP address of the client from which the persistent connections you want to view or delete
persist.
• key
Species a string that the system is using to persist the connections you want to view or delete.
• mode
Species the type of persistence of the connections you want to view or delete. The options are:
• cookie
Cookie persistence uses an HTTP cookie stored on a client's computer to allow the client to connect
to the same server previously visited at a web site.
• destination-address
Also known as sticky persistence, destination address afnity persistence supports TCP and UDP
protocols, and directs session requests to the same server based solely on the destination IP address
of a packet.
• hash
Hash persistence is based on an existing iRule.
• msrdp
MSRDP persistence provides an efcient way of load balancing trafc and maintaining persistent
sessions between Windows(r) clients and servers that are running the Microsoft(r) Terminal Services
service. The recommended scenario for enabling the MSRDP persistence feature is to create a load
balancing pool that consists of members running Windows .NET Server 2003, Enterprise Edition,
1037
Traffic Management Shell (tmsh) Reference Guide
or later, where all members belong to a Windows cluster and participate in a Windows session
directory.
• sip
Session Initiation Protocol (SIP) persistence is a type of persistence available for server pools. You
can congure SIP persistence for proxy servers that receive SIP messages sent through UDP. The
BIG-IP system currently supports persistence for SIP messages sent through UDP, TCP, or SCTP.
• source-address
Also known as simple persistence, source address afnity persistence supports TCP and UDP
protocols, and directs session requests to the same server based solely on the source IP address of a
packet. When you specify a source address as the mode of persistence, you must specify an IP address
using the client-addr option.
• ssl-session-id
SSL persistence is a type of persistence that tracks non-terminated SSL sessions, using the SSL
session ID. Even when the client's IP address changes, the system still recognizes the connection as
being persistent based on the session ID. Note that the term, non-terminated SSL sessions, refers to
sessions in which the system does not perform the tasks of SSL certicate authentication and
encryption/re-encryption.
• universal
Universal persistence allows you to write an expression that denes what to persist on in a packet.
The expression, written using the same expression syntax that you use in iRules(r), denes some
sequence of bytes to use as a session identier.
• node-addr
Species the IP address of the node with which the client sessions that you want to view or delete remain
persistent.
• node-port
Species the port number of the node with which the client sessions that you want to view or delete
remain persistent.
• pool
Species the pool member with which the client sessions that you want to view or delete remain persistent.
• save-to-le
Species the le which persist-records information can be save to. With this option, it can write a le
larger than 2GB.
• virtual
Species the virtual server with which the client sessions that you want to view or delete remain persistent.
See Also
delete, show, tmsh
sip
Congures a Session Initiation Protocol (SIP) persistence prole.
1038
LTM Persistence
Syntax
Congure the sip component within the ltm persistence module using the syntax in the following sections.
Modify
create sip [name]
modify sip [name]
all
app-service [[string] | none]
defaults-from [name]
description [string]
match-across-pools [ enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
sip-info [Call-ID | From | none | SIP-ETag | Subject | To]
timeout [integer]
edit sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv sip [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list sip
list sip [ [ [name] | [glob] | [regex] ] ... ]
show running-config sip
show running-config sip [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete sip [name]
all
Description
You can use the sip component to congure a SIP persistence prole for the BIG-IP(r) system. SIP persistence
is a type of persistence available for server pools. You can congure SIP persistence for proxy servers that
receive SIP messages sent through UDP. The BIG-IP system currently supports persistence for SIP messages
sent through UDP, TCP, or SCTP.
1039
Traffic Management Shell (tmsh) Reference Guide
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
Examples
list sip
Displays all SIP persistence proles.
create sip sip_persistence defaults-from sip_info
Creates a custom SIP persistence prole named sip_persistence that inherits its settings from the default
SIP persistence prole.
mv sip /Common/my_sip_prole to-folder /Common/my_folder
Moves a custom SIP persistence prole named my_sip_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is sip_info, the system default cookie persistence prole.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
1040
LTM Persistence
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• sip-info
Species the SIP header eld on which you want SIP sessions to persist. The default value is none.
• timeout
Species the duration of the persistence entries. The default value is 180 seconds.
• to-folder
sip persistence proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
source-addr
Congures a source address afnity persistence prole.
Syntax
Congure the source-addr component within the ltm persistence module using the syntax in the following
sections.
Modify
create source-addr [name]
modify source-addr [name]
all
app-service [[string] | none]
defaults-from [name]
description [string]
map-proxies [enabled | disabled]
map-proxy-address [ip address]
map-proxy-class [class name]
hash-algorithm [carp | default]
mask [ [ip address] | none]
match-across-pools [enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
mirror [enabled | disabled]
1041
Traffic Management Shell (tmsh) Reference Guide
override-connection-limit [enabled | disabled]
timeout [integer]
edit source-addr [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv source-addr [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Display
list source-addr
list source-addr[ [ [name] | [glob] | [regex] ] ... ]
show running-config source-addr
show running-config source-addr[ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete source-addr [name]
all
Description
You can use the source-addr component to congure a source address afnity persistence prole for the
BIG-IP(r) system. Also known as simple persistence, source address afnity persistence supports TCP and
UDP protocols, and directs session requests to the same server based solely on the source IP address of a
packet.
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have to write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
Examples
list source-addr
Displays all source address afnity persistence proles.
create source-addr simple_persistence defaults-from source_addr
Creates a custom source address afnity persistence prole named simple_persistence that inherits its
settings from the default source address afnity persistence prole.
mv source-addr /Common/my_source-addr_prole to-folder /Common/my_folder
Moves a custom source address persistence prole named my_source-addr_prole to a folder named
my_folder, where my_folder has already been created and exists within /Common.
1042
LTM Persistence
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is source_addr, the system default cookie persistence prole.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hash-algorithm
Species the system uses hash persistence load balancing. The default value is default (no hash
persistence).
The options are:
• carp
Species to use the Cache Array Routing Protocol (CARP) to select the pool member for LB. The
input to CARP is the hash value of source address.
• default
no hash persistence.
• map-proxies
Enables or disables the map proxies attribute. The default value is disabled.
This attribute controls whether a source address will rst be checked against an IP data-group/class to
determine whether it is a well-known proxy address. If it matches the IP class, then the source address
will be mapped to a single IP address for the purposes of persistence. The default well known proxy
class is based on a pre-dened data-group "aol" which represents the AOL(r) company's
previously-published list of proxies. Using this feature enables you to use client/source IP address
persistence with a simple persist mask, but forces all clients matching the IP class to persist to the same
server. The IP data-group/class may also be changed using either the map-proxy-class prole attribute
or globally by changing the DB variable Persist.WellKnownProxyClass. Also, the IP address used for
mapping a single source IP address for persistence may also be specically set using the
map-proxy-address prole attribute.
• map-proxy-address
Species the single IP address to use when the source address matches the proxy data-group/class. The
default value is any which results in the default behavior of using one of the IP addresses from the proxy
data-group/class. Note: This mapped IP address does not have to be contained in the IP data-group/class.
It may actually be any IP address since it is only used for keying the persistence record.
• map-proxy-class
Species the data-group/class to use for determining whether a source address is from a proxy. The
default value is none which will result in map_proxies using the class dened by the DB variable
Persist.WellKnownProxyClass.
• mask
1043
Traffic Management Shell (tmsh) Reference Guide
Species an IP mask. This is the mask used by simple persistence for connections. The default value is
::.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the duration of the persistence entries. The default value is 180 seconds.
• to-folder
source-addr persistence proles can be moved to any folder under /Common, but conguration
dependencies may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
ssl
Congures a Secure Socket Layer (SSL) persistence prole.
Syntax
Congure the ssl component within the ltm persistence module using the syntax in the following sections.
1044
LTM Persistence
Modify
create ssl [name]
modify ssl [name]
all
app-service [[string] | none]
defaults-from [name]
description [string]
match-across-pools [ enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
timeout [integer]
edit ssl [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv ssl [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list ssl
list ssl [ [ [name] | [glob] | [regex] ] ... ]
show running-config ssl
show running-config ssl [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
non-default-properties
one-line
partition
Delete
delete ssl [name]
all
Description
You can use the ssl component to congure a destination address afnity persistence prole for the BIG-IP(r)
system. SSL persistence is a type of persistence that tracks non-terminated SSL sessions, using the SSL
session ID. Even when the client's IP address changes, the system still recognizes the connection as being
persistent based on the session ID. Note that the term, non-terminated SSL sessions, refers to sessions in
which the system does not perform the tasks of SSL certicate authentication and encryption/re-encryption.
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have to write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
1045
Traffic Management Shell (tmsh) Reference Guide
Examples
list ssl
Displays all SSL persistence proles.
create ssl ssl_persistence defaults-from ssl
Creates a custom SSL persistence prole named ssl_persistence that inherits its settings from the default
SSL persistence prole.
mv ssl /Common/my_ssl_prole to-folder /Common/my_folder
Moves a custom SSL persistence prole named my_ssl_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is ssl, the system default cookie persistence prole.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
1046
LTM Persistence
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the duration of the persistence entries. The default value is 300 seconds.
• to-folder
ssl persistence proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
universal
Congures a universal persistence prole.
Syntax
Congure the universal component within the ltm persistence module using the syntax in the following
sections.
Modify
create universal [name]
modify universal [name]
app-service [[string] | none]
defaults-from [name]
description [string]
match-across-pools [enabled | disabled]
match-across-services [enabled | disabled]
match-across-virtuals [enabled | disabled]
method [hash | insert | passive | rewrite]
mirror [enabled | disabled]
override-connection-limit [enabled | disabled]
rule [ [iRule name] | none]
timeout [integer]
edit universal [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv universal [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
1047
Traffic Management Shell (tmsh) Reference Guide
Display
list universal
list universal [ [ [name] | [glob] | [regex] ] ... ]
show running-config universal
show running-config universal [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete universal [name]
Description
You can use the universal component to congure a universal persistence prole for the BIG-IP(r) system.
With universal persistence you can write an expression that denes what to persist on in a packet. The
expression, written using the same expression syntax that you use in iRules(r), denes some sequence of
bytes to use as a session identier.
A persistence prole is a prole that enables persistence when you assign the prole to a virtual server.
Using a persistence prole means that you do not have to write an iRule to implement a type of persistence.
You can either use the default prole, or create a custom prole based on the default.
Examples
list universal
Displays all universal persistence proles.
create universal uni_persistence defaults-from universal
Creates a custom universal persistence prole named uni_persistence that inherits its settings from the
default universal persistence prole.
mv universal /Common/my_universal_prole to-folder /Common/my_folder
Moves a custom universal persistence prole named my_universal_prole to a folder named my_folder,
where my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is universal, the system default cookie persistence prole.
• description
User dened description.
• glob
1048
LTM Persistence
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• match-across-pools
Species, when enabled, that the system can use any pool that contains this persistence record. The
default value is disabled.
• match-across-services
Species, when enabled, that all persistent connections from a client IP address, which go to the same
virtual IP address, also go to the same node. The default value is disabled.
• match-across-virtuals
Species, when enabled, that all persistent connections from the same client IP address go to the same
node. The default value is disabled.
• mirror
Species whether the system mirrors persistence records to the high-availability peer. The default value
is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• override-connection-limit
Species, when enabled, that the pool member connection limits are not enforced for persisted clients.
Per-virtual connection limits remain hard limits and are not disabled. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rule
Species an iRule name when you are using a rule for universal persistence.
• timeout
Species the duration of the persistence entries. The default value is 180 seconds.
• to-folder
universal persistence proles can be moved to any folder under /Common, but conguration
dependencies may restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, show, tmsh
1049
Traffic Management Shell (tmsh) Reference Guide
LTM Profile
analytics
Congures an analytics prole.
Syntax
Congure the analytics component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create analytics [name]
modify analytics [name]
alerts [none | add | delete | modify | replace-all-with] {
name [string] {
app-service [[string] | none]
granularity [application | pool-member |
virtual-server]
metric [average-page-load-time | average-request-throughput |
average-response-throughput | average-server-latency |
average-tps | max-page-load-time | max-request-throughput |
max-server-latency | max-response-throughput | max-tps]
sample-period [integer]
threshold [integer]
threshold-relation [above | below]
}
}
app-service [[string] | none]
captured-traffic-external-logging [enabled | disabled]
captured-traffic-internal-logging [enabled | disabled]
collect-page-load-time [enabled | disabled]
collect-geo [enabled | disabled]
collect-http-throughput [enabled | disabled]
collect-ip [enabled | disabled]
collect-max-tps-and-throughput [enabled | disabled]
collect-methods [enabled | disabled]
collect-response-codes [enabled | disabled]
collect-server-latency [enabled | disabled]
collect-subnets [enabled | disabled]
collect-url [enabled | disabled]
collect-user-agent [enabled | disabled]
collect-user-sessions [enabled | disabled]
collected-stats-external-logging [enabled | disabled]
collected-stats-internal-logging [enabled | disabled]
defaults-from [ analytics profile name [string] | none]
description [string]
external-logging-publisher [name]
notification-by-email [enabled | disabled]
notification-by-snmp [enabled | disabled]
notification-by-syslog [enabled | disabled]
notification-email-addresses [none | add | delete | modify |
replace-all-with] { email-address [string] }
publish-irule-statistics [enabled | disabled]
sampling [enabled | disabled]
session-cookie-security [always-secure | ssl-only | never-secure]
session-timeout-minutes [integer]
smtp-config [ smtp configuration object name ]
subnet-masks [none | add | delete | modify |
replace-all-with] {
name [string] {
subnet [IPv4/IPv6 address]
}
}
traffic-capture [none | add | delete | modify |
replace-all-with] {
name [string] {
app-service [[string] | none]
captured-protocols [all | http | https]
client-ips [none | add | delete | modify |
replace-all-with] { ipv4.address }
dos-activity [any | mitigated-by-dosl7]
methods [none | add | delete | modify |
replace-all-with] { method [string] }
node-addresses [none | add | delete | modify |
replace-all-with] { node }
request-captured-parts [all | body | headers | none]
request-content-filter-search-part [all | body | headers |
none | uri]
request-content-filter-search-string [none | [string]]
response-captured-parts [all | body | headers | none]
response-codes [none | add | delete | modify |
replace-all-with] { response-code [integer] }
response-content-filter-search-part [all | body |
headers | none]
response-content-filter-search-string [none | [string]]
url-path-prefixes [none | add | delete | modify |
replace-all-with] { url-path-prefix [string] }
user-agent-substrings [none | add | delete | modify |
replace-all-with] { user-agent-substring [string] }
virtual-servers [none | add | delete | modify |
replace-all-with] { virtual }
}
}
edit analytics [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list analytics
list analytics [ [ [name] | [glob] | [regex] ] ... ]
show running-config analytics
show running-config analytics [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete analytics [name]
1052
LTM Profile
Description
Use the analytics component to create, modify, display, or delete an analytics prole for use with analytics
functionality.
Examples
create analytics my_analytics_prole defaults-from analytics
Creates a custom analytics prole named my_analytics_prole that inherits its settings from the system
default analytics prole.
list analytics
Displays the properties of all analytics proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• alerts
Adds, deletes, or replaces a set of analytics alerts. You can congure the following options for an
analytics alert:
• app-service
Species the name of the application service to which the alert belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the alert. Only the application service can modify or delete the alert.
• granularity
Species a granularity level on which the alert is dened.
The options are:
• application
Species that an alert is triggered for applications for which a threshold is breached.
• pool-member
Species that an alert is triggered for pool members for which a threshold is breached.
• virtual-server
Species that an alert is triggered for virtual servers for which a threshold is breached.
• metric
Species a metric on which the alert is dened.
The options are:
• average-page-load-time
Species that an alert is triggered when the average time it takes for the client to respond to a
request breaches the dened threshold.
• average-request-throughput
Species that an alert is triggered when the average number of bits per second the system
processed, based on requests only, breaches the dened threshold.
• average-response-throughput
1053
Traffic Management Shell (tmsh) Reference Guide
Species that an alert is triggered when the average number of bits per second the system
processed, based on responses only, breaches the dened threshold.
• average-server-latency
Species that an alert is triggered when the average time it takes for the web server to respond
to a request breaches the dened threshold.
• average-tps
Species that an alert is triggered when the average number of transactions per second breaches
the dened threshold.
• max-page-load-time
Species that an alert is triggered when the longest time it takes for the client to respond to a
request breaches the dened threshold.
• max-request-throughput
Species that an alert is triggered when the maximum number of bits per second the system
processed, based on requests only, breaches the dened threshold.
• max-response-throughput
Species that an alert is triggered when the maximum number of bits per second the system
processed, based on requests only, breaches the dened threshold.
• max-server-latency
Species that an alert is triggered when the longest time it takes for the web server to respond
to a request breaches the dened threshold.
• max-tps
Species that an alert is triggered when the largest number of transactions per second breaches
the dened threshold.
• name
Species a unique name for an alert. This option is required for the commands create, delete, and
modify.
• sample-period
Species that the alert metric is triggered when the conditions that trigger the alert last a dened
amount of time, measured in seconds. The default value is 300.
• threshold
Species the threshold that must be breached in order for the system to generate alert.
• threshold-relation
Species whether the metric value must be below or above the metric.
The options are:
• above
Species that an alert is issued if metric current value is above the threshold.
• below
Species that an alert is issued if metric current value is below the threshold.
• captured-trafc-external-logging
Enables or disables the external logging of captured trafc.
• captured-trafc-internal-logging
1054
LTM Profile
Enables or disables the internal logging of captured trafc.
• collect-page-load-time
Enables or disables the collection of the page load time statistics. The page load time is the round-trip
latency between client end-users and the servers, that is, the round-trip time between an end-userâs
request for a page until the time the response nishes loading.
• collect-geo
Enables or disables the collection of the names of the countries from where the trafc was sent.
• collect-http-throughput
Enables or disables the collection of throughput statistics. This property has been deprecated. As of
v11.3.0, HTTP throughput is always collected.
• collect-ip
Enables or disables the collection of client IPs statistics.
• collect-max-tps-and-throughput
Enables or disables the collection of maximum TPS and throughput for all collected entities.
• collect-methods
Enables or disables the collection of HTTP methods statistics.
• collect-response-codes
Enables or disables the collection of response codes returned by the servers.
• collect-server-latency
Enables or disables the collection of server latency statistics. This property has been deprecated. As of
v11.3.0, server latency is always collected.
• collect-subnets
Enables or disables the collection of client side subnets.
• collect-url
Enables or disables the collection of requested URL statistics.
• collect-user-agent
Enables or disables the collection of user agents.
• collect-user-sessions
Enables or disables the collection of the unique user sessions.
• collected-stats-external-logging
Enables or disables the external logging of the collected statistics.
• collected-stats-internal-logging
Enables or disables the internal logging of the collected statistics.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is analytics.
• description
User dened description.
• external-logging-publisher
Species the external logging publisher used to send statistical data to one or more destinations.
• glob
1055
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• notication-by-email
Enables or disables sending the analytics alerts by email.
• notication-by-snmp
Enables or disables sending the analytics alerts by SNMP traps. notication-by-syslog must be enabled.
• notication-by-syslog
Enables or disables logging of the analytics alerts into the Syslog.
• notication-email-addresses
Species which email addresses receive alerts by email when notication-by-email is enabled.
• partition
Displays the administrative partition within which the component resides.
• publish-irule-statistics
Enables or disables publishing analytics statistics for iRules.
• sampling
Enables or disables transaction sampling. This attribute can be set in the default prole only. The default
value is disabled.
• session-cookie-security
Species the condition for adding a secure attribute to the session cookie. The options are:
• always
The secure attribute is always added to the session cookie.
• never
The secure attribute is never added to the session cookie.
• ssl-only
The secure attribute is only added to the session cookie when the virtual server has a client-SSL
prole. This is the default value.
• session-timeout-minutes
Species the number of minutes of user non-activity before the system considers the session to be over.
• smtp-cong
Species the SMTP conguration to be used with analytics.
• subnet-masks
Adds, deletes, or replaces predened subnet addresses. This options denes the display names given to
certain subnet addresses seen in the client IP subnets report.
• subnet
Subnet address. IPv4 addresses will be masked by 255.255.255.0. IPv6 addresses will be masked
by ffff:ffff:ffff:ffff:: .
• trafc-capture
1056
LTM Profile
Adds, deletes, or replaces an analytics trafc capture denition. You can congure the following options
for an analytics trafc capture:
• app-service
Species the name of the application service to which the analytics trafc capture belongs. The
default value is none. Note: If the strict-updates option is enabled on the application service that
owns the object, you cannot modify or delete the analytics trafc capture. Only the application service
can modify or delete the analytics trafc capture.
• captured-protocols
Species whether the system captures trafc data sent using all protocols, or only one type of protocol.
The options are:
• all
Species that the system captures trafc data sent using all protocols.
• http
Species that the system captures trafc data sent using http protocol.
• https
Species that the system captures trafc data sent using https protocol.
• client-ips
Adds, deletes, or replaces a set of client IP addresses from/to which captured trafc is sent.
• dos-activity
Species whether the system captures trafc data mitigated by DoS Layer 7 Enforcer or regardless
of DoS activity.
The options are:
• any
Species that system does not lter trafc data by DoS activity.
• mitigated-by-dosl7
Species that the system captures only trafc data mitigated by DoS Layer 7 Enforcer.
• methods
Adds, deletes, or replaces a set of HTTP methods used to send requests from which trafc is captured.
• name
Species a unique name for an analytics trafc capture. This option is required for the commands
create, delete, and modify.
• node-addresses
Adds, deletes, or replaces a set of node addresses from/to which captured trafc is sent.
• request-captured-parts
Species what parts of the request data the system captures.
The options are:
• all
Species that the system captures all the parts of the request data.
• body
Species that the system captures the body of the request data.
1057
Traffic Management Shell (tmsh) Reference Guide
• headers
Species that the system captures the HTTP headers of the request data.
• none
Species that the system does not capture the request data.
• request-content-lter-search-part
Species which part of the request is ltered by a specic string.
The options are:
• all
Species that the system lters all the parts of the request data.
• body
Species that the system lters the body of the request data.
• headers
Species that the system lters the HTTP headers of the request data.
• none
Species that system does not lter the request data.
• uri
Species that the system lters the URI path component, including the query string, of the request
data.
• request-content-lter-search-string
Species the string by which a request data is ltered, or none.
• response-captured-parts
Species what parts of the response data the system captures.
The options are:
• all
Species that the system captures all the parts of the response data.
• body
Species that the system captures the body of the response data.
• headers
Species that the system captures the HTTP headers of the response data.
• none
Species that the system does not capture the response data.
• response-codes
Adds, deletes, or replaces a set of HTTP response codes from which trafc is captured.
• response-content-lter-search-part
Species which part of the response is ltered by a specic string.
The options are:
• all
Species that the system lters all the parts of the response data.
1058
LTM Profile
• body
Species that the system lters the body of the response data.
• headers
Species that the system lters the HTTP headers of the response data.
• none
Species that system does not lter the response data.
• response-content-lter-search-string
Species the string by which the response data is ltered, or none.
• url-path-prexes
Adds, deletes, or replaces a set of URL path prexes on which trafc can be captured (both to and
from).
• user-agent-substrings
Adds, deletes, or replaces a set of user agent substrings on which trafc can be captured (both to and
from).
• virtual-servers
Adds, deletes, or replaces a set of virtual servers from/to which captured trafc is sent.
See Also
create, delete, edit, glob, list, ltm virtual, smtp, modify, regex, reset-stats, show, tmsh
certificate-authority
Denes the settings necessary to authenticate the client certicate.
Syntax
Congure the certicate-authority within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create certificate-authority [name]
modify certificate-authority [name]
authenticate-depth
ca-file
crl-file
default-name
description
update-crl
edit certificate-authority [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1059
Traffic Management Shell (tmsh) Reference Guide
Display
list certificate-authority
list certificate-authority [ [ [name] | [glob] | [regex] ] ... ]
app-service
partition
show certificate-authority
show certificate-authority [ [ [name] | [glob] | [regex] ] ... ]
all-properties
field-fmt
non-default-properties
one-line
Description
Use the certicate-authority component to modify or display a certicate-authority prole.
Examples
create ltm prole certicate-authority mycaprole { ca-le ca.crt }
Creates a certicate authority prole named mycaprole using the system defaults.
modify ltm prole certicate-authority mycaprole { authenticate-depth 3 }
Modies the authenticate-depth setting to 3 for the certicate authority prole named mycaprole.
Options
• app-service
Displays the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the Application Service that owns the object, you cannot
modify or delete the object. Only the Application Service can modify or delete the object.
• authenticate-depth
Species the authenticate depth. This is the client certicate chain maximum traversal depth.
• ca-le
Species the certicate authority le name or, you can use default for the default certicate authority
le name. Congures certicate verication by specifying a list of client or server certicate authorities
that the trafc management system trusts.
• crl-le
Species the certicate revocation list le name. You can use default for the default certicate revocation
le name.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied.
• description
User dened description.
• name
Species the prole instance name. This option is required for the modify command.
1060
LTM Profile
• partition
Species the administrative partition within which the prole resides.
• regex
Species the items that match the regular expression. The regular expression must be preceded by an
at sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for
a description of regular expression syntax.
• update-crl
Automatically updates the CRL le.
See Also
edit, glob, list, modify, regex, show, tmsh,
classification
Congures a classication prole.
Syntax
Congure the classication prole within the ltm prole module using the syntax shown in the following
sections.
Modify
modify classification [name]
description [string]
smtp-server [ smtp server configuration object name ]
edit classification [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list classification
list classification [ [ [name] | [glob] | [regex] ] ... ]
show running-config classification
show running-config classification [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Use the classication component to modify, or display a classication prole.
1061
Traffic Management Shell (tmsh) Reference Guide
Examples
edit classication classication
Edits the classication prole named classication.
Note: The prole name cannot be changed.
list classication
Displays the properties of the classication prole.
Options
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species the prole instance name. The name must be classication. This option is required for the
modify command.
• partition
Species the administrative partition within which the prole resides.
• regex
Species the items that match the regular expression. The regular expression must be preceded by an
at sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for
a description of regular expression syntax.
• smtp-server
Species the SMTP server conguration to be used with classication for sending reports via email.
See Also
edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, sys smtp-server
client-ldap
Congures an Client LDAP prole.
Syntax
Congure the client-ldap component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create client-ldap [name]
modify client-ldap [name]
app-service [[string] | none]
1062
LTM Profile
defaults-from [ [name] | none]
description [string]
activation-mode [ none | allow | require ]
edit client-ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list client-ldap
list client-ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config client-ldap
show running-config client-ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Delete
delete client-ldap [name]
Description
You can use the client-ldap component to create, modify, display, or delete an Client LDAP prole with
which you can manage Client LDAP trafc.
Examples
create client-ldap my_clientldap_prole defaults-from clientldap
Creates a custom Client LDAP prole named my_clientldap_prole that inherits its settings from the
system default Client LDAP prole.
list client-ldap
Displays the properties of all Client LDAP proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is smtp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
1063
Traffic Management Shell (tmsh) Reference Guide
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• activation-mode
Sets the activation-mode STARTTLS. The options are NONE, ALLOW, or REQUIRE. The default
value is REQUIRE.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, sys provision, tmsh
client-ssl
Congures a Client SSL prole.
Syntax
Congure the client-ssl component within the ltm.prole module using the syntax shown in the following
sections.
Create/Modify
create client-ssl [name]
modify client-ssl [name]
alert-timeout [indefinite | [integer] ]
allow-non-ssl [disabled | enabled]
app-service [[string] | none]
authenticate [always | once]
authenticate-depth [integer]
ca-file [name]
cache-size [integer]
cache-timeout [integer]
cert [name]
cert-extension-includes {
none |
[ authority-key-identifier basic-constraints
certificate-policies crl-distribution-points
extended-key-usage fresh-crl issuer-alternative-name
key-usage subject-alternative-name
subject-directory-attribute subject-key-identifier
]...
}
cert-key-chain [add | delete | modify | replace-all-with] {
[ [name] ] {
cert [name | none]
chain [name | none]
key [name]
passphrase [none | [string] ]
ocsp-stapling-params [name | none]
}
}
1064
LTM Profile
cert-lookup-by-ipaddr-port [disabled | enabled]
chain [name | none]
ciphers [name | none]
client-cert-ca [name | none]
crl-file [name]
allow-expired-crl [enabled | disabled]
defaults-from [clientssl | [name] ]
description [string]
destination-ip-blacklist [name]
destination-ip-whitelist [name]
forward-proxy-bypass-default-action [intercept | bypass]
handshake-timeout [indefinite | [integer] ]
hostname-blacklist [name]
hostname-whitelist [name]
key [ [name] | none]
mod-ssl-methods [disabled | enabled]
mode [disabled | enabled]
options {
none |
[ all-bugfixes cipher-server-preference
dont-insert-empty-fragments ephemeral-rsa
microsoft-big-sslv3-buffer microsoft-sess-id-bug
msie-sslv2-rsa-padding netscape-ca-dn-bug
netscape-challenge-bug netscape-demo-cipher-change-bug
netscape-reuse-cipher-change-bug no-dtls
no-session-resumption-on-renegotiation no-ssl no-sslv2 no-sslv3
no-tls no-tlsv1 no-tlsv1.1 no-tlsv1.2 passive-close
pkcs1-check-1 pkcs1-check-2 single-dh-use ssleay-080-client-dh-bug
sslref2-reuse-cert-type-bug tls-block-padding-bug tls-d5-bug
tls-rollback-bug ]...
}
passphrase [none | [string] ]
peer-cert-mode [auto | ignore | request | require]
peer-no-renegotiate-timeout [indefinite | [integer] ]
proxy-ssl [disabled | enabled]
proxy-ssl-passthrough [disabled | enabled]
proxy-ca-cert [name]
proxy-ca-key [name]
proxy-ca-lifespan [integer]
proxy-ca-passphrase [string]
renegotiate-max-record-delay [indefinite | [integer] ]
renegotiate-period [indefinite | [integer] ]
renegotiate-size [indefinite | [integer] ]
renegotiation [disabled | enabled]
retain-certificate [true | false]
secure-renegotiation [request | require | require-strict]
max-renegotiations-per-minute [integer]
max-aggregate-renegotiation-per-minute [integer]
server-name [name]
session-mirroring [disabled | enabled]
session-ticket [disabled | enabled]
session-ticket-timeout [integer]
sni-default [true | false]
sni-require [true | false]
source-ip-blacklist [name]
source-ip-whitelist [name]
ssl-forward-proxy [disabled | enabled]
ssl-forward-proxy-bypass [disabled | enabled]
strict-resume [disabled | enabled]
unclean-shutdown [disabled | enabled]
generic-alert [disabled | enabled]
ssl-sign-hash [any | sha1 | sha256 | sha384]
edit client-ssl [ [ [name] | [glob] | [regex] ] ... ]
1065
Traffic Management Shell (tmsh) Reference Guide
all-properties
non-default-properties
options:
mv client-ssl [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats client-ssl
reset-stats client-ssl [ [ [name] | [glob] | [regex] ] ... ]
Display
list client-ssl
list client-ssl [ [ [name] | [glob] | [regex] ] ... ]
show running-config client-ssl
show running-config client-ssl [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show client-ssl
show client-ssl [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete client-ssl [all | [name]]
recursive
Description
You can use the client-ssl component to create, modify, or delete a custom Client SSL prole, or display
a custom or default Client SSL prole.
Client-side proles allow the trafc management system to handle authentication and encryption tasks for
any SSL connection coming into a trafc management system from a client system.
Examples
create client-ssl my_clientssl_prole
Creates a clientssl prole named my_clientssl_prole using the system defaults.
create clientssl my_clientssl_prole authenticate-depth number
Creates a Client SSL prole named my_clientssl_prole using the system defaults, except that a user is
authenticated with depth number.
mv client-ssl /Common/my_client-ssl_prole to-folder /Common/my_folder
1066
LTM Profile
Moves a custom client-ssl prole named my_client-ssl_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common. =head1 OPTIONS
• alert-timeout
Species the maximum time period in seconds to keep the SSL session active after alert message is sent.
The default value is 10 seconds.
• allow-non-ssl
Enables or disables non-SSL connections. Specify enabled when you want non-SSL connections to
pass through the trafc management system as clear text. The default value is disabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• authenticate
Species how often the system authenticates a user. The default value is once.
• authenticate-depth
Species the authenticate depth. This is the client certicate chain maximum traversal depth. The default
value is 9.
• ca-le
Species the certicate authority (CA) le name. Congures certicate verication by specifying a list
of client or server CAs that the trafc management system trusts. The default value is none.
• cache-size
Species the SSL session cache size. For client-side proles only, you can congure timeout and size
values for the SSL session cache. Because each prole maintains a separate SSL session cache, you can
congure the values on a per-prole basis. The default value is 262144.
• cache-timeout
Species the SSL session cache timeout value. This species the number of usable lifetime seconds of
negotiated SSL session IDs. The default value is 3600 seconds. Acceptable values are integers greater
than or equal to 0 and less than or equal to 86400.
• cert
This option is deprecated and is maintained here for backward compatibility reasons. Please check
cert-key-chain option to add certicate, key, passphrase and chain to the prole.
• cert-extension-includes
Species the extensions of the web server certicates to be included in the generated certicates using
SSL Forward Proxy. For example, { basic-constraints }. The default value is none. The extensions are:
• authority-key-identier
Authority Key Identier provides a means of identifying the public key corresponding to the private
key used to sign a certicate.
• basic-constraints
Basic Constraints are used to indicate whether the certicate belongs to a CA.
• certicate-policies
Certicate Policies contain a sequence of one or more policy information terms.
• crl-distribution-points
CRL Distribution Points identify how CRL information is obtained.
1067
Traffic Management Shell (tmsh) Reference Guide
• destination-ip-blacklist
Species the data group name of destination ip blacklist when SSL forward proxy bypass feature is
enabled.
• destination-ip-whitelist
Species the data group name of destination ip whitelist when SSL forward proxy bypass feature is
enabled.
• extended-key-usage
Extended Key Usage is used, typically on a leaf certicate, to indicate the purpose of the public key
contained in the certicate.
• forward-proxy-bypass-default-action
Species the SSL forward proxy bypass default action. The default option is intercept.
• fresh-crl
Fresh CRL (a.k.a Delta CRL Distribution Point) identies how delta CRL information is obtained.
• hostname-blacklist
Species the data group name of hostname blacklist when SSL forward proxy bypass feature is
enabled.
• hostname-whitelist
Species the data group name of hostname whitelist when SSL forward proxy bypass feature is
enabled.
• issuer-alternative-name
As with subject-alternative-name, Issuer Alternative Name is used to associate Internet style
identities with the certicate issuer.
• key-usage
Key Usage provides a bitmap specifying the cryptographic operations which may be performed using
the public key contained in the certicate; for example, it could indicate that the key should be used
for signature but not for encipherment.
• subject-alternative-name
Subject Alternative Name allows identities to be bound to the subject of the certicate. These identities
may be included in addition to or in place of the identity in the subject eld of the certicate.
• subject-directory-attributes
Subject Directory Attributes are used to convey identication attributes (for example, nationality)
of the subject.
• subject-key-identier
Subject Key Identier provides a means of identifying certicates that contains a particular public
key.
• cert-key-chain
Adds, deletes, or replaces a set of certicate, key, passphrase, chain and OCSP Stapling Parameters
object. client-ssl prole requires at least one cert/key pair to work. Multiple cert/key types can be
associated to a client-ssl prole using following options:
• cert
Species the name of the certicate installed on the trafc management system for the purpose of
terminating or initiating an SSL connection. You can specify the default certicate name, which is
default.crt.
1068
LTM Profile
• chain
Species or builds a certicate chain le that a client can use to authenticate the prole. The default
value is none.
• key
Species the name of a key le that you generated and installed on the system. When selecting this
option, type a key le name or use the default value default.key.
• passphrase
Species the key passphrase, if required. The default value is none.
• ocsp-stapling-params
Species the OCSP Stapling Parameters object which will be used with this cert-key-chain object
for a client-ssl prole. The default value is none.
• cert-lifespan
Species the lifespan of the certicate generated using the SSL forward proxy feature. The default value
is 30.
• cert-lookup-by-ipaddr-port
Species whether to perform certicate look up by IP address and port number.
• chain
This option is deprecated and is maintained here for backward compatibility reasons. Please check
cert-key-chain option to add certicate, key, passphrase and chain to the prole.
• ciphers
Species a cipher name. The default value is DEFAULT, which uses the default ciphers.
• client-cert-ca
Species the client cert certicate authority name. The default value is none.
• crl-le
Species the certicate revocation list le name. The default value is none.
• allow-expired-crl
Use the specied CRL le even if it has expired. The default value is disabled.
• defaults-from
This setting species the prole that you want to use as the parent prole. Your new prole inherits all
settings and values from the parent prole specied. The default value is clientssl.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• handshake-timeout
Species the handshake timeout in seconds. The default value is 10 seconds.
• key
This option is deprecated and is maintained here for backward compatibility reasons. Please check
cert-key-chain option to add certicate, key, passphrase and chain to the prole.
• mod-ssl-methods
1069
Traffic Management Shell (tmsh) Reference Guide
Enables or disables ModSSL method emulation. Enable this option when OpenSSL methods are
inadequate, for example, when you want to use SSL compression over TLSv1. The default value is
disabled.
• mode
Species the prole mode, which enables or disables SSL processing. The default value is enabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• options
Enables options, including some industry-related workarounds. Enter options inside braces, for example,
{dont-insert-empty-fragments microsoft-sess-id-bug}.
The default value is dont-insert-empty-fragments. The options are:
• all-bugxes
This option enables the following industry-related defect workarounds: microsoft-sess-id-bug,
netscape-challenge-bug, netscape-reuse-cipher-change-bug, sslref2-reuse-cert-type-bug,
microsoft-big-sslv3-buffer, msie-sslv2-rsa-padding, ssleay-080-client-dh-bug, tls-d5-bug,
tls-block-padding-bug, and dont-insert-empty-fragments.
It is usually safe to use this option to enable the defect workaround options when compatibility with
broken implementations is desired. It is usually safe to use this option to enable the defect workaround
options when compatibility with broken implementations is desired. Note that if you edit the
conguration in the Web-based conguration utility, the system expands the all-bugxes syntax
into each individual option.
• cipher-server-preference
When choosing a cipher, this option uses the server's preferences instead of the client references. If
this option was not set, the SSL server would follow the client's references. When this option is set,
the SSLv3/TLSv1 server chooses by using its own references.
Note: This option has no effect. The BIG-IP system always behaves as if the option is active, even
when you disable it.
• dont-insert-empty-fragments
Disables a countermeasure against an SSL 3.0/TLS 1.0 protocol vulnerability affecting CBC ciphers.
These ciphers cannot be handled by certain broken SSL implementations. This option has no effect
for connections using other ciphers.
• ephemeral-rsa
Uses ephemeral (temporary) RSA keys when doing RSA operations. According to the specications,
this is done only when an RSA key can be used for signature operations only (namely under export
ciphers with restricted RSA key length). By setting this option, you specify that you want to use
ephemeral RSA keys always. This option breaks compatibility with the SSL/TLS specications and
may lead to interoperability problems with clients. Therefore, F5 Networks does not recommend
this option. Use ciphers with ephemeral Dife-Hellman (EDH) key exchange instead. This option
is ignored for server-side SSL.
• microsoft-big-sslv3-buffer
Enables a workaround for communicating with older Microsoft(r) applications that use non-standard
SSL record sizes.
• microsoft-sess-id-bug
Handles a Microsoft session ID problem.
1070
LTM Profile
• msie-sslv2-rsa-padding
Enables a workaround for communicating with older Microsoft applications that use non-standard
RSA key padding. This option is ignored for server-side SSL.
• netscape-ca-dn-bug
Handles a defect regarding the system crashing or hanging. If the system accepts a Netscape
Navigator(r) browser connection, demands a client cert, has a non-self-signed CA that does not have
its CA in Netscape, and the browser has a certicate, the system crashes or hangs.
• netscape-challenge-bug
Handles the Netscape challenge problem.
• netscape-demo-cipher-change-bug
Manipulates the SSL server session resumption behavior to mimic that of certain Netscape servers
(see the Netscape reuse cipher change bug workaround description). Note that F5 Networks does
not recommend this option for normal use. It is ignored for server-side SSL.
• netscape-reuse-cipher-change-bug
Handles a defect within Netscape-Enterprise/2.01 (https://merchant.neape.com), only appearing
when connecting through SSLv2/v3 then reconnecting through SSLv3. In this case, the cipher list
changes.
First, a connection is established with the RC4-MD5 cipher list. If it is then resumed, the connection
switches to using the DES-CBC3-SHA cipher list. However, according to RFC 2246, (section 7.4.1.3,
cipher suite) the cipher list should remain RC4-MD5.
As a workaround, you can attempt to connect with a cipher list of DES-CBC-SHA:RC4-MD5 and
so on. For some reason, each new connection uses the RC4-MD5 cipher list, but any re-connection
attempts to use the DES-CBC-SHA cipher list. Thus Netscape, when reconnecting, always uses the
rst cipher in the cipher list.
• no-session-resumption-on-renegotiation
When performing renegotiation as an SSL server, this option always starts a new session (that is,
session resumption requests are only accepted in the initial handshake). The system ignores this
option for server-side SSL.
• no-ssl
Do not use any version of the SSL protocol.
• no-sslv2
Do not use the SSLv2 protocol.
• no-sslv3
Do not use the SSLv3 protocol.
• no-tls
Do not use any version of the TLS protocol.
• no-tlsv1
Do not use the TLSv1.0 protocol.
• no-tlsv1.1
Do not use the TLSv1.1 protocol.
• no-tlsv1.2
Do not use the TLSv1.2 protocol.
• no-dtls
1071
Traffic Management Shell (tmsh) Reference Guide
Do not use any version of the DTLS protocol.
• passive-close
Species how to handle passive closes.
• none
Disables all workarounds. Note that F5 Networks does not recommend this option.
• pkcs1-check-1
This debugging option deliberately manipulates the PKCS1 padding used by SSL clients in an attempt
to detect vulnerability to particular SSL server vulnerabilities. Note that F5 Networks does not
recommend this option for normal use. The system ignores this option for client-side SSL.
• pkcs1-check-2
This debugging option deliberately manipulates the PKCS1 padding used by SSL clients in an attempt
to detect vulnerability to particular SSL server vulnerabilities. Note that F5 Networks does not
recommend this option for normal use. The system ignores this option for client-side SSL.
• single-dh-use
Creates a new key when using temporary/ephemeral DH parameters. This option must be used to
prevent small subgroup attacks, when the DH parameters were not generated using strong primes
(for example. when using DSA-parameters). If strong primes were used, it is not strictly necessary
to generate a new DH key during each handshake, but F5 Networks recommends it. Enable the Single
DH Use option whenever temporary or ephemeral DH parameters are used.
• ssleay-080-client-dh-bug
Enables a workaround for communicating with older SSLeay-based applications that specify an
incorrect Dife-Hellman public value length. This option is ignored for server-side SSL.
• sslref2-reuse-cert-type-bug
Handles the SSL reuse certicate type problem.
• tls-block-padding-bug
Enables a workaround for communicating with older TLSv1-enabled applications that use incorrect
block padding.
• tls-d5-bug
This option is a workaround for communicating with older TLSv1-enabled applications that specify
an incorrect encrypted RSA key length. This option is ignored for server-side SSL.
• tls-rollback-bug
Disables version rollback attack detection. During the client key exchange, the client must send the
same information about acceptable SSL/TLS protocol levels as it sends during the rst hello. Some
clients violate this rule by adapting to the server's answer. For example, the client sends an SSLv2
hello and accepts up to SSLv3.1 (TLSv1), but the server only processes up to SSLv3. In this case,
the client must still use the same SSLv3.1 (TLSv1) announcement. Some clients step down to SSLv3
with respect to the server's answer and violate the version rollback protection. The system ignores
this option for server-side SSL.
• partition
Displays the administrative partition within which the prole resides.
• passphrase
This option is deprecated and is maintained here for backward compatibility reasons. Please check
cert-key-chain option to add certicate, key, passphrase and chain to the prole.
• peer-cert-mode
1072
LTM Profile
Species the peer certicate mode. The default value is ignore.
• peer-no-renegotiate-timeout Species the timeout in seconds when the server sends Hello Request
and waits for ClientHello before it sends Alert with fatal alert. You can also specify indenite. The
default is 10 seconds.
• proxy-ca-cert
Species the name of the certicate le that is used as the certication authority certicate when SSL
forward proxy feature is enabled. The certicate should be generated and installed by you on the system.
When selecting this option, type a certicate le name.
• proxy-ca-key
Species the name of the key le that is used as the certication authority key when SSL forward proxy
feature is enabled. The key should be generated and installed by you on the system. When selecting this
option, type a key le name.
• proxy-ca-passphrase
Species the passphrase of the key le that is used as the certication authority key when SSL forward
proxy feature is enabled. When selecting this option, type the passphrase corresponding to the selected
proxy-ca-key.
• proxy-ssl
Enabling this option requires a corresponding server ssl prole with proxy-ssl enabled to perform
transparent SSL decryption. This allows further modication of application trafc within an SSL tunnel
while still allowing the server to perform necessary authorization, authentication, auditing steps.
• proxy-ssl-passthrough
Enabling this option requires a corresponding server ssl prole with proxy-ssl-passthrough enabled.
This allows Proxy SSL to passthrough the trafc when ciphersuite negotiated between the client and
server is not supported. The default option is disabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• renegotiate-max-record-delay
Species the maximum number of SSL records that the trafc management system can receive before
it renegotiates an SSL session. After the system receives this number of SSL records, it closes the
connection. This setting applies to client proles only. The default value is indenite.
• renegotiate-period
Species the number of seconds required to renegotiate an SSL session. The default value is indenite.
• renegotiate-size
Species the size of the application data, in megabytes, that is transmitted over the secure channel. If
the size of the data is higher than this value, the trafc management system must renegotiate the SSL
session. The default value is indenite.
• renegotiation
Species whether renegotiations are enabled. The default value is enabled. When renegotiations are
disabled, and the system is acting as an SSL server, and a COMPAT or NATIVE cipher is negotiated,
the system will abort the connection. Additionally, when renegotiations are disabled, and the system is
acting as an SSL client, the system will ignore the server's HelloRequest messages.
• retain-certicate
APM module requires storing certicate in SSL session. When set to false, certicate will not be stored
in SSL session. The default value is true.
1073
Traffic Management Shell (tmsh) Reference Guide
• generic-alert
Enables or disables generic-alert. The default option is enabled, which causes the SSL prole to use
generic alert number. Conversely, you can specify disabled to cause SSL prole to use alert number
dened in RFC5246/RFC6066 strictly.
• secure-renegotiation
Species the secure renegotiation mode. The default value is require. When secure renegotiation is
required, any client attempting to renegotiate that does not support secure renegotiation will have its
connection aborted. When secure renegotiation is set to require-strict, any client attempting to connect
that does not support secure renegotiation will have its initial handshake denied. When secure renegotiation
is set to request, unpatched clients will be permitted to renegotiate. This setting is NOT recommended
however, as it is subject to active man-in-the-middle attacks.
• max-renegotiations-per-minute
Species the maximum number of renegotiation attempts allowed in a minute. The default value is 5.
• max-aggregate-renegotiation-per-minute
Species the maximum number of aggregate renegotiation attempts allowed in a minute. The default
value is 0.
• server-name
Species the server names to be matched with SNI (server name indication) extension information in
ClientHello from a client connection. Wildcard is supported by using wildcard character "*" to match
multiple names.
• sni-default
When true, this prole is the default SSL prole when the server name in a client connection does not
match any congured server names, or a client connection does not specify any server name at all.
• sni-require
When this option is enabled, a client connection that does not specify a known server name or does not
support SNI extension will be rejected.
• ssl-sign-hash
Species SSL sign hash algorithm which is used to sign and verify SSL Server Key Exchange and
Certicate Verify messages for the specied SSL proles. The default value is sha1.
• strict-resume
Enables or disables strict-resume. The default option is disabled, which causes the SSL prole to resume
an uncleanly shut down SSL session. Conversely, you can specify enabled to prevent an SSL session
from being resumed after an unclean shutdown.
• unclean-shutdown
By default, the SSL prole performs unclean shutdowns of all SSL connections, which means that
underlying TCP connections are closed without exchanging the required SSL shutdown alerts. If you
want to force the SSL prole to perform a clean shutdown of all SSL connections, set this option to
disabled.
• session-mirroring
Enables or disables the mirroring of sessions to high availability peer. By default, this setting is disabled,
which causes the system to not mirror ssl sessions.
• session-ticket
Enables or disables session-ticket. The default option is disabled, which causes the SSL prole not to
use session ticket per RFC 5077. Conversely, you can specify enabled to cause SSL prole to use session
ticket per RFC 5077.
1074
LTM Profile
• session-ticket-timeout
Species the session ticket timeout. The default value is 0 which means cache timeout is used.
• source-ip-blacklist
Species the data group name of source ip blacklist when SSL forward proxy bypass feature is enabled.
• source-ip-whitelist
Species the data group name of source ip whitelist when SSL forward proxy bypass feature is enabled.
• ssl-forward-proxy
Enables or disables SSL forward proxy feature. The default option is disabled. Conversely, you can
specify enabled to use the SSL Forward Proxy Feature.
• ssl-forward-proxy-bypass
Enables or disables SSL forward proxy bypass feature. The default option is disabled. Conversely, you
can specify enabled to use the SSL Forward Proxy Bypass Feature.
• to-folder
client-ssl proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
dhcpv4
Congures a Dynamic Host Conguration Protocol (DHCP) prole.
Syntax
Congure the dhcpv4 prole within the ltm prole module using the syntax shown in the following sections.
Create/Modify
create dhcpv4 [name]
modify dhcpv4 [name]
app-service [[string] | none]
defaults-from [[name] | none]
mode [relay | forwarding]
description [string]
idle-timeout [ [integer] | indefinite ]
default-lease-time [integer]
transaction-timeout [integer]
authentication {
enabled [true | false]
virtual [[string] | none]
user-name {
format [mac-address | mac-and-relay-option | relay-option |
tcl-snippet]
suboption-id1 [integer]
suboption-id2 [integer]
separator1 [[string] | none]
separator2 [[string] | none]
tcl [[string] | none]
}
1075
Traffic Management Shell (tmsh) Reference Guide
}
subscriber-discovery {
enabled [true | false]
subscriber-id {
format [mac-address | mac-and-relay-id | tcl-snippet]
suboption-id1 [integer]
suboption-id2 [integer]
separator1 [[string] | none]
separator2 [[string] | none]
tcl [[string] | none]
}
}
relay-agent-id {
add [true | false]
remove [true | false]
suboption {
id1 [integer]
id2 [integer]
value1 [string | none]
value2 [string | none]
}
}
ttl-value [integer]
ttl-dec-value [ by-0 | by-1 | by-2 | by-4 ]
max-hops [integer]
edit dhcpv4 [ [name] ... ]
all-properties
non-default-properties
reset-stats dhcpv4
reset-stats dhcpv4 [ [ [name] | [regex] ] ... ]
Display
list dhcpv4
list dhcpv4 [ [ [name] | [regex] ] ... ]
show running-config dhcpv4
show running-config dhcpv4
[ [ [name] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show dhcpv4
show dhcpv4 [ [ [name] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete dhcpv4 [name]
1076
LTM Profile
Description
You can use the dhcpv4 prole to manage DHCPv4 network trafc.
Examples
create dhcpv4 my_dhcpv4_prole defaults-from dhcpv4
Creates a custom DHCPv4 prole named my_dhcpv4_prole that inherits its settings from the system
default DHCPv4 prole.
list dhcpv4 all-properties
Displays all properties for all DHCPv4 proles.
create dhcpv4 new_dhcpv4_prole { mode relay idle-timeout 120 transaction-timeout 45
default-lease-time 3600 ttl-value 0 ttl-dec-value by-2 max-hops 4 subscriber-discovery { enabled true
subscriber-id { format mac-and-relay-option suboption-id1 1 separator1 - } } authentication { enabled
true virtual new_authen_vs user-name { format mac-and-relay-option suboption-id1 1 separator1 -
} } relay-agent-id { add false remove true } }
Creates a DHCPv4 prole named new_dhcpv4_prole with idle-timeout value of <120 seconds>,
transaction-timeout of <45 seconds>, default-lease-time of 3600 seconds, ttl-dec-value of 2 and max-hops
of 4. The BIG-IP virtual will work in relay mode, with subscriber discovery enabled and congured with
the subscriber-id format set to mac-and-relay-option and congured to use only suboption 1 (the rst
suboption ID) of the relay-agent info option (option 82) and to use the - to concatenate the MAC address
to the rst suboption ID. The authentication is enabled and its user-name equals the subscriber-id and the
authentication virtual name is new_authen_vs. It also does not add relay agent option 82 but removed it (if
exists) from the server-to-client messages.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• default-lease-time
Provides the default value in seconds of DHCPv4 lease time in case it was missing in the client-server
exchange. The default is 86400.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is dhcpv4.
• description
User dened description.
• mode
Species the operation mode of the DHCP virtual. If the virtual to run in relay mode, then it means that
it is acting as a standard DHCPv4 relay agent. This means that the relay will change some of the DHCPv4
packet elds before sending it to either the client or server. The forwarding mode is similar to relay
except that the virtual will not modify the standard elds, instead it will forward the message from client
to server and vice-versa. The default is relay.
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 60 seconds.
• transaction-timeout
1077
Traffic Management Shell (tmsh) Reference Guide
Species DHCPv4 transaction timeout, in seconds. The transactions should complete within the timeout
specied. If a transaction does not complete for any reason, it is removed. The default value is 45 seconds.
• authentication
Manages the subscriber authentication attributes.
• enabled
To enable or disable subscriber authentication. If enabled, then user has to ll the following elds.
Default is false.
• virtual
Species the authentication virtual server name.
• user-name
Manages the authentication user name's attributes. The user-name is what will be used to authenticate
the DHCP client.
• format
Species the user-name format. The options are: MAC address, MAC + relay-agent option,
relay-agent option or tcl-snippet. The concatenation symbol is dened as separator1.
• suboption-id1
The relay-agent option (option 82) rst suboption ID. The default is 1.
• suboption-id2
The relay-agent option (option 82) second suboption ID. The default is 2.
• separator1
A string that is used to concatenate the MAC address and the relay-agent info option (option 82)
to create the authentication user-name. The default is @.
• separator2
A string that is used to concatenate the relay-agent info option (option 82) suboptions 1 and 2 to
create the authentication user-name. The default is @.
• tcl-snippet
A tcl snippet to format the user name. This value will be taken into account only if the format
value was chosen to be tcl-snippet.
• subscriber-discovery
Manages the subscriber discovery attributes.
• enabled
To enable or disable subscriber discovery. If enabled, then user has to ll the following elds. Default
is false.
• subscriber-id
Manages the subscriber-id attributes. The subscriber-id is used by SPM to create, delete and update
subscriber sessions.
• format
Species the subscriber-id format. The options are: MAC address, MAC + relay-agent option,
relay-agent option or tcl-snippet. The concatenation symbol is dened as separator1.
• suboption-id1
The relay-agent info option (option 82) rst suboption ID. The default is 1.
1078
LTM Profile
• suboption-id2
The relay-agent info option (option 82) second suboption ID. The default is 2.
• separator1
A string that is used to concatenate the MAC address and the relay-agent info option (option 82)
to create the subscriber-id. The default is @.
• separator2
A string that is used to concatenate the relay-agent info option (option 82) suboptions 1 and 2 to
create the subscriber-id. The default is @.
• tcl-snippet
A tcl snippet to format the subscriber-id. This value will be taken into account only if the format
value was chosen to be tcl-snippet.
• relay-agent-id
Manages the relay agent information option (option 82) attributes. As a relay, the DHCP virtual can
insert this option.
• add
Species if the user wants the DHCP relay agent to insert option 82 or not. Default is false.
• remove
Species if the user wants the DHCP relay agent to remove option 82 from the server-to-client trafc
or not. Default is false.
• suboptions
Manages the inserted relay agent information option (option 82) suboptions. We allow only two
suboptions to be inserted.
• id1
An integer to represent the rst suboption ID. Default is 1.
• value1
A string to represent the rst suboption value.
• id2
An integer to represent the second suboption ID. Default is 2.
• value2
A string to represent the second suboption value.
• ttl-value
Species the ttl absolute value that the user may want to set for each outgoing DHCP packet. Default
is 0; and in this case, we use the ttl-dec-value eld.
• ttl-dec-value
Species the amount that the DHCP virtual will use to decrement the ttl for each outgoing DHCP packet.
Default is by-1.
• max-hops
Species the maximum number of relay agents that the DHCPv4 messages pass through before they
are discarded. The default is 4.
1079
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, ltm prole, ltm virtual, modify, show, dhcpv6 prole, reset-stats, tmsh
dhcpv6
Congures a Dynamic Host Conguration Protocol for IPv6 (DHCPv6) prole.
Syntax
Congure the dhcpv6 prole within the ltm prole module using the syntax shown in the following sections.
Create/Modify
create dhcpv6 [name]
modify dhcpv6 [name]
app-service [[string] | none]
defaults-from [[name] | none]
mode [relay | forwarding]
description [string]
idle-timeout [ [integer] | indefinite ]
default-lease-time [integer]
transaction-timeout [integer]
authentication {
enabled [true | false]
virtual [[string] | none]
user-name {
format [mac-address | option37 | mac-and-option37 | option38 |
mac-and-option38 | option37-and-option38 | mac-and-option37-and-option38 |
tcl-snippet]
separator1 [[string] | none]
separator2 [[string] | none]
tcl [[string] | none]
}
}
subscriber-discovery {
enabled [true | false]
subscriber-id {
format [mac-address | option37 | mac-and-option37 | option38 |
mac-and-option38 | option37-and-option38 | mac-and-option37-and-option38 |
tcl-snippet]
separator1 [[string] | none]
separator2 [[string] | none]
tcl [[string] | none]
}
}
remote-id-option {
add [true | false]
remove [true | false]
enterprise-number [integer]
value [string | none]
}
subscriber-id-option {
add [true | false]
remove [true | false]
value [string | none]
}
edit dhcpv6 [ [name] ... ]
1080
LTM Profile
all-properties
non-default-properties
reset-stats dhcpv6
reset-stats dhcpv6 [ [ [name] | [regex] ] ... ]
Display
list dhcpv6
list dhcpv6 [ [ [name] | [regex] ] ... ]
show running-config dhcpv6
show running-config dhcpv6
[ [ [name] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show dhcpv6
show dhcpv6 [ [ [name] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete dhcpv6 [name]
Description
You can use the dhcpv6 prole to manage DHCPv6 network trafc.
Examples
create dhcpv6 my_dhcpv6_prole defaults-from dhcpv6
Creates a custom DHCPv6 prole named my_dhcpv6_prole that inherits its settings from the system
default DHCPv6 prole.
list dhcpv6 all-properties
Displays all properties for all DHCPv6 proles.
create dhcpv6 new_dhcpv6_prole { mode relay idle-timeout 120 transaction-timeout 45
default-lease-time 3600 subscriber-discovery { enabled true subscriber-id { format mac-and-option37
separator1 @ } } authentication { enabled true virtual new_authen_vs user-name { format
mac-and-option37 separator1 @ } } remote-id-option { add false remove true } subscriber-id-option
{ add false remove true } }
Creates a DHCPv6 prole named new_dhcpv6_prole with idle-timeout value of <120 seconds>,
transaction-time out of <45 seconds> and default-lease-time of 3600 seconds. The BIG-IP virtual will work
in relay mode, with subscriber discovery enabled and congured with the subscriber-id format set to
mac-and-option37 (remote-id relay agent option) and to use the @ to concatenate both MAC address and
option 37. The authentication is enabled and its user-name equals the subscriber-id and the authentication
1081
Traffic Management Shell (tmsh) Reference Guide
virtual name is new_authen_vs. It also does not add either option 37 or options 38 (remote-id option and
subscriber-id option) but remove them (if exists) from the server-to-client messages.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• default-lease-time
Provides the default value in seconds of DHCPv6 lease time in case it was missing in the client-server
exchange. The default is 86400.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is dhcpv6.
• description
User dened description.
• mode Species the operation mode of the DHCP virtual. If the virtual to run in relay mode, then it means
that it is acting as a standard DHCPv6 relay agent. This means that the relay will encapsulate the original
messages into one of the relay messages before it send it to the server or the client. In the forwarding
mode, the virtual will just forward the message to either the server or the client. The default is relay.
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 60 seconds.
• transaction-timeout
Species DHCPv6 transaction timeout, in seconds. The transactions should complete within the timeout
specied. If a transaction does not complete for any reason, it is removed. The default value is 45 seconds.
• authentication
Manages the subscriber authentication attributes.
• enabled
To enable or disable subscriber authentication. If enabled, then user has to ll the following elds.
Default is false.
• virtual
Species the authentication virtual server name.
• user-name
Manages the authentication user name's attributes. The user-name is what will be used to authenticate
the DHCP client.
• format
Species the user-name format. The options are: MAC address, option37, MAC + option37,
option38, MAC + option38, option37 + option38, mac + option37 + option38 tcl-snippet. The
concatenation symbols are dened as separator1 and separator2.
• separator1
A string that is used to concatenate the MAC address and the rst two strings of the authentication
user-name. The default is @.
• separator2
1082
LTM Profile
A string that is used to concatenate the MAC address and the second two strings of the
authentication user-name. The default is @.
• tcl-snippet
A tcl snippet to format the user name. This value will be taken into account only if the format
value was chosen to be tcl-snippet.
• subscriber-discovery
Manages the subscriber discovery attributes.
• enabled
To enable or disable subscriber discovery. If enabled, then user has to ll the following elds. Default
is false.
• subscriber-id
Manages the subscriber-id attributes. The subscriber-id is used by SPM to create, delete and update
subscriber sessions.
• format
Species the user-name format. The options are: MAC address, option37, MAC + option37,
option38, MAC + option38, option37 + option38, mac + option37 + option38 tcl-snippet. The
concatenation symbols are dened as separator1 and separator2.
• separator1
A string that is used to concatenate the rst two strings of the subscriber-id. The default is @.
• separator2
A string that is used to concatenate the second two strings of the subscriber-id. The default is @.
• tcl-snippet
A tcl snippet to format the subscriber-id. This value will be taken into account only if the format
value was chosen to be tcl-snippet.
• remote-id-option
Manages the DHCPv6 relay agent remote-id option (option 37) attributes. As a relay, the DHCP virtual
can insert or remove this option.
• add
Species if the user wants the DHCP relay agent to insert option 37 or not. Default is false.
• remove
Species if the user wants the DHCP relay agent to remove option 37 from the server-to-client trafc
or not. Default is false.
• enterprise-number
Species the enterprise number of the inserted remote-id option (option 37).
• value
A string to represent the remote-id option value.
• subscriber-id-option
Manages the DHCPv6 relay agent subscriber-id option (option 38) attributes. As a relay, the DHCP
virtual can insert or remove this option.
• add
1083
Traffic Management Shell (tmsh) Reference Guide
Species if the user wants the DHCP relay agent to insert option 38 or not. Default is false.
• remove
Species if the user wants the DHCP relay agent to remove option 38 from the server-to-client trafc
or not. Default is false.
• value
A string to represent the subscriber-id option value.
See Also
create, delete, edit, ltm prole, ltm virtual, modify, show, dhcpv6 prole, reset-stats, tmsh
diameter
Congures a prole to manage Diameter network trafc.
Syntax
Congure the diameter component within the ltm prole module using the syntax in the following sections.
Create/Modify
create diameter [name]
modify diameter [name]
app-service [[string] | none]
connection-prime [disabled | enabled]
defaults-from [name]
description [string]
destination-realm [string]
handshake-timeout [number]
host-ip-rewrite [disabled | enabled]
max-retransmit-attempts [number]
max-watchdog-failure [number]
origin-host-to-client [string]
origin-host-to-server [string]
origin-realm-to-client [string]
origin-realm-to-server [string]
overwrite-destination-host [disabled | enabled]
parent-avp [ [number] | [string] ]
persist-avp [ [number] | [string] ]
reset-on-timeout [disabled | enabled]
retransmit-timeout [number]
watchdog-timeout [number]
mv diameter [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
edit diameter [ [ [name] | [glob] | [regex] ] ... ]
1084
LTM Profile
all-properties
non-default-properties
reset-stats diameter
reset-stats diameter [ [ [name] | [glob] | [regex] ] ... ]
Display
list diameter
list diameter [ [ [name] | [glob] | [regex] ] ... ]
show running-config diameter
show running-config diameter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show diameter
show diameter [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete diameter [name]
Description
You can use the diameter component to congure a prole to manage Diameter network trafc.
Examples
create diameter my_diameter_prole defaults-from diameter
Creates a Diameter prole named my_diameter_prole that inherits its settings from the system default
Diameter prole.
list diameter
Displays the properties of all Diameter proles.
mv diameter /Common/my_diameter_prole to-folder /Common/my_folder
Moves a custom diameter prole named my_diameter_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• connection-prime
1085
Traffic Management Shell (tmsh) Reference Guide
When enabled, and the system receives a capabilities exchange request from the client, the system will
establish connections and perform handshaking with all the servers prior to sending the capabilities
exchange answer to the client. The default value is disabled.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is diameter.
• description
User dened description.
• destination-realm
This attribute has been deprecated as of BIG-IP v11.3.0. Species the realm to which messages are
routed. A value of none indicates that the destination-realm option is disabled. The default value is
none.
You can specify a fully qualied domain name as an ASCII string. For more information about this
option, see RFC 3588 section 6.6.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• handshake-timeout
Species the handshake timeout in seconds. This setting species the maximum number of seconds that
a connection can be idle after the capabilities exchange request was sent to the server.The default value
is 10. The system will reset the connection after it has timed out.
You can specify a numeric value in the range 0 to 4294967295. The recommended value is in the range
of 5 to 30
• host-ip-rewrite
When enabled and the message is a capabilities exchange request or capabilities exchange answer,
rewrite the host-ip-address attribute with the system's egress IP address. The default value is enabled.
• max-retransmit-attempts
Species the maximum number of retransmit attempts. This setting species the maximum number of
attempts that BIG-IP will take to retransmit the request messages if it does not receive the corresponding
answer messages. If retransmit is unsuccessful, after maximum attempts, BIG_IP will send an error
response. The default value is 1.
You can specify a numeric value in the range 0 to 4294967295. The recommended value is in the range
of 1 to 10
• max-watchdog-failure
Species the maximum number of device watchdog failures that the trafc management system can
take before it tears down the connection. After the system receives this number of device watchdog
failures, it closes the connection. The default value is 10.
You can specify a numeric value in the range 0 to 4294967295.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• origin-host
This attribute has been deprecated as of BIG-IP v11.3.0. Please use, origin-host-to-client or
origin-host-to-server. Species the origin host of BIG-IP. The origin-host is used to overwrite the
1086
LTM Profile
server's actual origin host attribute when it responds to the client. A value of none indicates that origin-host
is disabled. The default value is none.
You can specify an ASCII string as a FQDN. See RFC 3588 section 6.3.
• origin-host-to-client
Species the origin host to client of BIG-IP. The origin-host-to-client is used to overwrite the server's
actual origin host attribute when it responds to the client. A value of none indicates that
origin-host-to-client is disabled. The default value is none.
You can specify an ASCII string as a FQDN. See RFC 3588 section 6.3.
• origin-host-to-server
Species the origin host to server of BIG-IP. The origin-host-to-server is used to overwrite the client's
actual origin host attribute when it responds to the server. A value of none indicates that
origin-host-to-server is disabled. The default value is none.
You can specify an ASCII string as a FQDN. See RFC 3588 section 6.3.
• origin-realm
This attribute has been deprecated as of BIG-IP v11.3.0. Please use, origin-realm-to-client or
origin-realm-to-server. Species the origin realm of BIG-IP. The origin-realm is used to overwrite the
server's actual origin realm attribute when it responds to the client. A value of none indicates that
origin-realm is disabled. The default value is none.
You can specify an ASCII string as a FQDN. See RFC 3588 section 6.4.
• origin-realm-to-client
Species the origin realm of BIG-IP. The origin-realm-to-client is used to overwrite the server's actual
origin realm attribute when it responds to the client. A value of none indicates that origin-realm-to-client
is disabled. The default value is none.
You can specify an ASCII string as a FQDN. See RFC 3588 section 6.4.
• origin-realm-to-server
Species the origin realm to server of BIG-IP. The origin-realm-to-server is used to overwrite the client's
actual origin realm attribute when it responds to the server. A value of none indicates that
origin-realm-to-server is disabled. The default value is none.
You can specify an ASCII string as a FQDN. See RFC 3588 section 6.4.
• overwrite-destination-host
This attribute has been deprecated as of BIG-IP v11.3.0. When you enable this option, the system replaces
the value of the destination host eld in the Diameter header with the BIG-IP(r) pool member address.
When you disable this option, the system does not modify the destination host eld. The default value
is enabled.
• parent-avp
Species the name of the Diameter attribute that the system uses to indicate if the persist-avp option
is embedded in a grouped avp. A value of none indicates that the value of the persist-avp option is not
embedded in a grouped avp. The default value is none.
You can specify an ASCII string or a numeric ID in the range 1 to 4294967295. Acceptable strings can
be found in RFC 3588 section 4.5.
• partition
Displays the administrative partition within which the prole resides.
• persist-avp
1087
Traffic Management Shell (tmsh) Reference Guide
Species the name of the Diameter attribute that the system persists on. A value of none indicates that
persistence is disabled. The default value is session-id.
You can specify an ASCII string or a numeric ID in the range 1 to 4294967295. Acceptable strings can
be found in RFC 3588 section 4.5.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-on-timeout
When it is enabled and the watchdog failures exceed the max watchdog failure, the system resets the
connection. The default value is enabled.
• retransmit-timeout
Species the retransmit timeout in seconds. This setting species the number of seconds to retransmit
the request messages if BIG-IP does not receive the corresponding answer messages . The default value
is 10.
You can specify a numeric value in the range 0 to 4294967295. The recommended value is in the range
of 5 to 30
• to-folder
diameter proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
• watchdog-timeout
Species the watchdog timeout in seconds. This setting species the number of seconds that a connection
is idle before the device watchdog request is sent. The default value is 0, which means BIG-IP will not
send a device watchdog request to either client or server side.
You can specify a numeric value in the range 0 to 4294967295. The recommended value is in the range
of 6 to 30
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
dns
Congures a Domain Name System (DNS) prole.
Syntax
Congure the dns component within the ltm prole module using the syntax in the following sections.
Create/Modify
create dns [name]
modify dns [name]
app-service [[string] | none]
avr-dnsstat_sample_rate [integer]
cache [string]
defaults-from [ [name] | none]
1088
LTM Profile
description [string]
dns64 [disabled | secondary | immediate | v4-only]
dns64-additional-section-rewrite [disabled | v6-only | v4-only | any]
dns64-prefix [IPv6 prefix]
dns-security [string]
enable-cache [no | yes]
enable-dnssec [no | yes]
enable-dns-express [no | yes]
enable-dns-firewall [no | yes]
enable-gtm [no | yes]
enable-hardware-query-validation [no | yes]
enable-hardware-response-cache [no | yes]
enable-logging [no | yes]
enable-rapid-response [no | yes]
log-profile [ [name] | none]
process-rd [no | yes]
process-xfr [no | yes]
rapid-response-last-action [allow | drop | noerror | nxdomain | refuse |
truncate]
unhandled-query-action [allow | drop | hint | noerror | reject]
use-local-bind [no | yes]
edit dns [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv dns [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats dns
reset-stats dns [ [ [name] | [glob] | [regex] ] ... ]
Display
list dns
list dns [ [ [name] | [glob] | [regex] ] ... ]
show running-config dns
show running-config dns [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete dns [name]
Description
You can use this component to create, modify, display, or delete a DNS prole to dene how the BIG-IP
system handles DNS trafc. You can also display and reset DNS prole statistics.
1089
Traffic Management Shell (tmsh) Reference Guide
Examples
create dns my_dns_prole defaults-from dns
Creates a DNS prole named my_dns_prole that inherits its settings from the system default DNS prole.
list dns
Displays the properties of all DNS proles.
mv dns /Common/my_dns_prole to-folder /Common/my_folder
Moves a custom dns prole named my_dns_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• avr-dnsstat-sample-rate
Sets AVR DNS statistics rate. The default value is 0, which means AVR DNS statistics is disabled. If
the sampling rate is set to 1, each query will be sent to the analytics database. If the sampling rate is set
to an integer N, every N th query will be sent and the analytics database will count it N times. When
sampling rate is greater than one, the statistics will be inaccurate if the trafc volume is low. However,
when the trafc volume is high, the system performance will benet from sampling and the inaccuracy
will be negligible. Also be aware that analytics database has its own internal sampling mechanism. The
sampling rate does not apply to DNS rewall statistics. AVR DNS statistics contain query name, query
type, virtual server IP and client IP.
• cache
Species the user-created cache that the system uses to cache DNS responses. When you select a cache
for the system to use, you must also enable the DNS cache setting.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is dns.
• description
User dened description.
• dns64
Sets DNS64 mapping mode. The default value is disabled.
• dns64-additional-section-rewrite
Sets DNS64 additional section rewriting. For AAAA and A records in additional section, this eld
species how they are being rewritten. The default value is disabled.
• dns64-prex
Species DNS64 mapping IPv6 prex.
• dns-security
Indicates the DNS security prole the system uses.
• enable-cache
Indicates whether the system caches DNS responses. The default value is no.
• enable-dnssec
1090
LTM Profile
Indicates whether to perform DNS Security Extension (DNSSEC) operations on the DNS packet, for
example, respond to DNSKEY queries; add RRSIGs to response.
• enable-dns-express
Indicates whether the dns-express service is enabled. The service handles zone transfers from the primary
DNS server.
• enable-dns-rewall
Indicates whether DNS rewall capability is enabled. The default value is no.
• enable-gtm
Indicates whether the Global Trafc Manager handles DNS resolution for DNS queries and responses
that contain Wide IP names. The default value is yes.
• enable-hardware-query-validation
On supported platforms, indicates whether the hardware will accelerate query validation. The default
value is no.
• enable-hardware-response-cache
On supported platforms, indicates whether the hardware will cache responses. The default value is no.
• enable-logging
Indicates whether to enable high speed logging for DNS queries and responses or not. Default value is
no. When it is set to yes, a DNS prole must be congured with a log-prole.
• enable-rapid-response
On supported platforms, indicates whether to allow queries to be answered by Rapid Response. The
default value is no. When enabled, if the query name matches a GTM Wide IP name and GTM is enabled
on this prole, the DNS query will bypass Rapid Response.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• log-prole
Species the DNS logging prole used to congure what events get logged and their message format.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the prole resides.
• process-rd
Indicates whether to process client-side DNS packets with Recursion Desired set in the header. The
default value is yes. If set to no, processing of the packet will be subject to the unhandled-query-action
option.
• process-xfr
Indicates whether the system answers zone transfer requests for a DNS zone created on the system. The
default value is no. The enable-dns-express and process-xfr settings affect how the system responds
to zone transfer requests.
• rapid-response-last-action
Species what action to take when Rapid Response is enabled and the incoming query has not matched
a DNS-Express Zone. Default is drop. Option allow sends non-matching queries up the regular packet
1091
Traffic Management Shell (tmsh) Reference Guide
processing path. All other options result in a response returned immediately to the client: truncate
(truncate), nxdomain (non-existent name), noerror (no data), refuse (REFUSED return code).
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• to-folder
dns proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• unhandled-query-action
Species the action to take when a query does not match a Wide IP or a DNS Express Zone. The default
value is allow.
• use-local-bind
Indicates whether non-GTM and non-dns-express requests should be forwarded to the local BIND.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
dns-logging
Congures a domain name service logging (DNS Logging) prole.
Syntax
Congure the dns-logging component within the ltm prole module using the syntax in the following
sections.
Create/Modify
create dns-logging [name]
modify dns-logging [name]
description [string]
enable-query-logging [no | yes]
enable-response-logging [no | yes]
include-complete-answer [no | yes]
include-query-id [no | yes]
include-source [no | yes]
include-timestamp [no | yes]
include-view [no | yes]
log-publisher [name]
edit dns-logging [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv dns-logging [ [[source-name] [destination-name]] | [[name] to-folder
1092
LTM Profile
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Display
list dns-logging
list dns-logging [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete dns-logging [name]
Description
You can use this component to create, modify, display, or delete a DNS logging prole, to enable query or
response logging, and to dene the format of messages themselves.
Examples
list dns-logging
Displays the properties of all DNS logging proles.
create dns-logging my_dns_log_prole enable-query-logging yes log-publisher my_pub include-query-id
yes
Creates a DNS logging prole with query logging enabled. Messages will be sent to publisher my_pub.
Messages will contain the query ID.
mv dns-logging /Common/my_dns_logging_prole to-folder /Common/my_folder
Moves a custom dns-logging prole named my_dns_logging_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• description
User dened description.
• enable-query-logging
Log the contents of DNS queries. The default value for this option is yes.
• enable-response-logging
Log the contents of DNS responses. The default value is no.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• include-complete-answer
Selects whether all the resource records are included in response log messages. The default value is yes
(complete-answer).
1093
Traffic Management Shell (tmsh) Reference Guide
• include-query-id
Selects whether the query id sent by the client is included in the query and response log messages. The
default value is no.
• include-source
Selects whether the message originator is included in the query and response log messages. The default
value is yes.
• include-timestamp
Selects whether the time stamp of the message is included in the query and response log messages. The
default value is yes. You may or may not need this depending on whether the destination log servers
prepend a time stamp to messages.
• include-view
Selects whether the view is included in the query log messages. The default value is yes.
• log-publisher
Species the log publisher used to deliver messages to one or more destinations. This option must be
specied.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• to-folder
dns-logging proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, modify, mv, regex, ltm prole dns, tmsh
fasthttp
Congures a Fast HTTP prole.
Syntax
Modify the fasthttp component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create fasthttp [name]
modify fasthttp [name]
app-service [[string] | none]
client-close-timeout [integer]
connpool-idle-timeout-override [integer]
connpool-max-reuse [integer]
connpool-max-size [integer]
connpool-min-size [integer]
connpool-replenish [disabled | enabled]
connpool-step [integer]
1094
LTM Profile
defaults-from [ [name] | none]
description [string]
force-http-10-response [disabled | enabled]
hardware-syn-cookie [disabled | enabled]
header-insert [none | [string] ]
http-11-close-workarounds [disabled | enabled]
idle-timeout [integer]
insert-xforwarded-for [disabled | enabled]
layer-7 [disabled | enabled]
max-header-size [integer]
max-requests [integer]
mss-override [integer]
reset-on-timeout [disabled | enabled]
server-close-timeout [integer]
server-sack [disabled | enabled]
server-timestamp [disabled | enabled]
receive-window-size [65535 - 2^31 bytes for window scale enabling]
unclean-shutdown [disabled | enabled]
mv fasthttp [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
edit fasthttp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats fasthttp
reset-stats fasthttp [ [ [name] | [glob] | [regex] ] ... ]
Display
list fasthttp
list fasthttp [ [ [name] | [glob] | [regex] ] ... ]
show running-config fasthttp
show running-config fasthttp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show fasthttp
show fasthttp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete fasthttp [name]
1095
Traffic Management Shell (tmsh) Reference Guide
Description
You can use this component to create, modify, display, or delete a Fast HTTP prole. This prole provides
the ability to accelerate certain HTTP connections such as banner ads.
Examples
create fasthttp my_fast_http_prole defaults-from fasthttp
Creates a Fast HTTP prole named my_fast_http_prole that inherits its settings from the system default
Fast HTTP prole.
mv fasthttp /Common/my_fasthttp_prole to-folder /Common/my_folder
Moves a custom fasthttp prole named my_fasthttp_prole to a folder named my_folder, where my_folder
has already been created and exists within /Common.
show fasthttp
Displays fasthttp prole statistics in the system default units.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• client-close-timeout
Species the number of seconds after which the system closes a client connection, when the system
either receives a client FIN packet or sends a FIN packet. This option overrides the idle-timeout option.
The default value is 5.
• server-sack
Species whether to support server sack option in cookie response by default. The default value is
disabled.
• server-timestamp
Species whether to support server timestamp option in cookie response by default. The default value
is disabled.
• receive-window-size
Species the window size to use, minimum and default to 65535 bytes, the maximum is 2^31 for window
scale enabling.
• connpool-idle-timeout-override
Species the number of seconds after which a server-side connection in a OneConnect(tm) pool is
eligible for deletion, when the connection has no trafc. This option overrides the idle-timeout option.
The default value is 0 (zero) seconds, which disables the override setting.
• connpool-max-reuse
Species the maximum number of times that the system can re-use a current connection. The default
value is 0 (zero).
• connpool-max-size
Species the maximum number of connections to a load balancing pool. A value of 0 (zero) species
that a pool can accept an unlimited number of connections. The default value is 2048.
• connpool-min-size
1096
LTM Profile
Species the minimum number of connections to a load balancing pool. The default value of 0 (zero)
species that there is no minimum.
• connpool-replenish
When enabled, the system replenishes the number of connections to a load balancing pool to the number
of connections that existed when the server closed the connection to the pool. The default value is
enabled.
When disabled, the system replenishes the connection that was closed by the server, only when there
are fewer connections to the pool than the number of connections set in the connpool-min-size option.
• connpool-step
Species the increment at which the system makes additional connections available, when all available
connections are in use. The default value is 4.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is fasthttp.
• description
User dened description.
• force-http10-response
Species whether to rewrite the HTTP version in the status line of the server to HTTP 1.0 to discourage
the client from pipelining or chunking data. The default value is disabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hardware-syn-cookie
Species whether or not to use hardware SYN Cookie when cross system limit. The default value is
disabled
• header-insert
Species a string that the system inserts as a header in an HTTP request. If the header exists already,
the system does not replace it. The default value is none.
• http11-close-workarounds
Enables or disables HTTP 1.1 close workarounds. The default value is disabled.
• idle-timeout
Species the number of seconds after which a connection is eligible for deletion, when the connection
has no trafc. The default value is 300 seconds.
• insert-xforwarded-for
Species whether the system inserts the XForwarded For header in an HTTP request with the client
IP address, to use with connection pooling.
The options are:
• disabled
Species that the system does not insert the XForwarded For header.
• enabled
Species that the system inserts the XForwarded For header with the client IP address.
• layer7
1097
Traffic Management Shell (tmsh) Reference Guide
When enabled, the system parses HTTP data in the stream. Disable this option if you want to use the
performance HTTP prole to shield against denial-of-service attacks against non-HTTP protocols. The
default value is enabled.
• max-header-size
Species the maximum amount of HTTP header data that the system buffers before making a load
balancing decision. The default value is 32768.
• max-requests
Species the maximum number of requests that the system can receive on a client connection, before
the system closes the connection. The default value of 0 species that requests are not limited.
• mss-override
Species a maximum segment size (MSS) override for server connections. The default value is 0 (zero),
which corresponds to an MSS of 1460. You can specify any integer between 536 and 1460.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-on-timeout
When enabled, the system sends a TCP RESET packet when a connection times out, and deletes the
connection. The default value is enabled.
• server-close-timeout
Species the number of seconds after which the system closes a client connection, when the system
either receives a client FIN packet or sends a FIN packet. This option overrides the value of the
idle-timeout option. The default value is 5.
• to-folder
fasthttp proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
• unclean-shutdown
Species how the system handles closing a connection. The options are:
• disabled
Prevents an unclean shutdown of a client connection. This is the default value.
• enabled
Species to permit an unclean shutdown of a client connection.
• fast
Species that the system sends a RESET packet to close the connection only if the client attempts
to send further data after the response has completed.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
1098
LTM Profile
fastl4
Congures a Fast Layer 4 prole.
Syntax
Congure the fastl4 component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create fastl4 [name]
modify fastl4 [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
hardware-syn-cookie [disabled | enabled]
idle-timeout [immediate | indefinite | [integer] ]
ip-tos-to-client [ [integer] | pass-through]
ip-tos-to-server [ [integer] | pass-through]
keep-alive-interval [integer]
link-qos-to-client [ [integer] | pass-through]
link-qos-to-server [ [integer] | pass-through]
priority-to-client [ [integer] | pass-through]
priority-to-server [ [integer] | pass-through]
loose-close [disabled | enabled]
loose-initialization [disabled | enabled]
mss-override [integer]
pva-acceleration [full | none | partial | guaranteed ]
pva-dynamic-client-packets [integer ]
pva-dynamic-server-packets [integer ]
pva-offload-dynamic [ enabled | disabled ]
pva-offload-state [embryonic | establish]
pva-flow-aging [enabled | disabled]
pva-flow-evict [enabled | disabled]
reassemble-fragments [disabled | enabled]
reset-on-timeout [disabled | enabled]
rtt-from-client [disabled | enabled]
rtt-from-server [disabled | enabled]
server-sack [disabled | enabled]
server-timestamp [disabled | enabled]
receive-window-size [65535 - 2^31 bytes for window scale enabling]
software-syn-cookie [disabled | enabled]
syn-cookie-whitelist [disabled | enabled]
tcp-close-timeout [immediate | indefinite | [integer] ]
tcp-generate-is [disabled | enabled]
tcp-handshake-timeout [immediate | indefinite | [integer] ]
tcp-strip-sack [disabled | enabled]
tcp-timestamp-mode [preserve | rewrite | strip]
tcp-wscale-mode [preserve | rewrite | strip]
late-binding [enabled | disabled]
explicit-flow-migration [enabled | disabled]
client-timeout [integer]
timeout-recovery [ disconnect | fallback ]
mv fastl4 [ [[source-name] [destination-name]] | [[name] to-folder
1099
Traffic Management Shell (tmsh) Reference Guide
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
edit fastl4 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats fastl4
reset-stats fastl4 [ [ [name] | [glob] | [regex] ] ... ]
Display
list fastl4
list fastl4 [ [ [name] | [glob] | [regex] ] ... ]
show running-config fastl4
show running-config fastl4
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show fastl4
show fastl4 [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete fastL4 [name]
Description
You can use this component to create, modify, display, or delete a Fast Layer 4 prole. The Fast L4 prole
is the default prole that the system uses when you create a basic conguration for non-UDP (User Datagram
Protocol) trafc.
Any changes you make to an active Fast L4 prole (one that is in use by a virtual server) take effect after
the value of the idle-timeout option has passed. That means new connections are affected by the prole
change immediately. However, for the new values to take effect, old connections need to be either aged out
or closed. =head1 EXAMPLES
create fastl4 my_fastl4_prole defaults-from fastl4
Creates a custom Fast Layer 4 prole named my_fastl4_prole that inherits its settings from the system
default Fast L4 prole.
mv fastl4 /Common/my_fastl4_prole to-folder /Common/my_folder
Moves a custom fastl4 prole named my_fastl4_prole to a folder named my_folder, where my_folder
has already been created and exists within /Common.
1100
LTM Profile
Please refer to the mv manual page for examples on how to use the mv command.
show fastl4
Displays statistics for all Fast Layer 4 proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is fastl4.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hardware-syn-cookie
Enables or disables hardware SYN cookie support when PVA10 is present on the system. The default
value is disabled.
Note that when you set the hardware-syn-cookie option to enabled, you may also want to set the
following bigdb database variables using the db component, based on your requirements:
• pva.SynCookies.Full.ConnectionThreshold (default: 500000)
• pva.SynCookies.Assist.ConnectionThreshold (default: 500000)
• pva.SynCookies.ClientWindow (default: 0)
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 300 seconds. You can also specify immediate or indenite.
When you specify an idle-timeout for the Fast L4 prole, for the prole to work properly, the value
needs to be greater than the bigdb database variable Pva.Scrub_time_in_msec.
• ip-tos-to-client
Species an IP Type of Service (ToS) number for the client-side. This option species the ToS level
that the trafc management system assigns to IP packets when sending them to clients. The default value
is 65535, which indicates, do not modify.
• ip-tos-to-server
Species an IP ToS number for the server side. This option species the ToS level that the trafc
management system assigns to IP packets when sending them to servers. The default value is 65535,
which indicates, do not modify.
• keep-alive-interval
Species the keep-alive probe interval, in seconds. The default value is disabled (0 seconds).
• link-qos-to-client
1101
Traffic Management Shell (tmsh) Reference Guide
Species a Link Quality of Service (QoS) (VLAN priority) number for the client side. This option
species the QoS level that the system assigns to packets when sending them to clients. The default
value is 65535, which indicates, do not modify.
• link-qos-to-server
Species a Link QoS (VLAN priority) number for the server side. This option species the QoS level
that the system assigns to packets when sending them to servers. The default value is 65535, which
indicates, do not modify.
• priority-to-client
Species internal packet priority for the client side. This option species the internal packet priority
that the system assigns to packets when sending them to clients. The default value is 65535, which
indicates, do not modify.
• link-qos-to-server
Species internal packet priority for the server side. This option species the internal packet priority
that the system assigns to packets when sending them to servers. The default value is 65535, which
indicates, do not modify.
• loose-close
Species that the system closes a loosely-initiated connection when the system receives the rst FIN
packet from either the client or the server. The default value is disabled.
• loose-initialization
Species that the system initializes a connection when it receives any Transmission Control Protocol
(TCP) packet, rather than requiring a SYN packet for connection initiation. The default value is disabled.
• mss-override
Species a maximum segment size (MSS) override for server connections. Note that this is also the
MSS advertised to a client when a client rst connects.
The default value is 0 (zero), which disables this option. You can specify an integer from 256 to 9162.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• pva-acceleration
Species the Packet Velocity(r) ASIC acceleration policy. The default value is full. guaranteed is the
low latency enhancement, full and partial has same effect for ePVA platforms.
• pva-dynamic-client-packets
Species the number of client packets before dynamic ePVA hardware re-ofoading occurs. The valid
value is 0~10. The default value is 2.
• pva-dynamic-server-packets
Species the number of server packets before dynamic ePVA hardware re-ofoading occurs. The valid
value is 0~10. The default value is 2.
• pva-ofoad-dynamic
Species whether PVA ow dynamic ofoading is enabled or not. The default is enabled.
For a ow or ow(s) in a connection to be ofoaded to ePVA hardware, both the client
(pva-dynamic-client-packets) and server (pva-dynamic-server-packets) ow packets setting need to be
1102
LTM Profile
satised. If only one direction packets need to be taken into consideration, the other direction packets
should set to zero.
• pva-ofoad-state
Species at what stage the ePVA performs hardware ofoad. The default value is embryonic and implies
at TCP CSYN or the rst client UDP packet. establish implies TCP 3WAY handshaking or UDP CS
round trip are conrmed.
• pva-ow-aging
Species if automatic aging from ePVA ow cache upon inactive and idle for a period, default to
enabled.
• pva-ow-evict
Species if this ow can be evicted upon hash collision with a new ow learn snoop request, defaults
to enabled.
• reassemble-fragments
Species whether to reassemble fragments. The default value is disabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-on-timeout
Species whether you want to reset connections on timeout. The default value is enabled.
• rtt-from-client
Enables or disables the TCP timestamp options to measure the round trip time to the client. The default
value is disabled.
• rtt-from-server
Enables or disables the TCP timestamp options to measure the round trip time to the server. The default
value is disabled.
• server-sack
Species whether to support server sack option in cookie response by default. The default value is
disabled.
• server-timestamp
Species whether to support server timestamp option in cookie response by default. The default value
is disabled.
• receive-window-size
Species the window size to use, minimum and default to 65535 bytes, the maximum is 2^31 for window
scale enabling.
• software-syn-cookie
Enables or disables software SYN cookie support when PVA10 is not present on the system. The default
value is disabled.
• syn-cookie-whitelist
Species whether or not to use a SYN Cookie WhiteList when doing software SYN Cookies. This means
not doing a SYN Cookie for the same src IP address if it has been done already in the previous
tm.owstate.timeout (30) seconds. The default value is disabled.
• tcp-close-timeout
1103
Traffic Management Shell (tmsh) Reference Guide
Species a TCP close timeout in seconds. You can also specify immediate or indenite. The default
value is 5 seconds.
• tcp-generate-isn
Species whether you want to generate TCP sequence numbers on all SYNs that conform with RFC1948,
and allow timestamp recycling. The default value is disabled.
• tcp-handshake-timeout
Species a TCP handshake timeout in seconds. You can also specify immediate or indenite. The default
value is 5 seconds.
• tcp-strip-sack
Species whether you want to block the TCP SackOK option from passing to the server on an initiating
SYN. The default value is disabled.
• tcp-timestamp-mode
Species how you want to handle the TCP timestamp. The default value is preserve.
• tcp-wscale-mode
Species how you want to handle the TCP window scale. The default value is preserve.
• late-binding
Species whether to enable or disable intelligent selection of a back-end server pool. The default value
is disabled. With this option enabled, an iRule can read a Layer 7 (FIX) packet to select a server pool,
and then can send the FIX stream down to the ePVA. The ePVA then manages the FIX stream at a low
latency, for as long as the stream persists. To keep the latency low, the BIG-IP software does not examine
any more Layer-7 data in that FIX stream.
If you enable this option, you also need a FIX prole in the Performance FastL4 Virtual Server
conguration.
• explicit-ow-migration
Species whether to have the iRule code determine exactly when the FIX stream drops down to the
ePVA hardware. The default value is disabled.
The explicit ow migration state indicates whether connections are automatically migrated into the
ePVA hardware (disabled), or the iRule must explicitly migrate them with the BIGTCP::release_ow
command (enabled).
• client-timeout
Species late binding client timeout in seconds. This is the number of seconds allowed for a client to
transmit enough data to select a server pool. If this timeout expires, the timeout-recovery option dictates
whether to drop the connection or fallback to the normal FastL4 load-balancing method to pick a server
pool. The default timeout is 30 seconds.
• timeout-recovery
Species late binding timeout recovery mode. This is the action to take when late binding timeout occurs
on a connection. This could be disconnect if only the L7 iRule actions are acceptable to pick a server
or fallback if the normal FastL4 load-balancing methods are acceptable to pick a server. The default
action is to disconnect.
• to-folder
fastl4 proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
1104
LTM Profile
fix
Congures an Financial Information eXchange Protocol (FIX) prole.
Syntax
Congure the x component within the ltm prole module using the syntax shown in the following sections.
Create/Modify
create fix [name]
modify fix [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
error-action [drop_connection | dont_forward]
full-logon-parsing [true | false]
message-log-publisher [publisher]
quick-parsing [true | false]
statistics-sample-interval [integer]
report-log-publisher [publisher]
response-parsing [true | false]
sender-tag-class {{[sender-id] [class name]}...}
edit fix [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats fix
reset-stats fix [ [ [name] | [glob] | [regex] ] ... ]
Display
list fix
list fix [ [ [name] | [glob] | [regex] ] ... ]
show running-config fix
show running-config fix [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show fix
show fix [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
1105
Traffic Management Shell (tmsh) Reference Guide
Delete
delete fix [name]
Description
You can use the x component to manage an Financial Information eXchange Protocol prole.
Examples
create x my_x defaults-from x
Creates an nancial information exchange protocol prole named my_x using the system defaults.
create x my_x { }
Creates an nancial information exchange protocol prole named my_x.
• app-service
Species the name of the application service to which this object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this object. Only the application service can modify or delete this object.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is none.
• description
User dened description.
• error-action
Species the error handling method.
• full-logon-parsing
Enable or disable logon message is always fully parsed.
• message-log-publisher
Species the publisher for message logging.
• quick-parsing
Enable or disable quick parsing which parses the basic standard elds and validates message length and
checksum.
• statistics-sample-interval
Species the sample interval in seconds of the message rate.
• response-parsing
Enable or disable response parsing which parses the messages from FIX server.
• report-log-publisher
Species the publisher for error message and status report.
• partition
Species the administrative partition within which the prole resides.
• sender-tag-class
Species the tag substitution map between sender id and tag substitution data group.
1106
LTM Profile
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, ltm prole x
ftp
Congures an FTP prole.
Syntax
Congure the ftp component within the ltm prole module using the syntax shown in the following sections.
Create/Modify
create ftp [name]
modify ftp [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
port [name]
allow-ftps [disabled | enabled]
security [disabled | enabled]
translate-extended [disabled | enabled]
inherit-parent-profile [disabled | enabled]
log-publisher [log publisher name | none]
log-profile [log profile name | none]
mv ftp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
edit ftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ftp
list ftp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ftp
show running-config ftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ftp [name]
1107
Traffic Management Shell (tmsh) Reference Guide
Description
Use this command to create, modify, display, or delete an FTP prole with which you can manage FTP
trafc.
Examples
create ftp my_ftp_prole defaults-from ftp
Creates a custom FTP prole named my_ftp_prole that inherits its settings from the system default FTP
prole.
list ftp
Displays the properties of all FTP proles.
mv ftp /Common/my_ftp_prole to-folder /Common/my_folder
Moves a custom ftp prole named my_ftp_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is ftp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• port
Species a service for the data channel port used for this FTP prole. The default port is ftp-data.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• allow-ftps
Allow explicit FTPS negotiation. The default value is disabled.
• security
1108
LTM Profile
Enables or disables secure FTP trafc for the BIG-IP(r) Application Security Manager. You can set the
security option only if the system is licensed for the BIG-IP Application Security Manager. The default
value is disabled.
• to-folder
ftp proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• translate-extended
This option is enabled by default, and thus, automatically translates RFC2428 extended requests EPSV
and EPRT to PASV and PORT when communicating with IPv4 servers.
• inherit-parent-prole
Enables the FTP data channel to inherit the TCP prole used by the control channel. If disabled, the
data channel uses FastL4 (BigProto) only.
• log-publisher
Specify the name of the log publisher which logs translation events. See help sys log-cong for more
details on the logging sub-system. Use the sys log-cong publisher component to set up a log publisher.
• log-prole
Specify the name of the ALG log prole which controls the logging of ALG . See help ltm alg-log-prole
for more details on the logging prole sub-system. Use the ltm alg-log-prole prole component to set
up a ALG log prole.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
gtp
Congures a GTP prole.
Syntax
Congure the gtp component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create gtp [name]
modify gtp [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
ingress-max [integer]
edit gtp [ [ [name] | [glob] | [regex] ] ... ]
1109
Traffic Management Shell (tmsh) Reference Guide
all-properties
non-default-properties
mv gtp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats gtp
reset-stats gtp [ [ [name] | [glob] | [regex] ] ... ]
Display
list gtp
list gtp [ [ [name] | [glob] | [regex] ] ... ]
show running-config gtp
show running-config gtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show gtp
show gtp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete gtp [name]
Description
You can use the gtp component to manage a GTP prole.
Examples
create gtp my_gtp_prole defaults-from gtp
Creates a GTP prole named my_gtp_prole using the system defaults.
create gtp my_gtp_prole { ingress-max 1000 }
Creates a GTP prole named my_gtp_prole that species the maximum number of messages that can be
held in the ingress queue is 1000.
mv gtp /Common/my_gtp_prole to-folder /Common/my_folder
Moves a custom gtp prole named my_gtp_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• app-service
1110
LTM Profile
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is gtp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ingress-max
Species the maximum number of messages that can be held in ingress queue. If it is 0, then it is
unlimited. The default value is 0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
html
Congures an HTML prole.
Syntax
Congure the html component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create html [name]
modify html [name]
defaults-from [ [name] | none]
content-detection [disabled | enabled]
content-selection
[add | delete | replace-all-with] {
[content-type] ...
}
1111
Traffic Management Shell (tmsh) Reference Guide
content-selection none
rules
[add | delete | replace-all-with] {
[html-rule] ...
}
rules none
mv html [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats html
reset-stats html [ [ [name] | [glob] | [regex] ] ... ]
Display
list html
list html [ [ [name] | [glob] | [regex] ] ... ]
show running-config html
show running-config html [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show html
show html [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete html [name]
Description
Use this command to create, modify, display, or delete an HTML prole with which you can manage HTML
trafc.
Examples
create html my_html_prole defaults-from html
Creates a custom HTML prole named my_html_prole that inherits its settings from the system default
HTML prole.
list html
Displays the properties of all HTML proles.
mv html /Common/my_html_prole to-folder /Common/my_folder
1112
LTM Profile
Moves a custom HTML prole named my_html_prole to a folder named my_folder, where my_folder
has already been created and exists within /Common.
Please refer to the mv manual page for examples on how to use the mv command.
Options
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is html.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• content-detection
Scans initial HTTP payload to look for HTML signatures and enables HTML prole if HTML-like
patterns are detected.
• content-selection
Matches content-type from response header against a list of content-types and enables HTML prole if
a match is found.
• rules
Species a list of HTML (content rewrite) rules, separated by spaces, that are used for parsing and
patching HTML.
• to-folder
html proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
See Also
create, delete, glob, list, ltm virtual, modify, mv, reset-stats, show, tmsh
http
Congures an HTTP prole.
Syntax
Congure the http component within the ltm prole module using the syntax shown in the following
sections.
1113
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create http [name]
modify http [name]
accept-xff [disabled | enabled]
app-service [[string] | none]
basic-auth-realm [ ["string"] | none]
defaults-from [ [name] | none]
description [string]
encrypt-cookie-secret [none | [passphrase] ]
encrypt-cookies
[add | delete | replace-all-with] {
[cookie] ...
}
encrypt-cookies none
enforcement {
excess-client-headers [disabled | enabled]
excess-server-headers [disabled | enabled]
max-header-size [integer]
max-header-count [integer]
max-requests [integer]
oversize-client-headers [disabled | enabled]
oversize-server-headers [disabled | enabled]
pipeline [allow | pass-through | reject]
truncated-redirects [disabled | enabled]
unknown-method [allow | pass-through | reject]
known-methods
[add | delete | replace-all-with] {
[HTTP method] ...
}
}
fallback-host [ [hostname] | none]
fallback-status-codes
[add | delete | replace-all-with] {
[fallback status code]...
}
fallback-status-codes none
header-erase [none | [string] ]
header-insert [none | [string] ]
insert-xforwarded-for [disabled | enabled]
lws-separator [none | string ]
lws-width [integer]
oneconnect-transformations [disabled | enabled]
proxy-type [reverse | explicit | transparent]
redirect-rewrite [all | matching | nodes | none]
request-chunking [preserve | rechunk | selective ]
response-chunking [preserve | rechunk | selective | unchunk]
response-headers-permitted
[add | delete | replace-all-with] {
[response header] ...
}
response-headers-permitted none
server-agent-name [string]
explicit-proxy {
enabled [no | yes]
dns-resolver [dns-resolver]
tunnel-name [tunnel]
route-domain [route-domain]
default-connect-handling [deny | allow]
connect-error-message ["string"]
dns-error-message ["string"]
bad-request-message ["string"]
bad-response-message ["string"]
}
sflow {
poll-interval [integer]
poll-interval-global [no | yes]
sampling-rate [integer]
1114
LTM Profile
sampling-rate-global [no | yes]
}
via-host-name [string]
via-request [append | preserve | remove]
via-response [append | preserve | remove]
xff-alternative-names
[add | delete | replace-all-with] {
[xff alternative name] ...
}
hsts {
mode [enabled | disabled]
maximum-age [integer]
include-subdomains [enabled | disabled]
}
edit http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv http [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats http
reset-stats http [ [ [name] | [glob] | [regex] ] ... ]
Display
list http
list http [ [ [name] | [glob] | [regex] ] ... ]
show running-config http
show running-config http [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show http
show http [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete http [name]
Description
You can use the http component to create, modify, display, or delete an HTTP prole.
The BIG-IP(r) system installation includes the following default HTTP-type proles:
1115
Traffic Management Shell (tmsh) Reference Guide
• http
The default HTTP prole contains values for properties related to managing HTTP trafc.
You can create a new HTTP-type prole using an existing prole as a parent prole, and then you can
change the values of the properties to suit your needs.
Examples
create http my_http_prole defaults-from http
Creates a custom HTTP prole named my_http_prole that inherits its settings from the system default
HTTP prole.
mv http /Common/my_http_prole to-folder /Common/my_folder
Moves a custom HTTP prole named my_http_prole to a folder named my_folder, where my_folder
has already been created and exists within /Common.
Please refer to the mv manual page for examples on how to use the mv command.
Options
• accept-xff
Enables or disables trusting the client IP address, and statistics from the client IP address, based on the
request's XFF (X-forwarded-for) headers, if they exist.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• basic-auth-realm
Species a quoted string for the basic authentication realm. The system sends this string to a client
whenever authorization fails. The default value is none.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is http.
• description
User dened description.
• encrypt-cookie-secret
Species a passphrase for the cookie encryption. The default value is none.
• encrypt-cookies
Species to encrypt specic cookies that the BIG-IP system sends to a client system. The default value
is none.
• enforcement
Species protocol enforcement options for the HTTP prole:
• excess-client-headers
Species the pass-through behavior when max-header-count is exceeded by the client. The default
is disabled which rejects the connection.
• excess-server-headers
Species the pass-through behavior when max-header-count is exceeded by the server. The default
is disabled which rejects the connection.
1116
LTM Profile
• unknown-method
Species the behavior when an unknown method is seen. The default is allow which allows all
methods, (known or unknown).
• known-methods
Species the HTTP methods known by the HTTP lter. Combine with the unknown-method eld
to control behavior when unusual methods are parsed.
• max-header-size
Species the maximum header size. The default value is 32768.
• max-header-count
Species the maximum number of headers in HTTP request or response that will be handled. If
client or server sends request or response with the number of headers greater then specied, the
connection will be dropped. The default value is 64.
• max-requests
Species the number of requests that the system accepts on a per-connection basis. The default value
is 0 (zero), which means the system does not limit the number of requests per connection.
• oversize-client-headers
Species the pass-through behavior when max-header-size is exceeded by the client. The default
is disabled which rejects the connection.
• oversize-server-headers
Species the pass-through behavior when max-header-size is exceeded by the server. The default
is disabled which rejects the connection.
• pipeline
Enables or disables HTTP/1.1 pipelining. If pass-through is chosen, then the HTTP lter will switch
to pass through mode (and be disabled) if pipelined data is seen. The default value is allow, which
means that clients can make requests even when prior requests have not received a response. In order
for this to succeed, however, destination servers must include support for pipelining.
• to-folder
http proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
• truncated-redirects
Species the pass-through behavior when a redirect lacking the trailing carriage-return and line feed
pair at the end of the headers is parsed. The default is disabled, which will silently drop the invalid
HTTP.
• unknown-method
Species the behavior (allow, reject, or pass-through) when an unknown HTTP method is parsed.
The default is to allow unknown methods.
• fallback-host
Species an HTTP fallback host. The default value is none.
With HTTP redirection, you can redirect HTTP trafc to another protocol identier, host name, port
number, or URI path. For example, if all members of a targeted pool are unavailable (that is, the members
are disabled, marked as down, or have exceeded their connection limit), the system can redirect the
HTTP request to the fallback host, with the HTTP reply Status Code 302 Found.
• fallback-status-codes
1117
Traffic Management Shell (tmsh) Reference Guide
Species one or more three-digit status codes that can be returned by an HTTP server. The default value
is none.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• header-erase
Species the header string that you want to erase from an HTTP request. The default value is none.
• header-insert
Species a quoted header string that you want to insert into an HTTP request. The default value is none.
The HTTP header being inserted can include a client IP address. Including a client IP address in an
HTTP header is useful when a connection goes through a secure network address translation (SNAT)
and you need to preserve the original client IP address. When you assign the congured HTTP prole
to a virtual server, the system then inserts the header specied by the prole into any HTTP request that
the system sends to a pool or pool member.
• insert-xforwarded-for
Enables or disables insertion of an X-Forwarded-For header. The default value is disabled.
When using connection pooling, which allows clients to make use of other client requests' server
connections, you can insert the X-Forwarded-For header and specify a client IP address.
• lws-separator
Species the linear white space separator that the system uses between HTTP headers when a header
exceeds the maximum width specied in the lws-width option. The valid value should be none, or, any
combination of cr(carriage return), lf(line feed), or sp(space). The default value is none.
• lws-width
Species the maximum number of columns that a header that is inserted into an HTTP request can have.
The default value is 80.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• oneconnect-transformations
Species whether the system performs HTTP header transformations for the purpose of keeping
server-side connections open. The default value is enabled. This feature requires conguration of a
OneConnect(tm) prole.
• partition
Displays the partition within which the component resides.
• redirect-rewrite
Species which of the application HTTP redirects the system rewrites to HTTPS. The options are:
• all
Species to rewrite all application redirects to HTTPS.
• matching
Species to rewrite to HTTPS only application redirects that match the original URI exactly.
• nodes
If the URI contains a node IP address, instead of a host name, species that the system rewrites the
node IP address to the virtual server IP address.
1118
LTM Profile
• none
Species that the system does not rewrite to HTTPS any application HTTP redirects. This is the
default value.
Use this feature when an application is generating HTTP redirects that send the client to HTTP (a
non-secure channel) when you want the client to continue accessing the application using HTTPS (a
secure channel). This is a common occurrence when using client SSL processing on a BIG-IP system.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• request-chunking
Species how to handle chunked and unchunked requests. The default value is selective. The options
are described under response-chunking.
• response-chunking
Species how to handle chunked and unchunked responses. The default value is selective. The options
are:
• unchunk
If the request or response is chunked, this option unchunks the request or response, processes the
HTTP content, and passes the request or response on as unchunked. The Keep-Alive value for the
Connection header is not supported, and therefore the system sets the value of the header to close.
If the request or response is unchunked, the LTM system processes the HTTP content and passes
the request or response on untouched.
• rechunk
If the request or response is chunked, the system unchunks the request or response, processes the
HTTP content, re-adds the chunk trailer headers, and then passes on the request or response as
chunked. Any chunk extensions are lost.
If the request or response is unchunked, the system adds transfer encoding and chunking headers on
egress.
• preserve
If the request or response is chunked or unchunked, the system leaves the request or response chunked,
processes the HTTP content, and passes the request or response on untouched.
• selective
If the request or response is chunked, the system unchunks the request or response, processes the
HTTP content, re-adds the chunk trailer headers, and then passes on the request or response as
chunked. Any chunk extensions are lost.
If the request is unchunked, the system processes the HTTP content, and then passes on the request
or response untouched.
• response-headers-permitted
Species headers that the BIG-IP system allows in an HTTP response. The default value is none.
• explicit-proxy
Species explicit settings for the HTTP prole:
• enabled
Species whether the explicit proxy service is enabled or disabled. The default it is no.
1119
Traffic Management Shell (tmsh) Reference Guide
• dns-resolver
Species the dns-resolver object that will be used to resolve hostnames in proxy requests. The default
is dns-resolver.
• tunnel-name
Species the tunnel that will be used for outbound proxy requests. This enables other virtual servers
to receive connections initiated by the proxy service. The default is http-tunnel.
• route-domain
Species the route-domain that will be used for outbound proxy requests. The default is 0.
• default-connect-handling
Species the behavior of the proxy service for CONNECT requests. If set to deny, CONNECT
requests will only be honored if there is another virtual server listening for the requested outbound
connection. If set to allow outbound connections will be made regardless of other virtual servers.
The default is deny.
• host-names
Species the which host names are to be treated as local. Proxy requests made for those hosts will
be treated as regular HTTP requests and will be sent to the congured default pool.
• connect-error-message
Species the error message that will be returned to the browser when a proxy request can't be
completed because of a failure to establish the outbound connection.
• dns-error-message
Species the error message that will be returned to the browser when a proxy request can't be
completed because of a failure to resolve the hostname in the request.
• bad-request-message
Species the error message that will be returned to the browser when a proxy request can't be
completed because the request was malformed.
• bad-response-message
Species the error message that will be returned to the browser when a proxy request can't be
completed because the response was malformed.
• sow
Species sFlow settings for the HTTP prole:
• poll-interval
Species the maximum interval in seconds between two pollings. The default value is 0. To enable
this setting, you must also set the poll-interval-global setting to no.
• poll-interval-global
Species whether the global HTTP poll-interval setting, which is available under sys sow
global-settings module, overrides the object-level poll-interval setting. The default value is yes.
The available values are:
• no
Species to use the object-level poll-interval setting.
• yes
Species to use the global HTTP poll-interval setting.
• sampling-rate
1120
LTM Profile
Species the ratio of packets observed to the samples generated. For example, a sampling rate of
2000 species that 1 sample will be randomly generated for every 2000 packets observed. The default
value is 0. To enable this setting, you must also set the sampling-rate-global setting to no.
• sampling-rate-global
Species whether the global HTTP sampling-rate setting, which is available under sys sow
global-settings module, overrides the object-level sampling-rate setting. The default value is yes.
The available values are:
• no
Species to use the object-level sampling-rate setting.
• yes
Species to use the global HTTP sampling-rate setting.
• via-host-name
Species the hostname that will be used in the Via: HTTP header. See via-request and via-response
for how the Via: header will be handled. If either via-request or via-response are set to append, then
this is required.
• via-request
Species how you want to process Via: HTTP header in requests sent to OWS. The default setting is
remove. The available values are:
• append
The value from via-host-name is appended to the Via: HTTP header.
• preserve
Via: HTTP header is preserved without changes.
• remove
Via: HTTP header is removed from the request.
• via-response
Species how you want to process Via: HTTP header in responses sent to clients. The default setting
is remove. The available values are the same as in via-request.
• server-agent-name
Species the string used as the server name in trafc generated by LTM. The default value is BigIP.
• alternative-xff-names
Species alternative XFF headers instead of the default X-forwarded-for header.
• hsts
Species HSTS settings for the HTTP prole:
• mode
Species if the HSTS settings are enabled or disabled. The default is disabled.
• maximum-age
Species the maximum age to be sent in the HSTS header. The default is 16070400.
• include-subdomains
Species if the includeSubdomains directive is sent in the HSTS header. The default is enabled.
1121
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, ltm prole fasthttp, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
http-compression
Congures an HTTP Compression prole.
Syntax
Congure the http-compression component within the ltm prole module using the syntax shown in the
following sections.
Create/Modify
create http-compression [name]
modify http-compression [name]
allow-http-10 [disabled | enabled]
app-service [[string] | none]
browser-workarounds [disabled | enabled]
buffer-size [integer]
cpu-saver [disabled | enabled]
cpu-saver-high [integer]
cpu-saver-low [integer]
content-type-exclude
[add | delete | replace-all-with] {
[content type] ...
}
content-type-exclude none
content-type-include
[add | delete | replace-all-with] {
[content type] ...
}
content-type-include none
defaults-from [ [name] | none]
description [string]
gzip-level [integer]
gzip-memory-level [integer, in bytes]
gzip-window-size [integer]
keep-accept-encoding [disabled | enabled]
method-prefer [deflate | gzip]
min-size [integer]
selective [disabled | enabled]
uri-exclude
[add | delete | replace-all-with] {
[URI] ...
}
uri-exclude none
uri-include
[add | delete | replace-all-with] {
[URI] ...
}
uri-include none
vary-header [disabled | enabled]
edit http-compression [ [ [name] | [glob] | [regex] ] ... ]
1122
LTM Profile
all-properties
non-default-properties
mv http-compression [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats http-compression
reset-stats http-compression [ [ [name] | [glob] | [regex] ] ... ]
Display
list http-compression
list http-compression [ [ [name] | [glob] | [regex] ] ... ]
show running-config http-compression
show running-config http-compression [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
one-line
partition
show http-compression
show http-compression [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete http-compression [name]
Description
You can use the http-compression component to create, modify, display, or delete an HTTP Compression
prole.
The BIG-IP(r) system installation includes the following default HTTP Compression-type proles:
• http-compression
• wan-optimized-compression
The default HTTP Compression prole contains values for properties related to managing compression
settings.
You can create a new HTTP Compression-type prole using an existing prole as a parent prole, and then
you can change the values of the properties to suit your needs.
Examples
create http-compression my_hc_prole defaults-from http-compression
1123
Traffic Management Shell (tmsh) Reference Guide
Creates a custom HTTP Compression prole named my_hc_prole that inherits its settings from the system
default HTTP Compression prole.
mv http-compression /Common/my_httpcompression_prole to-folder /Common/my_folder
Moves a custom http-compression prole named my_httpcompression_prole to a folder named my_folder,
where my_folder has already been created and exists within /Common.
Options
• allow-http10
Enables or disables compression of HTTP/1.0 server responses. The default value is disabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• browser-workarounds
Enables or disables compression of browser workarounds. The default value is disabled. Enabling this
options turns off compression on server responses when any of the following conditions are detected:
• If the client browser is Netscape Navigator(r) version 4.0x, compression is turned off. Netscape
advertises that the browser can handle compression gracefully. In this case, F5 Networks disables
compression entirely for that class of browser.
• If the client browser is Netscape Navigator version 4.x (4.10 and later) and the server response
Content-Type is not either text/html or text/plain compression is turned off. This class of Netscape
browsers can handle plain text and HTML just ne, but there are known issues with other types of
content.
• If the client browser is Microsoft(r) Internet Explorer (any version), the server response Content-Type
is either text/css or application/x-javascript, and the client connection is over SSL, compression is
turned off. The Microsoft article ID for this problem is 825057.
• If the client browser is Microsoft Internet Explorer (any version), the server response Content-Type
is either text/css or application/x-javascript, and the server sets the header Cache-Control to no-cache,
compression is turned off. The Microsoft article ID for this problem is 327286.
• buffer-size
Species the maximum number of uncompressed bytes that the system buffers before determining
whether to compress the response. Useful when the headers of a server response do not specify the length
of the response content. The default value is 4096.
• content-type-exclude
Species a string list of HTTP Content-Type responses that you do not want the system to compress.
The default value is none.
• content-type-include
Species a string list of HTTP Content-Type responses that you want the system to compress. The
default value is { text/ application/ (xml|x-javascript) }.
• cpu-saver
Enables or disables the CPU saver feature. When the CPU saver is enabled, the system monitors the
percent of CPU usage and adjusts compression rates automatically when the CPU usage reaches the
percentage dened in the compress-cpu-saver-low and compress-cpu-saver-high options. The default
value is enabled.
• cpu-saver-high
1124
LTM Profile
Species the percent of CPU usage at which the system starts automatically decreasing the amount of
content being compressed, as well as the amount of compression that the system is applying. The default
value is 90.
• cpu-saver-low
Species the percent of CPU usage at which the system resumes content compression at the user-dened
rates. The default value is 75.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is httpcompression.
• description
User dened description.
• gzip-level
Species a value that determines the amount of memory that the system uses when compressing a server
response. The default value is 1.
• gzip-memory-level
Species the amount of memory (in kilobytes) that the system uses when compressing a server response.
The system rounds the value up to the nearest power of two. The default value is 8. The maximum value
is 256.
• gzip-window-size
Species the number of kilobytes in the window size that the system uses when compressing a server
response. The system rounds the value up to the nearest power of two. The default value is 16k. The
maximum value is 128k.
• keep-accept-encoding
Species where data compression is performed. When enabled, the target server, rather than the BIG-IP
local trafc management system, performs data compression. The default value is disabled.
• method-prefer
Species the type of compression that the system prefers. The default value is gzip.
• min-size
Species the minimum length in bytes of a server response that is acceptable for compression. The
length in bytes applies to content length only, not headers. The default value is 1024.
• partition
Displays the administrative partition within which the prole resides.
• selective
Enables or disables selective compression mode. Note that the data compression feature compresses
HTTP server responses, and not client requests. The default value is disabled.
• to-folder
http-compression proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
• uri-exclude
Disables compression on a specied list of HTTP Request-URI responses. Use a regular expression to
specify a list of URIs you do not want to compress. The default value is none.
• uri-include
Enables compression on a specied list of HTTP Request-URI responses. Use a regular expression to
specify a list of URIs you want to compress. The default value is none.
1125
Traffic Management Shell (tmsh) Reference Guide
• vary-header
Enables or disables the insertion of a Vary header into cacheable server responses. The default value is
enabled.
See Also
create, delete, edit, glob, list, ltm prole fasthttp, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
http2
Congures a HTTP/2 protocol prole.
Syntax
Congure the http2 component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create http2 [name]
modify http2 [name]
activation-modes { [npn | alpn | always] ... }
concurrent-streams-per-connection [integer]
connection-idle-timeout [integer]
defaults-from [ [name] | none]
description [string]
frame-size [integer]
insert-header [disabled | enabled]
insert-header-name ["string"]
receive-window [integer]
write-size [integer]
header-table-size [integer]
Display
list http2
list http2 [ [ [name] | [glob] | [regex] ] ... ]
show running-config http2
show running-config http2 [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show http2
show http2 [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
1126
LTM Profile
Delete
delete http2 [name]
Description
You can use the http2 component to create, modify, display, or delete a HTTP/2 prole.
The BIG-IP(r) system installation includes the following default HTTP/2-type proles:
• http2
The default HTTP/2 prole contains values for properties related to managing HTTP/2 trafc.
You can create a new HTTP/2-type prole using an existing prole as a parent prole, and then you can
change the values of the properties to suit your needs.
Examples
create http2 my_http2_prole defaults-from http2
Options
• activation-modes
Species what will cause a connection to be treated as a HTTP/2 connection. The values npn and alpn
specify that the TLS next-protocol-negotiation and application-layer-protocol-negotiation will be used
to determine whether HTTP/2 should be activated. Clients that use TLS, but only support HTTP will
work as-if HTTP/2 is not present. The value always species that all connections are assumed to be
HTTP/2 connections. The default value is { npn alpn }.
• concurrent-streams-per-connection
Species how many concurrent requests are allowed to be outstanding on a single HTTP/2 connection.
• connection-idle-timeout
Species how many seconds a HTTP/2 connection is left open idly before it is shutdown.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is http2.
• description
User dened description.
• frame-size
Species the size of the data frames, in bytes, that HTTP/2 will send to the client. Larger frame sizes
will improve network utilization, but may affect concurrency. The default value is 2048.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• insert-header
Species whether an HTTP header that indicates the use of HTTP/2 should be inserted in the request
going to the back-end server. The default value is disabled.
• insert-header-name
Species the name of the HTTP header controlled by insert-header. The default value is "X-HTTP/2".
1127
Traffic Management Shell (tmsh) Reference Guide
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• receive-window
Species the receive window, in KB. The receive window is a mechanism used by HTTP/2 to perform
ow control. The receive window allows HTTP/2 to stall individual upload streams when needed. This
mechanism is available only for HTTP/2 version 3. The default value is 32.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• write-size
Species the total size of combined data frames, in bytes, HTTP/2 will send in a single write. This
controls the size of the TLS records when HTTP/2 is used over SSL. A large write size will cause HTTP/2
to buffer more data, but will improve network utilization. The default value is 16384.
• header-table-size
Species the size of the header table, in KB. The HTTP/2 protocol compresses http headers to save
bandwidth. A larger table will allow better compression, at the cost of more memory usage. The default
value is 4. This is currently unused.
See Also
create, delete, edit, glob, list, ltm prole fasthttp, ltm virtual, modify, regex, reset-stats, show, tmsh
icap
Congures an Internet Content Adaptation Protocol (ICAP) prole.
Syntax
Congure the icap component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create icap [name]
modify icap [name]
defaults-from [ [name] | none]
description [string]
header-from [string]
host [string]
preview-length [integer]
referer [string]
uri [string]
user-agent [string]
edit icap [ [ [name] | [glob] | [regex] ] ... ]
1128
LTM Profile
all-properties
non-default-properties
mv icap [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats icap
reset-stats icap [ [ [name] | [glob] | [regex] ] ... ]
Display
list icap
list icap [ [ [name] | [glob] | [regex] ] ... ]
show running-config icap
show running-config icap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show icap
show icap [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete icap [name]
Description
You can use the icap component to manage an Internet Content Adaptation Protocol prole.
Examples
create icap my_icap defaults-from icap
Creates an internet content adaptation protocol prole named my_icap using the system defaults.
create icap my_icap { uri icap://mycompany.com/ad_insertion/ }
Creates an internet content adaptation protocol prole named my_icap that uses
icap://mycompany.com/ad_insertion/ as the ICAP URI.
mv icap /Common/my_icap_prole to-folder /Common/my_folder
Moves a custom icap prole named my_icap_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is icap.
1129
Traffic Management Shell (tmsh) Reference Guide
• description
User dened description.
• header-from
Species the header-from attribute to use in the ICAP header. Please refer to RFC 3507 section 4.3.2.
• host
Species the host attribute to use the in the ICAP header. Please refer to RFC 3507 section 4.3.2i.
• preview-length
Species the ICAP data preview size. Please refer to RFC 3507 section 4.5.
• referer
Species the referer attribute to use in the ICAP header. Please refer to RFC 3507 section 4.3.2.
• to-folder
icap proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• uri
Species the ICAP URI to use in the ICAP header. Please refer to RFC 3507 section 4.2. Macro expansion
has been implemented for all attributes values in the ICAP header. If an ICAP header attribute value
contains ${SERVER_IP}, the macro will be replaced with the IP address of the ICAP server selected
from the internal virtual server's pool. If an ICAP header attribute contains ${SERVER_PORT}, the
macro will be replaced with the port of the ICAP server selected from the internal virtual server's pool.
For example, the URI attribute in an ICAP prole could be set to
icap://${SERVER_IP}:${SERVER_PORT}/videoOptimization.
• user-agent
Species the user-agent attribute to use in the ICAP header. Please refer to RFC 3507 section 4.3.2.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh, ltm prole
response-adapt
iiop
Congures an Internet Inter-Orb Protocol (IIOP) prole.
Syntax
Congure the iiop component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create iiop [name]
modify iiop [name]
abort-on-timeout [disabled | enabled]
app-service [[string] | none]
defaults-from [name]
description [string]
1130
LTM Profile
persist-object-key [disabled | enabled]
persist-request-id [disabled | enabled]
timeout [integer]
edit iiop [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats iiop
reset-stats iiop [name]
Display
list iiop
list iiop [ [ [name] | [glob] | [regex] ] ... ]
show running-config iiop
show running-config iiop [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show iiop
show iiop [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete iiop [name]
Description
You can use the iiop component to manage IIOP network trafc. The system parses the incoming TCP
stream, disaggregates it into IIOP messages, and performs load balancing and persistence based on the
parameters you set.
Examples
create iiop my_iiop_prole defaults-from iiop
Creates an IIOP prole named my_iiop_prole that inherits its settings from the system default IIOP prole
named iiop.
list iiop all-properties
Displays all properties for all IIOP proles.
Options
• abort-on-timeout
1131
Traffic Management Shell (tmsh) Reference Guide
Species whether the system aborts the connection if there is no response received within the time
specied in the timeout option. The default value is disabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is iiop.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which this prole resides.
• persist-object-key
Species whether to persist connections based on the object key in the IIOP request. The default value
is disabled.
• persist-request-id
Species whether to persist connections based on the request ID in the IIOP request. The default value
is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• timeout
Species the request timeout. The system uses this value when the abort-on-timeout option is enabled.
The default value is 30 seconds.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
ipother
Congures a generic IP prole for non-TCP and non-UDP trafc.
1132
LTM Profile
Syntax
Congure the ipother component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create ipother [name]
modify ipother [name]
app-service [[string] | none]
defaults-from [[name] | none]
description [string]
idle-timeout [immediate | indefinite | integer]
edit ipother [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats ipother
reset-stats ipother [ [ [name] | [glob] | [regex] ] ... ]
Display
list ipother
list ipother [ [ [name] | [glob] | [regex] ] ... ]
show running-config ipother
show running-config ipother
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show ipother
show ipother [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete ipother [name]
Description
You can use the ipother component to manage non-TCP and non-UDP network trafc. If you want to
manage TCP or UDP trafc, then use the appropriate TCP or UDP LTM proles.
Examples
create ipother my_ipother_prole defaults-from ipother
1133
Traffic Management Shell (tmsh) Reference Guide
This creates a custom IP-OTHER prole that is named my_ipother_prole which inherits its settings from
the system default IP-OTHER prole.
list ipother all-properties
Displays all properties for all IP-OTHER proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is ipother.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 60 seconds.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the prole resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, ltm prole, ltm virtual, modify, show, regex, reset-stats, tmsh
mblb
Congures an MBLB prole (experimental).
Syntax
Congure the mblb component within the ltm prole module using the syntax shown in the following
sections.
1134
LTM Profile
Create/Modify
create mblb [name]
modify mblb [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
isolate-abort [disabled | enabled]
isolate-expire [disabled | enabled]
isolate-server [disabled | enabled]
isolate-client [disabled | enabled]
egress-high [# of messages]
egress-low [# of messages]
ingress-high [# of messages]
ingress-low [# of messages]
min-conn [# of connections]
tag-ttl [# of seconds]
shutdown-timeout [# of seconds]
edit mblb [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list mblb
list mblb [ [ [name] | [glob] | [regex] ] ... ]
show running-config mblb
show running-config mblb [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Delete
delete mblb [name]
Description
Use this command to create, modify, display, or delete an MBLB prole with which you can customize
MBLB behavior.
Examples
create mblb my_mblb_prole defaults-from mblb
Creates a custom MBLB prole named my_mblb_prole that inherits its settings from the system default
MBLB prole.
list mblb
Displays the properties of all MBLB proles.
Options
• app-service
1135
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is mblb.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• isolate-abort
Specify whether to isolate abort event propagation.
• isolate-expire
Specify whether to isolate expiration event propagation.
• isolate-server
Specify whether to isolate serverside shutdown event propagation. This also dominate serverside
abort/expiration event propagation.
• isolate-client
Specify whether to isolate clientside shutdown event propagation. This also dominate clientside
abort/expiration event propagation.
• egress-high
Specify the high water mark for egress message queue. The default value is 50.
• egress-low
Specify the low water mark for egress message queue. The default value is 5.
• ingress-high
Specify the high water mark for ingress message queue. The default value is 50.
• ingress-low
Specify the low water mark for ingress message queue. The default value is 5.
• min-conn
Specify the minimum number of serverside connections. The default value is 0.
• tag-ttl
Specify the TTL (time to live) for message TAG. The default value is 60.
• shutdown-timeout
1136
LTM Profile
Delays sending FIN when BIGIP receives the rst FIN packet from either the client or the server. Value
of 0 means send FIN immediately otherwise the minimum of tcp idle timeout and shutdown timeout is
used. The default value is 5 seconds
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, sys provision, tmsh
mssql
Congures a prole to manage mssql(tds) database trafc.
Syntax
Congure the mssql component within the ltm prole module using the syntax in the following sections.
Create/Modify
create mssql [name]
modify mssql [name]
app-service [[string] | none]
defaults-from [name]
description [[string] | none]
read-pool [string]
read-write-split-by-user [disabled | enabled]
read-write-split-by-command [disabled | enabled]
user-can-write-by-default [true | false]
user-list [add | delete | none | replace-all-with] {
[user names...]
}
write-persist-timer [number]
write-pool [string]
edit mssql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats mssql
reset-stats mssql [ [ [name] | [glob] | [regex] ] ... ]
Display
list mssql
list mssql [ [ [name] | [glob] | [regex] ] ... ]
show running-config mssql
show running-config mssql [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1137
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
show mssql
show mssql [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete mssql [name]
Description
You can use the mssql component to congure a prole to manage mssql(tds) database trafc.
Examples
create mssql my_mssql_prole defaults-from mssql
Creates a mssql prole named my_mssql_prole that inherits its settings from the system default mssql
prole.
list mssql
Displays the properties of all mssql proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is mssql.
• partition
Displays the administrative partition within which the prole resides.
• read-pool
Species the pool of MS SQL database servers to which the system sends ready-only requests.
• read-write-split-by-command
When enabled, the system decides which pool to send the client requests the by the content in the
message. It can only be enabled when read-write-split-by-user is disabled.
• read-write-split-by-user
When enabled, the system decides which pool to send the client requests the by user name. It can only
be enabled when read-write-split-by-command is disabled.
• user-can-write-by-default
1138
LTM Profile
Species whether users have write access by default. When set to true, all users have write access,
except those added to the users list.
• user-list
Species the users who have read-only access to the MS SQL if user-can-write-by-default is true, or
the users who have write access to the MS SQL database if user-can-write-by-default is false.
• write_persist_timer
Specify how many minimum time in milliseconds the connection will be persisted to write-pool after
connection switch to write pool.
• write-pool
Species the pool of MS SQL database servers to which the system sends requests that are not read-only.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
ntlm
Congures a Microsoft(r) Windows(r) NT Local Area Network (LAN) manager prole.
Syntax
Congure the ntlm component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create ntlm [name]
modify ntlm [name]
app-service [[string] | none]
defaults-from [name]
description [string]
insert-cookie-domain [domain]
insert-cookie-name [cookie name]
insert-cookie-passphrase [passphrase]
key-by-cookie [disabled | enabled]
key-by-cookie-name [cookie name]
key-by-domain [disabled| enabled]
key-by-ip-address [disabled | enabled]
key-by-target [disabled| enabled]
key-by-user [disabled | enabled]
key-by-workstation [disabled| enabled]
edit ntlm [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ntlm
1139
Traffic Management Shell (tmsh) Reference Guide
list ntlm [ [ [name] | [glob] | [regex] ] ... ]
show running-config ntlm
show running-config ntlm [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete ntlm [name]
Description
You can use the ntlm component to create a Microsoft Windows NT LAN manager (NTLM) prole to
manage servers on the LAN that are running Windows NT.
Examples
create ntlm my_ntlm_prole defaults-from ntlm
Creates a Microsoft Windows NT LAN manager prole named my_ntlm_prole that inherits its settings
from the system default NTLM prole named ntlm.
list ntlm all-properties
Displays all properties for all NTLM proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is ntlm.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• insert-cookie-domain
Species an optional domain for the inserted cookie. The default is none, which causes no domain to
be congured for the inserted cookie.
• insert-cookie-name
Species a cookie name that the system inserts in the cookie. The default value is NTLMconnpool.
• insert-cookie-passphrase
Species a cookie passphrase that the system inserts in the cookie. The default value is mypassphrase.
• key-by-cookie
Species whether the system uses the existing cookie as the key. The default value is disabled.
1140
LTM Profile
• key-by-cookie-name
Species whether the system uses the value of the insert-cookie-name option as the key. The default
value is mycookie.
• key-by-domain
Species whether the system uses the NTLM domain as the key. The default value is disabled.
• key-by-ip-address
Species whether the system uses the client IP address as the key. The default value is disabled.
• key-by-target
Species whether the system uses the NTLM target as the key. The default value is disabled.
• key-by-user
Species whether the system uses the NTLM user as the key. The default value is enabled.
• key-by-workstation
Species whether the system uses the NTLM workstation as the key. The default value is disabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
ocsp-stapling-params
Congures the OCSP Stapling Parameters object.
Syntax
Congure the ocsp-stapling-params component within the ltm.prole module using the syntax shown in
the following sections. This object is associated with the certicate in a cert-key-chain object in a client-ssl
prole to enable OCSP Stapling.
Create/Modify
create ocsp-stapling-params [name]
modify ocsp-stapling-params [name]
cache-error-timeout [integer]
cache-timeout [indefinite | [integer] ]
clock-skew [integer]
description [string]
dns-resolver [name]
proxy-server-pool [name]
responder-url [none | [string] ]
sign-hash [sha1 | sha256]
1141
Traffic Management Shell (tmsh) Reference Guide
signer-cert [name]
signer-key [name]
signer-key-passphrase [none | [string] ]
status-age [integer]
strict-resp-cert-check [disabled | enabled]
timeout [indefinite | [integer] ]
trusted-ca [name]
trusted-responders [none | [name] ]
use-proxy-server [disabled | enabled]
edit ocsp-stapling-params [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ocsp-stapling-params
list ocsp-stapling-params [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete ocsp-stapling-params [all | [name]]
recursive
Description
You can use the ocsp-stapling-params component to create, modify, display or delete a custom OCSP
Stapling Parameters object.
The OCSP Stapling Parameters object is associated with the certicate in a cert-key-chain object of a
clientssl prole.
Examples
create ocsp-stapling-params my_ocsp_stapling_params dns-resolver name
Creates an OCSP Stapling Parameters object named my_ocsp_stapling_params using the DNS resolver
specied by name.
create ocsp-stapling-params my_ocsp_stapling_params use-proxy-server enabled proxy-server-pool
name
Creates an OCSP Stapling Parameters object named my_ocsp_stapling_params using the proxy server
pool specied by name.
Options
• cache-error-timeout
Species the lifetime of an error response in the cache, in seconds. The default value is 3600 seconds.
• cache-timeout
Species the lifetime of the OCSP response in the cache, in seconds. The actual time period for which
the response is cached is the minimum of the response validity period and the cache-timeout. The default
value is indenite, indicating that the response validity period takes precedence.
• clock-skew
1142
LTM Profile
Species the tolerable absolute difference in the clocks of the responder and the BIG-IP, in seconds.
The default value is 300.
• description
User dened description.
• dns-resolver
Species the DNS resolver object used for fetching the OCSP response.
• proxy-server-pool
Species the proxy server pool used for fetching the OCSP response.
• responder-url
Species the absolute URL that overrides the OCSP responder URL obtained from the certicate's AIA
extension(s). This should be a HTTP or HTTPS based URL.
• sign-hash
Species the hash algorithm used for signing the OCSP request. The default value is sha256.
• signer-cert
Species the certicate corresponding to the key used for signing the OCSP request.
• signer-key
Species the key used for signing the OCSP request.
• signer-key-passphrase
Species the passphrase of the key used for signing the OCSP request.
• status-age
Species the maximum allowed lag time for the 'thisUpdate' time in the OCSP response that the BIG-IP
accepts. If this maximum is exceeded, the response is dropped. If this value is set to 0, this validation
is skipped. The default value is 86400 seconds.
• strict-resp-cert-check
If enabled, the responder's certicate is checked for OCSP signing extension. The default value is
disabled.
• timeout
Species the time interval (in seconds) that the BIG-IP waits for before aborting the connection to the
OCSP responder. The default value is 8. The timeout should be less than the handshake timeout of the
clientssl prole that the OCSP Stapling Parameters object is associated with.
• trusted-ca
Species the certicate-authority that signs the responder's certicate.
• trusted-responders
Species the certicate(s) used for validating the OCSP response when the responder's certicate has
been omitted from the response.
• use-proxy-server
Species whether the proxy server pool or the DNS resolver should be used for the connection to the
OCSP responder.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, tmsh
1143
Traffic Management Shell (tmsh) Reference Guide
one-connect
Congures a OneConnect(tm) prole.
Syntax
Congure the one-connect component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create one-connect [name]
modify one-connect [name]
app-service [[string] | none]
defaults-from [name]
description [string]
idle-timeout-override [disabled | enabled]
share-pools [disabled | enabled]
max-age [integer]
max-reuse [integer]
max-size [integer]
source-mask [ip address]
limit-type [none|idle|strict]
edit one-connect [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv one-connect [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats one-connect
reset-stats one-connect[ [ [name] | [glob] | [regex] ] ... ]
Display
list one-connect
list one-connect [ [ [name] | [glob] | [regex] ] ... ]
show running-config one-connect
show running-config one-connect [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show one-connect
show one-connect [ [ [name] | [glob] | [regex] ] ... ]
1144
LTM Profile
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete one-connect [name]
Description
You can use the one-connect component to create a OneConnect prole that optimizes connections by
improving client performance and increasing server capacity.
Examples
create one-connect my_OC_prole defaults-from oneconnect
Creates a OneConnect prole named my_OC_prole that inherits its settings from the system default
OneConnect prole named oneconnect.
list one-connect all-properties
Displays all properties for all OneConnect proles.
mv one-connect /Common/my_oneconnect_prole to-folder /Common/my_folder
Moves a custom one-connect prole named my_oneconnect_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is oneconnect.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• idle-timeout-override
Species the number of seconds that a connection is idle before the connection ow is eligible for
deletion. The default value is disabled.
• share-pools
Indicates that connections may be shared not only within a virtual server, but also among similar virtual
servers (e.g. those that differ only in destination address). When enabled, all virtual servers that use the
same One Connect and other internal network proles can share connections.
• max-age
1145
Traffic Management Shell (tmsh) Reference Guide
Species the maximum age, in number of seconds, of a connection in the connection reuse pool. For
any connection with an age higher than this value, the system removes that connection from the reuse
pool. The default value is 86400.
• max-reuse
Species the maximum number of times that a server connection can be reused. The default value is
1000.
• max-size
Species the maximum number of connections that the system holds in the connection reuse pool. If
the pool is already full, then the server connection closes after the response is completed. The default
value is 10000.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• source-mask
Species a source IP mask. The default value is 0.0.0.0.
The system applies the value of this option to the source address to determine its eligibility for reuse.
A mask of 0.0.0.0 causes the system to share reused connections across all clients. A host mask (all 1's
in binary), causes the system to share only those reused connections originating from the same client IP
address.
• limit-type
Connection limits with OneConnect are different from straight TCP connection limits. Three options
are supported: "none" (the default), "idle", and "strict". When the limit is "none", simultaneous in-ight
requests and responses over TCP connections to a pool member are counted toward the limit (this being
the historical handling). There may be more TCP connections open to support new requests than there
can be simultaneous in-ight requests and responses. This is particularly true when SNAT pools and
narrow source address masks are used. When the limit is "idle", idle connections will be dropped as the
TCP connection limit is reached. For short intervals, during the overlap of the idle connection being
dropped and the new connection being established, the TCP connection limit may be exceeded. When
the limit is "strict", the TCP connection limit is honored with no exceptions. This means that idle
connections will prevent new TCP connections from being made until they expire, even if they could
otherwise be reused. This is not a recommended conguration except in very special cases with short
expiration timeouts.
• to-folder
one-connect proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
1146
LTM Profile
pcp
Congures a PCP prole.
Syntax
Create/Modify
create pcp [name]
modify pcp [name]
announce-after-failover [ enabled | disabled ]
announce-multicast [integer]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
map-filter-limit [integer]
map-limit-per-client [integer]
map-recycle-delay [integer]
max-mapping-lifetime [integer]
min-mapping-lifetime [integer]
rule [[rule_name] | none]
third-party-allowed-subnets
[add | delete | replace-all-with] {
[ip address/prefix length] ...
}
third-party-option [ enabled | disabled ]
edit pcp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list pcp
list pcp [ [ [name] | [glob] | [regex] ] ... ]
show running-config pcp
show running-config pcp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show pcp
show pcp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete pcp [name]
1147
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the pcp component to specify Port Control Protocol attributes for a prole that can be used in
an LSN pool.
Examples
create pcp my_pcp_prole defaults-from pcp
Creates a custom PCP prole named my_pcp_prole that inherits its settings from the system default pcp
prole.
list pcp all-properties
Displays all properties for all PCP proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is pcp, a prole that is shipped in the software.
• description
User dened description.
• announce-after-failover
Species that the BIG-IP software should send an unsolicited ANNOUNCE response to all PCP clients
when there is a failover. The unsolicited ANNOUNCE response goes over a link-local multi-cast address,
and it contains a new EPOCH time. This signals to the PCP clients that they should renew all of their
active mappings.
• announce-multicast
Whenever the BIG-IP system reboots, or if there is any possibility that the system lost its PCP-mapping
state, it sends an unsolicited ANNOUNCE response to all of its PCP clients. It sends the response over
a link-local multi-cast address, and it contains a new EPOCH time. The PCP clients react by renewing
all of their active IP mappings. To compensate for possible packet loss (since the multi-cast address is
link-local), you can use this property to set the number of multi-cast re-sends. Default is 10 re-sends.
• map-lter-limit
A PCP client can request a "lter" for a mapping entry, where the lter limits the number of external
endpoints that can use the IP map. The lter request contains the particular IP address and port for the
endpoint (or subnet of endpoints), as well as a prex length. Enter the maximum number of lters
(allowed subnets) that clients are allowed to set for each PCP mapping. Default is 1.
• map-limit-per-client
Species the maximum number of PCP mappings per client. Default is 65535 (unlimited).
Use run util lsndb to see the currently-active set of PCP mappings on the system. See util lsndb for
details on the LSN DB utility.
• map-recycle-delay
After a IP mapping times out (that is, its lifetime expires), there is a further delay before the public-side
address and port can be used by another PCP client. Use this property to set the recycle delay. Default
is 60 (seconds).
1148
LTM Profile
Use run util lsndb to see the currently-active set of PCP mappings on the system. See util lsndb for
details on the LSN DB utility.
• max-mapping-lifetime
When a PCP client requests an IP mapping from a BIG IP system, it also requests a "lifetime" for the
mapping. The mapping expires at the end of that lifetime. This property is the maximum number of
seconds allowed for a mapping lifetime. Default is 86400 (seconds), or 1 day.
Use run util lsndb to see the currently-active set of PCP mappings on the system. See util lsndb for
details on the LSN DB utility.
• min-mapping-lifetime
Species the minimum number of seconds allowed for a mapping lifetime. Default is 600 (seconds), or
10 minutes.
Use run util lsndb to see the currently-active set of PCP mappings on the system. See util lsndb for
details on the LSN DB utility.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex (regex)
for a description of regular expression syntax.
• rule
Species the iRule that is associated with this pcp prole. An iRule can read packets and possibly lter
them based on whatever programming logic you design. For example, an iRule could reject all PCP
mapping requests using a specic port, or pass an ANNOUNCE request through a specic port. An
iRule gives you the exibility to lter, process, or log the PCP packets that t this prole.
Select an iRule from the menu of existing iRules. To create a new one, use the create ltm rule command
(see ltm rule).
• third-party-allowed-subnets
Species the PCP clients that can make MAP requests on behalf of other clients. Enter a collection of
IP prexes (IPv4 or IPv6) with their prex lengths. If a PCP client outside of any of these subnets
attempts a PCP mapping, the BIG-IP software rejects the mapping.
You can shorten any IPv6 addresses as dened in RFC 2373 (see http://www.ietf.org/rfc/rfc2373.txt).
This list is only used if the third-party-option is also enabled.
If the list is empty and the third-party-option is enabled, any PCP client can create mappings for third
parties.
• third-party-option
Allows PCP clients to make MAP requests on behalf of other clients, using the THIRD_PARTY ag
in the PCP request. You can set this property to enabled or disabled. If you enable this property, we
recommend using the third-party-subnets option to limit the the clients that can use the THIRD_PARTY
ag; it is a potential security risk. The default is disabled.
See Also
create, delete, edit, list, ltm lsn-pool, modify, tmsh
1149
Traffic Management Shell (tmsh) Reference Guide
pptp
Congures a Point-to-Point Tunneling Protocol (PPTP) prole.
Syntax
Congure the pptp component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create pptp [name]
modify pptp [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [[string] | none]
publisher-name [[string] | none]
include-destination-ip [disabled | enabled]
edit pptp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats pptp
reset-stats pptp [ [ [name] | [glob] | [regex] ] ... ]
Display
list pptp
list pptp [ [ [name] | [glob] | [regex] ] ... ]
show running-config pptp
show running-config pptp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show pptp
show pptp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete pptp [name]
1150
LTM Profile
Description
You can use the pptp component to manage a PPTP prole.
Examples
create pptp my_pptp_prole defaults-from pptp
Creates a PPTP prole named my_pptp_prole using the system defaults.
create pptp my_pptp_prole { log-server-ip disabled }
Creates a PPTP prole named my_pptp_prole with server address logging disables.
modify pptp my_pptp_prole description "This is a PPTP Prole"
Modies the description attribute of a PPTP prole named my_pptp_prole.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is pptp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• publisher-name
Species the name of the log publisher for PPTP events.
• include-destination-ip
Species whether the log messages for call establishment/disconnect include the server's ip address.
The default value is disabled. When disabled the ip address will be displayed as 0.0.0.0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
1151
Traffic Management Shell (tmsh) Reference Guide
qoe
Congures a Quality of Experience (QoE) Monitoring prole.
Syntax
Congure the qoe component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create qoe [name]
modify qoe [name]
app-service [[string] | none]
defaults-from [name]
description [[string] | none]
video [true | false]
reset-stats qoe
reset-stats qoe [ [ [name] | [glob] | [regex] ] ... ]
Display
list qoe
list qoe [ [ [name] | [glob] | [regex] ] ... ]
show running-config qoe
show running-config qoe [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show qoe
show qoe [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete qoe [name]
Description
You can use the qoe component to monitor Video Quality of Experience.
Examples
create qoe my_qoe defaults-from qoe
Creates an quality of experience prole named my_qoe.
1152
LTM Profile
create qoe my_qoe { video true }
• video
Species to monitor the QoE MOS score of video streams with the format of MP4 or FLV.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, ltm prole qoe
radius
Congures a RADIUS prole for network trafc load balancing.
Syntax
Congure the radius component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create radius [name]
modify radius [name]
app-service [[string] | none]
clients [add | delete | modify | replace-all-with] {
[ip address] ...
}
clients none
defaults-from [name]
description [string]
persist-avp [ [string] | [integer] | none]
pem-protocol-profile-radius [ [pem_protocol_profile_radius_name] | none]
subscriber-discovery [ disabled | enabled ]
mv radius [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
edit radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats radius
reset-stats radius [ [ [name] | [glob] | [regex] ] ... ]
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ... ]
1153
Traffic Management Shell (tmsh) Reference Guide
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show radius
show radius [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete radius [name]
Description
You can use the radius component to manage RADIUS network trafc.
Examples
create radius my_radius_server
Creates a RADIUS prole named my_radius_server that inherits its settings from the system default
RADIUS prole.
delete radius my_radius_server
Deletes the RADIUS prole named my_radius_server.
mv radius /Common/my_radius_prole to-folder /Common/my_folder
Moves a custom radius prole named my_radius_prole to a folder named my_folder, where my_folder
has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• clients
Species host and network addresses from which clients can connect. The default value is none, which
indicates that any client can connect.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is radiusLB.
• description
User dened description.
• glob
1154
LTM Profile
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• pem-protocol-prole-radius
Species PEM protocol prole to be used when subscriber discovery is enabled. PEM protocol prole
denes mapping of RADIUS AVPs to subscriber ID and other PEM subscriber session attributes.
• persist-avp
Species the name of the RADIUS attribute on which trafc persists. Acceptable values are ASCII
strings from section 5 of RFC 2865 or numeric codes (1-255). The default value is none, which indicates
that persistence is disabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• subscriber-discovery
Species whether to enable PEM subscriber discovery based on the content of RADIUS packets. The
options are disabled and enabled. The default value is disabled, which indicates that it will not extract
subscriber information from RADIUS packets.
• to-folder
radius proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
ramcache
Manages the BIG-IP(r) system RAM cache.
Syntax
Congure the ramcache component within the ltm prole module using the syntax shown in the following
sections.
Display
show ramcache
show ramcache [ [ [name] | [glob] | [regex] ] ... ]
exact
host [string]
1155
Traffic Management Shell (tmsh) Reference Guide
max-response [integer]
uri [string]
Delete
delete ramcache [name]
Description
You can use the ramcache component to delete the entries in or show information about the BIG-IP(r)
system RAM cache.
Examples
show ramcache
Displays information about the entries in the BIG-IP system RAM cache.
delete ramcache
Deletes the entries in the BIG-IP system RAM cache.
Options
• exact
Displays the exact number of entries in the RAM cache.
• host
Displays the host from which the entry was cached.
• max-response
Displays the maximum number of entries that can be in the RAM cache. The default value is 0 (zero),
which means that the system does not limit the maximum entries.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• uri
Displays the URI from which the entry was cached.
See Also
delete, show, tmsh
request-adapt
Congures a HTTP request adaptation prole.
1156
LTM Profile
Syntax
Congure the request-adapt component within the ltm prole module using the syntax shown in the
following sections.
Create/Modify
create request-adapt [name]
modify request-adapt [name]
defaults-from [ [name] | none]
enabled [ yes | no ]
internal-virtual [ [name] | none]
preview-size [integer]
service-down-action [ ignore | reset | drop ]
timeout [integer]
allow-http-10 [ yes | no ]
edit request-adapt [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv request-adapt [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats request-adapt
reset-stats request-adapt [ [ [name] | [glob] | [regex] ] ... ]
Display
list request-adapt
list request-adapt [ [ [name] | [glob] | [regex] ] ... ]
show running-config request-adapt
show running-config request-adapt [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show request-adapt
show request-adapt [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete request-adapt [name]
1157
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the request-adapt component to manage a HTTP request adaptation prole.
Examples
create request-adapt my_req_adapt defaults-from request-adapt
Creates a HTTP request adaptation prole named my_req_adapt using the system defaults.
create request-adapt my_req_adapt { enabled yes }
Creates a HTTP request adaptation prole named my_req_adapt that is enabled for adapting HTTP requests.
mv request-adapt /Common/my_requestadapt_prole to-folder /Common/my_folder
Moves a custom request-adapt prole named my_requestadapt_prole to a folder named my_folder,
where my_folder has already been created and exists within /Common.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is requestadapt.
• enabled
Enables adaptation of HTTP requests. If set to yes, HTTP requests will be forwarded to the specied
internal virtual server for adaptation. The default value is yes.
• internal-virtual
Species the name of the internal virtual server to use for adapting the HTTP request.
• preview-size
Species the maximum size of the preview buffer. The preview buffer is used to hold a copy of the
HTTP request header and data sent to the internal virtual server in case the adaptation server reports
that it does not need to adapt the HTTP request. Setting the preview-size to 0, disables buffering the
request and should only be done if the adaptation server will always return with a modied HTTP request
or the original HTTP request. The default value is 1024.
• service-down-action
Species the action to take if the internal virtual server does not exist or returns an error. The default
value is ignore.
The options are:
• ignore
Ignore the error and send the unmodied HTTP request to a HTTP server selected from this virtual
server's pool.
• drop
Drop the connection.
• reset
Reset the connection.
• timeout
Species a timeout in milliseconds. If the internal virtual server does not return a result within the
specied time, a timeout error will occur. A 0 value disables the timeout. The default value is 0.
• to-folder
request-adapt proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
1158
LTM Profile
• allow-http-10
Species whether to forward HTTP version 1.0 requests for adaptation. By default only HTTP version
1.1 requests are forwarded. Version 1.0 is not supported. While it should work in most cases, it might
be necessary to restrict adaptation on a site-specic basis. The default value is no.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh, ltm prole
response-adapt
request-log
Congures a Request-Logging prole.
Syntax
Congure the request-log component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create request-log [name]
modify request-log [name]
app-service [[string] | none]
defaults-from [[name] | none]
description [string]
log-request-logging-errors [disabled | enabled]
log-response-by-default [disabled | enabled]
log-response-logging-error [disabled | enabled]
proxy-close-on-error [disabled | enabled]
proxy-respond-on-logging-error [disabled | enabled]
proxy-response [string]
request-log-error-pool [ [pool_name] | none]
request-log-error-protocol [ TCP | UDP | none]
request-log-error-template [string]
request-log-pool [ [pool_name] | none]
request-log-protocol [ TCP | UDP | none]
request-log-template [string]
request-logging [disabled | enabled]
response-log-error-pool [ [pool_name] | none]
response-log-error-protocol [ TCP | UDP | none]
response-log-error-template [string]
response-log-pool [ [pool_name] | none]
response-log-protocol [ TCP | UDP | none]
response-log-template [string]
response-logging [disabled | enabled]
edit request-log [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv request-log [ [[source-name] [destination-name]] | [[name] to-folder
1159
Traffic Management Shell (tmsh) Reference Guide
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
Display
list request-log
list request-log [ [ [name] | [glob] | [regex] ] ... ]
show running-config request-log
show running-config request-log
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show request-log
show request-log [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete request-log [name]
Description
You can use the request-log component to manage request-log network trafc.
Examples
create request-log my_reqlog_prole defaults-from request-log
Creates a custom request-log prole named my_reqlog_prole that inherits its settings from the system
default request-log prole.
list request-log all-properties
Displays all properties for all request-log proles.
mv request-log /Common/my_requestlog_prole to-folder /Common/my_folder
Moves a custom request-log prole named my_requestlog_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the default values from this prole.
• description
1160
LTM Profile
User dened description.
• log-request-logging-errors
Enables secondary logging should the primary lack sufcient available bandwidth. This mechanism is
best used to send an alert to a completely separate destination.
• log-response-by-default
Indicates if response logging may be overridden via iRule. This eld determines the default response
action.
• log-response-logging-errors
Enables secondary logging should the primary lack sufcient available bandwidth. This mechanism is
best used to send an alert to a completely separate destination.
• partition
Displays the administrative partition within which the prole resides.
• proxy-close-on-error
Species, if enabled, that the logging prole will close the connection after sending its proxy-response.
• proxy-respond-on-logging-error
Species that the logging prole respond directly (for example, with an HTTP 502) if the logging fails.
• proxy-response
Species the response to send on logging errors.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• request-log-error-pool
Species the name of the pool from which to select log servers.
• request-log-error-protocol
Species the HighSpeedLogging protocol to use when logging.
• request-log-error-template
Species the template to use when generating log messages. Shell style escapes (for example, $foo
and/or ${foo}) are used to import transaction-specic values.
• request-log-pool
Species the name of the pool from which to select log servers.
• request-log-protocol
Species the HighSpeedLogging protocol to use when logging.
• request-log-template
Species the template to use when generating log messages. Shell style escapes (for example, $foo
and/or ${foo}) are used to import transaction-specic values.
• request-logging
Enables or disables logging before the response is returned to the client.
• response-log-error-pool
Species the name of the pool from which to select log servers.
• response-log-error-protocol
1161
Traffic Management Shell (tmsh) Reference Guide
Species the HighSpeedLogging protocol to use when logging.
• response-log-error-template
Species the template to use when generating log messages. Shell style escapes (for example, $foo
and/or ${foo}) are used to import transaction-specic values.
• response-log-pool
Species the name of the pool from which to select log servers.
• response-log-protocol
Species the HighSpeedLogging protocol to use when logging.
• response-log-template
Species the template to use when generating log messages. Shell style escapes (for example, $foo
and/or ${foo}) are used to import transaction-specic values.
• response-logging
Enables or disables logging before the response is returned to the client.
• to-folder
request-log proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, ltm prole, ltm virtual, modify, mv, show, regex, tmsh
response-adapt
Congures a HTTP response adaptation prole.
Syntax
Congure the response-adapt component within the ltm prole module using the syntax shown in the
following sections.
Create/Modify
create response-adapt [name]
modify response-adapt [name]
defaults-from [ [name] | none]
enabled [ yes | no ]
internal-virtual [ [name] | none]
preview-size [integer]
service-down-action [ ignore | reset | drop ]
timeout [integer]
allow-http-10 [ yes | no ]
edit response-adapt [ [ [name] | [glob] | [regex] ] ... ]
1162
LTM Profile
all-properties
non-default-properties
mv response-adapt [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats response-adapt
reset-stats response-adapt [ [ [name] | [glob] | [regex] ] ... ]
Display
list response-adapt
list response-adapt [ [ [name] | [glob] | [regex] ] ... ]
show running-config response-adapt
show running-config response-adapt [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show response-adapt
show response-adapt [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete response-adapt [name]
Description
You can use the response-adapt component to manage a HTTP response adaptation prole.
Examples
create response-adapt my_req_adapt defaults-from response-adapt
Creates a HTTP response adaptation prole named my_req_adapt using the system defaults.
create response-adapt my_req_adapt { enabled yes }
Creates a HTTP response adaptation prole named my_req_adapt that is enabled for adapting HTTP
responses.
mv response-adapt /Common/my_responseadapt_prole to-folder /Common/my_folder
Moves a custom responseadapt prole named my_responseadapt_prole to a folder named my_folder,
where my_folder has already been created and exists within /Common.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is responseadapt.
1163
Traffic Management Shell (tmsh) Reference Guide
• enabled
Enables adaptation of HTTP responses. If set to yes, HTTP responses will be forwarded to the specied
internal virtual server for adaptation. The default value is yes.
• internal-virtual
Species the name of the internal virtual server to use for adapting the HTTP response.
• preview-size
Species the maximum size of the preview buffer. The preview buffer is used to hold a copy of the
HTTP response header and data sent to the internal virtual server in case the adaptation server reports
that it does not need to adapt the HTTP response. Setting the preview-size to 0, disables buffering the
response and should only be done if the adaptation server will always return with a modied HTTP
response or the original HTTP response. The default value is 1024.
• service-down-action
Species the action to take if the internal virtual server does not exist or returns an error. The default
value is ignore.
The options are:
• ignore
Ignore the error and send the unmodied HTTP response to a HTTP server selected from this virtual
server's pool.
• drop
Drop the connection.
• reset
Reset the connection.
• timeout
Species a timeout in milliseconds. If the internal virtual server does not return a result within the
specied time, a timeout error will occur. A 0 value disables the timeout. The default value is 0.
• to-folder
response-adapt proles can be moved to any folder under /Common, but conguration dependencies
may restrict moving the prole out of /Common.
• allow-http-10
Species whether to forward HTTP version 1.0 responses for adaptation. By default only HTTP version
1.1 responses are forwarded. Version 1.0 is not supported. While it should work in most cases, it might
be necessary to restrict adaptation on a site-specic basis. The default value is no.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh, ltm prole request-adapt
rewrite
congure a rewrite prole
1164
LTM Profile
Syntax
Congure the rewrite component within the prole module using the syntax shown in the following
sections.
Display
list rewrite
list rewrite [[name] | [glob]]
show running-config rewrite
show running-config rewrite [[name] | [glob]]
all-properties
non-default-properties
one-line
| grep
Create/Modify
create rewrite [name]
modify rewrite [name]
app-service [[string] | none]
bypass-list [add | delete | replace-all-with | none] { [uri list] }
client-caching-type [cache-all | cache-css-js | cache-img-css-js | no-cache]
defaults-from [[name] | none]
java-ca-file [[certificate file] | none]
java-crl [[certificate revocation list file] | none]
java-sign-key [[certificate key file] | none]
java-sign-key-passphrase [[string] | none]
java-signer [[certificate file] | none]
location-specific [false | true]
rewrite-list [add | delete | replace-all-with | none] { [uri list] }
rewrite-mode [portal | uri-translation]
set-cookie-rules [add | delete | modify | replace-all-with | none] {
[name] {
client {
domain [string]
path [string]
}
server {
domain [string]
path [string]
}
}
}
split-tunneling [false | true]
uri-rules [add | delete | modify | replace-all-with | none] {
[name] {
[type [both | request | response]]
client {
scheme [string]
host [string]
port [string]
path [string]
}
server {
scheme [string]
host [string]
port [string]
path [string]
}
1165
Traffic Management Shell (tmsh) Reference Guide
}
}
edit rewrite [ [ [name] | [glob] ] ... ]
all-properties
non-default-properties
Delete
delete rewrite [name]
Description
Use the rewrite component to congure a Rewrite Prole in URI Translation or Portal (Access) mode.
Examples
• URI Translation Mode
• Create a prole
create my_uri_rewrite rewrite-mode uri-translation
• Add a rule to rewrite URIs
modify my_uri_rewrite uri-rules add { my_rule { client { path /client/ } server { path /server/ } } }
modify my_uri_rewrite uri-rules add { my_rule { client { scheme http host www.client.com path / }
server { scheme http host www.server.com path / } } }
• Add a rule to rewrite Set-Cookie headers
modify my_uri_rewrite set-cookie-rules add { my_rule { client { domain client.com path / } server {
domain server.com path / } } }
• Portal (Access) Mode
• Create a prole
create my_portal_rewrite rewrite-mode portal
• Congure the client to cache all les
modify my_portal_rewrite client-caching-type cache-all
• Set the rewrite list and bypass list
modify my_portal_rewrite rewrite-list add { *://www.myportal.com/* http://abc*.com/* } bypass-list
add { *://external_web.com/* }
• Congure split-tunneling
modify my_portal_rewrite split-tunneling true
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• bypass-list
1166
LTM Profile
Species a list of URIs that are bypassed inside a web page when the page is accessed using Portal
Access. The default is none.
• client-caching-type
Species one of four options for client caching. When the Client Cache setting for a web application
resource is set to default, the system uses the setting congured in the Rewrite prole. If the Client
Cache option is congured for any other setting, the web application resource item caching conguration
overwrites the setting in the Rewrite prole. The default is cache-css-js. The options are:
• cache-all
Do not modify cache headers on backend servers.
• cache-css-js
Cache only the CSS le and Java Script.
• cache-img-css-js
Cache only images, the CSS le and Java Script.
• no-cache
Eliminate caching.
• defaults-from
Species the prole from which the Rewrite prole inherits properties. Explicitly specied properties
override inherited properties.
• java-ca-le
Species a CA against which to verify signed Java applets signatures. The default value is ca-bundle.crt.
• java-crl
Species a CRL against which to verify signed Java applets signature certicates. The default value is
none.
• java-sign-key
Species a private key for re-signing of signed Java applets after patching. The default value is
default.key.
• java-sign-key-passphrase
Species a passphrase for the private key to be encrypted with. The default value is none. Note: your
passphrase will be encrypted and displayed under the label java-sign-key-passphrase-encrypted.
• java-signer
Species a certicate to use for re-signing of signed Java applets after patching. The default value is
default.crt.
• location-specic
Species whether or not this object contains one or more attributes with values that are specic to the
location where the BIG-IP device resides. The location-specic attribute is either true or false. When
using policy sync, mark an object as location-specic to prevent errors that can occur when policies
reference objects, such as authentication servers, that are specic to a certain location. The default value
is none.
• rewrite-list
Species a list of URIs that are rewritten inside a web page when the page is accessed using Portal
Access. The default value is none.
• rewrite-mode
1167
Traffic Management Shell (tmsh) Reference Guide
Species the mode of rewriting. uri-translation is a rules-based rewrite mode. portal is for use with
Portal Access.
• set-cookie-rules
Used with uri-translation mode. Species the rules for rewriting HTTP Set-Cookie headers. Each rule
has a name and a client and server domain and path. The name may be any alphanumeric string and
must be unique. The path must be an absolute directory path and not a relative path or a le path. If the
domain and path of the Set-Cookie header in the HTTP response match the domain and path of the
server side of a rule, they will be rewritten to the domain and path of client side of that rule. Set-Cookie
rules take precedence over URI rules when rewriting Set-Cookie headers.
• split-tunneling
Species whether the prole provides for split tunneling. The default is false.
• uri-rules
Used with uri-translation mode. Species the rules for rewriting request and response headers and
response bodies. These rules affect the following.
• request headers
URI, Host, Referer
• response headers
Content-Location, Link, Location, Refresh, Set-Cookie
• response body
HTML, CSS
Each rule has a name, a type, and a client and server URI. The name may be any alphanumeric string
and must be unique. The type may be "request", "response", or "both": "request" rules affect request
headers only, "response" rules affect response headers and bodies only, and "both" rules affect both.
URIs must include a path; scheme, host, and port are optional. If a URI must contain a scheme or host,
it must include both. If it must include a port, it must also include a scheme and host. Paths may be
absolute directory paths only. They may not be relative paths or le paths. If a URI in a request header
matches the client side URI of a rule, it will be rewritten to the server side URI of that rule. If a URI in
a response header or body matches the server side URI of a rule, it will be rewritten to the client side
URI of that rule. When rewriting Set-Cookie headers, the host and path of the server side URI are used
to match the domain and path of the header. The client side host and path replace that header's domain
and path if a match is found. Set-Cookie rules take precedence over URI rules when rewriting Set-Cookie
headers.
rtsp
Congures an RTSP (realtime streaming protocol) prole.
Syntax
Congure the rtsp component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create rtsp [name]
1168
LTM Profile
modify rtsp [name]
app-service [[string] | none]
check-source [disabled | enabled]
defaults-from [name]
description [string]
idle-timeout [integer]
max-header-size [integer]
max-queued-data [integer]
multicast-redirect [disabled | enabled]
proxy [external | internal | none]
proxy-header [ [name] | none]
real-http-persistence [disabled | enabled]
rtcp-port [number]
rtp-port [number]
session-reconnect [disabled | enabled]
unicast-redirect [disabled | enabled]
log-publisher [log publisher name | none]
log-profile [log profile name | none]
edit rtsp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv rtsp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats rtsp
reset-stats rtsp [ [ [name] | [glob] | [regex] ] ... ]
Display
list rtsp
list rtsp [ [ [name] | [glob] | [regex] ] ... ]
show running-config rtsp
show running-config rtsp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show rtsp
show rtsp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete rtsp [name]
1169
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the rtsp component to manage a prole that you use to control RTSP trafc.
Examples
create rtsp my_rtsp_prole defaults-from rtsp
Creates a custom RTSP prole named my_rtsp_prole that inherits its settings from the system default
RTSP prole.
list rtsp all-properties
Displays all properties for all RTSP proles.
mv rtsp /Common/my_rtsp_prole to-folder /Common/my_folder
Moves a custom rtsp prole named my_rtsp_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• check-source
When enabled the system uses the source attribute in the transport header to establish the target address
of the RTP stream, and before the response is forwarded to the client, updates the value of the source
attribute to be the virtual address of the BIG-IP system. When disabled the system does not change the
source attribute. The default value is enabled.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is rtsp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 300 seconds.
• max-header-size
Species the maximum size of an RTSP request or response header that the RTSP lter accepts before
dropping the connection. The default value is 4096 bytes.
• max-queued-data
Species the maximum amount of data that the RTSP lter buffers before dropping the connection. The
default value is 32768 bytes.
• multicast-redirect
Species whether to enable or disable multicast redirect. When enabled, the client can select the
destination to which to stream data. The default value is disabled.
1170
LTM Profile
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• proxy
Species whether the RTSP lter is associated with an RTSP proxy conguration. The default value is
none.
• proxy-header
When the proxy option is set, species the name of the header in the RTSP proxy conguration that is
passed from the client-side virtual server to the server-side virtual server. Note that the name of the
header must begin with X-. The default value is none.
To use the proxy-header option, you must specify a value for the proxy option.
• real-http-persistence
Species whether to enable or disable real HTTP persistence. When enabled, the RTSP lter automatically
persists Real Networks RTSP over HTTP using the RTSP port. The default value is enabled. If you
disable this parameter, you can override the default behavior with an iRule.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rtcp-port
Species the number of the port to use for the Real Time Control Protocol (RTCP) service. The default
value is 0 (zero). RTCP allows monitoring of real-time data delivery.
• rtp-port
Species the number of the port to use for the RTP service. The default value is 0 (zero).
• session-reconnect
Species whether to enable or disable session reconnect. When enabled, the RTSP lter persists the
control connection, which is being resumed, to the correct server. The default value is disabled.
• to-folder
rtsp proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• unicast-redirect
Species whether to enable or disable unicast redirect. When enabled, the client can select the destination
to which to stream data. The default value is disabled.
• log-publisher
Specify the name of the log publisher which logs translation events. See help sys log-cong for more
details on the logging sub-system. Use the sys log-cong publisher component to set up a log publisher.
• log-prole
Specify the name of the ALG log prole which controls the logging of ALG . See help ltm alg-log-prole
for more details on the logging prole sub-system. Use the ltm alg-log-prole prole component to set
up a ALG log prole.
1171
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
sctp
Congures a Stream Control Transmission Protocol (SCTP) prole.
Syntax
Congure the sctp component within the ltm prole module using the syntax shown in the following
sections.
Create
create sctp [name]
modify sctp [name]
app-service [[string] | none]
cookie-expiration [integer]
defaults-from [name]
description [string]
heartbeat-interval [integer]
heartbeat-max-burst [integer]
idle-timeout [integer]
in-streams [integer]
init-max-retries [integer]
ip-tos [integer]
link-qos [integer]
max-burst [integer]
out-streams [integer]
proxy-buffer-high [integer]
proxy-buffer-low [integer]
receive-chunks [integer]
receive-ordered [disabled | enabled]
receive-window-size [integer]
reset-on-timeout [disabled | enabled]
secret [default | [string] ]
send-buffer-size [integer]
send-max-retries [integer]
send-partial [disabled | enabled]
tcp-shutdown [disabled | enabled]
transmit-chunks [integer]
edit sctp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv sctp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats sctp
reset-stats sctp [ [ [name] | [glob] | [regex] ] ... ]
1172
LTM Profile
Display
list sctp
list sctp [ [ [name] | [glob] | [regex] ] ... ]
show running-config sctp
show running-config sctp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show sctp
show sctp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete sctp [name]
Description
You can use the sctp component to manage a prole for SCTP trafc.
Examples
create sctp my_sctp_prole defaults-from sctp
Creates a custom SCTP prole named my_sctp_prole that inherits its settings from the system default
SCTP prole.
list sctp all-properties
Displays all properties for all SCTP proles.
mv sctp /Common/my_sctp_prole to-folder /Common/my_folder
Moves a custom sctp prole named my_sctp_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• cookie-expiration
Species how many seconds the cookie is valid. The default value is 60 seconds.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is sctp.
• description
1173
Traffic Management Shell (tmsh) Reference Guide
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• heartbeat-interval
Species the number of seconds to wait before sending a heartbeat chunk. The default value is 30
seconds.
• heartbeat-max-burst
Species the number of heartbeat packets to be sent in a single burst. The default value is 1.
• idle-timeout
Species the number of seconds without trafc before a connection is eligible for deletion. The default
value is 300 seconds.
• in-streams
Species the number of inbound streams. The default value is 2.
• init-max-retries
Species the maximum number of retries to establish a connection. The default value is 4.
• ip-tos
Species the Type of Service (ToS) that is set in packets sent to the peer. The default value is 0.
• link-qos
Species the Link Quality of Service (QoS) that is set in sent packets. The default value is 0.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• out-streams
Species the number of outbound streams. The default value is 2.
• partition
Displays the administrative partition within which the component resides.
• proxy-buffer-high
Species the proxy buffer level after which the system closes the receive window. The default value is
16384.
• proxy-buffer-low
Species the proxy buffer level after which the system opens the receive window. The default value is
4096.
• receive-chunks
Species the size (in chunks) of the rx_chunk buffer. The default value is 256.
• receive-ordered
When enabled, the default, the system delivers messages to the application layer in order.
• receive-window-size
Species the size (in bytes) of the receive window. Prorate this value to the receive-chunks value. The
default value is 65535.
• regex
1174
LTM Profile
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-on-timeout
When enabled, the default, the system resets the connection when the connection times out.
• secret
Species the internal secret string used for HTTP Message Authenticated Code (HMAC) cookies.
• send-buffer-size
Species the size in bytes of the buffer. The default value is 65536.
• max-burst
Species the maximum number of data packets to send in a single burst. The default value is 4.
• send-max-retries
Species the maximum number of time the system tries again to send the data. The default value is 8.
• send-partial
When enabled, the default, the system accepts partial application data.
• tcp-shutdown
When enabled, the system emulates the closing of a TCP connection. The default value is enabled.
• to-folder
sctp proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• transmit-chunks
Species the size of the tx_chunk buffer. The default value is 256.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
server-ldap
Congures an Server LDAP prole.
Syntax
Congure the server-ldap component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create server-ldap [name]
modify server-ldap [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
1175
Traffic Management Shell (tmsh) Reference Guide
activation-mode [ none | allow | require ]
ss-activation-mode [ none | allow | require ]
edit server-ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list server-ldap
list server-ldap [ [ [name] | [glob] | [regex] ] ... ]
show running-config server-ldap
show running-config server-ldap [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Delete
delete server-ldap [name]
Description
You can use the server-ldap component to create, modify, display, or delete an Server LDAP prole with
which you can manage Server LDAP trafc.
Examples
create server-ldap my_serverldap_prole defaults-from serverldap
Creates a custom Server LDAP prole named my_serverldap_prole that inherits its settings from the
system default Server LDAP prole.
list server-ldap
Displays the properties of all Server LDAP proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is smtp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
1176
LTM Profile
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• activation-mode
Sets the activation-mode for STARTTLS. The options are NONE, ALLOW, or REQUIRE. The default
value is NONE.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, sys provision, tmsh
server-ssl
Congures a Server SSL prole.
Syntax
Congure the server-ssl component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create server-ssl [name]
modify server-ssl [name]
alert-timeout [indefinite | [integer] ]
app-service [[string] | none]
authenticate [always | once]
authenticate-depth [integer]
authenticate-name [ [name] | none]
ca-file [ [file name] | none]
cache-size [integer]
cache-timeout [integer]
cert [ [file name] | none]
chain [ [name] | none]
ciphers [ [name] | none]
crl-file [none]
allow-expired-crl [enabled | disabled]
defaults-from [ [name] | none]
description [string]
expire-cert-response-control [drop | ignore]
handshake-timeout [indefinite | [integer] ]
key [ [file name] | none]
mod-ssl-methods [disabled | enabled]
mode [disabled | enabled]
options {
none |
[ all-bugfixes cipher-server-preference
dont-insert-empty-fragments ephemeral-rsa
microsoft-big-sslv3-buffer microsoft-sess-id-bug
msie-sslv2-rsa-padding netscape-ca-dn-bug
netscape-challenge-bug netscape-demo-cipher-change-bug
netscape-reuse-cipher-change-bug
no-session-resumption-on-renegotiation
1177
Traffic Management Shell (tmsh) Reference Guide
no-ssl no-sslv2 no-sslv3 no-tls no-tlsv1 no-tlsv1.1 no-tlsv1.2
no-dtls passive-close pkcs1-check-1
pkcs1-check-2 single-dh-use ssleay-080-client-dh-bug
sslref2-reuse-cert-type-bug tls-block-padding-bug tls-d5-bug
tls-rollback-bug ]
}
passphrase [none | [string] ]
peer-cert-mode [ignore | require]
proxy-ssl [disabled | enabled]
proxy-ssl-passthrough [disabled | enabled]
renegotiate-period [indefinite | [integer] ]
renegotiate-size [indefinite | [integer] ]
renegotiation [disabled | enabled]
retain-certificate [true | false]
secure-renegotiation [request | require | require-strict]
server-name [name]
session-mirroring [disabled | enabled]
session-ticket [disabled | enabled]
generic-alert [disabled | enabled]
sni-default [true | false]
sni-require [true | false]
ssl-forward-proxy [disabled | enabled]
ssl-forward-proxy-bypass [disabled | enabled]
ssl-sign-hash [any | sha1 | sha256 | sha384]
strict-resume [disabled | enabled]
unclean-shutdown [disabled | enabled]
untrusted-cert-response-control [drop | ignore]
edit server-ssl [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv server-ssl [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats server-ssl
reset-stats server-ssl [ [ [name] | [glob] | [regex] ] ... ]
Display
list server-ssl
list server-ssl [ [ [name] | [glob] | [regex] ] ... ]
show running-config server-ssl
show running-config server-ssl
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show server-ssl
show server-ssl [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
1178
LTM Profile
Delete
delete server-ssl [all | [name]]
recursive
Description
You can use the server-ssl component to manage a server SSL prole.
Server-side proles enable the trafc management system to handle encryption tasks for any SSL connection
being sent from a local trafc management system to a target server. A server-side SSL prole is acts as a
client by presenting certicate credentials to a server when authentication of the local trafc management
system is required. You implement this type of prole by using the default prole, or by creating a custom
prole based on the Server SSL prole template and modifying its settings.
Examples
create server-ssl my_serverssl_prole defaults-from serverssl
Creates a custom Server SSL prole named my_serverssl_prole that inherits its settings from the system
default prole serverssl.
list server-ssl all-properties
Displays all properties for all Server SSL proles.
mv server-ssl /Common/my_serverssl_prole to-folder /Common/my_folder
Moves a custom server-ssl prole named my_serverssl_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• alert-timeout
Species the maximum time period in seconds to keep the SSL session active after alert message is sent.
The default value is 10 seconds.
• authenticate
Species the frequency of authentication. The default value is once.
• authenticate-depth
Species the client certicate chain maximum traversal depth. The default value is 9.
• authenticate-name
Species a Common Name (CN) that is embedded in a server certicate. The system authenticates a
server based on the specied CN. The default value is none.
• ca-le
Species the certicate authority le name. Congures certicate verication by specifying a list of
client or server CAs that the trafc management system trusts. The default value is none.
• cache-size
1179
Traffic Management Shell (tmsh) Reference Guide
Species the SSL session cache size. For client proles only, you can congure timeout and size values
for the SSL session cache. Because each prole maintains a separate SSL session cache, you can congure
the values on a per-prole basis. The default value is 262144.
• cache-timeout
Species the SSL session cache timeout value, which is the usable lifetime seconds of negotiated SSL
session IDs. The default value is 3600 seconds. Acceptable values are integers greater than or equal to
0 and less than or equal to 86400.
• cert
Species the name of the certicate installed on the trafc management system for the purpose of
terminating or initiating an SSL connection. The default value is none.
• chain
Species or builds a certicate chain le that a client can use to authenticate the prole. The default
value is none.
• ciphers
Species a cipher name. The default value is DEFAULT.
• crl-le
Species the certicate revocation list le name. The default value is none.
• allow-expired-crl
Use the specied CRL le even if it has expired. The default value is disabled.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is serverssl.
• description
User dened description.
• expire-cert-response-control
Species the BIGIP action when the server certicate has expired. The default value is drop, which
causes the connection to be dropped. Conversely, you can specify ignore to cause the connection to
ignore the error and continue.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• handshake-timeout
Species the handshake timeout in seconds. The default value is 10.
• key
Species the key le name. Species the name of the key installed on the trafc management system
for the purpose of terminating or initiating an SSL connection. The default value is none.
• mod-ssl-methods
Enables or disables ModSSL methods. The default value is disabled.
Enable this option when OpenSSL methods are inadequate. For example, you can enable ModSSL
method emulation when you want to use SSL compression over TLSv1.
• mode
Enables or disables SSL processing. The default value is enabled.
• name
1180
LTM Profile
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• options
Enables options, including some industry-related workarounds. Enter options inside braces, for example,
{ dont-insert-empty-fragments microsoft-sess-id-bug}. The default value is
dont-insert-empty-fragments.
• all-bugxes
This option enables the following industry-related defect workarounds: microsoft-sess-id-bug,
netscape-challenge-bug, netscape-reuse-cipher-change-bug, sslref2-reuse-cert-type-bug,
microsoft-big-sslv3-buffer, msie-sslv2-rsa-padding, ssleay-080-client-dh-bug, tls-d5-bug,
tls-block-padding-bug, and dont-insert-empty-fragments.
It is usually safe to use this option to enable the defect workaround options when compatibility with
broken implementations is desired. Note that if you edit the conguration in the browser-based
Conguration utility, the system expands the all-bugxes syntax into each individual option.
• cipher-server-preference
When choosing a cipher, this option uses the server's preferences instead of the client references.
When this option is not set, the SSL server always follows the client's references. When this option
is set, the SSLv3/TLSv1 server chooses by using its own references. Due to the different protocol,
for SSLv2 the server sends its list of preferences to the client and the client always chooses.
• dont-insert-empty-fragments
Disables a countermeasure against a SSL 3.0/TLS 1.0 protocol vulnerability affecting CBC ciphers.
These ciphers cannot be handled by certain broken SSL implementations. This option has no effect
for connections using other ciphers.
• ephemeral-rsa
Uses ephemeral (temporary) RSA keys when doing RSA operations. According to the specications,
this is only done when an RSA key can be used for signature operations (namely under export ciphers
with restricted RSA key length). By setting this option, you specify that you always want to use
ephemeral RSA keys. This option breaks compatibility with the SSL/TLS specications and may
lead to interoperability problems with clients. Therefore, F5 Networks does not recommend this
option. Use ciphers with EDH (ephemeral Dife-Hellman) key exchange instead. This option is
ignored for server-side SSL.
• microsoft-big-sslv3-buffer
Enables a workaround for communicating with older Microsoft(r) applications that use non-standard
SSL record sizes.
• microsoft-sess-id-bug
Handles a Microsoft session ID problem.
• msie-sslv2-rsa-padding
Enables a workaround for communicating with older Microsoft applications that use non-standard
RSA key padding. This option is ignored for server-side SSL.
• netscape-ca-dn-bug
Handles a defect regarding the system crashing or hanging. If the system accepts a Netscape
Navigator(r) browser connection, demands a client cert, has a non-self-signed CA that does not have
its CA in Netscape, and the browser has a certicate, the system crashes or hangs.
• netscape-challenge-bug
Handles the Netscape challenge problem.
• netscape-demo-cipher-change-bug
1181
Traffic Management Shell (tmsh) Reference Guide
Manipulates the SSL server session resumption behavior to mimic that of certain Netscape servers
(see the Netscape reuse cipher change bug workaround description). Note that F5 Networks does
not recommend this option for normal use. It is ignored for server-side SSL.
• netscape-reuse-cipher-change-bug
Handles a defect within Netscape-Enterprise/2.01 (https://merchant.neape.com), appearing only
when connecting through SSLv2/v3, and then reconnecting through SSLv3. In this case, the cipher
list changes.
First, a connection is established with the RC4-MD5 cipher list. If it is then resumed, the connection
switches to using the DES-CBC3-SHA cipher list. However, according to RFC 2246, (section 7.4.1.3,
cipher suite) the cipher list is RC4-MD5.
As a workaround, you can attempt to connect with a cipher list of DES-CBC-SHA:RC4-MD5 and
so on. For some reason, each new connection uses the RC4-MD5 cipher list, but any re-connection
attempts to use the DES-CBC-SHA cipher list. Thus Netscape, when reconnecting, always uses the
rst cipher in the cipher list.
• no-session-resumption-on-renegotiation
When performing renegotiation as an SSL server, this option always starts a new session (that is,
session resumption requests are accepted only in the initial handshake). The system ignores this
option for server-side SSL.
• no-ssl
Do not use any version of the SSL protocol.
• no-sslv2
Do not use the SSLv2 protocol.
• no-sslv3
Do not use the SSLv3 protocol.
• no-tls
Do not use any version of the TLS protocol.
• no-tlsv1
Do not use the TLSv1.0 protocol.
• no-tlsv1.1
Do not use the TLSv1.1 protocol.
• no-tlsv1.2
Do not use the TLSv1.2 protocol.
• no-dtls
Do not use any version of the DTLS protocol.
• passive-close
Species how to handle passive closes.
• none
Disables all workarounds. Note that F5 Networks does not recommend this option.
• pkcs1-check-1
This debugging option deliberately manipulates the PKCS1 padding used by SSL clients in an attempt
to detect vulnerability to particular SSL server vulnerabilities. Note that F5 Networks does not
recommend this option for normal use. The system ignores this option for client-side SSL.
• pkcs1-check-2
1182
LTM Profile
This debugging option deliberately manipulates the PKCS1 padding used by SSL clients in an attempt
to detect vulnerability to particular SSL server vulnerabilities. Note that F5 Networks does not
recommend this option for normal use. The system ignores this option for client-side SSL.
• single-dh-use
Creates a new key when using temporary/ephemeral DH parameters. This option must be used to
prevent small subgroup attacks, when the DH parameters were not generated using strong primes
(for example. when using DSA-parameters). If strong primes were used, it is not strictly necessary
to generate a new DH key during each handshake, but F5 Networks recommends it. Enable the Single
DH Use option whenever temporary or ephemeral DH parameters are used.
• ssleay-080-client-dh-bug
Enables a workaround for communicating with older SSLeay-based applications that specify an
incorrect Dife-Hellman public value length. This option is ignored for server-side SSL.
• sslref2-reuse-cert-type-bug
Handles the SSL reuse certicate type problem.
• tls-block-padding-bug
Enables a workaround for communicating with older TLSv1-enabled applications that use incorrect
block padding.
• tls-d5-bug
This option is a workaround for communicating with older TLSv1-enabled applications that specify
an incorrect encrypted RSA key length. This option is ignored for server-side SSL.
• tls-rollback-bug
Disables version rollback attack detection. During the client key exchange, the client must send the
same information about acceptable SSL/TLS protocol levels as it sends during the rst hello. Some
clients violate this rule by adapting to the server's answer. For example, the client sends an SSLv2
hello and accepts up to SSLv3.1 (TLSv1), but the server only processes up to SSLv3. In this case,
the client must still use the same SSLv3.1 (TLSv1) announcement. Some clients step down to SSLv3
with respect to the server's answer and violate the version rollback protection. The system ignores
this option for server-side SSL.
• partition
Displays the administrative partition within which the component resides.
• passphrase
Species the key passphrase, if required. The default value is none.
• peer-cert-mode
Species the peer certicate mode. The default value is ignore.
• proxy-ssl
Enabling this option requires a corresponding client ssl prole with proxy-ssl enabled to perform
transparent SSL decryption. This feature allows further modication of application trafc within an
SSL tunnel while still allowing the server to perform necessary authorization, authentication, auditing
steps.
• proxy-ssl-passthrough
Enabling this option requires a corresponding client ssl prole with proxy-ssl-passthrough enabled.
This allows Proxy SSL to passthrough the trafc when ciphersuite negotiated between the client and
server is not supported. The default option is disabled.
• regex
1183
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• renegotiate-period
Species the number of seconds from the initial connect time after which the system renegotiates an
SSL session. The default value is indenite, which means that you do not want the system to renegotiate
SSL sessions.
Each time the session renegotiation is successful, a new connection is started. Therefore, the system
attempts to renegotiate the session again, in the specied amount of time following a successful session
renegotiation. For example, setting the renegotiate-period option to 3600 seconds triggers session
renegotiation at least once an hour.
• renegotiate-size
Species a throughput size, in megabytes, of SSL renegotiation. This option forces the trafc management
system to renegotiate an SSL session based on the size, in megabytes, of application data that is transmitted
over the secure channel. The default value is indenite, which species that you do not want a throughput
size.
• renegotiation
Species whether renegotiations are enabled. The default value is enabled. When renegotiations are
disabled, the system is acting as an SSL server, and a COMPAT or NATIVE cipher is negotiated, the
system will abort the connection. Additionally, when renegotiations are disabled and the system is acting
as an SSL client, the system will ignore the server's HelloRequest messages.
• retain-certicate
APM module requires storing certicate in SSL session. When set to false, certicate will not be stored
in SSL session. The default value is true.
• generic-alert
Enables or disables generic-alert. The default option is enabled, which causes the SSL prole to use
generic alert number. Conversely, you can specify disabled to cause SSL prole to use alert number
dened in RFC5246/RFC6066 strictly.
• secure-renegotiation
Species the secure renegotiation mode. The default value is require-strict. When secure renegotiation
is set to require, any connection to an unpatched server will be aborted. For server-ssl, there is no
difference between require and require-strict secure renegotiation. When secure renegotiation is set
to request, connections to unpatched servers will be permitted. This setting is NOT recommended
however, as it is subject to active man-in-the-middle attacks.
• server-name
Species the server name to be included in SNI (server name indication) extension during SSL handshake
in ClientHello.
• session-mirroring
Enables or disables the mirroring of sessions to high availability peer. By default, this setting is disabled,
which causes the system to not mirror ssl sessions.
• session-ticket
Enables or disables session-ticket. The default option is disabled, which causes the SSL prole not to
use session ticket per RFC 5077. Conversely, you can specify enabled to cause SSL prole to use session
ticket per RFC 5077.
• sni-default
When true, this prole is the default SSL prole when the server name in a client connection does not
match any congured server names, or a client connection does not specify any server name at all.
1184
LTM Profile
• sni-require
When this option is enabled, connections to a server that does not support SNI extension will be rejected.
• ssl-forward-proxy
Enables or disables ssl-forward-proxy feature. The default option is disabled. Conversely, you can
specify enabled to use the SSL Forward Proxy Feature.
• ssl-sign-hash
Species SSL sign hash algorithm which is used to sign and verify SSL Server Key Exchange and
Certicate Verify messages for the specied SSL proles. The default value is sha1.
• ssl-forward-proxy-bypass
Enables or disables ssl-forward-proxy-bypass feature. The default option is disabled. Conversely, you
can specify enabled to use the SSL Forward Proxy Bypass Feature.
• strict-resume
Enables or disables the resumption of SSL sessions after an unclean shutdown. The default value is
disabled, which indicates that the SSL prole refuses to resume SSL sessions after an unclean shutdown.
• to-folder
server-ssl proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
• unclean-shutdown
Species, when enabled, that the SSL prole performs unclean shutdowns of all SSL connections, which
means that underlying TCP connections are closed without exchanging the required SSL shutdown
alerts. If you want to force the SSL prole to perform a clean shutdown of all SSL connections, you can
disable this option.
• untrusted-cert-response-control
Species the BIGIP action when the server certicate has untrusted CA. The default value is drop,
which causes the connection to be dropped. Conversely, you can specify ignore to cause the connection
to ignore the error and continue.
See Also
create, delete, edit, glob, list, ltm prole client-ssl, ltm virtual, modify, mv, regex, show, tmsh
sip
Congures a Session Initiation Protocol (SIP) prole.
Syntax
Congure the sip component within the ltm prole module using the syntax shown in the following sections.
Create/Modify
create sip [name]
modify sip [name]
alg-enable [disabled | enabled]
app-service [[string] | none]
community [ [community name] | none]
1185
Traffic Management Shell (tmsh) Reference Guide
defaults-from [ [name] | none]
description [string]
dialog-aware [disabled | enabled]
dialog-establishment-timeout [integer]
enable-sip-firewall [no | yes]
insert-record-route-header [disabled | enabled]
insert-via-header [disabled | enabled]
max-media-sessions [integer]
max-registrations [integer]
max-sessions-per-registration [integer]
max-size [integer]
registration-timeout [integer]
rtp-proxy-style [symmetric | restricted-by-ip-address | any-location]
secure-via-header [disabled | enabled]
security [disabled | enabled]
sip-session-timeout [integer]
terminate-on-bye [disabled | enabled]
user-via-header [ [via-header] | none]
log-publisher [log publisher name | none]
log-profile [log profile name | none]
edit sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv sip [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats sip
reset-stats sip [ [ [name] | [glob] | [regex] ] ... ]
Display
list sip
list sip [ [ [name] | [glob] | [regex] ] ... ]
show running-config sip
show running-config sip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show sip
show sip [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete sip [name]
1186
LTM Profile
Description
You can use the sip component to manage a SIP prole.
Examples
create sip my_sip_prole defaults-from sip
Creates a SIP prole named my_sip_prole using the system defaults.
create sip my_sip_prole { terminate-bye disabled }
Creates a SIP prole named my_sip_prole that leaves a connection open following the completion of a
BYE transaction.
mv sip /Common/my_sip_prole to-folder /Common/my_folder
Moves a custom sip prole named my_sip_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• alg-enable
Enables or disables the SIP ALG (Application Level Gateway) feature. The default value is disabled.
Note: for a SIP prole with ALG enabled to function correctly, the virtual which uses the prole must
have destination and mask set to 0.0.0.0 for IPv4, or :: for IPv6. Additionally, the virtual must have
source-address-translation enabled.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• community
Species the community to which you want to assign the virtual server that you associate with this
prole. The default value is none.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all of the settings
and values from the specied parent prole. The default value is sip.
• description
User dened description.
• dialog-aware
Enables or disables the ability for the system to be aware of unauthorized use of the SIP dialog. The
default value is disabled.
• dialog-establishment-timeout
Indicates the timeout value for dialog establishment in a sip session. The default value is 10 seconds.
• enable-sip-rewall
Indicates whether to enable SIP rewall functionality or not. Default value is no.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• insert-record-route-header
1187
Traffic Management Shell (tmsh) Reference Guide
Enables or disables the insertion of a Record-Route header, which indicates the next hop for the following
SIP request messages. The default value is disabled.
• insert-via-header
Enables or disables the insertion of a Via header, which indicates where the message originated. The
response message uses this routing information. The default value is disabled.
• max-media-sessions
Indicates the maximum number of SDP media sessions that the BIG-IP system accepts. The default
value is 6.
• max-registrations
Indicates the maximum number of registrations, the maximum allowable REGISTER messages can be
recorded that the BIG-IP system accepts. The default value is 100.
• max-sessions-per-registration
Indicates the maximum number of calls or sessions can be made by a user for a single registration that
the BIG-IP system accepts. The default value is 50.
• max-size
Species the maximum SIP message size that the BIG-IP system accepts. The default value is 65535
bytes.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• registration-timeout
Indicates the timeout value for a sip registration. The default value is 3600 seconds.
• rtp-proxy-style
Indicates the style in which the RTP will proxy the data. When a dialog is established, the necessary
SDP data needs to know where the RTP ows are directed. The default value is symmetric. The options
available are:
• symmetric
Indicates the use of a bidirectional related ow.
• restricted-by-ip-address
Indicates the use of ephemeral listeners to support xed client IP, listener is restricted to connections
coming from a particular source.
• any-location
Indicates the use of ephemeral listeners to support wildcard, connections are allowed to come from
anyway.
• secure-via-header
1188
LTM Profile
Enables or disables the insertion of a Secure Via header, which indicates where the message originated.
When you are using SSL/TLS (over TCP) to create a secure channel with the server node, use this setting
to congure the system to insert a Secure Via header into SIP requests. The default value is disabled.
• security
Enables or disables security for the SIP prole. The default value is disabled.
• sip-session-timeout
Indicates the timeout value for a sip session. The default value is 300 seconds.
• terminate-on-bye
Enables or disables the termination of a connection when a BYE transaction nishes. Use this parameter
with UDP connections only, not with TCP connections. The default value is enabled.
• to-folder
sip proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• user-via-header
Enables or disables the insertion of a Via header specied by a system administrator. The default value
is none.
• log-publisher
Specify the name of the log publisher which logs translation events. See help sys log-cong for more
details on the logging sub-system. Use the sys log-cong publisher component to set up a log publisher.
• log-prole
Specify the name of the ALG log prole which controls the logging of ALG . See help ltm alg-log-prole
for more details on the logging prole sub-system. Use the ltm alg-log-prole prole component to set
up a ALG log prole.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
smtp
Congures an SMTP prole.
Syntax
Congure the smtp component within the ltm prole module using the syntax shown in the following
sections. The smtp prole is available when the asm module is enabled. You enable the asm module via
provisioning commands, which are described in help sys provision.
Create/Modify
create smtp [name]
modify smtp [name]
app-service [[string] | none]
defaults-from [ [name] | none]
1189
Traffic Management Shell (tmsh) Reference Guide
description [string]
security [disabled | enabled]
edit smtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list smtp
list smtp [ [ [name] | [glob] | [regex] ] ... ]
show running-config smtp
show running-config smtp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Delete
delete smtp [name]
Description
You can use the smtp component to create, modify, display, or delete an SMTP prole with which you can
manage SMTP trafc.
Examples
create smtp my_smtp_prole defaults-from smtp
Creates a custom SMTP prole named my_smtp_prole that inherits its settings from the system default
SMTP prole.
list smtp
Displays the properties of all SMTP proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is smtp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
1190
LTM Profile
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• security
Enables or disables secure SMTP trafc for the BIG-IP(r) Application Security Manager. The default
value is disabled.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, sys provision, tmsh
smtps
Congures an SMTPs prole.
Syntax
Congure the smtps component within the ltm prole module using the syntax shown in the following
sections. The smtps prole is available when the asm module is enabled. You enable the asm module via
provisioning commands, which are described in help sys provision.
Create/Modify
create smtps [name]
modify smtps [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
activation-mode [ none | allow | require ]
edit smtps [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list smtps
list smtps [ [ [name] | [glob] | [regex] ] ... ]
show running-config smtps
show running-config smtps [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1191
Traffic Management Shell (tmsh) Reference Guide
Delete
delete smtps [name]
Description
You can use the smtps component to create, modify, display, or delete an SMTPs prole with which you
can manage SMTPs trafc.
Examples
create smtps my_smtps_prole defaults-from smtps
Creates a custom SMTPs prole named my_smtps_prole that inherits its settings from the system default
SMTPs prole.
list smtps
Displays the properties of all SMTPs proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is smtp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• activation-mode
Sets the activation-mode for STARTTLS. The options are NONE, ALLOW, or REQUIRE. The default
value is NONE.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, sys provision, tmsh
1192
LTM Profile
socks
Congures a SOCKS prole.
Syntax
Congure the socks component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create socks [name]
modify socks [name]
protocol-versions {
[ [socks4] | [socks4a] | [socks5] ] ... ]
}
dns-resolver [dns-resolver]
tunnel-name [tunnel]
route-domain [route-domain]
default-connect-handling [deny | allow]
edit socks [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats socks
reset-stats socks [ [ [name] | [glob] | [regex] ] ... ]
Display
list socks
list socks [ [ [name] | [glob] | [regex] ] ... ]
show running-config socks
show running-config socks [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show socks
show socks [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete socks [name]
1193
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the socks component to create, modify, display, or delete an SOCKS prole.
The BIG-IP(r) system installation includes the following default SOCKS-type proles:
• socks
The default SOCKS prole contains values for properties related to managing SOCKS trafc.
You can create a new SOCKS-type prole using an existing prole as a parent prole, and then you can
change the values of the properties to suit your needs.
Examples
create socks my_socks_prole defaults-from socks
Creates a custom SOCKS prole named my_socks_prole that inherits its settings from the system default
SOCKS prole.
Options
• protocols-versions
Species the SOCKS protocol versions that are supported. The value is one or more off:
• socks4
Species protocol support for SOCKS version 4.
• socks4a
Species protocol support for SOCKS version 4A (like version 4, but with hostname support).
• socks5
Species protocol support for SOCKS version 5 (with hostname and IPv6 support).
The default value species all available protocols.
• dns-resolver
Species the dns-resolver object that will be used to resolve hostnames in connect requests. The default
is dns-resolver.
• tunnel-name
Species the tunnel that will be used for outbound connect requests. This enables other virtual servers
to receive connections initiated by the proxy service. The default is socks-tunnel.
• route-domain
Species the route-domain that will be used for outbound connect requests. The default is 0.
• default-connect-handling
Species the behavior of the proxy service for connect requests. If set to deny, connect requests will
only be honored if there is another virtual server listening for the requested outbound connection. If set
to allow outbound connections will be made regardless of other virtual servers. The default is deny.
See Also
create, delete, edit, glob, list, ltm virtual, net dns-resolver, net route-domain, net tunnels, modify, regex,
reset-stats, show, tmsh
1194
LTM Profile
spdy
Congures a SPDY protocol prole.
Syntax
Congure the spdy component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create spdy [name]
modify spdy [name]
activation-mode [npn | alpn | tls | always]
concurrent-streams-per-connection [integer]
connection-idle-timeout [integer]
defaults-from [ [name] | none]
description [string]
frame-size [integer]
insert-header [disabled | enabled]
insert-header-name ["string"]
priority-handling [strict | fair]
protocol-versions { [spdy3 | spdy2 | http1.1] ... }
receive-window [integer]
write-size [integer]
compression-window-size [integer]
compression-level [integer]
mv spdy [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list spdy
list spdy [ [ [name] | [glob] | [regex] ] ... ]
show running-config spdy
show running-config spdy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show spdy
show spdy [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
1195
Traffic Management Shell (tmsh) Reference Guide
Delete
delete spdy [name]
Description
You can use the spdy component to create, modify, display, or delete a SPDY prole.
The BIG-IP(r) system installation includes the following default SPDY-type proles:
• spdy
The default SPDY prole contains values for properties related to managing SPDY trafc.
You can create a new SPDY-type prole using an existing prole as a parent prole, and then you can
change the values of the properties to suit your needs.
Examples
create spdy my_spdy_prole defaults-from spdy
mv spdy /Common/my_spdy_prole to-folder /Common/my_folder
Moves a custom spdy prole named my_spdy_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• activation-mode
Species what will cause a connection to be treated as a SPDY connection. The value npn species
that the TLS next-protocol-negotiation will be used to determine whether SPDY should be activated.
The value alpn species that the TLS application-layer-negotiation extension with be used. The value
tls species that both extensions will be used. Clients that use TLS, but only support HTTP will work
as-if SPDY is not present. The value always species that all connections are assumed to be SPDY
connections. Clients that only support HTTP will not be able to send requests. The default value is tls.
• concurrent-streams-per-connection
Species how many concurrent requests are allowed to be outstanding on a single SPDY connection.
• connection-idle-timeout
Species how many seconds a SPDY connection is left open idly before it is shutdown.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is spdy.
• description
User dened description.
• frame-size
Species the size of the data frames, in bytes, that SPDY will send to the client. Larger frame sizes will
improve network utilization, but may affect concurrency. The default value is 2048.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• insert-header
1196
LTM Profile
Species whether an HTTP header that indicates the use of SPDY should be inserted in the request
going to the back-end server. The default value is disabled.
• insert-header-name
Species the name of the HTTP header controlled by insert-header. The default value is "X-SPDY".
• protocol-versions
Species which SPDY protocols clients are allowed to use. This parameter has effect with
activation-mode npn only. Choices are spdy3, spdy2, http1.1. The order of the protocols is most
preferred rst, least preferred last. Putting http1.1 in the list will cause SPDY to let HTTP1.1 trafc
pass, if http1.1 is not in the list, clients that don't support http1.1 will be blocked. The client will typically
pick the rst protocol it supports. At least one SPDY version must be present in the list. The default
value is { spdy3 spdy2 http1.1 }
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• priority-handling
Species how SPDY should handle priorities of concurrent streams within the same connection. The
value strict means that higher priority streams will be processed to completion before lower priority
streams are processed. The value fair lets higher priority streams use more bandwith than lower priority
stream, without completely blocking the lower priority streams. The default value is strict.
• receive-window
Species the receive window, in KB. The receive window is a mechanism used by SPDY to perform
ow control. The receive window allows SPDY to stall individual upload streams when needed. This
mechanism is available only for SPDY version 3. The default value is 32.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• to-folder
spdy proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• write-size
Species the total size of combined data frames, in bytes, SPDY will send in a single write. This controls
the size of the TLS records when SPDY is used over SSL. A large write size will cause SPDY to buffer
more data, but will improve network utilization. The default value is 16384.
• compression-window-size
Species the size of the compression window, in KB. The SPDY protocol compresses http headers to
save bandwidth. A larger window will allow better compression, at the cost of more memory usage. The
default value is 8.
• compression-level
Species the level of compression used by default. This ranges from 0-10, with 10 being the most
compression. Excess CPU usage will lower the level actually used to try to increase throughput. If the
level is zero, then no compression is used. The default value is 5.
See Also
create, delete, edit, glob, list, ltm prole fasthttp, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
1197
Traffic Management Shell (tmsh) Reference Guide
statistics
Congures a Statistics prole.
Syntax
Congure the statistics component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create statistics [name]
modify statistics [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
field1 [string]
field2 [string]
field3 [string]
field4 [string]
field5 [string]
field6 [string]
field7 [string]
field8 [string]
field9 [string]
field10 [string]
field11 [string]
field12 [string]
field13 [string]
field14 [string]
field15 [string]
field16 [string]
field17 [string]
field18 [string]
field19 [string]
field20 [string]
field21 [string]
field22 [string]
field23 [string]
field24 [string]
field25 [string]
field26 [string]
field27 [string]
field28 [string]
field29 [string]
field30 [string]
field31 [string]
field32 [string]
edit statistics [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv statistics [ [[source-name] [destination-name]] | [[name] to-folder
1198
LTM Profile
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats statistics
reset-stats statistics [ [ [name] | [glob] | [regex] ] ... ]
Display
list statistics
list statistics [ [ [name] | [glob] | [regex] ] ... ]
show running-config statistics
show running-config statistics
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show statistics
show statistics [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete statistics [all | name]
Description
You can use the statistics component to create, modify, display, or delete a Statistics prole that provides
user-dened statistical counters.
Examples
create statistics my_stats_prole defaults-from stats
Creates a Statistics prole name my_stats_prole that inherits all settings and values from the prole stats.
list statistics my_stats
Displays the conguration of the prole my_stats.
list statistics my_stats eld1 total_users eld2 current_users eld3 max_users
Creates a Statistics prole named my_stats with a total users counter in Field 1 and a current users counter
in Field 2. You can then write an iRule to count the total number of connections, and record the current
number of connections.
For more information about writing and using iRules(r), see the F5 Networks DevCentral web site at
http://devcentral.f5.com.
mv statistics /Common/my_statistics_prole to-folder /Common/my_folder
Moves a custom statistics prole named my_statistics_prole to a folder named my_folder, where
my_folder has already been created and exists within /Common.
1199
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is stats.
• description
User dened description.
• eld1 ... eld32
Species the name of a counter. You can specify a counter for up to 32 elds. The default value for
each eld is none.
You can then write an iRule that uses the counter names to gather statistics about the trafc the system
is processing.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• to-folder
statistics proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, mv, regex, show, tmsh
stream
Congures a Stream prole.
Syntax
Congure the stream component within the ltm prole module using the syntax shown in the following
sections.
1200
LTM Profile
Create/Modify
create stream [name]
modify stream [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
source [none | [string] ]
target [none | [string] ]
edit stream [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv stream [ [[source-name] [destination-name]] | [[name] to-folder
[folder-name]] | [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats stream
reset-stats stream [ [ [name] | [glob] | [regex] ] ... ]
Display
list stream
list stream [ [ [name] | [glob] | [regex] ] ... ]
show running-config stream
show running-config stream
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show stream
show stream [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete stream [name]
Description
You can use the stream component to search and replace strings within a data stream, such as a TCP
connection.
1201
Traffic Management Shell (tmsh) Reference Guide
Examples
create stream my_stream_prole defaults-from stream
Creates a custom Stream prole named my_stream_prole that inherits its settings from the system default
stream prole.
list stream all-properties
Displays all properties for all Stream proles.
mv stream /Common/my_stream_prole to-folder /Common/my_folder
Moves a custom stream prole named my_stream_prole to a folder named my_folder, where my_folder
has already been created and exists within /Common.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is stream.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• source
Species the string that you want to rewrite. The default value is none.
• target
Species the new string, to replace the source string. The default value is none.
• to-folder
stream proles can be moved to any folder under /Common, but conguration dependencies may
restrict moving the prole out of /Common.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
1202
LTM Profile
tcp
Congures a Transmission Control Protocol (TCP) prole.
Syntax
Congure the tcp component within the ltm prole module using the syntax shown in the following sections.
Create/Modify
create tcp [name]
modify tcp [name]
abc [disabled | enabled]
ack-on-push [disabled | enabled]
app-service [[string] | none]
close-wait-timeout [integer]
cmetrics-cache [disabled | enabled]
cmetrics-cache-timeout [integer]
congestion-control [high-speed | new-reno | none | reno | scalable |
vegas | illinois | woodside | chd | cdg | cubic | westwood]
defaults-from [ [name] | none]
deferred-accept [disabled | enabled]
delay-window-control [disabled | enabled]
delayed-acks [disabled | enabled]
delay-window-control [disabled | enabled]
description [string]
dsack [disabled | enabled]
early-retransmit [disabled | enabled]
ecn [disabled | enabled]
fast-open [disabled | enabled]
fast-open-cookie-expiration [integer]
fin-wait-timeout [integer]
fin-wait-2-timeout [integer]
hardware-syn-cookie [disabled | enabled]
idle-timeout [integer]
init-cwnd [integer]
init-rwnd [integer]
ip-tos-to-client [integer]
keep-alive-interval [integer]
limited-transmit [disabled | enabled]
link-qos-to-client [integer]
max-retrans [integer]
md5-signature [disabled | enabled]
md5-signature-passphrase [none | [string] ]
minimum-rto [integer]
mptcp [disabled | enabled]
mptcp-csum [disabled | enabled]
mptcp-csum-verify [disabled | enabled]
mptcp-debug [disabled | enabled]
mptcp-fallback [reset | retransmit | activeaccept | accept]
mptcp-joinmax [integer]
mptcp-nojoindssack [disabled | enabled]
mptcp-rtomax [integer]
mptcp-rxmitmin [integer]
mptcp-subflowmax [integer]
mptcp-makeafterbreak [disabled | enabled]
mptcp-timeout [integer]
mptcp-fastjpoin [disabled | enabled]
nagle [disabled | enabled | auto]
pkt-loss-ignore-rate [integer]
pkt-loss-ignore-burst [integer]
proxy-buffer-high [integer]
proxy-buffer-low [integer]
1203
Traffic Management Shell (tmsh) Reference Guide
proxy-mss [disabled | enabled]
proxy-options [disabled | enabled]
rate-pace [disabled | enabled]
rate-pace-max-rate [integer]
receive-window-size [integer]
reset-on-timeout [disabled | enabled]
selective-acks [disabled | enabled]
selective-nack [disabled | enabled]
send-buffer-size [integer]
slow-start [disabled | enabled]
syn-cookie-whitelist [disabled | enabled]
syn-max-retrans [integer]
syn-rto-base [integer]
tail-loss-probe [disabled | enabled]
time-wait-recycle [disabled | enabled]
time-wait-timeout [integer]
timestamps [disabled | enabled]
verified-accept [disabled | enabled]
zero-window-timeout [integer]
edit tcp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats tcp
reset-stats tcp [ [ [name] | [glob] | [regex] ] ... ]
Display
list tcp
list tcp [ [ [name] | [glob] | [regex] ] ... ]
show running-config tcp
show running-config tcp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show tcp
show tcp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete tcp [name]
Description
You can use the tcp component to manage TCP network trafc. Many of the options are standard
SYSCTL-types of options, while others are unique to the trafc management system. For most of the options,
1204
LTM Profile
the default values usually meet your needs. The specic options that you might want to change are:
reset-on-timeout, idle-timeout, ip-tos-to-client, and link-qos-to-client.
The system installation includes these default TCP-type proles: tc, tcp-cell-optimized, tcp-lan-optimized,
and tcp-wan-optimized. You can modify the settings of these proles, or create new TCP-type proles
using any of these existing proles as parent proles.
Examples
create tcp my_tcp_prole defaults-from tcp
Creates a custom TCP prole named my_tcp_prole that inherits its settings from the system default tcp
prole.
list tcp all-properties
Displays all properties for all TCP proles
Options
• abc
When enabled, increases the congestion window by basing the increase amount on the number of
previously unacknowledged bytes that each acknowledgement code (ACK) includes. The default value
is enabled.
• ack-on-push
When enabled, signicantly improves performance to Microsoft(r) Windows(r) and MacOS peers, who
are writing out on a very small send buffer. The default value is enabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• close-wait-timeout
Species the number of seconds that a connection remains in a LAST-ACK (last acknowledgement
code) state before quitting. A value of 0 (zero) represents a term of forever (or until the maxrtx of the
FIN state). The default value is 5 seconds.
• cmetrics-cache
Species, when enabled, the default value, that the system uses a cache for storing congestion metrics.
• cmetrics-cache-timeout
Species the time, in seconds, for which entries in the congestion metrics cache are valid. The default
value is 0, which defers to the sys db variable route.metrics.timeout.
• congestion-control
Species the algorithm to use to share network resources among competing users to reduce congestion.
The default value is high-speed.
The options are:
• cdg
Species that the system use a Caia Delay-Gradient congestion control algorithm, where congestion
inferences are made based on a gradient of RTT over time. Improves inferences made about packet
loss and whether they are due to congestion or other factors. The use of a shadow window improves
coexistence with loss-based TCP ows.
• chd
1205
Traffic Management Shell (tmsh) Reference Guide
Species that the system use a Caia-Hamilton delay-based congestion control algorithm, where
delay-based congestion window operations are performed only once per RTT. Tolerates packet losses
that are likely to be unrelated to congestion. Uses a shadow window to help regain lost transmission
opportunities when competing with loss-based TCP ows.
• cubic
Species that the system uses a component optimized for high latency, high bandwidth connections
as the TCP congestion control algorithm.
• high-speed
Species that the system uses a more aggressive, loss-based algorithm.
• illinois
Species that the system uses a hybrid of both delay and loss as the TCP congestion control algorithm.
• new-reno
Species that the system uses a modication to the Reno algorithm that responds to partial
acknowledgements when SACKs are unavailable.
• none
Species that the system does not use a network-congestion-control mechanism, even when congestion
occurs.
• reno
Species that the system uses an implementation of the TCP Fast Recovery algorithm, which is
based on the implementation in the BSD Reno release.
• scalable
Species that the system uses a TCP algorithm modication that adds a scalable, delay-based and
loss-based component into the Reno algorithm.
• vegas
Species that the system uses a delay-based component as the TCP congestion control algorithm.
• westwood
Species that the system uses the Westwood+ bandwidth estimation component as the TCP congestion
control algorithm.
• woodside
Species that the system uses a hybrid of both delay and loss as the TCP congestion control algorithm.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is tcp.
• deferred-accept
Species, when enabled, that the system defers allocation of the connection chain context until the
system has received the payload from the client. This option is useful for dealing with 3-way handshake
denial-of-service (DOS) attacks. The default value is disabled.
• delay-window-control
When enabled, the system uses an estimate of queueing delay as a measure of congestion, in addition
to the normal loss-based control, to control the amount of data sent. The default value is disabled.
• delayed-acks
Species, when enabled, the default value, that the trafc management system allows coalescing of
multiple acknowledgement (ACK) responses.
1206
LTM Profile
• description
User dened description.
• dsack
When enabled, species the use of the SACK option to acknowledge duplicate segments. The default
is disabled.
• early-retransmit
Species, when enabled, that the system uses early retransmit recovery (as specied in RFC 5827) to
reduce the recovery time for connections that are receive-buffer or user-data limited. The default value
is disabled.
• ecn
Species, when enabled, that the system uses the TCP ags CWR and ECE to notify its peer of congestion
and congestion counter-measures. The default value is disabled.
• fast-open
Species, when enabled, that the system supports TCP Fast Open, which allows a client to include the
rst packet of data with the SYN to reduce latency. The default value is disabled.
• fast-open-cookie-expiration
Species the number of seconds that a "Fast Open Cookie" delivered to a client is valid for SYN packets
from that client. The default value is 21600 seconds (6 hours). A value of 0 (zero) means use the default.
The maximum value is 1000000 seconds.
• n-wait-timeout
Species the number of seconds that a connection is in the FIN-WAIT-1 or closing state before quitting.
The default value is 5 seconds. A value of 0 (zero) represents a term of forever (or until the maxrtx of
the FIN state).
• n-wait-2-timeout
Species the number of seconds that a connection is in the FIN-WAIT-2 state before quitting. The
default value is 300 seconds. A value of 0 (zero) represents a term of forever (or until the maxrtx of the
FIN state).
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• hardware-syn-cookie
Species whether or not to use hardware SYN Cookie when cross system limit. The default value is
disabled.
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 300 seconds.
• init-cwnd
Species the initial congestion window size for connections to this destination. The actual window size
is this value multiplied by the MSS (Maximal Segment Size) for the same connection. The default value
is 0 (zero), which means to use the values specied in RFC2414. The range is from 0 to 16.
• init-rwnd
Species the initial receive window size for connections to this destination. The actual window size is
this value multiplied by the MSS (Maximal Segment Size) for the same connection. The default value
is 0 (zero), which means to use the Slow Start value. The range is from 0 to 16.
1207
Traffic Management Shell (tmsh) Reference Guide
• ip-tos-to-client
Species the Type of Service (ToS) level that the trafc management system assigns to TCP packets
when sending them to clients. The default value is 0 (zero).
• keep-alive-interval
Species the keep-alive probe interval, in seconds. The default value is 1800 seconds.
• limited-transmit
Species, when enabled, the default value, that the system uses limited transmit recovery revisions for
fast retransmits (as specied in RFC 3042) to reduce the recovery time for connections on a lossy
network.
• link-qos-to-client
Species the Link Quality of Service (QoS) level that the system assigns to TCP packets when sending
them to clients. The default value is 0 (zero).
• max-retrans
Species the maximum number of retransmissions of data segments that the system allows. The default
value is 8.
• md5-signature
Species, when enabled, that the system uses RFC2385 TCP-MD5 signatures to protect TCP trafc
against intermediate tampering. The default value is disabled.
• md5-signature-passphrase
Species a plain text passphrase which may be between 1 and 80 characters in length, and is used in a
shared-secret scheme to implement the spoof-prevention parts of RFC2385. The default value is none.
• minimum-rto
Species the minimum TCP retransmission timeout in milliseconds. The default value is 0 milliseconds;
which means using the TCP stack default.
• mptcp
Species, when enabled, that the system will accept MPTCP connections. The default value is disabled.
• mptcp-csum
Species, when enabled, that the system will calculate the checksum for MPTCP connections. The
default value is disabled.
• mptcp-csum-verify
Species, when enabled, that the system verifys checksum for MPTCP connections. The default value
is disabled.
• mptcp-debug
This option is DEPRECATED v12.0.0 onwards and is maintained here for backward compatibility
reasons. Species, when enabled, that the system provides debug logs and statistics for MPTCP
connections. The default value is disabled.
• mptcp-fallback
Species, MPTCP fallback mode. The default value is reset.
The options are:
• accept
Species accept on fallback.
• active-accept
1208
LTM Profile
Species active accept on fallback.
• reset
Species that the connection is reset on fallback.
• retransmit
Species retransmit on fallback.
• mptcp-joinmax
Species the max number of MPTCP connections that can join to given one. The default value is 5.
• mptcp-nojoindssack
Species, when enabled, no DSS option is sent on the JOIN ACK. The default value is disabled.
• mptcp-rtomax
Species, the number of RTOs before declaring subow dead. The default value is 5.
• mptcp-rxmitmin
Species the minimum value (in msec) of the retransmission timer for these MPTCP ows. The default
value is 1000.
• mptcp-subowmax
Species the maximum number of MPTCP subows for a single ow. The default value is 6.
• mptcp-makeafterbreak
Species, when enabled, that make-after-break functionality is supported, allowing for long-lived
MPTCP sessions. The default value is disabled.
• mptcp-timeout
Species, the timeout value to discard long-lived sessions that do not have an active ow, in seconds.
The default value is 3600.
• mptcp-fastjoin
Species, when enabled, FAST join, allowing data to be sent on the MP_JOIN SYN, which can allow
a server response to occur in parallel with the JOIN. The default value is disabled.
• nagle
Species, when enabled, that the system applies Nagle's algorithm to reduce the number of short
segments on the network. The default value is disabled. When auto,the use of Nagle's algorithm is
decided based on network conditions.
Note that for interactive protocols such as Telnet, rlogin, or SSH, F5 Networks recommends disabling
this setting on high-latency networks, to improve application responsiveness.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the prole resides.
• pkt-loss-ignore-burst
Species the probability of performing congestion control when multiple packets in a row are lost, even
if the pkt-loss-ignore-rate was not exceeded. Valid values are 0 (zero) through 32. The default value
is 0 (zero), which means that the system performs congestion control, if any packets are lost. Higher
values decrease the chance of performing congestion control.
• pkt-loss-ignore-rate
1209
Traffic Management Shell (tmsh) Reference Guide
Species the threshold of packets lost per million at which the system should perform congestion control.
Valid values are 0 (zero) through 1,000,000. The default value is 0 (zero), which means that the system
performs congestion control, if any packet loss occurs. If you set the ignore rate to 10 and packet loss
for a TCP connection is greater than 10 per million, congestion control occurs.
• proxy-buffer-high
Species the highest level at which the receive window is closed. The default value is 49152.
• proxy-buffer-low
Species the lowest level at which the receive window is closed. The default value is 32768.
• proxy-mss
Species, when enabled, that the system advertises the same mss to the server as was negotiated with
the client. The default value is disabled.
• proxy-options
Species, when enabled, that the system advertises an option, such as a time-stamp to the server only
if it was negotiated with the client. The default value is disabled.
• rate-pace
Species, when enabled, that the system will rate pace TCP data transmissions. The default value is
disabled.
• rate-pace-max-rate
If not 0, sets the maximum rate in bytes per second that TCP data transmission will be paced to. If set
to 0, no maximum is enforced. The default value is 0.
• receive-window-size
Species the size of the receive window, in bytes. The default value is 65535 bytes.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-on-timeout
Species whether to reset connections on timeout. The default value is enabled.
• selective-acks
Species, when enabled, the default value, that the system negotiates RFC2018-compliant Selective
Acknowledgements with peers.
• selective-nack
Species whether Selective Negative Acknowledgment is enabled or disabled. The default value is
enabled.
• send-buffer-size
Species the size of the buffer, in bytes. The default value is 65535 bytes.
• slow-start
Species, when enabled, the default value, that the system uses larger initial window sizes (as specied
in RFC 3390) to help reduce round trip times. Note that disabling this attribute causes the setting for
cmetrics-cache to be ignored.
• syn-cookie-whitelist
Species whether or not to use a SYN Cookie WhiteList when doing software SYN Cookies. This means
not doing a SYN Cookie for the same src IP address if it has been done already in the previous
tm.owstate.timeout (30) seconds. The default value is disabled.
1210
LTM Profile
• syn-max-retrans
Species the maximum number of retransmissions of SYN segments that the system allows. The default
value is 3.
• syn-rto-base
Species the initial RTO (Retransmission TimeOut) base multiplier for SYN retransmission, in
milliseconds. This value is modied by the exponential backoff table to select the interval for subsequent
retransmissions. The default value is 0.
• tail-loss-probe
Species whether the system uses tail loss probe to reduce the number of retransmission timeouts. The
default value is disabled.
• time-wait-recycle
Species whether the system recycles the connection when a SYN packet is received in a TIME-WAIT
state. The default value is enabled.
• time-wait-timeout
Species the number of milliseconds that a connection is in the TIME-WAIT state before closing. The
default value is 2000 milliseconds. The range is from 0 to 600,000 (10 minutes).
• timestamps
Species, when enabled, the default value, that the system uses the timestamps extension for TCP (as
specied in RFC 1323) to enhance high-speed network performance.
• veried-accept
Species, when enabled, that the system can actually communicate with the server before establishing
a client connection. To determine this, the system sends the server a SYN before responding to the
client's SYN with a SYN-ACK. When disabled, the system accepts the client connection before selecting
a server to talk to. This option is not compatible with iRules. The default value is disabled.
• zero-window-timeout
Species the timeout in milliseconds for terminating a connection with an effective zero length TCP
transmit window. The timeout starts when the peer advertises a zero length TCP window or when enough
data has been sent to ll the previously advertised window. The timer is canceled when a non-zero length
window is received. The default is 20000 milliseconds.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
tftp
Congures a TFTP prole.
Syntax
Congure the tftp component within the ltm prole module using the syntax shown in the following
sections.
1211
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create tftp [name]
modify tftp [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
idle-timeout [integer]
log-publisher [log publisher name | none]
log-profile [log profile name | none]
mv tftp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
edit tftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tftp
list tftp [ [ [name] | [glob] | [regex] ] ... ]
show running-config tftp
show running-config tftp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete tftp [name]
Description
Use this command to create, modify, display, or delete an TFTP prole with which you can manage TFTP
trafc.
Examples
create tftp my_tftp_prole defaults-from tftp
Creates a custom TFTP prole named my_tftp_prole that inherits its settings from the system default
TFTP prole.
list tftp
Displays the properties of all TFTP proles.
mv tftp /Common/my_tftp_prole to-folder /Common/my_folder
Moves a custom tftp prole named my_tftp_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
1212
LTM Profile
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is tftp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• to-folder
tftp proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• idle-timeout
Species an idle timeout in seconds. This setting species the number of seconds that a connection is
idle before the connection is eligible for deletion. The default value is 300 seconds.
• log-publisher
Specify the name of the log publisher which logs translation events. See help sys log-cong for more
details on the logging sub-system. Use the sys log-cong publisher component to set up a log publisher.
• log-prole
Specify the name of the ALG log prole which controls the logging of ALG events. See help ltm
alg-log-prole for more details on the logging prole sub-system. Use the ltm alg-log-prole prole
component to set up an ALG log prole.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
udp
Congures a User Datagram Protocol (UDP) prole.
1213
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the udp component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create udp [name]
modify udp [name]
allow-no-payload [disabled | enabled]
app-service [[string] | none]
datagram-load-balancing [disabled | enabled]
defaults-from [[name] | none]
description [string]
idle-timeout [immediate | indefinite | integer]
ip-tos-to-client [[integer] | pass-through]
link-qos-to-client [[integer] | pass-through]
no-checksum [disabled | enabled]
proxy-mss [disabled | enabled]
ip-ttl-mode [proxy | preserve | decrement]
edit udp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv udp [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
reset-stats udp
reset-stats udp [ [ [name] | [glob] | [regex] ] ... ]
Display
list udp
list udp [ [ [name] | [glob] | [regex] ] ... ]
show running-config udp
show running-config udp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show udp
show udp [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
1214
LTM Profile
Delete
delete udp [name]
Description
You can use the udp component to manage UDP network trafc.
Examples
create udp my_udp_prole defaults-from udp
Creates a custom UDP prole named my_udp_prole that inherits its settings from the system default
UDP prole.
list udp all-properties
Displays all properties for all UDP proles.
mv udp /Common/my_udp_prole to-folder /Common/my_folder
Moves a custom udp prole named my_udp_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• allow-no-payload
Provides the ability to allow the passage of datagrams that contain header information, but no essential
data. The default is disabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• datagram-load-balancing
Provides the ability to load balance UDP datagram by datagram. The default is disabled.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is udp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• idle-timeout
Species the number of seconds that a connection is idle before the connection is eligible for deletion.
The default value is 60 seconds.
• ip-tos-to-client
Species the Type of Service level that the trafc management system assigns to UDP packets when
sending them to clients. The default value is 0 (zero).
• ip-ttl-mode
1215
Traffic Management Shell (tmsh) Reference Guide
Describe the outgoing UDP packet's TTL mode. Modes are: Proxy: Set the IP TTL to 255, which is the
default. Preserve: Set the IP TTL to the original packet TTL value. Decrement: Set the IP TTL to the
original packet TTL value minus 1.
• link-qos-to-client
Species the Quality of Service level that the system assigns to UDP packets when sending them to
clients. The default value is 0 (zero).
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• no-checksum
Enables or disables checksum processing. Note that if the datagram is IPv6, the system always performs
checksum processing. The default value is disabled.
• partition
Displays the administrative partition within which the prole resides.
• proxy-mss
Species, when enabled, that the system advertises the same mss to the server as was negotiated with
the client. The default value is disabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• to-folder
udp proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
See Also
create, delete, edit, glob, ltm prole, ltm virtual, modify, mv, show, regex, reset-stats, tmsh
wa-cache
Manages the BIG-IP(r) system WebAccelerator cache.
Syntax
Congure the wa-cache component within the ltm prole module using the syntax shown in the following
sections.
Delete
delete wa-cache [name]
Description
You can use the wa-cache component to delete the entries in the BIG-IP(r) system WebAccelerator cache.
1216
LTM Profile
Examples
delete wa-cache
Deletes the entries in the BIG-IP system WebAccelerator cache.
See Also
delete, tmsh
web-acceleration
Congures a Web Acceleration prole.
Syntax
Congure the web-acceleration component within the ltm prole module using the syntax shown in the
following sections.
Create/Modify
create web-acceleration [name]
modify web-acceleration [name]
applications
[add | delete | modify | replace-all-with] {
[application] ...
}
applications none
app-service [[string] | none]
cache-aging-rate [integer]
cache-client-cache-control-mode [all | max-age | none]
cache-insert-age-header [disabled | enabled]
cache-max-age [integer]
cache-max-entries [integer]
cache-object-max-size [integer]
cache-object-min-size [integer]
cache-size [integer]
cache-uri-exclude
[add | delete | replace-all-with] {
[URI] ...
}
cache-uri-exclude none
cache-uri-include
[add | delete | replace-all-with]{
[URI] ...
}
cache-uri-include .*
cache-uri-include-override
[add | delete | replace-all-with]{
[URI] ...
}
cache-uri-include-override none
cache-uri-pinned
[add | delete | replace-all-with] {
[URI] ...
}
cache-uri-pinned none
metadata-cache-max-size 25
1217
Traffic Management Shell (tmsh) Reference Guide
defaults-from [ [name] | none]
description [string]
edit web-acceleration [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats web-acceleration
reset-stats web-acceleration [ [ [name] | [glob] | [regex] ] ... ]
Display
list web-acceleration
list web-acceleration [ [ [name] | [glob] | [regex] ] ... ]
show running-config web-acceleration
show running-config web-acceleration [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
one-line
partition
show web-acceleration
show web-acceleration [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete web-acceleration [name]
Description
You can use the web-acceleration component to create, modify, display, or delete an Web Acceleration
prole.
The BIG-IP(r) system installation includes the following default Web Acceleration-type proles:
• web-acceleration
• optimized-caching
• optimized-acceleration
The default Web Acceleration prole contains values for properties related to managing WA Cache.
You can create a new Web Acceleration-type prole using an existing prole as a parent prole, and then
you can change the values of the properties to suit your needs.
Examples
create web-acceleration my_wa_prole defaults-from web-acceleration
1218
LTM Profile
Creates a custom Web Acceleration prole named my_wa_prole that inherits its settings from the system
default Web Acceleration prole.
Options
• applications
Congures a list of applications assigned to this prole. Assigning at least one application enables WA
functionality. The default value of none species that WA is not enabled.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• cache-aging-rate
Species how quickly the system ages a cache entry. The aging rate ranges from 0 (slowest aging) to
10 (fastest aging). The default value is 9.
• cache-client-cache-control-mode
Species which cache disabling headers sent by clients the system ignores. The default value is all.
• cache-insert-age-header
When enabled, inserts Age and Date headers in the response. The default value is enabled.
• cache-max-age
Species how long the system considers the cached content to be valid. The default value is 3600 seconds.
• cache-max-entries
Species the maximum number of entries that can be in the WA cache. The default value is 10000.
• cache-object-max-size
Species the largest object that the system considers eligible for caching. The default value is 50000
bytes.
• cache-object-min-size
Species the smallest object that the system considers eligible for caching. The default value is 500
bytes.
• cache-size
Species the maximum size, in megabytes, for the WA cache. When the cache reaches the maximum
size, the system starts removing the oldest entries. The default value is 100 megabytes.
• cache-uri-exclude
Congures a list of Uniform Resource Identiers (URIs) to exclude from the WA Cache. The default
value is none and species that no URI will be excluded.
• cache-uri-include
Congures a list of URIs that are cacheable. The default value is .* and species that all URIs are
cacheable.
• cache-uri-include-override
Congures a list of URIs that should be cached in the WA cache even though they would normally not
be cached due to constraints dened by cache-object-max-size or others. The default value is none.
URIs on the cache-uri-include-override list are cacheable even if they are not on the cache-uri-include
list.
• cache-uri-pinned
1219
Traffic Management Shell (tmsh) Reference Guide
Congures a list of URIs that are kept in the WA cache regardless their max-age or expiry settings. The
default value is none. URIs on the cache-uri-pinned list are cacheable even if they are not on the
cache-uri-include list.
• metadata-cache-max-size
Species the maximum size of the metadata cache. The metadata cache applies only when there is an
application applied to the prole, and does not include the content cache.
• defaults-from
Congures the prole that you want to use as the parent prole. Your new prole inherits all settings
and values from the parent prole specied. The default value is webacceleration.
• description
User dened description.
• partition
Displays the administrative partition within which the prole resides.
See Also
create, delete, edit, glob, list, ltm prole fasthttp, ltm virtual, modify, regex, reset-stats, show, tmsh
web-security
Congures a Web Security prole.
Syntax
Congure the web-security component within the ltm prole module using the syntax shown in the
following sections.
Create/Modify
create web-security [name]
modify web-security [name]
defaults-from [ [name] | none]
edit web-security [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list web-security
list web-security [ [ [name] | [glob] | [regex] ] ... ]
... ]
all-properties
non-default-properties
one-line
partition
1220
LTM Profile
Delete
delete web-security [name]
Description
You can use the web-security component to create, modify, display, or delete an Web Security prole.
The BIG-IP(r) system installation includes the following default Web Security-type proles:
• websecurity
The default Web Security prole contains values for properties related to managing web security.
You can create a new Web Security-type prole using an existing prole as a parent prole, and then you
can change the values of the properties to suit your needs.
Examples
create web-security my_asm_prole defaults-from web-security
Creates a custom Web Security prole named my_asm_prole that inherits its settings from the system
default Web Security prole.
Options
• defaults-from
Congures the prole that you want to use as the parent prole. Your new prole inherits all settings
and values from the parent prole specied. The default value is none.
• partition
Displays the administrative partition within which the prole resides.
See Also
create, delete, edit, glob, list, ltm prole fasthttp, ltm virtual, modify, regex, reset-stats, show, tmsh
xml
Congures an XML prole.
Syntax
Congure the xml component within the ltm prole module using the syntax shown in the following
sections.
Create/Modify
create xml [name]
modify xml [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
1221
Traffic Management Shell (tmsh) Reference Guide
namespace-mappings [ [none] |
[ { { mapping-namespace namespace1 mapping-prefix prefix1 } } ]
xpath-queries [ none |
[ add | delete | replace_all_with { queries } ] ]
multiple-query-matches [enabled | disabled]
edit xml [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
mv xml [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list xml
list xml [ [ [name] | [glob] | [regex] ] ... ]
show running-config xml
show running-config xml [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete xml [name]
Description
Use this command to create, modify, display, or delete an XML prole with which you can use XML
functionality.
Examples
create xml my_xml_prole defaults-from xml
Creates a custom XML prole named my_xml_prole that inherits its settings from the system default
XML prole.
list xml
Displays the properties of all XML proles.
mv xml /Common/my_xml_prole to-folder /Common/my_folder
Moves a custom xml prole named my_xml_prole to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• app-service
1222
LTM Profile
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is xml.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• namespace-mappings
Species a list of mappings between namespaces and prexes to be used in the XPath queries of the
prole.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• to-folder
xml proles can be moved to any folder under /Common, but conguration dependencies may restrict
moving the prole out of /Common.
• xpath-queries
Species the list of XPath queries that are used by the prole. A match of any of the queries will trigger
the XML_CONTENT_BASED_ROUTING iRule event.
• multiple-query-matches
Enables or disables multiple matches for a single XPath query.
See Also
create, delete, edit, glob, list, ltm virtual, modify, mv, regex, reset-stats, show, tmsh
1223
Traffic Management Shell (tmsh) Reference Guide
LTM TacDB
customdb
Congures a custom tacdb to be used for le loads. A customdb includes a URL (including local le paths)
from where TACDB les are loaded. These les contain TAC code information.
Syntax
Congure the customdb component within the ltm tacdb module using the syntax in the following sections.
Create/Modify
create customdb [name]
modify customdb [[name] | all]
url [string]
poll-interval [integer]
user [string]
password [string]
app-service [name]
description [string]
Display
list customdb [[name] | all | [property]]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete customdb [[name] | all]
Description
You can use the customdb component to dene a custom tacdb
Examples
create customdb new { url le:/shared/images/new.txt }
Creates a new custom tacdb, "new" with TAC code information in the le specied by url.
Options
• create
Creates a new custom tacdb.
• delete
Deletes the custom tacdb that you specify next.
• url
Species the url to fetch the le containing the TACDB information.
• poll-interval
Species the time interval in seconds at which the url needs to be polled.
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description for this customdb.
• partition
Displays the administrative partition within which the component resides.
See Also
edit, list, modify, tmsh
customdb-file
Manages a custom TACDB le
Syntax
List the customdb-le component within the ltm tacdb module using the syntax in the following sections.
Create
create customdb-file [name]
source-path [string]
app-service [name]
DEPRECATED: Though this command is visible, this is not meant to be used by the users. The
daemons use it internally.
Display
list customdb-file [[name] | all | [property]]
all-properties
one-line
partition
1226
LTM TacDB
Delete
delete customdb-file [[name] | all]
DEPRECATED: Though this command is visible, this is not meant to be used by the users. The
daemons use it internally.
Description
The customdb-le is created internally using the URl specied in ltm tacdb customdb.
Examples
create customdb-le new { source-path le:/shared/images/new.txt }
Creates a new customdb le object, "new" from the source le /shared/images/new.txt
list customdb-le [leobj-name]
Lists the attributes of customdb le object, "new" from the source le /shared/images/new.txt
Options
• create
Creates a new le object for custom tacdb.
• delete
Deletes the le object that you specify next.
• source-path
Species the location from where the TACDB le object sources the le.
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description for this customdb le object.
• partition
Displays the administrative partition within which the component resides.
See Also
edit, list, tmsh
1227
Traffic Management Shell (tmsh) Reference Guide
Net
arp
Manages entries in the Address Resolution Protocol (ARP) table.
Syntax
Congure the arp component within the net module using the syntax in the following sections.
Create/Modify
create arp [name]
description [string]
ip-address [ip address ... ip address]
mac-address [mac address]
modify arp [name]
description [string]
mac-address [mac address]
edit arp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
=head2 DISPLAY
list arp
list arp [ [ [name] | [glob] | [regex] ] ... ]
show running-config arp
show running-config arp
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show arp
show arp [ [ [name] | [glob] | [regex] ] ... ]
(dynamic | static)
Delete
delete arp [name]
Description
You can use the arp component to add entries to or delete entries from the ARP table.
You can create static ARP entries for IPv4 addresses to link-layer addresses, such as Ethernet media access
control (MAC) addresses. You can view and delete static and dynamic ARP entries.
Note that you can use the db component in the sys module to congure how the system handles ARP entries
for dynamic timeout, maximum dynamic entries, add reciprocal, and maximum retries. For more information,
see sys db.
Examples
create arp myARP ip-address 10.10.10.20 mac-address 00:0b:09:88:00:9a
Creates an arp mapping of the IP address 10.10.10.20 to the MAC address 00:0b:09:88:00:9a, and the name
of this entry is myARP. Alternatively, the address can be used as the name, like the following example.
create arp 10.10.10.20 mac-address 00:0b:09::88:00:9a
Creates an arp mapping of IP address 10.10.10.20 to the MAC address 00:0b:09:88:00:9a.
modify arp 10.10.10.20 mac-address 00:0b:09:88:00:9b
Modies the ARP mapping of the ARP entry named 10.10.10.20 to the MAC address 00:0b:09:88:00:9b.
show arp
Displays ARP status and statistics for the system.
show arp any%2
Displays ARP status and statistics for all IP addresses in route domain 2. A glob expression displays the
same result: show arp *%2.
list arp all-properties
Displays all properties for all ARP entries for the system.
list arp non-default-properties
Displays all non-default properties for all ARP entries for the system.
delete arp all
Deletes all ARP entries for the system.
delete arp myARP
Deletes the ARP entry named myARP.
Options
• description
User dened description.
• dynamic
Displays the status of dynamic ARP entries.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ip address
Species the IP address, in one of the following formats, for which you want to congure an ARP entry:
• IPv4 address in dotted-quad notation, for example, 10.10.10.1
1230
Net
• host name, for example, www.f5.com
You can also specify a list of IP addresses separated by a single space. For example, this list contains
three IP addresses: 10.10.10.20 10.10.10.21 10.10.10.22.
• ip-address
The IP address to be mapped. This is optional, and if not present, the name needs to be a string that
represents a valid IP address.
• mac-address
Species a 6-byte ethernet address in not case-sensitive hexadecimal colon notation, for example,
00:0b:09:88:00:9a. You must specify a MAC address when you create an ARP entry.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• static
Displays the status of static ARP entries.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
cmetrics
Displays and deletes entries in the route metrics table on the BIG-IP(r) system.
Syntax
Use the cmetrics component within the net module to view route metrics or delete a route metric entry
using the following syntax.
Display
show cmetrics
option:
bandwidth
dest-addr [ip address]
hwaddress
mtu
rtt
rttvar
ssthresh
tmm
Delete
delete cmetrics
option:
dest-addr [IP address]
1231
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the cmetrics component to display entries in the route metrics table on the BIG-IP system.
Additionally, you can delete a specied route metric entry from the table. The options are display-only
values and cannot be used for ltering.
Note: You can delete only entries that have no connection references.
Examples
show cmetrics
Displays all the entries in the route metrics table.
delete cmetrics dest-addr 10.10.1.11
Deletes the entry with destination IP address 10.10.1.11 from the route metrics table.
Options
• bandwidth
Displays the size of the channel.
• dest-addr
Species the destination IP address of the entry that you want to display or delete. You can enter this
address in either IPv4 or IPv6 format.
• hwaddress
Displays the Media Access Control (MAC) address for the route.
• mtu
Displays the maximum transmit unit size on the route.
• rtt
Displays the round-trip time on the route.
• rttvar
Displays the variance in the round-trip time.
• ssthresh
Displays the cached slow-start threshold.
• tmm
Displays the identifying number of the tmm (Trafc Management Microkernel).
See Also
delete, show, tmsh
dag-globals
congure global disaggregation settings.
1232
Net
Syntax
Congure the dag-globals component within the net module using the syntax shown in the following
sections.
Modify
modify dag-globals
round-robin-mode [global | local]
edit dag-globals
all-properties
non-default-properties
Display
list dag-globals
show running-config dag-globals
all-properties
non-default-properties
one-line
Description
Provides the ability to congure global disaggregation settings.
• round-robin-mode
Species whether the round robin disaggregator (DAG) on a blade can disaggregate packets to all the
TMMs in the system or only to the TMMs local to the blade.
See Also
list, modify, show, tmsh
ike-evt-stat
Displays and resets IKE event statistics
Syntax
Display and reset the ike-evt-stat component within the net module using the syntax in the following
section.
Modify
reset-stats ike-evt-stat
1233
Traffic Management Shell (tmsh) Reference Guide
Display
show ike-evt-stat
Description
You can use the ike-evt-stat component to display and reset IKE event statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
reset-stats, show, tmsh
ike-msg-stat
Displays and resets IKE message statistics
Syntax
Display and reset the ike-msg-stat component within the net module using the syntax in the following
section.
Modify
reset-stats ike-msg-stat
Display
show ike-msg-stat
Description
You can use the ike-msg-stat component to display and reset IKE message statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
reset-stats, show, tmsh
1234
Net
interface
Congures the parameters of interfaces.
Syntax
Congure the interface component within the net module using the syntax in the following sections.
Modify
modify interface [name]
description [string]
[disabled | enabled]
flow-control (none |rx | tx | tx-rx)
force-gigabit-fiber [enabled | disabled]
media [auto | 10baseT half | 10baseT full | 100baseTX half |
100baseTX full | 1000baseT half | 1000baseT full |
1000baseSX full | 1000baseLX full | 1000baseCX full |
10GbaseT full | 10GbaseSR full | 10GbaseLR full |
10GbaseER full | 10SFP+Cu full | 40GbaseSR4 full |
40GbaseLR4 full | none | no-phy]
media-fixed [auto | 10baseT half | 10baseT full |
100baseTX half | 100baseTX full | 1000baseT half |
1000baseT full | none | no-phy]
media-sfp [auto | 10baseT half | 10baseT full | 100baseTX half |
100baseTX full | 1000baseT half | 1000baseT full |
1000baseSX full | 1000baseLX full | 1000baseCX full |
10GbaseT full | 10GbaseSR full | 10GbaseLR full |
10GbaseER full | 10SFP+Cu full | 40GbaseSR4 full |
40GbaseLR4 full | none | no-phy]
no-mgmt
prefer-port [fixed | sfp]
sflow {
poll-interval [integer]
poll-interval-global [no | yes]
}
stp [disabled | enabled]
stp-auto-edge-port [enabled | disabled]
stp-edge-port [false | true]
stp-link-type [auto | p2p | shared]
stp-reset
qinq-ethertype [string]
edit interface [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats interface
reset-stats interface [ [ [name] | [glob] | [regex] ] ... ]
Display
list interface
list interface [ [ [name] | [glob] | [regex] ] ... ]
1235
Traffic Management Shell (tmsh) Reference Guide
show running-config interface
show running-config interface
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
mac-address
media-active
media-capabilities
media-max
mtu
non-default-properties
(pending | not-pending)
one-line
show interface
show interface [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the interface component to enable or disable an interface, and to display and set media options,
duplex mode, and status for an interface. In addition, you can specify whether the interface participates in
the spanning tree protocol (STP) conguration, and set per-interface STP parameters such as link type, edge
port status, and automatic edge port detection.
Examples
modify interface 1.1 enabled
Enables the interface named 1.1.
modify interface 1.2 disabled
Disables the interface named 1.2.
modify interface 1.1 1.2 1.3 stp disable
Disables STP on the interfaces named 1.1, 1.2, and 1.3.
modify interface 1.1 1.2 1.3 stp-auto-edge-port enabled
Sets auto edge detection for STP on the interfaces named 1.1, 1.2, and 1.3.
modify interface 1.1 1.2 1.3 stp-edge-port true
Sets the edge port attribute for STP on the interfaces named 1.1, 1.2, and 1.3.
Options
• description
User dened description.
• [disabled | enabled]
Enables or disables the specied interface. The default value is enabled.
• ow-control
Species how the system controls the sending of PAUSE frames for ow control. The default value is
tx-rx.
• none
1236
Net
Disables ow control.
• rx
Species that the interface honors pause frames from its partner, but does not generate pause frames.
• tx
Species that the interface ignores pause frames from its partner, and generates pause frames when
necessary.
• tx-rx
Species that the interface honors pause frames from its partner, and also generates pause frames
when necessary.
• force-gigabit-ber
Enables or disables forcing of gigabit ber media. If this is enabled for a gigabit ber interface, the
media setting will be forced, and no auto-negotiation will be performed. If it is disabled, auto-negotiation
will be performed with just a single gigabit ber option advertised.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• if-index
Displays the index assigned to this interface. It is a unique identier assigned for all objects displayed
in the SNMP IF-MIB.
• mac-address
Displays the 6-byte ethernet address in not case-sensitive hexadecimal colon notation, for example,
00:0b:09:88:00:9a.
• media
Species the settings for the interface. The possible values are: 10baseT-full, 10baseT-half, 10GbaseER
full, 10GbaseLR-full, 10GbaseSR-full, 10GbaseT-full, 10SFP+Cu-full, 40GbaseSR4-full,
40GbaseLR4-full, 100baseTX-half, 100baseTX-full, 1000baseLX full, 1000baseCX-full, 1000baseT-full,
1000baseT-half, 1000baseSX-full, auto, none, and no-phy.
When you set the media option, the system automatically sets either the media-sfp or media-xed
option, based on whether the interface supports small factor form pluggable (SFP) interfaces, or for
combo ports whether SFP is the preferred port.
• media-active
Displays the current media setting for the interface.
• media-xed
Species the settings for a xed (non-pluggable) interface. Use this option only with a combo port to
specify the media type for the xed interface, when it is not the preferred port.
• media-max
Displays the maximum media value for the interface.
• media-sfp
Species the settings for an SFP (pluggable) interface. Note that you use this option only with a combo
port to specify the media type for the SFP interface, when it is not the preferred port.
• mtu
Displays the Maximum Transmission Unit (MTU) of the interface, which is the maximum number of
bytes in a frame without IP fragmentation.
1237
Traffic Management Shell (tmsh) Reference Guide
• name
Species an interface name, for example 3.1, where 3 is the physical slot number holding the network
interface hardware and 1 is the physical port number of that interface on that hardware. Another example
is mgmt, the name given to the management interface.
• no-mgmt
Ensures that no changes are made to the mgmt interfaces when all is specied. This is especially
convenient when disabling all trafc interfaces using the disabled command.
• [pending | not-pending]
Pending indicates that the slot with which the interface is associated does not contain a blade.
Not-pending indicates that the slot with which the interface is associated is not a cluster member. The
default value is pending.
• prefer-port
Indicates which side of a combo port the interface uses, if both sides of the port have the potential for
external links. The default value is sfp. Do not use this option for non-combo ports.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• sow
Species sFlow settings for the interface:
• poll-interval
Species the maximum interval in seconds between two pollings. The default value is 0. To enable
this setting, you must also set the poll-interval-global setting to no.
• poll-interval-global
Species whether the global interface poll-interval setting, which is available under sys sow
global-settings module, overrides the object-level poll-interval setting. The default value is yes.
The available values are:
• no
Species to use the object-level poll-interval setting.
• yes
Species to use the global interface poll-interval setting.
• serial
Displays the serial number of the pluggable unit on an interface. It is only available on a
SFP/SFP+/XFP/QSFP+ unit.
• stp
Enables or disables STP. If you disable STP, no STP, RSTP, or MSTP packets are transmitted or
received on the interface or trunk, and spanning tree has no control over forwarding or learning on
the port or the trunk. The default value is enabled.
• stp-auto-edge-port
Sets the STP automatic edge port detection for the interface. The default value is enabled. When
STP automatic edge port detection is set to enabled on an interface, the system monitors the interface
for incoming STP, RSTP, or MSTP packets. If no such packets are received for a sufcient period
of time (about three seconds), the interface is automatically given edge port status. When automatic
edge port detection is set to disabled on an interface, the system does not automatically give the
1238
Net
interface the edge port status. Any STP setting set on a per-interface basis applies to all spanning
tree instances.
• stp-edge-port
Sets STP edge port detection. The default value is true.
• stp-link-type
Species the STP link type for the interface. The default value is auto.
The spanning tree system includes important optimizations that can only be used on point-to-point
links. That is, on links that connect just two bridges. If these optimizations are used on shared links,
incorrect or unstable behavior may result. By default, the implementation assumes that full-duplex
links are point-to-point and that half-duplex links are shared.
The options are:
• auto
Species that the system determines the spanning tree link type, which is based on the duplex
setting.
• p2p
Species that the system uses the optimizations for point-to-point spanning tree links.
Point-to-point links connect only two spanning tree bridges.
• shared
Species that the system uses the optimizations for shared spanning tree links. Shared links
connect two or more spanning tree bridges.
• stp-reset
Resets STP, which forces a migration check.
• qinq-ethertype
Species the ether-type value used for the packets handled on this port when it is a member in a
QinQ vlan. The ether-type can be set to any string containing a valid hexadecimal 16 bits number,
or any of the well known ether-types: 0x8100, 0x9100, 0x88a8. Default value is set to 0x8100.
• if-index
Displays the index assigned to this interface. It is a unique identier assigned for all objects displayed
in the SNMP IF-MIB.
• vendor
Displays the name of the vendor of the pluggable unit on an interface. It is only available on a
SFP/SFP+/XFP/QSFP+ unit.
See Also
edit, glob, list, modify, regex, reset-stats, show, tmsh
interface-cos
Displays and resets COS (Class of Service) related statistics for the interfaces.
1239
Traffic Management Shell (tmsh) Reference Guide
Syntax
Display cos related statistics within the net module using the following syntax.
Modify
reset-stats interface-cos
Display
show interface-cos
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the interface-cos component to display COS related statistics, including pkts out and bits out
for all 8 COS queue.
Examples
show interface-cos
Displays interface COS related statistics for the system.
For information about the command reset-stats, see help reset-stats.
See Also
reset-stats, show,
mroute
Displays the multicast routes in the BIG-IP(r) system.
Syntax
Display multicast route (mroute) entries within the net module using the syntax given below.
Display
show net mroute
source [IP address]
group [multicast group address]
Description
Use the mroute component to display all the multicast routes in the BIG-IP(r) system. Results can be ltered
using source option, group option, or both.
1240
Net
Examples
show net mroute
Displays all the multicast routes in the system.
show net mroute source 10.10.10.1
Displays all the multicast routes in the system whose source IP address is 10.10.10.1.
show net mroute group 224.1.0.13
Displays all the multicast routes in the system whose group multicast address is 224.1.0.13.
show net mroute source 10.10.10.1 group 224.1.0.13
Displays all the multicast routes in the system whose source IP address is 10.10.10.1 and group multicast
address is 224.1.0.13.
Options
• source
Species the source IP address of the multicast routes that you want to display.
• group
Species the multicast group address to display. Only a single group may be specied with the group
option.
See Also
show, tmsh
multicast-globals
Manage multicast trafc conguration options
Syntax
Congure the multicast-globals component within the net module using the syntax shown in the following
sections.
Modify
modify multicast-globals
rate-limit [disabled | enabled]
edit multicast-globals
all-properties
non-default-properties
Display
list multicast-globals
1241
Traffic Management Shell (tmsh) Reference Guide
show running-config multicast-globals
all-properties
non-default-properties
one-line
Description
Provides the ability to congure options related to multicast trafc processing.
Examples
modify multicast-globals rate-limit enabled
Species, when enabled, that the DB variable switchboard.maxmcastrate setting controls the multicast
packet per second rate limiting in the switch. The default value is enabled.
See Also
edit, list, modify, show, tmsh
ndp
Congures IPv6-to-Ethernet neighbor discovery display and control.
Syntax
Congure the ndp component within the net module using the syntax in the following sections.
Create/Modify
create ndp [name]
description [string]
ip-address [ip address]
mac-address [MAC address]
modify ndp [name]
description [string]
mac-address [MAC address]
edit ndp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ndp
list ndp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ndp
show running-config ndp
[ [ [name] | [glob] | [regex] ] ... ]
1242
Net
all-properties
non-default-properties
one-line
show ndp
show ndp [ [ [name] | [glob] | [regex] ] ... ]
[all | dynamic | field-fmt | static]
Delete
delete ndp [ [all]| [name]... ]
Description
Congures the IPv6-to-Ethernet address translation tables used by the IPv6 neighbor discovery protocol.
Examples
create ndp myNdp ip-address fec0:f515::c001 mac-address 00:0B:DB:3F:F6:57
Maps the IPv6 address, fec0:f515::c001, to the MAC address, 00:0B:DB:3F:F6:57, and the name of this
entry is myNdp. Alternatively, the address can be used as the name, like the following example.
create ndp fec0:f515::c001 mac-address 00:0B:DB:3F:F6:57
Maps the IPv6 address, fec0:f515::c001, to the MAC address, 00:0B:DB:3F:F6:57.
show ndp
Displays all static and dynamic IPv6 address-to-MAC address mappings.
Options
• ip-address
The IP address that is to be mapped. This is optional, and if not present, the name needs to be a string
that represents a valid IP address.
• description
User dened description.
• dynamic
Displays dynamic IPv6 address-to-MAC address mapping.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ip-address
The IP address that is to be mapped. This is optional, and if not present, the name needs to be a string
that represents a valid IP address.
• mac-address
Species a 6-byte Ethernet address in hexadecimal colon notation that is not case-sensitive, for example,
00:0b:09:88:00:9a.
• regex
1243
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• static
Displays static IPv6 address-to-MAC address mapping.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
packet-filter
Congures packet lter rules.
Syntax
Congure the packet-lter component within the net module using the syntax in the following sections.
Create/Modify
create packet-filter [name]
modify packet-filter [name]
action [accept | continue | discard | reject]
app-service [[string] | none]
description [string]
logging [enabled | disabled]
order [integer]
rate-class [name]
rule "[BPF expression]"
vlan [name]
edit packet-filter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats packet-filter
reset-stats packet-filter
[ [ [name] | [glob] | [regex] ] ... ]
Display
list packet-filter
list packet-filter
[ [ [name] | [glob] | [regex] ] ... ]
show running-config packet-filter
show running-config packet-filter
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
1244
Net
non-default-properties
one-line
show packet-filter
show packet-filter [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete packet-filter [ all | [name] ]
Description
You can use the packet-lter component to create a layer of security for the trafc management system
using packet lter rules.
The BIG-IP(r) system packet lters are based on the Berkeley Software Design Packet Filter (BPF)
architecture. Packet lter rules are composed of four mandatory attributes and three optional attributes. The
mandatory attributes are name, order, action, and rule. The optional attributes are vlan, logging, and
rate-class. The rule attribute you choose denes the BPF script to match for the rule.
Important: By default, packet ltering is disabled. You must enable packet ltering using the Conguration
utility. For more information, see the TMOS(r) Management Guide for BIG-IP(r) Systems.
Examples
You can create a set of rules that specify what incoming trafc you want the system to accept and how to
accept it. See the examples following.
• Example 1: Block spoofed addresses
This example prevents private IP addresses from being accepted on a public VLAN. This is a way of
ensuring that no one can spoof private IP addresses through the external VLAN of the system. In this
example, the system logs when this happens:
create packet-filter spoof_blocker {
order 5
action discard
vlan external
logging enabled
rule " (src net 172.19.255.0/24) "
}
• Example 2: Allow restricted management access
You can provide restricted SSH and HTTPS access to the trafc management system for management
purposes, and keep a log of that access. Note: This not the same management access you can get through
the management port/interface (mgmt); that interface is not affected by any packet lter conguration,
and if that is the only way you want to allow access to your system, this conguration is not necessary.
1245
Traffic Management Shell (tmsh) Reference Guide
In the rst rule shown below, SSH is allowed access from a single xed-address administrative
workstation, and each access is logged. In the subsequent rule, browser-based Conguration utility
access is allowed from two xed-address administrative workstations; however, access is not logged.
create packet-filter management_ssh {
order 10
action accept
logging enabled
rule " (proto TCP) and (src host 172.19.254.10) and
(dst port 22) "
}
create packet-filter management_gui {
order 15
action accept
rule " (proto TCP) and (src host 172.19.254.2 or
src host 172.19.254.10) and (dst port 443) "
}
• Example 3: Allow access to all virtual servers
In this nal example, you can verify that all of the virtual servers in your conguration are reachable
from the public network. This is critical if you have decided to use a default-deny policy. This example
also shows how to rate shape all trafc to the virtual server IP address with a default rate class (that can
be overridden by individual virtual servers or iRules(r) later).
Note: This example has a single virtual server IP, and it does not matter what port trafc is destined
for. If you want to be more specic, you can specify each service port, as well (for example, HTTP, FTP,
telnet).
create packet-filter virtuals {
order 20
action accept
vlan external
rate class root
rule " ( dst host 172.19.254.80 ) "
}
Options
You can use these options with the packet-lter component to create packet lter rules:
• action
Species how the system handles a packet that matches the criteria in the packet lter rule. There is no
default; you must specify a value when you create a packet lter rule.
The possible values are:
• accept
Indicates that the system accepts the packet, and stops processing additional packet lter rules, if
there are any.
• continue
1246
Net
Indicates that the system acknowledges the packet for logging or statistical purposes, but makes no
decision on how to handle the packet. The system continues to evaluate trafc matching a rule with
the Continue action, starting with the next packet lter rule in the list.
• discard
Indicates that the system drops the packet, and stops processing additional packet lter rules, if there
are any.
• reject
Indicates that the system drops the packet, and also sends a reject packet to the sender, indicating
that the packet was refused.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• logging
Enables or disables packet lter logging. If you omit this value, no logging is performed.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• order
Species a sort order greater than 0 (zero). No two rules may have the same sort order. There is a single,
global list of rules. Each rule in the list has a relative integer order. The system rst evaluates the rule
with the lowest order value, and then evaluates all other rules based on ascent of the order value assigned
to each rule.
For example, if there are 5 rules, numbered 500, 100, 300, 200, 201; the rule evaluation order is 100,
200, 201, 300, 500.
The system compares each packet to be ltered against the list of rules in sequence, starting with the
rst. Evaluation of the rule list stops on the rst match that has an action of accept, discard or reject.
A match on a rule with an action of none does not stop further evaluation of the rule list; the system
updates the statistics count and generates a log if the rule indicates it, but otherwise rule processing
continues with the next rule in the list.
F5 Networks recommends that you sequence rules for effect and efciency; generally this means:
-- Assign the lowest order to more specic rules, so that the system will evaluate those rules rst.
-- The system evaluates one expression with multiple criteria more efciently than multiple expressions
each with a single criterion.
This option is required.
• rate-class
Species the name of a rate class. The value is the name of any existing rate class. If omitted, no rate
lter is applied.
• regex
1247
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rule
Species the BPF expression to match. The rule is mandatory, however you can leave it empty. If empty,
the packet lter rule matches all packets.
• vlan
Species the VLAN to which the packet lter rule applies. The value for this option is any VLAN name
currently in existence. If you omit this value, the rule applies to all VLANs. If you do not provide a
VLAN name when you create a packet-lter, the rule applies to all VLANs.
See Also
create, delete, edit, glob, list, ltm virtual, modify, net packet-lter-trusted, net vlan, net vlan-group, regex,
reset-stats, show, tmsh
packet-filter-trusted
Modies or displays trusted allow lists for packet lters.
Syntax
Congure the packet-lter-trusted component within the net module using the syntax in the following
sections.
Modify
modify packet-filter-trusted
description [string]
ip-addresses none
ip-addresses
[add | delete | replace-all-with] {
[ip address ... ]
}
mac-addresses none
mac-addresses
[ add | delete | replace-all-with] ] {
[MAC address ...]
}
vlans none
vlans
[add | delete | replace-all-with] ] {
[vlan name ... ]
}
edit packet-filter-trusted
Display
list packet-filter-trusted
1248
Net
show running-config packet-filter-trusted
all-properties
non-default-properties
one-line
Description
Use the packet-lter-trusted component to create a layer of security for the trafc management system
using trusted allow lists.
Trusted allow lists are lists of IP addresses, MAC addresses, and VLANs that are exempt from packet lter
rules.
Important: By default, packet ltering is disabled. You must enable packet ltering using the Conguration
utility. For more information, see the TMOS(r) Management Guide for BIG-IP(r) Systems.
Example
Creates a trusted allow list that allows anything listed to bypass the packet lter.
In the following example, you have an administrative laptop that you want to have unrestricted access to
the trafc management system. This is a laptop, and therefore it might have a different IP address from time
to time. One way to solve the problem is to add a trusted MAC address. This trusted allow list example
shows the laptop MAC address as 00:02:3F:3E:2F:FE. Now the laptop can access the trafc management
system regardless of what address it boots with or to which VLAN it is connected, as long as it is on the
same physical segment as the trafc management system.
Also in this example, the trafc management system is congured for basic rewalling of the private/internal
network. This example shows a way to lter incoming trafc and allow outgoing trafc to be unrestricted.
To do this, you add trusted VLANs that represent all trafc that originated on the internal network. Another
way to do this is to use trusted IP addresses instead, for example, 192.168.26.0/24.
modify packet-filter-trusted {
vlans add { internal1 internal2 }
mac-addresses add { 00:02:3F:3E:2F:FE }
}
Options
• description
User dened description.
• ip-addresses
Species a list of source IP addresses. Any trafc matching a source IP address in the list is automatically
allowed. This simplies conguration of the packet lter to allow trusted internal trafc to be passed
from VLAN to VLAN without a lter rule, including out to the Internet. Processing of trafc by this
option occurs before rule list evaluation, making it impossible to override this option and mask out
(block) certain types of trafc with a packet lter rule. This option is empty by default.
• mac-addresses
Species a list of MAC addresses. The system allows any trafc matching a MAC address in the source
address list. This simplies conguration of the packet lter to allow trusted internal trafc to be passed
from VLAN to VLAN without a lter rule, including out to the Internet. Processing of trafc by this
option occurs before rule list evaluation, making it impossible to override this option and mask out
(block) certain types of trafc with a packet lter rule. This option is empty by default.
• vlans
1249
Traffic Management Shell (tmsh) Reference Guide
Species a list of ingress VLANs. Any trafc received on a VLAN that is on the ingress VLAN list is
automatically allowed. This simplies conguration of the packet lter to allow trusted internal trafc
to be passed from VLAN to VLAN without a lter rule, including out to the Internet. Processing of
trafc by this option occurs before rule list evaluation, making it impossible to override this option and
mask out (block) certain types of trafc with a packet lter rule. This option is empty by default.
See Also
edit, list, ltm virtual, modify, net packet-lter, net vlan, net vlan-group, show, tmsh
port-mirror
Congures interface (port) mirroring.
Syntax
Congure the port-mirror component within the net module using the syntax in the following sections.
Create/Modify
create port-mirror [interface_name]
modify port-mirror [interface_name]
app-service [[string] | none]
interfaces
[add | delete | replace-all-with] {
[interface_name ... ]
}
interfaces [default | none]
edit port-mirror [ [ [interface_name] | [glob] | [regex] ] ... ]
all-properties
Display
list port-mirror
list port-mirror
[ [ [interface_name] | [glob] | [regex] ] ... ]
show running-config port-mirror
show running-config port-mirror
[ [ [interface_name] | [glob] | [regex] ] ... ]
one-line
Delete
delete port-mirror [interface_name]
Description
You can use the port-mirror component to mirror trafc from interfaces on a blade to other interfaces on
the same blade or another blade.
1250
Net
Examples
create port-mirror 1/1.1 interfaces add 1/1.2 1/1.3 1/1.4
Creates a port mirror from interface 1.1 on blade 1 to interfaces 1.2, 1.3, 1.4 on the same blade. The system
mirrors trafc from interfaces 1.2, 1.3, and 1.4 on blade 1 to the interface 1.1 on the same blade.
modify port-mirror 1/1.1 interfaces delete 1/1.3 1/1.4
Deletes interfaces 1.3 and 1.4 on blade 1 from the existing port mirror 1/1.1 on the same blade.
Option
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interface_name
Species the name of the interface, for example, 1/1.1.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, net interface, regex, show, tmsh
route
Congures a route for trafc management.
Syntax
Congure the route component within the net module using the syntax in the following sections.
Create/Modify
create route [name | ip address/netmask | default | default-inet6]
modify route [name | ip address/netmask | default | default-inet6]
blackhole
description [string]
gw [ip address]
interface [name]
mtu [integer]
1251
Traffic Management Shell (tmsh) Reference Guide
network [ip address/netmask]
pool [name]
edit route
[ [name | ip address/netmask | default | default-inet6] | [glob] | [regex]
] ... ]
all-properties
non-default-properties
Display
list route
list route
[ [name | ip address/netmask | default | default-inet6] | [glob] | [regex]
] ... ]
show running-config route
show running-config route
[ [name | ip address/netmask | default | default-inet6] | [glob] | [regex]
] ... ]
all-properties
mtu
non-default-properties
one-line
partition
show route
show route
[ [name | ip address/netmask | default | default-inet6] | [glob] | [regex]
] ... ]
connected
dynamic
field-fmt
lookup [ip address]
static
Delete
delete route [name | ip address/netmask | default | default-inet6]
Description
You can congure routes for the system, including default routes.
Note that when you use the command edit to create a new route, by default the gw (gateway) option is set.
If you do not want to use the gw option, remove that line of syntax in the editor.
Examples
create route myRoute3 network 12.12.4.0/24 interface external
Sets the route myRoute3 to the address 12.12.4.0/24 on the interface named external.
create route 12.12.3.0/24 gw 10.10.10.254
Sets the route to the subnet 12.12.3.0/24 whose gateway IP address is 10.10.10.254.
create route default gw 10.10.10.254
1252
Net
Sets the default gateway IP address to 10.10.10.254.
show route lookup myRoute
Displays the route that the system uses to reach the IP address 12.12.3.0.
Options
Note: The options blackhole, gw, interface, and pool are mutually exclusive. You can use only one of
these options at a time, and you must specify at least one of these options when conguring a route.
• blackhole
Species that the system drops trafc that is addressed to the specied destination.
• connected
Displays connected routes.
• description
User dened description.
• dynamic
Displays dynamic routes.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• gw
Species a gateway address for the system.
• interface
Species the tunnel, VLAN or VLAN group to which the system sends trafc.
• ip address/netmask
Species the destination subnet and mask using CIDR notation, such as 12.12.3.0/24. You can also
specify the keyword default or default-inet6.
• lookup
Displays the route that the system uses to reach the specied IP address. You can specify only a single
IP address with the lookup option.
• mtu
Sets a specic maximum transition unit (MTU). If you set this option to 0 (zero), the system selects the
appropriate MTU for the route, and does not display the MTUs.
• network
Species the destination subnet and mask using CIDR notation, such as 12.12.3.0/24. You can also
specify the keyword default or default-inet6.
• partition
Displays the administrative partition within which the route resides.
• pool
Species a pool to which the system sends trafc. This allows the system to send trafc to multiple,
load-balanced gateways.
• regex
1253
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• static
Displays static routes.
See Also
create, delete, edit, glob, list, ltm pool, modify, net vlan, net vlan-group, regex, show, tmsh
route-domain
Congures route-domains for trafc management.
Syntax
Congure the route-domain component within the net module using the syntax in the following sections.
Create/Modify
create route-domain [ [name] | none]
id [integer]
modify route-domain [name]
app-service [[string] | none]
bwc-policy [string]
connection-limit [integer]
description [string]
flow-eviction-policy [ [eviction policy name] | none ]
fw-enforced-policy [ [policy_name] | none ]
fw-staged-policy [ [policy_name] | none ]
id [integer]
parent [ [name] | none]
service-policy [ [policy_name] | none ]
strict [disabled | enabled]
routing-protocol
[add | delete | replace-all-with] {
[protocol name] ...
}
vlans
[add | delete | replace-all-with] {
[vlan name] ...
}
edit route-domain [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats route-domain [name]
1254
Net
fw-enforced-policy-rules { [rule name] }
fw-staged-policy-rules { [rule name] }
options:
ip-intelligence-categories
port-misuse
Display
list route-domain
list route-domain [ [name] | [glob] | [regex] ] ... ]
show running-config route-domain
show running-config route-domain
[ [name] | [glob] | [regex] ] ... ]
all-properties
one-line
non-default-properties
show route-domain [ [ [name] | [glob] | [regex] ] ... ]
ip-intelligence-categories
port-misuse
Delete
delete route-domain [name]
Description
Using route domains, you can assign the same IP address to more than one device on a network, as long as
each instance of the IP address resides in a separate routing domain.
Examples
create route-domain myRouteDomain id 1 vlans add { my_vlan }
Creates a route domain named myRouteDomain with an ID of 1 that includes my_vlan.
list route-domain all-properties
Displays all properties of all route domains.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• bwc-policy
Congures the bandwidth control policy for the route-domain. If set, it will enforce a throughput policy
for incoming network trafc.
• connection-limit
1255
Traffic Management Shell (tmsh) Reference Guide
Congures the connection limit for the route domain. If set to a value other than zero, this species the
total number of open connections allowed on this route domain. The default value is 0, unlimited.
• description
User dened description.
• id
Species a unique numeric identier for the route-domain. This option is required during creation; it
may not be modied once set.
• ow-eviction-policy
Species a ow eviction policy for the route domain to use, to select which ows to evict when the
number of connections approaches the connection limit on the route domain. The default value is none.
• fw-enforced-policy
Species an enforced rewall policy. fw-enforced-policy rules are enforced on a route-domain.
• fw-enforced-policy-rules
Species rewall rules enforced on net route-domain via referenced fw-enforced-policy.
• fw-staged-policy
Species a staged rewall policy. fw-staged-policy rules are not enforced while all the visibility aspects
namely statistics, reporting and logging function as if the fw-staged-policy rules were enforced on a
route-domain.
• fw-staged-policy-rules
Species rewall rules staged on net route-domain via referenced fw-staged-policy.
• parent
Species the route domain the system searches when it cannot nd a route in the congured domain.
The default value is None.
If you specify a parent, during route table lookup, if the system cannot nd a route in the current route
domain, the system searches routes in the parent route domain. If no route is found in the parent route
domain, the system searches the parent route domain's parent, and so on, until the system nds either a
match or a parent with a value of None. For example, if rd_1 has a parent of rd_0 (in this example,
route domain rd_0 has a parent of None), and you include vlan_a in rd_1, when requests arrive for
vlan_a, the system looks in rd_1 for a route for the specied destination. If no route is found, the system
searches route domain 0. If it still cannot nd a route, the request for vlan_a fails. If, using the same
example, you set the parent to None, under the same conditions, the system looks in rd_1, and if it
cannot nd a matching route, the system refrains from searching any other route domain, the request
for vlan_a fails.
• port-misuse
Used to show or reset port misuse policy statistics for the route domain.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• service-policy
Congures the service policy for the route-domain. If set, it will enforce the service policy for incoming
network trafc. The service policy can be used to set specic policy based congurations like ow
timers, which applies to the ows that matches the policy specication.
• strict
Species whether the system allows a connection to span route domains. The default value is enabled.
1256
Net
Note: When you enable this option, the system may nd invalid iRules(r) that passed validation.
• routing-protocol
Species routing protocols, by name, for the system to use in the route domain. The default value is
none. Dynamic routing must be licensed to use this option.
• vlans
Species VLANs, by name, for the system to use in the route domain. The default value is none.
• ip-intelligence-categories
Used to show/ reset statistics on IP intelligence white/ black lists categories.
See Also
create, delete, edit, glob, list, modify, net service-policy, net vlan, net vlan-group, regex, show, tmsh, net
bwc-policy
router-advertisement
Congures IPv6 prexes for router advertisement on a VLAN.
Syntax
Modify the router-advertisement component within the net module using the syntax shown in the following
sections.
Create/Modify
create router-advertisement [name]
modify router-advertisement [name]
app-service [[string] | none]
current-hop-limit [integer]
description [string]
disabled | enabled
max-interval [integer]
min-interval [integer]
mtu [integer]
no-other-config | other-config
prefixes
[add | delete | modify | replace-all-with] {
[name] ... {
app-service [[string] | none]
autonomous | not-autonomous
description [string]
on-link | not-on-link
preferred-lifetime [integer]
prefix [ip address]
prefix-length [integer]
valid-lifetime [integer]
}
}
reachable-time [integer]
retransmit-timer [integer]
router-lifetime [integer]
1257
Traffic Management Shell (tmsh) Reference Guide
unmanaged | managed
vlan [name]
edit router-advertisement [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list router-advertisement
list router-advertisement [ [ [name] | [glob] | [regex] ] ... ]
show running-config router-advertisement
show running-config router-advertisement
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete router-advertisement [name]
Description
Router advertisements are part of the conguration of BIG-IP(r) network components. When creating a
router advertisement, you must specify a VLAN on the command line.
Examples
create router-advertisement my_ra vlan my_vlan
Creates the router advertisement my_ra that includes the VLAN my_vlan.
delete router-advertisement my_ra
Deletes the router advertisement named my_ra and all associated prexes.
Options
Note the following information regarding options for the router-advertisement component:
• The options disabled and enabled are mutually exclusive.
• The options no-other-cong and other-cong are mutually exclusive.
• The options unmanaged and managed are mutually exclusive.
• The options autonomous and not-autonomous are mutually exclusive.
• The options on-link and not-on-link are mutually exclusive.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• autonomous
1258
Net
Indicates that the Autonomous Flag eld in the prex information option be set to 1. The default value
is 1.
• current-hop-limit
Denes the hop limit sent in the router advertisement. The default value is 0 (zero).
• description
User dened description.
• disabled
Disables router advertisement for the VLAN. This is the default.
• enabled
Enables router advertisement for the VLAN.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• managed
Indicates that the Managed address conguration ag eld in the router advertisement be set to 1.
• max-interval
Species the maximum time allowed between sending unsolicited multicast Router Advertisements
from the interface, in seconds. The default value is 600.
• min-interval
Species, in seconds, the minimum time allowed between sending unsolicited multicast Router
Advertisements from the interface. The default value is 200.
• mtu
Sets a specic maximum transition unit (MTU) for the VLAN. The default value is 0 (zero).
• name
Species a unique name for the component. This option is required for the create, delete, and modify
commands.
• no-other-cong
Indicates that the Other Conguration ag eld in the router advertisement be set to 0 (zero). The default
value is 0 zero.
• not-autonomous
Indicates that the Autonomous ag eld in the prex information option be set to 0 (zero).
• not-on-link
Indicates that the on-link ag eld in the prex information option be set to 0 (zero).
• on-link
Indicates that the on-link ag eld in the prex information option be set to 1. The default value is 1.
• other-cong
Indicates that the Other Conguration ag eld in the router advertisement be set to 1.
• preferred-lifetime
Species, in seconds, the value for the Preferred Lifetime eld in the prex information option. The
default value is 604800.
• prex
1259
Traffic Management Shell (tmsh) Reference Guide
Species the prex for the prex information option.
• prex-length
Species the length of the prex for the prex information option.
• prexes
Species the objects that hold the prex specic information for the router advertisement.
• reachable-time
Species the value to be used for the Reachable Time eld in the Router Advertisement. The default
value is 0 (zero).
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• retransmit-timer
Species the value to be used for the Retransmit Timer eld in the Router Advertisement. The default
value is 0 (zero).
• router
Species that the router advertisement acts as a router for the VLAN.
• router-lifetime
Species the value to be used for the Router Lifetime eld in the Router Advertisement. The default
value is 1800.
• unmanaged
Species that the Managed address conguration ag eld in the router advertisement be set to 0 (zero).
The default value is 0 (zero).
• valid-lifetime
Species, in seconds, the value for the Valid Lifetime eld in the prex information option. The default
value is 2592000.
See Also
create, delete, edit, glob, list, modify, net vlan, regex, show, tmsh
rst-cause
Displays and Reset TCP/IP Reset Cause Statistics
Syntax
Display and Reset the rst-cause component within the net module using the syntax in the following section.
Modify
reset-stats rst-cause
1260
Net
Display
show rst-cause
(default | field-fmt)
Description
You can use the rst-cause component to display and reset TCP/IP reset cause statistics. This will help to
debug the reason for TCP/IP reset.
Options
For information about the options that you can use with the command show, see help show.
See Also
reset-stats, show, tmsh
self
Congures a self IP address for a VLAN.
Syntax
Modify the self component within the net module using the syntax shown in the following sections.
Create/Modify
create self [name]
modify self [name]
address [ip address/netmask]
address-source [from-management | from-user]
allow-service [all | default | none]
allow-service
[add | delete | replace-all-with] {
[protocol:port] ...
}
app-service [[string] | none]
description [string]
fw-enforced-policy [ [policy_name] | none ]
fw-staged-policy [ [policy_name] | none ]
service-policy [ [policy_name] | none ]
traffic-group [[string] | default | non-default | none]
vlan [name]
edit self [
[ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats self [ [ [name] | [glob] | [regex] ] ... ]
1261
Traffic Management Shell (tmsh) Reference Guide
fw-enforced-policy-rules { [rule name] }
fw-staged-policy-rules { [rule name] }
mv self [ [[source-name] [destination-name]] | [[name] to-folder [folder-name]]
| [[name...name] to-folder [folder-name]] ]
to-folder
Display
list self
list self
[ [ [name] | [glob] | [regex] ] ... ]
show running-config self
show running-config self
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete self [name]
Description
A self IP address is an IP address that is assigned to the system. Self IP addresses are part of the conguration
of the BIG-IP(r) network components. You must dene at least one self IP address for each VLAN.
Examples
create self mySelf address 10.10.10.24/16 vlan internal
Adds the self IP address 10.10.10.24 to the VLAN named internal. This entry is named mySelf. Alternatively,
the name can encompass the IP address and mask elds, like the following example.
create self 10.10.10.24/16 vlan internal
Adds the self IP address 10.10.10.24 to the VLAN named internal.
modify self 10.1.1.1/16 vlan external trafc-group /Common/trafc-group-1
Enables a oating IP address on the external VLAN. The trafc-group option makes this virtual address
available to whichever device is active on the given trafc-group. In other words, when the standby device
becomes the active device for that trafc-group, it uses this virtual address. Only one of the devices in the
trafc-group can use the IP address at any given time.
mv /net self /Common/10.10.10.15/24 /Common/myselfIP2
Moves/Renames the Self IP from 10.10.10.15/24 to myselfIP2.
Note: If you wish to change the name of the self IP, you may use a name that is the same as the IP Address
or a name that does not represent a different IP Address than the one congured. If using prex-length
adornment on the name, it must match the existing prex-length/netmask for the self IP.
Please refer to the mv manual page for additional examples on how to use the mv command.
1262
Net
Options
• allow-service
Species the type of protocol/service that the VLAN handles. If you use this property to allow SSH,
HTTP, and/or HTTPS service, administrators can use this self-IP address to log into the BIG-IP system;
this makes the current self-IP available as a management-IP address on the VLAN.
The options are:
• add
Adds the specied protocol/service to the VLAN.
• all
Species that the VLAN handles all protocols/services.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the object. Only the application service can modify or delete the object.
• default
Species that the system uses a pre-dened set of network protocols/services that are commonly
required for BIG-IP deployment. You can customize this set of services with the self-allow component.
This is not the default for the allow-service property; none, described below, is the actual default.
• delete
Removes the specied protocol/service from the VLAN.
• none
Species that the VLAN handles no protocols/services. This is the default setting for a self IP address.
• replace-all-with
Replaces the current protocol/service that the VLAN handles with the specied protocol/service.
• address
Species the IP address and netmask to be assigned to the system. This is an optional eld. If not
specied, the name of the entry must appear in the format [ip address/mask].
• address-source
Species the source of the self IP. This is an optional eld. If not specied, the default value of from-user
is used.
The options are:
• from-management
Assigns the self IP with the management IP rather than the provided address or entry name.
• from-user
Assigns the self IP with the provided address or entry name.
• description
User-dened description.
• oating
Read-only property based on the trafc-group. A oating self IP address is a self IP address for a VLAN
that serves as a shared address by all devices of a BIG-IP trafc-group.
1263
Traffic Management Shell (tmsh) Reference Guide
• fw-enforced-policy
Species an enforced rewall policy. fw-enforced-policy rules are enforced on a self IP address.
• fw-enforced-policy-rules
Species rewall rules enforced on net self via referenced fw-enforced-policy.
• fw-staged-policy
Species a staged rewall policy. fw-staged-policy rules are not enforced while all the visibility aspects
namely statistics, reporting and logging function as if the fw-staged-policy rules were enforced on a
self IP address.
• service-policy
Congures the service policy for the self IP address. If set, it will enforce the service policy for incoming
network trafc. The service policy can be used to set specic policy based congurations like ow
timers, which applies to the ows that matches the policy specication.
• fw-staged-policy-rules
Species rewall rules staged on net self via referenced fw-staged-policy.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• unit
Read-only property that species the unit in a redundant system. Based on trafc-group.
• trafc-group
Species the trafc group of the self IP address. The default trafc group is trafc-group-local-only,
the non-oating trafc-group.
• inherited-trafc-group
Read-only property that indicates if the trafc-group is inherited from the parent folder.
• vlan
Species the VLAN for which you are setting a self IP address. This option is required.
See Also
create, delete, edit, glob, list, modify, mv, net self-allow, net service-policy, net vlan, net vlan-group, regex,
security log prole, show, tmsh
self-allow
Congures the default "allow list" for all self IP addresses on the BIG-IP(r) system when the option
allow-service of the component self is set to default.
Syntax
Modify the self-allow component within the net module using the syntax shown in the following sections.
1264
Net
Modify
modify self-allow
defaults [all | none]
defaults
[add | delete | replace-all-with] {
[protocol:port] ...
}
edit self-allow
all-properties
Display
list self-allow
show running-config self-allow
all-properties
defaults
one-line
Delete
You cannot delete the default allow list.
Description
You can use the self-allow component to modify or display the default allow list for all self IP addresses
on the BIG-IP system when the option allow-service of the component self is set to default. The default
allow list displays which service and protocol ports allow connections from outside the system. The system
refuses connections made to a service or protocol port that is not on the list.
Examples
modify self-allow defaults all
Sets the default allow list to all. Then, if the value of the option allow-service of the net self component is
default, the system accepts trafc from all protocol port combinations.
modify self-allow default replace-all-with { tcp:55 }
Sets the default "allow list" for all self IP addresses on the system to TCP on port 55.
list self-allow defaults
Displays the default "allow list" for all self IP addresses on the system.
Options
• defaults
Species to set the default allow list to one of the following:
• all
Species that all protocols and services allow connections from outside the system. Use this option
to open the system to complete access.
1265
Traffic Management Shell (tmsh) Reference Guide
• none
Species that no protocols or services allow connections from outside the system.
• protocol:port
Species a list of protocols/services that allow connections from outside the system.
• replace-all-with
Species to replace the current protocols and services that allow connections from outside the system
with the specied protocols and services.
See Also
edit, list, modify, net vlan, net vlan-group, show, tmsh
service-policy
Congures the service policy.
Syntax
Modify the service policy component within the net module using the syntax shown in the following sections.
Create/Modify
create service-policy [name]
modify service-policy [name]
description [string]
port-misuse-policy [[port misuse policy name] | [none]]
timer-policy [[timer policy name] | [none]]
edit service-policy [[name] | all]
all-properties
non-default-properties
Display
list service-policy
show running-config service-policy
all-properties
non-default-properties
one-line
Description
service-policy conguration allows one to specify certain properties that would apply to a ow. Service
policy consists of other policy objects like timer policy and port misuse policy objects. The policy can be
applied at different contexts, like Global context, a route domain context, self-ip context, or a rewall rule.
When a service policy is congured both at a context level, as well as on a rewall rule, and a ow matches
the rule, the more specic service-policy conguration in the rule will override the service policy setting
at the context level. You can use the service-policy component to congure a shareable and reusable set of
1266
Net
network service policies which can be associated with a number of conguration objects of the following
types: net self, net route-domain, security rewall policy rules, security rewall rule-list rules, ltm
virtual. Timer policy object is not effective with ltm virtual context, and port misuse policy object is not
effective with net self context.
Examples
create net service-policy ow-policy timer-policy idle-ow-policy
list service-policy
net service-policy flow-policy {
timer-policy idle-flow-policy
}
Creates service policy and associates a timer policy conguration object. (see net timer-policy).
modify net service-policy ow-policy port-misuse-policy tcp-port-policy
list service-policy
net service-policy flow-policy {
timer-policy idle-flow-policy
port-misuse-policy tcp-port-policy
}
Associates a port misuse policy with service policy. (see security rewall port-misuse-policy).
list service-policy
Displays the current service policy conguration.
Options
• description
User dened description.
• port-misuse-policy
Specify service port misuse policy.
• timer-policy
Specify service timer policy.
See Also
create, edit, list, modify, security rewall rule-list, security rewall policy, net timer-policy, security rewall
port-misuse-policy, tmsh
stp
Congures a Spanning Tree Protocol (STP) instance.
Syntax
Congure the stp component within the net module using the syntax shown in the following sections.
1267
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create stp [all | [name] ]
modify stp [all | [name] ]
app-service [[string] | none]
description [string]
instance-id [integer]
interfaces [ add | delete | modify | replace-all-with ] {
[interface name] {
app-service [[string] | none]
external-path-cost [integer]
internal-path-cost [integer]
priority [integer]
}
}
interfaces none
priority [integer]
trunks [ add | delete | modify | replace-all-with ] {
[interface name] {
app-service [[string] | none]
external-path-cost [integer]
internal-path-cost [integer]
priority [integer]
}
}
trunks none
vlans [ add | delete | replace-all-with ] {
[vlan name ...]
}
vlans none
edit stp [ [ all | [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list stp
list stp [ [ all | [name] | [glob] | [regex] ] ... ]
show stp running-config
show stp running-config [ [ all | [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete stp [all | [name] ]
Description
You can use the stp component to congure an STP instance.
Examples
list stp
Displays all STP instances on the system.
1268
Net
show running-cong stp
Displays the running conguration information for all STP instances.
delete stp myStp2
Removes all members from the STP instance, and then deletes the instance itself.
Note that you cannot delete spanning tree instance 0 (the Common and Internal Spanning Tree). You can
only use the command delete in Multiple Spanning Tree Protocol (MSTP) mode.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• external-path-cost
Species the external path cost number for either an interface or trunk. The default value is 20000.
Each network interface has an associated path cost within each spanning tree instance. The path cost
represents the relative cost of sending network trafc through that interface. In calculating the spanning
tree, the algorithm tries to minimize the total path cost between each point of the tree and the root bridge.
By manipulating the path costs of different interfaces or trunks it is possible to steer trafc toward paths
that are faster, more reliable, and/or more economical. Path costs can take values in the range 1 -
200,000,000. The default path cost for an interface or a trunk is based on the maximum, not actual speed,
of the interface or trunk.
In MSTP mode there are two kinds of path cost: external and internal. The external path cost applies
only to spanning tree instance 0, the Common and Internal Spanning Tree (CIST). It is used to calculate
the cost to reach an adjacent spanning tree region.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• instance-id
The instance ID for this STP instance. In Multiple Spanning Tree Protocol (MSTP) mode, there will be
exactly one STP instance with ID 0. The instance ID can be a value between 1 and 255.
• internal-path-cost
Species the internal path cost number for either an interface or trunk. The default value is 20000.
Each network interface has an associated path cost within each spanning tree instance. The path cost
represents the relative cost of sending network trafc through that interface. In calculating the spanning
tree, the algorithm tries to minimize the total path cost between each point of the tree and the root bridge.
By manipulating the path costs of different interfaces or trunks it is possible to steer trafc toward paths
that are faster, more reliable, and/or more economical. Path costs can take values in the range 1 -
200,000,000. The default path cost for an interface or a trunk is based on the maximum, not actual speed,
of the interface or trunk.
In MSTP mode there are two kinds of path cost: external and internal. The internal path costs can be
independently set for each spanning tree instance (including instance 0) in MSTP mode. The internal
path costs are used to calculate the costs of reaching adjacent bridges within the same spanning tree
region.
• priority
1269
Traffic Management Shell (tmsh) Reference Guide
Species the priority number of either a bridge, interface, or trunk. The default value for a bridge is
61440. The default value for both interfaces and trunks is 128.
Each bridge, interface, and trunk in a spanning tree instance has a priority value. The relative values of
the priorities control the topology of the spanning tree chosen by the protocol. The bridge with the lowest
priority value (numerically) will become the root of the spanning tree. Priority values vary from 0 -
61440 in steps of 4096.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• vlans
Species the VLANs that you want to add to, delete from, or replace-all-with for this STP instance.
See Also
create, delete, edit, glob, list, modify, net interface, net trunk, net vlan, regex, show, tmsh
stp-globals
Congures spanning tree protocols on the system.
Syntax
Congure the stp-globals component within the net module using the syntax shown in the following
sections.
Modify
modify stp-globals
config-name [configuration name]
config-revision [integer]
description [string]
fwd-delay [integer]
hello-time [integer]
max-age [integer]
max-hops [integer]
mode [disabled | mstp | passthru | rstp | stp]
transmit-hold [integer]
edit stp-globals
all-properties
non-default-properties
Display
list stp-globals
show running-config stp-globals
all-properties
1270
Net
non-default-properties
one-line
Description
Provides the ability to congure spanning tree protocols for the trafc management system. Spanning tree
protocols are Layer 2 protocols for preventing bridging loops. The system supports multiple spanning tree
protocol (MSTP), rapid spanning tree protocol (RSTP), and spanning tree protocol (STP).
Examples
modify stp-globals mode passthru
Sets the STP mode to passthru. Passthru mode forwards spanning tree bridge protocol data units (BPDUs)
received on any interface to all other interfaces.
modify stp-globals mode disabled
Sets the STP mode to disabled. No MSTP, RSTP, or STP packets are transmitted or received on the interface
or trunk, and the spanning tree algorithm exerts no control over forwarding or learning on the port or the
trunk.
Options
• cong-name
Species the conguration name (1 - 32 characters in length) only when the spanning tree mode is
MSTP. The default conguration name is a string representation of a globally unique MAC address
belonging to the trafc management system.
The MSTP standard introduces the concept of spanning tree regions, which are groups of adjacent bridges
with identical conguration names, conguration revision levels, and assignments of VLANs to spanning
tree instances.
Note: The system default conguration name is a string representation of the globally unique MAC
address of the trafc management system in which hyphens replace the colons in the standard MAC
address. For example, the default conguration name 00-01-D7-68-11-80, represents the MAC address
00:01:D7:68:11:80.
• cong-revision
Species the revision level of the MSTP conguration only when the value of the mode option is mstp.
The specied number must be in the range 0 through 65535. The default value is 0 (zero).
• description
User dened description.
• fwd-delay
In the original STP, the forward delay parameter controlled the number of seconds for which an interface
was blocked from forwarding network trafc after a reconguration of the spanning tree topology. This
parameter has no effect when RSTP or MSTP are used, as long as all bridges in the spanning tree use
the RSTP or MSTP protocol. If any legacy STP bridges are present, then neighboring bridges must fall
back to the old protocol, whose reconguration time is affected by the value of the fwd-delay option.
The default value is 15 seconds, and the valid range is 4 to 30.
• hello-time
Species the time interval in seconds between the periodic transmissions that communicate spanning
tree information to the adjacent bridges in the network. The default value is 2 seconds, and the valid
1271
Traffic Management Shell (tmsh) Reference Guide
range is 1 - 10. The default value is optimal in virtually all cases. F5 Networks recommends that you
do not change the value of the hello-time option.
• max-age
Species the number of seconds for which spanning tree information received from other bridges is
considered valid. The default value is 20 seconds, and the valid range is 6 - 40 seconds.
• max-hops
Species the maximum number of hops an MSTP packet can travel before it is discarded. Use this option
only when the value of the mode option is mstp. The number of hops must be in the range of 1 to 255
hops. The default number of hops is 20.
• mode
Species one of three spanning tree modes:
• disabled
Species to discard spanning tree bridge protocol data units (BPDUs) received on any interface.
• mstp
Species multiple spanning tree protocol.
• passthru
Forwards spanning tree bridge protocol data units (BPDUs) received on any interface to all other
interfaces. Essentially, passthru mode makes the trafc management system transparent to spanning
tree BPDUs. This is the system default.
• rstp
Species rapid spanning tree protocol (RSTP) converges to a fully-connected state quickly.
• stp
The system supports STP mode for legacy systems. If STP is detected in the network, the trafc
management system changes to STP mode even when the mode option is set to disabled, mstp, or
rstp.
• transmit hold
Species the absolute limit on the number of spanning tree protocol packets the trafc management
system may transmit on a port in any hello-time interval. It is used to ensure that spanning tree packets
do not unduly load the network even in unstable situations. The default value is 6 packets, and the valid
range is 1 through 10 packets.
See Also
edit, interface, list, modify, show, tmsh
timer-policy
Congures the timer policy.
Syntax
Modify the timer policy component within the net module using the syntax shown in the following sections.
A timer-policy is attached to a service-policy and applied either through an ACL rule or policy applied on
1272
Net
a context. The list of supported contexts where a timer policy can be applied are: SelfIP, Route Domain and
Global. The precedence of the timer policy is as follows (highest precedence is 1):
• ACL rule congured on a Virtual Server
• ACL rule congured on a SelfIP
• Policy congured on a SelfIP
• ACL rule congured on a Route Domain
• Policy congured on a Route Domain
• ACL rule congured through Global Rules
• Policy congured on Global Service Policy
Note that within the same context, ACL rule based service policy takes rst precedence. Among the different
contexts, the order of precedence is as follows: Virtual Server, SelfIP, Route Domain, Global.
Create/Modify
create timer-policy [name]
modify timer-policy [name]
description [string]
rules [add | delete | modify | replace-all-with] {
[ [rule name] ] {
description [string]
destination-ports [add | delete | replace-all-with] {
[ [port] | [port1-port2] ]
}
destination-ports none
ip-protocol [protocol name]
timers [add | delete | modify | replace-all-with] {
[ [flow timer type] ] {
value [timeout]
}
}
timers none
}
}
rules none
edit timer-policy [[name] | all]
all-properties
non-default-properties
Display
list timer-policy
show running-config timer-policy
all-properties
non-default-properties
one-line
Description
You can use the timer-policy component to congure a shareable and reusable set of network timer policies
which can be associated with a service policy object.
1273
Traffic Management Shell (tmsh) Reference Guide
Examples
create net timer-policy add idle-ow-policy { rules add { r1 { ip-protocol tcp destination-ports add {
80 8080 } timers add { ow-idle-timeout { value 120 } } } r2 { ip-protocol udp destination-ports add {
7878 } timers add { ow-idle-timeout { value 300 } } } } }
list timer-policy
net timer-policy {
idle-flow-policy {
rules {
r1 {
ip-protocol tcp
destination-ports {
http { }
webcache { }
}
timers {
flow-idle-timeout {
value 120
}
}
}
r2 {
ip-protocol udp
destination-ports {
7878 { }
}
timers {
flow-idle-timeout {
value 300
}
}
}
}
}
}
Creates timer policy rules to set specic timeout conguration for tcp ports 80 & 8080 trafc and another
entry for protocol udp.
Here is another example to illustrate the rule match behavior for policy with rules congured with 'all-other'
for destination-ports and ip-protocol. Consider a policy as listed below.
list timer-policy
net timer-policy {
flow-idle-policy {
rules {
r1 {
ip-protocol tcp
destination-ports {
all-other { }
}
timers {
flow-idle-timeout {
value 120
}
}
}
r2 {
ip-protocol udp
destination-ports {
9090 { }
}
timers {
1274
Net
flow-idle-timeout {
value 300
}
}
}
r3 {
ip-protocol all-other
destination-ports {
all-other { }
}
timers {
flow-idle-timeout {
value 40
}
}
}
}
}
}
For an incoming ow:- a) TCP, any port: Matches rule r1 b) UDP, port 1010: Matches no rule c) ICMP:
Matches rule r3
For the above policy, since there is a specic UDP rule for port 9090, a UDP ow with port other than 9090
will not match any rule. If the rule r2 were to be deleted, all UDP trafc will match against the 'all-other'
ip-protocol rule r3.
If the user would like to apply a specic timeout for UDP trafc with destination port being anything other
than 9090, one can enter rule r4 to the above policy:
r4 {
ip-protocol udp
destination-ports {
all-other { }
}
timers {
flow-idle-timeout {
value 60
}
}
}
modify timer-policy idle-ow-policy delete r1
Removes the timer policy rule r1.
list timer-policy
Displays the current timer policy conguration list.
Options
• description
User dened description.
• rules
Adds, deletes, or replaces a named timer policy rule.
• ip-protocol
Species the IP protocol entry for which the timer policy rule is being congured. This could be a
layer-4 protocol (such as tcp, udp or sctp). Only ows matching the congured protocol will make
use of this rule. Press the <tab> key for a full list of valid protocols. Keyword 'all-other' as an
1275
Traffic Management Shell (tmsh) Reference Guide
ip-protocol entry means, if there are no specic ip-protocol rule that matches the ow, the ow then
matches the 'all-other' ip-protocol rule. Please see example above for rule match behavior.
• destination-ports
Species the destination port or port range to match against the ow. Keyword 'all-other' as a port
entry means, if there are no specic port entry rules to match against the ow, the ow then matches
the 'all-other' port rule. For eg. if a policy consists of just two rules r1 and r2, with the same protocol
'tcp' but destination port 80 for r1 and port 'all-other' for r2 congured, an incoming ow with port
80 will match r1 and incoming ow with port 9090 will match r2. Without the 'all-other' port rule
r2, incoming ow with port 9090 will not match any rule.
• timers
Species the ow timer conguration for the different timer types.
• value
Species the timeout value in seconds.
See Also
create, edit, list, modify, security rewall rule-list, security rewall policy, net service-policy, tmsh
trunk
Congures a trunk with link aggregation.
Syntax
Modify the trunk component within the net module using the syntax shown in the following sections.
Create/Modify
create trunk [name]
modify trunk [name]
app-service [[string] | none]
bandwidth
description [string]
distribution-hash [dst-mac | src-dst-ipport | src-dst-mac]
interfaces
[add | delete | replace-all-with] {
[name ... ]
}
lacp [disabled | enabled]
lacp-mode [active | passive]
lacp-timeout [short | long]
link-select-policy [auto | maximum-bandwidth]
mac-address [MAC address]
stp [disabled | enabled]
stp-reset
qinq-ethertype [string]
edit trunk [ [ [name] | [glob] | [regex] ] ... ]
1276
Net
all-properties
non-default-properties
reset-stats trunk
reset-stats trunk [ [ [name] | [glob] | [regex] ] ... ]
Display
list trunk
list trunk [ [ [name] | [glob] | [regex] ] ... ]
show running-config trunk
show running-config trunk
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
cfg-mbr-count
non-default-properties
one-line
working-mbr-count
show trunk
show trunk [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete trunk [all | [name]
Description
Link Aggregation allows multiple physical links to be treated as one logical link. It is also referred to as
trunking.
The main objective of link aggregation is to provide increased bandwidth at a lower cost, without having
to upgrade hardware. The bandwidth of the aggregated trunk is the sum of the capacity of individual member
links. Thus, it provides an option for linearly incremental bandwidth as opposed to bandwidth options
available through physical layer technology. The trafc management system supports link aggregation
control protocol (LACP).
When a trunk is created, LACP is disabled by default. In this mode, no control packets are exchanged and
the member links carry trafc as long as the physical layer is operational. In the event of physical link
failure, an LACP member is removed from the aggregation.
Note that both endpoints of the trunk should have identical LACP conguration to work properly. A mixed
conguration where one endpoint is LACP enabled and the other is LACP disabled, is not valid.
Examples
create trunk my_trunk interfaces add {1.1 1.2 1.3}
Creates a trunk named my_trunk that includes the interfaces 1.1, 1.2, and 1.3.
modify trunk my_trunk lacp enabled
1277
Traffic Management Shell (tmsh) Reference Guide
Enable LACP on the trunk named my_trunk.
modify trunk my_trunk lacp-mode active
Enable active LACP mode on the trunk my_trunk.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• bandwidth
Species the operation bandwidth in bytes per second.
• cfg-mbr-count
Displays the number of congured members that are associated with this trunk.
• description
User dened description.
• distribution-hash
Species the basis for the hash that the system uses as the frame distribution algorithm. The system uses
the resulting hash to determine which interface to use for forwarding trafc.
When frames are transmitted on a trunk, they are distributed across the working member links. The
distribution function ensures that the frames belonging to a particular conversation are neither mis-ordered
nor duplicated at the receiving end. Distribution is done by calculating a hash value based on source
and destination addresses carried in the frame and associating the hash value with a link. All frames
with a particular hash value are transmitted on the same link, thereby maintaining frame order.
The options are:
• dst-mac
Uses the destination MAC addresses to calculate the hash value.
• src-dst-mac
Uses the source, destination, and MAC addresses to calculate the hash value.
• src-dst-ipport
Uses the source and destination IP addresses and ports to calculate the hash value.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• id
Displays the ID of the trunk.
• interfaces
Species the interfaces by name separated by spaces that you want to add to the trunk, delete from the
trunk, or with which you want to replace all existing interfaces associated with the trunk.
• lacp
Species, when enabled, that the system supports the link aggregation control protocol (LACP), which
monitors the trunk by exchanging control packets over the member links to determine the health of the
1278
Net
links. If LACP detects a failure in a member link, it removes the link from the link aggregation. LACP
is disabled by default, for backward compatibility.
• lacp-mode
Species the operation mode for LACP if the lacp option is enabled for the trunk. The options are:
• active
Species that the system periodically transmits LACP packets, regardless of the control value of the
peer system.
• passive
Species that the system periodically transmits LACP packets, unless the control value of the peer
system is active.
• lacp-timeout
Species the rate at which the system sends the LACP control packets. The default value is long.
The options are:
• long
Species that the system exchanges LACP packets every 30 seconds.
• short
Species that the system exchanges LACP packets every second.
• link-select-policy
Sets the LACP policy that the trunk uses to determine which member link (interface) can handle new
trafc.
Link aggregation is allowed only when all the interfaces are operating at the same media speed and
connected to the same partner aggregation system. When there is a mismatch among congured members
due to conguration errors or topology changes (auto-negotiation), link selection policy determines
which links become working members and form the aggregation.
The options are:
• auto
Species that the system chooses the lowest numbered operational link as the reference link. All the
members that have the same media speed and are connected to the same partner as that of the reference
link are declared as working members, and they are aggregated. The other congured members do
not carry trafc.
• maximum-bandwidth
Species that the system adds to the aggregation a subset of links that gives maximum aggregate
bandwidth to the trunk.
• mac-address
Species the media access control (MAC) address, which is associated with the trunk, in not case-sensitive
hexadecimal colon notation, for example, 00:0b:09:88:00:9a.
• media
Displays the media settings for the trunk.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
1279
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• stp
Enables or disables spanning tree protocols (STP). The default value is enabled.
If you disable STP, the system does not transmit or receive STP, RSTP, or MSTP packets on the trunk,
and STP has no control over forwarding or learning on the trunk.
• stp-reset
Resets STP, which forces a migration check.
• qinq-ethertype
Species the ether-type value used for the packets handled on this trunk when it is a member in a QinQ
vlan. The ether-type can be set to any string containing a valid hexadecimal 16 bits number, or any
of the well known ether-types: 0x8100, 0x9100, 0x88a8. Default value is set to 0x8100.
• working-mbr-count
Displays the number of working members associated with this trunk.
See Also
create, delete, edit, glob, list, modify, net interface, net vlan, net vlan-group, regex, reset-stats, show, tmsh
vlan
Congures a virtual local area network (VLAN).
Syntax
Modify the vlan component within the net module using the syntax shown in the following sections.
Create/Modify
create vlan [name]
modify vlan [name]
app-service [[string] | none]
auto-lasthop [default | enabled | disabled ]
description [string]
failsafe [disabled | enabled]
failsafe-action [failover | failover-restart-tm | reboot | restart-all]
failsafe-timeout [integer]
interfaces
[add | delete | modify | replace-all-with] {
[name] ... {
[tagged | untagged]
tag-mode [ customer | service | double | none ]
}
}
interfaces none
learning [disable-drop | disable-forward | enable-forward]
mtu [integer]
sflow {
poll-interval [integer]
poll-interval-global [no | yes]
sampling-rate [integer]
1280
Net
sampling-rate-global [no | yes]
}
source-checking [disabled | enabled]
tag [integer]
customer-tag [[string] | none]
cmp-hash [default | dst-ip | src-ip]
dag-tunnel [outer | inner]
dag-round-robin [disabled | enabled]
edit vlan [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list vlan
list vlan [ [ [name] | [glob] | [regex] ] ... ]
show running-config vlan
show running-config vlan
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show vlan
show vlan [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete vlan [name]
Description
VLANs are part of the conguration of the BIG-IP(r) network components. VLANs can be based on either
ports or tags. When creating a VLAN, a tag value for the VLAN is automatically chosen unless you specify
a tag value on the command line.
VLANs can have both tagged and untagged interfaces. You can add an interface to multiple VLANs as a
tagged interface. You can add an interface to a single VLAN as an untagged interface. The tagged trafc
can be single tagged and double tagged.
Note: To reset the statistics that display when you use the command sequence show vlan, you must reset
the statistics for the trunks and interfaces associated with the VLAN.
Examples
create vlan my_vlan interfaces add { 1.2 1.3 1.4 }
Create the VLAN my_vlan that includes the interfaces 1.2, 1.3, and 1.4.
delete vlan my_vlan
Delete the VLAN named my_vlan.
1281
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User-dened description.
• failsafe
Enables a fail-safe mechanism that causes the active cluster to fail over to a redundant cluster when loss
of trafc is detected on a VLAN, and trafc is not restored during the failover timeout period for that
VLAN. The default value is disabled.
When you set the VLAN failsafe option to enabled, the default failsafe-action value is restart-all.
Therefore, when the fail-safe mechanism is triggered, all the daemons are restarted and the unit fails
over.
• failsafe-action
Species the action for the system to take when the fail-safe mechanism is triggered. The default value
is failover-restart-tm.
• failsafe-timeout
Species the number of seconds that an active unit can run without detecting network trafc on this
VLAN before it starts a failover. The default value is 90 seconds.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• if-index
Displays the index assigned to this VLAN. It is a unique identier assigned for all objects displayed in
the SNMP IF-MIB.
• interfaces
Species a list of tagged or untagged interfaces and trunks that you want to congure for the VLAN.
Use tagged interfaces or trunks when you want to assign a single interface or trunk to multiple VLANs.
A tagged interface is one that you assign to a VLAN in a way that causes the system to add a VLAN
tag into the header of any frame passing through that interface or trunk.
A trunk is a combination of two or more interfaces and cables congured as one link.
• tag-mode
Species the tag mode of the interface or trunk associated with. The default value is none.
The available values are:
• customer
Species tag-mode setting for vlan members that are facing customer network and carry single
tagged trafc.
• service
Species tag-mode setting for vlan members that are facing the service provider networks and
carry single tagged trafc.
• double
1282
Net
Species tag-mode setting for vlan members that are facing the service provider networks and
carry double tagged trafc.
• none
Species no tag-mode setting.
• learning
Species whether switch ports placed in the VLAN are congured for switch learning, forwarding
only, or dropped. The default value is enable-forward.
• mtu
Sets a specic maximum transition unit (MTU) for the VLAN. The default value is 1500. This value
does not include the layer2 header.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by
an at sign (@[regular expression]) to indicate that the identier is a regular expression. See help
regex for a description of regular expression syntax.
• sow
Species sFlow settings for the VLAN:
• poll-interval
Species the maximum interval in seconds between two pollings. The default value is 0. To
enable this setting, you must also set the poll-interval-global setting to no.
• poll-interval-global
Species whether the global VLAN poll-interval setting, which is available under sys sow
global-settings module, overrides the object-level poll-interval setting. The default value is yes.
The available values are:
• no
Species to use the object-level poll-interval setting.
• yes
Species to use the global VLAN poll-interval setting.
• sampling-rate
Species the ratio of packets observed to the samples generated. For example, a sampling rate
of 2000 species that 1 sample will be randomly generated for every 2000 packets observed.
The default value is 0. To enable this setting, you must also set the sampling-rate-global setting
to no.
• sampling-rate-global
Species whether the global VLAN sampling-rate setting, which is available under sys sow
global-settings module, overrides the object-level sampling-rate setting. The default value is
yes.
The available values are:
• no
Species to use the object-level sampling-rate setting.
1283
Traffic Management Shell (tmsh) Reference Guide
• yes
Species to use the global VLAN sampling-rate setting.
• source-checking
Species that only connections that have a return route in the routing table are accepted. The default
value is disabled.
• tag
Species a number that the system adds into the header of any frame passing through the VLAN.
The value can be 1 through 4094. The default is to not use this option, and the system assigns a tag
number.
• customer-tag
Species a number that the system adds into the header of any double tagged frame passing through
the VLAN. The value can be any of the following: 1 through 4094, or none. The default is none.
• cmp-hash
Species how the trafc on the VLAN will be disaggregated. The trafc disaggregation on the
VLAN can be based on source ip, dest ip, or L4 ports. The default cmp hash uses L4 ports.
• dag-tunnel
Species whether the ip tunnel trafc on the VLAN should be disaggregated based on the inner ip
header or outer ip header. The default value is outer.
• dag-round-robin
Species whether intended stateless trafc on the VLAN should be disaggregated in a round-robin
order instead of using static hash. The stateless trafc include nonIP L2 trafc and user-specied
UDP protocols. The sys db variable dag.roundrobin.redag allows HSBs to round robin stateless
trafc to remote HSBs/blades.
See Also
create, delete, edit, glob, list, ltm virtual, modify, net interface, net self, net vlan-group, regex, show, tmsh
vlan-allowed
Displays a list of available VLANs which can be used by the system.
Syntax
Display the vlan-allowed component within the net module using the syntax shown in the following sections.
Display
show vlan-allowed
field-fmt
Description
Displays a list of available VLANs which can be used by the system.
1284
Net
See Also
show, tmsh
vlan-group
Congures a VLAN group.
Syntax
Modify the vlan-group component within the net module using the syntax shown in the following sections.
Create/Modify
create vlan-group [name]
modify vlan-group [name]
app-service [[string] | none]
auto-lasthop [default | enabled | disabled ]
bridge-in-standby [disabled | enabled]
bridge-multicast [disabled | enabled]
bridge-traffic [disabled | enabled]
description [string]
members
[add | delete | replace-all-with] ] {
[vlan name] ...
}
members [default | none]
migration-keepalive [disabled | enabled]
mode [opaque | translucent | transparent]
proxy-excludes
[add | delete | replace-all-with] ] {
[ip address] ...
}
proxy-excludes [default | none]
tag [integer]
edit vlan-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list vlan-group
list vlan-group [ [ [name] | [glob] | [regex] ] ... ]
show running-config vlan-group
show running-config vlan-group
[ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show vlan-group
show vlan-group [ [ [name] | [glob] | [regex] ] ... ]
1285
Traffic Management Shell (tmsh) Reference Guide
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete vlan-group [name]
Description
The vlan-group component denes a VLAN group, which is a grouping of two or more VLANs belonging
to the same IP network for the purpose of allowing Layer 2 packet forwarding between those VLANs.
The VLANs between which the packets are to be passed must be on the same IP network, and they must
be grouped using the vlan-group component. For example: modify vlan-group network11 members add
{ internal external }.
Examples
create vlan-group my_vlan-group members add { vlan1 vlan2 }
Creates a VLAN group named my_vlan-group that consists of VLANs named vlan1 and vlan2.
modify vlan-group proxy-excludes add { 10.10.10.1 }
Sets the global VLAN group proxy exclusion list.
delete vlan-group my_vlan-group
Deletes the VLAN group named my_vlan-group.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• bridge-trafc
When enabled, species that the VLAN group forwards all frames, including non-IP trafc. The default
value is disabled.
• bridge-in-standby
When enabled, species that the VLAN group forwards packets, even when the system is the standby
unit in a redundant system. This option is designed for deployments in which the VLAN group exists
on only one of the units. If that does not match your conguration, using this option may cause adverse
effects. The default value is disabled.
• bridge-multicast
When enabled, allows bridging of non-Internet Protocol (IP) Address Resolution Protocol (ARP) multicast
frames across a VLAN group. An example of when you might want to use this option is when you are
implementing the Spanning Tree Protocol (STP).
• description
User-dened description.
• glob
1286
Net
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• if-index
Displays the index assigned to this VLAN group. It is a unique identier assigned for all objects displayed
in the SNMP IF-MIB.
• members
The names of the VLANs that you want to add to or delete from the VLAN group.
• migration-keepalive
Species whether the system will send keepalive frames (TCP keepalives and empty UDP packets
depending on the connection type) when a node is moved from one VLAN group member to another
VLAN group member for all existing connections that the system has to that node.
• mode
Species the level of exposure of remote MAC addresses within VLAN groups. The default value is
translucent.
The options are:
• opaque
Use this option when you have a Cisco router in the network sending CDP packets to the system.
Because opaque VLAN groups require a source and destination MAC address, and CDP packets do
not contain a source and destination MAC address, the CDP packets are not forwarded through the
VLAN group. This mode changes the MAC address to the MAC address assigned to the VLAN
group, a proxy ARP with Layer 3 forwarding.
• translucent
Uses the real MAC address of the requested host with the locally unique bit toggled. Species that
the system uses Layer 2 forwarding with locally-unique bit, toggled in ARP response across VLANs.
• transparent
Leaves the MAC address unchanged by the trafc management system. Species that the system
uses Layer 2 forwarding with the original MAC address of the remote system preserved across
VLANs.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• proxy-excludes
Species the IP addresses that you want to include in the proxy ARP exclusion list. If you use VLAN
groups, you must congure a proxy ARP forwarding exclusion list. F5 Networks recommends that you
congure this feature if you use VLAN groups with a redundant system. The reason is that both units
need to communicate directly with their gateways and the back-end nodes. Creating a proxy ARP
exclusion list prevents trafc from being proxied through the active unit due to proxy ARP. This trafc
needs to be sent directly to the destination, not proxied.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• tag
Species a number from 1 through 4094 to be the tag for the VLAN.
1287
Traffic Management Shell (tmsh) Reference Guide
A VLAN tag is an identication number the system inserts into the header of a frame that indicates the
VLAN to which the destination device belongs. Use VLAN tags when a single interface forwards trafc
for multiple VLANs.
See Also
create, delete, edit, glob, list, modify, net interface, net self, net vlan, regex, show, tmsh
wccp
Congures Web Cache Communication Protocol (WCCP) services.
Syntax
Congure the wccp component within the net module using the syntax in the following sections.
Create/Modify
create wccp [name]
modify wccp [name]
app-service [[string] | none]
cache-timeout [integer]
description [string]
services [add | delete | replace-all-with] {
[object identifier] {
app-service [[string] | none]
hash-fields [dest-ip | dest-port | src-ip | src-port | none]
password [string | none]
port-type [none | dest | source]
ports [integer]
priority [integer]
protocol [tcp | udp]
redirection-method [gre | l2]
return-method [gre | l2]
routers [add | delete | replace-all-with] {
[ip address ...]
}
traffic-assign [hash | mask]
tunnel-local-address [ip address]
tunnel-remote-addresses [add | delete | replace-all-with] {
[ip address ...]
}
weight [integer]
}
}
edit wccp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list wccp
list wccp [ [ [name] | [glob] | [regex] ] ... ]
show running-config wccp
1288
Net
show running-config wccp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete wccp [name]
Description
You can use the wccp component to create and modify WCCPv2 service groups. WCCPv2 is a
content-routing protocol developed by Cisco Systems, Inc., which provides a mechanism to redirect trafc
ows in real time. A WCCP service in this context is a set of redirection criteria and processing instructions
that the BIG-IP(r) system applies to any trafc that a router in the service group redirects to the BIG-IP
system.
Examples
list wccp service-wccp all-properties
Displays the services and their attributes in the service group named service-wccp.
modify server-wccp cache-timeout 40
Changes the cache-timeout setting to 40 for the service group named server-wccp.
modify server-wccp services modify { 77 {weight 60} }
Changes the weight setting to 60 for the service identied as 77 in the service group named server-wccp.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• cache-timeout
Species the frequency of control messages between the system and the router. The range is from 1 to
60 seconds. The default value is 10.
• description
User-dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
1289
Traffic Management Shell (tmsh) Reference Guide
• services
Species the service group identier, a number between 51 and 255 that matches a service ID congured
on the router.
Adds, deletes, or replaces a set of services. You can congure the following options for a service:
• app-service
Species the name of the application service to which the service belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the service. Only the application service can modify or delete the service.
• hash-elds
Species to the router which trafc attributes to use to determine which BIG-IP system it should
forward trafc to for load balancing: destination IP address (dest-ip), destination port (dest-port),
source IP address (src-ip), and/or source port (src-port).
• object identier
Species the service group identier, a number between 51 and 255 that matches a service ID
congured on the router.
• password
Species the password for MD5 authentication or none.
• port-type
Species whether the WCCP interception of trafc is based on the destination port (dest) or source
port (source), or is not specied (none). The default value is none.
• ports
Species one or more ports (up to 8) on which trafc is redirected.
• priority
Species the precedence of the service group relative to the other service groups. The range is from
1 to 255. The default value is 100.
• protocol
Species the protocol of the trafc to be redirected: TCP (tcp) or UDP (udp). The default value is
tcp.
• redirection
Species the method the router uses to redirect trafc: GRE gre or L2 l2. The default value is gre.
• return
Species the method used to return passthrough trafc to the router: GRE (gre) or L2 (l2). The
default value is gre.
• routers
Species the IP addresses of the WCCP-enabled routers that redirect trafc.
• trafc-assign
Species whether load balancing is achieved by a hash algorithm or a mask. If you specify hash,
specify one or more attributes using the option hash-elds.
• tunnel-local-address
Species an IP address on the BIG-IP system to which the WCCP-enabled routers should redirect
trafc. Specify a self IP address of an external VLAN on the BIG-IP system.
• tunnel-remote-addresses
1290
Net
Species the Router Identier IP address of the router that redirects trafc.
• weight
Species the relative importance of this trafc in a load-balancing environment. The range is from
1 to 100. The default value is 50.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
1291
Traffic Management Shell (tmsh) Reference Guide
Net Bwc
policy
Congures a bandwidth control policy for trafc ow.
Syntax
Congure the policy component within the net bwc module using the syntax in the following sections.
Create/Modify
create policy [name]
modify policy [name]
app-service [[string] | none]
description [string]
dynamic [ enabled ]
max-rate [integer]
max-user-rate [integer]
max-user-rate-pps [integer]
ip-tos [ integer | pass-through]
link-qos [integer | pass-through]
measure [ disabled ]
log-publisher [[string] | none]
log-period [integer]
categories [none] {
max-cat-rate [integer]
max-cat-rate-percentage [integer]
ip-tos [ integer | pass-through]
link-qos [integer | pass-through]
traffic-priority-map [string]
}
traffic-priority-map [string]
edit policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list policy
list policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config net policy
show running-config net policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete net policy [all | [name] ]
Description
You can use the net bwc policy to create a bandwidth control policy to handle trafc ow, and then associate
it with other components such as packet lter, iRule and virtual server. For details on packet lter, virtual
server, please refer to the respective documentation.
Examples
create net bwc policy
Creates a bwc policy (see below).
list net bwc policy all-properties
Displays all of the properties of all of the bwc policies.
delete net bwc policy
Deletes a policy (see below).
Example For Static Policy:
net bwc policy silver_static_policy {
max-rate 120mbps
}
Example For Dynamic Policy:
net bwc policy gold-dynamic-policy {
categories {
web {
description "This is a web test category."
max-cat-rate 600kbps
ip-tos 7
link-qos 5
}
}
description "This is a test."
dynamic enabled
max-rate 40gbps
max-user-rate 1gbps
}
Example For Dynamic Policy With Measure Enabled:
net bwc policy gold-dynamic-policy {
categories {
web {
description "This is a web test category."
max-cat-rate 600kbps
ip-tos 7
link-qos 5
}
}
1294
Net Bwc
description "This is a test."
dynamic enabled
measure enabled
log_publisher /Common/my_log_publisher
log-period 2048
max-rate 40gbps
max-user-rate 1gbps
}
Example For Bwc Using Packet Filter:
net bwc policy bwc {
max-rate 1mbps
}
Dene packet lter with bwc on it:
net packet-filter pfilter {
action continue
bwc policy bwc
logging enabled
order 2
rule ip
}
Example For Bwc Association With Virtual Server:
ltm virtual l2-for-virtual {
destination 0.0.0.0:any
l2-forward
mask any
profiles {
fastL4 { }
}
rules {
bwc_test
}
translate-address disabled
translate-port disabled
vlans {
lan
wan
}
vlans-enabled
}
ltm virtual tcp-passthrough {
destination 0.0.0.0:http
ip-protocol tcp
mask any
profiles {
tcp { }
}
rules {
bwc_test
}
translate-address disabled
vlans-disabled
}
1295
Traffic Management Shell (tmsh) Reference Guide
Example For Delete Bwc Policy:
net bwc policy silver_static_policy
Example For Bwc Policy Trafc Map:
net bwc policy bwc-policy-105 {
categories {
cat1 {
max-cat-rate 10mbps
traffic-priority-map tc1->cat1
}
cat2 {
max-cat-rate 10mbps
traffic-priority-map tc1->cat2
}
}
dynamic enabled
max-rate 100mbps
max-user-rate 10mbps
}
Notes: Only static policies are supported for association with packet lter or virtual server components.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• name
Species a unique name for the policy. This option is required for the commands create, delete, and
modify.
• description
User dened description.
• max-rate
Species the maximum bandwidth that trafc is allowed using the policy associated. The range is from
1Mbps to 320Gbps.
Valid units: bps(default), gbps, kbps, mbps.
• max-user-rate
Species the maximum bandwidth that trafc is allowed using the policy associated. The range is from
5kbps to 2Gbps.
Valid units: bps(default), gbps, kbps, mbps.
• max-user-rate-pps
Species the limiter in packets per second that trafc is allowed using the associated policy. This does
not allocate any fairshare bandwidth. When congured this acts purely as a simple packet limiter. It is
packet size and protocol agnostic. It can be congured only on a dynamic policy. When congured
along with mbps values, whichever lower limit pps vs mbps is applied. When congured, both need to
pass for packets to go through. The default value is 0 (not congured).
• trafc-priority-map
1296
Net Bwc
Species the bwc priority-group to use during congestion. This is optional and to be congured only as
needed. A bwc priority-group can be shared and amongst categories of the same bwc policy but not
across bwc policies. When congured on policy or category, the max-user-rate or max-cat-rate as
congured would be additionally applied. Thus the lower of all values for max. rates would take effect.
• max-cat-rate
Species the maximum bandwidth that trafc is allowed using this category with associated policy. The
range is from 500Kbps to max-user-rate.
Valid units: bps(default), gbps, kbps, mbps.
• max-cat-rate-percentage
Species the maximum bandwidth as percentage of <max-user-rate> that trafc is allowed using this
category with associated policy. The range is from 1 to 100.
• dynamic
Species the type for policy to be dynamic type. This option is optional for the commands create, delete,
and modify. The default valid is disabled. When dynamic is disabled, the policy type is said to be static,
where the maximum rate is enforced for combined trafc using the policy and no fairness bandwidth
guarantee for each of the trafc respectively. The default value is: disabled. Note: policy type change
modication is a disallowed conguration.
By enabling this option, the policy is dynamic type and requires you to congure max-user-rate-range.
This type of policy enforces fairness for all the trafc associated with the policy and also for each trafc
within the policy.
• ip-tos
Species an IP ToS number for the trafc using the net bwc policy. This option species the ToS level
that the trafc management system assigns to UDP packets when sending them. The default value is
pass-through, which indicates, do not modify UDP packets. The valid range for IP ToS value that can
be specied is 0 to 63.
Note: If this is specied, bandwidth policy is not enforced. The packets are just marked for a downstream
system to process.
• link-qos
Species a Link QoS (VLAN priority) for the trafc using the net bwc policy. This option species
the QoS level that the system assigns to UDP packets when sending. The default value is pass-through,
which indicates, do not modify UDP packets. The valid range for QoS value is 0 to 7.
Note: If this is specied, bandwidth policy is not enforced. The packets are just marked for a downstream
system to process.
• measure
Enables or disables bandwidth measurement on all the future instances of bwc policy. Users can override
this setting using iRules. If enabling measurement on all instances is not desired then users can keep
this setting disabled and use iRules to enable measurement on specic instances of bwc policy.
• log_publisher
Species the name of the log publisher congured in the system. Bandwidth measurement results will
be sent to this log publisher.
• log_period
Time interval in milliseconds representing the frequency of generation of bandwidth measurement logs.
• categories
1297
Traffic Management Shell (tmsh) Reference Guide
This species the categories under policy. Note: policy need to be enabled as dynamic to congure
categories. Up to a maximum of 32 categories can be congured. All the categories under the dynamic
policy share the bandwidth as specied for the category, up to a maximum of max-user-rate. Specify
the maximum bandwidth for the category of trafc using max-cat-rate or by max-cat-rate-percentage
as a percentage of the maximum user rate. Either only the range or absolute value is required.
Example to congure a dynamic bandwidth policy category using tmsh:
root@(localhost)(cfg-sync
Standalone)(Active)(/Common)(tmos.net.bwc policy.gold-dynamic-policy)#
categories add { web { max-cat-rate 600kbps } }
net bwc policy gold-dynamic-policy {
categories {
web {
max-cat-rate 600kbps
}
}
dynamic enabled
max-rate 40gbps
max-user-rate 1gbps
}
The parameters for dynamic policy and categories:
net bwc policy test-policy {
app-service none
categories {
web {
app-service none
description "This is a web test cat"
max-cat-rate 600kbps
max-cat-rate-percentage 0
ip-tos 6
}
}
description "This is a test"
dynamic enabled
ip-tos pass-through
link-qos pass-through
max-rate 40gbps
max-user-rate 1gbps
measure enabled
log-publisher /Common/my_log_publisher
log-period 2048
partition Common
}
• max-cat-rate-percentage
Species the percentage of the value of the max-cat-rate option of the category, which is associated
with the net bwc policy component to which this shaping policy is associated, that is available for this
trafc ow. The value range is from 500kbps to max-user-rate.
Few Examples Using iRule:
Please refer to iRule documentation for complete list of bwc commands. Below are few examples and
do not cover all cases.
1298
Net Bwc
Example To Associate Static Bwc Policy Using iRule:
when CLIENT_ACCEPTED {
BWC::policy attach silver_static_policy
}
Example To Associate Dynamic Bwc Policy Using iRule:
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]
BWC::policy attach gold-dynamic-policy $mycookie
}
Example For Bwc Policy To Mark Trafc Flows Using iRule:
BWC::mark <set|unset> <bwc policy name> <tos <value>> <qos <value>>
So to assign a policy, color, and mark here is an example rule
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
BWC::policy attach gold_user $mycookie
BWC::color set gold_user p2p
BWC::mark set gold_user tos 8 qos 4
}
Example For Using Bwc Policy Category To Color A Flow Using iRule:
After a ow has been assigned a policy, at some later time when the trafc is classied the user can assign
an application to this ow. This uses the bwc cong to create a bwc policy with the categories keyword:
for example, p2p category below:
tmsh create net bwc policy gold_user categories add { p2p { max-cat-rate 8mbps } } max-rate 10mbps
max-user-rate 10mbps dynamic enabled
The rule args
BWC::color <set|unset> <bwc policy name> <app name>
So to assign a policy and color here is an example rule
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
BWC::policy attach gold_user $mycookie
BWC::color set gold_user p2p
}
Example For Bwc Policy Rate Change Using iRule:
After a policy is created, irule can modify the rate for a session or category
1299
Traffic Management Shell (tmsh) Reference Guide
The rule args
BWC::rate <bwc policy session> <value>
BWC::rate <bwc policy session> <app_name> <value>
So to modify the rate
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
BWC::policy attach gold_user $mycookie
BWC::color set gold_user p2p
BWC::mark set gold_user tos 8 qos 4
BWC::rate $mycookie p2p 1000000bps
}
Example For Bwc Policy To Measure The Bandwidth Using iRule:
BWC::measure <<<start|stop> | <identier id_str> | <get rate|bytes>> <ow|session> [session_str]>
To start the bandwidth measurement for BWC policy
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
BWC::policy attach gold_user $mycookie
BWC::measure start session
}
The above iRule will start the measurement of bandwidth on the gold_user policy instance. The results will
be published to the destination specied in the log_publisher setting for the gold_user bwc policy. The
measurement results will be logged every 'log_period' amount of time, which is also specied in the policy
settings for gold_user.
Note: Attaching a BWC policy is a pre-requisite for all 'BWC::measure.' iRules. Failing to do so will result
in the iRule execution failure which in turn will abort the connection.
To start the bandwidth measurement for a ow inside a BWC policy and tag the results.
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
BWC::policy attach gold_user $mycookie
BWC::measure identifier MYFLOW flow
BWC::measure start flow
}
The above iRule will start the measurement of bandwidth on the current ow or the ow over which the
current iRule is running. The results will be published to the destination specied in the log_publisher
setting for the gold_user bwc policy. The measurement results will be logged every 'log_period' amount of
time, which is also specied in the policy settings for gold_user. Every log message containing the bandwidth
result will carry the tag 'MYFLOW'. This helps identify different types of bandwidth results when analyzing
the bandwidth measurement results.
1300
Net Bwc
To start the bandwidth measurement for a BWC session and get the periodic results.
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
set measureID "MYSESSION"
BWC::policy attach gold_user $mycookie
BWC::measure identifier $measureID session
BWC::measure start session
}
when SERVER_CONNECTED {
TCP::collect
set count 0
}
when SERVER_DATA {
if {$count >= 1000 } {
set rate [BWC::measure get rate session]
set bytes [BWC::measure get bytes session]
log local0. "Rate $rate/sec : Bytes $bytes : for address $mycookie"
set count 0
}
TCP::release
TCP::collect
incr count
}
The above example creates an instance of BWC policy gold_user and enables measurement on it upon the
iRule event CLIENT_ACCEPTED. It also starts collecting so that it keeps getting notifed upon the data
arrival. For every 1000 packets a measurement of bandwidth is logged. This is an example that illustrates
how to measure bandwidth periodically using iRules. Note that the bandwidth measurement results are still
sent to congured log_publisher at every log_period interval.
An example log message that is sent to a log publisher.
Apr 2 16:29:04 MYSESSION BWC Measurement: Moving average - 539277 bytes/sec. Total bytes -
7305051
Example For Bwc Policy Using Pps:
BWC::pps <value >
when CLIENT_ACCEPTED {
set mycookie [IP::remote_addr]:[TCP::remote_port]
BWC::policy attach gold_user $mycookie
BWC::pps 100
}
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
1301
Traffic Management Shell (tmsh) Reference Guide
priority-group
Congures a bandwidth control policy for trafc ow.
Syntax
Congure the priority-group component within the net bwc module using the syntax in the following
sections.
Create/Modify
create priority-group [name]
modify priority-group [name]
app-service [[string] | none]
description [string]
priority-classes [none] {
description [string]
weight-percentage [integer]
}
edit priority-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list priority-group
list priority-group [ [ [name] | [glob] | [regex] ] ... ]
show running-config net bwc priority-group
show running-config net bwc priority-group [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
one-line
Delete
delete net bwc priority-group [all | [name] ]
Description
You can use the net bwc priority-group to create a bandwidth trafc group policy to handle trafc ow,
and then associate it with bwc component such as bwc policy/category.
Examples
create net bwc priority-group
Creates a bwc policy (see below).
list net bwc priority-group all-properties
1302
Net Bwc
Displays all of the properties of all of the bwc policies.
delete net bwc priority-group
Deletes a bwc trafc group (see below).
Example For Dynamic Policy:
net bwc priority-group tc-GOLD {
priority-classes {
tc-BLUE {
weight-percentage 30
}
tc-RED {
weight-percentage 20
}
}
}
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• name
Species a unique name for the policy. This option is required for the commands create, delete, and
modify.
• description
User dened description.
• weight-percentage
Species the maximum bandwidth that trafc is allowed during congestion using the trafc class
associated. The range is from 1Mbps to 320Gbps.
Valid units: bps(default), gbps, kbps, mbps.
iRule
Please refer to iRule documentation for iRule to use bandwidth control policy.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
traffic-group
Congures a bandwidth control policy for trafc ow.
Syntax
Congure the trafc-group component within the net bwc module using the syntax in the following
sections.
1303
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create traffic-group [name]
modify traffic-group [name]
app-service [[string] | none]
description [string]
dynamic [ enabled ]
priority-classes [none] {
weight-percentage [integer]
}
edit traffic-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list traffic-group
list traffic-group [ [ [name] | [glob] | [regex] ] ... ]
show running-config net bwc traffic-group
show running-config net bwc traffic-group [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
one-line
Delete
delete net bwc traffic-group [all | [name] ]
Description
You can use the net bwc trafc-group to create a bandwidth trafc group policy to handle trafc ow,
and then associate it with bwc component such as bwc policy/category.
Examples
create net bwc trafc-group
Creates a bwc policy (see below).
list net bwc trafc-group all-properties
Displays all of the properties of all of the bwc policies.
delete net bwc trafc-group
Deletes a bwc trafc group (see below).
Example For Dynamic Policy:
net bwc traffic-group tc-GOLD {
priority-classes {
tc-BLUE {
weight-percentage 30
1304
Net Bwc
}
tc-RED {
weight-percentage 20
}
}
}
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• name
Species a unique name for the policy. This option is required for the commands create, delete, and
modify.
• description
User dened description.
• weight-percentage
Species the maximum bandwidth that trafc is allowed during congestion using the trafc class
associated. The range is from 1Mbps to 320Gbps.
Valid units: bps(default), gbps, kbps, mbps.
• dynamic
Species the type for trafc group to be dynamic type. This option is optional for the commands create,
delete, and modify. The default valid is disabled. When dynamic is disabled, the trafc group type is
said to be static. The type of trafc group should match with be bwc policy that would be mapped. Note:
policy type change modication is a disallowed conguration.
iRule
Please refer to iRule documentation for iRule to use bandwidth control policy.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
1305
Traffic Management Shell (tmsh) Reference Guide
Net Cos
global-settings
Congures the global conguration for class of service (CoS).
Syntax
Modify the global-settings component within the net cos module using the syntax shown in the following
sections.
Create/Modify
modify global-settings
feature-enabled
feature-disabled
precedence [dscp-only, 8021p-only]
default-map-dscp
[add | delete | modify | replace-all-with] {
[map-dscp-name] ...
}
default-map-8021p
[add | delete | modify | replace-all-with] {
[map-8021p-name] ...
}
default-traffic-priority [ traffic-priority-name ]
Display
list global-settings
all-properties
non-default-properties
one-line
show global-settings
Description
You can use the global-settings component to congure and view information about the global settings of
all CoS behavior.
show keyword displays an analysis of the relative weights of the associated trafc-priority objects.
Examples
modify global-settings default-trafc-priority NORMAL_PRIORITY
Replace the default trafc-priority with trafc-priority NORMAL_PRIORITY.
modify global-settings default-map-8021p add { VOIP }
Add the VOIP 802.1p mapping. The VOIP object species the 802.1p eld value and associated trafc
priority.
Options
• feature-enabled
Enable 8 hardware egress CoS queue feature.
• feature-disabled
Disable 8 hardware egress CoS queue feature.
• precedence
Species the precedence between handling of DSCP and 802.1p. Currently, provided options are
dscp-only and 8021p-only.
• default-map-dscp
Enables adding and removal of mappings between DSCP eld values and trafc priorities. See net cos
trafc-priority and net cos map-dscp.
• default-map-8021p
Enables adding and removal of mappings between 802.1p eld values and trafc priorities.
• default-trafc-priority
Species the default trafc-priority which is applied to all trafc that does not match a specied
DSCP/802.1p eld value. This allows the user to specify only the mappings which do not match the
default.
See Also
net cos trafc-priority, net cos map-dscp
map-8021p
Congures vlan 8021.p tag to trafc priority mapping.
Syntax
Modify the map-8021p component within the net cos module using the syntax shown in the following
sections.
Create/Modify
create map-8021p [name]
modify map-8021p [name]
value [0..7]
traffic-priority [name]
edit map-8021p [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1308
Net Cos
Display
list map-8021p
list map-8021p [ [ [name] | [glob] | [regex] ] ... ]
show map-8021p
show map-8021p [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete map-8021p [name]
Description
The map-8021p object allows users to associate 802.1p eld values to relative trafc priority. These objects
are associated with active system conguration via net cos global-settings.
Examples
create map-8021p VOIP value 4 trafc-priority HIGH_PRIORITY
Create the map-8021p named VOIP that associates 802.1p value 4 trafc with trafc-priority named
HIGH_PRIORITY.
delete map-8021p VOIP
Delete the map-8021p named VOIP.
Options
• value
Species the 802.1p eld value.
• trafc-priority
Species the trafc-priority object associated with trafc matching value.
See Also
create, delete, edit, glob, list, net cos global-settings, modify, net cos trafc-priority, net cos map-dscp,
regex, show, tmsh
map-dscp
Congures IP DSCP eld to trafc priority mapping.
1309
Traffic Management Shell (tmsh) Reference Guide
Syntax
Modify the map-dscp component within the net cos module using the syntax shown in the following
sections.
Create/Modify
create map-dscp [name]
modify map-dscp [name]
value [0..7]
traffic-priority [name]
edit map-dscp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list map-dscp
list map-dscp [ [ [name] | [glob] | [regex] ] ... ]
show map-dscp
show map-dscp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete map-dscp [name]
Description
The map-dscp object allows users to associate DSCP eld values to relative trafc priority. These objects
are associated with active system conguration via net cos global-settings.
Examples
create map-dscp VOIP value 4 trafc-priority HIGH_PRIORITY
Create the map-dscp named VOIP that associates DSCP value 4 trafc with trafc-priority named
HIGH_PRIORITY.
delete map-dscp VOIP
Delete the map-dscp named VOIP.
Options
• value
Species the DSCP eld value.
• trafc-priority
1310
Net Cos
Species the trafc-priority object associated with trafc matching value.
See Also
create, delete, edit, glob, list, net cos global-settings, modify, net cos trafc-priority, net cos map-dscp,
regex, show, tmsh
traffic-priority
Congures a trafc priority object.
Syntax
Modify the trafc-priority component within the net cos module using the syntax shown in the following
sections.
Create/Modify
create traffic-priority [name]
modify traffic-priority [name]
weight [1..127]
buffer [1..127]
edit traffic-priority [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list traffic-priority
list traffic-priority [ [ [name] | [glob] | [regex] ] ... ]
show traffic-priority
show traffic-priority [ [ [name] | [glob] | [regex] ] ... ]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Delete
delete traffic-priority [name]
Description
The trafc-priority object allows users to assign relative scheduling and buffer weightings. These objects
are associated to specic trafc with net cos map-dscp and net cos map-8021p. There can be at most 8
1311
Traffic Management Shell (tmsh) Reference Guide
trafc-priorities dened in the system. The DEFAULT_PRIORITY priority may be deleted or modifed
as desired.
Examples
create trafc-priority HIGH_PRIORITY weight 127
Create the trafc-priority HIGH_PRIORITY that has a weight of 127.
delete trafc-priority HIGH_PRIORITY
Delete the trafc-priority named HIGH_PRIORITY.
Options
• weight
Species the egress buffer weight. This value is used relative to other egress trafc-priority objects
typical of weighted round-robin behavior.
• buffer
Species the relative buffer weight where available egress buffer space is distributed with consistent
relative weight.
See Also
create, delete, edit, glob, list, net cos global-settings, modify, net cos map-dscp, net cos map-8021p, regex,
show, tmsh
1312
Net Cos
Net DNS Resolver
resolver
Congures a DNS resolver on the BIG-IP(r) system.
Syntax
Congure the DNS resolver component using the syntax in the following sections.
Create/Modify
create [name]
modify [name]
answer-default-zones [yes | no]
cache-size [integer]
forward-zones [add | delete | modify | replace-all-with] {
[ [zone-name] ] {
nameservers [add | delete | replace-all-with] {
[ [IPv4address:port] | [IPv6address.port] ]
}
nameservers none
}
forward-zones none
randomize-query-name-case [yes | no]
route-domain [name]
use-ipv4 [yes | no]
use-ipv6 [yes | no]
use-tcp [yes | no]
use-udp [yes | no]
Display
list
list [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
show [name]
reset-stats
Delete
delete resolver [name]
Description
You can use the dns-resolver component to congure and view information about a DNS Resolver object.
A DNS resolver performs recursive resolution to ll its cache.
Important: When sizing caches, consider the total amount of memory available and how you wish to allocate
memory for DNS caching. Note that cache sizing values are per-TMM process; therefore, a platform with
eight TMMs consumes the amount of memory set for the Resolver object times eight.
Important: DNS Resolver objects use the DNS root nameservers published by InterNIC.
Examples
list
Displays the properties of the DNS Resolver myRes.
Options
• answer-default-zones
Species whether the resolver answers queries for default zones: localhost, reverse 127.0.0.1 and ::1,
and AS112 zones. The default value is no.
• cache-size
Species the maximum cache size in bytes of the DNS Resolver object. The default value is 5767168.
The BIG-IP system caches the supporting records in a DNS response in the resource record cache. After
the maximum size of the cache is reached, when new or refreshed content is added to the cache, the
expired and older content is removed from the cache. A higher maximum size allows more DNS responses
to be cached and increases the cache hit percentage. A lower maximum size forces earlier eviction of
cached content, but can lower the cache hit percentage.
• forward-zones
Adds, deletes, modies, or replaces a set of forward zones on a DNS Resolver, by specifying zone
name(s). A given zone name should only use the symbols allowed for a fully qualied domain name
(FQDN), namely ASCII letters a though z, digits 0 through 9, hyphen -, and period .. For example
site.example.com would be a valid zone name.
A DNS Resolver congured with a forward zone will forward any queries that resulted in a cache-miss
(the answer was not available in the cache) and which also match a congured zone name, to the
nameserver specied on the zone. If no nameservers are specied on the zone, an automatic SERVFAIL
is returned. When a forward zone's nameserver returns a valid response to the DNS Cache, that response
is cached and then returned to the requestor.
• nameservers
Adds, deletes, modies, or replaces a set of nameservers in a forward zone on a DNS Resolver. A
nameserver is represented by an IPaddress and port in the format [IPv4:port] or [IPv6.port], for
example 10.10.10.10:53 or 2001::1:ff.53, respectively.
If more than one nameserver is listed for a given forward zone, a matching query will be sent to the
nameserver that is currently deemed the most responsive (based on RTTs). If no response is received
within a certain window of time, the DNS Resolver will resend the query to another nameserver with
an increased wait window, until a response is received.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
1314
Net DNS Resolver
• randomize-query-name-case
Species whether the resolver randomizes the case of query names. The default value is yes.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• route-domain
Species the route domain the resolver uses for outbound trafc. The default value is the default route
domain.
• use-ipv4
Species whether the resolver sends DNS queries to IPv4 addresses. The default value is yes.
• use-ipv6
Species whether the resolver sends DNS queries to IPv6 addresses. The default value is yes.
• use-tcp
Species whether the resolver can send queries over the TCP protocol. The default value is yes.
• use-udp
Species whether the resolver can send queries over the UDP protocol. The default value is yes.
See Also
create, delete, edit, glob, list, show, modify, regex, tmsh
1315
Traffic Management Shell (tmsh) Reference Guide
Net FDB
tunnel
Manages tunnel entries in the Layer 2 Forwarding table.
Syntax
Congure the tunnel component within the net fdb module using the syntax in the following sections.
Display
show tunnel
show tunnel [ [ [tunnel name] | [glob] | [regex] ] ... ]
dynamic
field-fmt
Description
You can use the tunnel component to manage tunnel entries in the Layer 2 Forwarding tables.
Examples
show tunnel
Displays all dynamic tunnel entries in the Layer 2 Forwarding table.
Options
• all-records
Shows, from the specied Tunnel, all dynamic records.
• dynamic
Displays all dynamic tunnel entries in the Layer 2 Forwarding table.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
glob, net tunnels, regex, show, tmsh
vlan
Manages VLAN entries in the Layer 2 Forwarding table.
Syntax
Congure the vlan component within the net fdb module using the syntax in the following sections.
Modify
modify vlan [vlan name]
app-service [[string] | none]
records
[add | delete | modify | replace-all-with] {
[MAC address] ... {
app-service [[string] | none]
description [string]
trunk [trunk name]
interface [interface name]
}
}
records none
edit vlan [ [ all | [vlan name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list vlan
list vlan [ [ [vlan name] | [glob] | [regex] ] ... ]
show running-config vlan
show running-config vlan [ [vlan name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
records
show vlan
show vlan [ [ [vlan name] | [glob] | [regex] ] ... ]
dynamic
field-fmt
static
Delete
delete vlan
delete vlan [all | [vlan name] ]
all-records
1318
Net FDB
dynamic
static
Description
You can use the vlan component to manage entries in VLAN Layer 2 Forwarding tables.
Examples
modify vlan internal records add { 00:0b:09:88:00:9a { interface 1.2 } }
Creates a mapping of the MAC address 00:0b:09:88:00:9a to interface 1.2 on VLAN internal.
modify vlan internal records modify { 00:0b:09:88:00:9a { interface 1.1 } }
Modies the mapping of the MAC address 00:0b:09:88:00:9a to interface 1.1 on VLAN internal.
show vlan
Displays all dynamic and static entries in the Layer 2 Forwarding table.
list vlan all-properties
Displays all properties for all static entries in the Layer 2 Forwarding table.
list vlan non-default-properties
Displays all non-default properties for all static entries in the Layer 2 Forwarding table.
delete vlan all
Deletes all entries in all VLAN Layer 2 Forwarding tables.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• all-records
Deletes, from the specied VLAN, all dynamic and static records.
• description
User dened description.
• dynamic
Displays or deletes all dynamic entries in the Layer 2 Forwarding table.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• interface
Species an interface to which you want to map a MAC address. You must specify either an interface
or a trunk when you create an entry in the Layer 2 Forwarding table.
• MAC address
Species a 6-byte ethernet address in not case-sensitive hexadecimal colon notation, for example,
00:0b:09:88:00:9a. You must specify a MAC address when you create an entry in the Layer 2 Forwarding
table.
1319
Traffic Management Shell (tmsh) Reference Guide
• partition
Displays the administrative partition in which the VLAN resides.
• records
Species MAC addresses for the VLAN Layer 2 Forwarding table. Species MAC addresses that you
want to add to, delete from, modify, or replace in the VLAN Layer 2 Forwarding table.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• static
Displays or deletes all static entries in the Layer 2 Forwarding table.
• trunk
Species a trunk to which you want to map a MAC address. You must specify either an interface or a
trunk when you create an entry in the Layer 2 Forwarding table.
See Also
delete, edit, glob, list, modify, net vlan, regex, show, tmsh
1320
Net FDB
Net IPsec
ike-daemon
Congures the Internet Key Exchange (ISAKMP) daemon.
Syntax
Congure the ike-daemon component within the net ipsec module using the syntax in the following sections.
Modify
modify ike-daemon
description [string]
isakmp-natt-port [port number]
isakmp-port [port number]
log-level [error|warning|notify|info|debug|debug2]
natt-keep-alive [seconds]
log-publisher [string]
Display
list
list ike-daemon
show running-config ike-daemon
all-properties
non-default-properties
one-line
Description
You can use the ike-daemon component to congure global settings for the IKE agent.
Examples
modify ike-daemon isakmp-port 500
Sets the isakmp port to 500.
Options
• description
User dened description.
• isakmp-natt-port
Species the port that the IKE daemon uses to accept ISAKMP messages when NAT-Traversal is
detected. This is also the port number used to accept UDP-encapsulated ESP trafc for NAT-Traversal.
Only 4500 is currently supported.
• isakmp-port
Species the port that the IKE daemon uses to accept ISAKMP messages. Only 500 is currently supported.
• log-level
Species the logging level of the IKE daemon. The log le is located at /var/log/racoon.log.
• natt-keep-alive
Species the interval between sending NAT-Traversal keep-alive packets. The default value is 20
seconds. Set to 0 to disable keep-alive packets.
• log-publisher
Species the logging publisher. A new log-publisher object can be created via TMSH command tmsh
create sys log-cong publisher.
See Also
list, net ipsec ike-peer, tmsh
ike-peer
Congures one or more IKE peers for IPsec.
Syntax
Congure the ike-peer component within the net ipsec module using the syntax in the following sections.
Create/Modify
create ike-peer [string]
modify ike-peer [string]
app-service [[string] | none]
ca-cert-file [certificate file]
crl-file [CRL file]
description [string]
dpd-delay [integer]
generate-policy [off | on | unique ]
lifetime [minutes]
mode [main | aggressive]
my-cert-file [certificate file]
my-cert-key-file [certificate key file]
my-id-type [address | asn1dn | fqdn | keyid-tag | user-fqdn]
my-id-value [string]
nat-traversal [on | off | force]
passive [true | false]
peers-cert-file [certificate file]
peers-cert-type [certfile | none]
peers-id-type [address | asn1dn | fqdn | keyid-tag | user-fqdn]
peers-id-value [string]
phase1-auth-method [pre-shared-key | rsa-signature | dss | ecdsa-256 |
ecdsa-384 | ecdsa-521]
phase1-encrypt-algorithm [3des | aes | blowfish | camellia | cast128 | des]
phase1-hash-algorithm [md5 | sha1 | sha256 | sha384 | sha512]
phase1-perfect-forward-secrecy [modp1024 | modp1536 | modp2048 | modp3072
| modp4096 | modp6144 | modp768 | modp8192]
preshared-key [string]
preshared-key-encrypted [string]
prf [sha1 | sha256 | sha384 | sha512]
proxy-support [disabled | enabled]
1322
Net IPsec
remote-address [ip address]
replay-window-size [integer]
state [disabled | enabled]
traffic-selector [name]
verify-cert [true | false]
version [add | delete | none | replace-all-with] {
[v1|v2]
}
Display
list ike-peer
show running-config ike-peer
all-properties
non-default-properties
one-line
show ike-peer
show ike-peer [name]
Delete
delete ike-peer [string]
Description
You can use the ike-peer component to modify the IKE phase 1 parameters for each remote IKE peer. The
setting in the default anonymous ike-peer will apply to any peer that does not match a more specic
ike-peer directive.
Examples
create ike-peer SanJose { remote-address 1.2.3.4 preshared-key abc phase1-auth-method pre-shared-key
}
Creates an ike-peer named SanJose that has the IP address of 1.2.3.4 using preshared key as the
authentication method.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• ca-cert-le
Species the le name, which contains the certicates of the trusted root and intermediate certicate
authorities.
• crl-le
Species the le name of the Certicate Revocation List.
• description
User-dened description.
• dpd-delay
1323
Traffic Management Shell (tmsh) Reference Guide
This option activates the Dead Peer Detection (DPD) and sets the time (in seconds) allowed between
two proofs of liveness requests. The default value is 30. When the value is set to 0, it means to disable
DPD monitoring, but still negotiate DPD support.
• generate_policy
This directive is for the responder. To use it, set passive to true so the IKE peer is only a responder. If
the responder does not have any policy in the Security Policy Database (SPD) during phase 2 negotiation,
and the directive is set to on, then the racoon daemon chooses the rst proposal in the Security
Association (SA) payload from the initiator, and generates policy entries from the proposal. It is useful
to negotiate with clients whose IP address is allocated dynamically. If an inappropriate policy is installed
into the responder�s SPD by the initiator, other communications might fail due to a policy mismatch
between the initiator and the responder. The initiator ignores this directive. The default value is off.
• lifetime
Species the lifetime of an IKE SA that will be proposed in the phase 1 negotiations.
• mode
Species the exchange mode for phase 1 when racoon is the initiator, or the acceptable exchange mode
when racoon is the responder.
• my-cert-le
Species the name of my certicate le. The certicate type must match the phase1-auth-method
value.
• my-cert-key-le
Species the name of my certicate key le. The certicate key type must match the
phase1-auth-method value.
• my-id-type
Species the identier type sent to the remote host to use in the phase 1 negotiation.
• my-id-value
Species the identier value sent to the remote host to use in the phase 1 negotiation.
• nat-traversal
Enables use of the NAT-Traversal IPsec extension (NAT-T). NAT-T allows one or both peers to reside
behind a NAT gateway (that is, performing address- or port-translation). The presence of NAT gateways
along the path is discovered during the phase 1 handshake, and if found, NAT-T is negotiated. When
NAT-T is in charge, all ESP and AH packets of a given connection are encapsulated into UDP datagrams
(port 4500, by default). The options are:
• force
NAT-T is used regardless of whether NAT is detected between the peers.
• off
NAT-T is not proposed/accepted. This is the default.
• on
NAT-T is used when a NAT gateway is detected between the peers.
• passive
Specify true if you do not want to be the initiator of the IKE negotiation with this ike-peer.
• peers-cert-le
Species the peer's certicate for authentication. This is no longer needed in IKEv2.
• peers-cert-type
1324
Net IPsec
Species that the only peers-cert-type supported is certle. This is no longer needed in IKEv2.
• peers-id-type
Species that address, fqdn, asn1dn, user-fqdn, or keyid-tag can be used as peers-id-type.
• peers-id-value
Species the peer's identier to be received. If it is not dened, then the IKE agent will not verify the
peer's identier in the ID payload transmitted from the peer. The usage of peers-id-type and
peers-id-value is the same as my-id-type and my-id-value except that the individual component values
of an asn1dn identier may specied as * to match any value (for example, "C=XX, O=MyOrg, OU=*,
CN=Mine").
• phase1-auth-method
Denes the authentication method used for the phase 1 negotiation. Possible values are: pre-shared-key
if using preshared-key, and dss, ecdsa-256, ecdsa-384, ecdsa-521 or rsa-signature if using X.509
certicate-based authentication."
• phase1-encrypt-algorithm
Species the encryption algorithm used for the ISAKMP phase 1 negotiation. This directive must be
dened. Possible value is one of following: des, 3des, blowsh, cast128, aes, or camellia for Oakley.
• phase1-hash-algorithm
Denes the hash algorithm used for the ISAKMP phase 1 negotiation. This directive must be dened.
The algorithm should be one of following: md5, sha1, sha256, sha384, or sha512 for Oakley.
• phase1-perfect-forward-secrecy
Denes the group used for the Dife-Hellman exponentiations to provide perfect forward secrecy. This
directive must be dened. The group is one of following: modp768, modp1024, modp1536, modp2048,
modp3072, modp4096, modp6144, or modp8192.
• preshared-key
Species the preshared key for ISAKMP SAs. This eld is valid only when phase1-auth-method is
pre-shared-key.
• preshared-key-encrypted
Species the preshared key for ISAKMP SAs. This eld is valid only when phase1-auth-method is
pre-shared-key. Stores preshared-key in encrypted form.
• prf
Species the pseudo-random function to derive keying material for all cryptographic operations.
• proxy-support
If this value is enabled, both values of ID payloads in the phase 2 exchange are used as the addresses
of end-point of IPsec-SAs. This attribute must be enabled, which is the default value. This eld is used
only for IKEv1.
• remote-address
Species the IP address of the IKE remote node. The format required for specifying a route domain ID
in an IP address is A.B.C.D%ID. For example, A.B.C.D%2, where the IP address A.B.C.D pertains to
route domain 2. The route domain id should be same as the route domain id specied in the
source/destination address of the trafc selector associated with this remote node.
• replay-window-size
Species the replay window size of the IPsec SAs negotiated with the IKE remote node. This window
limits the number of out-of-order IPsec packets that can be received relative to the packet with the highest
sequence number that has been authenticated so far. Packets with older sequence numbers that are outside
this range are rejected. The default value is 64. The valid range is from 4 to 255.
1325
Traffic Management Shell (tmsh) Reference Guide
• state
Enables or disables this IKE remote node.
• trafc-selector
Species the names of the trafc-selector objects associated with this ike-peer.
• verify-cert If set to true, the identier sent by the remote host (as specied in its my_identier statement)
is compared with the credentials in the certicate as follows: Type asn1dn: the entire certicate subject
name is compared with the identier, e.g. \"C=XX, O=YY, ...\". Type address, fqdn, or user_fqdn:
The certicate's subjectAltName is compared with the identier. If the two do not match, the negotiation
will fail. The default value is false, which is not to verify the identier using the peer's certicate.
• version
Species which version of IKE to be used. The default value is v1. The following versions are available:
• v1 Species version IKEv1 will be used.
• v2
Species version IKEv2 will be used.
See Also
create, modify, delete, list, tmsh
ike-sa
Displays IKE security associations on the BIG-IP(r) system.
Syntax
Use the ike-sa component within the ipsec module to manage IKE security associations using the following
syntax.
Display
show ike-sa
option:
all-properties
peer-ip [IP address]
peer-name [name]
route-domain [integer]
traffic-selector [name]
Description
You can use the ike-sa component to display information about IKE security associations in the system.
Examples
show ike-sa all-properties
Display detail information about IKE security associations.
1326
Net IPsec
Options
• peer-ip
Species the peer IP address of the security associations that you want to display.
• peer-name
Species the peer name of the security associations that you want to display.
• route-domain
Species route domain used for trafc that you want to display. The default value is the default route
domain.
• trafc-selector
Species the name of the trafc-selector associated with the security associations that you want to
display.
See Also
show
ipsec-policy
Congures the IPsec security policy.
Syntax
Congure the ipsec-policy component within the net ipsec module using the syntax in the following sections.
Create/Modify
create ipsec-policy [name]
modify ipsec-policy [name]
app-service [[string] | none]
description [string]
ike-phase2-auth-algorithm [aes-gcm128 | aes-gcm192 | aes-gcm256 | aes-gmac128
| aes-gmac192 | aes-gmac256 | sha1 | sha256 | sha384 | sha512]
ike-phase2-encrypt-algorithm [3des | aes128 | aes192 | aes256 | aes-gcm128
| aes-gcm192 | aes-gcm256 | aes-gmac128 | aes-gmac192 | aes-gmac256 | null]
ike-phase2-lifetime [integer]
ike-phase2-lifetime-kilobytes [integer]
ike-phase2-perfect-forward-secrecy [modp1024 | modp1536 | modp2048 | modp3072
| modp4096 | modp6144 | modp768 | modp8192]
ipcomp [deflate| none | null]
mode [transport | tunnel | isession | interface]
protocol [esp]
tunnel-local-address [ip address]
tunnel-remote-address [ip address]
Display
list ipsec-policy
list ipsec-policy
list ipsec-policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config ipsec-policy
show running-config ipsec-policy [ [ [name] | [glob] | [regex] ] ... ]
1327
Traffic Management Shell (tmsh) Reference Guide
all-properties
non-default-properties
partition
show ipsec-policy
show ipsec-policy [name]
Display
show ipsec-policy [name]
Description
An ipsec-policy indicates the ipsec rule and action to be applied to the packets matched by the trafc-selector
associated with this ipsec-policy.
Examples
create ipsec ipsec-policy tunnel_policy_sjc_sea { description "ipsec policy for the sjc-sea ipsec tunnel"
mode tunnel tunnel-local-address 1.1.1.1 tunnel-remote-address 2.2.2.2 }
Creates the tunnel mode ipsec-policy tunnel_policy_sjc_sea.
delete ipsec ipsec-policy tunnel_policy_sjc_sea
Deletes the ipsec-policy tunnel_policy_sjc_sea.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• ike-phase2-auth-algorithm
Species a payload authentication algorithm for ESP. This attribute is only valid when IKE is used to
negotiate Security Associations. The possible options are: aes-gcm128, aes-gcm192, aes-gcm256,
aes-gmac128, aes-gmac192, aes-gmac256, sha256, sha384, sha512 and sha1. The default value is
aes-gcm128.
Note: Because aes-gcm and aes-gmac are authenticated encryption algorithms, when
ike-phase2-auth-algorithm is set to aes-gcm or aes-gmac, ike-phase2-encrypt-algorithm has to be set
to the identical algorithm with the same key length. sha256, sha384, sha512 and sha1 can only be used
with an encryption algorithm that is NOT an authenticated encryption algorithm.
• ike-phase2-encrypt-algorithm
Species an encryption algorithm for ESP. This attribute is only valid when IKE is used to negotiate
security associations. The default value is aes-gcm128.
1328
Net IPsec
Note: Because aes-gcm and aes-gmac are authenticated encryption algorithms, when
ike-phase2-encrypt-algorithm is set to one of these algorithms, ike-phase2-auth-algorithm has to be
set to the identical algorithm with the same key length.
• ike-phase2-lifetime
Species the lifetime duration in minutes, for the dynamically-negotiated security associations (SA).
This attribute is only valid when IKE is used to negotiate security associations.
• ike-phase2-lifetime-kilobytes
Species the lifetime duration in kilobytes, for the dynamically-negotiated security associations (SA).
This attribute is only valid when IKE is used to negotiate security associations. A value of '0' means the
SA will not re-key based on the number of bytes encrypted/decrypted. The minimum recommended
value is 1000 kilobytes. This value is not negotiated between peers."
• ike-phase2-perfect-forward-secrecy
Denes the group of Dife-Hellman exponentiations. This attribute is only valid when IKE is used to
negotiate Security Associations. The value 'none' indicates that the PFS is disabled for phase2 SA
negotiations.
• mode
Species a security protocol mode for use. The options are:
• transport
IPsec transport mode is used.
• tunnel
IPsec tunnel mode is used.
• isession
A special tunnel mode ipsec-policy that is only applicable on wom, remote-endpoint, or
local-endpoint.
• interface
IPsec interface mode is used.
• protocol
Species the IPsec protocol: Encapsulating Security Payload (ESP) or Authentication Header (AH).
• ipcomp
Species the compression algorithm for IPComp. The following codec are available:
• none
Disable IPComp
• deate
Packets will be encapsulated with IPComp header and Deate compression algorithm will be applied
to the data.
• null
Packets will be encapsulated with IPComp header but no compression algorithm will be applied to
the data.
• tunnel-local-address
1329
Traffic Management Shell (tmsh) Reference Guide
Species the IP address of the local IPsec tunnel endpoint. This option is only valid when mode is
tunnel. The format required for specifying a route domain ID in an IP address is A.B.C.D%ID. For
example, A.B.C.D%2, where the IP address A.B.C.D pertains to route domain 2.
• tunnel-remote-address
Species the IP address of the remote IPsec tunnel endpoint. This option is only valid when mode is
tunnel. The format required for specifying a route domain ID in an IP address is A.B.C.D%ID. For
example, A.B.C.D%2, where the IP address A.B.C.D pertains to route domain 2.
See Also
list, net ipsec trafc-selector, net ipsec manual-security-association, tmsh
ipsec-sa
Displays IPsec security associations on the BIG-IP(r) system.
Syntax
Use the ipsec-sa component within the ipsec module to manage IPsec security associations using the
following syntax.
Display
show ipsec-sa
option:
all-properties
src-addr [IP address]
dst-addr [IP address]
route-domain [integer]
spi [integer]
traffic-selector [name]
Description
You can use the ipsec-sa component to display information about IPsec security associations in the system.
Examples
show ipsec-sa all-properties
Display detail information about IPsec security associations.
Options
• src-addr
Species the source IP address of the security associations that you want to display.
• dst-addr
Species the destination IP address of the security associations that you want to display.
• route-domain
Species route domain used for trafc that you want to display. The default value is the default route
domain.
1330
Net IPsec
• spi
Species the SPI of the security associations that you want to display.
• trafc-selector
Species the name of the trafc-selector object associated with the security associations that you want
to display.
See Also
show, net ipsec trafc-selector, net ipsec ipsec-policy, tmsh
manual-security-association
Congures the IPsec manual-security-association.
Syntax
Congure the manual-security-association component within the net ipsec module using the syntax in
the following sections.
Create/Modify
create manual-security-association
modify manual-security-association
app-service [[string] | none]
description [string]
auth-algorithm [sha1]
auth-key [key]
destination-address [ip address]
encrypt-algorithm [3des|aes128|aes192|aes256|null]
encrypt-key [key]
ipsec-policy [name]
protocol [esp]
source-address [ip address]
spi [number]
Display
list manual-security-association
show manual-security-association
show running-config manual-security-association
app-service
all-properties
non-default-properties
one-line
Delete
delete manual-security-association [name]
1331
Traffic Management Shell (tmsh) Reference Guide
Description
Manually congures Security Association Database(SAD) entries. Because each SA provides data protection
only for unidirectional trafc, you must congure a manual-security-association for trafc in each direction
to establish a bidirectional IPsec tunnel.
Examples
create ipsec manual-security-association msa_on_dut2_transport_in { auth-key test description
"manual security association on dut2 for dut1 - transport" destination-address 7.7.7.7 encrypt-key
test ipsec-policy transport_policy_on_dut2 source-address 2.2.2.2 spi 1025 }
Creates a manual-security-association object named msa_on_dut2_transport_in to use IPsec to protect
trafc from 2.2.2.2 to 7.7.7.7 with the authentication key test and the encryption key test. The ipsec-policy
object named transport_policy_on_dut2 is associated with this manually congured security association.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auth-algorithm
Species an authentication algorithm.
• auth-key
Species the key for the authentication algorithm.
• auth-key-encrypted
Displays the encrypted auth-key.
• description
User-dened description.
• destination-address
Species the destination of the security association.
• encrypt-algorithm
Species an encryption algorithm.
• encrypt-key
Species the key for the encryption algorithm.
• encrypt-key-encrypted
Display the encrypted encrypt-key.
• ipsec-policy
Species the ipsec-policy associated with this manual-security-association.
• protocol
Species the IPsec protocol: Encapsulating Security Payload (ESP) or Authentication Header (AH).
• source-address
Species the source address of the security association.
• spi
1332
Net IPsec
Species the Security Parameters Index. If this is the Security Association(SA) for the outbound
trafc, make sure it matches the SPI of the inbound SA congured on the remote site and vice versa.
SPI values between 0 and 255 are reserved for the future use by IANA and cannot be used.
See Also
list, net ipsec ipsec-policy, tmsh
traffic-selector
Congures a trafc selector for IPsec.
Syntax
Congure the trafc-selector component within the net ipsec module using the syntax in the following
sections.
Create/Modify
create traffic-selector [name]
modify traffic-selector [name]
action [protect]
app-service [[string] | none]
description [string]
destination-address [ip address/netmask]
destination-port [port number]
direction [both | in | out]
ipsec-policy [name]
ip-protocol [protocol number]
order [integer]
source-address [ip address/netmask]
source-port [port number]
Display
list
list traffic-selector
Delete
B<delete traffic-selector [name]>
Description
You can use the trafc-selector component to specify which incoming trafc you want the system to protect
with IPsec.
Examples
create trafc-selector sjc2sea { source-address 10.10.10.0/24 destination address 20.20.20.0/24 direction
both ipsec-policy my_policy}
1333
Traffic Management Shell (tmsh) Reference Guide
Creates a trafc-selector named sjc2sea, which has the IP address of 10.10.10.0/24 using ipsec-policy named
my_policy.
Options
• action
Species how the system handles trafc that matches the criteria in the trafc selector. Only protect is
currently supported.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• destination-address
Species the destination IP address of the trafc to be matched. The format required for specifying a
route domain ID in an IP address is A.B.C.D%ID. For example, A.B.C.D%2, where the IP address
A.B.C.D pertains to route domain 2.
• destination-port
Species the destination port number of the trafc to be matched.
• direction
Species the direction of trafc to be protected with IPsec. If the direction is both, use source-address
and destination-address with respect to the outbound direction. The default value is both.
• ip-protocol
Species the IP protocol of the trafc to be matched.
• ipsec-policy
Species the name of the IPsec policy to be enforced on the matched trafc.
• order
Species the order in which trafc is matched, if trafc can be matched to multiple trafc selectors.
Trafc is matched to the the trafc selector with the highest priority (lowest order number).
• source-address
Species the source IP address of the trafc to be matched. The format required for specifying a route
domain ID in an IP address is A.B.C.D%ID. For example, A.B.C.D%2, where the IP address A.B.C.D
pertains to route domain 2.
• source-port
Species the source port number of the trafc to be matched.
See Also
list, net ipsec ipsec-policy, tmsh
1334
Net IPsec
Net Rate Shaping
class
Congures a rate class.
Syntax
Congure the class component within the net rate-shaping module using the syntax in the following
sections.
Create/Modify
create class [name]
modify class [name]
app-service [[string] | none]
ceiling [integer]
ceiling-percentage [integer]
description [string]
direction [any | to-client | to-server]
drop-policy [ [custom drop policy name ] | fred | red | tail]
max-burst [integer]
parent [class name]
queue [ [custom queue name | pfifp | sfq]
rate [integer]
rate-percentage [integer]
shaping-policy [ [custom shaping policy name] | none]
edit class [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list class
list class [ [ [name] | [glob] | [regex] ] ... ]
show running-config class
show running-config class [ [ [name] | [glob] | [regex] ] ... ]
all-properties
current-module
non-default-properties
one-line
show class
show class [ [ [name] | [glob] | [regex] ] ... ]
current-module
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Delete
delete class [all | [name] ]
Description
You can use the class component to create a rate class. A rate class lets you specify shaping properties for
a specic type of trafc, such as Layer 3 trafc that species a certain source, destination, or service.
Specically, a rate class denes the number of bits per second that the system accepts per ow and the
number of packets in a queue.
You congure rate shaping by creating a class and then assigning the class to a packet lter, a virtual server,
or from within an iRule. When you congure a class, you can associate another class with the class you are
conguring using the parent option.
You can also associate drop policies, shaping policies, and queues with a class using the drop-policy,
shaping-policy, and queue options of the class component. You can associate pre-congured drop policies
and queues with the class, or you can create custom drop policies, queues, and shaping policies, and then
associate them with the class.
Note that if you specify a value for the shaping-policy option of the class, the system automatically changes
the ceiling-percentage, drop-policy, max-burst, queue, and rate-percentage options of the class to match
the values in the specied shaping policy.
Examples
create class my_class rate 10
Creates a class named my_class with a rate of 10.
list class all-properties
Displays all of the properties of all of the classes.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• ceiling
Species (in bps) how far beyond the value specied for the rate option that trafc can ow. This
number sets an absolute limit. No trafc can exceed this rate. The rate class might limit trafc throughput
to the value of the rate option when there is high contention among siblings of a parent-child class
hierarchy. The default value is the value of the rate option. The minimum value is 296 bps.
• ceiling-percentage
Species the ceiling of the rate class as a percentage of the ceiling of the associated parent class. This
option applies only to rate classes with an associated parent rate class. The default value is 0 (zero),
which indicates that the class uses the value of the ceiling option.
• description
User dened description.
• direction
Species the direction of trafc to which the class is applied. The default value is any.
1336
Net Rate Shaping
• drop-policy
Species the name of a drop policy. You can use one of the pre-congured drop policies, or you can
create a customized drop policy using the drop-policy component.
The default value is tail, which is the simplest drop policy. The pre-congured drop policies are:
• fred
Species that the system uses Flow-based Random Early Detection to decide whether to drop packets
based on the aggressiveness of each ow.
• red
Species that the system uses Random Early Detection to determine whether to drop packets to
maintain the average queue length within the specied range.
• tail
Species that the system drops all incoming packets when the queue is full.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• max-burst
Species the maximum number of bytes that trafc can burst beyond the value of the rate option. The
trafc may not burst higher than the value of the ceiling option. The default value is 0 (zero).
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• parent
Associates another class with this class. The class you are conguring (which when you congure a
parent class for it becomes a child class) can borrow bandwidth from the parent class. The parent class
can use any of the unused bandwidth of the child class.
• queue
Species the queuing method. The default value is sfq. The pre-congured options are:
• pfo
The Priority FIFO queuing method queues all trafc under a set of ve sub-queues based on the
Type of Service (TOS) eld of the trafc. Four of the sub-queues correspond to the four possible
TOS values (Minimum delay, Maximum throughput, Maximum reliability, and Minimum cost). The
fth sub-queue represents trafc with no TOS value. The Priority FIFO method processes these ve
sub-queues in a way that preserves the meaning of the TOS value as much as possible. For example,
a packet with the TOS value of Minimum cost might yield dequeuing to a packet with the TOS value
of Minimum delay.
• sfq
Stochastic Fair Queuing is a queuing method that further queues packets under a set of many FIFO
sub-queues. Selecting a specic sub-queue is based on a hash of the ow address information. SFQ
dequeues packets from the set of sub-queues in a Round Robin fashion. The overall effect is that
fairness of dequeuing is achieved, because packets from one ow cannot occupy the queues at the
exclusion of those of another ow.
Note that if you assign a shaping policy to the class, then the queuing discipline of the class becomes
that specied in the shaping policy. If you do not assign a shaping policy to the class, the default
queue is sfq.
1337
Traffic Management Shell (tmsh) Reference Guide
• rate
Species the guaranteed throughput rate of the trafc handled by this rate class, in bits per second (bps).
• rate-percentage
Species the rate of the rate class as a percentage of the ceiling of the associated parent class. This option
applies only to rate classes with an associated parent rate class. The default value is 0 (zero), which
species that the system uses the value of the rate option.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• shaping-policy
Species the name of a shaping policy. The default value is none.
Note that the system automatically changes the ceiling-percentage, drop-policy, max-burst, queue,
and rate-percentage options of this class to match the values in the specied shaping policy.
See Also
create, delete, edit, glob, list, modify, net rate-shaping drop-policy, net rate-shaping queue, net rate-shaping
shaping-policy, regex, show, tmsh
color-policer
Congures a policer, which can be applied to other conguration entities to meter or rate-shape trafc using
color based classication of packets.
Syntax
Congure the color-policer component within the net rate-shaping module using the syntax in the following
sections.
Create
create color-policer [name]
modify color-policer [name]
action [action]
committed-burst-size [integer]
committed-information-rate [integer]
excess-burst-size [integer]
Display
list color-policer
options:
all-properties
1338
Net Rate Shaping
Delete
delete color-policer [name]
Description
You can use a color-policer to create a metering/policing conguration to be applied to other conguration
entities. For instance, to limit or track out of prole network trafc to a vCMP guest, a color-policer can
be added to a vcmp trafc-prole and be applied to any number of vcmp guest objects.
Based on the conguration of color-policer attributes a packet may be counted as either green, yellow, or
red. These categories can be tracked for accounting purposes, as well as allowing for out of prole (Red)
trafc to be dropped as a rate-shaping or DOS protection technique.
Examples
list net color-policer
Lists the current conguration of all color-policers.
create net color-policer ftyMpbsLimiter action drop-red committed-information-rate 50mbps
committed-burst-size 10mb excess-burst-size 10mb
Congures a policer with a committed information rate (CIR) of 50 mbps committed burst size (CBS) of
10 mb, and excess burst size (EBS) of 10 mb. See individual descriptions of options bellow for more detailed
semantics.
Options
• action
One of drop-red or default. Drop-red means that a packet which exceeds the excess burst rate of the
policer, and is marked red should be dropped immediately before even attempting to enqueue the packet
to/from the guest. Default means that the default behavior for the resulting color packets should be taken,
which may vary depending on additional system conguration, and load. For instance, a Red colored
packet may be considered lowest priority with respect to QOS queues associated with the guest. Thus,
allowing as much trafc through as is available, but increasing the drop probability for packets out of
prole in the case that the system is under high enough data-plane trafc load.
• committed-burst-size
When the data rate exceeds the committed-information-rate then the committed-burst-size (by default
specied in bytes) is the burst size below which a packet is marked green, and above which it may be
marked yellow, or red.
• committed-information-rate
The committed rate of data transfer that is to be given to a metered entity that the policer is associated
with. Trafc is marked green as long as it stays below this rate or if bursts above this rate are smaller
than the committed-burst-size.
• excess-burst-size
An additional data burst size to be used on top of the committed-burst-size. A packet is marked yellow
if it exceeds the committed-burst-size but not the additional excess-burst-size, and red if it exceeds
the excess-burst-size.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
1339
Traffic Management Shell (tmsh) Reference Guide
drop-policy
Congures a custom drop policy for use in rate shaping.
Syntax
Congure the drop-policy component within the net rate-shaping module using the syntax in the following
sections.
Create/Modify
create drop-policy [name]
modify drop-policy [name]
app-service [[string] | none]
average-packet-size [integer]
description [string]
fred-max-active [integer]
fred-max-drop [integer]
fred-min-drop [integer]
inverse-weight [integer]
max-probability [integer]
max-threshold [integer]
min-threshold [integer]
red-hard-limit [integer]
type [fred | red | tail]
edit drop-policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list drop-policy
list drop-policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config drop-policy
show running-config drop-policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete drop-policy [all | [name] ]
Description
A drop policy tells the system when and how to drop packets when the trafc handling queue is full, if
required. The system comes with three pre-congured drop policies: fred, red, and tail.
You can use the drop-policy component to create a custom drop policy, and then associate it with a class
using the drop-policy option of the class component. For more information, see net rate-shaping class.
1340
Net Rate Shaping
You can also associate a custom drop policy with a shaping policy using the drop-policy option of the
shaping-policy component. For more information, see net rate-shaping shaping-policy.
Examples
create drop-policy my_dp
Creates a custom drop policy named my_dp.
list drop-policy all-properties
Displays all of the properties of all of the drop policies.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• average-packet-size
Species the average MTU (maximum transmission unit) size in the range of 0 to 10000 bytes. The
default value is 0 (zero).
• description
User dened description.
• fred-max-active
Species the maximum number of ows that can be active for each queue. The range is 0 to 10000. The
default value is 0 (zero),which disables active ow limitation.
• fred-max-drop
Species a hard drop limit in the range of 0 to 400. The default value is 0 (zero). Setting this to a small
value does not change the hard drop limit, but a higher number increases the limit.
• fred-min-drop
Species a hard no drop limit in the range of 0 to 100. The default value is 0 (zero). Setting this to a
large value prevents packets from being dropped.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• inverse-weight
Species the weight used to calculate the average queue length. Valid values are 0, 64, 128, 256, 512,
and 1024. The default value is 0 (zero).
• max-probability
Species the maximum percentage probability in the range of 0 to 100 according to which packets are
dropped when the average queue length is between the minimum and maximum thresholds. The default
value is 0 (zero).
• max-threshold
Species the queue length above which the system drops packets. The default value is 0 (zero).
• min-threshold
Species the queue length below which the system does not drop packets. The default value is 0 (zero).
• name
1341
Traffic Management Shell (tmsh) Reference Guide
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• red-hard-limit
Species the maximum queue size in bytes. Additional packets are dropped. The default value is 0
(zero).
This option applies only when the value of the type option is red.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• type
Species the type of drop policy. The default value is tail.
The options are:
• fred
Species that the system uses Flow-based Random Early Detection to decide whether to drop packets
based on the aggressiveness of each ow.
• red
Species that the system uses Random Early Detection to determine whether to drop packets to
maintain the average queue length within the specied range.
• tail
Species that the system drops all incoming packets when the queue is full. This is the simplest drop
policy.
Note that although you could create a drop policy based on tail, that is already the default value of
the drop-policy option in both the shaping-policy and class components.
See Also
create, delete, edit, glob, list, modify, net rate-shaping class, net rate-shaping queue, net rate-shaping
shaping-policy, regex, show, tmsh
queue
Congures a custom queuing method.
Syntax
Congure the queue component within the net rate-shaping module using the syntax in the following
sections.
Create/Modify
create queue [pfifo | sfq]
modify queue [all | pfifo | sfq]
app-service [[string] | none]
description [string]
1342
Net Rate Shaping
pfifo-max-size [integer]
pfifo-min-size [integer]
sfq-bucket-count [integer]
sfq-bucket-size [integer]
sfq-perturbation [integer]
type [pfifo | sfq]
edit queue [ [ [all | pfifo | sfq] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list queue
list queue [ [ [all | pfifo | sfq] | [glob] | [regex] ] ... ]
show running-config queue
show running-config queue
[ [ [all | pfifo | sfq] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete queue [all | [name] ]
Description
You can use the queue component to congure a custom queuing method.
Examples
create queue my_q type pfo
Creates a pfo type queue name my_q.
list queue all-properties
Displays all of the properties of all of the queue.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
1343
Traffic Management Shell (tmsh) Reference Guide
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• pfo-max-size
Species the size of the largest queue for the pfo type only. The default value is 0 (zero). Valid units
are bytes(default), eb, gb, k, kb, mb, pb, and tb.
• pfo-min-size
Species the size of the smallest queue for the pfo type only. The default value is 0 (zero). Valid units
are bytes(default), eb, gb, k, kb, mb, pb, and tb.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• sfq-bucket-count
Species the number of buckets into which the queue is divided when you are conguring the sfq type.
Valid values are 0, 16, 32, 64, 128, 256, 512, and 1024. The default value is 0 (zero).
• sfq-bucket-size
Species the bucket size for the sfq type. The default value is 0 (zero). Valid units are bytes(default),
eb, gb, k, kb, mb, pb, and tb.
• sfq-perturbation
Species the interval in seconds at which the system recongures the SFQ hash function. This option
applies only to the sfq type. The default value is 0 (zero).
• type
Species the queue discipline this custom queue uses. The options are:
• pfo
The Priority FIFO queuing method queues all trafc under a set of ve sub-queues based on the
Type of Service (TOS) eld of the trafc. Four of the sub-queues correspond to the four possible
TOS values (Minimum delay, Maximum throughput, Maximum reliability, and Minimum cost). The
fth sub-queue represents trafc with no TOS value. The Priority FIFO method processes these ve
sub-queues in a way that preserves the meaning of the TOS value as much as possible. For example,
a packet with the TOS value of Minimum cost might yield dequeuing to a packet with the TOS value
of Minimum delay.
• sfq
Stochastic Fair Queuing is a queuing method that further queues packets under a set of many FIFO
sub-queues. Selecting a specic sub-queue is based on a hash of the ow address information. SFQ
dequeues packets from the set of sub-queues in a Round Robin fashion. The overall effect is that
fairness of dequeuing is achieved, because packets from one ow cannot occupy the queues at the
exclusion of those of another ow.
See Also
create, delete, edit, glob, list, modify, net rate-shaping class, net rate-shaping drop-policy, net rate-shaping
shaping-policy, regex, show, tmsh
1344
Net Rate Shaping
shaping-policy
Congures a custom rate shaping policy for trafc ow.
Syntax
Congure the shaping-policy component within the net rate-shaping module using the syntax in the
following sections.
Create/Modify
create shaping-policy [name]
modify shaping-policy [name]
app-service [[string] | none]
ceiling-percentage [integer]
description [string]
drop-policy [ [name] | none]
max-burst [integer]
queue [ [name] | none]
rate-percentage [integer]
edit shaping-policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list shaping-policy
list shaping-policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config shaping-policy
show running-config shaping-policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete shaping-policy [all | [name] ]
Description
You can use the shaping-policy component to create a custom rate shaping policy to handle trafc ow,
and then associate the shaping policy with a class.
Note that if you specify a value for the shaping-policy option of a class, the system automatically changes
the ceiling-percentage, drop-policy, max-burst, queue, and rate-percentage options of that class to match
the values in the shaping policy.
Examples
create shaping-policy my_sp
1345
Traffic Management Shell (tmsh) Reference Guide
Creates a shaping policy named my_sp.
list shaping policies all-properties
Displays all of the properties of all of the shaping policies.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• ceiling-percentage
Species the percentage of the value of the ceiling option specied for the parent associated with the
class component to which this shaping policy is associated. The default value is 0 (zero).
• description
User dened description.
• drop-policy
Species the name of a drop policy for this trafc ow. The default value is none.
You can use one of the pre-congured drop policies, or you can create a customized drop-policy using
the drop-policy component.
The pre-congured drop policies are:
• fred
Species that the system uses Flow-based Random Early Detection to decide whether to drop packets
based on the aggressiveness of each ow.
• red
Species that the system uses Random Early Detection to determine whether to drop packets to
maintain the average queue length within the specied range.
• tail
Species that the system drops all incoming packets when the queue is full. This is the simplest drop
policy.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• max-burst
Species the maximum number of bytes that trafc is allowed to burst beyond the value of the rate
option of the class component to which this shaping policy is associated. The default value is 0 (zero).
Valid units are byte, bytes(default), eb, gb, k, kb, mb, pb, and tb.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• queue
Species the queuing method for this trafc ow. The default value is none. You can create a customized
queuing method using the queue component. For more information, see net rate-shaping queue.
The precongured queues are:
1346
Net Rate Shaping
• pfo
The Priority FIFO queuing method queues all trafc under a set of ve sub-queues based on the
Type of Service (TOS) eld of the trafc. Four of the sub-queues correspond to the four possible
TOS values (Minimum delay, Maximum throughput, Maximum reliability, and Minimum cost). The
fth sub-queue represents trafc with no TOS value. The Priority FIFO method processes these ve
sub-queues in a way that preserves the meaning of the TOS value as much as possible. For example,
a packet with the TOS value of Minimum cost might yield dequeuing to a packet with the TOS value
of Minimum delay.
• sfq
Stochastic Fair Queuing is a queuing method that further queues packets under a set of many FIFO
sub-queues. Selecting a specic sub-queue is based on a hash of the ow address information. SFQ
dequeues packets from the set of sub-queues in a Round Robin fashion. The overall effect is that
fairness of dequeuing is achieved, because packets from one ow cannot occupy the queues at the
exclusion of those of another ow.
• rate-percentage
Species the percentage of the value of the rate option of the parent, which is associated with the class
component to which this shaping policy is associated, that is available for this trafc ow. The default
value is 0 (zero).
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, net rate-shaping drop-policy, net rate-shaping queue, net rate-shaping
shaping-policy, regex, show, tmsh
1347
Traffic Management Shell (tmsh) Reference Guide
Net Tunnels
etherip
Congures an EtherIP tunnel prole.
Syntax
Congure the etherip component within the net tunnels module using the syntax in the following sections.
Create/Modify
create etherip [name]
modify etherip [name]
app-service [[string] | none]
defaults-from [name]
description [string]
edit etherip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list etherip
list etherip [ [ [name] | [glob] | [regex] ] ... ]
show running-config etherip
show running-config etherip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete etherip [ all | [name] ]
Description
You can use the etherip component to create an EtherIP prole that you associate with a tunnel using the
tunnel component. This will cause ethernet frames to be sent over the tunnel. For more information about
creating a tunnel see net tunnel.
Examples
create etherip my_etherip
Creates an EtherIP prole called my_etherip.
list etherip all-properties
Displays all of the properties of all EtherIP proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is etherip.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
fec
Congures a Forward Error Correction (FEC) prole.
Syntax
Congure the fec component within the net tunnels module using the syntax in the following sections.
Create/Modify
create fec [name]
modify fec [name]
app-service [[string] | none]
decode-idle-timeout [integer]
decode-max-packets [integer]
1350
Net Tunnels
decode-queues [integer]
defaults-from [name]
description [string]
encode-max-delay [integer]
keepalive-interval [integer]
lzo [disabled | enabled]
repair-adaptive [disabled | enabled]
repair-packets [integer]
source-adaptive [disabled | enabled]
source-packets [integer]
udp-port [integer]
edit fec [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
=head2 DISPLAY
list fec
list fec [ [ [name] | [glob] | [regex] ] ... ]
show running-config fec
show running-config fec [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete fec [ all | [name] ]
Description
You can use the fec component to create a FEC prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create fec my_fec
Creates a FEC prole called my_fec.
list fec all-properties
Displays all of the properties of all of the FEC proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is fec.
1351
Traffic Management Shell (tmsh) Reference Guide
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• decode-idle-timeout
Species the maximum waiting time for packets in decoding queues. Packets waiting longer than this
time are discarded. Range is from 250 to 2000 milliseconds. The default value is 1500 milliseconds.
• decode-max-packets
Species the maximum number of waiting packets in decoding queues. Range is from 200 to 8000. The
default value is 512.
• decode-queues
Species the number of decoding queues. Valid numbers are 8, 16, 32, 64, 128, 256, 512, 1024. The
default value is 32.
• encode-max-delay
Species the maximum waiting time for packet aggregation. Range is from 500 to 5000 microseconds.
The default value is 500 microseconds.
• keepalive-interval
Species the interval between keepalive (statistical data) packets. Range is from 0 to 100 seconds. The
default value is 5 seconds.
• lzo
Controls the use of the LZO compression algorithm to compress data packets. The default value is
enabled.
• repair-adaptive
Controls the use of the adaptive FEC repair technique to modify the number of redundant packets
according to actual network conditions. The default value is enabled.
• repair-packets
Species the number of redundant packets to add. Range is from 0 to 15. The default value is 15. This
value should be less than or equal to the value specied for source-packets.
• source-adaptive
Controls the use of the adaptive FEC source packets technique to reduce the number of packets for better
MTU usage. The default value is enabled.
• source-packets
Species the number of packets into which the system divides the aggregated payload. Range is from
1 to 15. The default value is 15.
1352
Net Tunnels
• udp-port
Species the local port for receiving FEC packets. The default value is 8288.
See Also
create, delete, edit, glob, list, modify, net tunnels ipip, net tunnels tunnel, net tunnels wccp, regex, show,
tmsh
fec-stat
Displays FEC tunnels statistics.
Syntax
Display statistics for the FEC tunnels using the syntax in the following section.
Display
show action
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the fec-stat component to display FEC tunnels statistics. The statistics details are described
below:
• name
Species the FEC tunnel name.
• prole
Species the FEC prole name used for the tunnel.
• out_raw_packets
Species the number of FEC outgoing raw packets coming from the LAN.
• out-raw-bits
Species the number of FEC outgoing raw bits coming from the LAN.
• out_rdnd_packets
Species the number of FEC outgoing redundant packets sent to the WAN.
• out_rdnd_bits
Species the number of FEC outgoing redundant bits sent to the WAN.
• in_raw_packets
Species the number of incoming raw packets sent to the LAN.
• in-raw-bits
Species the number of incoming raw bits sent to the LAN.
• in_rdnd_packets
Species the number of FEC redundant packets incoming from the WAN.
1353
Traffic Management Shell (tmsh) Reference Guide
• in_rdnd_bits
Species the number of FEC redundant bits incoming from the WAN.
• in_rdnd_lost
Species the number of FEC redundant packets lost incoming from the WAN.
• in_raw_lost
Species the number of incoming from WAN raw packets lost.
• rmt_in_rdnd_packets
Species the number of FEC redundant packets from a remote server when incoming from the WAN.
• rmt_in_raw_packets
Species the number of raw packets from remote a server when incoming from the WAN.
• rmt_in_rdnd_lost
Species the number of FEC redundant packets lost from a remote server when incoming from the
WAN.
• rmt_in_raw_lost
Specifies the number of raw packets lost from a remote server when incoming
from the WAN.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, fec, net tunnels, net tunnels fec, net tunnels tunnel, tmsh
geneve
Congures a Geneve prole.
Syntax
Congure the geneve component within the net tunnels module using the syntax in the following sections.
Create/Modify
create geneve [name]
modify geneve [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
1354
Net Tunnels
port [integer]
flooding-type [none | multicast | multipoint]
edit geneve [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list geneve
list geneve [ [ [name] | [glob] | [regex] ] ... ]
show running-config geneve
show running-config geneve [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete geneve [ all | [name] ]
Description
You can use the geneve component to create a geneve prole that you associate with a tunnel using the
tunnel component. For more information about creating a tunnel see net tunnel.
Examples
create geneve my_geneve
Creates a geneve prole called my_geneve.
list geneve all-properties
Displays all the properties of all the geneve proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is geneve.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
1355
Traffic Management Shell (tmsh) Reference Guide
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• port
Species the local port for receiving geneve packets. The default is 6081.
• ooding-type
Species the ooding type to use to transmit multicast, broadcast and unknown destination frames. The
default is multipoint.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
gre
Congures a Generic Router Encapsulation (GRE) prole.
Syntax
Congure the gre component within the net tunnels module using the syntax in the following sections.
Create/Modify
create gre [name]
modify gre [name]
app-service [[string] | none]
defaults-from [name]
description [string]
rx-csum [disabled | enabled]
tx-csum [disabled | enabled]
encapsulation [standard | nvgre]
flooding-type [none | multipoint]
edit gre [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list gre
list gre [ [ [name] | [glob] | [regex] ] ... ]
show running-config gre
1356
Net Tunnels
show running-config gre [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete gre [ all | [name] ]
Description
You can use the gre component to create a GRE prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create gre my_gre
Creates a GRE prole called my_gre.
list gre all-properties
Displays all of the properties of all of the GRE proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is gre.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rx-csum
Species whether the system veries the checksum on received packets. The default value is disabled.
1357
Traffic Management Shell (tmsh) Reference Guide
• tx-csum
Species whether the system includes a checksum on transmitted packets. The default value is disabled.
• encapsulation
Species the avor of GRE header to use for encapsulation. The default value is standard.
• ooding-type
Species the ooding type to use to transmit broadcast and unknown destination frames. The default is
none.
See Also
create, delete, edit, glob, list, modify, net tunnels ipip, net tunnels tunnel, net tunnels wccp, regex, show,
tmsh
ipip
Congures an IP over IP (IPIP) prole.
Syntax
Congure the ipip component within the net tunnels module using the syntax in the following sections.
Create/Modify
create ipip [name]
modify ipip [name]
app-service [[string] | none]
defaults-from [name]
description [string]
proto [IPv4 | IPv6]
ds-lite [bool]
edit ipip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ipip
list ipip [ [ [name] | [glob] | [regex] ] ... ]
show running-config ipip
show running-config ipip [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
1358
Net Tunnels
Delete
delete ipip [ all | [name] ]
Description
You can use the ipip component to create an IPIP prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create ipip my_ipip
Creates an IPIP prole called my_ipip.
list ipip all-properties
Displays all of the properties of all of the IPIP proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is ipip.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the partition within which this component resides.
• proto
Species the next header protocol. The default value is IPv4.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• ds-lite
Species whether the prole is used for a DS-lite deployment. When enabled, an augmented ow lookup
is made using the IPv6 address in the outer header in addition to the inner header addresses for packets
coming over this tunnel. The default value is disabled.
1359
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, modify, net tunnels gre, net tunnels tunnel, net tunnels wccp, regex, show,
tmsh
ipsec
Congures an IPsec prole.
Syntax
Congure the ipsec component within the net tunnels module using the syntax in the following sections.
Create/Modify
create ipsec [name]
modify ipsec [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
traffic-selector [name]
edit ipsec [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ipsec
list ipsec [ [ [name] | [glob] | [regex] ] ... ]
show running-config ipsec
show running-config ipsec [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete ipsec [ all | [name] ]
Description
You can use the ipsec component to create an ipsec prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create ipsec my_ipsec
1360
Net Tunnels
Creates an IPsec prole called my_ipsec.
list ipsec all-properties
Displays all the properties of all the IPsec proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is ipsec.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• trafc-selector
Species the IPsec trafc selector for the IPsec tunnel.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
map
Congures a MAP tunnel prole.
Syntax
Congure the map component within the net tunnels module using the syntax in the following sections.
Create/Modify
create map [name]
1361
Traffic Management Shell (tmsh) Reference Guide
modify map [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
ip6-prefix [ipv6 address/prefix length]
ip4-prefix [ipv4 address/prefix length]
ea-bits-length [integer]
port-offset [integer]
edit map [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list map
list map [ [ [name] | [glob] | [regex] ] ... ]
show running-config map
show running-config map [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete map [ all | [name] ]
Description
You can use the map component to create a MAP prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create map my_map
Creates a MAP prole called my_map.
list map all-properties
Displays all the properties of all the MAP proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is map.
• description
1362
Net Tunnels
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• ip6-prex
Species the IPv6 Prex using CIDR notation, such as 2014::/48. The default prex length is 48.
• ip4-prex
Species the IPv4 Prex using CIDR notation, such as 192.0.0.0/8. The default prex length is 8.
• ea-bits-length
Species the length in bits of the EA (Embedded Address) of the MAP domain. The default is 32 (IPv4
prex 24 bits + PSID 8 bits).
• port-offset
Species the port offset bits length of the MAP domain. The default is 6.
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
ppp
Congures a PPP prole.
Syntax
Congure the ppp component within the net tunnels module using the syntax in the following sections.
Create/Modify
create ppp [name]
modify ppp [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
lcp-echo-failure [integer]
1363
Traffic Management Shell (tmsh) Reference Guide
lcp-echo-interval [integer]
vj [disabled | enabled]
edit ppp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list ppp
list ppp [ [ [name] | [glob] | [regex] ] ... ]
show running-config ppp
show running-config ppp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete ppp [ all | [name] ]
Description
You can use the ppp component to create a ppp prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create ppp my_ppp
Creates a PPP prole called my_ppp.
list ppp all-properties
Displays all the properties of all the PPP proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is ppp.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
1364
Net Tunnels
• lcp-echo-failure
Species the number of consecutive PPP LCP echo messages that must go unanswered for the server
to drop PPP connection. For example, if the server sends number of consecutive PPP LCP Echo Request
messages that go unanswered (by Echo Reply), it will close the PPP connection. The default value is 4.
• lcp-echo-interval
Species the interval, in seconds, between the PPP LCP Echo Request messages that the server sends
to the peer (client). The default value is 30.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• vj
Species whether the system uses Van Jacobson Header Compression (also known as VJ compression,
or just Header Compression), which is an option in most versions of PPP. VJ is a data compression
protocol described in RFC 1144, specically designed by Van Jacobson to improve TCP/IP performance
over slow serial links. The default value is disabled.
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
tunnel
Congures a tunnel.
Syntax
Congure the tunnel component within the net tunnels module using the syntax in the following sections.
Create/Modify
create tunnel [name]
modify tunnel [name]
app-service [[string] | none]
auto-lasthop [default | enabled | disabled ]
description [string]
local-address [ip address]
secondary-address [ip address]
mode [bidirectional | inbound | outbound]
mtu [integer]
use-pmtu [enabled | disabled ]
profile [name]
remote-address [ip address]
traffic-group [[traffic group] | none]
tos [integer]
transparent [enabled | disabled ]
1365
Traffic Management Shell (tmsh) Reference Guide
idle-timeout [integer]
key [integer]
edit tunnel [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list tunnel
list tunnel [ [ [name] | [glob] | [regex] ] ... ]
show running-config tunnel
show running-config tunnel [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete tunnel [ all | [name] ]
Description
You can use the tunnel component to congure a tunnel.
Examples
create tunnel my_tunnel local-address 10.10.10.1 remote-address 11.11.11.1 prole gre
Creates a tunnel named my_tunnel between the local IP address 10.10.10.1 and the remote IP address
11.11.11.1.
list tunnel all-properties
Displays all of the properties of all of the tunnels.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• auto-lasthop
When enabled, species that the system returns packets to the MAC address from which they were sent.
The default setting is default, which species that the system uses the default route to send back the
request.
• description
User dened description.
• glob
1366
Net Tunnels
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• if-index
Displays the index assigned to this tunnel. It is a unique identier assigned for all objects displayed in
the SNMP IF-MIB.
• local-address
Species a local IP address. This option is required.
• secondary-address
Species a secondary non-oating IP address when the local-address is set to a oating address. Currently
this setting is supported by NVGRE tunnels only.
• mode
Species how the tunnel carries trafc. The default value is bidirectional.
• mtu
Species the maximum transmission unit (MTU) of the tunnel. The default value is 0. When the MTU
is set to the default value (of 0), the MTU of the tunnel is computed by the system and is set to the MTU
size of the underlying interface minus the encapsulation overhead introduced by the tunneling protocol.
The valid range is 0 - 65535.
• use-pmtu
Enables or disables the tunnel to use the PMTU (Path MTU) information provided by ICMP NeedFrag
error messages. If enabled and the tunnel MTU is set to 0, the tunnel will use the PMTU information.
If enabled and the tunnel MTU is xed to a non-zero value, the tunnel will use the minimum of PMTU
and MTU. If disabled, the tunnel will use xed MTU, or calculate its MTU using tunnel encapsulation
congurations.
• name
Species a unique name for the component. This option is required for the commands create, and
modify.
• partition
Displays the administrative partition within which the component resides.
• prole
Species the prole that you want to associate with the tunnel. This option is required for the create
command.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• remote-address
Species a remote IP address. This value is required for the commands create and modify.
• trafc-group
Species a trafc-group for use with the tunnel. Trafc group determines the CongSync behavior of
the tunnel object.
• tos
Species a value for insertion into the Type of Service (ToS) octet within the IP header of the
encapsulating header of transmitted packets. The default value is preserve. The possible values are 0
(zero) - 255.
1367
Traffic Management Shell (tmsh) Reference Guide
• transparent
Enables or disables the tunnel to be transparent. If enabled, the user can inspect and/or manipulate the
encapsulated trafc owing through the BIG-IP. A transparent tunnel terminates a tunnel while presenting
the illusion that the tunnel transits the device unperturbed i.e. the BIG-IP appears like an intermediate
router that simply routes IP trafc through the device. The default value is disabled.
• idle-timeout
Species an idle timeout for wildcard tunnels in seconds. This setting species the number of seconds
that a wildcard tunnel connection is idle before the connection is eligible for deletion. The default value
is 300 seconds.
• key
The key eld may represent different values depending on the type of the tunnel. For VXLAN it represents
the Virtual Network Identier (VNI). The default value is 0.
See Also
create, delete, edit, glob, list, modify, net tunnels gre, net tunnels ipip, net tunnels wccp, regex, show, tmsh
v6rd
Congures a 6RD prole.
Syntax
Congure the v6rd component within the net tunnels module using the syntax in the following sections.
Create/Modify
create v6rd [name]
modify v6rd [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
v6rdprefix [IPv6 address]
v6rdprefixlen [integer]
ipv4prefix [IPv4 address]
ipv4prefixlen [integer]
edit v6rd [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list v6rd
list v6rd [ [ [name] | [glob] | [regex] ] ... ]
show running-config v6rd
show running-config v6rd [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
1368
Net Tunnels
non-default-properties
one-line
partition
Delete
delete v6rd [ all | [name] ]
Description
You can use the v6rd component to create a v6rd prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create v6rd my_v6rd
Creates a 6RD prole called my_v6rd.
list v6rd all-properties
Displays all the properties of all the 6RD proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is v6rd.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• v6rdprex
Species the IPv6 prex for 6rd domain.
• v6rdprexlen
Species the IPv6 prex length of the 6rd domain. The default is 56.
1369
Traffic Management Shell (tmsh) Reference Guide
• ipv4prex
As an extension not mentioned in the RFC5969, it species the IPv4 prex for the Customer-Edge (CE)
devices of a 6RD domain at a Border-Relay (BR) in case that the subnet prexes used by the 6RD
devices do not share the same IPv4 prex. If they do, there is no need to congure this parameter. The
default value is 0.0.0.0.
• ipv4prexlen
Also noted as IPv4MaskLen in RFC5969, it species the number of identical high-order bits shared by
all CE and BR IPv4 addresses in a given 6RD domain. The valid range is from zero to 32. It is a required
value for create. It defaults to zero, i.e. the full ipv4 address must be encapsulated.
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
vxlan
Congures a VXLAN prole.
Syntax
Congure the vxlan component within the net tunnels module using the syntax in the following sections.
Create/Modify
create vxlan [name]
modify vxlan [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
port [integer]
flooding-type [none | multicast | multipoint | replicator]
edit vxlan [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list vxlan
list vxlan [ [ [name] | [glob] | [regex] ] ... ]
show running-config vxlan
show running-config vxlan [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
1370
Net Tunnels
Delete
delete vxlan [ all | [name] ]
Description
You can use the vxlan component to create a vxlan prole that you associate with a tunnel using the tunnel
component. For more information about creating a tunnel see net tunnel.
Examples
create vxlan my_vxlan
Creates a VXLAN prole called my_vxlan.
list vxlan all-properties
Displays all the properties of all the VXLAN proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is vxlan.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which this component resides.
• port
Species the local port for receiving VXLAN packets. The default is 4789.
• ooding-type
Species the ooding type to use to transmit multicast, broadcast and unknown destination frames. The
default is multicast.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
1371
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, modify, net tunnels tunnel, regex, show, tmsh
wccp
Congures a Web-cache coordination protocol (WCCP) GRE prole.
Syntax
Congure the wccp component within the net tunnels module using the syntax in the following sections.
Create/Modify
create wccp [name]
modify wccp [name]
app-service [[string] | none]
defaults-from [name]
description [string]
rx-csum [disabled | enabled]
tx-csum [disabled | enabled]
wccp-version [1 | 2]
edit wccp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list wccp
list wccp [ [ [name] | [glob] | [regex] ] ... ]
show running-config wccp
show running-config wccp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
Delete
delete wccp [ all | [name] ]
Description
You can use the wccp component to create a WCCP GRE prole that you associate with a tunnel using the
tunnel component. For more information about creating a tunnel see net tunnel.
Examples
create wccp my_wccp_gre
1372
Net Tunnels
Creates a WCCP GRE prole called my_wccp_gre.
list wccp all-properties
Displays all of the properties of all of the WCCP GRE proles.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the existing prole from which the system imports settings for the new prole. The default
value is wccpgre.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• rx-csum
Species whether the system veries the checksum on received packets. The default value is disabled.
• tx-csum
Species whether the system includes a checksum on transmitted packets. The default value is disabled.
• wccp-version
Species the version of WCCP that the system uses. The default value is 2.
See Also
create, delete, edit, glob, list, modify, net tunnels gre, net tunnels ipip, net tunnels tunnel, regex, show, tmsh
1373
Traffic Management Shell (tmsh) Reference Guide
PEM
forwarding-endpoint
Congures forwarding endpoints for the Policy Enforcement Manager (PEM).
Syntax
Modify the forwarding-endpoint component within the pem module using the syntax shown in the following
sections.
Create/Modify
create forwarding-endpoint [name]
modify forwarding-endpoint [name]
app-service [[string] | none]
description [[string] | none]
persistence {
type [destination-ip | disabled | hash | source-ip]
fallback [destination-ip | disabled | source-ip]
hash-settings {
algorithm [carp ]
length [integer]
offset [integer]
source [tcl-snippet | uri]
tcl-value [string]
}
}
pool [name]
snat-pool [name]
source-port [change | preserve | preserve-strict]
translate-address [disabled | enabled]
translate-service [disabled | enabled]
edit forwarding-endpoint [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list forwarding-endpoint
list forwarding-endpoint [ [ [name] | [glob] | [regex] ] ... ]
show running-config forwarding-endpoint
show running-config forwarding-endpoint [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
one-line
partition
Delete
delete forwarding-endpoint [name]
Note: All references to the forwarding-endpoint must be removed before it can be deleted.
Description
forwarding-endpoint is used to specify PEM policy forwarding action(s).
Note: A valid LTM pool with at least one member must be pre-congured before creating a
forwarding-endpoint. Please refer to ltm pool for more info about conguring LTM pools.
Examples
create forwarding-endpoint my_endpoint { pool my_pool snatpool my_snatpool source-port preserved
translate-address enabled translate-service enabled }
Creates a Policy Enforcement Manager forwarding endpoint named my_endpoint.
delete forwarding-endpoint my_endpoint
Deletes the forwarding-endpoint named my_endpoint.
list forwarding-endpoint my_endpoint
Displays the properties of the forwarding-endpoint named my_endpoint.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, user cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
Species a user-dened description.
• persistence
Allows to set a specic persistence method for the pool member selection.
• fallback
Species the fallback persistence method so that it applies when default persistence fail.
The options are:
• destination-ip
Map the destination ip address to a specic pool member so that subsequent trafc sent to this
address is directed to the same pool member.
• source-ip
Map the source ip address to a specic pool member so that subsequent trafc from this address
is directed to the same pool member.
• disabled
Species that this feature is disabled.
1376
PEM
• hash-settings
Species the settings for the hash persistence method.
• algorithm
Species the algorithm to calculate the hash value. Currently only the carp algorithm is available.
• length
Species the length of the source string used to calculate hash value. Default value of length is
1024.
• offset
Species the offset in bytes from start of the source string to calculate the hash value. Default
value of offset is 0.
• source
Species the source for the string value which is used to calculate hash value.
• tcl-value
Species the tcl script snippet so that when this script is executed its result used to calculate the
hash value.
• type
Species the persistance method.
The options are:
• destination-ip
Map the destination ip address to a specic pool member so that subsequent trafc sent to this
address is directed to the same pool member.
• hash
Map the hash value to a specic pool member so that subsequent trafc with the same hash value
is directed to the same pool member.
• source-ip
Map the source ip address to a specic pool member so that subsequent trafc from this address
is directed to the same pool member.
• disabled
Species that this feature is disabled.
• pool
Species the name of an LTM pool where the trafc is going to be directed to. Is used in the PEM policy
rule forwarding actions. Note that the pool must be pre-congured before it can be referenced by a
forwarding action.
• snat-pool
Species the name of an existing LTM SNAT pool (snatpool) that is used to translate the client IP
address to one of the congured IP addresses in that SNAT pool. The Self-IP addresses of the BIG-IP
system must not be included in the SNAT pool. The default value is none.
• source-port
Species whether the system preserves the source port of the connection. The default value is preserve.
The options are:
• change
1377
Traffic Management Shell (tmsh) Reference Guide
Species that the system changes the source port. This setting is useful for obfuscating internal
network address.
• preserve
Species that the system preserves the value congured for the source port, unless the source port
from a particular snat is already in use, in which case the system uses a different port.
• preserve-strict
Species that the system preserves the value congured for the source port. If the port is in use, the
system does not process the connection. F5 Networks recommends restricting the use of this setting
to cases that meet at least one of the following conditions:
The port is congured for UDP trafc.
The system is congured for nPath routing or is running in transparent mode (that is, there is no
translation of any other Layer 3 or Layer 4 eld).
There is a one-to-one relationship between virtual IP addresses and node addresses, or clustered
multiprocessing (CMP) is disabled.
• translate-address
Species, when enabled, that the system translates the original destination address of the virtual server.
When disabled, species that the system uses the address without translation. The default value is
disabled.
• translate-service
Note that translate-service is really translate-port. It species, when enabled, that the system translates
the original destination port. When disabled, it species that the system uses the original destination
port without translation. The default value is disabled.
See Also
create, delete, edit, glob, list, modify, pem interception-endpoint, pem listener, pem policy, pem prole
diameter-endpoint, pem prole spm, pem reporting format-script, pem service-chain-endpoint, pem
subscriber, pem subscribers, regex, show, tmsh
interception-endpoint
Congures interception endpoints for the Policy Enforcement Manager (PEM).
Syntax
Modify the interception-endpoint component within the pem module using the syntax shown in the
following sections.
Create/Modify
create interception-endpoint [name]
modify interception-endpoint [name]
app-service [[string] | none]
1378
PEM
persistence [destination-ip | disabled | source-ip]
pool [name]
edit interception-endpoint [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list interception-endpoint
list interception-endpoint [ [ [name] | [glob] | [regex] ] ... ]
show running-config interception-endpoint
show running-config interception-endpoint [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
one-line
partition
Delete
delete interception-endpoint [name]
Note: You must remove all references to an interception-endpoint before you can delete the
interception-endpoint.
Description
You can use the interception-endpoint component to congure interception-endpoint denitions for the
Policy Enforcement Manager. The interception-endpoint is used to clone all trafc. Note: Before you create
a cloning-endpoint you have to create a valid pool. Please refer to ltm pool for more information about how
to create a pool.
Examples
create interception-endpoint my_endpoint { pool pool1 }
Creates a Policy Enforcement Manager interception-endpoint named my_endpoint.
delete interception-endpoint my_endpoint
Deletes the interception-endpoint named my_endpoint.
list interception-endpoint my_endpoint
Displays the properties of the interception-endpoint named my_endpoint.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• persistence
1379
Traffic Management Shell (tmsh) Reference Guide
Species the persistence that is based on either the source or destination IP addresses only.
• pool
Species the pool. It is mandatory to specify a pool when creating any interception-endpoint. Before
you create an interception-endpoint you have to create a valid pool.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem listener, pem policy, pem prole
diameter-endpoint, pem prole spm, pem reporting format-script, pem service-chain-endpoint, pem
subscriber, pem subscribers, regex, show, tmsh
irule
Congures an PEM iRule for trafc management system conguration.
Syntax
Congure the irule component within the pem module using the syntax shown in the following sections.
Create/Modify
create irule [name]
edit irule [name]
modify irule [ [ [name] | [glob] | [regex] ] ... ]
Note: When using tmsh, you can only create pem iRule using the editor, which starts when you use the
create or edit commands. You cannot create an pem iRule directly on the command line. The vim editor
applies the autoindent and smartindent options. You can toggle on/off paste mode using the F12 key.
Note: You can also edit user metadata associated with a pem iRule. See the example section for more
information.
Display
list irule
list irule [ [ [name] | [glob] | [regex] ] ... ]
show running-config irule
show running-config irule [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
show irule
show irule [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
1380
PEM
Delete
delete irule [name]
Description
You can apply pem iRules as an action when the trafc matches the lter criteria dened in pem policy
rule. The syntax that you use to write pem iRules is based on the Tools Command Language (Tcl)
programming standard. Thus, you can use many of the standard Tcl commands, plus a robust set of extensions
that the BIG-IP(r) policy enforcement management system provides to help you customize the actions you
want to apply to the trafc.
You cannot edit the system iRules that come with the BIG-IP system. However, you can open a system
iRule in the editor and use it as a template to create a new rule.
To create a new pem iRule using a system rule as a template:
• Enter the command sequence edit irule [system rule name].
tmsh opens the system rule in an editor.
• Change the name of the rule in the editor.
• Edit the rule and exit the editor.
tmsh checks for syntax errors, and if there are none, it saves the new rule.
For more information about iRules(r), see http://devcentral.f5.com/.
Examples
list irule
Displays all iRules.
delete irule my_irule
Deletes the pem iRule named my_irule.
create irule my_irule {
priority 1
when PEM_POLICY {
}
}
Creates a pem iRule named my_irule with priority 1.
modify rule my_irule {
when RULE_INIT {}
metadata replace-all-with {
my_meta {
persist false
value "hello"
}
my_meta2 {
persist false
value "hello 2"
}
}
}
1381
Traffic Management Shell (tmsh) Reference Guide
Modies an existing pem iRule named my_irule by adding a new metadata and modifying an existing
metadata.
The metadata attribute is the user dened key/value pair. Metadata has the following format:
metadata
[add | delete | modify] {
[metadata_name] {
value [ "value content" ]
persist [ true | false ]
}
}
modify irule my_irule {
when RULE_INIT {}
metadata delete { my_meta }
}
Deletes a metadata from a pem iRule.
Options
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the create, delete, and modify
commands.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• metadata
Species the user-dened key/value pair associated with the rule. See the example section for usage
format.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
listener
Congures listeners for the Policy Enforcement Manager (PEM).
Syntax
Modify the listener component within the pem module using the syntax shown in the following sections.
1382
PEM
Create/Modify
create listener [name]
modify listener [name]
app-service [[string] | none]
description [string]
profile-spm [name]
virtual-servers [name] [add | delete | replace-all-with] {
[virtual_server_name ... ]
}
edit listener [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list listener
list listener [ [ [name] | [glob] | [regex] ] ... ]
show running-config listener
show running-config listener [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete listener [name]
Note: You must remove all references to a listener before you can delete the listener.
Description
You can use the listener component to congure listener denitions for the Policy Enforcement Manager.
Examples
create listener lis1 { prole-spm spm1 virtual-servers add {vs_tcp vs_udp} }
Creates a Policy Enforcement Manager listener named lis1.
delete listener lis1
Deletes the listener named lis1.
list listener lis1
Displays the properties of the listener named lis1.
Options
• app-service
1383
Traffic Management Shell (tmsh) Reference Guide
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• prole-spm
Species the spm prole name.
• virtual-servers
Adds, deletes, or replaces a set of virtual servers, by specifying a virtual server name.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem interception-endpoint, pem policy,
pem prole diameter-endpoint, pem prole spm, pem reporting format-script, pem service-chain-endpoint,
pem subscriber, pem subscribers, regex, show, tmsh
policy
Congures policies for the Policy Enforcement Manager (PEM).
Syntax
Modify the policy component within the pem module using the syntax shown in the following sections.
Create/Modify
create policy [name]
modify policy [name]
description [string]
status [enabled | disabled]
transactional [enabled | disabled]
rules [add | delete | modify | replace-all-with] {
[rule_name ... ] {
app-service [[string] | none]
classification-filters [add | delete | modify | replace-all-with] {
[filter_name ...] {
app-service [[string] | none]
application [application_name]
category [category_name]
operation [match | nomatch]
}
}
dscp-marking-downlink [integer]
dscp-marking-uplink [integer]
dtos-tethering {
dtos-detect [enabled | disabled]
tethering-detect [enabled | disabled]
report {
dest {
hsl {
format-script [ [format_script_name] | none]
publisher [ [publisher_name] | none ]
}
}
}
1384
PEM
}
flow-info-filters [add | delete | modify | replace-all-with] {
[filter-name ...] {
app-service [[string] | none]
dscp-code [integer]
dst-ip-addr [ip address/prefixlen]
dst-port [port]
from-vlan [vlan_name]
l2-endpoint [disabled | vlan]
operation [match | nomatch]
ip-addr-type [IPv4 | IPv6 | any]
proto [ tcp | udp | any]
src-ip-addr [ip address/prefixlen]
src-port [port]
}
}
flow-info-filters [none]
forwarding {
endpoint [forwarding_endpoint_name]
fallback-action [drop | continue]
internal-virtual [name]
icap-type [request | response | both | none]
type [icap | pool | route-to-network | none]
}
gate-status [enabled | disabled]
http-redirect {
redirect-url [string]
fallback-action [drop | continue]
}
intercept [intercept_endpoint_name]
l2-marking-downlink [integer]
l2-marking-uplink [integer]
modify-http-hdr {
name [header_name]
operation [insert | none | remove]
value-content [header_value]
value-type [string | tcl-snippet]
}
insert-content {
duration [integer]
frequency [always | once | once-every]
position [append | prepend]
tag_name [name]
value-content [string]
value-type [string | tcl-snippet]
}
precedence [integer]
qoe-reporting {
dest {
hsl {
format-script [ [format_script_name] | none]
publisher [ [publisher_name] | none ]
}
}
}
reporting {
dest {
gx {
monitoring-key [name]
}
hsl {
publisher [name]
format-script [name]
session-reporting-fields
[add | delete | replace-all-with] {
[reporting field ... ]
1385
Traffic Management Shell (tmsh) Reference Guide
}
flow-reporting-fields
[add | delete | replace-all-with] {
[reporting field ... ]
}
transaction-reporting-fields
[add | delete | replace-all-with] {
[reporting field ... ]
}
}
radius-accounting {
radius-aaa-virtual [name]
}
}
granularity [flow | session | transaction]
interval [integer]
transaction {
http {
hostname-len [integer]
uri-len [integer]
user-agent-len [integer]
}
}
volume {
downlink
total
uplink
}
}
quota {
rating-group [name]
reporting-level [rating-group | service-id]
}
qos-rate-pir-downlink [bwc policy name | none]-> [category name | none]
qos-rate-pir-uplink [bwc policy name | none]-> [category name | none]
service-chain [service chain endpoint name]
tcl-filter [tcl-script]
url-categorization-filters [add | delete | modify | replace-all-with] {
[filter_name ...] {
category [category_name]
operation [match | nomatch]
}
}
}
}
rules [none]
edit policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list policy
list policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config policy
show running-config policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1386
PEM
one-line
partition
show policy
show policy [name]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete policy [name]
Note: You must remove all references to a policy before you can delete the policy.
Description
You can use this policy component to congure the policy denitions on the Policy Enforcement Manager.
A policy is a set of rules which are used to match trafc ow and apply actions. A rule has conguration
for lters and actions. All congured lters must match before the actions can be applied to the trafc ow.
There are four lters: classication-lter, url-category-lter, ow-info-lter, and tcl-lter. Classication-lter
allows for matching the trafc based on the ow L7 features, such as a specic application (for example,
Google Mail) or application category (for example, Web). URL-category-lter allows for matching the type
of URL, such as adult content. Flow-info-lter allows for matching the trafc using L2-L4 ow parameters.
Tcl-lter provides a customized method to match trafc ows using iRule commands. The actions can be
steering or/and reporting. Steering allows the user to manipulate the trafc when all congured lters match
the ow. The steering options can be forwarded (option forwarding), drop/pass(option gate-status),
redirect(option http-redirect), or intercept(option intercept). Reporting allows the user to report the usage
to different endpoints by different output formats. The reporting options can be gx or hsl. Policy attribute
transactional allow policy enforcement for HTTP trafc for each transaction. Quota allows users to do
quota management over Gy by specifying the rating group, which has all the parameters associated.
Examples
create policy my_policy rules add {
rule_1 {
flow-info-filters {
flow_1 {
dscp-code 8
}
flow_2 {
dst-port 80
}
forwarding {
endpoint server1
fallback-action continue
}
}
precedence 1
}
rule_2 {
reporting {
dest {
hsl {
1387
Traffic Management Shell (tmsh) Reference Guide
endpoint-id pem_hsl
format-script fm1
}
}
granularity flow
volume {
total 5000
}
}
precedence 2
}
}
Creates a Policy Enforcement Manager policy named my_policy with two rules, rule_1 and rule_2. rule_1
denes the ow-info-lters so that when the ow with DSCP is 8 or destination port is 80, the trafc will
be forwarded to server1. rule_2 denes a ow-based reporting rule which will send ow usage record to
pem_hsl endpoint using format script dened in fm1 whenever total increases by 5000 bytes.
delete policy my_policy
Deletes the policy named my_policy.
list policy my_policy
Displays properties of the policy named my_policy.
Options
• app-service
Species the name of the application service to which the policy belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the policy. Only the application service can modify or delete the policy.
• description
User dened description.
• transactional
Indicate the policy enable or disable policy enforcement for each HTTP transaction.
• partition
Displays the administrative partition within which the policy resides.
• rules
Adds, deletes, or replaces a set of rules, by specifying a rule name. If a rule by the specied name does
not exist, it will be created. You can congure the following options for a rule:
• app-service
Species the name of the application service to which the rule belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the rule. Only the application service can modify or delete the rule.
• classication-lters
Adds, deletes, or replaces a set of classication-lters. You can congure the following options for
a classication-lter.
• app-service
1388
PEM
Species the name of the application service to which the classication-lter belongs. The default
value is none. Note: If the strict-updates option is enabled on the application service that owns
the object, you cannot modify or delete the rule. Only the application service can modify or delete
the classication-lter.
• application
Species the name of the application where the rule applies to the trafc. The default value is
none.
• category
Species the name of the category of applications where the rule applies to the trafc. The default
value is none.
• operation
The options match and nomatch indicate the trafc ow must match or not match the condition
specied in the classication lter. The default value is match.
• dscp-marking-downlink
Species the action to modify the DSCP code in the downlink packet when the trafc ow matches
the rule matching criteria. The range is 0 to 63, or pass-through. The default value is pass-through,
indicating the DSCP code of the downlink packet will not be changed when the trafc ow matches
the rule.
• dscp-marking-uplink
Species the action to modify the DSCP code in the uplink packet when the trafc ow matches
the rule matching criteria. The range is 0 to 63, or pass-through. The default value is pass-through,
indicating the DSCP code of the uplink packet will not be changed when the trafc ow matches
the rule.
• dtos-tethering
Denes the device type & OS and tethering detection action and its options.
• dtos-detect
Species the device type & OS detection to be enabled or disabled. Default is disabled
• tethering-detect
Species the tethering detection to be enabled or disabled. Default is disabled
• report
You can congure the following options for dtos and tethering reporting.
• dest
You can congure the following options for destination.
• hsl
You can congure the following options for hsl publisher.
• publisher
Species the publisher name.
• format-script
Species the format script name to format the HSL output string format.
• ow-info-lters
1389
Traffic Management Shell (tmsh) Reference Guide
Adds, deletes, or replaces a set of the ow-info-lters. The ow info lter denes the ow conditions
(Layer 4) that the trafc should meet (or not meet) for this enforcement policy rule to apply. You
can congure the following options for a ow-info-lter.
• app-service
Species the name of the application service to which the ow-info-lter belongs. The default
value is none. Note: If the strict-updates option is enabled on the application service that owns
the object, you cannot modify or delete the rule. Only the application service can modify or delete
the ow-info-lter.
• dscp-code
Species the value of DSCP code which matches incoming trafc based on a value in the DSCP
eld in the IP header. The range is 0 to 63, or disabled. The default value is disabled, indicating
that the DSCP code will not be used to lter the packet in the ow-info-lter.
• dst-ip-addr
Species the destination IP address and prex length that the rule applies to. The format is [ip
address/prexlen]. The default value is 0.0.0.0/0.
• dst-port
Species the destination port against which the packet will be compared. The default value is
any.
• from-vlan
Species the name of the source vlan to match the ingress ow arriving from that vlan.
• l2-endpoint
Species an L2 endpoint type to be used when matching the trafc ows. The default value is
disabled, indicating that L2 endpoint is not used for matching the ows. You can congure the
following options:
• disabled
Flows are not matched based on the L2 endpoint specication.
• vlan
The vlan name specied in from-vlan is used to match the trafc ows.
• operation
Species whether the rule applies to trafc that matches (match) or does not match (nomatch)
the trafc ow dened here. The options are match and nomatch. The default value is match.
• proto
Species the protocol that this rule applies to. The options are any, tcp, and udp. The default
value is any.
• ip-add-type
Species the ip address type (IPv4 or IPv6) that this rule applies to. The options are any, IPv4,
and IPv6. The default value is any.
• src-ip-addr
Species the source IP address and prex length that the rule applies to. The format is [ip
address/prexlen]. The default value is 0.0.0.0/0.
• src-port
Species the source port of the network you want the rule to affect. The default value is any.
• forwarding
1390
PEM
Manages the forwarding action and its attributes.
• endpoint
Species the forwarding endpoint. The endpoint can be icap, pool or route-to-network. Depending
on the type chosen ow can be steered to icap server, pool or to the network.
• fallback-action
Species whether the connection should continue unchanged or should be dropped in the event
the forwarding action fails for any reason. The options are: drop or continue, and the default is
drop.
• internal-virtual
Species the internal virtual server name if the type selected is icap.
• icap-type
Denes the ICAP adaptation type: request only adaptation, request and response adaptation or
both types of adaptations combined.
• type
Species the type of forwarding action.
• gate-status
Species, when set to enabled, that the trafc can pass through the system without being changed.
Set disabled to drop trafc that this rule applies to. The options are disabled and enabled. The
default is enabled.
• http-redirect
Manages the HTTP redirect action and its attributes.
• redirect-url
Species the HTTP redirection URL.
• fallback-action
Species whether the connection should continue unchanged or should be dropped in the
event the forwarding action fails for any reason. The options are: drop or continue, and the
default is drop.
• intercept
Species the name of the intercept endpoint.
• l2-marking-downlink
Set Layer-2 Quality of Service Marking in downlink trafc that matches a rule. Setting a L2 QoS
Marking affects the packet delivery priority. The range is 0 to 7, or pass-through. The default
value is pass-through, indicating the L2 QoS Marking of the packet will not be changed when
the packet matches the rule.
• l2-marking-uplink
Set Layer-2 Quality of Service Marking in uplink trafc that matches a rule. Setting a L2 QoS
marking affects the packet delivery priority. The range is 0 to 7, or pass-through. The default
value is pass-through, indicating the L2 QoS Marking of the packet will not be changed when
the packet matches the rule.
• modify-http-hdr
Species the action to modify the HTTP header when the trafc ow matches the rule matching
criteria. You can congure the following options for modifying the HTTP header.
• name
1391
Traffic Management Shell (tmsh) Reference Guide
Species the HTTP header name used by the operation option to modify the HTTP header.
• operation
Species the operation used to modify the HTTP header. The options are insert, none, and
remove. The default value is none which indicates that no HTTP header modications will
be made.
• value-content
Species the HTTP header value content used by the operation option to modify the HTTP
header. Based on the selected value-type option, the content format will be interpreted either
as a string or a tcl snippet. Note: This eld is applicable only when the operation option is
set to insert.
• value-type
Species the type of content format used in the value-content eld. The options are string
and tcl-snippet. The default value is string which indicates that the value-content eld will
be interpreted as a string.
• insert-content
Species the action to insert content into the webpage.
• duration
Species the periodicity of the insert action. Note: This value is useful only when the
frequency is set to once-every.
• frequency
Species the frequency of the insert content action. It can take values once, once-every,
always.
The options are:
• always
Species if the action need to be applied always on the matched ow.
• once
Species if the action need to be applied once per subscriber.
• once-every
Species if the action need to be applied once-every time interval congured in duration
per subscriber.
• position
Species the position with respect to the tag name congured. It can take values append,
prepend.
• value-content
Species the value content to be inserted into the webpage. Based on the selected value-type
option, the content format will be interpreted either as a string or a tcl-snippet.
• value-type
Species the type of content format used in the value-content eld. The options are string
and tcl-snippet. The default value is string which indicates that the value-content eld will
be interpreted as a string.
• tag_name
Species the tag name to which the content is either appended or prepended.
1392
PEM
• precedence
Species the precedence for the rule in relation to the other rules. The range is 1 to 4294967295
where 1 has the highest precedence. A rule with higher precedence is evaluated at a high priority.
It is mandatory to specify precedence when creating a rule in a policy.
• qoe-reporting
You can congure the following options for Quality-of-Experience (QoE) reporting.
• dest
You can congure the following options for destination.
• hsl
You can congure the following options for hsl publisher.
• publisher
Species the publisher name.
• format-script
Species the format script name to format the HSL output string format.
• reporting
You can congure the following options for reporting.
• dest
You can congure the following options for destination.
• gx
You can congure the following options for gx endpoint.
• monitoring-key
Species the monitoring-key.
• hsl
You can congure the following options for hsl endpoint.
• publisher
Species the publisher.
• format-script
Species the format script name to format the HSL output string format.
• session-reporting-elds
Species the session elds and their order based on which messages should be
published.
• 3gpp-parameters
Reports the 3gpp-parameters of the session subscriber.
• application-id
Reports the application/category ID that is classied for this session.
• called-station-id
Reports the called station ID of the session subscriber.
• calling-station-id
1393
Traffic Management Shell (tmsh) Reference Guide
Reports the calling station ID of the session subscriber.
• concurrent-ows
Reports the number of concurrent ows of this session.
• downlink-volume
Reports the aggregate incoming bytes for the trafc associated with this session.
• duration-seconds
Reports the total duration of all the ows belonging to the trafc associated with
this session.
• last-record-sent
Reports the time (seconds) when sending the last record.
• new-ows
Reports the number of new ows associated with this session since last record.
• observation-time-seconds
Reports the timestamp of the record.
• record-reason
Reports the reason for sending the record.
• record-type
Reports the reporting record type as 3 : session based record.
• report-id
Reports the reporting module ID.
• report-version
Reports the format version of this record.
• subscriber-id
Reports the subscriber ID that of this session.
• subscriber-id-type
Reports the ID type of the subscriber of this session.
• successful-transactions
Reports the total number of successful transactions associated with this session.
• terminated-ows
Reports the total number of terminated ows during this session.
• timestamp-msec
Reports the time stamp on this record in milli-seconds.
• total-transactions
Reports the total number of transactions of this session.
• uplink-volume
Reports the aggregate outgoing bytes for the trafc associated with this session.
• ow-reporting-elds
Species the ow elds and their order based on which messages should be published.
• application-id
1394
PEM
Reports the application/category ID that is classied for this ow.
• destination-ip
Reports the destination IP address of the trafc.
• destination-transport-port
Reports the destination port of the trafc.
• downlink-volume
Reports the total number of bytes received for this ow by the subscriber.
• ow-end-milli-seconds
Reports the timestamp (milli-seconds) in UNIX time format when the ow ends.
• ow-end-seconds
Reports the timestamp (seconds) in UNIX time format when the ow ends.
• ow-start-milli-seconds
Reports the timestamp (milli-seconds) in UNIX time format when the ow starts.
• ow-start-seconds
Reports the timestamp (seconds) in UNIX time format when the ow starts.
• observation-time-seconds
Reports the timestamp (seconds) of the record.
• protocol-identier
Reports the transport layer protocol of the ow (TCP or UDP).
• record-type
Reports the reporting record type of the ow: 0 - ow start, 1 - ow end, 2 - ow
interim.
• report-id
Reports the reporting module ID.
• report-version
Reports the format version of this record.
• route-domain
Reports the route domain ID of the ow.
• source-ip
Reports the source IP address of the subscriber that initiates the ow.
• source-transport-port
Reports the source port of the subscriber.
• subscriber-id
Reports the subscriber ID that initiates this ow.
• subscriber-id-type
Reports the ID type of the subscriber that initiates this ow.
• timestamp-msec
Reports the timestamp (milli-seconds) of the record.
• total-transactions
1395
Traffic Management Shell (tmsh) Reference Guide
Reports the total number of transactions of this ow.
• uplink-volume
Reports the number of bytes sent from the subscriber in this ow.
• url-category-id
Reports the ID of the rst URL category that is classied for the ow.
• vlan-id
Reports the Vlan ID of the ow.
• transaction-reporting-elds
Species the transaction elds and their order based on which messages should be
published.
• application-id
Reports the application/category ID that is classied for this transaction.
• destination-ip
Reports the destination IP address of the trafc.
• destination-transport-port
Reports the destination port of the trafc.
• downlink-volume
Reports the number of HTTP response bytes for this transaction.
• http-hostname
Reports the HTTP host name of this trafc.
• http-hostname-truncated
Reports the truncated HTTP host name due to excessive length.
• http-response-code
Reports the HTTP response code of the transaction.
• http-url
Reports the HTTP URL of the transaction.
• http-url-truncated
Reports the truncated HTTP URL of the transaction due to excessive length.
• http-user-agent
Reports the user agent of the HTTP request in this transaction.
• http-user-agent-truncated
Reports the truncated user agent of the HTTP request in this transaction due to
excessive length.
• protocol-identier
Reports the transport layer protocol of the trafc (TCP or UDP).
• record-type
Reports the reporting record type as 10-transactional.
• report-id
Reports the reporting module ID.
1396
PEM
• report-version
Reports the format version of the transaction record.
• route-domain
Reports the route domain ID of the trafc.
• skipped-transactions
Reports the number of transactional reports skipped within the ow since the last
successfully transmission in the transaction.
• source-ip
Reports the source IP address of the subscriber.
• source-transport-port
Reports the source port of the subscriber.
• subscriber-id
Reports the subscriber ID that initiates this transaction.
• subscriber-id-type
Reports the subscriber ID type of the subscriber that initiates this transaction.
• transaction-classication-result
Reports all the classication tokens from the classication engine.
• transaction-end-milli-seconds
Reports the transaction timestamp (milli-seconds) in UNIX time format when the
corresponding HTTP response is received.
• transaction-end-seconds
Reports the transaction timestamp (seconds) in UNIX time format when the
corresponding HTTP response is received.
• transaction-number
Reports the sequential number of transaction in this ow (starting from 1).
• transaction-start-milli-seconds
Reports the transaction timestamp (milli-seconds) in UNIX time format when an
HTTP request is received.
• transaction-start-seconds
Reports the transaction timestamp (seconds) in UNIX time format when an HTTP
request is received.
• uplink-volume
Reports the number of HTTP request bytes for this transaction.
• url-category-id
Reports the ID of the rst URL category that is classied for the transaction.
• vlan-id
Reports the Vlan ID of trafc.
• radius-accounting
You can congure the following options for radius-accounting endpoint.
• radius-aaa-virtual
1397
Traffic Management Shell (tmsh) Reference Guide
Species the internal virtual server for radius-accounting endpoint.
• granularity
Species the type of reporting will be generated when the policy applies. The options are
ow, session and transaction. The default value is session which indicates the session report
will be generated if this policy applies.
• interval
Species the time interval in seconds the report will be generated. The default value is 0
which indicates this feature is disabled.
• transaction
You can congure the following options when the transaction report granularity is selected.
• http
Species the HTTP transaction report options for the following HTTP attributes.
• hostname-len
Species the maximum HTTP hostname string length to include in the HTTP
transaction report. The range is 0 to 65535. The default value is 0.
• uri-len
Species the maximum HTTP URI string length to include in the HTTP transaction
report. The range is 0 to 65535. The default value is 256.
• user-agent-max
Species the maximum HTTP user agent string length to include in the HTTP
transaction report. The range is 0 to 65535. The default value is 0.
• volume
You can congure the following options for volume threshold. The report will be generated
when any of the following conditions happened. If reporting dest is set, either interval must
be set to non-0 or one of volume properties must be set to non-0.
• downlink
The report will be generated if the downlink trafc exceeds the threshold. The default
value is 0 which indicates this feature is disabled.
• total
The report will be generated if the uplink and downlink trafc exceeds the threshold. The
default value is 0 which indicates this feature is disabled.
• uplink
The report will be generated if the uplink trafc exceeds the threshold. The default value
is 0 which indicates this feature is disabled.
• quota
You can congure the following options for quota management.
• rating-group
Species the rating-group name.
• reporting-level
Species the quota reporting level whether per rating group or per service-id.
1398
PEM
• qos-rate-pir-downlink
Species the congured bandwidth control policy for Peak Information Rate (PIR) to apply to
downlink trafc that matches this rule. Use none to reset bwc policy name or category name.
• qos-rate-pir-uplink
Species the congured bandwidth control policy for Peak Information Rate (PIR) to apply to
uplink trafc that matches this rule. Use none to reset bwc policy name or category name.
• service-chain
Species where to forward the trafc affected by this rule.
• tcl-lter
Species the tcl expression which uses iRule commands to lter the packet. It is a match if
tcl-lter returns TRUE/1 or nomatch if FALSE/0. All congured lters (ow-info-lters,
classication-lters, and tcl-lter) must match before rule actions are applied.
• url-categorization-lters
Adds, deletes, or replaces a set of url-categorization-lters. You can congure the following options
for a url-categorization-lter.
• app-service
Species the name of the application service to which the url-categorization-lter belongs. The
default value is none. Note: If the strict-updates option is enabled on the application service
that owns the object, you cannot modify or delete the rule. Only the application service can
modify or delete the url-categorization-lter.
• url-category
Species the name of the url-category of the trafc where the rule applies. The default value is
none.
• operation
The options match and nomatch indicate the trafc ow must match or not match the condition
specied in the classication lter. The default value is match.
• status
Species the current status of the policy. The options are disabled and enabled. The default value
is enabled.
See Also
create, delete, edit, glob, list, ltm prole qoe, modify, pem forwarding-endpoint, pem interception-endpoint,
pem listener, pem prole diameter-endpoint, pem prole spm, pem reporting format-script, pem
service-chain-endpoint, pem subscriber, pem subscribers, regex, reset-stats, show, tmsh
service-chain-endpoint
Congures service chain endpoints for the Policy Enforcement Manager (PEM).
Syntax
Modify the service-chain-endpoint component within the pem module using the syntax shown in the
following sections.
1399
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create service-chain-endpoint [name]
modify service-chain-endpoint [name]
app-service [[string] | none]
service-endpoints [add | delete | modify | replace-all-with] {
[service endpoint name ... ] {
app-service [[string] | none]
forwarding-endpoint
to-endpoint [forwarding endpoint name]
from-vlan [vlan name]
http-adapt-service
internal-virtual [internal virtual server | none]
icap-type [request | response | both | none]
order [integer]
service-option [optional | mandatory]
steering-policy [policy name | none]
}
}
edit service-chain-endpoint [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list service-chain-endpoint
list service-chain-endpoint [ [ [name] | [glob] | [regex] ] ... ]
show running-config service-chain-endpoint
show running-config service-chain-endpoint [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
one-line
partition
Delete
delete service-chain-endpoint [name]
Note: You must remove all references to a service-chain-endpoint before you can delete the
service-chain-endpoint.
Description
You can use the service-chain-endpoint component to congure service-chain-endpoint denitions for
the Policy Enforcement Manager (PEM). Each service-chain-endpoint consists of one or more
service-endpoints, where a service-endpoint consists of a non-zero integer order, existing from-vlan a valid
fwd-endpoint or a http-adapatation-service endpoint. When you congure a BIG-IP that has a
service-chain-endpoint with multiple service-endpoints, trafc will pass through different endpoints choosen
dynamically.
Note: You must create a valid forwarding-endpoint and a valid vlan before you can create a service-endpoint.
If you are enabling http-adapt-service, you must create Request Adapt and Response Adapt proles and
1400
PEM
attach to the trafc virtual. Also create an internal-virtual and enable icap prole. You must also give each
service-endpoint an order from 1 up to 2^32-1. The lower the service-endpoint order is, the higher its
precedence is (i.e., trafc will pass though it before other higher order service-endpoints). Each
service-endpoint has a boolean (true/false) service-option that denes what would happen if the
service-endpoint is down. If service-option is mandatory, the trafc ow is dropped if the service-endpoint
is down. If service-option is optional, the trafc ow will be bypassed to the next available service-endpoint.
For more information about how to create a vlan, please refer to net vlan. Also please refer to pem
forwarding-endpoint for more information about how to create a pem forwarding-endpoint.
Examples
create service-chain-endpoint chain1 service-endpoints add { ser_ep1 { order 10 from-vlan vlan1
forwarding-endpoint { to-endpoint fw_ep1 } service-option optional } ser_ep2 { order 5 from-vlan
vlan2 http-adapt-service {internal-virtual iv1} service-option mandatory } }
Creates a PEM service-chain-endpoint named chain1 that has two service-endpoints: ser_ep1 and ser_ep2.
The rst ser_ep1 has an order of 10 and is optional and has forwarding-endpoint with to-endpoint fw_ep1,
type transparent and vlan1 as a from-vlan. The second ser_ep2 has an order of 5 is mandatory and has
http-adapt-service enabled with ivs1 as internal-server and vlan2 as a from-vlan. Note that ser_ep2 will
precede ser_ep1 because the lower the service-endpoint order is, the higher its precedence is.
delete service-chain-endpoint chain1
Deletes the service-chain-endpoint named chain1.
list service-chain-endpoint chain1
Displays the properties of the service-chain-endpoint named chain1.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• service-endpoints
Adds, deletes, or replaces a set of the service endpoints by specifying a series of service-endpoint names.
If any of these names did not exist before, then new names will be created. Each service-endpoint is
identied by a vlan and a forwarding-endpoint.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you
cannot modify or delete the object. Only the application service can modify or delete the object.
• forwarding-endpoint
Species the forwarding endpoint attributes to be set. The below attributes can be set:
• to-endpoint
This is a default endpoint that will be chosen if steering policy is not congured. You have to
create a valid PEM forwarding-endpoint before you can add to-endpoint to a service-endpoint.
• from-vlan
Species the vlan that the trafc will come from toward the service-endpoint. Note: The vlan has
to exist before you can create a from-vlan eld.
1401
Traffic Management Shell (tmsh) Reference Guide
• http-adapt-service
Species the option to set attributes for http adapt services. Below are the attributes that can be set.
• internal-virtual
This is the internal virtual on which icap is enabled. You have to create the internal-virtual and
assign icap prole before adding here.
• icap-type
Denes the ICAP adaptation type: request only adaptation, request and response adaptation or
both types of adaptations combined.
• order
Species the order of the service-endpoint among other service-endpoints. The lower the
service-endpoint's order is, the more precedence it has (i.e., the trafc will go through the
lowest-ordered service-endpoint rst, then through higher order service-endpoint, ... etc.).
• service-option
Species the behavior when a service-endpoint is not available (i.e., is down). This option is limited
when ICAP is dened as the service-endpoint and will not apply if the ICAP service is unavailable.
You can congure the following options:
• mandatory
If the service-endpoint is down, the trafc ow is dropped.
• optional
If the service-endpoint is down, the trafc ow will be bypassed to the next available
service-endpoint.
• steering-policy
If the steering policy is congured, the policy is evaluated and if steering is enabled the ow will
be steered to the corresponding endpoint.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener,
pem policy, pem prole diameter-endpoint, pem prole spm, pem reporting format-script, pem subscriber,
pem subscribers, regex, show, tmsh
sessiondb
Displays, deletes, modies, and reset-stats a PEM subscriber session record on the BIG-IP(r) system.
Syntax
Use the sessiondb component within the pem module to view, delete, modify or reset statistics on a session
record using the following syntax.
Note: Delete and Modify commands apply to all IP addresses if there are multiple IP addresses in a session.
1402
PEM
Display
show sessiondb subscriber-id [string]
show sessiondb session-ip [ip address]
all-properties
Delete
delete sessiondb
subscriber-id [string]
session-ip [ip address]
Modify
modify sessiondb
subscriber-id [string]
session-ip [ip address]
session-state [marked-for-deletion | not-provisioned | provisioned |
provisioning-pending ]
Reset-Stats
reset-stats sessiondb
subscriber-id [string]
session-ip [ip address]
Description
You can use the sessiondb component to display session record on the BIG-IP system. Additionally, you
can delete, reset-stats and modify a specied session record. Either subscriber-id or session-ip must be
specied as the query key. session-state must be specied in modify command. Wildcard query is not
supported.
When specifying an IP address in show/delete/modify/reset-stats sessiondb session-ip commands, the
route domain ID may be optionally included. The route domain ID follows the IP address and is separated
by '%'. For example, 10.10.10.100%5 is an IP address in route domain 5.
Note: show and reset-stats commands apply to both static and dynamic subscribers. delete and modify
command only apply to dynamic subscribers. The session of static subscribers cannot be deleted. The
session-state of static subscribers cannot be changed. To delete a static subscriber session you have to
delete the static subscriber conguration in pem subscriber.
Examples
show sessiondb subscriber-id 4085551212
Displays the session record of subscriber id 4085551212.
show sessiondb session-ip 10.10.10.100
Displays the session record of session ip address 10.10.10.100.
show sessiondb session-ip 10.10.10.100%5
Displays the session record of session ip address 10.10.10.100 in route domain 5.
1403
Traffic Management Shell (tmsh) Reference Guide
show sessiondb subscriber-id 4085551212 all-properties
Displays the session record of subscriber id 4085551212, and statistics for each IP.
show sessiondb session-ip 10.10.10.100 all-properties
Displays the session record of session ip address 10.10.10.100, and statistics for each IP.
delete sessiondb subscriber-id 4085551212
Deletes the session record of subscriber id 4085551212.
delete sessiondb session-ip 10.10.10.100
Deletes the session record of IP address 10.10.10.100.
delete sessiondb session-ip 10.10.10.100%5
Deletes the session record of IP address 10.10.10.100 in route domain 5.
reset-stats sessiondb subscriber-id 4085551212
Reset the session statistics of subscriber id 4085551212. Flows Current species the active ows and it
cannot be reset.
modify sessiondb subscriber-id 4085551212 session-state provisioned
Modify the session state of subscriber id 4085551212 to provisioned.
Options
• session-ip
Species the IP address of the subscriber session record. You can enter this address in either IPv4 or
IPv6 format.
• subscriber-id
Species the subscriber ID of the subscriber session record.
• session-state
Species the subscriber session state of the subscriber session record that you want to modify. It is only
required in modify command.
The options are:
• marked-for-deletion
Species the subscriber session to be scheduled for deletion.
• provisioned
Species the subscriber session state to be marked as provisioned, regardless of whether the policies
have been assigned or not. The unknown subscriber policies are not applied to the subscriber ows,
even if no subscriber policies are provisioned.
• not-provisioned
Species the subscriber session state to be marked as not-provisioned. No further attempts to provision
the session are made. The unknown subscriber policies are applied to the subscriber ows.
• provisioning-pending
Species the subscriber session state to be marked as having in process of provisioning. This will
trigger a session provisioning request (e.g. Gy CCR request) immediately. If no response is received,
or the provisioning process fails for any reason, another request will be sent after the retry timeout,
until the session is provisioned successfully, or the number of retries is reached.
1404
PEM
See Also
delete, modify, reset-stats, show, tmsh
subscriber
Congures subscribers for the Policy Enforcement Manager (PEM).
Syntax
Modify static subscriber component within PEM module using the syntax shown in the following sections.
Create/Modify
create subscriber [name]
modify subscriber [name]
app-service [[string] | none]
ip-address-list [add | delete | replace-all-with] {
[ip address ...]
}
policies [add | delete | replace-all-with] {
[policy_name ...]
}
policies [default | none]
subscriber-id-type [dhcp | dhcp-custom | e164 | imsi | mac-address |
mac-dhcp | nai | private ]
edit subscriber [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list subscriber
list subscriber [ [ [name] | [glob] | [regex] ] ... ]
show running-config subscriber
show running-config subscriber [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete subscriber [name]
Note: You must remove all references to a subscriber before you can delete the subscriber.
1405
Traffic Management Shell (tmsh) Reference Guide
Description
You can use the subscriber component to congure subscriber denitions for the Policy Enforcement
Manager. Subscriber session IP addresses may optionally include a route domain ID. When specied, the
route domain ID follows the IP address, after '%' separator. For example, 10.10.10.100%5 is an IP address
in route domain 5. A subscriber session may have multiple IP addresses in different route domains.
Examples
create subscriber 4085551212 { ip-address-list add { 10.10.10.2 10.10.10.3 } policies add { policy1 }
subscriber-id-type imsi }
Creates a PEM subscriber 4085551212 with IP addresses 10.10.10.2 and 10.10.10.3, subscriber id type
imsi, and a policy policy1.
create subscriber 4085551212 { ip-address-list add { 10.10.10.2%5 10.10.10.3%77 } policies add {
policy1 } subscriber-id-type imsi }
Creates a PEM subscriber 4085551212 with IP addresses 10.10.10.2 and 10.10.10.3 in route domains 5 and
77 respectively, subscriber id type imsi, and a policy policy1.
create subscriber 4085551212 { ip-address-list add { 10.10.10.2%5 10.10.10.2%77 } policies add {
policy1 } subscriber-id-type imsi }
Creates a PEM subscriber 4085551212 with two IP address entries that consist of the same IP address
10.10.10.2 and different route domain IDs: 5 and 77, subscriber id type imsi, and a policy policy1.
delete subscriber sub1
Deletes the subscriber named sub1.
list subscriber sub1
Displays the properties of the subscriber named sub1.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• name
Species a unique subscriber identier (up to 64 characters). This option is required for the commands
create, delete, and modify.
• ip-address-list
Adds, deletes, or replaces a list of the ip address to associate with the subscriber.
• policies
Adds, deletes, or replaces a set of the policies to associate with the subscriber.
• subscriber-id-type
Species the format to use for the subscriber id. The default value is imsi.
The options are:
• dhcp
For subscribers discovered via DHCP: an identier comprises either Relay Option (option 82) for
DHCPv4 based subscriber IDs or REMOTE-ID and SUBSCRIBER-ID Options (options 37 and 38)
for DHCPv6, as congured in the corresponding DHCP prole.
1406
PEM
• dhcp-custom
For subscribers discovered via DHCP: an identier created using a custom TCL snippet.
• e164
A numbering plan that denes the format of an MSISDN international phone number (up to 15
digits). The number typically consists of three elds: country code, national destination code, and
subscriber number.
• imsi
International Mobile Subscriber Identity. A globally unique code number that identies a GSM,
UMTS, or LTE mobile phone user.
• mac-address
For subscribers discovered via DHCP: subscriber MAC address in a standard IEEE 802 format for
MAC-48 (six groups of two hexadecimal digits, separated by colons ':').
• mac-dhcp
For subscribers discovered via DHCP: a concatenation of mac-address and dhcp identier as
congured in the corresponding DHCP prole.
• nai
Network Access Identier. A fully qualied network name in the form <user>@<realm>; identies
a subscriber and the home network to which the subscriber belongs.
• private
The subscriber id type is private for the given deployment.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener,
pem policy, pem prole diameter-endpoint, pem prole spm, pem reporting format-script, pem
service-chain-endpoint, regex, show, tmsh
subscriber-attribute
Congures subscriber attributes in Policy Enforcement Manager (PEM).
Syntax
Congure the subscriber-attribute component within the pem module using the syntax shown in the
following sections.
Create/Edit/Modify
create subscriber-attribute [name]
modify subscriber-attribute [name]
app-service [[string] | none]
description [string]
export [disabled | enabled]
import [disabled | enabled]
1407
Traffic Management Shell (tmsh) Reference Guide
well-known-attr-id [called-station-id | calling-station-id | imeisv | imsi
| ipaddr | not-defined | subs-id | user-location-info | username]
edit subscriber-attribute [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list subscriber-attribute
list subscriber-attribute [ [ [name] | [glob] | [regex] ] ... ]
show running-config subscriber-attribute
show running-config subscriber-attribute [ [ [name] | [glob] | [regex] ] ...
]
all-properties
non-default-properties
one-line
partition
Delete
delete subscriber-attribute [name]
Note: You must remove all references to a subscriber-attribute before you can delete the subscriber-attribute.
Description
You can use the subscriber-attribute component to congure subscriber attribute denitions in Policy
Enforcement Manager.
Examples
create subscriber-attribute 3gpp_imsi { import enabled export enabled well-known-attr-id imsi}
Creates a PEM subscriber attribute 3gpp_imsi with import enabled, export enabled, and well-known
attribute id 'imsi'.
delete subscriber-attribute 3gpp_imsi
Deletes the PEM subscriber attribute named 3gpp_imsi.
list subscriber-attribute 3gpp_imsi
Displays the properties of the PEM subscriber attribute named 3gpp_imsi.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• export
1408
PEM
Species whether the subscriber attribute can be exported (inserted) to the outgoing messages dened
in pem protocol prole. This conguration is not applicable when referenced in pem protocol prole
radius. It is applicable when referenced in pem protocol prole gx. The default value is enabled.
• import
Species whether the subscriber attribute can be imported (parsed) from the incoming messages dened
pem protocol prole. The default value is enabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the name of the administrative partition within which the subscriber attribute resides.
• well-known-attr-id
Species an identier of a well-known (build-in) subscriber attribute. The system provides a special
handling for well-known subscriber attributes. For instance, most of the well-known attributes are
included into session reporting records by default.
The options are:
• called-station-id
The well-known subscriber attribute ID is called-station-id.
• calling-station-id
The well-known subscriber attribute ID is calling-station-id.
• imeisv
The well-known subscriber attribute ID is imeisv.
• imsi
The well-known subscriber attribute ID is imsi.
• ipaddr
The well-known subscriber attribute ID is ipaddr. It can be ipv4 or ipv6 address.
• not-dened
The well-known subscriber attribute ID is not dened. This is the default value.
• subs-id
The well-known subscriber attribute ID is subs-id.
• user-location-info
The well-known subscriber attribute ID is user-location-info.
• username
The well-known subscriber attribute ID is username.
See Also
create, delete, edit, glob, list, modify, pem protocol prole gx, pem protocol prole radius, pem protocol
diameter-avp, pem protocol radius-avp, regex, show, tmsh
1409
Traffic Management Shell (tmsh) Reference Guide
subscribers
Loads static subscribers for the Policy Enforcement Manager (PEM) from a le.
Syntax
Loads static subscribers from a le within the pem module using the syntax shown in the following sections.
Load
load subscribers le [lename]
Description
You can use the command load pem subscribers to load static subscribers denitions for the Policy
Enforcement Manager (PEM). The maximum number of static subscribers allowed is (2 * sys db variable
tmm.pem.spm.maxsessionlimit) or 100000, whichever is the lesser.
The static subscribers le is a csv le with the following elds: <Subscriber ID>,<Subscriber ID
Type>,<Number of IP address>[,<IP address N>]*[,<Policy N>]+. Each record can have zero IP address
but must have at least one policy.
The maximum number of IP addresses per subscriber is set by sys db variable tmm.pem.session.ip.addr.max.
The maximum number of IPv4 addresses per subscriber is set by sys db variable
tmm.pem.session.ipv4.addr.max.
The maximum number of IPv6 addresses per subscriber is set by sys db variable
tmm.pem.session.ipv6.addr.max.
For example, these are the examples from such le:
subscriber1,e164,2,11.1.1.1,11.1.1.2,bronze,gold,silver
subscriber2,imsi,0,gold
The lename either absolute le name or just the base le name under folder: /var/local/pem/subscribers/
For more information about static subscriber, please refer to pem subscriber module.
Examples
load subscribers le my_ss_le
Loads static subscribers from le "my_ss_le" under the folder: /var/local/pem/subscribers/.
load subscribers le /shared/tmp/new_ss_le
Loads static subscribers from le "new_ss_le" under the folder: /shared/tmp/.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener,
pem policy, pem prole diameter-endpoint, pem prole spm, pem reporting format-script, pem
service-chain-endpoint, regex, show, tmsh
1410
PEM
PEM Global Settings
analytics
Congures the global settings that pertain to Analytics reporting for Policy Enforcement Manager (PEM).
Syntax
Modify the analytics component within the pem global-settings module using the syntax shown in the
following sections.
Modify
modify analytics {
mode [disabled | enabled]
subscriber-aware [disabled | enabled]
logging {
hsl {
endpoint-id [log-publisher]
}
}
}
edit analytics [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list analytics
list analytics [ [ [name] | [glob] | [regex] ] ... ]
show running-config analytics
show running-config analytics [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
You can use the analytics component to congure global settings for analytics reporting.
Examples
modify analytics mode disabled subscriber-aware disabled logging hsl endpoint-id hsl_endpoint
Enables the analytics reporting for PEM and congures logging endpoint as hsl_endpoint.
list analytics
Displays the conguration for analytics settings.
Options
• mode
Species the mode for analytics reporting. It can take enable or disable as value.
• subscriber-aware
Species the subscriber awareness for analytics reporting. It can take enable or disable as value.
• logging
You can congure the following option for logging.
• hsl
You can congure the following options for hsl endpoint.
• endpoint-id
Species the endpoint name.
See Also
create, delete, edit, glob, list, modify, pem listener, pem policy, pem prole diameter-endpoint, pem prole
spm, pem reporting format-script, pem service-chain-endpoint, pem subscriber, pem subscribers, regex,
show, tmsh
insert-content
Congures the global settings that pertain to insert content for Policy Enforcement Manager (PEM).
Syntax
Modify the insert-content component within the pem global-settings module using the syntax shown in
the following sections.
Modify
modify insert-content {
max-duration [value]
}
edit insert-content [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list insert-content
list insert-content [ [ [name] | [glob] | [regex] ] ... ]
show running-config insert-content
1412
PEM Global Settings
show running-config insert-content [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
You can use the insert-content component to congure global settings for content insert functionality.
Examples
modify insert-content max-duration 3600
Modies the content insertion max duration when action is throttled to apply once.
list insert-content
Displays the conguration for insert-content settings.
Options
• mode
Species the max duration for applying insert content action when frequency Once is used.
See Also
create, delete, edit, glob, list, modify, pem listener, pem policy, pem prole diameter-endpoint, pem prole
spm, pem reporting format-script, pem service-chain-endpoint, pem subscriber, pem subscribers, regex,
show, tmsh
quota-mgmt
Congures the global settings that pertain to quota management over Gy for Policy Enforcement Manager
(PEM).
Syntax
Modify the quota-mgmt component within the pem global-settings module using the syntax shown in the
following sections.
Modify
modify quota-mgmt
default-rating-group [rating-group-name]
service-context-id [string]
edit quota-mgmt [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1413
Traffic Management Shell (tmsh) Reference Guide
Display
list quota-mgmt
list quota-mgmt [ [ [name] | [glob] | [regex] ] ... ]
show running-config quota-mgmt
show running-config quota-mgmt [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
You can use the quota-mgmt component to congure global settings for quota management over Gy.
Examples
Congures rg_grp_1 as default rating group and service-context-id as [email protected]. rg_grp_1 should
be dened before.
list quota-mgmt
Displays the conguration for quota-mgmt.
Options
• default-rating-group
Species the default rating group for quota management over Gy.
• service-context-id
Species the service-context-id to be used for CCR message over Gy.
See Also
create, delete, edit, glob, list, modify, pem quota-mgmt rating-group, pem listener, pem policy, pem prole
diameter-endpoint, pem prole spm, pem reporting format-script, pem service-chain-endpoint, pem
subscriber, pem subscribers, regex, show, tmsh
subscriber-activity-log
Congures the global settings that pertain to subscriber activity log messages for Policy Enforcement
Manager (PEM).
Syntax
Modify the subscriber-activity-log component within the pem global-settings module using the syntax
shown in the following sections.
Modify
modify subscriber-activity-log
1414
PEM Global Settings
dynamic-subscriber-ids [add | delete | modify | replace-all-with] {
[id_name ...]
}
dynamic-subscriber-ids [none]
publisher [name]
static-subscriber-ids [add | delete | replace-all-with] {
[id_name ...]
}
static-subscriber-ids [default | none]
subscriber-ip-addresses [add | delete | modify | replace-all-with] {
[ip address/prefixlen ...]
}
subscriber-ip-addresses [none]
edit subscriber-activity-log [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats subscriber-activity-log
Display
list subscriber-activity-log
list subscriber-activity-log [ [ [name] | [glob] | [regex] ] ... ]
show running-config subscriber-activity-log
show running-config subscriber-activity-log [ [ [name] | [glob] | [regex] ]
... ]
all-properties
non-default-properties
one-line
partition
show subscriber-activity-log
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
default
field-fmt
Description
You can use the subscriber-activity-log component to monitor behavior of the subscribers in the
troubleshooting mode by sending activity log messages to one or more destinations. You can add static and
dynamic subscribers by IDs, or by subscriber IP addresses. The activity log messages contain the internal
information exposing the subscribers behavior.
Examples
modify subscriber-activity-log publisher pub1 dynamic-subscriber-ids add { 4081112222 }
Adds dynamic subscriber 4081112222 to troubleshooting mode by sending activity log messages to all
destinations dened in pub1.
list subscriber-activity-log
Displays the list of the subscribers in troubleshooting mode.
1415
Traffic Management Shell (tmsh) Reference Guide
show subscriber-activity-log
Displays the logging statistics of the subscribers in troubleshooting mode.
reset-stats subscriber-activity-log
Resets the logging statistics of the subscribers in troubleshooting mode.
Options
• dynamic-subscriber-ids
Species a list of dynamic subscriber IDs to be in troubleshooting mode.
• publisher
Species the external logging publisher used to send activity log messages to one or more destinations.
• static-subscriber-ids
Species a list of static subscriber IDs to be in troubleshooting mode.
• subscriber-ip-addresses
Species a list of subscriber IP addresses to be in troubleshooting mode.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener,
pem policy, pem prole diameter-endpoint, pem prole spm, pem reporting format-script, pem
service-chain-endpoint, pem subscriber, pem subscribers, regex, show, tmsh
1416
PEM Global Settings
PEM Profile
diameter-endpoint
Congures a Diameter endpoint prole.
Syntax
Congures the diameter-endpoint prole within the pem prole module using the syntax shown in the
following sections.
Modify
modify diameter-endpoint
gx-endpoint {
defaults-from [ [name] | none]
destination-host [string]
destination-realm [string]
fatal-grace-time {
enabled [yes | no]
time [integer]
}
msg-max-retransmits [integer]
msg-retransmit-delay [integer]
origin-host [string]
origin-realm [string]
pem-protocol-profile-gx [ [pem_protocol_profile_gx_name] | none]
product-name [string]
supported-apps [Gx]
}
}
edit diameter-endpoint [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats diameter-endpoint
reset-stats diameter-endpoint [ [ [name] | [glob] | [regex] ] ... ]
Display
list diameter-endpoint
list diameter-endpoint [ [ [name] | [glob] | [regex] ] ... ]
show running-config diameter-endpoint
show running-config diameter-endpoint [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
show diameter-endpoint
show diameter-endpoint [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Description
You can use the diameter-endpoint component to modify or display a diameter-endpoint prole.
Examples
modify gx-endpoint origin-host example-host.example-realm.org origin-realm example-realm
destination-host example-peer.peer-realm.org destination-realm peer-realm.org
Sets the origin and destination of this diameter endpoint.
modify gx-endpoint msg-max-retransmits 8 msg-retransmit-delay 10000
Changes the maximum times a message will be retransmitted to 8 and changes the retransmission delay to
10 seconds.
Options
• defaults-from
Species the name of the object to inherit the settings from.
• destination-host
Species the destination host for diameter messages. This should be a FQDN.
• destination-realm
Species the destination realm for diameter messages. This should be a FQDN.
• fatal-grace-time
You can congure following options for fatal-grace-time. It denes the period that a diameter connection
can be down before all sessions associated with that diameter endpoint are terminated. If the connection
is re-established before fatal-grace-time seconds then the sessions will not be terminated automatically.
• enabled
Species whether fatal-grace-time option is enabled or no.
• time
Species the fatal-grace-time period in seconds.
• msg-max-retransmits
Species the number of times an outgoing request message will be retransmitted before being dropped.
• msg-retransmit-delay
Species the delay in milliseconds after which an unanswered request will be retransmitted.
• origin-host
Species the origin host for diameter messages. This should be a FQDN.
• origin-realm
1418
PEM Profile
Species the origin realm for diameter messages. This should be a FQDN.
• pem-protocol-prole-gx
Species PEM protocol prole to be used when subscriber discovery is enabled. PEM protocol prole
denes mapping of Diameter Gx AVPs to subscriber ID and other PEM subscriber session attributes.
• product-name
Species the string used in the product-name AVP in the capabilities exchange messages.
• supported-apps
Adds, deletes, or replaces a set of the supported applications.
See Also
edit, glob, list, ltm virtual, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener, pem
policy, pem prole spm, pem reporting format-script, pem service-chain-endpoint, pem subscriber, pem
subscribers, regex, reset-stats, show, tmsh
radius-aaa
Congures a PEM radius AAA prole.
Syntax
Congures the radius-aaa prole within the pem prole module using the syntax shown in the following
sections.
Create/Modify
create radius-aaa [name]
modify radius-aaa [name]
app-service [[string] | none]
defaults-from [[name] | none]
description [string]
retransmission-timeout [integer]
shared-secret [string]
password [string]
transaction-timeout [integer]
edit radius-aaa [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius-aaa
list radius-aaa [ [ [name] | [glob] | [regex] ] ... ]
show running-config radius-aaa
show running-config radius-aaa [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1419
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
show radius-aaa
show radius-aaa [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete radius-aaa [name]
Description
You can use the radius-aaa component to create, modify, display, or delete a radius-aaa prole.
Examples
create radius-aaa my_radius_aaa_prole
Creates a custom radius-aaa prole named my_radius_aaa_prole.
list radius-aaa my_radius_aaa_prole
Displays the properties of the radius-aaa prole named my_radius_aaa_prole.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is radiusaaa.
• description
User dened description.
• retransmission-timeout
Species the retransmission timeout value of the Radius-AAA prole in seconds.
• shared-secret
Species the shared secret of the Radius-AAA prole when connecting to the RADIUS server.
• password
Species the password of the Radius-AAA prole for authenticating to the RADIUS server.
• transaction-timeout
Species the transaction timeout value of the Radius-AAA prole in seconds.
• partition
Species the administrative partition within which the prole resides.
1420
PEM Profile
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh
spm
Congures a Subscriber Policy Manager prole.
Syntax
Congures the spm prole within the pem prole module using the syntax shown in the following sections.
Create/Modify
create spm [name]
modify spm [name]
app-service [[string] | none]
defaults-from [[name] | none]
description [string]
global-policies-high-precedence [add | delete | replace-all-with] {
[policy_name ...]
}
global-policies-high-precedence [ default | none ]
global-policies-low-precedence [add | delete | replace-all-with] {
[policy_name ...]
}
global-policies-low-precedence [ default | none ]
unknown-subscriber-policies [add | delete | replace-all-with] {
[policy_name ...]
}
unknown-subscriber-policies [ default | none ]
fast-pem [enable | disable]
fast-vs-name [name]
edit spm [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats spm
reset-stats spm [ [ [name] | [glob] | [regex] ] ... ]
Display
list spm
list spm [ [ [name] | [glob] | [regex] ] ... ]
show running-config spm
show running-config spm [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1421
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
show spm
show spm [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete spm [name]
Description
You can use the spm component to create, modify, display, or delete a spm prole.
Examples
create spm my_spm_prole
Creates a custom spm prole named my_spm_prole.
list spm my_spm_prole
Displays the properties of the spm prole named my_spm_prole.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole. The default value is spm.
• description
User dened description.
• global-policies-high-precedence
Adds, deletes, or replaces a set of the policies.
• global-policies-low-precedence
Adds, deletes, or replaces a set of the policies.
• unknown-subscriber-policies
Adds, deletes, or replaces a set of the policies.
• fast-pem
Species whether fast PEM optimization is enabled or not. The default is enabled.
Species whether fast PEM optimization is enabled or not. PEM optimization will use the fast-vs-name
virtual server for a portion of the trafc. The default is enabled.
• fast-vs-name
1422
PEM Profile
Species the virtual server which will be used in fast PEM optimization when fast-pem is enabled. The
virtual server should have fastL4 prole attached.
• partition
Species the administrative partition within which the prole resides.
See Also
edit, glob, list, ltm virtual, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener, pem
policy, pem prole diameter-endpoint, pem reporting format-script, pem service-chain-endpoint, pem
subscriber, regex, reset-stats, show, tmsh
1423
Traffic Management Shell (tmsh) Reference Guide
PEM Protocol
diameter-avp
Congures diameter AVPs in Policy Enforcement Manager (PEM).
Syntax
Congure the diameter-avp component within the pem protocol module using the syntax shown in the
following sections.
Create/Edit/Modify
create diameter-avp [name]
modify diameter-avp [name]
app-service [[string] | none]
avp-code [integer]
data-type [address | enumerated | float32 | float64 | grouped | integer32
| integer64 | octetstring | rat-type | time | unsigned32 | unsigned64 |
utf8string]
description [string]
length [integer]
parent-avp [ [diameter_avp_name | none]
vendor-id [integer]
edit diameter-avp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list diameter-avp
list diameter-avp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete diameter-avp [name]
Note: You must remove all references to a diameter-avp before you can delete the diameter-avp.
Description
You can use the diameter-avp component to congure Diameter AVP denitions in Policy Enforcement
Manager.
Examples
create diameter-avp user_equipment_value { data-type octetstring avp-code 460 }
Creates a PEM diameter-avp user_equipment_value with avp-code 460 and data-type octetstring.
delete diameter-avp user_equipment_value
Deletes the diameter-avp named user_equipment_value.
list diameter-avp user_equipment_value
Displays the properties of the diameter-avp named user_equipment_value.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• avp-code
Species the avp-code of the Diameter AVP.
• data-type
Species the data type of the Diameter AVP. The default value is octetstring.
Note: The 'V' bit, known as the Vendor-Specic bit, indicates whether the optional vendor-id eld is
present in the AVP header. When set, the AVP code belongs to the specic vendor code address space.
The 'V' bit is dened as ag-vendor-specic property in pem protocol prole gx.
The options are:
• address
The address format is derived from the octetstring AVP base format. It is a discriminated union,
representing, for example a 32-bit (IPv4) or 128-bit (IPv6) address, most signicant octet rst. The
rst two octets of the address AVP represents the AddressType, which contains in address family.
The AddressType is used to discriminate the content and format the remaining octets.
• enumerated
Enumerated is derived from the integer32 AVP Base Format. The denition contains a list of valid
values and their interpretation and is described in the Diameter application introducing the AVP.
• oat32
This represents oating point values of single precision. The 32-bit value is transmitted in network
byte order. The AVP length eld MUST be set to 12 (16 if the 'V' bit is enabled).
• oat64
This represents oating point values of double precision. The 64-bit value is transmitted in network
byte order. The AVP length eld MUST be set to 16 (20 if the 'V' bit is enabled).
• grouped
The data eld is specied as a sequence of AVPs. Each of these AVPs follows - in the order in which
they are specied - including their headers and padding. The AVP length eld is set to 8 (12 if the
1426
PEM Protocol
'V' bit is enabled) plus the total length of all included AVPs, including their headers and padding.
Thus the AVP length eld of an AVP of type grouped is always a multiple of 4.
• integer32
32 bit signed value, in network byte order. The AVP length eld MUST be set to 12 (16 if the 'V'
bit is enabled).
• integer64
64 bit signed value, in network byte order. The AVP length eld MUST be set to 16 (20 if the 'V'
bit is enabled).
• octetstring
The data contains arbitrary data of variable length. Unless otherwise noted, the AVP length eld
MUST be set to at least 8 (12 if the 'V' bit is enabled). AVP Values of this type that are not a multiple
of four-octets in length is followed by the necessary padding so that the next AVP (if any) will start
on 32-bit boundary.
• rat-type
species the value format to be encoded or decoded as the RAT-Type dened in 3GPP TS 29.212.
• time
The time format is derived from the ocetestring AVP base format. The string MUST contain four
octets, in the same format as the rst four bytes are in the NTP timestamp format.
• unsigned32
32 bit unsigned value, in network byte order. The AVP length eld MUST be set to 12 (16 if the 'V'
bit is enabled).
• unsigned64
64 bit signed value, in network byte order. The AVP length eld MUST be set to 16 (20 if the 'V'
bit is enabled).
• utf8string
The utf8string format is derived from the octetstring AVP base format. This is a human readable
string represented using the ISO/IEC IS 10646-1 character set, encoded as an octetstring using the
UTF-8 transformation format described in RFC 2279.
• description
User dened description.
• length
Species the data length of the Diameter AVP.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• parent-avp
Species the name of the parent AVP if it is in a grouped AVP.
• vendor-id
Species the vendor-id of the Diameter VSA.
See Also
create, delete, edit, glob, list, modify, pem protocol prole gx, pem protocol prole radius, pem protocol
radius-avp, pem subscriber-attribute, regex, show, tmsh
1427
Traffic Management Shell (tmsh) Reference Guide
radius-avp
Congures RADIUS AVPs in Policy Enforcement Manager (PEM).
Syntax
Congure the radius-avp component within the pem protocol module using the syntax shown in the
following sections.
Create/Edit/Modify
create radius-avp [name]
modify radius-avp [name]
app-service [[string] | none]
data-type [3gpp-rat-type | 3gpp-user-location-info | integer | ipaddr |
ipv6addr | ipv6prefix | octet | string | time]
description [string]
max-length [integer]
min-length [integer]
type [integer]
vendor-id [integer]
vendor-type [integer]
edit radius-avp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius-avp
list radius-avp [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete radius-avp [name]
Note: You must remove all references to a radius-avp before you can delete the radius-avp.
Description
You can use the radius-avp component to congure RADIUS AVP denitions in Policy Enforcement
Manager.
Examples
create radius-avp imeisv { data-type string type 26 vendor-id 10415 vendor-type 20 }
1428
PEM Protocol
Creates a PEM radius-avp imeisv which is an Vendor Specic Attribute of 3GPP with type value 26.
delete radius-avp imeisv
Deletes the radius-avp named imeisv.
list radius-avp imeisv
Displays the properties of the radius-avp named imeisv.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• data-type
Species the data type of the RADIUS AVP. The default value is string.
The options are:
• 3gpp-rat-type
species the value format to be encoded or decoded as the 3GPP-RAT-Type dened in 3GPP TS
29.061.
• 3gpp-user-location-info
species the value format to be encoded or decoded as the 3GPP-User-Location-Info dened in
3GPP TS 29.061.
• integer
32-bit unsigned integer in network byte order.
• ipaddr
IPv4 address in network byte order.
• ipv6addr
IPv6 address in network byte order.
• ipv6prex
IPv6 prex data format is dened in RFC 3162.
• octet
UTF-8 text [RFC3629], totaling 253 octets or less in length.
• string
string (i.e., binary data), totaling 253 octets or less in length. This includes the opaque encapsulation
of data structures dened outside of RADIUS.
• time
time as a 32-bit unsigned value in network byte order and in seconds since 00:00:00 UTC, January
1, 1970.
• description
User dened description.
• max-length
Species the maximum data length of the RADIUS AVP/VSA. It doesn't include the AVP/VSP header.
The default value is 253.
1429
Traffic Management Shell (tmsh) Reference Guide
• min-length
Species the minimum data length of the RADIUS AVP/VSA. It doesn't include the AVP/VSP header.
The default value is 1.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• type
Species the type of the RADIUS AVP. 26 is for vendor specic attribute (VSA).
• vendor-id
Species the vendor-id of the RADIUS VSA. This property is mandatory if type is 26.
• vendor-type
Species the vendor-type of the RADIUS VSA. This property is mandatory if type is 26.
See Also
create, delete, edit, glob, list, modify, pem protocol prole gx, pem protocol prole radius, pem protocol
diameter-avp, pem subscriber-attribute, regex, show, tmsh
1430
PEM Protocol
PEM Protocol Profile
gx
Congures a Diameter Gx protocol prole in Policy Enforcement Manager (PEM).
Syntax
Congure the gx component within the pem protocol prole module using the syntax shown in the following
sections.
Cp/Create/Edit/Modify
cp gx [source_name] [ destination_name]
create gx [name]
modify gx [name]
app-service [[string] | none]
description [string]
messages [add | delete | modify | replace-all-with] {
[ [message-name] ] {
direction [any | in | out]
message-type [ccr-i | cca-i | ccr-u | cca-u | ccr-t | cca-t | rar
| raa]
avps [add | delete | modify | replace-all-with] {
[ [avp-name] ] {
default [string]
diameter-avp [ [diameter_avp_name] | none]
flag-mandatory [disabled | enabled]
flag-protected [disabled | enabled]
flag-vendor-specific [disabled | enabled]
interim-message-include [disabled | enabled]
parent-label [string]
reporting-message-include [disabled | enabled]
subscriber-attr [ [subscriber_attribute_name] | none]
}
}
}
}
subscriber-id {
avp [ [diameter_avp_name] | none]
type [e164 | imsi | nai | private]
type-avp [ [diameter_avp_name] | none]
}
edit gx [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list gx
list gx [ [ [name] | [glob] | [regex] ] ... ]
show running-config gx
show running-config gx [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete gx [name]
Note: You must remove all references to a PEM protocol prole gx before you can delete it.
Description
You can use the gx component to congure PEM protocol prole gx denitions in Policy Enforcement
Manager.
Examples
create cust_gx messages add {my_ccr direction out message-type ccr { avps add {avp1 { subscriber-attr
3gpp_location diameter-avp user_equipment_value ag-mandatory enabled} } } }
Creates a custom PEM Gx protocol prole cust_gx and adds a message. The message is dened as CCR
on the egress direction. PEM will insert the Diameter AVP as specied in user_equipment_value with the
value stored subscriber attribute 3gpp_location with mandatory ag enabled.
delete gx cust_gx
Deletes the PEM Gx protocol prole named cust_gx.
list gx cust_gx
Displays the properties of the PEM Gx protocol prole named cust_gx.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• messages
Adds, deletes, or replaces a set of messages which specify mapping of Diameter AVPs to subscriber
session attribute for specic Gx message. If a message by the specied name does not exist, it will be
created. You can congure the following options for a message:
• app-service
Species the name of the application service to which the message belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the message. Only the application service can modify or delete the
message.
• direction
1432
PEM Protocol Profile
Species the direction of the message.
The options are:
• any
PEM will process the message in both ingress and egress directions.
• in
PEM will process the message in ingress direction.
• out
PEM will process the message in egress direction.
• message-type
Species the type of the message.
The options are:
• ccr-i
The message is Gx Credit-Control-Request (CCR) Initial.
• cca-i
The message is Gx Credit-Control-Answer (CCA) Initial.
• ccr-u
The message is Gx Credit-Control-Request (CCR) Update.
• cca-u
The message is Gx Credit-Control-Answer (CCA) Update.
• ccr-t
The message is Gx Credit-Control-Request (CCR) Terminate.
• cca-t
The message is Gx Credit-Control-Answer (CCA) Terminate.
• rar
The message is Gx Re-Authorization-Request (RAR).
• raa
The message is Gx Re-Authorization-Answer (RAA).
• avps
Adds, deletes, or replaces a set of mapping between Diameter AVPs and PEM subscriber attributes.
You can congure the following options.
• app-service
Species the name of the application service to which the AVP belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the
object, you cannot modify or delete the avp. Only the application service can modify or delete
the avp.
• default
Species the Diameter AVP default value. When inserting the AVP, the default value is used if
the corresponding subscriber attribute is not dened or is not present.
• diameter-avp
Species the name of the Diameter AVP. The default value is none.
1433
Traffic Management Shell (tmsh) Reference Guide
• ag-mandatory
Species the value of the mandatory ag in the Diameter AVP when inserting into the message.
This ag only applies to Diameter AVP in outgoing message.
• ag-protected
Species the value of the protected ag in the Diameter AVP when inserting into the message.
This ag only applies to Diameter AVP in outgoing message.
• ag-vendor-specic
Species the value of the vendor-specic ag in the Diameter AVP when inserting into the
message. This ag only applies to Diameter AVP in outgoing message.
• interim-message-include
Species whether this AVP needs to be included in the interim-message (ccr-u only) updates
which are generated if there is any change related to session parameters. This ag only applies
to Diameter AVP in outgoing message.
• parent-label
Species how grouped AVPs can be combined. The AVPs with the same parent-label will be
combined in the same grouped AVP.
• reporting-message-include
Species whether this AVP needs to be included in the reporting-message (ccr-u only) updates
which are generated for reporting usage information. This ag only applies to Diameter AVP in
outgoing message.
• subscriber-attr
Species the name of the subscriber session attribute to be mapped to Diameter AVP. The default
value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• subscriber-id
Species how subscriber ID specied by PCRF should be read by PEM.
• avp
Subscription ID comes with type and data in diameter. This eld species the avp in the message
that should be matched to get subscriber ID data in raw format.
• type
Species the subscriber ID type (imsi. e164, private) that PEM will use for the session for the ID
read by avp.
The options are:
• e164
A numbering plan that denes the format of an MSISDN international phone number (up to 15
digits). The number typically consists of three elds: country code, national destination code,
and subscriber number.
• imsi
International Mobile Subscriber Identity. A globally unique code number that identies a GSM,
UMTS, or LTE mobile phone user.
• nai
1434
PEM Protocol Profile
Network Access Identier. A fully qualied network name in the form <user>@<realm>; identies
a subscriber and the home network to which the subscriber belongs.
• private
The subscriber id type is private for the given deployment.
• type-avp
Subscription ID comes with type and data in diameter. type-avp species avp in message that should
be matched.
See Also
create, delete, edit, glob, list, modify, pem protocol prole radius, pem protocol diameter-avp, pem protocol
radius-avp, pem subscriber-attribute, regex, tmsh
radius
Congures a RADIUS protocol prole in Policy Enforcement Manager (PEM).
Syntax
Congure the radius component within the pem protocol prole module using the syntax shown in the
following sections.
Cp/Create/Edit/Modify
cp radius [source_name] [destination_name]
create radius [name]
modify radius [name]
app-service [[string] | none]
description [string]
messages [add | delete | modify | replace-all-with] {
[ [message-name] ] {
direction [any | in | out]
message-type [acct-req-start | acct-req-stop |
acct-req-interim-update]
avps [add | delete | modify | replace-all-with] {
[ [avp-name] ] {
default [string]
ingress-op [ import | none]
radius-avp [ [radius_avp_name] | none]
subscriber-attr [ [subscriber_attribute_name] | none]
}
}
}
}
subscriber-id [add | delete | modify | replace-all-with] {
[ [id-name] ] {
order [integer]
prefix [[string] | none]
radius-avp [[radius_avp_name] | none]
suffix [[string] | none]
}
1435
Traffic Management Shell (tmsh) Reference Guide
}
subscriber-id-type [e164 | imsi | nai | private]
edit radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list radius
list radius [ [ [name] | [glob] | [regex] ] ... ]
show running-config radius
show running-config radius [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete radius [name]
Note: You must remove all references to a pem protocol prole radius before you can delete it.
Description
You can use the radius component to congure pem protocol prole radius denitions in Policy Enforcement
Manager.
Examples
create cust_acct_start messages add { my_acct_start { direction in message-type acct-req-start avps
add { avp1 { subscriber-attr _sys_attr_3gpp_imeisv radius-avp _sys_radius_3gpp_imeisv ingress-op
import } } } }
Creates a custom PEM RADIUS protocol prole cust_acct_start and add a message to dene how the
RADIUS message can be processed. The message is dened as RADIUS accounting on the ingress direction.
The mapping action ingress-op is to extract RADIUS AVP dened in _sys_radius_3gpp_imeisv and store
the value into subscriber attribute _sys_attr_3gpp_imeisv.
delete radius cust_acct_start
Deletes the PEM RADIUS protocol prole named cust_acct_start.
list radius cust_acct_start
Displays the properties of the PEM RADIUS protocol prole named cust_acct_start.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
1436
PEM Protocol Profile
• description
User dened description.
• messages
Adds, deletes, or replaces a set of messages which specify mapping of RADIUS AVPs to subscriber
session attributes for specic Gx message. If a message by the specied name does not exist, it will be
created. You can congure the following options for a message:
• app-service
Species the name of the application service to which the message belongs. The default value is
none. Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the message. Only the application service can modify or delete the
message.
• direction
Species the direction of the message.
The options are:
• any
PEM will process the message in both ingress and egress directions.
• in
PEM will process the message in ingress direction.
• out
PEM will process the message in egress direction.
• message-type
Species the type of the message.
The options are:
• acct-req-start
The message is RADIUS accounting with the value of Acct-Status-Type AVP set to 1 (Start).
• acct-req-stop
The message is RADIUS accounting with the value of Acct-Status-Type AVP set to 2 (Stop).
• acct-req-interim-update
The message is RADIUS accounting with the value of Acct-Status-Type AVp set to 3
(Interim-Update).
• avps
Adds, deletes, or replaces a set of mapping between RADIUS AVPs and PEM subscriber attributes.
You can congure the following options.
• app-service
Species the name of the application service to which the avp belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object,
you cannot modify or delete the message. Only the application service can modify or delete the
avp.
• default
Species the RADIUS AVP default value. When inserting the AVP, the default value is used if
the corresponding subscriber session attribute is not dened or is not present.
1437
Traffic Management Shell (tmsh) Reference Guide
• ingress-op
Species the ingress operation applied when processing the RADIUS AVP. The default value
is none.
The options are:
• import
Species that the RADIUS AVP will be parsed and the value will be stored in the subscriber
attribute.
• none
Species that there is no ingress operation applied to the RADIUS AVP.
• radius-avp
Species the name of the RADIUS AVP. The default value is none.
• subscriber-attr
Species the name of the subscriber session attribute to be mapped to RADIUS AVP. The default
value is none.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• subscriber-id
Adds, deletes, or replaces a set of RADIUS AVPs to form PEM subscriber ID. You can congure the
following options:
• order
Species the order of RADIUS AVPs when constructing the subscriber ID.
• prex
Species the prex string when constructing subscriber ID with the value of the RADIUS AVP.
• radius-avp
Species the value of RADIUS AVP which will be used to construct the subscriber ID.
• sufx
Species the sufx string when constructing subscriber ID with the value of the RADIUS AVP.
• subscriber-id-type
Species the subscriber ID type session attribute value for the session created.
The options are:
• e164
A numbering plan that denes the format of an MSISDN international phone number (up to 15
digits). The number typically consists of three elds: country code, national destination code, and
subscriber number.
• imsi
International Mobile Subscriber Identity. A globally unique code number that identies a GSM,
UMTS, or LTE mobile phone user.
• nai
1438
PEM Protocol Profile
Network Access Identier. A fully qualied network name in the form <user>@<realm>; identies
a subscriber and the home network to which the subscriber belongs.
• private
The subscriber id type is private for the given deployment.
See Also
create, delete, edit, glob, list, modify, pem protocol prole gx, pem protocol diameter-avp, pem protocol
gx-avp, pem subscriber-attribute, regex, tmsh
1439
Traffic Management Shell (tmsh) Reference Guide
PEM Quota Management
rating-group
Congures a rating-group for quota management in Policy Enforcement Manager (PEM).
Syntax
Modify the rating-group component within the pem quota-mgmt module using the syntax shown in the
following sections.
Create/Modify
create rating-group [name]
modify rating-group [name]
app-service [[string] | none]
rating-group-id [integer]
description [string]
request-on-install [yes | no]
default-threshold [integer]
default-validity-time [integer]
default-quota-holding-time [integer]
initial-quota-request {
interval [integer]
volume {
input-octets
output-octets
total-octets
}
default-quota {
interval [integer]
volume {
input-octets
output-octets
total-octets
}
time {
usage-time
consumption-time
}
default-breach-action [terminate | allow | redirect]
default-forwarding-endpoint [name]
edit rating-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list rating-group
list rating-group [ [ [name] | [glob] | [regex] ] ... ]
show running-config rating-group
show running-config rating-group [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete rating-group [name]
Note: You must remove all references to a rating-group object before you can delete it.
Examples
create rating-group rg1 { rating-group-id 1 initial-quota-request { volume { input-octets 1000
output-octets 1000 total-octets 2000 } } default-quota { volume { input-octets 1000 output-octets 1000
total-octets 2000 } } request-on-install yes }
Creates a PEM rating-group named rg1.
delete rating-group rg1
Deletes the rating-group named rg1.
list rating-group rg1
Displays the properties of the rating-group named rg1.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• rating-group-id
Species the rating-group-id that will be used by quota managing endpoint. For instance, this could be
the rating group in case of Gy endpoint.
• request-on-install
Species whether quota has to be requested from the quota managing endpoint (Eg : Gy) when policy
refererring this rating-group is installed for a subscriber or later when ow is initiated.
• default-threshold
Species the default threshold if the quota managing endpoint does not specify threshold.
• default-validity-time
Species the default validity time for the quota in seconds if OCS did not specify it.
• default-quota-holding-time
Species the default quota holding time in seconds for which quota is valid without any usage if not
specied by OCS.
• initial-quota-request
Species the initial quota, that will be requested from the quota managing endpoint. Could be either
time or volume.
1442
PEM Quota Management
• time
Species the time in seconds.
• volume
You can congure the following options for volume initial quota.
• output-octets
Species the initial quota for downlink trafc.
• total-octets
Species the initial quota for total uplink and downlink trafc.
• input-octets
Species the initial quota for uplink trafc.
• default-quota
Species the default quota, that will be used if quota managing endpoint does not respond. Could be
either time or volume.
• time
Species the quota in time.
• usage-time
Species the usage time in seconds.
• consumption-time
Species the quota consumption time in seconds.
• volume
You can congure the following options for volume default quota.
• output-octets
Species the default quota for downlink trafc.
• total-octets
Species the default quota for total uplink and downlink trafc.
• input-octets
Species the default quota for uplink trafc.
See Also
create, delete, edit, glob, list, modify, pem policy, show, tmsh
1443
Traffic Management Shell (tmsh) Reference Guide
PEM Reporting
format-script
Congures format scripts for the Policy Enforcement Manager (PEM).
Syntax
Modify the format-script component within the pem reporting module using the syntax shown in the
following sections.
Create/Modify
create format-script [name]
modify format-script [name]
app-service [[string] | none]
definition [string]
description [string]
edit format-script [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list format-script
list format-script [ [ [name] | [glob] | [regex] ] ... ]
show running-config format-script
show running-config format-script [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Delete
delete format-script [name]
Note: You must remove all references to a format script object before you can delete it.
Description
You can use the format-script component to create scripts for HSL reporting. The scripts use TCL syntax
and dene a custom format that is applied in an enforcement policy rule. The format and elds available
differ depending on whether the rule species session-based or ow-based reporting.
Examples
create format-script fm1 { denition { return "(ow app_id[PEM::ow stats reported app-id],
bytes-in:[PEM::ow stats reported bytes-in])" } }
Creates a PEM reporting format script named fm1.
delete format-script fm1
Deletes the format script named fm1.
list format-script fm1
Displays the properties of the format script named fm1.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• denition
Species a script using TCL syntax that denes a custom format for HSL reporting applied in an
enforcement policy rule. The format and elds available differ depending on whether you are using
session-based or ow-based reporting in the rule.
• Session-based formats:
The options are:
• app-id
Species the application id of the session record.
• bytes-in
Species the aggregate incoming bytes of the session.
• bytes-out
Species the aggregate outgoing bytes of the session.
• last-send-sec
Species the value of seconds of the timestamp since the previous record was sent.
• last-send-usec
Species the value of microseconds of the timestamp since the previous record was sent.
• param-3gpp
Species the comma-separated string of the value of imsi, imeisv, tower-id, and user-name.
• rec-reason
Species the reason for sending report. The values are 1: period time, 2: volume threshold, 3:
subscriber logout, 4: inactivity.
• rec-type
Species the type of the session-based record (always 3).
• subs-id
Species the subscriber id.
• subs-id-type
Species the subscriber id type (e164, imsi, nai, or private).
1446
PEM Reporting
• timestamp-sec
Species the seconds value of the timestamp when the record was generated. The Unix epoch is
1970-01-01T00:00:00Z.
• timestamp-usec
Species the microseconds value of the timestamp when the record was generated.
• Flow-based formats:
The options are:
• app-id
Species the application id of the ow record.
• bytes-in
Species the aggregate incoming bytes of the ow.
• bytes-out
Species the aggregate outgoing bytes of the ow.
• dst-ip
Species the destination ip address of the ow.
• dst-port
Species the destination port of the ow.
• proto
Species the protocol of the ow.
• rec-type
Species the type of the ow-based record. The value is 0: ow init, 1: ow interim, and 2: ow
end.
• src-ip
Species the source ip address of the ow.
• src-port
Species the destination port of the ow.
• subs-id
Species the subscriber id.
• subs-id-type
Species the subscriber id type (e164, imsi, nai, or private).
• ow-start-time-sec
Species the seconds value of the timestamp when the ow starts. The Unix epoch is
1970-01-01T00:00:00Z.
• ow-start-time-usec
Species microseconds value of the timestamp when the ow starts.
• ow-end-time-sec
Species the seconds value of the timestamp when the ow ends. The Unix epoch is
1970-01-01T00:00:00Z.
• ow-end-time-usec
Species microseconds value of the timestamp when the ow ends.
1447
Traffic Management Shell (tmsh) Reference Guide
• timestamp-sec
Species the of seconds value of the timestamp when the record was generated. The Unix epoch
is 1970-01-01T00:00:00Z.
• timestamp-usec
Species the microseconds value of the timestamp when the record was generated.
• description
Species a user-dened description.
See Also
create, delete, edit, glob, list, modify, pem forwarding-endpoint, pem interception-endpoint, pem listener,
pem policy, pem prole diameter-endpoint, pem prole spm, pem service-chain-endpoint, pem subscriber,
pem subscribers, regex, show, tmsh
1448
PEM Reporting
PEM Stats
action
Displays and resets PEM policy action statistics.
Syntax
Display statistics for the action component within the pem stats module using the syntax in the following
section.
Display
show action
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the action component to display PEM policy action statistics. The statistics details are described
below:
• Pass
Species the number of ows that are passed (gate enabled).
• Drop
Species the number of ows that are dropped (gate disabled).
• Clone
Species the number of ows to which clone actions apply.
• HTTP Redirect
Species the number of ows to which redirection actions apply.
• ICAP Request
Species the number of ows to which ICAP actions apply on the request direction.
• ICAP Response
Species the number of ows to which ICAP actions apply on the response direction.
• Steering
Species the number of ows to which steering actions apply.
• Service Chain
Species the number of ows to which steering endpoint actions apply.
• Steering on Response
Species the number of ows to which steering actions apply on the response direction.
• QoS Uplink
Species the number of uplink ows to which QoS actions apply. Uplink means to network.
• QoS Downlink
Species the number of downlink ows to which QoS actions apply. Downlink means to subscriber.
• DSCP Marking Uplink
Species the number of uplink ows with DSCP action applies.
• DSCP Marking Downlink
Species the number of downlink ows with DSCP action applies.
• HTTP Headers Modify
Species the number of HTTP Headers Modify actions.
• Insert Content
Species the number of Insert Content actions.
• iRule
Species the number of iRule actions.
• L2 Marking Uplink
Species the number of uplink ows to which L2 Marking actions apply.
• L2 Marking Downlink
Species the number of downlink ows to which L2 Marking actions apply.
• Flow Reporting
Species the number of actions of ow reporting record generation applied.
• Session Reporting
Species the number of actions of session record generation applied.
• Transaction Reporting
Species the number of actions of transaction record generation applied.
• Policy Re-evaluation Rate (count/min)
Species the number of successful policy reevaluations per minute.
• Policy Re-evaluation Rate Maximum
Species the maximum number of policy reevaluations overall for all subscribers and ows.
• Media Quality-of-experience (QoE)
Species the number of actions of media Quality-of-experience (QoE) record generation applied.
You can reset the PEM policy action statistics using reset-stats command.
Examples
show action
Displays the PEM policy action statistics.
reset-stats action
Resets the PEM policy action statistics.
Options
For information about the options that you can use with the command show, see help show.
1450
PEM Stats
See Also
show, pem stats gx, pem stats gy, pem stats hsl, pem stats radius, pem stats subscriber, tmsh
dtos
Displays and resets PEM dtos statistics.
Syntax
Display statistics for the dtos component within the pem stats module using the syntax in the following
section.
Display
show dtos
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the dtos component to display PEM dtos statistics. The statistics details are described below:
• TAC Database
Species the number of TAC database queries and successful lookups since the last reset of the counter.
• TCP Fingerprint
Species the number of TCP ngerprint queries and successful OS identication since the last reset of
the counter.
• User-agent
Species the number of user-agent queries and successful OS identication since the last reset of the
counter.
You can reset the PEM dtos statistics using reset-stats command.
Examples
show dtos
Displays the PEM dtos statistics.
reset-stats dtos
Resets the PEM dtos statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, pem stats action, pem stats gx, pem stats gy, pem stats radius, pem stats subscriber, pem stats hsl,
tmsh
1451
Traffic Management Shell (tmsh) Reference Guide
gx
Displays and resets PEM gx statistics.
Syntax
Display statistics for the gx component within the pem stats module using the syntax in the following
section.
Display
show gx
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the gx component to display PEM gx statistics. The statistics details are described below:
• Concurrent Sessions
Species the number of active Gx sessions established.
• Concurrent Sessions Maximum
Species the maximum number of active Gx sessions observed since the last reset of the counter.
• Sessions Created
Species the total number of Gx sessions observed since the last reset of the counter.
• Non Provisioned Sessions
Species the current number of inactive Gx sessions for which provisioning or creation error happened.
• Non Provisioned Sessions Maximum
Species the maximum number of inactive Gx sessions for which provisioning or creation error happened.
• Provisioning Initiated
Species the current number sessions for which provisioning or creation over Gx has been initiated.
• Provisioning Initiated Maximum
Species the maximum number sessions for which provisioning or creation over Gx has been initiated.
• Error Messages Received
Species the number of erroneous messages or response with error code received (may be separated to
two counters).
• Termination Initiated
Species the current number of Gx sessions for which close is initiated.
• Termination Initiated Maximum
Species the maximum number of Gx sessions for which close is initiated.
• Sessions Terminated
Species the total number of Gx sessions terminated since the last reset of the counter.
• CCR Sent
1452
PEM Stats
Species the number of CCR requests of all types sent.
• CCA Received
Species the number of CCA responses of all types received.
• CCR Initial Sent
Species the number of CCR Initial requests sent since the last reset of the counter.
• CCA Initial Received
Species the number of CCA Initial responses received since the last reset of the counter.
• CCR Update Sent
Species the number of CCR Update requests sent since the last reset of the counter.
• CCA Update Received
Species the number of CCA Update responses received since the last reset of the counter.
• RAR Received
Species the number of RAR received.
• RAA Sent
Species the number of RAA sent.
• CCR Usage Monitoring Sent
Species the number of CCR with usage monitoring report sent.
• CCA Usage Monitoring Received
Species the number of CCA with usage monitoring report ack received.
• CCR Termination Sent
Species the number of CCR Termination requests sent since the last reset of the counter.
• CCA Termination Received
Species the number of CCA Termination responses received since the last reset of the counter.
You can reset the PEM gx statistics using reset-stats command.
Examples
show gx
Displays the PEM gx statistics.
reset-stats gx
Resets the PEM gx statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, pem stats action, pem stats gy, pem stats hsl, pem stats radius, pem stats subscriber, tmsh
1453
Traffic Management Shell (tmsh) Reference Guide
gy
Displays and resets PEM gy statistics.
Syntax
Display statistics for the gy component within the pem stats module using the syntax in the following
section.
Display
show gy
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the gy component to display PEM gy statistics. The statistics details are described below:
• Concurrent Sessions
Species the number of active Gy sessions established.
• Concurrent Sessions Maximum
Species the maximum number of active Gy sessions observed since the last reset of the counter.
• Sessions Created
Species the total number of Gy sessions observed since the last reset of the counter.
• Non Provisioned Sessions
Species the current number of inactive Gy sessions for which provisioning or creation errors happen.
• Non Provisioned Sessions Maximum
Species the maximum number of inactive Gy sessions for which provisioning or creation errors happen.
• Provisioning Initiated
Species the current number of sessions for which provisioning or creation over Gy has been initiated.
• Provisioning Initiated Maximum
Species the maximum number of sessions for which provisioning or creation over Gy has been initiated.
• Error Messages Received
Species the number of erroneous messages or response with error code received (may be separated to
two counters).
• Termination Initiated
Species the current number of Gy sessions for which close is initiated.
• Termination Initiated Maximum
Species the maximum number of Gy sessions for which close is initiated.
• Sessions Terminated
Species the total number of Gy sessions terminated since the last reset of the counter.
• CCR Sent
1454
PEM Stats
Species the number of CCR requests of all types sent.
• CCA Received
Species the number of CCA responses of all types received.
• CCR Initial Sent
Species the number of CCR Initial requests sent since the last reset of the counter.
• CCA Initial Received
Species the number of CCA Initial responses received since the last reset of the counter.
• CCR Update Sent
Species the number of CCR Update requests sent since the last reset of the counter.
• CCA Update Received
Species the number of CCA Update responses received since the last reset of the counter.
• RAR Received
Species the number of RAR received.
• RAA Sent
Species the number of RAA sent.
• CCR Termination Sent
Species the number of CCR Termination requests sent since the last reset of the counter.
• CCA Termination Received
Species the number of CCA Termination responses received since the last reset of the counter.
You can reset the PEM gy statistics using reset-stats command.
Examples
show gy
Displays the PEM gy statistics.
reset-stats gy
Resets the PEM gy statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, pem stats action, pem stats gx, pem stats hsl, pem stats radius, pem stats subscriber, tmsh
hsl
Displays and resets PEM hsl statistics.
Syntax
Display statistics for the hsl component within the pem stats module using the syntax in the following
section.
1455
Traffic Management Shell (tmsh) Reference Guide
Display
show hsl
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the hsl component to display PEM hsl statistics. The statistics details are described below:
• Session Records
Species the number of Session-based records sent to each HSL endpoint since the last reset of the
counter.
• Flow Start Records
Species the number of Flow Start records sent to each HSL endpoint since the last reset of the counter.
• Flow Interim Records
Species the number of Flow Interim records sent to each HSL endpoint since the last reset of the
counter.
• Flow Stop Records
Species the number of Flow Stop records sent to each HSL endpoint since the last reset of the counter.
• Transaction Records
Species the number of HTTP Transaction records sent to each HSL endpoint since the last reset of the
counter.
• Records Skipped
Species the number of reporting records skipped from being sent the HSL endpoint since the last reset
of the counter.
• Media Quality-of-Experience (QoE) Records
When Media Quality-of-Experience (QoE) reporting is congured, species the number of QoE Records
records sent to each HSL endpoint since the last reset of the counter.
• Media Quality-of-Experience (QoE) Records Skipped
When Media Quality-of-Experience (QoE) reporting is congured, species the number of QoE reporting
records skipped (not real media) from being sent the HSL endpoint since the last reset of the counter.
You can reset the PEM hsl statistics using reset-stats command.
Examples
show hsl
Displays the PEM hsl statistics.
reset-stats hsl
Resets the PEM hsl statistics.
Options
For information about the options that you can use with the command show, see help show.
1456
PEM Stats
See Also
show, pem stats action, pem stats gx, pem stats gy, pem stats radius, pem stats subscriber, tmsh
radius
Displays and resets PEM radius statistics.
Syntax
Display statistics for the radius component within the pem stats module using the syntax in the following
section.
Display
show radius
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the radius component to display PEM radius statistics. The statistics details are described
below:
• Accounting-Start
Species the number of Accounting-Start packets received.
• Accounting-Stop
Species the number of Accounting-Stop packets received.
• Accounting-Interim
Species the number of Accounting-Interim packets received.
• Accounting-Retransmission
Species the number of Accounting-Retransmission packets received.
You can reset the PEM radius statistics using reset-stats command.
Examples
show radius
Displays the PEM radius statistics.
reset-stats radius
Resets the PEM radius statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, pem stats action, pem stats gx, pem stats gy, pem stats hsl, pem stats subscriber, tmsh
1457
Traffic Management Shell (tmsh) Reference Guide
subscriber
Displays and resets PEM subscriber statistics.
Syntax
Display statistics for the subscriber component within the pem stats module using the syntax in the following
section.
Display
show subscriber
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the subscriber component to display PEM subscriber statistics. The statistics details are
described below:
• Concurrent Subscribers
Species the number of concurrent subscribers per device. Note that you can use the db component in
the sys module to congure tmm.pem.spm.maxsessionlimit to set the number of subscribers supported
per processing unit (TMM). Then, the max number of the subscribers per device is set accordingly.
• Concurrent Subscribers Maximum
Species the max number of concurrent subscribers observed since the last reset of the counter.
• Total Subscribers
Species the total number of established subscribers since the last reset of the counter.
• Subscriber Limit Exceeded
Species the counter of the subscribers creation failures, which are caused by exceeding the max number
of subscribers supported by one processing unit (TMM).
• Failed Provisioning Attempts
Species the aggregated number of failed provisioning attempts for all subscribers in the system since
the last reset of the counter. A provisioning attempt fails if a policy server (PCRF) returns an error, or
does not respond for any reason.
• No Radius info
Species the current number of dynamic subscribers triggered by the data trafc without receiving
Radius accounting start.
• No Radius Info Maximum
Species the max number of dynamic subscribers triggered by the data trafc without receiving Radius
accounting start observed since the last reset of the counter.
• Waiting For Provisioning
Species the number of current subscribers waiting for provisioning completed.
• Waiting For Provisioning Maximum
Species the max number of subscribers waiting for provisioning completed observed since the last
reset of the counter.
1458
PEM Stats
• Not Provisioned
Species the number of current subscribers which are not provisioned.
• Not Provisioned Maximum
Species the number of subscribers not provisioned since the last reset of the counter.
• Unknown
Species the number of current subscribers with "Unknown Subscriber Policy" (non-provisioned from
the PCRF). This counter aggregates the counters of subscribers in the state of "Waiting for Provisioning"
and "Not Provisioned".
• Unknown Maximum
Species the max number of subscribers with "Unknown Subscriber Policy" (non-provisioned from
PCRF) since the last reset of the counter.
• Provisioned
Species the number of currently provisioned subscribers.
• Provisioned Maximum
Species the number of provisioned subscribers observed since the last reset of the counter.
• Inactive Subscribers Removed
Species the number of subscribers removed due to inactivity timeout.
• Marked For Deletion
Species the number of current subscribers marked for deletion for any reason.
• Marked For Deletion Maximum
Species the max number of subscribers marked for deletion for any reason observed since the last reset
of the counter.
You can reset the PEM subscriber statistics using reset-stats command.
Examples
show subscriber
Displays the PEM subscriber statistics.
reset-stats subscriber
Resets the PEM subscriber statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, pem stats action, pem stats gx, pem stats gy, pem stats hsl, pem stats radius, tmsh
tethering
Displays and resets PEM tethering statistics.
1459
Traffic Management Shell (tmsh) Reference Guide
Syntax
Display statistics for the tethering component within the pem stats module using the syntax in the following
section.
Display
show tethering
option:
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the tethering component to display PEM tethering statistics. The statistics details are described
below:
• Subscribers Monitored
Species the number of subscribers being monitored for tethering since the last reset of the counter.
• Subscribers Tethering
Species the number of subscribers tethering since the last reset of the counter.
• Subscribers Tethering Maximum
Species the maximum number of subscribers that were found to be tethering at any point since the last
reset of the counter.
You can reset the PEM tethering statistics using reset-stats command.
Examples
show tethering
Displays the PEM tethering statistics.
reset-stats tethering
Resets the PEM tethering statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, pem stats action, pem stats gx, pem stats gy, pem stats radius, pem stats subscriber, pem stats hsl,
tmsh
1460
PEM Stats
Security Analytics
settings
Congure global settings for security (AFM) analytics.
Syntax
Congure the settings component within the security analytics module using the syntax shown in the
following sections.
Modify
modify settings
acl-rules {
collect-client-ip [enabled | disabled]
collect-client-port [enabled | disabled]
collect-dest-ip [enabled | disabled]
collect-dest-port [enabled | disabled]
collect-server-side-stats [enabled | disabled]
}
collected-stats-internal-logging [enabled | disabled]
collected-stats-external-logging [enabled | disabled]
dns {
collect-client-ip [enabled | disabled]
}
dos-l2-l4 {
collect-client-ip [enabled | disabled]
}
l3-l4-errors {
collect-client-ip [enabled | disabled]
collect-dest-ip [enabled | disabled]
}
publisher [name]
smtp-config [name]
stale-rules {
collect [enabled | disabled]
}
Display
list settings
Description
Use the settings component to modify the settings for analytics entity collection for the AFM (advanced
rewall) module.
Examples
modify settings acl-rules { collect-client-ip disabled }
Disables source/client IP analytics collection for ACL rules.
list settings
Displays analytics settings for AFM.
Options
• acl-rules
Firewall (ACL) security statistics collection options.
• collect-client-ip
Species whether source/client IP address should be collected for ACL rule matching.
• collect-client-port
Species whether source/client port should be collected for ACL rule matching.
• collect-dest-ip
Species whether the destination IP address should be collected for ACL rule matching.
• collect-dest-port
Species whether the destination port should be collected for ACL rule matching.
• collect-server-side-stats
Species whether server side statistics (source address translation information, self IP address and
pool member address) should be collected for ACL rule matching.
• collected-stats-internal-logging
Enables or disables the internal logging of the collected statistics.
• collected-stats-external-logging
Enables or disables the external logging of the collected statistics.
• dns
DNS security statistics collection options.
• collect-client-ip
Species whether source/client IP address should be collected for DNS security.
• dos-l2-l4
Network DoS security statistics collection options.
• collect-client-ip
Species whether source/client IP address should be collected for network layer's DoS security.
• l3-l4-errors
Firewall errors statistics collection options.
• collect-client-ip
Species whether source/client IP address should be collected for rewall errors.
• collect-dest-ip
Species whether the destination IP address should be collected for rewall errors.
• publisher
Species the external logging publisher used to send statistical data to one or more destinations.
• smtp-cong
1462
Security Analytics
Species the default SMTP conguration used for exporting CSV or PDF security analytics reports.
• stale-rules
• collect
Species whether statistics about all rewall rules should be collected in order to present information
regarding rule staleness.
See Also
list, modify, show, tmsh, analytics network, analytics dos-l3, analytics dns-dos, analytics dns-protocol
1463
Traffic Management Shell (tmsh) Reference Guide
Security Anti Fraud
engine-update
Runs or loads an Anti-fraud engine update.
Syntax
Run or load the engine-update component within the security anti-fraud module using the syntax in the
following sections:
Load
load engine-update
file [filename]
If optional parameter le lename is specied in the load command, the command loads and installs engine
update from local le instead of the cloud.
Run
run engine-update
Display
list engine-update
all-properties
current-version-create-datetime
download-available
install-datetime
install-user
message
non-default-properties
one-line
partition
progress-status
progress-status-datetime
Description
You can use the engine-update component to run, load or display status of engine update.
Examples
list security anti-fraud engine-update
Displays the status of engine update.
Options
• current-version-create-datetime
Displays the creation time of currently installed engine update version.
• download-available
Displays whether new engine version is available for download from the cloud.
• le
Species the le name from which the engine update is going to be installed when using the load
command. A full path should be specied.
• install-datetime
Displays the time when engine update was installed.
• install-user
Displays the name of the user who installed the last engine update.
• message
Displays the message describing the failure status of engine update.
• partition
Displays the administrative partition within which this object resides.
• progress-status
Displays the engine update progress status.
• progress-status-datetime
Displays the time when engine update progress status was last changed.
See Also
list, security, security anti-fraud, tmsh
profile
Congures a Fraud Protection Service prole.
Syntax
Congure the prole component within the security anti-fraud module using the syntax shown in the
following sections.
Create/Modify
create profile [name]
modify profile [name]
alert-identifier [string]
alert-path [string]
alert-pool [[name] | none]
alert-publisher [[name] | none]
app-service [[string] | none]
auto-transactions {
bot-score [integer]
1466
Security Anti Fraud
click-score [integer]
integrity-fail-score [integer]
min-mouse-move-count [integer]
min-mouse-over-count [integer]
min-report-score [integer]
min-time-to-request [integer]
not-human-score [integer]
tampered-cookie-score [integer]
time-fail-score [integer]
}
before-load-function [[string] | none]
blocking-page {
response-body [string]
response-headers [string]
}
[case-sensitive | case-insensitive]
check-path-info [enabled | disabled]
cloud-service-pool [[name] | none]
cookies {
components-state [string]
components-state-lifetime [[integer] | session]
encryption-disabled [string]
encryption-disabled-lifetime [[integer] | session]
html-field-obfuscation [string]
html-field-obfuscation-lifetime [[integer] | session]
malware-cache [string]
malware-cache-lifetime [[integer] | session]
malware-counter [string]
malware-counter-lifetime [[integer] | session]
malware-forensic [string]
malware-forensic-lifetime [[integer] | session]
malware-guid [string]
malware-guid-lifetime [[integer] | session]
phishing-cache [string]
phishing-cache-lifetime [[integer] | session]
secure-channel [string]
secure-channel-lifetime [[integer] | session]
transaction-data [string]
transaction-data-lifetime [[integer] | session]
user-inspection [string]
user-name [string]
user-name-lifetime [[integer] | session]
}
defaults-from [[name] | none]
description [[string] | none]
forensic {
alert-path [string]
client-domains [none | add | delete | modify | replace-all-with] {
[string] ... }
cloud-config-path [string]
cloud-forensics-mode [integer]
cloud-remediation-mode [integer]
continue-element [string]
exe-location [string]
html [string]
self-post-location [string]
skip-element [string]
skip-path [string]
}
javascript-location [string]
malware {
allowed-domains [none | add | delete | modify | replace-all-with] {
[string] ... }
bait-location [string]
blacklist-words [none | add | delete | modify | replace-all-with] {
[string] ... }
flash-cookie-content [[string] | none]
flash-cookie-location [string]
flash-cookies [enabled | disabled]
1467
Traffic Management Shell (tmsh) Reference Guide
generic-whitelist-words [none | add | delete | modify | replace-all-with]
{ [string] ... }
source-integrity-location [string]
}
mobilesafe {
alert-threshold [integer]
app-integrity {
[enabled | disabled]
android {
score [integer]
signature [[string] | none]
}
ios {
hashes [none | add | delete | modify | replace-all-with] {
value [string] {
version [[string] | none]
}
}
score [integer]
}
}
malware {
android {
custom-malware [none | add | delete | modify | replace-all-with] {
name [string] {
package [string]
score [integer]
}
}
custom-whitelist [none | add | delete | modify | replace-all-with]
{
name [string] {
package [string]
}
}
}
check-custom [enabled | disabled]
check-generic [enabled | disabled]
[enabled | disabled]
ios {
custom-malware [none | add | delete | modify | replace-all-with] {
name [string] {
path [string]
score [integer]
}
}
custom-whitelist [none | add | delete | modify | replace-all-with]
{
name [string] {
path [string]
}
}
}
behaviour-analysis {
run [enabled | disabled]
score [integer]
}
}
mitm {
domains [none | add | delete | modify | replace-all-with] {
name [string] {
dns {
ip-ranges [none | add | delete | modify | replace-all-with]
{address | address-address ... }
spoofing-score [integer]
}
certificate {
forging-score [integer]
hash [string]
1468
Security Anti Fraud
}
}
}
[enabled | disabled]
}
os-security {
android {
untrusted-apps-score [integer]
versions [none | add | delete | modify | replace-all-with] {
priority [integer] {
from [string]
score [integer]
to [string]
}
}
}
[enabled | disabled]
ios {
versions [none | add | delete | modify | replace-all-with] {
priority [integer] {
from [string]
score [integer]
to [string]
}
}
}
}
rooting-jailbreak {
[enabled | disabled]
jailbreak-score [integer]
rooting-score [integer]
}
}
phishing {
allowed-elements [none | add | delete | modify | replace-all-with] {
[string] ...}
allowed-referrers [none | add | delete | modify | replace-all-with] {
[string] ...}
css-attribute-name [string]
css-content [[string] | none]
css-location [string]
expiration-checks [enabled | disabled]
image-location [string]
protected-elements [none | add | delete | modify | replace-all-with] {
[string] ...}
referrer-checks [enabled | disabled]
}
trigger-irule [enabled | disabled]
urls [none | add | delete | modify | replace-all-with] {
name [string] {
app-layer-encryption {
add-decoy-inputs [enabled | disabled]
[enabled | disabled]
fake-strokes [enabled | disabled]
hide-password-revealer [enabled | disabled]
html-field-obfuscation [enabled | disabled]
real-time-encryption [enabled | disabled]
remove-element-ids [enabled | disabled]
remove-event-listeners [enabled | disabled]
stolen-creds [enabled | disabled]
}
auto-transactions {
browser [enabled | disabled]
[enabled | disabled]
non-browser [enabled | disabled]
submit-buttons [none | add | delete | modify | replace-all-with] {
[string] ...}
}
inject-javascript [enabled | disabled]
1469
Traffic Management Shell (tmsh) Reference Guide
login-response {
status-code [[integer] | none]
domain-cookie [[string] | none]
exclude-string [[string] | none]
header [[string] | none]
include-string [[string] | none]
validation [enabled | disabled]
}
malware {
attach-html-to-alerts [enabled | disabled]
auto-learn-form-tags [enabled | disabled]
auto-learn-input-tags [enabled | disabled]
auto-learn-script-tags [enabled | disabled]
domain-availability [enabled | disabled]
enable-symbols [enabled | disabled]
[enabled | disabled]
external-injection [enabled | disabled]
generic-malware [enabled | disabled]
malicious-function [enabled | disabled]
manual-count-form-tags [integer]
manual-count-input-tags [integer]
manual-count-script-tags [integer]
rat-detection [enabled | disabled]
source-integrity [enabled | disabled]
visibility-check [enabled | disabled]
visibility-check-items [none | add | delete | modify |
replace-all-with] { [string] ...}
whitelist-words [none | add | delete | modify | replace-all-with]
{ [string] ...}
}
mobilesafe-encryption [enabled | disabled]
parameters [none | add | delete | modify | replace-all-with] {
name [string] {
attach-to-vtoken-report [enabled | disabled]
check-integrity [enabled | disabled]
encrypt [enabled | disabled]
identify-as-username [enabled | disabled]
method [GET | POST]
mobilesafe-encrypt [enabled | disabled]
obfuscate [enabled | disabled]
substitute-value [enabled | disabled]
}
}
phishing {
capture-users [enabled | disabled]
copy-detection [enabled | disabled]
css-protection [enabled | disabled]
[enabled | disabled]
}
}
}
users [add | delete | modify] {
name [string] {
modes [add | delete] {
mode [block | forensic | inspection | remediation] {
duration [integer]
enforce-policy [enforce | time-limited | unlimited]
first-login-time [date]
}
}
}
}
edit profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1470
Security Anti Fraud
Display
list profile
list profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config profile
show running-config profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete profile [name]
Description
You can use the prole component to create, modify, display, or delete an Anti-Fraud prole.
Note: The users property may be specied only for the commands modify, edit, and list and only when no
other properties are specied. By default, users are not displayed.
Note: The rst-login-time property of user modes may be specied only for the list command.
Examples
create prole my_antifraud_prole
Creates a custom Anti-Fraud prole named my_antifraud_prole with default parameters.
list prole
Displays the properties of all Anti-Fraud proles.
Options
• alert-identier
Species the ID of the customer in the dashboard.
• alert-path
Species the BIG-IP URL path where the alert is sent. This path cannot be none and must start with '/'.
• alert-pool
Species the name of the pool used when the system sends alerts.
• alert-publisher
Species the name of the log publisher used for sending alerts originating from the BIG-IP.
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• auto-transactions
1471
Traffic Management Shell (tmsh) Reference Guide
Species how the system differentiates between human and automatic (bot) transactions. You can
congure the following options for automatic transactions:
• bot-score
Species the score added to an alert that is triggered if the system determines that the client is a bot
and not a human. The default is a score of 50.
• click-score
Species the score added to an alert that is triggered if the min-mouse-over-count and
min-mouse-move-count conditions are not met. The default is a score of 40.
• integrity-fail-score
Species the score added to an alert that is triggered if the system detects a difference between the
actual parameter value and the expected value of a protected parameter sent after a user clicks a web
form's Submit button. The default is a score of 40.
• min-mouse-move-count
Species the minimum number of mouse movements necessary per page load in order for the system
to consider the transaction to be of human origin. The default is 5 movements.
• min-mouse-over-count
Species the minimum number of times the client's mouse is positioned over the Submit button in
a web form in order for the system to consider the transaction to be of human origin. The default is
2 button interactions.
• min-report-score
Species the lowest score necessary for the system to send an alert. The default value is 50.
• min-time-to-request
Species the minimum amount of time (in seconds) permitted between when a web form is opened
and the Submit button is clicked. The default is 2 seconds.
• not-human-score
Species the score added to an alert that is triggered if the system only suspects that the client is a
bot and not a human. The default is a score of 25.
• tampered-cookie-score
Species the score added to an alert that is triggered if the system detects that the transaction-data
cookie was tampered with. The default is a score of 50.
• time-fail-score
Species the score added to an alert that is triggered if the min-time-to-request condition is not
met. The default is a score of 20.
• before-load-function
Species the implementation of additional function to be run before JavaScript load, in the following
format: function(congs){...}. Note: For certain advanced congurations, F5 support may provide a
relevant code to be entered here, please do not use it on your own.
• blocking-page
Species information to display when the prole blocks a user account. You can congure the following
options for blocking page:
• response-body
Species the HTML code the system sends to the user whose account is blocked.
• response-headers
1472
Security Anti Fraud
Species the set of response headers that the system sends to the user whose account is blocked.
Separate each header with a new line (Ctrl-V followed by Ctrl-J).
• [case-sensitive | case-insensitive]
Species whether the prole treats protected URL paths as case sensitive, or not. The default value is
case-insensitive. Note: If you create a prole, you can use either property, thereafter it becomes read
only. If the prole is case insensitive, the system stores protected URL paths in lowercase in the prole
conguration.
• check-path-info
Species, when enabled, that the system protects requested URLs with trailing path_info that follow
URL paths.
• cloud-service-pool
Species the name of the pool used by the system for various internal purposes, like signing Forensics
tool.
• cookies
Species names and lifetimes for the cookies that the system uses to optimize its detection of malware,
data transactions, and phishing attacks on the web application. If you do not assign a name to a cookie,
a random name is assigned. You can congure the following cookies:
• components-state
Species the name of the cookie that veries that the system's expected JavaScript can run
successfully, and whether the system successfully decrypted conguration data arriving from server.
• components-state-lifetime
Species whether the components-state cookie is persistent, and if so, after how many minutes it
expires.
• encryption-disabled
Species the name of the cookie that the system adds if the system fails to decrypt a password (to
restore the original password as the user typed it), and the system forwards a request to the server
and waits for a login failure response. In this case, the cookie does not encrypt the password on the
next login attempt. This is used in situations where Application layer encryption is not possible (for
example, if the user is using an old browser that cannot encrypt passwords).
• encryption-disabled-lifetime
Species whether the encryption-disabled cookie is persistent, and if so, after how many minutes
it expires.
• html-eld-obfuscation
Species the name of the cookie that the system sets to identify the elds that were created by HTML
eld obfuscation, in order to remove them from the request before sending it back to the web
application, and to know which eld names to decrypt.
• html-eld-obfuscation-lifetime
Species whether the html-eld-obfuscation cookie is persistent, and if so, after how many minutes
it expires.
• malware-cache
Species the name of the cookie in which the system inserts plain text with a record of reasons for
sending previous malware alerts.
• malware-cache-lifetime
Species whether the malware-cache cookie is persistent, and if so, after how many minutes it
expires.
1473
Traffic Management Shell (tmsh) Reference Guide
• malware-counter
Species the name of the cookie that stores the counter of the honey pot segment used.
• malware-counter-lifetime
Species whether the malware-counter cookie is persistent, and if so, after how many minutes it
expires.
• malware-forensic
Species the name of the cookie that stores the essential response header values from the web
application to be sent to the user after he nishes or skips downloading and running Forensics tool
on his host.
• malware-forensic-lifetime
Species whether the malware-forensic cookie is persistent, and if so, after how many minutes it
expires.
• malware-guid
Species the name of the cookie set by JavaScript to a random string (12 chars long, not encrypted).
The system sends this cookie value in a special alert to the dashboard in order to associate it with
the logged in user.
• malware-guid-lifetime
Species whether the malware-guid cookie is persistent, and if so, after how many minutes it expires.
• phishing-cache
Species the name of the cookie in which the system inserts plain text with a record about phishing
alerts already sent. This is done in order to prevent ooding the system with additional alerts if the
page reloads.
• phishing-cache-lifetime
Species whether the phishing-cache cookie is persistent, and if so, after how many minutes it
expires.
• secure-channel
Species the name of the cookie that the system sets when the system provides JavaScript with a
public key for encryption operations. This cookie is used for the system to correlate incoming
encrypted data with the private key when a request comes from the client.
• secure-channel-lifetime
Species whether the secure-channel cookie is persistent, and if so, after how many minutes it
expires.
• transaction-data
Species the name of the cookie that contains information (such as mouse movement, clicks, and
events) in encrypted format and sends that information to the system.
• transaction-data-lifetime
Species whether the transaction-data cookie is persistent, and if so, after how many minutes it
expires.
• user-inspection
Species the name of cookie that is set once a user is identied in a web form submitted by the client
and this user is enforced in inspection mode.
• user-name
1474
Security Anti Fraud
Species the name of the cookie with the username value after a username is identied in a request.
This ensures that further transactions from the client are still associated with that user even if they
do not include the username eld.
• user-name-lifetime
Species whether the user-name cookie is persistent, and if so, after how many minutes it expires.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied.
• description
User dened description.
• forensic
Species how the system enforces scanning client host for malware (Forensics) and its removal
(remediation). You can congure the following options for Forensics and remediation:
• alert-path
Species the BIG-IP URL path for alerts from Forensics tool. This path cannot be none and must
start with '/'.
• client-domains
Adds, deletes, or replaces a set of client domains to be resolved by Forensics tool.
• cloud-cong-path
Species the BIG-IP URL path for requests from Forensics tool to cloud-service-pool. This path
cannot be none and must start with '/'.
• cloud-forensics-mode
Species the numeric value sent to cloud-service-pool to download Forensics tool.
• cloud-remediation-mode
Species the numeric value sent to cloud-service-pool to download Forensics tool in remediation
mode.
• continue-element
Species the HTML element with continue option that replaces %SKIP_PART% in the entire html
when enforce-policy is enforce.
• exe-location
Species the BIG-IP URL path to download Forensics tool that also replaces %EXE_LOCATION%
in the entire html. This path cannot be none and must start with '/'.
• html
Species the HTML code the system sends to the user after successful login with option to download
Forensics tool.
• self-post-location
Species the BIG-IP URL path for self POST page opened by Forensics tool during scanning. This
path cannot be none and must start with '/'.
• skip-element
Species the HTML element with skip option that replaces %SKIP_PART% in the entire html
when enforce-policy is not enforce.
• skip-path
1475
Traffic Management Shell (tmsh) Reference Guide
Species the BIG-IP URL path for skip / continue option that also replaces %SKIP_PATH% in
both continue-element and skip-element (before their replacement in the entire html). This path
cannot be none and must start with '/'.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• javascript-location
Species the BIG-IP URL directory where the injected JavaScript is located. The path here does not
include the actual lename of the injected JavaScript. This path cannot be none and must start with '/'.
• malware
Species how the system detects a malware attack on the web application. You can congure the
following options for Malware protection:
• allowed-domains
Adds, deletes, or replaces a set of whitelisted domains. The system does not send alerts on requests
for URLs from these domains, even if the system detects malware injection on these domains.
• bait-location
Species the BIG-IP URL location of a le that acts as bait for attackers. This path cannot be none
and must start with '/'.
• blacklist-words
Adds, deletes, or replaces a set of words that are blacklisted if they appear in the web application's
HTML or JavaScript code. If the system detects these words, the system generates a malware alert.
• ash-cookie-content
Species the ash le (in hexadecimal format) used to allow JavaScript to access the Flash object
on the client side. The default content is none. The length is limited to 64k.
• ash-cookie-location
Species the BIG-IP URL location of the SWF le that JavaScript requests to get the Flash le. This
path cannot be none and must start with '/'.
• ash-cookies
Species, when enabled, that the system may use a Flash shared object (FSO) as a place to store an
alternative malware cookie. This cookie tells the system, after a login attempt, that this user has
malware, and the system sends an alert.
• generic-whitelist-words
Adds, deletes, or replaces a set of generic blacklisted words that are ignored.
• source-integrity-location
Species the BIG-IP URL path where the system collects information about the HTML source from
multiple users. This path cannot be none and must start with '/'.
• mobilesafe
Species how the system detects and prevents phishing, Trojan, and pharming attacks on mobile devices
in real time. You can congure the following options for mobile security:
• alert-threshold
Species the minimal score for sending alerts from mobile devices.
• app-integrity
1476
Security Anti Fraud
Species how the system checks if the application on the mobile device has been tampered with.
You can congure the following options for Application integrity:
• [enabled | disabled]
Enables or disables Application integrity.
• android
Species Application integrity settings for Android platform. You can congure the following
options for Android Application integrity:
• score
Species Application integrity score for Android platform.
• signature
Species signature of Android application (in hexadecimal format).
• ios
Species Application integrity settings for iOS platform. You can congure the following options
for iOS Application integrity:
• hashes
Adds, deletes, or replaces a set of iOS Application hashes (in base64-encoded format). You
can congure the following options for iOS Application hash:
• version
Species iOS Application version for this hash.
• score
Species Application integrity score for iOS platform.
• malware
Species how the system checks for malicious applications on the customer's mobile devices. You
can congure the following options for Malware detection:
• android
Species Malware detection settings for Android platform. You can congure the following
options for Android Malware detection:
• custom-malware
Adds, deletes, or replaces a custom set of checked malware for Android platform. You can
congure the following options for each Android malware:
• package
Species package of checked Android malware.
• score
Species score for checked Android malware.
• custom-whitelist
Adds, deletes, or replaces a custom set of whitelist applications for Android platform. You
can congure the following options for each whitelist Android application:
• package
Species package of whitelist Android application.
1477
Traffic Management Shell (tmsh) Reference Guide
• check-custom
Enables or disables custom malware check.
• check-generic
Enables or disables generic malware check.
• [enabled | disabled]
Enables or disables Malware detection.
• ios
Species Malware detection settings for iOS platform. You can congure the following options
for iOS Malware detection:
• custom-malware
Adds, deletes, or replaces a custom set of checked malware for iOS platform. You can
congure the following options for each iOS malware:
• path
Species path of checked iOS malware.
• score
Species score for checked iOS malware.
• custom-whitelist
Adds, deletes, or replaces a custom set of whitelist applications for iOS platform. You can
congure the following options for each whitelist iOS application:
• path
Species path of whitelist iOS application.
• behaviour-analysis
Species how the system checks for suspicious behavior and characteristics on all applications
on the customer's mobile devices. You can congure the following options for behavior analysis:
• run
Enables or disables behaviour analysis run.
• score
Species score for behavior analysis.
• mitm
Species how the system checks the dened domains for DNS Spoong and Certicate Forging on
customer devices. You can congure the following options for Man-in-the-middle detection:
• domains
Adds, deletes, or replaces a set of domains for Man-in-the-middle detection. You can congure
the following options for a MITM domain:
• dns
Species DNS spoong detection settings for this domain. You can congure the following
options for DNS spoong detection:
• ip-ranges
Adds, deletes, or replaces a set of IP address ranges for DNS spoong detection.
1478
Security Anti Fraud
• spoong-score
Species score for DNS spoong detection.
• certicate
Species Certicate forging detection settings for this domain. You can congure the following
options for Certicate forging detection:
• forging-score
Species score for Certicate forging detection.
• hash
Species certicate hash.
• [enabled | disabled]
Enables or disables Man-in-the-middle detection.
• os-security
Species how the system checks the customer's mobile devices for old, unsupported, and unpatched
operation system (OS) versions. You can congure the following options for OS security:
• android
Species OS security settings for Android platform. You can congure the following options
for Android OS security:
• versions
Adds, deletes, or replaces an ordered set of version ranges for Android platform. You can
congure the following options for Android version range:
• from
Species Android version number from which OS is unpatched.
• priority
Species a unique ordinal number for Android version range in the set. This option is
required for the operations add, delete, modify, and replace-all-with.
• score
Species score for Android version range.
• to
Species Android version number to which OS is unpatched.
• [enabled | disabled]
Enables or disables OS security.
• ios
Species OS security settings for iOS platform. You can congure the following options for iOS
OS security:
• versions
Adds, deletes, or replaces an ordered set of version ranges for iOS platform. You can congure
the following options for iOS version range:
• from
Species iOS version number from which OS is unpatched.
1479
Traffic Management Shell (tmsh) Reference Guide
• priority
Species a unique ordinal number for iOS version range in the set. This option is required
for the operations add, delete, modify, and replace-all-with.
• score
Species score for iOS version range.
• to
Species iOS version number to which OS is unpatched.
• untrusted-apps-score
Species score for untrusted applications.
• rooting-jailbreak
Species how the system checks customer's mobile devices to determine if they are rooted / jailbroken.
You can congure the following options for Rooting / Jailbreak detection:
• [enabled | disabled]
Enables or disables Rooting / Jailbreak detection.
• jailbreak-score
Species score for jailbreak on iOS platform.
• rooting-score
Species score for rooting on Android platform.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• phishing
Species how the system detects a phishing attempt. You can congure the following options for phishing
site detection:
• allowed-elements
Adds, deletes, or replaces a set of URLs in requests for which the system does not verify (check) the
referrer header value.
• allowed-referrers
Adds, deletes, or replaces a set of domain names that are allowed to appear in the referrer header
when requesting protected resources.
• css-attribute-name
Species the attribute name as part of the CSS content. This name cannot be none.
• css-content
Species the content of the CSS le dened in the css-location setting.
• css-location
Species the BIG-IP URL location of the CSS le. Injecting JavaScript protects the web application
against phishing attempts because even if an attacker removes the injected JavaScript from the copied
1480
Security Anti Fraud
web page, the CSS element is not modied, and this triggers an alert. This path cannot be none and
must start with '/'.
• expiration-checks
Species, when enabled, that the system sends an alert if expired JavaScript engine les are used,
as this is an indication of a phishing attack.
• image-location
Species the BIG-IP URL location of the 1x1 pixel image le. If an attacker copies a web page with
this image, it most likely lacks the JavaScript, and this triggers an alert. This path cannot be none
and must start with '/'.
• protected-elements
Adds, deletes, or replaces a set of URLs in requests for which the system veries (checks) the referrer
header value. You can use wildcards, for example *.gif.
• referrer-checks
Species, when enabled, that the system veries (checks) requests coming to the web application
for resources from different domains.
• trigger-irule
Species, when enabled, that the system activates Anti-fraud iRule events. The default value is disabled.
• urls
Adds, deletes, or replaces a set of URLs in the web application that are protected by the system. You
can congure the following options for a protected URL:
• app-layer-encryption
Species when the system performs Application layer encryption. With Application layer encryption,
the system detects an attempt to steal and tamper with end-user passwords (or other protected
information), and also prevents it by encrypting the protected information. You can congure the
following options for Application layer encryption:
• add-decoy-inputs
Species, when enabled, that the system randomly and continuously generates and removes
decoy <input> elds that are added to the web page, thus making it harder for an attacker to
identify sensitive information with either JavaScript or a proxy. In order to enable it, you must
rst enable html-eld-obfuscation.
• [enabled | disabled]
Species whether the system protects this URL with Application layer encryption, and sends an
alert if an attacker attempts to breach Application layer encryption for this URL, or not.
• fake-strokes
Species, when enabled, that the system protects against in-browser key loggers by generating
fake keyboard events.
• hide-password-revealer
Species, when enabled, that the system hides the password revealer icon found in web pages.
• html-eld-obfuscation
Species, when enabled, that the system encrypts the names of dened <input> elds on the
client, and then decrypts them back to the original names on the BIG-IP.
• real-time-encryption
Species, when enabled, that the system encrypts passwords as they are typed (even before the
user clicks the Submit button in a web form).
1481
Traffic Management Shell (tmsh) Reference Guide
• remove-element-ids
Species, when enabled, that the system removes the ID attribute from the <input> elds in a
web form. In order to enable it, you must rst enable html-eld-obfuscation.
• remove-event-listeners
Species, when enabled, that the system removes event listeners from the encrypted <input>
elds in a web form. In order to enable it, you must rst enable html-eld-obfuscation.
• stolen-creds
Species, when enabled, that the system examines whether the user was trying to use a fabricated
password.
• auto-transactions
Species how the system protects this URL from automatic (bot) transactions. You can congure
the following options for Automated transactions detection:
• browser
Species, when enabled, that the system looks for bot automation performed within the browser.
• [enabled | disabled]
Species whether the system protects this URL against non-human transactions, and sends an
alert if the system detects a non-human transaction attempt for this URL, or not.
• non-browser
Species, when enabled, that the system looks for bot automation performed not within the
browser.
• submit-buttons
Adds, deletes, or replaces a set of non-standard Submit buttons found in forms of the web
application. You can specify the name, or the CSS syntax (ID, class, or tagname) for each button.
• inject-javascript
Enables or disables JavaScript injection into responses to this URL. The default value is enabled.
• login-response
Species validation criteria on the response of this URL when it is Login page. You must congure
at least one of them. If you congure more than one validation criteria, then all the criteria must be
fullled for successful login. You can congure the following Login page properties:
• status-code
Species an HTTP response status code that the server must return to the user upon successful
login.
• domain-cookie
Species a dened domain cookie that the successful response to the login URL must include.
• exclude-string
Species a string that should NOT appear in the successful response to the login URL.
• header
Species a header name and value that the successful response to the login URL must match.
• include-string
Species a string that should appear in the successful response to the login URL.
• validation
1482
Security Anti Fraud
Enables or disables successful login validation.
• malware
Species when the system detects attempts of attackers to inject malware in the URL. You can
congure the following options for Malware detection:
• attach-html-to-alerts
Species, when enabled, that the system attaches forensics information along with the alerts.
• auto-learn-form-tags
Species, when enabled, that the system learns the number of HTML form tags that appear in
the URL. In order to enable it, you must rst enable source-integrity.
• auto-learn-input-tags
Species, when enabled, that the system learns the number of HTML input tags that appear in
the URL. In order to enable it, you must rst enable source-integrity.
• auto-learn-script-tags
Species, when enabled, that the system learns the number of HTML script tags that appear in
the URL. In order to enable it, you must rst enable source-integrity.
• domain-availability
Species, when enabled, that the system checks that client network connectivity is not blocked
by malware.
• enable-symbols
Species, when enabled, that the system looks for malware strings (signatures) within JavaScript.
• [enabled | disabled]
Species whether the system protects this URL against injected malware, and sends an alert if
this URL is detected to have malware, or not.
• external-injection
Species, when enabled, that the system detects malicious scripts injected from domains not in
the prole's allowed-domains.
• generic-malware
Species, when enabled, that the system applies the detection of generic malware, using honeypots.
• manual-count-form-tags
Species the number of HTML forms that appear in the URL.
• manual-count-input-tags
Species the number of HTML inputs that appear in the URL.
• manual-count-script-tags
Species the number of HTML scripts that appear in the URL.
• rat-detection
Species, when enabled, that the system checks for Remote Access Trojans (RATs) on clients'
web browsers. If you enable it, you need to also enable ash-cookies.
• source-integrity
Species, when enabled, that the system veries that the URL's HTML source code matches the
HTML code sent from the server. The source integrity feature counts script tags that are external
(with src) and inline (without src).
• visibility-check
1483
Traffic Management Shell (tmsh) Reference Guide
Species, when enabled, that the system searches HTML pages for words from
visibility-check-items.
• visibility-check-items
Adds, deletes, or replaces a set of words that must appear in the web site's HTML pages and may
not be changed. If these words are changed, the system sends an alert.
• whitelist-words
Adds, deletes, or replaces a set of words that are permitted to appear in requests for this URL,
even though they are otherwise blacklisted by the system for other URLs.
• mobilesafe-encryption
Species, when enabled, that the system protects requests for this URL from mobile devices with
Application layer encryption.
• parameters
Adds, deletes, or replaces a set of sensitive parameters protected by the system. You can congure
the following options for each parameter:
• attach-to-vtoken-report
Species, when enabled, that the system adds the parameter value data to the alerts.
• check-integrity
Species, when enabled, that the system veries whether the user-input data was changed by
malware when it left the browser for the server.
• encrypt
Species, when enabled, that the system encrypts the parameter's value attribute.
• identify-as-username
Species, when enabled, that the system considers this parameter a username. Note: There may
be only one such parameter per URL, and its value is used only when login is successful (according
to the URL's login-response).
• method
Species the method of the request from which the systems gets the parameter data. Select either:
POST (the default value) or GET.
• mobilesafe-encrypt
Species that this parameter contains the encrypted elds from mobile devices. Note: There may
be only one such parameter per URL (usually called auth), it cannot have other settings enabled
and its method must be POST.
• obfuscate
Species, when enabled, that the system encrypts the parameter's name attribute.
• substitute-value
Species, when enabled, that the system substitutes the parameter's value with asterisks [*] in
the web application while the form is being lled. In order to enable it, you must rst enable
encrypt.
• phishing
Species when the system detects phishing attempts by attackers who set up a fake URL that imitates
the real URL. You can congure the following options for Phishing detection:
• capture-users
1484
Security Anti Fraud
Species, when enabled, that the system logs the usernames and text elds (not passwords) of
users attacked by a phishing attempt.
• copy-detection
Species, when enabled, that the system detects copied web pages.
• css-protection
Species, when enabled, that the system activates the CSS module, which is part of the system's
phishing detection backup mechanism.
• [enabled | disabled]
Species whether the system protects this URL against phishing, and sends an alert if the system
detects this URL to be under a phishing attempt, or not.
• users
Adds, deletes, or replaces a set of users enforced by the system upon successful login. You can congure
the following options for an enforced user:
• modes
Adds or deletes a single mode in the set of existing user modes.
• mode
Species a unique mode for the user. This option is required for the operations add and delete.
The options are:
• block
Species that the system blocks the user account by displaying blocking-page.
• forensic
Species that the system enforces the user to run Forensics tool on his host by displaying
forensic html.
• inspection
Species that the system turns on verbose activity logging for this user, i.e. collects all HTML
and JS sources from sessions and sends this data to the dashboard.
• remediation
Species that the system enforces the user to run Forensics tool in remediation mode that
deploys Anti-malware client on his host by displaying forensic html.
• duration
Species number of minutes during which the user is enforced in this mode since its rst login,
when enforce-policy is time-limited. After their expiration the user mode will be removed
automatically.
• enforce-policy
Species enforcement policy for this user mode. The options are:
• enforce
Species that the user must download and run Forensics tool in order to continue online
actions. Note: This policy may be specied only for the modes forensic and remediation.
• time-limited
Species that the user is enforced in this mode for a limited time, namely until rst-login-time
+ duration minutes. When this policy is specied for the modes forensic and remediation,
the user may skip downloading and running Forensics tool every time.
1485
Traffic Management Shell (tmsh) Reference Guide
• unlimited
Species that the user is enforced in this mode for unlimited time. When this policy is specied
for the modes forensic and remediation, the user may skip downloading and running Forensics
tool every time.
• rst-login-time
Displays time when the user rstly logged in being in this mode. A new user mode is added with
value none and it is updated automatically during trafc, when enforce-policy is time-limited.
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, security, security anti-fraud, tmsh
signatures-update
Runs or loads an Anti-fraud signatures update.
Syntax
Congure, run or load the signatures-update component within the security anti-fraud module using the
syntax in the following sections:
Modify
modify security anti-fraud signatures-update
update-automatically [enabled | disabled]
edit security anti-fraud signatures-update
all-properties
non-default-properties
Load
load signatures-update
file [filename]
Run
run signatures-update
Display
list signatures-update
all-properties
current-version-create-datetime
1486
Security Anti Fraud
download-available
install-datetime
install-user
message
non-default-properties
one-line
partition
progress-status
progress-status-datetime
update-automatically
Description
You can use the signatures-update component to run, load, congure or display status of signatures update.
Examples
list security anti-fraud signatures-update
Displays the status of signatures update.
Options
• current-version-create-datetime
Displays the creation time of currently installed signatures update version.
• download-available
Displays whether new signatures version is available for download from the cloud.
• le
Species the le name from which the signatures update is going to be installed when using the load
command. A full path should be specied.
• install-datetime
Displays the time when current signatures update was installed.
• install-user
Displays the name of the user who installed the last signatures update.
• message
Displays the message describing the failure status of signatures update.
• partition
Displays the administrative partition within which this object resides.
• progress-status
Displays the signatures update progress status.
• progress-status-datetime
Displays the time when signatures update progress status was last changed.
• update-automatically
Enables or disables automatic nightly update.
See Also
edit, list, modify, security, security anti-fraud, tmsh
1487
Traffic Management Shell (tmsh) Reference Guide
Security Datasync
device-stats
Display the Datasync Framework device stats.
Syntax
Display the device-stats component within the security datasync module using the syntax shown in the
following sections.
Display
list device-stats
list device-stats [ [ [name] | [glob] | [regex] ] ... ]
show running-config device-stats
show running-config device-stats [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Description
You can use the device-stats component to display the datasync device-stats for that are updated by the
Datasync Framework.
Options
• device
Displays the device name reected by the stats.
• table
Displays the table type reected by the stats.
• prole-chksum
Displays the checksum of the current active prole.
• activation-epoch
Displays the activation epoch of the current active generation.
• rows-available
Displays the number of available rows in the current active buffer.
• rows-in-use
Displays the number of rows that are in use in the current active buffer.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh, trust-domain
global-profile
Manage the Datasync Framework settings that are globally synced across devices.
Syntax
Manage the global-prole component within the security datasync module using the syntax shown in the
following sections.
Create/Modify
create global-profile [name]
modify global-profile [name]
table [name]
activation-epoch [ auto | [integer] ]
deactivation-epoch [ deactivated | always-active | [integer] ]
min-rows [ default | [integer] ]
max-rows [ default | [integer] ]
regen-time-offset [ default | [integer] ]
regen-interval [ default | none | [integer] ]
grace-time [ default | [integer] ]
master-key [string]
scramble-alg [string]
hash-alg [string]
mac-alg [string]
mode-of-op [string]
rsa-exp [ none | rsa-3 | rsa-f4 | default ]
rsa-bits [ default | none | [integer] ]
params [string]
edit global-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list global-profile
list global-profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config global-profile
show running-config global-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete global-profile [name]
1490
Security Datasync
Description
You can use the global-prole component to create, modify, display, or delete a datasync global-prole
for use with the Datasync Framework. All global-proles must reside in the automatically created
/Common/datasync-global folder. These proles are synced across all of the devices in the trust domain
using the manually-synced device-group datasync-global-dg.
Warning: Creating, modifying or deleting global-proles may result in the system being ofine, in the case
of a bad conguration.
Examples
create global-prole /Common/datasync-global/my_global_prole table table_name
Creates a custom datasync global-prole named my_global_prole for table table_name with initial
settings, a random master-key, and an activation-epoch 30 minutes in the future.
list global-prole /Common/datasync-global/*
Displays the properties of all datasync global-proles.
Options
• table
Species the table to which the prole belongs.
• activation-epoch
Species the epoch at which the prole becomes active, in UNIX-time.
• deactivation-epoch
Species the epoch at which the prole becomes inactive, in UNIX-time.
• create-timestamp
Displays the timestamp at which the prole was created, in UNIX-time.
• min-rows
Species the minimum number of rows to generate before going online.
• max-rows
Species the maximum number of rows to generate.
• regen-time-offset
Species the time offset at which regeneration will be done, in seconds.
• regen-interval
Species the time interval at which regeneration will be done, in seconds.
• grace-time
Species the grace time during which new buffers are supported, but not yet activated, in seconds.
• master-key
Species the secured master key upon which all cryptography is based. Use \"auto\" to generate a random
key.
• scramble-alg
Species the scrambling algorithm to use.
• hash-alg
Species the hashing algorithm to use.
1491
Traffic Management Shell (tmsh) Reference Guide
• mac-alg
Species the MAC algorithm to use.
• mode-of-op
Species the scrambling mode-of-operation to use.
• rsa-exp
Species the RSA exponent.
• rsa-bits
Species the number of bits to use for RSA keys.
• params
Species additional internal parameters.
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh, trust-domain
local-profile
Manage the Datasync Framework settings that are local, and not synced across devices.
Syntax
Manage the local-prole component within the security datasync module using the syntax shown in the
following sections.
Modify
modify local-profile [table_name]
buf-size [integer]
ds-area [ none | asm | fps ]
rows-bulk [integer]
gen-timeout-sec [integer]
min-mem-mb [integer]
min-cpu-percent [integer]
max-gen-rows [ infinite | [integer] ]
keep-conf-files [integer]
gen-pause-sec [integer]
offline-until-gen [ enable | disable ]
edit local-profile [table_name]
all-properties
non-default-properties
Display
list local-profile
list local-profile [table_name]
show running-config local-profile
1492
Security Datasync
show running-config local-profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Description
You can use the local-prole component to modify or display a datasync local-prole for use with the
Datasync Framework. Each prole is for a single table. The proles cannot be created or deleted, only
modied. These proles are local; they are not synced across devices.
Options
• buf-size
Species the size of each buffer in the table, in bytes.
• ds-area
Species the memory area on which the table will be allocated.
• rows-bulk
Species the number of rows to generate in each bulk.
• gen-timeout-sec
Species the timeout of running the external generator per single bulk.
• min-mem-mb
Species the minimum available memory in MB to start generator in non-urgent mode.
• min-cpu-percent
Species the minimum available CPU percent to start generator in non-urgent mode.
• max-gen-rows
Species the maximum rows to generate.
• keep-conf-les
Species the number of conguration les to keep when rolling old ones.
• gen-pause-sec
Species the time in seconds to pause between each bulk generation when in non-urgent mode.
• ofine-until-gen
Species if the system should be ofine until the table is generated.
See Also
edit, list, modify, show, tmsh
1493
Traffic Management Shell (tmsh) Reference Guide
Security DOS
bot-signature
Congures the Bot Signatures.
Syntax
Congure the bot-signature component within the security dos module using the syntax shown in the
following sections.
Create/Modify
create bot-signature [string]
modify bot-signature [name]
category [name]
domains [none | add | delete | replace-all-with] { [string] ... }
risk [high | low | medium]
rule [string]
signature-references [string]
url {
match-type [contains | regexp]
search-string [string]
}
user-agent {
match-type [contains | regexp]
search-string [string]
}
Display
list bot-signature
Delete
delete bot-signature [name]
Description
You can use the bot-signature component to create, modify, display, or delete a Bot Signature.
Examples
create bot-signature my_signature
Creates a custom Bot Signature named my_signature with initial settings.
list bot-signature
Displays the properties of all Bot Signatures.
Options
• category
Species the bot signature category.
• domains
Species the bot signature domain names.
• risk
Species the bot signature risk. The possible values are high, low and medium.
• rule
Species the bot signature rule.
• signature-references
Species the bot signature references.
• url
Species the bot signature's url matching rule. The following options are available:
• match-type
Species the bot signature's url rule match type. The possible values are contains or regexp.
• search-string
Species the bot signature's url string that should be matched.
• user-agent
Species the bot signature's user-agent matching rule. The following options are available:
• match-type
Species the bot signature's user-agent rule match type. The possible values are contains or regexp.
• search-string
Species the bot signature's user-agent string that should be matched.
See Also
edit, list, modify, security, security dos, tmsh
bot-signature-category
Congures the Bot Signature Categories.
Syntax
Congure the bot-signature-category component within the security dos module using the syntax shown
in the following sections.
Create/Modify
create bot-signature-category [string]
1496
Security DOS
modify bot-signature-category [name]
type [benign | malicious]
Display
list bot-signature-category
Delete
delete bot-signature-category [name]
Description
You can use the bot-signature-category component to create, modify, display, or delete a Bot Signature
Category.
Examples
create bot-signature my_signature_category
Creates a custom Bot Signature Category named my_signature_category with initial settings.
list bot-signature-category
Displays the properties of all Bot Signature Categories.
Options
• type
Species the bot signature type. The possible values are benign or malicious.
See Also
edit, list, modify, security, security dos, tmsh
device-config
Congures the global network DoS prole.
Syntax
Congure the global network DoS prole component within the security dos module using the syntax
shown in the following sections.
Modify
modify device-config dos-device-config
dos-device-vector {
[vector type] {
default-internal-rate-limit [integer | infinite]
detection-threshold-percent [integer | infinite]
1497
Traffic Management Shell (tmsh) Reference Guide
detection-threshold-pps [integer | infinite]
}
packet-types [ipv4-tcp-syn-only | ipv4-udp | ipv6-tcp-syn-only |
ipv6-udp]
auto-blacklisting [enabled | disabled]
blacklist-detection-seconds [integer]
blacklist-duration [integer]
blacklist-category [enter name of ip-intelligence category]
...
}
log-publisher [name]
reset-stats device-config
Display
list device-config
show running-config device-config
all-properties
dos-device-vector
log-publisher
show device-config
Description
This component is used to modify or display the global device DoS prole and statistics for use with network
DoS Protection functionality.
Examples
modify device-cong ...
Modies the global DoS prole settings.
list device-cong
Displays all the properties of the device DoS prole.
Options
• dos-device-vector
Congures attack detection thresholds and rate limit parameters for network DoS vectors.
• log-publisher
Species the name of the log publisher which logs translation events. See help sys log-cong for more
details on the logging sub-system.
Vector Types
• arp-ood
ARP Flood.
• bad-ext-hdr-order
1498
Security DOS
IPv6 extension headers in packet are out of order.
• bad-icmp-chksum
Bad ICMP checksum.
• bad-icmp-frame
Bad ICMP frames. To see the various reasons why ICMP frames are classied as bad, please refer to
the written documentation.
• bad-igmp-frame
Bad IGMP frames. To see the various reasons why IGMP frames are classied as bad, please refer to
the written documentation.
• bad-ip-opt
IPv4 option with illegal length.
• bad-ipv6-hop-cnt
Bad IPv6 hop count. Terminated packet (cnt==0). Dropped when the rate hits rate limit.
• bad-ipv6-ver
Bad IPv6 version. IP Version in the IPV6 packet is not 6.
• bad-sctp-chksum
Bad SCTP Checksum type.
• bad-tcp-chksum
Bad TCP checksum.
• bad-tcp-ags-all-clr
Bad TCP ags (all TCP header ags cleared).
• bad-tcp-ags-all-set
Bad TCP ags (all ags set).
• bad-ttl-val
Bad IP TTL value (TTL == 0 for IPv4).
• bad-udp-chksum
Bad UDP checksum.
• bad-udp-hdr
Bad UDP header. To see the various reasons why UDP headers are classied as bad, please refer to the
written documentation.
• bad-ver
Bad IP version 4. IPv4 version in IP header is not 4.
• dns-any-query
DNS any query packet.
• dns-a-query
DNS A query packet.
• dns-ptr-query
DNS PTR query packet.
• dns-ns-query
DNS NS query packet.
1499
Traffic Management Shell (tmsh) Reference Guide
• dns-soa-query
DNS SOA query packet.
• dns-cname-query
DNS CNAME query packet.
• dns-mx-query
DNS MX query packet.
• dns-aaaa-query
DNS AAAA query packet.
• dns-txt-query
DNS TXT query packet.
• dns-srv-query
DNS SRV query packet.
• dns-axfr-query
DNS AXFR query packet.
• dns-ixfr-query
DNS IXFR query packet.
• dns-malformed
DNS Malformed packet.
• dns-other-query
DNS OTHER query packet.
• dns-oversize
DNS packet with size > <tunable>. This sys db tunable is congurable with Dos.MaxDNSframeSize.
• dup-ext-hdr
Duplicate IPv6 extension headers.
• ether-brdcst-pkt
Ethernet broadcast packet.
• ether-mac-sa-eq-da
Ethernet MAC SA == DA.
• ether-multicast-pkt
Ethernet multicast packet.
• ext-hdr-too-large
IPv6 extension header size too large. The max IPV6 extension header size is congurable via the sys
db variable dos.maxipv6extsize.
• n-only-set
TCP header with only the FIN ag set.
• ood
A Flood is an attack where multiple (typically many) endpoints initiate network trafc to a single subnet
or recieving endpoint.
• hdr-len-gt-l2-len
Header length > L2 length. No room in L2 packet for IPv4 header (including options).
1500
Security DOS
• hdr-len-too-short
Header length too short. IPv4 header length in IP header is less than 20 bytes.
• hop-cnt-leq-one
IPv6 hop count <= <tunable> and the packet needs to be forwarded. This sys db tunable is congurable
by the sys db variable tm.minipv6hopcnt.
• host-unreachable
ICMP packets of type "Host Unreachable".
• icmp-frag-ood
ICMP fragments ood.
• icmp-frame-too-large
Packets larger than the maximum ICMP frame size. The max ICMP frame size is congurable via the
sys db variable dos.maxicmpframesize.
• icmpv4-ood
ICMPv4 Flood.
• icmpv6-ood
ICMPv6 Flood.
• igmp-ood
IGMP Flood.
• igmp-frag-ood
IGMP Fragment Flood.
• ip-bad-src
IP addr is a broadcast or multicast address.
• ip-err-chksum
IP error checksum. IPv4 header checksum error.
• ip-frag-ood
IPv4 fragment ood.
• ip-len-gt-l2-len
IP length > L2 length. Total length in IPv4 header is greater than the L3 part length in L2 packet.
• ip-overlap-frag
IPv4 overlapping fragments.
• ip-short-frag
IPv4 fragments whose payload size is less than the minimum IPv4 Fragment size. The minimum size
is congurable via the db variable tm.minipfragsize.
• ip-unk-prot
IP Uknown Protocol type.
• ip-opt-frames
IP option frames. IPv4 packets with options. db variable tm.acceptipoptions must be enabled to receive
IP options.
• ip-other-frag
The total IPv4 fragments' size has exceeded the reassembly queue or the maximum IP packet size.
1501
Traffic Management Shell (tmsh) Reference Guide
• ipv6-atomic-frag
IPv6 frame with frag extension hdr, but the MF and offset elds are both 0.
• ipv6-bad-src
IPv6 src address is a multicast address or IPv6 src or dst addr is a IPv4 mapped IPv6 address.
• ipv6-ext-hdr-frames
IPv6 extended header frames.
• ipv6-frag-ood
IPv6 fragment ood.
• ipv6-len-gt-l2-len
IPv6 length > L2 length.
• ipv6-other-frag
The total IPv6 fragments' size has exceeded the reassembly queue or the maximum IP packet size.
• ipv6-overlap-frag
IPv6 overlapping fragments.
• ipv6-short-frag
IPv6 fragments whose payload size is less than the minimum IPv6 Fragment size. The minimum size
is congurable via the db variable tm.minipv6fragsize.
• land-attack
Land Attack. IP Src Address equals IP Dst Address. Both V4 and V6 are counted.
• l2-len-ggt-ip-len
L2 length >> IP length. L2 packet length is much greater than payload length in IPv4 (L2 length > IP
length and L2 length > minimum packet size).
• l4-ext-hdrs-go-end
No L4 (extended headers go to or past the end of frame).
• no-l4
No L4. No L4 payload for IPv4.
• opt-present-with-illegal-len
TCP Option present with illegal length.
• payload-len-ls-l2-len
Payload length < L2 length. Payload length in IPv6 header is less than L3 part length in L2 packet.
• routing-header-type-0
Routing header type 0 present.
• sip-malformed
SIP malformed packet
• sip-invite-method
SIP INVITE method packet.
• sip-ack-method
SIP ACK method packet.
• sip-options-method
SIP OPTIONS method packet.
1502
Security DOS
• sip-bye-method
SIP BYE method packet.
• sip-cancel-method
SIP CANCEL method packet.
• sip-register-method
SIP REGISTER method packet.
• sip-publish-method
SIP PUBLISH method packet.
• sip-notify-method
SIP NOTIFY method packet.
• sip-subscribe-method
SIP SUBSCRIBE method packet.
• sip-message-method
SIP MESSAGE method packet.
• sip-prack-method
SIP PRACK method packet.
• sip-other-method
SIP OTHER method packet.
• sweep
A Sweep is an attack where a single endpoint initiates network trafc to a large number of recieving
endpoints or subnets.
• syn-and-n-set
SYN && FIN set.
• tcp-ack-ood
TCP packets with the ACK ag set (for non-existing ows).
• tcp-bad-urg
TCP packets with the URG ag set but URG pointer is 0.
• tcp-hdr-len-gt-l2-len
TCP header length > L2 length. No room in packet for TCP header (including options).
• tcp-hdr-len-too-short
TCP header length too short (length < 5). The offset eld in TCP header is less than 20 bytes.
• tcp-opt-overruns-tcp-hdr
TCP option overruns TCP header.
• tcp-syn-ood
TCP header with only the SYN ag set.
• tcp-synack-ood
TCP header with only the SYN and ACK ags set.
• tcp-rst-ood
TCP header with only the RST ag set.
1503
Traffic Management Shell (tmsh) Reference Guide
• tcp-window-size
TCP non-RST pkt with window size < <tunable>. This sys db tunable is congurable with
Dos.TcpLowWindowSize.
• tidcmp
ICMP source quench packets.
• too-many-ext-hdrs
Too many extended headers. The IPv6 extended headers are more than 4. This number can be set through
db variable dos.maxipv6exthdrs.
• tcp-syn-oversize
TCP data-SYN with pktlength > dos.maxsynsize which is 128 bytes by default.
• ttl-leq-one
TTL <= <tunable>. For IPv4 forwarding. This sys db tunable is congurable by tm.minipttl.
• unk-tcp-opt-type
Unknown TCP option type.
• udp-ood
UDP Flood.UDP ood vector counts any UDP packets that either match the UDP Port InclusionList or
donot match the UDP Port ExclusionList. "tmsh modify security dos udp-portlist" can be used to congure
the udp port list.For more info about udp portlist and how to congure it use "help security dos
udp-portlist"
• unk-ipopt-type
Unknown IP option type.
Parameters
• default-internal-rate-limit
This parameter is programmed in hardware to limit the trafc to BIG-IP software. If the hardware DoS
support does not exist software uses default-internal-rate-limit to limit the good trafc (most of them
are ood) to external servers. Bad packets are always dropped.
If the rate limit value is innite the rate limit is disabled.
• detection-threshold-percent
This parameter species relative threshold that uses dynamically learned 1-hour average rate to detect
attacks. If the current rate (1-minute average) increases the specied percent over the 1-hour average
rate, attack is detected.
If the threshold value is innite the detection is disabled.
• detection-threshold-pps
This parameter species absolute threshold value. If the current rate (1-minute average) is equal or above
the threshold value, attack is detected.
If the threshold value is innite the detection is disabled.
• packet-types
This parameter is used to specify type of packets that will be classied as Sweep/Flood attacks. There
are various types of packet types that can be specied.
• auto-blacklisting
Enables automatic blacklisting of offending IPs
1504
Security DOS
• blacklist-detection-seconds
Duration in seconds for which the IP has been offending.
• blacklist-duration
Duration in seconds for which this IP should be blocked.
• blacklist-category
Blacklist category (of IP intelligence) to which this IP should be added.
See Also
list, modify, security, security dos, show, tmsh
network-whitelist
Congures the DoS network whitelist component within the security dos module using the syntax shown
in the following sections. These DoS network whitelist entries are applied to all packets except those going
through the management interface.
Syntax
Modify
modify network-whitelist dos-network-whitelist
address-list <name>
description [string]
entries [add | delete | modify | replace-all-with] {
[ [name] ] {
description [string]
destination {
address [ip_address/prefixlen]
port [port]
}
ip-protocol [any | icmp | igmp | tcp | udp]
source {
address [ip_address/prefixlen] ]
vlans [vlan name | vlanid/mask]
}
}
}
Display
list network-whitelist
Description
You can use the network-whitelist component to congure a DoS network whitelist of upto eight entries
for all trafc except the management interface. Along with that you can use address-list to congure the
srcIP Global whitelist. To this address-list you need to attach the address list objects. This address-list can
be a nested list of fully qualied address. Subnets and IP address ranges and geo-locations are not allowed..
The HSB hardware compares all incoming trafc to the network-whitelist entries. If a match is found then
it does not do DoS vector checks for those packets. If a match is not found then DoS vector checks are done
1505
Traffic Management Shell (tmsh) Reference Guide
on those packets. The network software does its regular DoS vector checks on the incoming packets as
usual. If a DoS vector is hit then it compares that packet with the DoS network-whitelist entries. If the
packet matches an entry, then the system does not increment the DoS vector that matched. If the packets
does not match a DoS network-whitelist entry then the matched DoS vector is incremented and appropriate
action is taken.
If an entry species more than one of the above items, a packet must pass all of the items to successfully
match. For example, if an entry species a source subnet and a destination port, a packet must originate
from the given subnet and must also have the specied destination port.
Either destination ip_address/prexlen or source ip_address/prexlen can be specied in a network-whitelist
entry. An ip_address/prexlen for both source and destination cannot be specied for an entry.
Examples
modify network-whitelist dos-network-whitelist description "bad interfaces" entries add { re_telnet
{ ip-protocol tcp destination { port telnet } } }
Creates a new entry called re_telnet. It matches any TCP packet whose destination port is telnet.
modify network-whitelist dos-network-whitelist entries add { internal-net { source { address
172.27.0.0/16 } } }
Creates an entry that matches trafc from the 172.27.0.0 network.
list network-whitelist
security dos network-whitelist dos-network-whitelist {
entries {
re_telnet {
ip-protocol tcp
destination {
port telnet
}
}
internal-net {
source {
address 172.27.0.0/16
}
}
}
}
Displays the current list of DoS whitelist entries.
modify network-whitelist dos-network-whitelist entries delete { internal-net }
Removes the "internal-net" entry from the list of network-whitelist entries.
Options
• description
Your description for the DoS network-whitelist entries.
• entries
Adds, deletes, or replaces a network-whitelist entry.
• add
Creates a new entry, which you specify next with a unique string in curly braces ({}).
• delete
1506
Security DOS
Deletes the entry that you specify next, in curly braces ({}). You can use delete {all} to empty the
list of network-whitelist entries, which has the same effect as using none (see below).
• modify
Modies the existing entry that you specify next, in curly braces ({}). After the entry name, enter
the new conguration settings for the entry inside a nested set of curly braces.
• replace-all-with
Replaces the current set of network-whitelist entries with the entry(s) that you specify next, in curly
braces ({}).
• none
Empties the list of network-whitelist entries.
Enter the name of a entry to be added or modied, then enter an open curly brace ({), one or more of
the following options, and a closed curly brace (}).
• description
Your description for the current entry.
• destination
Matches against each packet's destination IP and/or destination port.
• address
Species an IP address and network to compare against the packet's destination address.
The format for an IPv4 address is a. b. c. d [/ prex ]. The general format for an IPv6 address is
a: b: c: d: e: f: g: h [/ prex ]; you can shorten this by eliminating leading zeros from each eld
(for example, you can shorten "2001:0db7:3f4a:09dd:ca90:ff00:0042:8329" to
"2001:db7:3f4a:9dd:ca90:ff00:42:8329"), and/or by removing the longest contiguous eld of
zeros (for example, you can shorten "2001:0:0:0:c34a:0:23ff:678" to "2001::c34a:0:23ff:678").
TMSH accepts any valid text representation of IPv6 addresses, as dened in RFC 2373 (see
http://www.ietf.org/rfc/rfc2373.txt).
• port
Species a port to compare against the packet's destination port.
• ip-protocol
Species the IP protocol to compare against the packet. This could be any, icmp, igmp, tcp or udp.
If you specify this option, a packet only matches if it uses the chosen protocol.
• source
Matches against each packet's source IP, and/or source VLANs.
• address
Species an IP address and network to compare against the packet's source address.
The format for an IPv4 address is a. b. c. d. The general format for an IPv6 address is a: b: c: d:
e: f: g: h.
• vlans
Species either a vlan name or a range of vlanids to compare against the packet. The range is
specied as vlanid/mask. For example if you specify "3200/8" then the vlanid range will be
3200-3327.
1507
Traffic Management Shell (tmsh) Reference Guide
Examples
modify security dos network-whitelist dos-network-whitelist address-list [name]
It adds list1 objects to the global address-list. For conguring the address list objects (list1) you can use the
following examples:
list security rewall address-list list1
security rewall address-list list1 { addresses { 30.30.30.30 { } 45:56:567:234:456:: { } } }
This is how you can list the address-list objects that you congured for global whitelists list security dos
network-whitelist address-list security dos network-whitelist dos-network-whitelist { address-list list1 }
See Also
edit, list, modify, security, security dos, tmsh security rewall address-lists
profile
Congures a DoS prole.
Syntax
Congure the prole component within the security dos module using the syntax shown in the following
sections.
Create/Modify
create profile [name]
modify profile [name]
app-service [[string] | none]
application [none | add | delete | modify | replace-all-with] {
name [string] {
bot-defense {
collect-stats [enabled | disabled]
cross-domain-requests [allow-all | validate-bulk |
validate-upon-request]
external-domains [none | add | delete | replace-all-with] { [string]
... }
grace-period [integer]
mode [always | disabled | during-attacks]
site-domains [none | add | delete | replace-all-with] { [string]
... }
url-whitelist [none | add | delete | replace-all-with] { [string]
... }
browser-legit-enabled [enabled | disabled]
browser-legit-captcha [enabled | disabled]
}
bot-signatures {
categories [none | add | delete | modify | replace-all-with] {
action {
[block | none | report]
}
}
check [enabled | disabled]
disabled-signatures [none | add | delete | modify |
replace-all-with]
}
captcha-response {
failure {
1508
Security DOS
body [string]
type [custom | default]
}
first {
body [string]
type [custom | default]
}
}
geolocations [none | add | delete | modify | replace-all-with] {
[black-listed | white-listed]
}
heavy-urls {
automatic-detection [enabled | disabled]
exclude [none | add | delete | replace-all-with] { [string] ...
}
include [none | add | delete | replace-all-with] { [string] ...
}
latency-threshold [integer]
protection [enabled | disabled]
}
ip-whitelist [none | add | delete | modify | replace-all-with] {
[address ... | address/mask ... ]
}
stress-based {
de-escalation-period [integer]
escalation-period [integer]
geo-captcha-challenge [enabled | disabled]
geo-client-side-defense [enabled | disabled]
geo-minimum-share [integer]
geo-rate-limiting [enabled | disabled]
geo-request-blocking-mode [block-all | rate-limit]
geo-share-increase-rate [integer]
ip-captcha-challenge [enabled | disabled]
ip-client-side-defense [enabled | disabled]
ip-maximum-tps [integer]
ip-minimum-tps [integer]
ip-rate-limiting [enabled | disabled]
ip-request-blocking-mode [block-all | rate-limit]
ip-tps-increase-rate [integer]
mode [off | transparent | blocking]
site-captcha-challenge [enabled | disabled]
site-client-side-defense [enabled | disabled]
site-maximum-tps [integer]
site-minimum-tps [integer]
site-rate-limiting [enabled | disabled]
site-tps-increase-rate [integer]
static-url-mitigation [enabled | disabled]
url-captcha-challenge [enabled | disabled]
url-client-side-defense [enabled | disabled]
url-maximum-tps [integer]
url-minimum-tps [integer]
url-rate-limiting [enabled | disabled]
url-tps-increase-rate [integer]
behavioral {
dos-detection [enabled | disabled]
anomaly-detection [enabled | disabled]
slowdown-incoming-requests [enabled | disabled]
rate-limit-incoming-requests [enabled | disabled]
preventive-mitigation [enabled | disabled]
}
}
tcp-dump {
maximum-duration [integer]
maximum-size [integer]
record-traffic [enabled | disabled]
repetition-interval [[integer] | once-per-attack]
}
tps-based {
de-escalation-period [integer]
1509
Traffic Management Shell (tmsh) Reference Guide
escalation-period [integer]
geo-captcha-challenge [enabled | disabled]
geo-client-side-defense [enabled | disabled]
geo-minimum-share [integer]
geo-rate-limiting [enabled | disabled]
geo-request-blocking-mode [block-all | rate-limit]
geo-share-increase-rate [integer]
ip-captcha-challenge [enabled | disabled]
ip-client-side-defense [enabled | disabled]
ip-maximum-tps [integer]
ip-minimum-tps [integer]
ip-rate-limiting [enabled | disabled]
ip-request-blocking-mode [block-all | rate-limit]
ip-tps-increase-rate [integer]
mode [off | transparent | blocking]
site-captcha-challenge [enabled | disabled]
site-client-side-defense [enabled | disabled]
site-maximum-tps [integer]
site-minimum-tps [integer]
site-rate-limiting [enabled | disabled]
site-tps-increase-rate [integer]
static-url-mitigation [enabled | disabled]
url-captcha-challenge [enabled | disabled]
url-client-side-defense [enabled | disabled]
url-maximum-tps [integer]
url-minimum-tps [integer]
url-rate-limiting [enabled | disabled]
url-tps-increase-rate [integer]
}
trigger-irule [enabled | disabled]
}
}
description [string]
dos-network [none | add | delete | modify | replace-all-with] {
name [string] {
behavioral-analysis [disabled | enabled]
network-attack-vector [none | add | delete | modify |
replace-all-with] {
attack-type [ext-hdr-too-large | hop-cnt-low | host-unreachable
|
icmpv4-flood | icmpv6-flood | icmp-frag | ip-frag-flood |
ip-opt-frames | ipv6-ext-hdr-frames | ipv6-frag-flood |
opt-present-with-illegal-len | sweep |
tcp-opt-overruns-tcp-hdr | tcp-rst-flood |
tcp-syn-flood | tcp-synack-flood | tidcmp |
too-many-ext-hdrs | tcp-syn-oversize | udp-flood | tcp-bad-urg
|
tcp-window-size | unk-tcp-opt-type]
rate-increase [integer]
rate-limit [integer]
rate-threshold [integer]
packet-types [suspicious | ipfrag | exthdr | tcp-syn-only |
tcp-synack | tcp-rst | host-unrch | tidcmp | icmp | udp-flood
|
dns-query-a | dns-query-aaaa | dns-query-any | dns-query-axfr
|
dns-query-cname | dns-query-ixfr | dns-query-mx | dns-query-ns
| dns-query-other | dns-query-ptr | dns-query-soa |
dns-query-srv | dns-query-src | dns-query-txt | sip-method-ack
| sip-method-cancel | sip-method-message | sip-method-options
|
sip-method-prack | sip-method-register | sip-method-bye |
sip-method-invite | sip-method-notify | sip-method-other |
sip-method-publish | sip-method-subscribe ]
auto-blacklisting [disabled | enabled]
blacklist-detection-seconds [integer]
blacklist-duration [integer]
blacklist-category [enter name of ip-intelligence category]
}
1510
Security DOS
}
}
protocol-dns [none | add | delete | modify | replace-all-with] {
name [string] {
dns-query-vector [none | add | delete | modify | replace-all-with]
{
query-type [a | aaaa | any | axfr | cname | ixfr | mx | ns |
other | ptr | soa | srv | txt ]
rate-increase [integer]
rate-limit [integer]
rate-threshold [intege]
}
prot-err-attack-detection [integer]
prot-err-atck-rate-incr [integer]
}
}
protocol-sip [none | add | delete | modify | replace-all-with] {
name [string] {
prot-err-atck-rate-increase [integer]
prot-err-atck-rate-threshold [integer]
prot-err-attack-detection [integer]
sip-method-vector [none | add | delete | modify | replace-all-with]
{
method-type [ack | cancel | message | options | prack | register
| bye | invite | notify | other | publish | subscribe ]
rate-increase [integer]
rate-limit [integer]
rate-threshold [integer]
}
}
}
whitelist [enter_name]
edit profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list profile
list profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config profile
show running-config profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete profile [name]
Description
You can use the prole component to create, modify, display, or delete a DoS prole for use with DoS
Protection functionality.
1511
Traffic Management Shell (tmsh) Reference Guide
Examples
create prole my_dos_prole
Creates a custom DoS prole named my_dos_prole with initial settings.
list prole
Displays the properties of all DoS proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• application
Adds, deletes, or replaces a single Application Security sub-prole. You can congure the following
options for Application Security:
• bot-defense
Species properties of proactive bot defense in Application Security. You can congure the following
options for Proactive Bot Defense:
• collect-stats
Enables or disables domain statistics collection.
• cross-domain-requests
Species a cross-domain requests handling mode. The options are:
• allow-all
Allows all cross-domain requests. This is the default value.
• validate-bulk
System validates domains in bulk: the cookies for the related domains are created together
with the cookie for the current domain, by generating challenges in iframes - one per each
domain.
• validate-upon-request
System validates domains upon request: the cookie for the related domain is generated when
a request arrives to an unqualied URL without a cookie.
• external-domains
Congures a list of external domains that are allowed to link to resources of this website.
• grace-period
Species the length of grace period (in seconds) in which only the Simple Bot Prevention is
enforced.
• mode
Species a mode of proactive bot defense. The options are:
• always
Species that the proactive bot defense is always enabled.
• disabled
Species that the proactive bot defense is disabled. This is the default value.
1512
Security DOS
• during-attacks
Species that the proactive bot defense is enabled only during attacks.
• site-domains
Congures a list of domains that are part of the website.
• url-whitelist
Congures a list of URLs to exclude from the proactive bot defense.
• browser-legit-enabled
Enables or disables the proactive bot defense validation of browser legitimacy and blocking of
requests from suspicious clients.
• browser-legit-captcha
Enables or disables the browser legitimacy detection improvement using CAPTCHA. In order
to enable it, you must rst enable browser-legit-enabled.
• bot-signatures
Species settings of Bot Signatures in Application Security. You can congure the following options
for Bot Signatures:
• categories
Species the action for each Bot Signature Category. You can congure the following options
for each Bot Signature Category:
• action
Species the action for the Bot Signature Category. The possible actions are none, block and
report.
• check
Enables or disables the checking of Bot Signature, allowing bots to be detected.
• disabled-categories
Congures a list of disabled Bot Signatures.
• captcha-response
Species properties of the CAPTCHA response in Application Security. You can congure the
following options for CAPTCHA Response Settings:
• failure
Species properties of a failed CAPTCHA response. You can congure the following options
for a failed CAPTCHA response:
• body
Congures a failed CAPTCHA response body.
• type
Congures a type of a failed CAPTCHA response body. You can congure the following
options for a failed CAPTCHA response type:
• custom
Congures a custom failed CAPTCHA response type.
• default
Congures a default failed CAPTCHA response type.
1513
Traffic Management Shell (tmsh) Reference Guide
• geolocations
Congures a list of blacklisted/whitelisted Geolocations. You can congure the following options
for each Geolocation:
• [black-listed | white-listed]
Species a type of Geolocation.
• heavy-urls
Species heavy URL protection in Application Security. You can congure the following options
for heavy URL protection:
• automatic-detection
Enables or disables automatic heavy URL detection. In order to enable it, you must rst enable
protection.
• exclude
Congures a list of URLs (or wildcards) to exclude from the heavy URLs.
• include
Congures a list of URLs to include in the heavy URLs.
• latency-threshold
Species the latency threshold for automatic heavy URL detection (in milliseconds).
• protection
Enables or disables heavy URL protection. To enable it, you must additionally enable one of the
following DoS URL-based prevention policy methods: url-client-side-defense or
url-rate-limiting. This can be done for either tps-based or stress-based anomaly protection.
• ip-whitelist
Adds, deletes, or replaces a set of IP addresses and subnets in the whitelist of Application Security.
• name
Species a dummy name for enabled Application Security. This option is required for the operations
create, delete, modify, and replace-all-with.
• stress-based
Species Stress-based anomaly in Application Security. You can congure the following options
for Stress-based anomaly:
• de-escalation-period
Species the de-escalation period (in seconds) in Stress-based anomaly.
• escalation-period
Species the escalation period (in seconds) in Stress-based anomaly.
• geo-captcha-challenge
Enables or disables Geolocation-based CAPTCHA challenge in Stress-based anomaly.
• geo-client-side-defense
Enables or disables Geolocation-based client side integrity defense in Stress-based anomaly.
• geo-minimum-share
Species the minimum trafc share for detection in Geolocation detection criteria of Stress-based
anomaly.
• geo-rate-limiting
1514
Security DOS
Enables or disables Geolocation-based rate limiting in Stress-based anomaly.
• geo-request-blocking-mode
Species a Geolocation-based request blocking mode of Stress-based anomaly. The options are:
• block-all
Species that the system blocks all requests from the respective Geolocation.
• rate-limit
Species that the system blocks requests from the respective Geolocation based on the trafc
share ratio. This is the default value.
• geo-share-increase-rate
Species the percentage by which TPS increased in Geolocation detection criteria of Stress-based
anomaly.
• ip-captcha-challenge
Enables or disables Source IP-based CAPTCHA challenge in Stress-based anomaly.
• ip-client-side-defense
Enables or disables Source IP-based client side integrity defense in Stress-based anomaly.
• ip-maximum-tps
Species the amount which TPS reached in IP detection criteria of Stress-based anomaly.
• ip-minimum-tps
Species the minimum TPS threshold for detection in IP detection criteria of Stress-based anomaly.
• ip-rate-limiting
Enables or disables Source IP-based rate limiting in Stress-based anomaly.
• ip-request-blocking-mode
Species a Source IP-based request blocking mode of Stress-based anomaly. The options are:
• block-all
Species that the system blocks all requests from the respective Source IP address.
• rate-limit
Species that the system blocks requests from the respective Source IP address based on the
trafc share ratio. This is the default value.
• ip-tps-increase-rate
Species the percentage by which TPS increased in IP detection criteria of Stress-based anomaly.
• mode
Species an operation mode of Stress-based anomaly. The options are:
• off
Species that the system does not check for DoS attacks. This is the default value.
• transparent
Species that when the system detects an attack, it displays the attack data on the Reporting
DoS Attacks screen. In transparent mode the system does not drop requests either from the
attacking IP address, or to attacked URLs.
• blocking
1515
Traffic Management Shell (tmsh) Reference Guide
Species that when the system detects an attack, in addition to displaying the attack data on
the Reporting DoS Attacks screen, the system also drops either connections from the attacking
IP address, or requests to attacked URLs.
• site-captcha-challenge
Enables or disables Site-wide CAPTCHA challenge in Stress-based anomaly.
• site-client-side-defense
Enables or disables Site-wide client side integrity defense in Stress-based anomaly.
• site-maximum-tps
Species the amount which TPS reached in Site-wide detection criteria of Stress-based anomaly.
• site-minimum-tps
Species the minimum TPS threshold for detection in Site-wide detection criteria of Stress-based
anomaly.
• site-rate-limiting
Enables or disables Site-wide rate limiting in Stress-based anomaly.
• site-tps-increase-rate
Species the percentage by which TPS increased in Site-wide detection criteria of Stress-based
anomaly.
• static-url-mitigation
Enables or disables Static URL mitigation in Stress-based anomaly.
• url-captcha-challenge
Enables or disables URL-based CAPTCHA challenge in Stress-based anomaly.
• url-client-side-defense
Enables or disables URL-based client side integrity defense in Stress-based anomaly.
• url-maximum-tps
Species the amount which TPS reached in URL detection criteria of Stress-based anomaly.
• url-minimum-tps
Species the minimum TPS threshold for detection in URL detection criteria of Stress-based
anomaly.
• url-rate-limiting
Enables or disables URL-based rate limiting in Stress-based anomaly.
• url-tps-increase-rate
Species the percentage by which TPS increased in URL detection criteria of Stress-based
anomaly.
• behavioral
Species properties of Behavioral Detection in Stress-based anomaly. You can congure the
following options for Behavioral Detection:
• dos-detection
Enables or disables the Behavior Based Detection.
• anomaly-detection
Enables or disables the detection of suspicious clients based on L7 behavioral analysis. In
order to enable it, you must rst enable dos-detection.
1516
Security DOS
• slowdown-incoming-requests
Enables or disables the slowdown of incoming requests from the detected suspicious clients.
In order to enable it, you must rst enable dos-detection and anomaly-detection.
• rate-limit-incoming-requests
Enables or disables the rate limit of incoming requests from the detected suspicious clients,
and of all incoming requests. In order to enable it, you must rst enable dos-detection.
• preventive-mitigation
Enables or disables the mitigation even before detecting a severe server health, in proportion
to the detected server health. In order to enable it, you must rst enable dos-detection.
• tcp-dump
Species properties of trafc recording during attacks in Application Security. You can congure
the following options for Record Trafc During Attacks:
• maximum-duration
Species the TCP dump maximum duration (in seconds).
• maximum-size
Species the TCP dump maximum size (in megabytes).
• record-trafc
Enables or disables trafc recording during attacks.
• repetition-interval
Species the TCP dump repetition interval (in seconds).
• tps-based
Species TPS-based anomaly in Application Security. You can congure the following options for
TPS-based anomaly:
• de-escalation-period
Species the de-escalation period (in seconds) in TPS-based anomaly.
• escalation-period
Species the escalation period (in seconds) in TPS-based anomaly.
• geo-captcha-challenge
Enables or disables Geolocation-based CAPTCHA challenge in TPS-based anomaly.
• geo-client-side-defense
Enables or disables Geolocation-based client side integrity defense in TPS-based anomaly.
• geo-minimum-share
Species the minimum trafc share for detection in Geolocation detection criteria of TPS-based
anomaly.
• geo-rate-limiting
Enables or disables Geolocation-based rate limiting in TPS-based anomaly.
• geo-request-blocking-mode
Species a Geolocation-based request blocking mode of TPS-based anomaly. The options are:
• block-all
Species that the system blocks all requests from the respective Geolocation.
1517
Traffic Management Shell (tmsh) Reference Guide
• rate-limit
Species that the system blocks requests from the respective Geolocation based on the trafc
share ratio. This is the default value.
• geo-share-increase-rate
Species the percentage by which TPS increased in Geolocation detection criteria of TPS-based
anomaly.
• ip-captcha-challenge
Enables or disables Source IP-based CAPTCHA challenge in TPS-based anomaly.
• ip-client-side-defense
Enables or disables Source IP-based client side integrity defense in TPS-based anomaly.
• ip-maximum-tps
Species the amount which TPS reached in IP detection criteria of TPS-based anomaly.
• ip-minimum-tps
Species the minimum TPS threshold for detection in IP detection criteria of TPS-based anomaly.
• ip-rate-limiting
Enables or disables Source IP-based rate limiting in TPS-based anomaly.
• ip-request-blocking-mode
Species a Source IP-based request blocking mode of TPS-based anomaly. The options are:
• block-all
Species that the system blocks all requests from the respective Source IP address.
• rate-limit
Species that the system blocks requests from the respective Source IP address based on the
trafc share ratio. This is the default value.
• ip-tps-increase-rate
Species the percentage by which TPS increased in IP detection criteria of TPS-based anomaly.
• mode
Species an operation mode of TPS-based anomaly. The options are:
• off
Species that the system does not check for DoS attacks. This is the default value.
• transparent
Species that when the system detects an attack, it displays the attack data on the Reporting
DoS Attacks screen. In transparent mode the system does not drop requests either from the
attacking IP address, or to attacked URLs.
• blocking
Species that when the system detects an attack, in addition to displaying the attack data on
the Reporting DoS Attacks screen, the system also drops either connections from the attacking
IP address, or requests to attacked URLs.
• site-captcha-challenge
Enables or disables Site-wide CAPTCHA challenge in TPS-based anomaly.
• site-client-side-defense
1518
Security DOS
Enables or disables Site-wide client side integrity defense in TPS-based anomaly.
• site-maximum-tps
Species the amount which TPS reached in Site-wide detection criteria of TPS-based anomaly.
• site-minimum-tps
Species the minimum TPS threshold for detection in Site-wide detection criteria of TPS-based
anomaly.
• site-rate-limiting
Enables or disables Site-wide rate limiting in TPS-based anomaly.
• site-tps-increase-rate
Species the percentage by which TPS increased in Site-wide detection criteria of TPS-based
anomaly.
• static-url-mitigation
Enables or disables Static URL mitigation in TPS-based anomaly.
• url-captcha-challenge
Enables or disables URL-based CAPTCHA challenge in TPS-based anomaly.
• url-client-side-defense
Enables or disables URL-based client side integrity defense in TPS-based anomaly.
• url-maximum-tps
Species the amount which TPS reached in URL detection criteria of TPS-based anomaly.
• url-minimum-tps
Species the minimum TPS threshold for detection in URL detection criteria of TPS-based
anomaly.
• url-rate-limiting
Enables or disables URL-based rate limiting in TPS-based anomaly.
• url-tps-increase-rate
Species the percentage by which TPS increased in URL detection criteria of TPS-based anomaly.
• trigger-irule
Species, when enabled, that the system activates an Application DoS iRule event. The default
value is disabled.
• description
User dened description.
• protocol-dns
Adds, deletes, or replaces a single Protocol DNS Security sub-prole. You can congure the following
options for Protocol DNS Security:
• name
Species a dummy name for enabled Protocol DNS Security. This option is required for the operations
create, delete, modify, and replace-all-with.
• dns-query-vector
Adds, deletes, or replaces Protocol DNS DoS vectors. You can congure the following options for
DNS query vectors:
1519
Traffic Management Shell (tmsh) Reference Guide
• query-type
Species the vector (DNS query) type for DoS attack detection.
• rate-increase
Species the rate increase for DoS attack detection.
• rate-limit
Species the rate limit for DoS attack detection.
• rate-threshold
Species the rate threshold for DoS attack detection.
• packet-types
Species the packet type for Sweep attack vector
• prot-err-attack-detection
Species if protocol errors attack detection is enabled or not. Eg: Malformed, Malicious DoS attacks.
• prot-err-atck-rate-incr
Species the protocol errors rate increase for DoS attack detection.
• rate-limit
Species the protocol errors rate limit for DoS attack detection.
• rate-threshold
Species the protocol errors rate threshold for DoS attack detection.
• protocol-sip
Adds, deletes, or replaces a single Protocol SIP Security sub-prole. You can congure the following
options for Protocol SIP Security:
• name
Species a dummy name for enabled Protocol SIP Security. This option is required for the operations
create, delete, modify, and replace-all-with.
• prot-err-atck-rate-increase
Species the protocol errors rate increase for DoS attack detection.
• prot-err-atck-rate-threshold
Species the protocol errors rate threshold for DoS attack detection.
• prot-err-attack-detection
Species if protocol errors attack detection is enabled or not. Eg: Malformed packets DoS attacks.
• sip-method-vector
Adds, deletes, or replaces Protocol SIP DoS vectors. You can congure the following options for
SIP method vectors:
• method-type
Species the vector type (SIP method) for DoS attack detection.
• rate-increase
Species the rate increase for DoS attack detection.
• rate-limit
Species the rate limit for DoS attack detection.
1520
Security DOS
• rate-threshold
Species the rate threshold for DoS attack detection.
• packet-types
Species the packet types for Sweep attack vector.
• dos-network
Adds, deletes, or replaces a single Network DoS Security sub-prole. You can congure the following
options for Network DoS Security:
• name
Species a dummy name for enabled Network DoS Security. This option is required for the
operations create, delete, modify, and replace-all-with.
• behavioral-analysis
This setting can be used to enable or disable the Behavioral based Anomaly/DoS feature per
virtual server by associating this prole to that virtual server. Default is disabled.
• network-attack-vector
Adds, deletes, or replaces Network Attack DoS vectors. You can congure the following options
for Network Attack vectors:
• attack-type
Species the vector type (Network Attack) for DoS attack detection.
• rate-increase
Species the rate increase for DoS attack detection.
• rate-limit
Species the rate limit for DoS attack detection.
• rate-threshold
Species the rate threshold for DoS attack detection.
• packet-types
Species the packet types for Sweep attack vector.
• whitelist
Species the Dos srcIP whitelist conguration.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by
an at sign (@[regular expression]) to indicate that the identier is a regular expression. See help
regex for a description of regular expression syntax.
1521
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, edit, glob, list, ltm virtual, modify, regex, security, security dos, show, tmsh
spva-stats
Shows the Conguration and Data path stats for sPVA.
Syntax
Displays the sPVA stats
Display
show security dos spva-stats
Description
This module shows the sPVA related conguration and data path stats. sPVA stats are relevant only in case
the Hardware is sPVA capable
Examples
show security dos spva-stats
Displays the below sPVA reslated stats
• Total SW entry
Total sPVA entry count present in SW
• Total HSB entry
Max number of sPVA entries in HSB
• Used HSB entry
Total number of sPVA entries present in HSB
• Global white list SW entry
Global whitelist entries present in SW
• Global white list HSB entry
Global Whitelist entries present in HSB.
• Global white list total entry
Total number of Global white list entries present in SW and HSB
• Global black list SW entry
Total number of global back list sPVA entries present in SW
• Global black list HSB entry
Total number of global black list sPVA entries present in HSB
• Global black list total entry
Total number of global black list entry count present in SW and HSB
• VS white list SW entry
1522
Security DOS
Total whitelist SW entry count for virtual server with port as wildcard.
• VS white list HSB entry
Total whitelist HSB entry count for virtual server with port as wildcard.
• VS white list total entry
Total count of white list entries present in SW and HSB for virtual server with port as wildcard.
• VS black list SW entry
Total black list SW entry count for virtual server with port as wildcard.
• VS black list HSB entry
Total black list HSB entry count for virtual server with port as wildcard.
• VS black list total entry
Total count of black list entries present in SW and HSB for virtual server with port as wildcard.
• App white list SW entry
Total whitelist SW entry count for application virtual server.
• App white list HSB entry
Total whitelist HSB entry count for application virtual server.
• App white list total entry
Total count of white list entries present in SW and HSB for application virtual server
• App black list SW entry
Total black list SW entry count for application virtual server
• App black list HSB entry
Total black list HSB entry count for application virtual server.
• App black list total entry
Total count of black list entries present in SW and HSB for application virtual server
• Global white list SW hit
Total packets hits for Gloabl White list in SW
• Global white list HSB hit
Total packets hits for Gloabl White list in HSB
• Global white list total hit
Total packets hits for global white list in SW and HSB.
• Global black list SW hit
Total packets hits for Gloabl black list in SW
• Global black list HSB hit
Total packets hits for Gloabl black list in HSB
• Global black list total hit
Total packets hits for black white list in SW and HSB.
• VS white list SW hit
Total packet hits for white list in SW for virtual server with port as wildcard.
• VS white list HSB hit
Total packet hits for white list in HSB for virtual server with port as wildcard.
1523
Traffic Management Shell (tmsh) Reference Guide
• VS white list total hit
Total packet hits for white list in SW and HSB for virtual server with port as wildcard.
• VS black list SW hit
Total packet hits for black list in SW for virtual server with port as wildcard.
• VS black list HSB hit
Total packet hits for black list in HSB for virtual server with port as wildcard.
• VS black list total hit
Total packet hits for black list in SW and HSB for virtual server with port as wildcard.
• App white list SW hit
Total packet hits for white list in SW for application virtual server.
• App white list HSB hit
Total packet hits for white list in HSB for application virtual server.
• App white list total hit
Total packet hits for white list in SW and HSB for application virtual server.
• App black list SW hit
Total packet hits for black list in SW for application virtual server.
• App black list HSB hit
Total packet hits for black list in HSB for application virtual server.
• App black list total hit
Total packet hits for black list in SW and HSB for application virtual server.
• White list SW hit
Total packet hits for white list in SW
• White list HSB hit
Total packet hits for white list in HSB
• White list total hit
Total packet hits for white list in SW and HSB
• Black list SW hit
Total packet hits for black list in SW
• Black list HSB hit
Total packet hits for black list in HSB
• Black list total hit
Total packet hits for black list in SW and HSB
udp-portlist
Congures the DoS udp portlist component within the security dos module using the syntax shown in the
following sections. These DoS udp portlist entries are applied to all udp packets except those going through
the management interface.
1524
Security DOS
Syntax
Modify
modify udp-portlist dos-udp-portlist
description [string]
list-type [exclude-listed-ports | include-listed-ports]
entries [modify | replace-all-with] {
[entry] {
description [string]
match-direction [both | dst | none | src]
port-number [number]
}
}
Display
list udp-portlist
Description
You can use the udp-portlist component to congure a DoS UDP portlist of upto eight entries for all UDP
trafc except the management interface. The HSB hardware compares all incoming UDP trafc to the
udp-portlist entries. There are 2 types of behavior, depending upon whether the udp port list is congured
as a white list or as a black list. White list and black list are mutually exclusive properties of a UDP port
list.
If the udp port list is congured as a list-type of exclude-listed-ports, and if a match is found on an incoming
packet, then we do not increment the UDP Flood DoS vector. If a match is not found, then the UDP Flood
DoS vector checks are done on those packets.
If the udp port list is congured as a list-type of include-listed-ports, and if a match is found on an incoming
packet, then we increment the UDP Flood DoS vector. If a match is not found, then the UDP Flood DoS
vector checks are not done on the packets.
Either destination port or source port or both can be specied in a udp-portlist entry.
Examples
modify udp-portlist dos-udp-portlist description "bad ports" list-type include-listed-ports Modies
the udp-portlist dos-udp-portlist to a blacklist.
modify udp-portlist dos-udp-portlist list-type exclude-listed-ports Modies the udp-portlist
dos-udp-portlist to a white-list.
modify udp-portlist dos-udp-portlist description "bad ports" entries modify { entry1 { match-direction
src port-number 161 } } Modies an entry. The new entry is for source UDP port 161. It matches any
UDP packet whose source port is 161.
modify udp-portlist dos-udp-portlist entries modify { 161 { match-direction both } }
Modies the entry for destination UDP port 161 to source and destination port 161. It matches any UDP
packet whose destination or source port is 161.
security dos udp-portlist dos-udp-portlist {
entries {
entry1 {
match-direction both
1525
Traffic Management Shell (tmsh) Reference Guide
port-number snmp
}
entry2 { }
entry3 { }
entry4 { }
}
white-list
}
Displays the current list of DoS UDP portlist entries.
Options
• description
Your description for the DoS udp-portlist.
• list-type
Sets the list type to be either exclude-listed-ports or include-listed-ports
• include-listed-ports
Sets the property of the dos-udp-portlist list to include-listed-ports (Blacklist).
• exclude-listed-ports
Sets the property of the dos-udp-portlist list to exclude-listed-ports (Whitelist).
• entries
Modies a udp-portlist entry.
• modify
Modies the existing entry that you specify next, in curly braces ({}). After the entry name, enter
the new conguration (port mode and port number) settings for the entry inside a nested set of curly
braces.
• replace-all-with
Replaces the current set of udp-portlist entries with the entry(s) that you specify next, in curly braces
({}).
Enter the name of a entry to be modied, then enter an open curly brace ({), one or more of the following
options, and a closed curly brace (}).
• description
Your description for the current entry.
• match-direction
Set the mode of matching (source, destination or both).
• port-number
Set the port number for matching.
See Also
edit, list, modify, security, security dos, tmsh
1526
Security DOS
Security Firewall
address-list
Congures an address-list for use by rewall rules. An address list is a list of IP-address prexes to compare
against the source-IP address and/or destination-IP address in an IP packet.
Syntax
Create/Modify
create address-list [name]
modify address-list [[name] | all]
addresses [add | delete | modify | replace-all-with] {
[ [ip address] ]
}
fqdns [add | delete | replace-all-with] {
[ fully qualified domain names]
}
fqdns none
geo [add | default | delete | replace-all-with] {
[ [country_code[:state_name/city_name] ] ]
}
geo none
app-service [name]
description [string]
edit address-list [[name] | all]
all-properties
non-default-properties
Display
list address-list [[name] | all | [property]]
show running-config address-list [[name] | all | [property]]
Delete
delete address-list [[name] | all]
Description
You can use the address-list component to dene reusable lists of addresses. You can use an address list
in any of the following rewalls and rewall rule lists: net self, net route-domain, security rewall
global-rules, security rewall rule-list, security rewall management-ip-rules, and ltm virtual. A
rewall rule compares all of the addresses in the list to either the source or destination IP in the packet,
depending on how you apply the list. If there is a match, the rewall rule takes an action, such as accepting
or dropping the packet.
Examples
create address-list alist1 addresses add { 10.10.1.1 10.10.1.2 192.168.24.0/24 }
Creates a new address list, "alist1," with two IPv4 addresses and one IPv4 subnet.
modify address-list alist1 addresses modify { 10.10.1.1 { description "management IP at wwmed site3"
} }
Modies the above address list with a description for the rst address.
modify alist1 geo add { TR:Istanbul }
Modies the above address list with an addition of a country:city/state.
modify address-list alist1 addresses add { 2001:DB8:a::/64 }
Modies the same address list by adding an IPv6 subnet.
list address-list alist1
security firewall address-list alist1 {
addresses {
10.10.1.1 {
description "management IP at wwmed site3"
}
10.10.1.2 { }
192.168.24.0/24 { }
2001:db8:a::/64 { }
}
}
Shows the modied address list.
create address-list xyz fqdns add { xyz.com }
Creates a new address list, "xyz" with a single fully qualied domain 'xyz.com'.
modify address-list xyz addresses add { 2001:DB8:a::/64 } fqdns add { abc.com }
Modies the same address list by adding an IPv6 subnet and another fully qualied domain 'abc.com'.
list address-list xyz
security firewall address-list xyz {
addresses {
2001:db8:a::/64 { }
}
fqdns {
abc.com { }
xyz.com { }
}
}
Shows the above address list 'xyz'.
Options
• addresses
Species a list of IP addresses and/or subnets to compare against a packet's source or destination address.
The format for an IPv4 address is a. b. c. d [/ prex ]. The general format for an IPv6 address is a: b: c:
d: e: f: g: h [/ prex ]; you can shorten this by eliminating leading zeros from each eld (for example,
1528
Security Firewall
you can shorten "2001:0db7:3f4a:09dd:ca90:ff00:0042:8329" to "2001:db7:3f4a:9dd:ca90:ff00:42:8329"),
and/or by removing the longest contiguous eld of zeros (for example, you can shorten
"2001:0:0:0:c34a:0:23ff:678" to "2001::c34a:0:23ff:678"). TMSH accepts any valid text representation
of IPv6 addresses, as dened in RFC 2373 (see http://www.ietf.org/rfc/rfc2373.txt).
The next keyword species the action to take with the addresses (add, delete, modify, or replace the
current set of addresses).
• add
Creates a new address list, which you specify next with IP addresses and/or prexes in curly braces
({}).
• delete
Deletes the address(es) that you specify next, in curly braces ({}).
• modify
Makes it possible to replace the optional description(s) for the address(es). You can specify a
description in a nested set of curly braces after each address.
• replace-all-with
Replaces the current set of IP addresses with the address(es) that you specify next, in curly braces
({}).
• fqdns
Species a list of fully qualied domain names to compare against packet's destination IP address
domain.
The next keyword species the action to take with the fqdns (add, delete, or replace the current set of
fqdns).
• geo
Species a list of geographic locations that the packet will be compared against.
• app-service
Associates this address list with a particular Application Service. An Application Service is a major
component of an iApp, an advanced conguration tool for creating and maintaining similar applications
on multiple servers. The asm module (see asm) has components for working with iApps.
• description
Is your description for this address list.
See Also
edit, list, modify, net self, net route-domain, security rewall global-rules, security rewall
management-ip-rules, security rewall rule-list, ltm virtual, tmsh
config-change-log
Congures rewall conguration change log setting.
Syntax
Modify the cong-change-log component within the security rewall module using the syntax shown in
the following sections.
1529
Traffic Management Shell (tmsh) Reference Guide
Modify
modify config-change-log log-changes [automatic | on | off]
modify config-change-log log-publisher [none | [name]]
Display
list config-change-log
show running-config config-change-log
Description
You can use the cong-change-log component to congure if changes to the rewall rules should be logged
or not. The default is to automatically determine if log is needed based on the mode of the
on-demand-compilation. If the mode of the on-demand-compilation is 'enabled', the changes will be logged.
If change log is enabled, a publisher need to be congured too.
Examples
modify config-change-log log-changes on log-publisher local-db-publisher
container-stat
Show the compilation result of rewall rules.
Syntax
show container-stat
Description
You can use the container-stat component to display the compilation result of rewall rules for each
container. For rewall rules, a container is uniquely identied by the combination of context type, context
name and policy type. The outputs of the command include: the time it takes to compile the rules and to
perform overlapping check for each container, the number of micro-rules, the size of the containers in bytes,
the amount of memory used for compilation, and the time the container is activated.
Examples
show security firewall container-stat
1530
Security Firewall
current-state
Show the current state of rewall rules compilation.
Syntax
show current-state
Description
You can use the current-state component to display the current system-wide state of rewall rules
compilation. The outputs of the command includes: the mode of on-demand compilation and on-demand
rule deploy (enabled or disabled), the rule compiler status (quiescent, pending-compilation, being-compiled,
pending-deployment, being-deployed, failed-compilation, failed-deployment, pccd-failed), compilation
start time, compilation end time, deployment start time, deployment end time, aggregate number of
micro-rules, active blob name, blob creation time, and if the blob MD5 is veried or not.
Examples
show security firewall current-state
See Also
security rewall on-demand-compilation, security rewall on-demand-rule-deploy
fqdn-entity
Perform on-demand refresh to query IP mappings for one (or all) congured FQDNs in rewall rules.
Syntax
Use the fqdn-entity component within the security rewall module to perform on-demand refresh to query
IP mappings for a specic FQDN (or all FQDNs) congured in rewall rules using the following syntax:
Display
load fqdn-entity [all | name]
Description
You can use the fqdn-entity component to perform on-demand refresh to query IP mappings for one or all
congured FQDNs in rewall rules.
BigIP will periodically refresh IP mappings for each FQDN upon previous mappings expiry time or after
refresh-interval as congured in security rewall global-fqdn-policy whichever is greater. fqdn-entity
1531
Traffic Management Shell (tmsh) Reference Guide
component can be used to refresh the IP mappings irrespective of either the expiry time or the
refresh-interval.
Examples
load fqdn-entity all
Perform on-demand refresh for all the congured FQDNs in rewall rules.
load fqdn-entity f5.com
Perform on-demand refresh for fqdn 'f5.com' congured in one of the rewall rules.
See Also
security rewall address-list, security rewall policy, security rewall rule-list, security rewall fqdn-info,
security rewall global-fqdn-policy
fqdn-info
Query run time information for one (or all) congured FQDNs in rewall rules.
Syntax
Use the fqdn-info component within the security rewall module to query run time information for one
(or all) congured FQDNs in rewall rules using the following syntax:
Display
show fqdn-info fqdn [all | name]
Description
You can use the fqdn-info component to query run time information for one or all congured FQDNs in
rewall rules. Use option fqdn to query information regarding a specic FQDN or all FQDNs congured
in rewall rules.
Following information related to each FQDN is queried using fqdn-info component: a) Last Refresh time.
b) Next Refresh time. c) Last Successful Refresh. d) DNS Records valid until e) IP Addresses
Options
• fqdn
Species the name of a FQDN. Use 'all' to query information for all congured FQDNs.
Examples
show fqdn-info fqdn all
Query information for all the congured FQDNs in rewall rules.
show fqdn-info fqdn f5.com
Query information for fqdn 'f5.com' congured in one of the rewall rules.
1532
Security Firewall
See Also
security rewall address-list, security rewall policy, security rewall rule-list
global-fqdn-policy
Congures the global fqdn policy which is used to resolve FQDN names to IP Address mappings for the
FQDN names that are specied in the rewall rules.
Syntax
Modify the global-fqdn-policy component within the security rewall module using the syntax shown in
the following sections.
Modify
modify global-fqdn-policy
app-service [name]
description [string]
dns-resolver [ [resolver_name] | none ]
refresh-interval [integer]
edit global-fqdn-policy
all-properties
non-default-properties
one-line
partition
recursive
Display
list global-fqdn-policy
show running-config global-fqdn-policy
all-properties
non-default-properties
one-line
partition
recursive
Description
You can use the global-fqdn-policy component to congure a net dns-resolver that will be used by rewall
to resolve FQDN names to IP Address mappings. These mappings in turn will be used to match rewall
rules (across all policies on all contexts) based on FQDN constraints.
Examples
modify global-fqdn-policy dns-resolver xyz
Modies the global-fqdn-policy to use dns resolver object named 'xyz'. Default refresh-interval is 60 minutes.
modify global-fqdn-policy dns-resolver xyz refresh-interval 120
1533
Traffic Management Shell (tmsh) Reference Guide
Modies the global-fqdn-policy to use dns resolver object named 'xyz' and specify periodic refresh rate of
120 minutes (2 hours) to re-resolve FQDN-to-IP mappings.
list global-fqdn-policy
Displays the current list of global-fqdn-policy contents.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description.
• dns-resolver
Species an existing net dns-resolver. This will be used by rewall to obtain FQDN-to-IP Address
mappings which will be used to match rewall rules based on FQDN constraints. Note dns-resolver
none can be used to remove the object from global-fqdn-policy if and only if there are no AFM rules
with (non empty) FQDN constraints.
• refresh-interval
Species refresh interval to be used to re-resolve FQDN-to-IP mappings. Unit is in minutes and default
is 60 minutes. Minimum allowed is 10 minutes and maximum is 46080 minutes.
See Also
create, edit, list, modify, security rewall, security rewall policy, net dns-resolver tmsh
global-rules
Congures the global network rewall rules. These rewall rules are applied to all packets except those
going through the management interface. They are applied rst, before any rewall rules for the packet's
virtual server, route domain, and/or self IP.
Syntax
Modify
modify global-rules
description [string]
enforced-policy [ [policy_name] | none ]
staged-policy [ [policy_name] | none ]
service-policy [ [policy_name] | none ]
edit global-rules
1534
Security Firewall
all-properties
non-default-properties
reset-stats global-rules
enforced-policy-rules { [rule name] }
staged-policy-rules { [rule name] }
options:
port-misuse
Display
list global-rules
show running-config global-rules
show global-rules
active
enforced-policy-rules
staged-policy-rules
options:
port-misuse
overlapping-status
Description
You can use the global-rules component to congure network rewall policy which is enforced or staged
on all IP and ICMP trafc except trafc on the management IP.
Examples
list global-rules
security firewall global-rules {
enforced-policy /Common/policy1
}
Displays the current list of global rules.
Options
• description
Your description for the global list of rewall rules.
• enforced-policy
Species an enforced rewall policy. enforced-policy rules are enforced globally.
• enforced-policy-rules
1535
Traffic Management Shell (tmsh) Reference Guide
Species rewall rules enforced on trafc globally via referenced enforced-policy.
• overlapping-status
Display detail overlapping information
• port-misuse
Used to show or reset global port misuse policy statistics.
• staged-policy
Species a staged rewall policy. staged-policy rules are not enforced while all the visibility aspects
namely statistics, reporting and logging function as if the staged-policy rules were enforced globally.
• staged-policy-rules
Species rewall rules staged on trafc globally via referenced staged-policy.
• service-policy
Species a service policy that would apply to trafc globally. The service policy is applied to all ows,
provided if there are no other context specic service policy conguration that overrides the global
service policy. For example, when a service policy is congured both at a global level, as well as on a
rewall rule, and a ow matches the rule, the more specic service policy conguration in the rule will
override the service policy setting at the global level. The service policy associated here can be created
using net service-policy command.
See Also
edit, list, modify, security rewall address-list, security rewall port-list, security rewall rule-list, security
log prole, security rewall schedule, tmsh, security rewall policy, net service-policy
management-ip-rules
Congures the management IP rewall rules. These rewall rules are applied to all packets that go through
the management interface.
Syntax
Modify
modify management-ip-rules
description [string]
rules [add | delete | modify | replace-all-with] {
[ [name] ] {
action [accept | accept-decisively | drop | reject]
description [string]
destination {
address-lists [add | default | delete | replace-all-with] {
[address list names...]
}
address-lists none
addresses [add | default | delete | replace-all-with] {
[ [ip address] | [ip address/prefixlen] ]
}
addresses none
port-lists [add | default | delete | replace-all-with] {
[port list names...]
}
1536
Security Firewall
port-lists none
ports [add | default | delete | none | replace-all-with] {
[ [port] | [port1-port2] ]
}
ports none
}
icmp [add | delete | modify | replace-all-with] {
[ [icmp_type] | icmp_type:icmp_code ] {
description [string]
}
}
icmp none
ip-protocol [protocol name]
log [no | yes]
place-after [first | last | [rule name]]
place-before [first | last | [rule name]]
rule-list [rule list name]
schedule [schedule name]
source {
address-lists [add | default | delete | replace-all-with] {
[address list names...]
}
address-lists none
addresses [add | default | delete | replace-all-with] {
[ [ip address] | [ip_address/prefixlen] ]
}
addresses none
port-lists [add | default | delete | replace-all-with] {
[port list names...]
}
port-lists none
ports [add | default | delete | replace-all-with] {
[ [port] | [port1-port2] ]
}
ports none
vlans [add | default | delete | replace-all-with] {
[vlan names...]
}
vlans none
}
status [disabled | enabled | scheduled]
}
}
rules none
edit management-ip-rules
all-properties
non-default-properties
Display
list management-ip-rules
show running-config management-ip-rules
Description
You can use the management-ip-rules component to congure network rewall rules that are applied to
all management interface trafc. The network software compares IP packets to the criteria specied in these
rules. If a packet matches the criteria then the system takes the action specied by the rule. If a packet does
not match a rule then the software compares the packet against the next rule. If a packet does not match any
rule the packet is accepted.
1537
Traffic Management Shell (tmsh) Reference Guide
For conguration sync management-ip-rules are synced to the devicegroup that has a type eld of
sync-failover. See cm cong-sync.
Matching An Ip Packet
You can use this TMSH component to match against any or all of the following properties of an IP packet:
• source address
• source port
• the packet's source VLAN
• destination address
• destination port
• the higher-level protocol in the packet's payload
If you match against more than one of these items, a packet must pass all of your tests to successfully match.
For example, if you match against a source subnet and several destination ports, a packet must originate
from the given subnet and must also have one of the specied destination ports.
Rule Order
Rules are evaluated in the order that you specify. You can use the list management-ip-rules command to
see the current rule order. As you add or modify rules in this component, you can use the place-before
rule-name or place-after rule-name option to choose the rule's place in the sequence.
Rule order can determine whether or not a packet is dropped. Consider the following rules:
• rule_a, matches source addresses against 172.16.0.0 and ACCEPTS all packets that match.
• rule_d, matches source addresses against 172.16.39.0 and DROPS all packets that match.
Also consider a packet from a host at 172.16.39.55. If rule_a appears before rule_d in the rule list, the
packet's source address matches rule_a rst and the software accepts it. The software never reaches rule_d
for comparison. If rule_d appears rst instead, the packet's source address now matches rule_d; in this case,
the software drops the packet.
Examples
modify management-ip-rules rules add { reject-internal-net { source { addresses replace-all-with {
172.27.0.0/16 } } action reject place-before rst } }
Creates a rule entry at the beginning of the list that rejects trafc from the 172.27.0.0 network.
modify management-ip-rules rules add { reject-insecure-ports { rule-list block_bad_mgmt place-before
rst } }
Adds a sub rule list to the management-IP rewall. Use the security rewall rule-list component to create
a custom rule list.
list management-ip-rules
security firewall management-ip-rules {
rules {
reject-insecure-ports {
rule-list block_bad_mgmt
}
reject-internal-net {
action reject
source {
addresses {
172.27.0.0/16 { }
}
}
1538
Security Firewall
}
}
}
Displays the current list of management-rewall rules.
modify management-ip-rules rules delete { reject-internal-net }
Removes the reject-internal-net rule from the management-IP rewall.
Options
• description
Your description for the management-rewall rules.
• rules
Adds, deletes, or replaces a rewall rule.
• add
Creates a new rule, which you specify next with a unique string in curly braces ({}). Use the
place-before or place-after option inside the curly braces to determine the order of the rule. If this
is the rst rule, use the replace-all-with option instead of add.
• delete
Deletes the rule that you specify next, in curly braces ({}).
• modify
Modies the existing rule that you specify next, in curly braces ({}). After the rule name, enter the
new conguration settings for the rule inside a nested set of curly braces.
• replace-all-with
Replaces the current set of global rules with the rule(s) that you specify next, in curly braces ({}).
Use this option for the rst management rule.
• none
Empties the list of management-rewall rules. This implicitly accepts all packets on the management
interface.
Enter the name of a rule to be added or modied, then enter an open curly brace ({), one or more of the
following options, and a closed curly brace (}).
• action
Species the action that the system takes when a packet matches the rule.
• accept
Species that a matching packet should be accepted. The security software stops comparing a
matching packet to any other management-rewall rules.
• accept-decisively
This option is functionally the same as accept.
• drop
Species that a matching packet should be silently dropped. The security software sends nothing
back to the packet source, and it does not compare the packet to any other management-rewall
rules.
• reject
1539
Traffic Management Shell (tmsh) Reference Guide
Species that a matching packet should be dropped. For TCP-based protocols, the security
software sends a TCP reset (with the RST ag raised) back to the source. For other protocols,
reject is equivalent to drop.
• app-service
Associates the management-rule list with a particular Application Service. An Application Service
is a major component of an iApp, an advanced conguration tool for creating and maintaining similar
applications on multiple servers. The asm module has components for working with iApps.
• description
Your description for the current rule.
• destination
Matches against each packet's destination IP and/or destination port. The next options choose the
matching criteria.
• address-lists
Species a list of IP-address lists (see security rewall address-list) to compare against the
packet's destination address.
This list uses the same add, delete, none, and replace-all-with options described above for rules,
as well as a default option.
• addresses
Species a list of IP addresses and/or subnets to compare against the packet's destination address.
The format for an IPv4 address is a. b. c. d [/ prex ]. The general format for an IPv6 address is
a: b: c: d: e: f: g: h [/ prex ]; you can shorten this by eliminating leading zeros from each eld
(for example, you can shorten "2001:0db7:3f4a:09dd:ca90:ff00:0042:8329" to
"2001:db7:3f4a:9dd:ca90:ff00:42:8329"), and/or by removing the longest contiguous eld of
zeros (for example, you can shorten "2001:0:0:0:c34a:0:23ff:678" to "2001::c34a:0:23ff:678").
TMSH accepts any valid text representation of IPv6 addresses, as dened in RFC 2373 (see
http://www.ietf.org/rfc/rfc2373.txt).
To edit this list, use the same add, delete, modify, none, and replace-all-with options described
above for rules.
• port-lists
Species a collection of port lists (see security rewall port-list) to compare against the packet's
destination port. If you use this option to specify a port list, a packet only matches if it's destination
port matches a port on these lists.
This list uses the same add, delete, none, and replace-all-with options described above for rules,
as well as a default option.
• ports
Species a list of ports and port ranges to compare against the packet's destination port.
To edit this list, use the same add, delete, modify, none, and replace-all-with options described
above for rules.
• icmp
Species a list of ICMP types and codes to compare against the packet. You must set the ip-protocol
option to "icmp" for this option to function. If you use this option, the current rule only matches
ICMP packets that have the ICMP properties you specify here. You can add, delete, or modify (that
is, change the description of) any entry in the list, or replace-all-with a new set of entries that you
specify between curly braces ({}).
1540
Security Firewall
Use the standard integer identiers to specify an ICMP type. For example: 3 is destination unreachable
and 3:1 is destination unreachable with a code of host unreachable. The ofcial list of ICMP types
and codes is here: http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml.
• ip-protocol
Species the IP protocol to compare against the packet. This could be a layer-3 protocol (such as
ipv4 or ipv6), or a higher-level protocol like ospf, rdp, or icmp. If you specify this option, a packet
only matches if it uses the chosen protocol. Press the <tab> key for a full list of valid protocols.
• log
Species whether the security software should write a log entry for all packets that match this rule.
You must also enable network lter logging in the security log prole component for this option
to have any effect. Note that the security software always increments the statistics counter when a
packet matches a rule, no matter how you set this option.
• place-after [rst | last | rule-name]
Species that a new rule should be placed after the rst rule, the last rule, or the rule-name you
specify. If you are adding individual rules (as opposed to specifying replace-all-with), then you
must use place-before or place-after to specify the rule's position in the list.
• place-before [rst | last | rule-name]
Species that a new rule should be placed before the rst rule, the last rule, or the rule-name you
specify. If you are adding individual rules (as opposed to specifying replace-all-with), then you
must use place-before or place-after to specify the rule's position in the list.
• rule-list
Species a full rule list instead of a customized rule that you might dene with the other options.
See security rewall rule-list. If you use this option, then only the schedule and status options are
valid; the tmsh software rejects any other options that you attempt to use with rule-list.
• schedule
Species a schedule for the rule. See security rewall schedule. If you omit this option, the rule or
rule list is enabled all the time.
If the rule refers to a rule-list, the rule-list is enabled according to the schedule. When the rule list
is enabled, the security software then honors the schedules dened within the rule-list.
• source
Matches against each packet's source IP, source port, and/or source VLAN. The next options choose
the matching criteria.
• address-lists
Species a list of address lists (see security rewall address-list) to compare against the packet's
source address.
This list uses the same add, delete, none, and replace-all-with options described above for rules,
as well as a default option.
• addresses
Species a list of IP addresses and networks to compare against the packet's source address.
The format for an IPv4 address is a. b. c. d. The general format for an IPv6 address is a: b: c: d:
e: f: g: h.
To edit this list, use the same add, delete, modify, none, and replace-all-with options described
above for rules.
• port-lists
1541
Traffic Management Shell (tmsh) Reference Guide
Species a collection of port lists (see security rewall port-list) to compare against the packet's
source port. If you use this option to specify a port list, a packet only matches if its source port
matches a port on these lists.
This list uses the same add, delete, none, and replace-all-with options described above for rules,
as well as a default option.
• ports
Species a list of ports and port ranges to compare against the packet's source port.
To edit this list, use the same add, delete, modify, none, and replace-all-with options described
above for rules.
• vlans
Species a list of VLANs, VLAN groups, and tunnels to compare against the packet.
This list uses the same add, delete, none, and replace-all-with options described above for rules,
as well as a default option.
• status
Species whether the rule is enabled, disabled or scheduled. A rule that is enabled is always
checked. A rule that is disabled is never checked. A rule that is scheduled is checked according to
the corresponding schedule conguration. A rule that is scheduled must have an associated schedule
conguration.
See Also
cm cong-sync, cm device-group, edit, list, modify, security rewall address-list, security rewall port-list,
security rewall rule-list, security log prole, security rewall schedule, tmsh
matching-rule
Shows the best match rewall rule amongst all the admin congured Network Firewall rules in different
contexts (global, route-domain, VIP/SelfIP) given source/destination IP address and port, protocol and user
congured vlan name. You can only use the show command with this component.
Syntax
show matching-rule
dest-addr [IP address]
source-addr [IP address]
dest-port [TCP/UDP port]
source-port [TCP/UDP port]
protocol [protocol]
vlan [vlan name]
Description
With user provided VLAN, source/destination IP addresses, TCP/UDP ports and protocol, the command
will try to match these parameters against user congured ACL rules in global, route domain, VIP/SelfIP
context, and return the best match rules. Both IPv4 and IPv6 addresses and all possible protocols are
supported. This command can be used as a diagnostic tool to trouble-shoot BigIP rewall conguration
problem. It provides a faster way to identify which ACL rule will have impact to the specied packet stream.
1542
Security Firewall
Examples
# show security rewall matching-rule dest-addr 1.1.1.1 dest-port 140 source-addr 2.2.2.2 source-port 141
protocol 10 vlan /Common/internal
Firewall Matching Rule:
-----------------------------------------------------------
Context Type Context Name Policy Name Rule Name Action
-----------------------------------------------------------
Global globalrule Accept
Total records returned: 1
See Also
show, tmsh
on-demand-compilation
Congures the compilation mode of rewall rules.
Syntax
Modify
modify on-demand-compilation mode [disabled | enabled]
Display
list on-demand-compilation mode
show running-config on-demand-compilation mode
Trigger On-Demand Compilation
run on-demand-compilation
Description
You can use the on-demand-compilation component to change the behavior of rewall rule compilation.
By default the system will automatically compile the changes at each conguration change. You can change
the behavior to manually trigger the compilation by setting the mode to enabled.
1543
Traffic Management Shell (tmsh) Reference Guide
Examples
modify security firewall on-demand-compilation mode enabled
run security firewall on-demand-compilation
See Also
security rewall on-demand-rule-deploy
on-demand-rule-deploy
Congures the rule deploy mode of rewall rules.
Syntax
Modify
modify on-demand-rule-deploy mode [disabled | enabled]
Display
list on-demand-rule-deploy mode
show running-config on-demand-rule-deploy mode
Trigger On-Demand Rule Deploy
run on-demand-rule-deploy
Description
You can use the on-demand-rule-deploy component to change the behavior of rewall rule deployment.
By default the system will automatically deploy the changes once the compilation is successful. You can
change the behavior to manually trigger the rule deployment by setting the mode to enabled.
Examples
modify security firewall on-demand-rule-deploy mode enabled
run security firewall on-demand-rule-deploy
1544
Security Firewall
See Also
security rewall on-demand-compilation
policy
Congures rewall policy.
Syntax
Modify the policy component within the security rewall module using the syntax shown in the following
sections.
Create/Modify
create policy [name]
copy-from [string]
modify policy [name]
description [string]
rules [add | delete | modify | replace-all-with] {
[ [name] ] {
action [accept | accept-decisively | drop | reject]
description [string]
destination {
address-lists [add | default | delete | replace-all-with] {
[address list names...]
}
address-lists none
addresses [add | default | delete | replace-all-with] {
[ [ip address] | [ip address/prefixlen] ]
}
addresses none
fqdns [add | delete | replace-all-with] {
[ fully qualified domain names]
}
fqdns none
geo [add | default | delete | replace-all-with] {
[ [country_code [state state_name] ] ]
}
geo none
port-lists [add | default | delete | replace-all-with] {
[port list names...]
}
port-lists none
ports [add | default | delete | none | replace-all-with] {
[ [port] | [port1-port2] ]
}
ports none
}
icmp [add | delete | modify | replace-all-with] {
[ [icmp_type] | icmp_type:icmp_code ] {
description [string]
}
}
icmp none
ip-protocol [protocol name]
irule [irule name]
irule-sample-rate [integer]
log [no | yes]
place-after [first | last | [rule name]]
place-before [first | last | [rule name]]
rule-list [rule list name]
1545
Traffic Management Shell (tmsh) Reference Guide
schedule [schedule name]
source {
address-lists [add | default | delete | replace-all-with] {
[address list names...]
}
address-lists none
addresses [add | default | delete | replace-all-with] {
[ [ip address] | [ip_address/prefixlen] ]
}
addresses none
fqdns [add | delete | replace-all-with] {
[ fully qualified domain names]
}
fqdns none
geo [add | default | delete | replace-all-with] {
[ [country_code [state state_name] ] ]
}
geo none
identity {
user-groups [add | delete | modify | none | replace-all-with] {
[user group names...]
}
user-lists [add | delete | modify | none | replace-all-with] {
[user list names...]
}
users [add | delete | modify | none | replace-all-with] {
[user names...]
}
}
port-lists [add | default | delete | replace-all-with] {
[port list names...]
}
port-lists none
ports [add | default | delete | replace-all-with] {
[ [port] | [port1-port2] ]
}
ports none
vlans [add | default | delete | replace-all-with] {
[vlan names...]
}
vlans none
}
status [disabled | enabled | scheduled]
service-policy [ service policy name]
}
}
rules none
edit policy
all-properties
non-default-properties
Display
list policy
show running-config policy
all-properties
non-default-properties
one-line
1546
Security Firewall
Description
You can use the policy component to congure a shareable and reusable set of network rewall rules which
can be associated as enforced or staged with a number of conguration objects of the following types: net
self, ltm virtual, security rewall global-rules, net route-domain.
Examples
modify policy rules add { reject-internal-net { place-before rst action reject source { addresses
replace-all-with { 172.27.0.0/16 } } }
Creates a rule entry at the beginning of the list that rejects trafc from the 172.27.0.0 network.
modify policy rules delete reject-internal-net
Removes the rule reject-internal-net from the list of rules.
create security rewall policy p1 rules add { r1 { source { geo add { US } } action reject place-after
rst } } Creates a policy with a single rule that rejects all packets from the US.
create security rewall policy xyz rules add { r1 { destination { fqdns add { f5.com } } action accept
place-after rst } } Creates a policy named 'xyz' with a single rule (named 'r1') that accepts all packets with
destination IP address in domain 'f5.com'.
list policy
Displays the current list of policy rules.
create policy "New Policy" copy-from "/Common/Existing Policy"
Creates a new policy New Policy by copying existing policy /Common/Existing Policy.
Options
• description
User dened description.
• copy-from
(CREATE)Species the name of an existing policy from which to copy all conguration options.
• rules
Adds, deletes, or replaces a rewall rule.
• action
Species the action that the system takes when a rule is matched.
• accept
Species that the current packet should be accepted.
• accept-decisively
Species that the current packet should be accepted and that packet will not be compared to any
other rewall rules in any other context.
• drop
Species that the current packet should be silently dropped. Nothing is sent back to the packet
source. The packet is not compared to any other rewall rules.
• reject
Species that the current packet should be dropped. For TCP based protocols a TCP reset is sent
to the source. For other protocols reject is equivalent to drop.
• description
1547
Traffic Management Shell (tmsh) Reference Guide
User dened description.
• destination
• address-lists
Species a list of address lists (see security rewall address-list) against which the packet will
be compared.
• addresses
Species a list of addresses and networks against which the packet will be compared.
• fqdns
Species a list of fully qualied domain names to compare against packet's destination IP address
domain.
• geo
Species a list of Geo Locations that the packet will be compared against.
• port-lists
Species a list of port lists (see security rewall port-list) against which the packet will be
compared.
• ports
Species a list of ports and port ranges against which the packet will be compared.
• icmp
Species a list of ICMP types and codes against which the packet will be compared. The standard
integer identiers are used to specify an ICMP type Example: 3 is destination unreachable and 3:1
is destination unreachable with a code of host unreachable. The list of ICMP types and codes can
be found here http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml.
• ip-protocol
Species the IP protocol against which the packet will be compared.
• irule
Species the name of the iRule that will be triggered when a packet matches this rewall rule. The
rewall rule match raises a FLOW_INIT iRule event.
• irule-sample-rate
Species the rate at which an iRule specied by irule option will be triggered when a packet matches
this rewall rule. The rate is an integer value in the range 0-65535 and species how many packets
must match this rewall rule before the iRule is triggered. The default value is 1 and causes the iRule
to be triggered for every packet that matches this rewall rule. A value of 0 disables iRule triggering.
• log
Species whether the packet will be logged if it matches the rule. Logging must also be enabled in
the corresponding logging conguration. (e.g. security log prole global-network when policy
assigned to global-rules). Note that the statistics counter is always incremented when a packet
matches a rule.
• place-after
Species that a new rule should be placed after another rule, rst or last. If individual rules are being
added (as opposed to specifying replace-all-with) then place-before or place-after must be specied.
• place-before
Species that a new rule should be placed before another rule, rst or last. If individual rules are
being added (as opposed to specifying replace-all-with) then place-before or place-after must be
specied.
1548
Security Firewall
• rule-list
Species a list of rules to evaluate. See security rewall rule-list. If a rule-list is specied then
only the schedule and status properties effect the rule.
• schedule
Species a schedule for the rule. See security rewall schedule. If the rule refers to a rule-list the
rule-list will be enabled according to the schedule. When the rule list is enabled, the schedules
dened within the rule-list will be honored.
• source
• address-lists
Species a list of address lists (see security rewall address-list) against which the packet will
be compared.
• addresses
Species a list of addresses and networks against which the packet will be compared.
• fqdns
Species a list of fully qualied domain names to compare against packet's source IP address
domain.
• geo
Species a list of Geo Locations against which the packet will be compared.
• port-lists
Species a list of port lists (see security rewall port-list) against which the packet will be
compared.
• ports
Species a list of ports and port ranges against which the packet will be compared.
• vlans
Species a list of vlans, vlan groups and tunnels against which the packet will be compared.
• status
Species whether the rule is enabled, disabled or scheduled. A rule that is enabled is always
checked. A rule that is disabled is never checked. A rule that is scheduled is checked according to
the corresponding schedule conguration. A rule that is scheduled must have an associated schedule
conguration.
• service-policy
Species the service policy conguration to use. (see net service-policy). The service policy can be
used to set specic policy based congurations like ow timers, which applies to the ows that
matches the rule.
See Also
create, edit, list, modify, security rewall address-list, security rewall port-list, security rewall rule-list,
security log prole, security rewall schedule, net service-policy, tmsh
1549
Traffic Management Shell (tmsh) Reference Guide
port-list
Congures a port-list for use by rewall rules. A rewall rule can match a packet's source port or destination
port against one of the ports in a port list, and can take some action (such as ACCEPT or DROP) for a
matching packet.
Syntax
Create/Modify
create port-list [name]
modify port-list [[name] | all]
app-service [name]
description [string]
ports [add | delete | modify | replace-all-with] {
[ [port] | [port] - [port] ]
}
edit port-list [[name] | all]
all-properties
non-default-properties
Display
list port-list [[name] | all | [property]]
show running-config port-list [[name] | all | [property]]
Delete
delete port-list [[name] | all]
Description
You can use the port-list component to dene reusable lists of ports for various rewall rules. The network
software compares a packet's source port and/or destination port against ports in this list. You can assign a
port list to the rewall rules in net self, net route-domain, security rewall global-rules, security rewall
rule-list, sys management-ip, and ltm virtual rewall rules.
Examples
create port-list p-list1 ports add { 80 }
Creates a new port list with one entry.
list port-list
security firewall port-list _sys_self_allow_tcp_defaults {
ports {
domain { }
f5-iquery { }
1550
Security Firewall
https { }
snmp { }
ssh { }
}
}
security firewall port-list _sys_self_allow_udp_defaults {
ports {
520 { }
cap { }
domain { }
f5-iquery { }
snmp { }
}
}
security firewall port-list p-list1 {
ports {
http { }
}
}
Shows all the port lists, including the one created in the previous example.
Options
• app-service
Associates this port list with a particular Application Service. An Application Service is a major
component of an iApp, an advanced conguration tool for creating and maintaining similar applications
on multiple servers. The asm module has components for working with iApps.
• description
Your description for the port list.
• ports
Species a list of ports to compare against a packet's source or destination port. Use one of the keywords
below and then specify the port(s) to add or delete. Specify ranges of ports with a dash between the two
ends of the range (for example, 80-88).
• add
Creates a new port list, which you specify next with port numbers in curly braces ({}).
• delete
Deletes the port(s) that you specify next, in curly braces ({}).
• modify
Is not supported for this component.
• replace-all-with
Replaces the current set of ports with the port(s) that you specify next, in curly braces ({}).
See Also
edit, list, modify, net self, net route-domain, security rewall address-list, security rewall rule-list, security
rewall global-rules, tmsh
1551
Traffic Management Shell (tmsh) Reference Guide
port-misuse-policy
Congures the port misuse policies.
Syntax
Congure the port misuse policy component within the security rewall module using the syntax shown
in the following sections.
Create/Modify
create port-misuse-policy [name]
modify port-misuse-policy [name]
app-service [[string] | none]
description [string]
drop-on-l7-mismatch [no | yes]
log-on-l7-mismatch [no | yes]
rules [add | delete | modify | replace-all-with] {
[ [rule name] ] {
description [string]
drop-on-l7-mismatch [no | yes | use-policy-setting]
ip-protocol [sctp | tcp | udp]
l7-protocol [protocol name]
log-on-l7-mismatch [no | yes | use-policy-setting]
port [port]
}
}
rules none
edit port-misuse-policy [[name] | all]
all-properties
non-default-properties
Display
list port-misuse-policy
show running-config port-misuse-policy
all-properties
non-default-properties
one-line
Delete
delete port-misuse-policy [[name] | all]
Description
You can use the port-misuse-policy component to congure a shareable and reusable set of network port
misuse policies which can be associated with a service policy objects. A port misuse policy has one or more
rules that match connections by IP transport layer (L4) protocol and port number. Each rule must have a
unique L4 protocol and port combination within the policy. When connection matches a policy rule (i.e.
L4 protocol/port pair) the rst data packet of the connection is tested to conform to application (L7) protocol
1552
Security Firewall
specied in the rule. If data conforms to the L7 protocol (or test is inconclusive) the policy stops. The
connection is allowed to proceed normally and data is processed as if no policy is in use. If data denitely
does not conform to the specied L7 protocol the connection is treated according to conguration of the
matched rule or the policy if rule uses policy defaults. In this case the rule or policy can drop the connection
or allow it to proceed, and can also log an event about L7 protocol mismatch.
Port misuse policy (via service policy) can be associated with objects of the following types: ltm virtual,
net route-domain, global. Several port misuse policies can be associated with objects of each type. In
addition to service policy specied in the object itself, service policies could be associated with ACL rules
of the security rewall policy, if it is associated with the object. When more than one policy is associated
with the object the most specic port misuse rule is used. For example, if connection matches an ACL rule
which has a service policy with port misuse policy also having a rule matching the connection, that port
misuse rule is applied. Otherwise the port misuse rule associated via virtual's service policy is applied, if
such rule exists and matches the connection. See also net service-policy.
Port misuse policies could be specied for both virtual server and route domain objects associated with the
connection. In this case all policies are applied. If a policy has a matching rule that drops the connection,
and connection fails to pass L7 protocol test, the connection is terminated and remaining policies are not
applied.
Examples
create security rewall port-misuse-policy web-ports-policy drop-on-l7-mismatch no
log-on-l7-mismatch yes rules add { p80 { ip-protocol tcp port 80 l7-protocol http drop-on-l7-mismatch
yes } p8080 { ip-protocol tcp port 8080 l7-protocol http } }
list security firewall port-misuse-policy web-ports-policy
security firewall port-misuse-policy web-ports-policy {
drop-on-l7-mismatch no
log-on-l7-mismatch yes
rules {
p80 {
drop-on-l7-mismatch yes
l7-protocol http
port http
}
p8080 {
l7-protocol http
port webcache
}
}
}
Creates port misuse policy with rules for tcp ports 80 and 8080 that test if rst data packet looks like HTTP.
The rule p80 tests all connections that have destination port TCP 80 and drops them if the rst data packet
does not look like HTTP. The rule p8080 tests all connections that have destination port TCP 8080 and logs
an event if the rst data packet does not look like HTTP (because of policy defaults).
modify security rewall port-misuse-policy web-ports-policy { rules add { p8888 { port 8888
drop-on-l7-mismatch yes }}}
Adds a new rule p8888 to port misuse policy web-ports-policy that tests all connections to TCP port 8888
and drops them and logs an event when the rst data packet does not look like HTTP.
list security rewall port-misuse-policy
Displays the current port misuse policy conguration list.
Options
• description
1553
Traffic Management Shell (tmsh) Reference Guide
User dened description.
• drop-on-l7-mismatch
Indicates if the connection should be dropped when there is a matching rule in the policy that has
drop-on-l7-mismatch set to use-policy-setting and connection that matches that rule fails L7 protocol
test. The default is yes.
• log-on-l7-mismatch
Indicates if a port misuse event should be logged when there is a matching rule in the policy that has
log-on-l7-mismatch set to use-policy-setting and connection that matches that rule fails L7 protocol
test. The default is no.
• rules
Adds, deletes, or replaces a named port misuse policy rule.
• description
User dened description.
• drop-on-l7-mismatch
Indicates if the connection should be dropped when it matches this rule but fails L7 protocol test.
Allowed values are yes, no, and use-policy-setting. The default is use-policy-setting.
• ip-protocol
Species the transport layer (L4) IP protocol for matching the connection. The valid protocols are
sctp, tcp, and udp. A port and L4 protocol combination must be unique for the policy. The default
is tcp.
• l7-protocol
Species the application layer (L7) protocol for the rule. When the connection matches the rule the
rst data packet is tested to conform to this protocol. If the test is negative the rule can drop the
connection and/or log a port misuse event depending on other options. If the test is positive or
inconclusive (not enough data) the connection is handled as if there was no port misuse policy
associated with the given object (virtual server or route domain), and policies at other objects are
applied. Press the <tab> key for a full list of valid protocols. The default protocol is http.
• log-on-l7-mismatch
Indicates if a port misuse event should be logged when the connection matches this rule but fails L7
protocol test. Allowed values are yes, no, and use-policy-setting. The default is use-policy-setting.
• port
Species the destination port number for matching the connection. The valid values are 1-65535. A
port and L4 protocol combination must be unique for the policy.
See Also
create, edit, list, modify, security rewall rule-list, security rewall policy, net service-policy, tmsh
rule-list
Congures a rule-list of network rewall rules. You can reuse a rule list in multiple rewalls, such as the
rewalls for self IPs, routing domains, and the global rewall.
1554
Security Firewall
Syntax
Create/Modify
create rule-list [name]
modify rule-list [[name] | all]
description [string]
rules [add | delete | modify | replace-all-with] {
[ [name] ] {
action [accept | accept-decisively | drop | reject]
app-service [name]
description [string]
source {
address-lists [add | default | delete | replace-all-with] {
[address list names...]
}
address-lists none
addresses [add | delete | modify | replace-all-with] {
[ [ip address] | [ip_address/prefixlen] ]
}
addresses none
fqdns [add | delete | replace-all-with] {
[ fully qualified domain names]
}
fqdns none
geo [add | default | delete | replace-all-with] {
[ [country_code [state state_name] ] ]
}
geo none
port-lists [add | default | delete | replace-all-with] {
[port list names...]
}
port-lists none
ports [add | default | delete | replace-all-with] {
[ [port] | [port1-port2] ]
}
ports none
vlans [add | default | delete | replace-all-with] {
[vlan names...]
}
vlans none
}
destination {
address-lists [add | default | delete | replace-all-with] {
[address list names...]
}
address-lists none
addresses [add | delete | modify | replace-all-with] {
[ [ip address] | [ip address/prefixlen] ]
}
addresses none
fqdns [add | delete | replace-all-with] {
[ fully qualified domain names]
}
fqdns none
geo [add | default | delete | replace-all-with] {
[ [country_code [state state_name] ] ]
}
geo none
port-lists [add | default | delete | replace-all-with] {
[port list names...]
}
port-lists none
ports [add | delete | modify | replace-all-with] {
[ [port] | [port1-port2] ]
}
ports none
}
1555
Traffic Management Shell (tmsh) Reference Guide
icmp [add | delete | modify | replace-all-with] {
[ [icmp_type] | icmp_type:icmp_code ] {
description [string]
}
}
icmp none
ip-protocol [protocol name]
irule [irule name]
irule-sample-rate [integer]
log [no | yes]
place-after [first | last | [rule name]]
place-before [first | last | [rule name]]
rule-list [rule list name]
schedule [schedule name]
status [disabled | enabled | scheduled]
service-policy [service policy name]
}
}
rules none
edit rule-list [[name] | all]
all-properties
non-default-properties
Display
list rule-list [[name] | all | [property]]
show running-config rule-list [[name] | all | [property]]
Description
You can use the rule-list component to congure network rewall rules to be applied to multiple rewalls.
The network software compares IP packets to the criteria specied in these rules. If a packet matches the
criteria then the system takes the action specied by the rule. If a packet does not match any rule in the list,
the software accepts the packet or passes it to the next rule or rule-list (for example, the system compares
the packet to net self-ip rules if the packet is destined for a network associated with a self-ip that has rewall
rules dened).
Matching An Ip Packet
You can use this TMSH component to match against any or all of the following properties of an IP packet:
• source address
• source fqdn
• source geo
• source port
• the packet's source VLAN
• destination address
• destination fqdn
• destination geo
• destination port
• the higher-level protocol in the packet's payload
1556
Security Firewall
If you match against more than one of these items, a packet must pass all of your tests to successfully match.
For example, if you match against a source subnet and several destination ports, a packet must originate
from the given subnet and must also have one of the specied destination ports.
Rule Order
The network software evaluates rewall rules in the order that you specify. You can use the list
management-ip-rules command to see the current rule order. As you add or modify rules in this component,
you can use the place-before rule-name or place-after rule-name option to choose the rule's place in the
sequence.
Rule order can determine whether or not a packet is dropped. Consider the following rules:
• rule_a, matches source addresses against 172.16.0.0 and ACCEPTS all packets that match.
• rule_d, matches source addresses against 172.16.39.0 and DROPS all packets that match.
Also consider a packet from a host at 172.16.39.55. If rule_a appears before rule_d in the rule list, the
packet's source address matches rule_a rst and the software accepts it. The software never reaches rule_d
for comparison. If rule_d appears rst instead, the packet's source address now matches rule_d; in this case,
the software drops the packet.
Examples
create rule-list block_bad_mgmt description "ports to be blocked on our management interfaces"
rules replace-all-with { reject_telnet { ip-protocol tcp destination { ports add { telnet } } action reject
} }
Creates a new rule list called block_bad_mgmt. It matches and rejects any TCP packet whose destination
port is telnet. The description indicates that the rule is intended for the management-IP rewall.
modify rule-list block_bad_mgmt rules add { reject_http { ip-protocol tcp destination { ports add {
http } } action reject place-after last } }
Modies the above rule list by blocking HTTP trafc, too.
list rule-list block_bad_mgmt
security firewall rule-list block_bad_mgmt {
description "ports to be blocked on our management interfaces"
rules {
reject_telnet {
action reject
destination {
ports {
telnet { }
}
}
ip-protocol tcp
}
reject_http {
action reject
destination {
ports {
http { }
}
}
ip-protocol tcp
}
}
}
Shows the above rule list, with both rules.
1557
Traffic Management Shell (tmsh) Reference Guide
modify rule-list rules add { reject-internal-net { place-before rst action reject source { addresses
replace-all-with { 172.27.0.0/16 } } } }
Creates a rule entry at the beginning of the list that rejects trafc from the 172.27.0.0 network.
create security rewall rule-list rl1 description "Geo Locations to be blocked" rules add { r1 { source
{ geo add { US } } place-after rst action drop } }
Creates a new rule list "rl1", which matches and rejects any packet with a US source. The description
explains the purpose of the rule list.
modify security rewall rule-list rl2 rules add { r2 { source { geo add { CA } } place-before last action
drop } }
security firewall rule-list rl2 {
description "Geo Locations to be blocked"
rules {
r2 {
action drop
source {
geo {
CA {
state none
}
}
}
}
r1 {
action drop
source {
geo {
US {
state none
}
}
}
}
}
}
Shows the above rule list, with both rules.
create security rewall rule-list rl1 description "domains to be blocked" rules add { r1 { destination
{ fqdns add { xyz.com} } place-after rst action drop } }
Creates a new rule list "rl1", which matches and rejects any packet with destination IP addresses in domain
'xyz.com'. The description explains the purpose of the rule list.
modify security rewall rule-list rl1 rules modify { r1 { destination { fqdns add { abc.com } } } }
Modies the above rule list by blocking destination IP addresses in domain 'abc.com' too.
list rule-list rl1
security firewall rule-list rl1 {
description "domains to be blocked"
rules {
r1 {
action drop
destination {
fqdns {
abc.com { }
xyz.com { }
}
}
1558
Security Firewall
}
}
}
Shows the above rule list, with the single rule r1.
Options
• app-service
Associates the rule list with a particular Application Service. An Application Service is a major component
of an iApp, an advanced conguration tool for creating and maintaining similar applications on multiple
servers. The asm module has components for working with iApps.
• description
Your description for this list of rewall rules.
• rules
Adds, deletes, or replaces a rewall rule.
• add
Creates a new rule, which you specify next with a unique string in curly braces ({}). Use the
place-before or place-after option inside the curly braces to determine the order of the rule. If this
is the rst rule, use the replace-all-with option instead of add.
• delete
Deletes the rule that you specify next, in curly braces ({}).
• modify
Modies the existing rule that you specify next, in curly braces ({}). After the rule name, enter the
new conguration settings for the rule inside a nested set of curly braces.
• none
Empties the list of rules. An empty rule list implicitly accepts all packets. The security software skips
this context and assesses packets against the next layer of rewall rules, if there is one (such as those
dened for net self-ip, net route-domain or ltm virtual)
• replace-all-with
Replaces the current list of rules with the rule(s) that you specify next, in curly braces ({}). Use this
option for the rst rule in the list.
Enter the name of a rule to be added or modied, then enter an open curly brace ({), one or more of the
following options, and a closed curly brace (}).
• action
Species the action that the system takes when a rule is matched.
• accept
Species that a matching packet should be accepted. The security software stops comparing a
matching packet to any other rules in the list. The software continues comparing the packet to
rules in the next appropriate context (such as net self-ip, net route-domain or ltm virtual).
• accept-decisively
Species that a matching packet should be accepted and should not be compared to any other
rewall rules in any other context.
• drop
1559
Traffic Management Shell (tmsh) Reference Guide
Species that a matching packet should be silently dropped. The security software sends nothing
back to the packet source. The security software does not compare the packet to any other rewall
rules in any other context.
• reject
Species that a matching packet should be dropped. For TCP-based protocols, the security
software sends a TCP reset (with the RST ag raised) back to the source. For other protocols,
reject is equivalent to drop.
• description
Your description for the current rule.
• destination
Matches against each packet's destination IP and/or destination port. The next options choose the
matching criteria.
• address-lists
Species a list of IP-address lists (see security rewall address-list) to compare against the
packet's destination address.
This list uses the same add, delete, none, and replace-all-with commands described above for
rules, as well as a default command.
• addresses
Species a list of IP addresses and/or subnets to compare against the packet's destination address.
The format for an IPv4 address is a. b. c. d [/ prex ]. The general format for an IPv6 address is
a: b: c: d: e: f: g: h [/ prex ]; you can shorten this by eliminating leading zeros from each eld
(for example, you can shorten "2001:0db7:3f4a:09dd:0a90:ff00:0042:8329" to
"2001:db7:3f4a:9dd:a90:ff00:42:8329"), and/or by removing the longest contiguous eld of zeros
(for example, you can shorten "2001:0:0:0:c34a:0:0:678" to "2001::c34a:0:0:678"). TMSH accepts
any valid text representation of IPv6 addresses, as dened in RFC 2373 (see
http://www.ietf.org/rfc/rfc2373.txt).
To edit this list, use the same add, delete, modify, none, and replace-all-with commands
described above for rules.
• fqdns
Species a list of fully qualied domain names to compare against packet's destination IP address
domain.
To edit this list, use the same add, delete, none, and replace-all-with commands described above
for rules.
• geo
Species a list of Geo Locations to compare a packet's source or destination Geo Location.
The format for a Geo Location is a 2 character string for the country code and a string for the
state.
To edit this list, use the same add, delete, modify, none, and replace-all-with options described
above for rules.
• port-lists
Species a collection of port lists (see security rewall port-list) to compare against the packet's
destination port. If you use this option to specify a port list, a packet only matches if it's destination
port matches a port on these lists.
If you combine address lists and port lists in the same rule, a packet must have a matching port
and a matching address to fully match the rule.
1560
Security Firewall
This list uses the same add, delete, none, and replace-all-with commands described above for
rules, as well as a default command.
• ports
Species a list of ports and port ranges to compare against the packet's destination port.
To edit this list, use the same add, delete, modify, none, and replace-all-with commands
described above for rules.
• icmp
Species a list of ICMP types and codes to compare against the packet. You must set the ip-protocol
option to "icmp" for this option to function. If you use this option, the current rule only matches
ICMP packets that have the ICMP properties you specify here. You can add, delete, or modify (that
is, change the description of) any entry in the list, or replace-all-with a new set of entries that you
specify between curly braces ({}).
Use the standard integer identiers to specify an ICMP type. For example: 3 is destination unreachable
and 3:1 is destination unreachable with a code of host unreachable. The ofcial list of ICMP types
and codes is here: http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml.
• ip-protocol
Species the IP protocol to compare against the packet. This could be a layer-3 protocol (such as
ipv4 or ipv6), or a higher-level protocol like ospf or rdp. If you specify this option, a packet only
matches if it uses the chosen protocol. Press the <tab> key for a full list of valid protocols.
• irule
Species the name of the iRule that will be triggered when a packet matches this rewall rule. The
rewall rule match raises a FLOW_INIT iRule event.
• irule-sample-rate
Species the rate at which an iRule specied by irule option will be triggered when a packet matches
this rewall rule. The rate is an integer value in the range 0-65535 and species how many packets
must match this rewall rule before the iRule is triggered. The default value is 1 and causes the iRule
to be triggered for every packet that matches this rewall rule. A value of 0 disables iRule triggering.
• log
Species whether the security software should write a log entry for all packets that match this rule.
You must also enable network lter logging in the security log prole component for this option
to have any effect. Note that the security software always increments the statistics counter when a
packet matches a rule, no matter how you set this option.
• place-after [rst | last | rule-name]
Species that a new rule should be placed after the rst rule, the last rule, or the rule-name you
specify. If you are adding individual rules (as opposed to specifying replace-all-with), then you
must use place-before or place-after to specify the rule's position in the list.
• place-before [rst | last | rule-name]
Species that a new rule should be placed before the rst rule, the last rule, or the rule-name you
specify. If you are adding individual rules (as opposed to specifying replace-all-with), then you
must use place-before or place-after to specify the rule's position in the list.
• rule-list
Species a full rule list instead of a customized rule that you might dene with the other options. If
you use this option, then only the schedule and status options are valid; the tmsh software rejects
any other options that you attempt to use with rule-list.
• schedule
1561
Traffic Management Shell (tmsh) Reference Guide
Species a schedule for the rule. See security rewall schedule. If you omit this option, the rule or
rule list is enabled all the time.
If the rule refers to a rule-list, the rule-list is enabled according to the schedule. When the rule list
is enabled, the security software then honors any schedules dened within the rule-list.
• source
Matches against each packet's source IP, source port, and/or source VLAN. The next options choose
the matching criteria.
• address-lists
Species a list of address lists (see security rewall address-list) to compare against the packet's
source address.
This list uses the same add, delete, none, and replace-all-with commands described above for
rules, as well as a default command.
• addresses
Species a list of IP addresses and networks to compare against the packet's source address.
The format for an IPv4 address is a. b. c. d. The format for an IPv6 address is a: b: c: d: e: f: g:
h.
To edit this list, use the same add, delete, modify, none, and replace-all-with commands
described above for rules.
• fqdns
Species a list of fully qualied domain names to compare against packet's source IP address
domain.
To edit this list, use the same add, delete, none, and replace-all-with commands described above
for rules.
• geo
Species a list of Geo Locations to compare a packet's source or destination Geo Location.
The format for a Geo Location is a 2 alphabet string for the country code and a string for the
state.
To edit this list, use the same add, delete, modify, none, and replace-all-with options described
above for rules.
• port-lists
Species a collection of port lists (see security rewall port-list) to compare against the packet's
source port. If you use this option to specify a port list, a packet only matches if its source port
matches a port on these lists.
This list uses the same add, delete, none, and replace-all-with commands described above for
rules, as well as a default command.
• ports
Species a list of ports and port ranges to compare against the packet's source port.
To edit this list, use the same add, delete, modify, none, and replace-all-with commands
described above for rules.
• vlans
Species a list of VLANs, VLAN groups, and tunnels to compare against the packet.
This list uses the same add, delete, none, and replace-all-with commands described above for
rules, as well as a default command.
1562
Security Firewall
• status
Species whether the rule is enabled, disabled or scheduled. A rule that is enabled is always
checked. A rule that is disabled is never checked. A rule that is scheduled is checked according to
the corresponding schedule conguration. A rule that is scheduled must have an associated schedule
conguration.
• service-policy
Species the service policy conguration to use. (see net service-policy). The service policy can be
used to set specic policy based congurations like ow timers, which applies to the ows that
matches the rule.
See Also
edit, list, modify, security rewall address-list, security rewall port-list, security rewall global-rules,
security log prole, security rewall schedule, net service-policy, tmsh
rule-stat
Displays statistics of rewall rules on the BIG-IP(r) system. You can only use the show command with this
component.
Syntax
show rule-stat
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the rule-stat component to display statistics of rewall rules.
Examples
show rule-stat
Displays rewall rule's statistics in the system default units.
show rule-stat raw
Displays raw rewall rule's statistics.
See Also
show, tmsh
schedule
Create a schedule that you can apply to rewall rules.
1563
Traffic Management Shell (tmsh) Reference Guide
Syntax
Create/Modify
create schedule [name]
modify schedule [[name] | all]
app-service [name]
daily-hour-end [hour:minute]
daily-hour-start [hour:minute]
date-valid-end [MM/DD/YYYY]
date-valid-start [MM/DD/YYYY]
description [text]
days-of-week [ [monday | tuesday | wednesday | thursday | friday | saturday
| sunday] ... ]
edit schedule [ [name] | [glob] | [regex] ] ... ]
Display
list schedule [[name] | all | [property]]
Delete
delete schedule [[name] | all]
show running-config schedule [[name] | all | [property]]
Description
You use the schedule component to specify when to apply a rewall rule. You can specify a start time and
an end time, some days of the week, a date when the schedule rst starts, and/or a date when the schedule
ends forever.
To apply the schedule to a rewall rule or rule list, edit the rewall or rule-list component. These are the
rewalls and rule lists where you can apply schedules:
•
security rewall global-rules
•
security rewall management-ip-rules
• net self
• net route-domain
• ltm virtual
•
security rewall rule-list
By default, all rewall rules are continuously active. By applying a schedule to a rewall rule, you reduce
the time that the rule is running.
If you create a schedule without any scheduling specications (such as daily-hour-start), the schedule is
always active.
Note you may not delete a schedule that is being used by any rewall rule or rule list.
1564
Security Firewall
Examples
create schedule my_schedule1 date-valid-start now date-valid-end 12/31/2016 daily-hour-start 8:00
daily-hour-end 17:00
Creates a new schedule which is active between 8am and 5pm every day until December 31, 2016.
list schedule>
security firewall schedule my_schedule1 {
daily-hour-end 17:00
daily-hour-start 8:00
date-valid-end 2016-12-31:00:00:00
date-valid-start 2012-12-12:08:40:01
}
security firewall schedule workHours {
daily-hour-end 18:00
daily-hour-start 8:00
days-of-week { monday tuesday wednesday thursday friday }
}
Lists two user-congured schedules, including the one that you created above.
modify schedule my_schedule1 days-of-week { monday tuesday wednesday }
Modies the schedule named "my_schedule1." This limits the schedule to running only on Mondays,
Wednesdays, and Fridays.
Options
• app-service
Associates this schedule with a particular Application Service. An Application Service is a major
component of an iApp, an advanced conguration tool for creating and maintaining similar applications
on multiple servers. The asm module has components for working with iApps.
• description
Describes the schedule.
• daily-hour-end
Species the time of day this schedule stops. This end hour must be after the daily-hour-start value.
The default is 24:00 (midnight).
A schedule may not contain hours that go past midnight (24:00): for example, a daily-hour-start of 20:00
and daily-hour-end of 02:00 is not allowed. If you need to cover both the late hours and early hours of
the day, please create two schedules.
• daily-hour-start
Species the time of day this schedule starts. This start hour must be before the daily-hour-end value.
The default is 0:00 (midnight at the start of the day).
• date-valid-end
Species the nal date for this schedule. The schedule stops ring as of this date. You may specify just
the specic date, or a specic date and time for the schedule to end. The date must be after the
date-valid-start value. The default is 19:14 1/18/2038 (the latest date expressible with a 32-bit integer).
• date-valid-start
Species the start date for this schedule. The schedule does not re before this date and time. You may
specify just the specic date, or a specic date and time for the schedule to start. You must specify a
date before the date-valid-end value. The default is midnight 1/1/1970 (Unix epoch).
• days-of-week
1565
Traffic Management Shell (tmsh) Reference Guide
Species which days of the week the schedule res. You must specify at least one day of the week, and
you cannot specify any day of the week more than once. The default is all seven days.
See Also
create, delete, edit, list, modify, net self, net route-domain, security rewall global-rules, security rewall
management-ip-rules, security rewall rule-list, ltm virtual, tmsh
user-domain
Congures a user-domain for use by rewall rules.
Syntax
Create/Modify
create user-domain [name]
modify user-domain [[name] | all]
domain string
ifmap-service [add | delete | modify | replace-all-with] {
[ip]
[port]
[login]
[password]
}
app-service [name]
description [string]
edit user-domain [[name] | all]
all-properties
non-default-properties
Display
list user-domain [[name] | all | [property]]
show running-config user-domain [[name] | all | [property]]
Delete
delete user-domain [[name] | all]
Run
run user-domain [[name] | all] clear-cache
1566
Security Firewall
Description
A user-domain object holds attributes to reach services that provide more information about a user. This
information includes the domain for which the service is dened, the identity service that can be used to
validate this user and the ifmap service that can be used to obtain more information about the user. User
domains also have associated cache data which is utilized by user identity feature for performance
improvements. You can use the user-domain component to dene reusable conguration that is used to
learn about more users used in the rewall rules or clear their associated cache data on demand.
Examples
create user-domain gladiators identity-server add { felix-legions { ip 1.1.1.1 login maximus password
meridius port 10002 } }
Creates a new user-domain object that denes a new identity-server for domain gladiators with an identity
service felix-legions
modify user-domain gladiators ifmap-server add { rome { ip 10.10.10.10 login marcus password
aurelius port 10002 } }
Modies the above user domain to add an ifmap server.
run user-domain grumpycat clear-cache
Clears the user identity cache associated with a specied user domain name.
run user-domain all clear-cache
Clears the user identity cache for all available user domains.
Options
• domain
Species a domain for which the identity and ifmap services are dened.
• app-service
Associates this user domain with a particular Application Service. An Application Service is a major
component of an iApp, an advanced conguration tool for creating and maintaining similar applications
on multiple servers. The asm module (see asm) has components for working with iApps.
• description
User-dened description for this user domain.
• clear-cache
Invokes clear-cache functionality for the given user-domain name.
See Also
edit, list, modify, net self, net route-domain, security rewall global-rules, security rewall
management-ip-rules, security rewall rule-list, ltm virtual, tmsh
user-list
Congures a user-list for use by rewall rules. A rewall rule can match a packet sourced from a particular
user against one of the users or user-groups in a user list, and can take some action (such as ACCEPT or
DROP) for a matching packet. An incoming packet's source IP address is matched in user identity database
to get the user and group properties which are then used to perform the rule match.
1567
Traffic Management Shell (tmsh) Reference Guide
Syntax
Create/Modify
Display
list user-list [[name] | all | [property]]
Delete
delete user-list [[name] | all]
Description
You can use the user-list component to dene reusable lists of user or user-group names for various rewall
rules. The network software compares a packet's source user (mapped by incoming source IP address) and
group that user belong to, against users (or user-groups) in this list. You can assign a user list to the rewall
rules in net self, net route-domain, security rewall global-rules, security rewall rule-list, and ltm
virtual rewall rules.
Examples
create user-list u-list1 users add { olympus\xyz }
Creates a new user list named u-list1 with one user named xyz in domain olympus.
create user-list u-list2 user-groups add { olympus\eng }
Creates a new user list named u-list2 with one group named eng in domain olympus.
list user-list
Shows all the user lists congured in the system.
Options
• app-service
Associates this user list with a particular Application Service. An Application Service is a major
component of an iApp, an advanced conguration tool for creating and maintaining similar applications
on multiple servers. The asm module has components for working with iApps.
• description
Your description for the user list.
• user-groups
Species a list of user groups to compare against the groups a user belongs to (which is mapped from
the source IP address).
• users
Species a list of users to compare against a packet's source user (which is mapped from the source IP
address).
See Also
edit, list, modify, net self, net route-domain, security rewall address-list, security rewall rule-list, security
rewall global-rules, tmsh
1568
Security Firewall
Security HTTP
file-type
Lists the available le types that can be used in the context of HTTP Protocol Security.
Syntax
Retrieve the list of the le-type values using the syntax shown in the following sections.
Display
list file-type
list file-type [ [ [name] | [glob] | [regex] ] ... ]
all
app-service
one-line
Description
Use this command to display the possible values of the le-type object to be used in the context of HTTP
Protocol Security. These possible values include predened and user-dened le types that you can select
to have the security proles allow or disallow.
Examples
list le-type
Displays all the le types supported by HTTP Protocol Security.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
See Also
glob, list, regex, security http prole, tmsh
mandatory-header
Lists the available mandatory headers that can be used in the context of HTTP Protocol Security.
Syntax
Retrieve the list of the mandatory-header values using the syntax shown in the following sections.
Display
list mandatory-header
list mandatory-header [ [ [name] | [glob] | [regex] ] ... ]
all
app-service
one-line
Description
Use this command to display the possible values of the mandatory-header object to be used in the context
of HTTP Protocol Security. These possible values include predened and user-dened HTTP headers that
you can select to be required by the security proles.
Examples
list mandatory-header
Displays all the mandatory headers supported by HTTP Protocol Security.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
See Also
glob, list, regex, security http prole, tmsh
profile
Congures an HTTP security prole.
Syntax
Congure the prole component within the security http module using the syntax shown in the following
sections.
Create/Modify
create profile [name]
modify profile [name]
app-service [[string] | none]
[case-sensitive | case-insensitive]
defaults-from [[name] | none]
description [[string] | none]
evasion-techniques {
alarm [disabled | enabled]
1570
Security HTTP
block [disabled | enabled]
}
file-types {
alarm [disabled | enabled]
[allowed | disallowed]
block [disabled | enabled]
values [add | delete | none | replace-all-with] { [string] ... }
}
http-rfc {
alarm [disabled | enabled]
bad-host-header [disabled | enabled]
bad-version [disabled | enabled]
block [disabled | enabled]
body-in-get-head [disabled | enabled]
chunked-with-content-length [disabled | enabled]
content-length-is-positive [disabled | enabled]
header-name-without-value [disabled | enabled]
high-ascii-in-headers [disabled | enabled]
host-header-is-ip [disabled | enabled]
maximum-headers [[integer] | disabled]
null-in-body [disabled | enabled]
null-in-headers [disabled | enabled]
post-with-zero-length [disabled | enabled]
several-content-length [disabled | enabled]
unparsable-content [disabled | enabled]
}
mandatory-headers {
alarm [disabled | enabled]
block [disabled | enabled]
values [add | delete | none | replace-all-with] { [string] ... }
}
maximum-length {
alarm [disabled | enabled]
block [disabled | enabled]
post-data [[integer] | any]
query-string [[integer] | any]
request [[integer] | any]
uri [[integer] | any]
}
methods {
alarm [disabled | enabled]
block [disabled | enabled]
values [add | delete | none | replace-all-with] { [string] ... }
}
response {
body [[string] | none]
headers [[new line separated headers] | none]
type [custom | default | redirect | soap-fault]
url [[string] | none]
}
edit profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list profile
list profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config profile
show running-config profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
1571
Traffic Management Shell (tmsh) Reference Guide
partition
recursive
Delete
delete profile [name]
Description
You can use the prole component to create, modify, display, or delete an HTTP security prole for use
with HTTP Protocol Security functionality.
Examples
create http my_http_prole defaults-from http_security
Creates a custom HTTP security named my_http_prole that inherits its settings from the system default
HTTP security prole.
list prole
Displays the properties of all HTTP security proles.
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• [case-sensitive | case-insensitive]
Species whether the security prole treats le types as case sensitive, or not. The default value is
case-sensitive. Note: If you create a prole, you can use either property, thereafter it becomes read only.
If the security prole is case insensitive, the system stores le types in lowercase in the security prole
conguration.
• defaults-from
Species the prole that you want to use as the parent prole. Your new prole inherits all settings and
values from the parent prole specied. The default value is none.
• description
User dened description.
• evasion-techniques
Species what action the system takes when it detects an evasion technique. Evasion techniques are
methods used by attackers to avoid detection of their attack. You can congure the following options
for evasion technique checks:
• alarm
Species, when enabled, that the system logs the request data and displays it in the Protocol Security
Statistics screen whenever the system detects an evasion technique. The default value is enabled.
• block
Species, when enabled, that the system stops requests whenever the system detects an evasion
technique. The default value is disabled.
1572
Security HTTP
• le-types
Species which le types the security prole considers legal, and species what action the system takes
when it detects a request for an illegal le type. You can congure the following options for le types:
• alarm
Species, when enabled, that the system logs the request data and displays it on the Protocol Security
Statistics screen whenever the system detects a request for an illegal le type. The default value is
enabled.
• [allowed | disallowed]
Indicates whether the values property lists le types that the security prole permits or prohibits.
Note: For each security prole you may dene either allowed le types or disallowed le types.
• block
Species, when enabled, that the system stops requests for an illegal le type. The default value is
disabled.
• values
Adds, deletes, or replaces a set of le types considered either legal or illegal by the security prole.
You can either select an available le-type or add a new one.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• http-rfc
Species which validations the system should check and what action the system takes when it detects
a request that is not formatted properly. You can congure the following options for HTTP protocol
checks:
• alarm
Species, when enabled, that the system logs the request data and displays it in the Protocol Security
Statistics screen whenever a request fails one of the enabled HTTP protocol checks. The default
value is enabled.
• bad-host-header
Species, when enabled, that the system inspects requests to see whether they contain a non RFC
compliant header value. The default value is enabled.
• bad-version
Species, when enabled, that the system inspects requests to see whether they request information
from a client using an HTTP protocol version 1.0 or higher. The default value is enabled.
• block
Species, when enabled, that the system stops requests whenever the system detects an evasion
technique. The default value is disabled.
• body-in-get-head
Species, when enabled, that the system examines requests that use the HEAD or GET methods to
see whether the requests contain data in their bodies, which is considered illegal. The default value
is disabled.
• chunked-with-content-length
Species, when enabled, that the system examines chunked requests for a content-length header,
which is not permitted. The default value is enabled.
• content-length-is-positive
1573
Traffic Management Shell (tmsh) Reference Guide
Species, when enabled, that the system examines requests to see whether their content length value
is greater than zero. The default value is enabled.
• header-name-without-value
Species, when enabled, that the system checks requests for valueless header names, which are
considered illegal. The default value is enabled.
• high-ascii-in-headers
Species, when enabled, that the system inspects request headers for ASCII characters greater than
127, which are not permitted. The default value is disabled.
• host-header-is-ip
Species, when enabled, that the system veries that the requestâs host header value is not an
IP address. The default value is disabled.
• maximum-headers
Species whether the system compares the number of headers in the requests against the maximum
number, and if so, how many headers are allowed. The default value is a maximum of 20 headers.
• null-in-body
Species, when enabled, that the system inspects request bodies to see whether they contain a Null
character, which is not allowed. The default value is disabled.
• null-in-headers
Species, when enabled, that the system inspects request headers to see whether they contain a Null
character, which is not allowed. The default value is enabled.
• post-with-zero-length
Species, when enabled, that the system examines POST method requests for no content-length
header, and for a content length of 0. The default value is disabled.
• several-content-length
Species, when enabled, that the system examines each request to see whether it has more than one
content-length header, which is considered illegal. The default value is enabled.
• unparsable-content
Species, when enabled, that the system examines requests for content that the system cannot parse,
which is not permitted. The default value is enabled.
• mandatory-headers
Species which headers must appear in requests, and species what action the system takes when it
detects a request without a mandatory header. You can congure the following options for mandatory
headers:
• alarm
Species, when enabled, that the system logs the request data and displays it on the Protocol Security
Statistics screen whenever a request does not include a mandatory header. The default value is
enabled.
• block
Species, when enabled, that the system stops requests that do not include a mandatory header. The
default value is disabled.
• values
Adds, deletes, or replaces a set of headers that must appear in requests to be considered legal by the
security prole. You can either select an available mandatory-header or add a new one. Note: The
1574
Security HTTP
system stores mandatory headers in lowercase in the security prole conguration, regardless of
whether it is case sensitive or not.
• maximum-length
Species the default maximum length settings that the security prole considers legal, and species
what action the system should take when it detects a request using an illegal length. You can congure
the following options for length checks:
• alarm
Species, when enabled, that the system logs the request data and displays it on the Protocol Security
Statistics screen whenever a request fails one of the length checks. The default value is enabled.
• block
Species, when enabled, that the system stops requests that fail one of the length checks. The default
value is disabled.
• post-data
Indicates whether there is a maximum acceptable length, in bytes, for the POST data portion of a
request, and if so, species it. The default value is any (no restriction).
• query-string
Indicates whether there is a maximum acceptable length, in bytes, for the query string portion of a
request, and if so, species it. The default value is 1024 bytes.
• request
Indicates whether there is a maximum acceptable length, in bytes, of a request, and if so, species
it. The default value is any (no restriction).
• uri
Indicates whether there is a maximum acceptable length, in bytes, for a URL, and if so, species it.
The default value is 1024 bytes.
• methods
Species which HTTP methods the security prole considers legal, and species what action the system
takes when it detects a request using an illegal method. You can congure the following options for
methods:
• alarm
Species, when enabled, that the system logs the request data and displays it on the Protocol Security
Statistics screen whenever a request uses an illegal method. The default value is enabled.
• block
Species, when enabled, that the system stops requests that use an illegal method. The default value
is disabled.
• values
Adds, deletes, or replaces a set of HTTP methods considered legal by the security prole. You can
either select an available asm http-method or add a new one. Note: HTTP methods are case sensitive
even if the security prole is case insensitive.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
1575
Traffic Management Shell (tmsh) Reference Guide
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• response
Species information to display when the security prole blocks a client request. You can congure
the following options for blocking page:
• body
Species the HTML code the system sends to the client in response to an illegal blocked request.
Only if the response type is custom, you can edit this text.
• headers
Species the set of response headers that the system sends to the client in response to an illegal
blocked request. Only if the response type is custom, you can edit this text. Separate each header
with a new line (Ctrl-V followed by Ctrl-J).
• type
Species which content, or URL, the system sends to the client in response to an illegal blocked
request.
• custom
Species a modied response text. You can edit the response header and HTML code in the
properties headers and body.
• default
Species the system-supplied response text written in HTML. You cannot edit that text. This is
the default value.
• redirect
Species that the system redirects the user to a specic web page instead of viewing a blocking
page. You can edit the redirect web page in the url property.
• soap-fault
Species the system-supplied response written in SOAP fault message structure. You cannot
edit that text. Use this type when a SOAP request is blocked due to an XML related violation.
• url
Species the particular URL to which the system redirects the user. Only if the response type is
redirect, you can edit this text. The web page should include a full URL path, for example,
http://www.myredirectpage.com.
See Also
asm http-method, create, delete, edit, glob, list, ltm virtual, modify, regex, security, security http, security
http le-type, security http mandatory-header, tmsh
1576
Security HTTP
Security IP Intelligence
blacklist-category
Global list of ip-intelligence blacklist categories. These ip-intelligence blacklist categories are used to
congure ip-intelligence policies.
Syntax
Congure the blacklist-category component within the security ip-intelligence module using the syntax
shown in the following sections.
Create/Modify
create blacklist-category [name]
modify blacklist-category [[name] | all]
app-service [name]
description [string]
bl-match-direction [destination | source | source-and-destination]
edit blacklist-category
all-properties
non-default-properties
one-line
partition
recursive
Display
list blacklist-category
show running-config blacklist-category
all-properties
non-default-properties
one-line
partition
recursive
Description
You can use the blacklist-category component to congure a shareable and reusable blacklist category
which can be congured with specic enforcement and logging settings under ip-intelligence policies.
Examples
modify blacklist-category Malware description "A variety of forms of hostile or intrusive software."
Modies the blacklist-category description.
list blacklist-category
Displays the current list of blacklist categories.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description.
• bl-match-direction
Indicates whether to match source IPs, destination IPs, or both.
• partition
Displays the administrative partition within which the component resides.
See Also
create, edit, list, modify, security ip-intelligence feed-list, security ip-intelligence policy, tmsh
feed-list
Congures a feed-list for use by rewall. A feed-list is a list of URL feeds from where les are downloaded
and the contents (IP-address prexes) are compared against the source-IP address and/or destination-IP
address in an IP packet by DWBL (Dynamic White/Black lists) by IP-Intelligence.
Syntax
Congure the feed-list component within the security ip-intelligence module using the syntax in the
following sections.
Create/Modify
create feed-list [name]
modify feed-list [[name] | all]
feeds [add | delete | modify | replace-all-with] {
name [string] {
default-blacklist-category [string]
default-list-type [whitelist | blacklist]
poll {
interval [integer]
user [string]
url [string]
password [string]
}
}
}
app-service [name]
description [string]
edit feed-list [[name] | all]
1578
Security IP Intelligence
all-properties
non-default-properties
load feed-list [[name] | all] feeds { name [string] }
Display
list feed-list [[name] | all | [property]]
show running-config feed-list [[name] | all | [property]]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete feed-list [[name] | all]
Description
You can use the feed-list component to dene reusable lists of feeds. You can use a feed list in a security
ip-intelligence policy. A policy compares all of the addresses in the list (downloaded from a le at the
specied url) to either the source or destination IP in the packet, depending on how you apply the list. If
there is a match, the ip-intelligence policy takes an action, such as accepting or dropping the packet.
Examples
create feed-list alist1 feeds add { poll { url http://f5.com/bl.txt }
Creates a new feed list, "alist1," with IPv4/IPv6 addresses in the le downloaded from the specied url.
modify feed-list alist1 feeds modify { description "DWBL le from f5.com" }
Modies the above feed list with a description.
modify feed-list alist1 feeds modify { poll { url https://f5.com/bl.txt }
Modies the same feed by changing the protocol.
list feed-list alist1
security ip-intelligence feed-list alist1 {
feeds {
url2 {
poll {
url https://f5.com/bl.txt
user user1
password user1_pwd
}
}
description "DWBL file from f5.com"
}
}
Shows the modied feed list.
1579
Traffic Management Shell (tmsh) Reference Guide
load feed-list alist1 alist2 feeds { feed1 feed2 }
Immediately downloads and updates feeds feed1 and feed2 of feed lists alist1 and alist2.
Options
• feeds
Adds, deletes, or replaces feeds. You can congure the following options for a feed:
• name
Species a name for a feed. This option is required for the operations create, delete, modify, and
replace-all-with.
• add
Creates a new feed list.
• delete
Deletes the feed list that you specify next, in curly braces ({}).
• modify
Makes it possible to replace the optional description(s) for the feed list.
• replace-all-with
Replaces the current set of feed list with the a new one that you specify next, in curly braces ({}).
• default-list-type
Species a default type for this specic entry whether it is a blacklist or whitelist
• whitelist
Species that this entry is a whitelist.
• blacklist
Species that this entry is a blacklist.
• default-blacklist-category
Default blacklist category type for all blacklist entries that do not have a corresponding category
string (eg. Botnet, Spyware, Malware)
• poll
You can congure the following options under this:
• interval
Species the frequency at which the url needs to be polled.
• user
Species the user which is used when downloading the url.
• url
Species the URL from where the white/black list will be downloaded. Note: Route domains
are not supported when specifying the url.
• password
Password for the user.
• default-list-type
Species a default type for this specic entry whether it is a blacklist or whitelist
1580
Security IP Intelligence
• whitelist
Species that this entry is a whitelist.
• blacklist
Species that this entry is a blacklist.
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• default-blacklist-category
Default blacklist category type for all blacklist entries that do not have a corresponding category
string (eg. Botnet, Spyware, Malware)
• description
User dened description for this feed list.
• partition
Displays the administrative partition within which the component resides.
See Also
edit, list, modify, net self, net route-domain, security ip-intelligence global-policy, security ip-intelligence,
ltm virtual, tmsh
global-policy
Congures the global ip-intelligence policy. These ip-intelligence policy contents/lters are applied to all
packets except those going through the management interface. They are applied rst, before any rewall
rules for the packet's virtual server, route domain.
Syntax
Modify the global-policy component within the security ip-intelligence module using the syntax shown
in the following sections.
Modify
modify global-policy
app-service [name]
description [string]
ip-intelligence-policy [ [policy_name] | none ]
edit global-policy
all-properties
non-default-properties
one-line
1581
Traffic Management Shell (tmsh) Reference Guide
partition
recursive
reset-stats global-policy
ip-intelligence-categories
Display
list global-policy
show running-config global-policy
all-properties
non-default-properties
one-line
partition
recursive
show global-policy
ip-intelligence-categories
Description
You can use the global-policy component to congure a shareable and reusable set of network rewall
DWBL (Dynamic White/Black lists) which can be enforced globally at the system level and the enforcement
happens before the route-domain or virtual server level.
Examples
modify global-policy policy pol1
Modies the global-policy with policy pol1.
list global-policy
Displays the current list of global-policy contents.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description.
• policy
Species an existing policy. policy contents are enforced at a global level.
• partition
Displays the administrative partition within which the component resides.
• ip-intelligence-categories
Used to show/ reset statistics on IP intelligence white/ black lists categories.
1582
Security IP Intelligence
See Also
create, edit, list, modify, security ip-intelligence feed-list, security ip-intelligence policy, tmsh
info
Query IP Intelligence information about specied IP Address.
Syntax
Use the info component within the security ip-intelligence module to query IP Intelligence information
about the IP address using the following syntax.
Display
show info address [IP address]
virtual-server [name]
route-domain [name]
Description
You can use the info component to query IP Intelligence information about an IP Address using IP
Intelligence policy attached to the selected context. Global context is the default when the command is used
without options. To select the virtual server or the route domain context use virtual-server or route-domain
option. Only one option can be used. If the IP Address is listed in any of the DWBL (Dynamic White/Black
List) feeds used by the selected IP Intelligence policy the query shows the list of categories and policy action
(drop or allow) for the address. If the policy is congured to query legacy IP Reputation database, that
information is also used in the query.
Examples
show info address 10.123.1.12
Query IP Intelligence information for IP address 10.123.1.12 using global IP Intelligence policy.
show info address 10.123.1.12 virtual-server /Commmon/vs
Query IP Intelligence information for IP address 10.123.1.12 using IP Intelligence policy congured for
virtual server /Commmon/vs.
Options
• virtual-server
Species the name of the virtual server congured with IP Intelligence policy to use in the query. This
option cannot be used with the route-domain option.
• route-domain
Species the name of the route domain congured with IP Intelligence policy to use in the query. This
option cannot be used with the virtual-server option.
See Also
security ip-intelligence feed-list, security ip-intelligence policy, tmsh, ltm virtual, net route-domain
1583
Traffic Management Shell (tmsh) Reference Guide
policy
Congures an ip-intelligence policy. It's comprised of three logical groups of settings: list of feed lists,
enforcement and logging settings per blacklist category, and default enforcement and logging settings for
blacklist categories.
Syntax
Congure the policy component within the security ip-intelligence module using the syntax in the following
sections.
Create/Modify
create policy [name]
modify policy [name]
app-service [name]
description [string]
blacklist-categories [add | default | delete | replace-all-with] {
[name] {
action [accept | drop | use-policy-setting]
app-service none
description none
log-blacklist-hit-only [no | yes | use-policy-setting]
log-blacklist-whitelist-hit [no | yes | use-policy-setting]
match-direction-override [match-destination | match-source |
match-source-and-destination]
}
}
feed-lists [add | default | delete | replace-all-with] { [name] }
default-action [accept | drop]
default-log-blacklist-hit-only [ no | yes ]
default-log-blacklist-whitelist-hit [ no | yes ]
edit policy
all-properties
non-default-properties
Display
list policy [ [ [name] | [glob] | [regex] ] ... ]
show running-config policy
show running-config policy [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Description
You can use the policy component to congure a shareable and reusable enforcement and logging settings
on Dynamic White/Black lists of IPs coming from downloaded feeds. The policy can then be enforced on
a number of conguration objects of the following types: ltm virtual, security ip-intelligence global-policy,
net route-domain.
1584
Security IP Intelligence
Examples
create policy pol1 { blacklist-categories add { Spyware { action use-policy-setting app-service none
description none log-blacklist-hit-only use-policy-setting log-blacklist-whitelist-hit yes } } feed-lists
add { alist1 alist2 } default-action drop default-log-blacklist-hit-only yes
default-log-blacklist-whitelist-hit no description none feed-lists none partition Common }
Creates a policy pol1 with feeds from alist1 and alist2 feed lists, specic enforcement and logging settings
for Spyware blacklist category and policy default settings for other categories.
modify policy pol1 { feed-lists delete { alist2 } }
Removes the feed-list alist2 from the policy pol1.
list policy
Displays the current list of ip-intelligence policies contents.
Options
• app-service
Species the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• description
User dened description.
• partition
Displays the administrative partition within which the component resides.
• blacklist-categories
Adds, deletes, or replaces blacklist categories.
• action
Species what enforcement action will be applied if the packet is categorized with this blacklist
category. If the packet is categorized with more than one blacklists the most restrictive action will
be applied.
• log-blacklist-hit-only
Species if a log message will be generated if the packet is categorized with this blacklist and the
packet's IP listed in no whitelists.
• match-direction-override
Overrides the current IP match direction setting for a category. If this value has not been overridden,
it will be set to the value of the parent category's bl-match-direction at the time that the category was
added to the policy.
• log-blacklist-whitelist-hit
Species if a log message will be generated if the packet is categorized with this blacklist and the
packet's IP is listed in a whitelist.
• feed-lists
Adds, deletes, or replaces a feed list. Species a list of feed lists (see security ip-intelligence feed-list)
against which the packet will be compared.
• default-action
1585
Traffic Management Shell (tmsh) Reference Guide
Species a default enforcement action which will be performed on the matched packet unless an implicit
action specied for one of the blacklist categories the packet's IP is categorized with. If the packet's IP
is listed in a white list the action is always accept.
• default-log-blacklist-hit-only
Species a default blacklist hit only logging action which will be performed on the matched packet
unless an implicit action specied for one of the blacklist categories the packet's IP is categorized with.
• default-log-blacklist-whitelist-hit
Species a default blacklist and whitelist hit logging action which will be performed on the matched
packet unless an implicit action specied for one of the blacklist categories the packet's IP is categorized
with.
See Also
create, edit, list, modify, security ip-intelligence feed-list, security log prole, tmsh
1586
Security IP Intelligence
Security Log
network-storage-field
Lists the available storage format elds that can be used in the context of Network Security Logging.
Syntax
Retrieve the list of the network-storage-eld values using the syntax shown in the following sections.
Display
list network-storage-field
list network-storage-field [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
one-line
app-service
Description
Use this command to display the possible values of the network-storage-eld object to be used in the
context of Network Security Logging. These possible values are predened trafc items available for the
server to log in context of Network event logging (for example, ACL events, TCP Open/Close, TCP/IP
error events).
Examples
list network-storage-eld
Displays all the storage elds supported by Network Security Logging.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
See Also
glob, list, regex, security log prole, tmsh
profile
Congures a Security log prole.
Syntax
Congure the prole component within the security log module using the syntax shown in the following
sections.
Create/Modify
create profile [name]
modify profile [name]
app-service [[string] | none]
application [none | add | delete | modify | replace-all-with] {
name [string] {
facility [local0 | local1 | local2 | local3 | local4 | local5 |
local6 | local7]
filter [none | add | delete | modify | replace-all-with] {
key [request-type | protocol | response-code | http-method |
search-all | search-in-headers | search-in-post-data |
search-in-query-string | search-in-request | search-in-uri] {
values [none | add | delete | replace-all-with] { [string]
... }
}
}
format {
field-delimiter [string]
field-format [string]
fields [none | { [string] ... }]
type [predefined | user-defined]
user-string [string]
}
guarantee-logging [enabled | disabled]
guarantee-response-logging [enabled | disabled]
local-storage [enabled | disabled]
logic-operation [and | or]
maximum-entry-length [1k | 2k | 10k | 64k]
maximum-header-size [integer]
maximum-query-size [integer]
maximum-request-size [integer]
protocol [udp | tcp | tcp-rfc3195]
remote-storage [none | remote | splunk | arcsight]
report-anomalies [enabled | disabled]
response-logging [none | illegal | all]
servers [none | add | delete | modify | replace-all-with] {
[IPv4:port | IPv6.port ... ]
}
}
}
description [string]
dos-application [none | add | delete | modify | replace-all-with] {
name [string] {
local-publisher [name]
remote-publisher [name]
}
ip-intelligence {
aggregate-rate [integer]
log-publisher [none | [name]]
log-translation-fields [disabled | enabled]
log-shun [disabled | enabled]
}
port-misuse {
log-publisher [none | [name]]
aggregate-rate [integer]
}
traffic-statistics {
log-sctive-flows [disabled | enabled]
log-publisher [none | [name]]
log-missed-flows [disabled | enabled]
log-reaped-flows [disabled | enabled]
log-syncookies [disabled | enabled]
1588
Security Log
log-syncookies-whitelist [disabled | enabled]
}
network [add | delete | modify | none | replace-all-with] {
name [string] {
filter {
log-acl-match-accept [disabled | enabled]
log-acl-match-drop [disabled | enabled]
log-acl-match-reject [disabled | enabled]
log-ip-errors [disabled | enabled]
log-tcp-errors [disabled | enabled]
log-tcp-events [disabled | enabled]
log-translation-fields [disabled | enabled]
log-geo-always [disabled | enabled]
}
rate-limit {
acl-match-accept [integer]
acl-match-drop [integer]
acl-match-reject [integer]
ip-errors [integer]
tcp-errors [integer]
tcp-events [integer]
aggregate-rate [integer]
}
format {
field-list [none | { acl_policy_name | acl_policy_type |
acl_rule_name | action | bigip_hostname | context_name | context_type |
date_time |
dest_ip | dest_port | drop_reason |
management_ip_address | protocol | route_domain |
sa_translation_pool | sa_translation_type | src_ip |
src_port | translated_dest_ip |
translated_dest_port | translated_ip_protocol |
translated_route_domain |
translated_src_ip | translated_src_port |
translated_vlan | vlan }]
field-list-delimiter [string]
type [field-list | none | user-defined]
user-defined [string]
}
publisher [none | [name]]
}
}
protocol-dns [add | delete | modify | none | replace-all-with] {
name [string] {
filter {
log-dns-drop [disabled | enabled]
log-dns-filtered-drop [disabled | enabled]
log-dns-malformed [disabled | enabled]
log-dns-malicious [disabled | enabled]
log-dns-reject [disabled | enabled]
}
format {
field-list [none | { action | attack_type | context_name | date_time
| dest_ip | dest_port |
dns_query_name | dns_query_type | src_ip | src_port
| vlan | route_domain }]
field-list-delimiter [string]
type [field-list | none | user-defined]
user-defined [string]
}
publisher [none | [name]]
}
}
protocol-dns-dos-publisher [none | [name]]
protocol-sip [add | delete | modify | none | replace-all-with] {
name [string] {
filter {
log-sip-drop [disabled | enabled]
log-sip-global-failures [disabled | enabled]
1589
Traffic Management Shell (tmsh) Reference Guide
log-sip-malformed [disabled | enabled]
log-sip-redirection-responses [disabled | enabled]
log-sip-request-failures [disabled | enabled]
log-sip-server-errors [disabled | enabled]
}
format {
field-list [none | { action | attack_type | context_name | date_time
| dest_ip | dest_port |
sip_method_type | sip_caller | sip_callee | src_ip |
src_port | vlan | route_domain }]
field-list-delimiter [string]
type [field-list | none | user-defined]
user-defined [string]
}
publisher [none | [name]]
}
}
protocol-sip-dos-publisher [none | [name]]
dos-network-publisher [none | [name]]
protocol-transfer [none | add | delete | modify | replace-all-with] {
name [string] {
publisher [name]
}
edit profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list profile
list profile [ [ [name] | [glob] | [regex] ] ... ]
show running-config profile
show running-config profile [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
recursive
Delete
delete profile [name]
Description
You can use the prole component to create, modify, display, or delete a Security log prole for use with
Security Logging functionality.
Examples
create prole my_log_prole
Creates a custom Security log prole named my_log_prole with initial settings.
list prole
Displays the properties of all Security log proles.
1590
Security Log
Options
• app-service
Species the name of the application service to which the prole belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the prole. Only the application service can modify or delete the prole.
• application
Adds, deletes, or replaces a single Application Security sub-prole. You can congure the following
options for Application Security:
• facility
Species the facility category of the logged trafc in Application Security. Select between local0
and local7.
• lter
Adds, deletes, or replaces a set of request lters in Application Security. You can congure the
following options for a request lter:
• key
Species a unique key for the request lter. This option is required for the operations create,
delete, modify, and replace-all-with. The options are:
• request-type
Species which kind of requests the system, or server, logs.
• protocol
Species whether request logging is dependent on the protocol.
• response-code
Species whether request logging is dependent on the response status code.
• http-method
Species whether request logging is dependent on the HTTP method.
• search-all, search-in-headers, search-in-post-data, search-in-query-string,
search-in-request, search-in-uri
Species whether the request logging is dependent on a specic string, and if so, the part of
the request where the system must nd the string. You can select only one of these lters,
the default is search-all, which means that the system logs all requests, regardless of string.
• values
Adds, deletes, or replaces a set of values in the request lter.
• format
Species a storage format in Application Security. You can congure the following options for the
storage format:
• eld-delimiter
Species a eld delimiter in the predened storage format. You may not use the % character.
The default delimiter is the comma character, for CSV.
• eld-format
Species a eld format (for each key/value pair) in the predened storage format. Use %k for
key and %v for value. The default format is empty that is interpreted as "%v", for CSV.
• elds
1591
Traffic Management Shell (tmsh) Reference Guide
Replaces a set of elds in the predened storage format. The order in the set is important - the
server displays the selected trafc items in the log sequentially according to it.
• type
Species a type of the storage format. The options are:
• predened
Species that the log displays only the predened items you select in the elds.
• user-dened
Species that the log displays any free text that you type in the user-string which can include
the predened items.
• user-string
Species a user string in the user-dened storage format.
• guarantee-logging
Indicates whether to guarantee local logging in Application Security.
• guarantee-response-logging
Indicates whether to guarantee local response logging in Application Security. In order to enable it,
you must rst enable guarantee-logging, and set response-logging to either illegal or all.
• local-storage
Enables or disables local storage in Application Security.
• logic-operation
Species the logic operation on the associated lters in Application Security. The options are:
• and
Species that requests must pass all lters in order for the system, or server, to log the requests.
• or
Species that requests must meet at least one lter in order for the system, or server, to log the
requests. This is the default value.
• maximum-entry-length
Species the maximum entry length in Application Security. The options are:
• 1k
This is the default length for remote servers that support the udp protocol.
• 2k
This is the default length for remote servers that support the tcp and tcp-rfc3195 protocols.
• 10k, 64k
These are possible lengths for remote servers that support the tcp protocol.
• maximum-header-size
Species the maximum headers size in Application Security.
• maximum-query-size
Species the maximum query string size in Application Security.
• maximum-request-size
Species the maximum request size in Application Security.
1592
Security Log
• name
Species a dummy name for enabled Application Security. This option is required for the operations
create, delete, modify, and replace-all-with.
• protocol
Species the protocol supported by the remote server in Application Security. Select either: tcp (the
default value), udp, or tcp-rfc3195.
• remote-storage
Species a remote storage type in Application Security. The options are:
• none
Species that the system does not store trafc on any remote logging server.
• remote
Species that the system stores all trafc on a remote logging server, like a syslog.
• splunk
Species that the system stores all trafc on a reporting server (Splunk) using a precongured
storage format. Key/value pairs are used in the log messages.
• arcsight
Species that the system stores all trafc on a remote logging server using the predened ArcSight
settings for the logs. The log messages are in Common Event Format (CEF).
• report-anomalies
Indicates whether to report detected anomalies in Application Security.
• response-logging
Species a response logging type in Application Security. The options are:
• none
Species that the system does not log responses. This is the default value.
• illegal
Species that the system logs responses to illegal requests.
• all
Species that the system logs all responses if the associated request-type lter has the all value.
• servers
Adds, deletes, or replaces a set of remote servers in Application Security, by specifying an IP address
and service port in the format [IPv4:port] or [IPv6.port].
• description
User dened description.
• dos-application
Adds, deletes, or replaces a single DoS (Application) Protection sub-prole. You can congure the
following options for DoS (Application) Protection:
• local-publisher
Species the name of the local log publisher used for Application DoS attacks. Note: This publisher
should have a single local-database destination.
• name
1593
Traffic Management Shell (tmsh) Reference Guide
Species a dummy name for enabled DoS (Application) Protection. This option is required for the
operations create, delete, modify, and replace-all-with.
• remote-publisher
Species the name of the remote log publisher used for Application DoS attacks. Note: This publisher
should have arcsight or splunk destinations.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• ip-intelligence
You can congure the following options under this:
• aggregate-rate
This option is used to set the aggregate rate limit that applies to any ip intelligence log message.
• log-publisher
Species the name of the log publisher used for IP Intelligence events.
• log-translation-elds
This option is used to enable or disable the logging of translated (i.e server side) elds in IP
Intelligence log messages. Translated elds include (but not limited to) Source Address/Port,
Destination Address/Port, IP Protocol, Route Domain and Vlan.
• log-shun
This option is used to enable or disable the logging of shun IP Intelligence events.
• port-misuse
You can congure the following options under this:
• log-publisher
Species the name of the log publisher used for port misuse events.
• aggregate-rate
This option is used to set the rate limit that applies to any port misuse log messages.
• trafc-statistics
You can congure the following options under this:
• log-active-ows
This option is used to enable and disable the logging of number of active ows on client side. The
number of ows are logged globally, per virtual server and per route domain periodically if number
of active ows increased or decreased.
• log-publisher
Species the name of the log publisher used for Trafc Statistics logs.
• log-reaped-ows
This option is used to enable and disable the logging of number of reaped ows on client side. The
number of ows are logged globally, per virtual server and per route domain periodically if number
of active ows increased or decreased.
• log-missed-ows
1594
Security Log
This option is used to enable and disable the logging of number of TCP packets (non SYN/ACK)
were dropped because of the ow table lookup failed. The number of packets are logged globally,
and per route domain periodically.
• log-syncookies
This option is used to enable and disable the logging of number of syncookies generated, accepted
and rejected in the context globally and per virtual server. These log messages will be generated
periodically.
• log-syncookies-whitelist
This option is used to enable and disable the logging of number of syncookies whitelist hits, accepted
and rejected in the context globally and per virtual server. These log messages will be generated
periodically.
• network
Add, delete, modify or replace a single Network Security sub-prole. You can congure the following
options under this:
• lter
Following options are available which enable or disable the logging of corresponding Network
events:
• log-acl-match-accept
This option is used to enable or disable the logging of packets that match ACL rules congured
with action = Accept or action = Accept Decisively.
• log-acl-match-drop
This option is used to enable or disable the logging of packets that match ACL rules congured
with action = Drop.
• log-acl-match-reject
This option is used to enable or disable the logging of packets that match ACL rules congured
with action = Reject.
• log-ip-errors
This option is used to enable or disable the logging of IP error packets.
• log-tcp-errors
This option is used to enable or disable the logging of TCP error packets.
• log-tcp-events
This option is used to enable or disable the logging of TCP events on client side. Only 'Established'
and 'Closed' states of a TCP session are logged if this option is enabled.
• log-translation-elds
This option is used to enable or disable the logging of translated (i.e server side) elds in ACL
match and TCP events. Translated elds include (but not limited to) Source Address/Port,
Destination Address/Port, IP Protocol, Route Domain and Vlan.
• log-geo-always
This option is used to enable or disable the logging of Geographic IP Location information elds
in ACL match and TCP logging. Geographic information includes the country code of Source
Address and Destination Address.
• rate-limit
1595
Traffic Management Shell (tmsh) Reference Guide
Following options are available to set throttling rate limits for the corresponding logging network
events:
• acl-match-accept
This option is used to set rate limits for the logging of packets that match ACL rules congured
with action = Accept or action = Accept Decisively. This option is effective only if logging of
this message type is enabled.
• acl-match-drop
This option is used to set rate limits for the logging of packets that match ACL rules congured
with action = Drop. This option is effective only if logging of this message type is enabled.
• acl-match-reject
This option is used to set rate limits for the logging of packets that match ACL rules congured
with action = Reject. This option is effective only if logging of this message type is enabled.
• ip-errors
This option is used to set rate limits for the logging of IP error packets. This option is effective
only if logging of this message type is enabled.
• tcp-errors
This option is used to set rate limits for the logging of TCP error packets. This option is effective
only if logging of this message type is enabled.
• tcp-events
This option is used to set rate limits for the logging of TCP events on client side. This option is
effective only if logging of this message type is enabled.
• aggregate-rate
This option is used to set the aggregate rate limit that applies to any network loggging message.
• format
Species the Storage format in Network Security sub-prole. These settings are only used to format
the log messages destined to a Remote Syslog server. You can congure the following options for
the storage format:
• eld-list
Species a set of elds to be logged. This option is valid when storage format type is eld-list.
The order in the set is important - the server displays the selected trafc items in the log
sequentially according to it. User can pick elds from the following list: acl_policy_name,
acl_policy_type, acl_rule_name, action, bigip_hostname, context_name, context_type,
date_time, dest_fqdn, dest_geo, dest_ip, dest_port, drop_reason, management_ip_address,
protocol, route_domain, sa_translation_pool, sa_translation_type, source_fqdn, source_user,
src_geo, src_ip, src_port, translated_dest_ip, translated_dest_port, translated_ip_protocol,
translated_route_domain, translated_src_ip, translated_src_port, translated_vlan, vlan.
• eld-list-delimiter
Species the delimiter string in eld-list storage format type. The default delimiter is the comma
character, for CSV. This option is valid when storage format type is eld-list. Special character
$ should not be used in delimiter string as it is reserved for internal usage. Also, the maximum
length allowed for eld-list-delimiter is 31 characters (excluding NUL terminator).
• type
Species a type of the storage format. The options are:
• eld-list
1596
Security Log
Species that the log displays only the items you specify in the eld-list with
eld-list-delimiter as the delimiter between the items.
• none
Default format type. With this option, the messages will be logged in the following format:
"management_ip_address","bigip_hostname","context_type","context_name","src_geo","src_ip",
"dest_geo","dest_ip","src_port","dest_port","vlan","protocol","route_domain",
"translated_src_ip","translated_dest_ip","translated_src_port","translated_dest_port",
"translated_vlan","translated_ip_protocol","translated_route_domain","acl_policy_type",
"acl_policy_name","acl_rule_name","action","drop_reason","sa_translation_type",
"sa_translation_pool","flow_id","source_user","source_fqdn","dest_fqdn"
• user-dened
Species that the log displays the message as per the user-dened string format.
• user-dened
Species the format of log message in form of user dened string. This option is valid when
storage format type is user-dened. Maximum congurable length is 512 characters. Any of the
following items, if wrapped within ${ }, will be substituted with the actual value when generating
the log: acl_policy_name, acl_policy_type, acl_rule_name, action, bigip_hostname,
context_name, context_type, date_time, dest_fqdn, dest_geo, dest_ip, dest_port, drop_reason,
management_ip_address, protocol, route_domain, sa_translation_pool, sa_translation_type,
source_fqdn, source_user, src_geo, src_ip, src_port, translated_dest_ip, translated_dest_port,
translated_ip_protocol, translated_route_domain, translated_src_ip, translated_src_port,
translated_vlan, vlan.
• publisher
Species the name of the log publisher used for Network events.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• protocol-dns
Add, delete, modify or replace a single Protocol (DNS) Security sub-prole. You can congure the
following options under this:
• lter
Following options are available which enable or disable the logging of corresponding Network
events:
• log-dns-drop
This option is used to enable or disable the logging of dropped DNS packets.
• log-dns-ltered-drop
1597
Traffic Management Shell (tmsh) Reference Guide
This option is used to enable or disable the logging of DNS packets that are dropped due to
ltering.
• log-dns-malformed
This option is used to enable or disable the logging of malformed DNS packets.
• log-dns-malicious
This option is used to enable or disable the logging of malicious DNS packets.
• log-dns-reject
This option is used to enable or disable the logging of rejected DNS packets.
• format
Species the Storage format in Protocol (DNS) Security sub-prole. These settings are only used
to format the log messages destined to a Remote Syslog server. You can congure the following
options for the storage format:
• eld-list
Species a set of elds to be logged. This option is valid when storage format type is eld-list.
The order in the set is important - the server displays the selected trafc items in the log
sequentially according to it. User can pick elds from the following list: action, attack_type,
context_name, date_time, dest_ip, dest_port, dns_query_name, dns_query_type, src_ip,
src_port, vlan.
• eld-list-delimiter
Species the delimiter string in eld-list storage format type. The default delimiter is the comma
character, for CSV. This option is valid when storage format type is eld-list. Special character
$ should not be used in delimiter string as it is reserved for internal usage. Also, the maximum
length allowed for eld-list-delimiter is 31 characters (excluding NUL terminator).
• type
Species a type of the storage format. The options are:
• eld-list
Species that the log displays only the items you specify in the eld-list with
eld-list-delimiter as the delimiter between the items.
• none
Default format type. With this option, the messages will be logged in the following format:
"date_time","context_name","vlan","dns_query_type","dns_query_name",
"attack_type","action","src_ip","dest_ip","src_port","dest_port", "route_domain"
• user-dened
Species that the log displays the message as per the user-dened string format.
• user-dened
Species the format of log message in form of user dened string. This option is valid when
storage format type is user-dened. Maximum congurable length is 512 characters. Any of the
following items, if wrapped within ${ }, will be substituted with the actual value when generating
the log: action, attack_type, context_name, date_time, dest_ip, dest_port, dns_query_name,
dns_query_type, route_domain, src_ip, src_port, vlan.
• name
Species a dummy name for enabled Protocol (DNS) Security. This option is required for the
operations create, delete, modify, and replace-all-with.
1598
Security Log
• publisher
Species the name of the log publisher used for DNS events.
• protocol-dns-dos-publisher
Species the name of the log publisher used for DNS DoS events.
• dos-network-publisher
Species the name of the log publisher used for DoS Network events.
• protocol-sip
Add, delete, modify or replace a single Protocol (SIP) Security sub-prole. You can congure the
following options under this:
• lter
Following options are available which enable or disable the logging of corresponding protocol sip
events:
• log-sip-drop
This option is used to enable or disable the logging of dropped SIP packets.
• log-sip-global-failures
This option is used to enable or disable the logging of SIP packets that resulted in global failures.
• log-sip-malformed
This option is used to enable or disable the logging of malformed SIP packets.
• log-sip-redirection-responses
This option is used to enable or disable the logging of SIP packets that resulted in sending
redirection response.
• log-sip-request-failures
This option is used to enable or disable the logging of SIP request failures.
• log-sip-server-errors
This option is used to enable or disable the logging of SIP packets that resulted in server errors.
• format
Species the Storage format in Protocol (SIP) Security sub-prole. These settings are only used to
format the log messages destined to a Remote Syslog server. You can congure the following options
for the storage format:
• eld-list
Species a set of elds to be logged. This option is valid when storage format type is eld-list.
The order in the set is important - the server displays the selected trafc items in the log
sequentially according to it. User can pick elds from the following list: action, attack_type,
context_name, date_time, dest_ip, dest_port, dns_query_name, dns_query_type, src_ip,
src_port, vlan.
• eld-list-delimiter
Species the delimiter string in eld-list storage format type. The default delimiter is the comma
character, for CSV. This option is valid when storage format type is eld-list. Special character
$ should not be used in delimiter string as it is reserved for internal usage. Also, the maximum
length allowed for eld-list-delimiter is 31 characters (excluding NUL terminator).
• type
Species a type of the storage format. The options are:
1599
Traffic Management Shell (tmsh) Reference Guide
• eld-list
Species that the log displays only the items you specify in the eld-list with
eld-list-delimiter as the delimiter between the items.
• none
Default format type. With this option, the messages will be logged in the following format:
"date_time","context_name","vlan","sip_method_type","sip_caller", "sip_callee",
"attack_type","action","src_ip","dest_ip","src_port","dest_port", "route_domain"
• user-dened
Species that the log displays the message as per the user-dened string format.
• user-dened
Species the format of log message in form of user dened string. This option is valid when
storage format type is user-dened. Maximum congurable length is 512 characters. Any of the
following items, if wrapped within ${ }, will be substituted with the actual value when generating
the log: action, attack_type, context_name, date_time, dest_ip, dest_port, dns_query_name,
dns_query_type, route_domain, src_ip, src_port, vlan.
• name
Species a dummy name for enabled Protocol (SIP) Security. This option is required for the operations
create, delete, modify, and replace-all-with.
• publisher
Species the name of the log publisher used for SIP events.
• protocol-sip-dos-publisher
Species the name of the log publisher used for SIP DoS events.
• protocol-transfer
Adds, deletes, or replaces a single Protocol (Transfer) Security sub-prole. You can congure the
following options for Protocol (Transfer) Security:
• name
Species a dummy name for enabled Protocol (Transfer) Security. This option is required for the
operations create, delete, modify, and replace-all-with.
• publisher
Species the name of the log publisher used for Protocol Security log messages. Note: This publisher
should have either local-database, local-syslog, remote-syslog, arcsight or splunk single destination.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
asm http-method, asm response-code, create, delete, edit, glob, list, ltm virtual, modify, regex, security,
security log, security log storage-eld, show, sys log-cong destination, sys log-cong publisher, tmsh
1600
Security Log
protocol-dns-storage-field
Lists the available storage format elds that can be used in the context of Protocol DNS Security Logging.
Syntax
Retrieve the list of the protocol-dns-storage-eld values using the syntax shown in the following sections.
Display
list protocol-dns-storage-field
list protocol-dns-storage-field [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
one-line
app-service
Description
Use this command to display the possible values of the protocol-dns-storage-eld object to be used in the
context of Protocol DNS Security Logging. These possible values are predened trafc items available for
the server to log in the context of DNS event logging (for example, Malformed, Malicious, or Dropped
DNS packets).
Examples
list protocol-dns-storage-eld
Displays all the storage elds supported by Protocol DNS Security Logging.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
See Also
glob, list, regex, security log prole, tmsh
protocol-sip-storage-field
Lists the available storage format elds that can be used in the context of Protocol SIP Security Logging.
Syntax
Retrieve the list of the protocol-sip-storage-eld values using the syntax shown in the following sections.
1601
Traffic Management Shell (tmsh) Reference Guide
Display
list protocol-sip-storage-field
list protocol-sip-storage-field [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
one-line
app-service
Description
Use this command to display the possible values of the protocol-sip-storage-eld object to be used in the
context of Protocol SIP Security Logging. These possible values are predened trafc items available for
the server to log in the context of SIP event logging (e.g Dropped SIP packets).
Examples
list protocol-sip-storage-eld
Displays all the storage elds supported by Protocol SIP Security Logging.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
See Also
glob, list, regex, security log prole, tmsh
remote-format
Lists the log format for different remote destinations (such as ArcSight, Splunk etc.) used by various Firewall
events (such as Network, IP Intelligence, DoS etc.).
Syntax
Retrieve the list of the remote-format using the syntax shown in the following sections.
Display
list remote-format
list remote-format [ [ [name] | [glob] | [regex] ] ... ]
all
all-properties
app-service
format
one-line
1602
Security Log
Description
Use this command to display the actual log format used to send rewall event logs to remote destinations
such as ArcSight, Splunk and Syslog. These log formats are used by the log destinations of log publisher
congured in different sub-proles (for example Network, IP Intelligence, DNS, DNS DoS etc.) of a security
log prole.
Examples
list remote-format
Displays the log format for all rewall events.
list remote-format network-arcsight
Displays the format for Network log events (such as ACL matches, TCP events etc.) sent to an ArcSight
destination.
list remote-format network-dos-splunk
Displays the format for Network DoS log events sent to a Splunk destination.
list remote-format ip-intelligence-syslog-default
Displays the format for IP Intelligence log events sent to a remote syslog destination.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• format
Displays the remote log format used by the object.
See Also
glob, list, regex, security log prole, tmsh
storage-field
Lists the available storage format elds that can be used in the context of Application Security Logging.
Syntax
Retrieve the list of the storage-eld values using the syntax shown in the following sections.
Display
list storage-field
list storage-field [ [ [name] | [glob] | [regex] ] ... ]
all
app-service
format
id
one-line
1603
Traffic Management Shell (tmsh) Reference Guide
Description
Use this command to display the possible values of the storage-eld object to be used in the context of
Application Security Logging. These possible values are predened trafc items available for the server to
log. The trafc items appear in the nal format string as arguments in the printf () function, i.e.
"%<position>$<specier>", therefore each storage eld has its xed format (specier) and id (position).
Examples
list storage-eld
Displays all the storage elds supported by Application Security Logging.
Options
• app-service
Displays the application service to which the object belongs. The default value is none. Note: If the
strict-updates option is enabled on the Application Service that owns the object, you cannot modify
or delete the object. Only the Application Service can modify or delete the object.
• format
Displays a format of the eld (s - string, d - decimal). It corresponds to the conversion specier in the
printf () function.
• id
Displays an order ID of the eld (starting from 1). It corresponds to the position in the argument list of
the desired argument in the printf () function.
See Also
glob, list, regex, security log prole, tmsh
1604
Security Log
Sys
autoscale-group
Congure autoscale group ID for BIG-IP VE Autoscale Service on Amazon Web Services(AWS).
Syntax
Congure the autoscale-group component within the sys module using the syntax in the following sections.
Create/Modify
modify autoscale-group [name]
autoscale-group-id [[string] | none]
description [string]
edit autoscale-group [name]
all-properties
Display
list autoscale-group
list autoscale-group [name]
all-properties
one-line
Description
Species Amazon Web Services (AWS) Auto-Scale Group ID to which given BIGIP-VE belongs to. These
settings will be used for Auto Scaling BIG-IP instances based on user specied policy by Amazon Web
Services(AWS).
Options
• autoscale-group-id
Species autoscale-group id as reported by Amazon Web Services(AWS).
• description
User dened description.
See Also
edit, list, modify, sys autoscale-group, tmsh
clock
Displays the current date and time.
Syntax
Display
show clock
field-fmt
modify clock
time [time]
Description
You can use the clock component to display the system date and time.
Examples
show clock
Display the current date and time.
modify clock time 2012-12-11:12:30:45
Set the system clock to the specied time.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
cluster
Congures a cluster in a VIPRION(r) system.
Syntax
Congure the cluster component within the sys module using the syntax in the following sections.
Modify
modify cluster [name]
address [IP address | none]
members {
[1 | 2 | 3 | 4] {
address [IP address | none]
[disabled | enabled]
1606
Sys
priming [disabled | enabled]
}
}
min-up-members [integer]
min-up-members-enabled [no | yes]
edit cluster default
all-properties
non-default-properties
Display
list cluster
show running-config cluster
show running-config cluster [option name]
one-line
show cluster
show cluster [option name]
field-fmt
Description
You can use the cluster component to modify the conguration of the primary blade in a cluster. When
you do this, the system automatically propagates the changes to the other blades in the cluster. This is known
as cluster synchronization.
Examples
modify cluster default address 192.168.217.44/24
Sets the oating management IP address for the cluster default to an IP address of 192.168.217.44.
list cluster my_cluster
Displays the properties of the cluster named my_cluster.
Options
address
Species an IP address for the cluster or cluster member. The default value is none.
disabled
Disables the specied cluster member. The default value is enabled.
enabled
Enables the specied cluster member. This is the default value.
members
Species the cluster members to be acted on by the command. A cluster member is a slot into which you
insert a blade. The cluster member is identied by the number assigned to the slot.
min-up-members
1607
Traffic Management Shell (tmsh) Reference Guide
Species the minimum number of cluster members that must be up for the cluster to remain Active. The
default value is 1.
min-up-members-enabled
When set to yes, species that when the number of cluster members that are active is below the value of
the option min-upmembers, the cluster fails over to its peer. The default value is no.
Enable this parameter when you congure a redundant pair.
Important: Make sure that you modify the value of the min-up-members option appropriately when you
take blades down in a cluster. Otherwise, you can get into the condition where disabling a cluster member
brings the cluster below the value of the option min-up-members, which can cause the cluster to fail over
to its peer.
name
Species a name for the cluster. This option is required.
priming
Prevents a cluster member from proceeding to the RUNNING cluster quorum state, which is useful when
a blade is in a reboot loop. The default value is disabled.
See Also
edit, list, modify, show, tmsh
config
Manages the BIG-IP(r) system conguration.
Syntax
Save the running conguration or load the system conguration les within the sys module using the
following syntax.
Modify
save config
binary
current-partition
exclude-gtm
file
gtm-only
one-line
passphrase
partitions
tar-file
time-stamp
user-only
wait
load config
current-partition
default
1608
Sys
exclude-gtm
file
files-folder
from-terminal
gtm-only
merge
passphrase
partitions
tar-file
user-only
verify
delete config file [file name]
Display
list config file
Description
The system applies all conguration changes that you make from within tmsh to the running conguration.
To save the running conguration to the system conguration les, use the command sequence save cong.
Additionally, you can replace the running conguration with the conguration in the system conguration
les using the command sequence load cong.
If any of these options are not specied, save/load cong will save or load the conguration in all partitions
on this system:
• binary
• default
• le
• from-terminal
• partitions
Examples
save cong
Saves the running conguration in all partitions by overwriting the system conguration les.
In Virtual Editions with f5-swap-eth installed, saves the mapping of Ethernet device names and MAC
addresses to /etc/ethmap to make the working BIG-IP still work after adding/deleting virtual NIC(s). It
also works for save cong partitions all.
save cong binary
Saves all running conguration by overwriting the system binary conguration database le.
save cong current-partition
Saves the running conguration in current update partition by overwriting the system conguration les.
save cong wait
Save request waits if another save operation is in progress.
save cong le my_le tar-le my_tar_le
1609
Traffic Management Shell (tmsh) Reference Guide
Saves all running conguration to the specied le, my_le, and all the user provided disk les referred to
by the conguration into my_tar_le.
save cong le my_le passphrase my_password
Saves all running conguration to the specied le, my_le and encrypt it with my_password.
save cong partitions { my_partition }
Saves the running conguration in my_partition by overwriting the system conguration les.
save cong partitions all
Saves the running conguration in all partitions by overwriting the system conguration les.
save cong user-only
Saves only user account conguration by overwriting the system conguration les.
load cong
Replaces the running conguration in all partitions with the conguration in the system conguration les.
load cong current-partition
Replaces the running conguration in current update partition with the conguration in the system
conguration les.
load cong merge le my_le
Loads the specied conguration from my_le, which modies the running conguration.
load cong verify le my_le
Validates the specied conguration in my_le to see whether they are valid to replace the running
conguration. The running conguration will not be changed.
load cong verify merge le my_le
Validates the specied conguration in my_le to see whether they are valid to be merged into the running
conguration. The running conguration will not be changed.
load cong default
Sets system conguration back to factory default settings.
load cong le my_le tar-le my_tar_le
Replaces all running congurations with the conguration in the specied le, my_le and the disk les
referred to by the conguration are retrieved from my_tar_le.
load cong le my_le les-folder my_les_folder
Replace all running conguration with the conguration in the specied le, my_le and the disk les
referred to by the conguration is taken from the directory tree under my_les_folder.
load cong le my_le passphrase my_password
Replaces all running conguration with the conguration in the specied encrypted le, my_le and decrypt
it with my_password.
While searching for disk les under the specied folder, the order of search is rst by le name as in
cache-path, and then by object-name. If more than one le is found for a name, then the relative path in the
cache-path is used to make the selection.
1610
Sys
That is, while looking for <Bsys le ssl-cert xxx { cache-path
/cong/lestore/les_d/Common_d/certicate_d/xxx_1 ... }>
Looks for file(s) named B<xxx_1>.
If none are found, looks for file(s) named "xxx"
When more than one file is found, looks for a copy that matches paths in the
order:
B<certificate_d/<name-found>>
B<Common_d/certificate_d/<name-found>>
load cong partitions { x }
Replace the running conguration in partition x with the conguration in the system conguration les.
load cong partitions all
Replace the running conguration in all partitions with the conguration in the system conguration les.
load cong from-terminal
Replace the running conguration with what is entered from the terminal.
1. Type the initial command. 2. The system responds with a conrmation prompt, type Y to conrm.
Replace the running conguration? (y/n) y
3. Type in the replacement conguration entries.
net self-allow {
defaults {
igmp:any
ospf:any
pim:any
tcp:161
tcp:22
tcp:4353
tcp:443
tcp:53
udp:1026
udp:161
udp:4353
udp:520
udp:53
}
}
net stp-globals {
config-name 00-01-D7-B5-67-00
}
sys management-ip 172.27.41.70/24 { }
sys management-route default {
gateway 172.27.41.254
}
sys provision ltm {
level nominal
}
....
ltm pool pool1 {
slow-ramp-time 200
}
.....
^D
1611
Traffic Management Shell (tmsh) Reference Guide
4. Use Ctrl+D to submit the changes or Ctrl+C to cancel the changes.
delete cong le myle
Delete myle in default directory, /var/local/scf/.
list cong le
Display les in default directory, /var/local/scf/.
Options
• base
This parameter is ignored for backwards compatibility. In previous TMOS versions, it indicated that
only the base conguration would be saved or loaded, as opposed to the full conguration. This option
cannot be specied with the binary, default, gtm-only, and user-only options.
• binary
Indicates binary conguration. This option may not be specied with any other options.
• default
Indicates factory default conguration. This option cannot be specied with any other options.
• le
Loads or saves a conguration from the specied le. For save, a le with a relative path is saved in
the default directory, /var/local/scf. For load, in shell mode, the default directory, /var/local/scf, is used
for a le with a relative path. In bash mode, for a le with a relative path, the current directory is searched
rst. If the le can't be found in the current directory, /var/local/scf is searched.
This option can be used with binary, default, from-terminal and partitions options.
• passphrase
Species a password to save or load an encrypted conguration le. This option can only be used with
option le.
• tar-le
Loads or saves disk les referred to by the conguration from the specied tar le. A le with a relative
path is looked up, relative to the current directory.
• les-folder
Loads disk les referred to by the conguration from the folder tree under the specied folder. Disk
les by name are searched for recursively. When there is more than one le with the same name, the
relative path of the le from the cache-path is used for selection.
• from-terminal
Species that the conguration will be input from the terminal in the same format as the system
conguration les in <B/cong>. Use Ctrl+D to submit the changes and Ctrl+C to cancel the changes.
This option cannot be specied with default, le and partitions.
• gtm-only
Indicates the Global Trafc Manage (GTM) conguration. This option cannot be specied with the
base, exclude-gtm, and user-only options.
• exclude-gtm
Indicates the BIG-IP conguration, excluding GTMs. This is only valid with the le option. This option
cannot be specied with the base, gtm-only, and user-only options.
• merge
1612
Sys
Loads the conguration from the specied le or from the terminal, which modies the running
conguration. If merging from the terminal, it requires Ctrl+D to complete the operation. This option
is only valid with the le or from-terminal options.
• partitions
Indicates the partitions in which conguration components reside. This option cannot be specied with
the default, le, from-terminal, or merge options.
• user-only
Indicates the conguration including user account information only. This option cannot be specied
with the base, default, exclude-gtm, or gtm-only options.
• time-stamp
Inserts a time-stamp in a le name. This is only valid with the le option.
• verify
Validates the specied conguration from le(s) or from the terminal without changing the running
conguration.
• wait
Species that tmsh should wait for another instance of tmsh to nish saving the conguration before
proceeding. If wait is not specied and another instance of tmsh is in the process of saving the
conguration, the command exits tmsh immediately (because the other instance of tmsh is already
saving the conguration).
See Also
load, save, tmsh
config-diff
Displays the differences between two specied single conguration les (SCFs).
Syntax
Display information using the cong-diff component within the sys module with the syntax in the following
section.
Display
show config-diff [file name] [file name]
Description
You can use the cong-diff component to display the differences between two previously created SCF les.
Examples
show cong-diff my.scf your.scf
Displays information about the differences between two specied les.
1613
Traffic Management Shell (tmsh) Reference Guide
Options
• le name
Species the name of an SCF le that you want to compare to another SCF le.
See Also
show, tmsh
connection
Sets idle timeout for, displays, and deletes active connections on the BIG-IP(r) system.
Syntax
Use the connection component within the sys module to manage connections using the following syntax.
Modify
modify connection
idle-timeout [integer]
Display
show connection
option:
all-properties
age [integer]
cs-client-addr [IP address]
cs-client-port [ [integer] | [service] ]
cs-server-addr [IP address]
cs-server-port [ [integer] | [service] ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
protocol [name]
save-to-file [ filename ]
ss-client-addr [IP address]
ss-client-port [ [integer] | [service] ]
ss-server-addr [IP address]
ss-server-port [ [integer] | [service] ]
type [any | mirror | self]
Delete
delete connection
option:
age [integer]
cs-client-addr [IP address]
cs-client-port [ [integer] | [service] ]
cs-server-addr [IP address]
cs-server-port [ [integer] | [service] ]
protocol [name]
ss-client-addr [IP address]
ss-client-port [ [integer] | [service] ]
ss-server-addr [IP address]
1614
Sys
ss-server-port [ [integer] | [service] ]
type [any | mirror | self]
Description
You can use the connection component to set the idle timeout for or delete active connections to the BIG-IP
system based on a specied lter. Additionally, you can display information about the active connections
to the system.
You can specify the <port> option using either a number or a service (80 or http).
Important: If you do not specify a port or service, the system deletes all connections that match just the IP
address. If you do not specify an IP address, the system deletes all connections including mirrored
connections.
Examples
show connection all-properties
Displays information about all active connections to the system.
modify connection idle-timeout 300
Changes the amount of idle time before a connection is disconnected to ve minutes (300 seconds).
Options
• age
Species, in seconds, the age of the active connections that you want to display or delete.
• cs-client-addr
Species the client-side remote IP address of the active connections that you want to display or delete.
• cs-client-port
Species the clientside remote port of the active connections that you want to display or delete.
• cs-server-addr
Species the clientside local IP address of the active connections that you want to display or delete.
• cs-server-port
Species the clientside local port of the active connections that you want to display or delete.
• idle-timeout
Species the interval, in seconds, that a connection can remain idle before the system closes the
connection.
• protocol
Species the protocol of the active connections that you want to display or delete.
• save-to-le
Species the le which connection information can be save to. With this option, it can write a le larger
than 2GB.
• ss-client-addr
Species the serverside local IP address of the active connections that you want to display or delete.
• ss-client-port
Species the serverside local port of the active connections that you want to display or delete.
1615
Traffic Management Shell (tmsh) Reference Guide
• ss-server-addr
Species the serverside remote IP address of the active connections that you want to display or delete.
• ss-server-port
Species the serverside remote port of the active connections that you want to display or delete.
• type
Species the type of active connections that you want to display or delete. The possible values are:
• any
Species all active connections.
• mirror
Species only mirrored connections.
• self
Species the connection with which you are accessing the system.
See Also
delete, modify, show, tmsh
console
Congures the serial console for the BIG-IP(r) system.
Syntax
Congure the console component within the sys module using the syntax in the following section.
Modify
modify console
baud-rate [integer]
Display
show console
Description
You can use the console component to congure the serial console on the BIG-IP system.
Options
• baud-rate
Species the baud rate for the serial console. Select from the following options:
• 9600
• 19200 (default)
1616
Sys
• 57600
• 115200
For information about the options that you can use with the command show, see help show.
See Also
modify, show, tmsh
cpu
Displays statistics about the Trafc Management Microkernel (TMM) service, specically, CPU cycles.
Syntax
Display statistics for the cpu component within the sys module using the syntax in the following section.
Display
show cpu
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the cpu component to display the CPU cycles for the system. You can also specify the unit
value in which the system displays statistics.
Examples
show cpu
Displays TMM processor statistics in the system default units.
show cpu raw
Displays raw TMM processor statistics.
See Also
show, tmsh
daemon-ha
Congures high availability for a BIG-IP(r) system.
Syntax
Congure the daemon-ha component within the sys module using the syntax in the following sections.
1617
Traffic Management Shell (tmsh) Reference Guide
Modify
modify daemon-ha [name]
heartbeat [enabled | disabled]
heartbeat-action [go-offline | go-offline-downlinks-restart |
go-offline-restart | reboot | restart | restart-all]
running [enabled | disabled]
edit daemon-ha [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list daemon-ha
list daemon-ha [ [ [name] | [glob] | [regex] ] ... ]
show running-config daemon-ha
show running-config daemon-ha [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
not-running-action
one-line
running-timeout
Description
You can use the daemon-ha component to congure the daemons on the system that handle high availability
for the BIG-IP system.
Examples
modify daemon-ha bigd running disabled
Disables the bigd daemon.
list daemon-ha bigd running-timeout
Displays the running timeout of the bigd daemon.
Options
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• heartbeat
Species whether heartbeat monitoring is enabled for the specied daemon. If monitoring is enabled
and the daemon does not maintain its heartbeat the action specied by the value of the heartbeat-action
option is taken.
The default value is enabled for all daemons, except the named daemon, which is disabled by default.
• heartbeat-action
Species the action the system takes if the specied daemon does not maintain its heartbeat.
The default value is dependent on the specied daemon, the most common default value is restart.
1618
Sys
• name
Species a unique name for the component. This option is required for the command modify.
• not-running-action
Species the action that the system takes if the daemon is not running. This option is read-only.
The default value is dependent on the specied daemon, the most common default value is
go-ofine-downlinks.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• running
Species whether the running-timeout and non-running-action options are enabled. The default value
is dependent on the specied daemon, the most common default value is enabled.
Note: This feature is implemented only for the daemons: tmm, mcpd, bcm56xxd, bigd, gtmd, clusterd,
tmrouted, bd, datasyncd and tmrouted.
• running-timeout
Species the amount of time (in seconds) that must elapse before the specied daemon is considered
to be not running. This option is read-only.
The default value is dependent on the specied daemon.
See Also
edit, glob, list, modify, regex, show, tmsh
datastor
Congures the data storage used for optimization.
Syntax
Congure the datastor component within the sys module using the syntax in the following sections.
Modify
modify datastor
dedup-cache-weight [integer]
description [string]
disk [disabled | enabled]
high-water-mark [integer]
low-water-mark [integer]
web-cache-weight [integer]
Display
list datastor
1619
Traffic Management Shell (tmsh) Reference Guide
show running-config datastor
all-properties
cache-size
non-default-properties
one-line
store-size
Description
You can use the datastor component to congure disk I/O operations and optimized page cache for frequently
accessed sectors. Note that symmetric data deduplication is one consumer of this storage space.
Examples
list datastor all-properties
Displays the data storage settings.
modify datastor disk disabled
Disables data storage on the disk.
Options
• cache-size
Displays the size of the data storage in megabytes (MB).
• dedup-cache-weight
Species the relative weight of the dedup cache for the Acceleration Manager module. The default value
is 10.
• description
User dened description.
• disk
Enables or disables the use of the disk (in addition to memory) for data storage.
If you enable or disable data storage on the disk, you must then restart the datastor service from the
command line using the command sequence bigstart restart datastor.
• high-water-mark
Species the percentage of full cache above which pruning starts. The valid range is 60 - 100 percent.
The default value is 92.
• low-water-mark
Species the percentage of full cache below which pruning stops. The valid range is 10 - 90 percent.
The default value is 80.
• store-size
Displays the amount of space for each disk path specied.
• web-cache-weight
Species the relative weight of the web cache for the Acceleration Manager module. The default value
is 10.
See Also
wom deduplication, list, modify, show, tmsh
1620
Sys
db
Displays or modies bigdb database entries.
Syntax
Congure the db component within the sys module using the syntax in the following sections.
Modify
modify db [name] value [database variable value]
modify db [name] reset-to-default
Display
list db
list db [ [ [name] | [glob] | [regex] ] ...]
all-properties
default-value
non-default-properties
one-line
value
value-range
show running-config db
show running-config db [ [ [name] | [glob] | [regex] ] ...]
all-properties
Description
You can use the db component to modify and retrieve the data that is stored in the bigdb conguration
database.
Important: After you change a bigdb database variable using the db component, you must run the command
sequence save cong. If you do not, the next time that you run the command sequence load [cong base |
cong], the value of the bigdb database variable may be reset to the value in the stored conguration.
Note that tmsh only displays bigdb database entries when you explicitly request them.
Examples
modify db Connection.SynCookies.Threshold value 16384
Sets the database entry, SYN Check(tm) Activation Threshold, to the given value.
modify db Connection.SynCookies.Threshold reset-to-default
Sets the database entry, SYN Check(tm) Activation Threshold, back to the default value.
list log.mcpd.level
Displays the properties of the database entry log.mcpd.level:
1621
Traffic Management Shell (tmsh) Reference Guide
Options
• default-value
Displays the system-supplied default value of the database entry.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species the unique name of the database variable. This option is required for the command modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reset-to-default
Resets the database variable back to its default value.
• value
Species the value to which you want to set the specied database entry.
• value-range
Displays the type of data that you can use with the value option. The options are:
• integer
• IP address
• list of valid values
• management IP address
• string
• unsigned integer
See Also
glob, list, modify, regex, show, tmsh
default-config
Loads the default conguration of the BIG-IP(r) system stored in the conguration les to the running
conguration of the system.
Syntax
Congure the default-cong component within the sys module using the following syntax.
Modify
load default-config
1622
Sys
Description
You can use the default-cong component to load the default system conguration to the running
conguration. This results in the user-dened conguration being removed from the running conguration.
Examples
load default-cong
Loads the default conguration stored on the system to the running conguration of the system.
See Also
load, tmsh
dns
Congures the Domain Name System (DNS) for the BIG-IP(r) system.
Syntax
Modify the dns component within the sys module using the syntax shown in the following sections.
Modify
modify dns
description [string]
include [string]
name-servers [add | delete | replace-all-with] {
[IP address] ...
}
name-servers none
search [add | delete | replace-all-with] {
[domain] ...
}
search none
edit dns
all-properties
non-default-properties
Display
list dns
list dns [option]
show running-config dns
show running-config dns [option]
all-properties
non-default-properties
one-line
Description
You can use the dns component to manage congurations by server grouping, in this case, DNS servers.
1623
Traffic Management Shell (tmsh) Reference Guide
Examples
• modify dns name-servers add { 192.168.10.20 192.168.10.22 }
Adds DNS name servers with the IP addresses, 192.168.10.20 and 192.168.10.22, to the BIG-IP system.
• modify dns search add { siterequest.com store.siterequest.com london.siterequest.com }
Adds the host names, siterequest.com, store.siterequest.com, and london.siterequest.com, to the DNS
search conguration for the BIG-IP system.
Note: When DNS searches for the host, siterequest, which is not a fully qualied domain name, it uses
the IP address of the rst match, in this case, siterequest.com.
• show running-conguration dns
Displays the running conguration of the dns component.
Options
• description
User dened description.
• include
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using the include option. If you use this option incorrectly, you
put the functionality of the system at risk.
• name-servers
Congures a group of DNS name servers for the BIG-IP system.
• search
Congures a list of domain names in a specic order. DNS uses that order when searching for host
names that are not fully qualied. You can use this option to delete domain names in the list.
See Also
edit, list, modify, tmsh
failover
Congures failover for a BIG-IP(r) unit in a redundant system conguration.
Syntax
Change the failover state within the sys module using the syntax in the following section.
Modify
run failover
device [string]
no-persist
offline
online
1624
Sys
persist
standby
traffic-group [[string] | default | non-default | none]
Display
show failover
cable
Description
Failover is the process where a standby unit in a redundant system conguration takes over when a software
or hardware failure is detected on the active unit.
Examples
run failover standby
Causes the active unit or cluster to go into the standby state forcing the other unit or cluster in the redundant
system conguration to become active.
run failover ofine
Causes the active unit or cluster to go into the Forced Ofine state.
run failover online
Changes the status of a unit or cluster from Forced Ofine to either Active or Standby, depending upon the
status of the other unit or cluster in a redundant system conguration.
show failover
Displays the failover state of the BIG-IP system (active, standby, ofine) and how long it has been in that
state.
run failover standby device my_bigip
Species that the my_bigip device should become the active device for all trafc groups.
run failover standby trafc-group trafc_grp01
Species that the trafc group named trafc_grp01 should fail over to the Standby state. The trafc group
will then become Active on another device.
run sys failover ofine no-persist
Changes the status of a unit to Forced Ofine and indicates that the change will not be persisted after a
system restart.
run sys failover ofine persist
Changes the status of a unit to Forced Ofine and indicates that the change will be persisted after a system
restart.
Options
Use these options to control failover of the system:
• device
Species the device that should next become the active device for the specied trafc group or all trafc
groups (if a trafc group is not specied). This option may only be specied with the standby option.
• no-persist
1625
Traffic Management Shell (tmsh) Reference Guide
Does not persist the change in status of a unit. The option is valid only with the ofine state.
• ofine
Changes the status of a unit or cluster to Forced Ofine. If persist or no-persist options are not specied,
the default action is to persist the ofine status of the unit between system restarts.
• online
Changes the status of a unit or cluster from Forced Ofine to either Active or Standby, depending upon
the status of the other unit or cluster in a redundant system conguration.
• persist
Persists the change in status of a unit. The option is valid only with the ofine state.
• standby
Species that the active unit or cluster fails over to a Standby state, causing the standby unit or cluster
to become Active.
• trafc-group
Species the trafc-group that should fail over to the Standby state, the trafc-group will become Active
on another device. This option may only be specied with the standby option.
Use this option to display the failover cable status of the system:
• cable
Displays the status that the failover daemon detects on the serial cable from its failover peer. It also
shows what the failover peer detects on the serial cable. An active BIG-IP system will see a zero from
its failover peer. A standby BIG-IP system will see a one from its failover peer.
See Also
run, tmsh
feature-module
Enables or disables a feature module on the BIG-IP(r) system.
Syntax
Congure the feature-module component within the sys module using the syntax in the following sections.
Modify
modify feature-module
modify feature-module [ [all] | [cgnat] ]
enabled | disabled
edit feature-module
[ [ [cgnat] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
1626
Sys
Display
list feature-module
list feature-module
[ [ [cgnat] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Description
You can use the feature-module component to modify the availability of any licensed feature modules on
your system.
Examples
• modify feature-module cgnat enabled
Enables the BIG-IP Carrier Grade NAT module.
• modify feature-module cgnat disabled
Disables the BIG-IP Carrier Grade NAT module.
• list feature-module
Displays the current feature module of the system.
Options
• all
Species that you are enabling or disabling all of the available modules.
• cgnat
Species that you are enabling or disabling the BIG-IP Carrier Grade NAT module.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
edit, glob, list, modify, regex, show, tmsh, provision
fix-connection
Displays FIX connection statistics.
1627
Traffic Management Shell (tmsh) Reference Guide
Syntax
Display
show fix-connection
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
all-properties
save-to-file
Description
You can use the x-connection component to display statistics about FIX connections.
Examples
show x-connection
Displays FIX connection statistics in the system default units.
Options
For information about the options that you can use with the command show, see help show.
folder
Congure folders (directory structure) on the BIG-IP(r) system.
Syntax
Congure the folder component within the sys module using the syntax in the following sections.
Create/Modify
create folder [name]
modify folder [name]
app-service [[string] | none]
description [string]
device-group [[string] | default | non-default | none]
no-ref-check [false | true]
traffic-group [[string] | default | non-default | none]
Display
list folder
list folder [ [name] | [glob] | [regex] | [recursive] ]
Delete
delete folder [name]
1628
Sys
Description
The folder system enables users to create logical containers for the purpose of granular control of
synchronization to other devices in a device group.
The folder system is hierarchical, with folders and sub-folders, in a parent-to-child relationship. The highest
level folder in the system is called root. For every administrative partition on the BIG-IP system, there is
a top-level folder. Top-level folders always have root as the parent. Users can create sub-folders to any
folder in the system.
Examples
create sys folder sub-folder1 device-group dg1 trafc-group none
Creates a new sub-folder to the current working folder called sub-folder1, associates the folder with a
device-group called dg1, and sets the trafc-group to no association.
modify sys folder /Common/sub-folder1/subfolder2 description "store pools for the B2 server
conguration"
Changes the description property of the folder indicated by its full name.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• device-group
Adds this folder and all conguration items in this folder to a device group for device failover or
cong-sync purposes. The options are:
• default
Indicates that this folder should use the device group setting of its parent folder. If the parent folder's
associated device group is changed, this folder's device group will change as well.
• non-default
Disassociates this folder from its parent folder's device group setting. This folder's device group eld
can then be set independently of the parent folder's eld.
• hidden
Folders may be hidden by setting this property to true. The -hidden command-line option will allow
you to view hidden folders, but is not required to use or modify a folder. The -hidden command-line
option only affects output from the list command and the results of tab completing a conguration item.
If set to false, the folder will always be visible as long as the user has the appropriate permissions.
• inherited-devicegroup
Species, when set to true, that this folder uses the device group setting of its parent folder. If the parent
folder's associated device group is changed then this folder's device group will change as well. This eld
is read-only.
• inherited-trafc-group
Species, when set to true, that this folder uses the trafc group setting of its parent folder. If the parent
folder's associated trafc group is changed then this folder's trafc group will change as well. This eld
is read-only.
1629
Traffic Management Shell (tmsh) Reference Guide
• no-ref-check
Species whether strict device group reference validation is performed on conguration items in the
folder. The options are:
• false
Requires conguration items in the folder to sync to a super-set of the devices that are associated
with any conguration that refers to conguration items in the folder. This is the default value.
• true
Disables this check. It is then assumed that any dependent conguration items contained in the folder
will be created locally on the other devices.
• trafc-group
Adds this folder and its conguration items to an existing trafc group. The values default and
non-default work as they do for the device-group option.
See Also
create, delete, glob, list, modify, regex, tmsh
geoip
Loads the GeoIP data les.
Syntax
Use the geoip component within the gtm module to load the GeoIP data les using the syntax in the following
sections.
Loading
load geoip
Description
The BIG-IP system ships with three default database les that are stored in the /usr/share/GeoIP/ directory.
The three les are: F5GeoIP.dat, F5GeoIPISP.dat, and F5GeoIPv6.dat.
You can download and install updated GeoIP database les using the procedure available from the F5
download site. The installation places the updated database les in the share/GeoIP directory.
When you run the load geoip command sequence, the system loads the GeoIP les from disk into the
running conguration. If you have downloaded and installed updated database les, those les are loaded
from the /shared/GeoIP directory. Otherwise, the default database les are loaded from the
/usr/share/GeoIP/ directory. Note that if both directories contain the same les, the les in shared/GeoIP
are loaded.
Examples
load geoip
Loads the GeoIP les from disk into the running conguration.
1630
Sys
See Also
load, tmsh
global-settings
Congures the global system settings for a BIG-IP(r) system.
Syntax
Congure the global-settings component within the sys module using the syntax in the following sections.
Modify
modify global-settings
aws-access-key [string]
aws-secret-key [string]
aws-api-max-concurrency [integer]
console-inactivity-timeout [integer]
custom-addr [IP address]
description [string]
failsafe-action [go-offline | reboot | resetart-all |
go-offline-restart-tm | failover-restart-tm]
file-local-path-prefix [local path prefix]
gui-security-banner [disabled | enabled]
gui-security-banner-text [string]
gui-setup [disabled | enabled]
host-addr-mode [custom | management | state-mirror]
hostname [string]
hosts-allow-include [string]
lcd-display [disabled | enabled]
net-reboot [disabled | enabled]
password-prompt [string]
mgmt-dhcp [disabled | enabled]
quiet-boot [disabled | enabled]
remote-host [add | delete | replace-all-with] {
[name]... {
addr [IP address]
hostname [string]
}
}
remote-host none
username-prompt [string]
edit global-settings
all-properties
non-default-properties
Display
list global-settings
list global-settings [option]
show running-config global-settings
show running-config global-settings [option]
all-properties
1631
Traffic Management Shell (tmsh) Reference Guide
non-default-properties
one-line
Description
You can use the global-settings component to set up the BIG-IP system.
Examples
modify system remote-host add { bigip151 {addr 172.27.226.151 hostname bigip151.saxon.net} }
Sets up a remote host named bigip151 with an IP address of 172.27.226.151 and a hostname of
bigip151.saxon.net.
list global-settings all-properties
Displays all of the properties of the global system settings.
Options
• aws-access-key
Amazon Web Services (AWS) supplied access key needed to make secure requests to AWS. The default
value is none.
• aws-secret-key
Amazon Web Services (AWS) supplied secret key needed to make secure requests to AWS. The default
value is none.
• aws-api-max-concurrency
Maximum concurrent connections allowed while making Amazon Web Service (AWS) api calls. The
default value is 1.
• console-inactivity-timeout
Species the number of seconds of inactivity before the system logs off a user that is logged on. The
default value is 0 (zero), which means that no timeout is set. The valid range is 0 - 2147483647.
• custom-addr
Species an IP address for the system. The default value is ::. The host-addr-mode option must be set
to custom in order for this setting to take effect.
• description
Species a user dened description. The default value is no description.
• failsafe-action
Species the action that the system takes when the switch board fails. The default value is
go-ofine-restart-tm.
• failover-restart-tm
Species that when the switch board fails the system restarts the trafc management system and
fails over to the other unit in a redundant pair.
• go-ofine
Species that when the switch board fails the system goes ofine.
• go-ofine-restart-tm
Species that when the switch board fails the system goes ofine and restarts the trafc management
system.
• reboot
1632
Sys
Species that after the active cluster fails over to its peer, it reboots while the peer processes the
trafc.
• restart-all
Species that when the switch board fails the system restarts all system services.
• le-local-path-prex
Species a list of folder prexes that can be applied for le objects. This is a space separated list of
folder prexes, contained in curly braces. Example: "{le:///shared/}" or "{le:///leobjectfolder/}
{/shared/}". By default the folders are "/shared/" and "/tmp/", represented as "{/shared/} {/tmp/}".
• gui-security-banner
Species whether the system presents on the login screen the text you specify in the
gui-security-banner-text option. If you disable this option, the system presents an empty frame in the
right portion of the login screen. The default value is enabled.
• gui-security-banner-text
Species the text to present on the login screen when the gui-security-banner option is enabled. The
default value is Welcome to the BIG-IP Conguration Utility.
Note: To enter a carriage return in the text type Ctrl-V followed by Ctrl-J. Additionally, you must
escape special characters, such as a question mark(?), with a back slash.
• gui-setup
Enables or disables the Setup utility in the browser-based Conguration utility. The default value is
enabled.
Note: When you congure a system using tmsh, disable this option. Disabling this option allows the
system administrators to use the browser-based Conguration utility without having to run the Setup
utility.
• host-addr-mode
Species the type of host address you want to assign to the system. The default value is management.
The options are:
• custom
Use this value to specify a custom IP address for the system using the custom-addr option.
• management
Indicates that the host address is the management port of the system.
• state-mirror
Use this value when the host address of the system is shared by the other system in a redundant pair.
In case of system failure, the trafc to the other system is routed to this system.
• hostname
Species a local name for the system. The default value is bigip1.
• hosts-allow-include
Warning: Do not use this parameter without assistance from the F5 Technical Support team. The system
does not validate the commands issued when you use the hosts-allow-include option. If you use this
option incorrectly, you put the functionality of the system at risk.
• lcd-display
1633
Traffic Management Shell (tmsh) Reference Guide
Enables or disables the LCD display on the front of the system. The default value is enabled.
• net-reboot
Enables or disables the network reboot feature. The default value is disabled.
If you enable this feature and then reboot the system, the system boots from an ISO image on the network,
rather than from an internal media drive. Use this option only when you want to install software on the
system, for example, for an upgrade or a re-installation.
Note: An enabled value reverts to disabled after you reboot the system a second time.
• password-prompt
Species the text to present above the password eld on the system's login screen.
• mgmt-dhcp
Species whether the system uses DHCP client for acquiring the management interface IP address. If
this option is enabled, manually specied IP addresses for the management interface may be overwritten
if the network also contains a DHCP server. If this option is disabled, no DHCP server will be applied
to the management interface, however any previously acquired address will still be used. The default
value is enabled for VE and disabled for all other platforms. When this option is enabled, manual
changes like create/delete on management-ip will not be allowed.
• quiet-boot
Enables or disables the quiet boot feature. The default value is enabled. When enabled, the system
suppresses informational text on the console during the boot cycle.
• remote-host
Congures a remote host in the /etc/hosts le. The default value is none. You must enter both an IP
address and a fully qualied domain name (FQDN) or alias for each host that you want to add to the
le.
• username-prompt
Species the text to present above the user name eld on the system's login screen.
See Also
edit, list, modify, show, tmsh
ha-group
Congures the high availability (HA) scoring mechanism for a unit in a trafc group of BIG-IP(r) systems.
Syntax
Congure the ha-group component within the sys module using the following syntax.
Create/Modify
create ha-group [name]
modify ha-group [name]
active-bonus [integer]
app-service [[string] | none]
clusters none
1634
Sys
clusters [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
attribute percent-up-members
threshold [integer]
weight [integer]
}
}
description [string]
[disabled | enabled]
pools none
pools [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
attribute percent-up-members
threshold [integer]
weight [integer]
}
}
trunks none
trunks [add | delete | modify | replace-all-with] {
[name] {
app-service [[string] | none]
attribute percent-up-members
threshold [integer]
weight [integer]
}
}
Display
list ha-group
list ha-group [name]
all
all-properties
current-module
one-line
Delete
delete ha-group [name]
Description
You can use the ha-group component to congure a high availability (HA) group that determines the HA
scoring mechanism for a unit in a trafc group. This mechanism compares the relative health of the two or
more units in the trafc group and the system with the highest score becomes the active unit. Note Use the
attribute ha-group of the trafc group to make the association.
Examples
create ha-group group1 pools add { ftp_pool { attribute percent-up-members weight 70 } }
Creates a HA group, named group1, that includes the pool named ftp_pool, and uses the attribute
percent-up-members and a weight of 70 to determine the HA score for a unit in a trafc group.
list ha-group group1
Displays the conguration of the HA group, group1.
1635
Traffic Management Shell (tmsh) Reference Guide
Options
• active-bonus
Species a number to add to the unit's HA score when the unit is active. This option ensures that the
state of a unit is dependent upon the history of its state. The default value is 10 (ten). The range is 0 -
100.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• attribute
Species an attribute of the component that you want to use for the HA scoring mechanism.
Percent-up-members is the only available attribute for HA scoring for the clusters, pools, and trunks
options.
• clusters
Species the clusters that you want to congure for the HA group. You can only congure a cluster on
a chassis.
• description
User dened description.
• [disabled | enabled]
Enables or disables the HA group in the HA table. The default value is enabled.
• name
Species the name of the component that you want to congure. This option is required when you create,
modify, or delete a HA group. This option is also required when you congure clusters, pools, or trunks
for the HA group.
• pools
Species the pools that you want to congure for the HA group.
• threshold
Species the minimum number of up interfaces in a trunk, up pool members in a pool, or up cluster
members in a cluster below which the specied component does not contribute to the HA score for the
unit. The default value is 0 (zero), which indicates this option is disabled. The value may not exceed the
number of members of the trunk, pool, or cluster.
• trunks
Species the trunks that you want to congure for the HA group.
• weight
The value of this option is multiplied by the percent of up cluster, pool, or trunk members, and is added
to the HA score. The default value is 10. The range is 10 - 100.
See Also
create, delete, list, modify, tmsh
1636
Sys
ha-status
Displays information about the high availability (HA) status of a unit in a redundant pair.
Syntax
Display information about the ha-status component within the sys module using the following syntax.
Display
show ha-status
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the ha-status component to display information about the high availability status of a unit in
a redundant pair.
Examples
show ha-status
Display information about the HA status of the unit.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
hardware
Displays the BIG-IP(r) system hardware.
Syntax
Display statistics for the hardware component within the sys module using the syntax in the following
section.
Display
show hardware
Description
You can use the hardware component to display information about the hardware.
1637
Traffic Management Shell (tmsh) Reference Guide
Examples
show hardware
Displays hardware information for the system.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
host-info
Displays statistics about the host.
Syntax
Congure the host-info component within the sys module using the syntax in the following sections.
Display
show host-info
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the host-info component to display statistics about the host, including CPU count, active CPU
count, processor mode, memory usage, and more.
Examples
show host-info
Displays host statistics in the system default units.
show host-info raw
Displays raw host statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
1638
Sys
httpd
Congures the HTTP daemon for the BIG-IP(r) system.
Syntax
Congure the httpd component within the sys module using the following syntax.
Create/Modify
modify httpd
allow [add | delete | none |replace-all-with] {
hostname or IP address ...
}
auth-name [string]
auth-pam-dashboard-timeout [off | on]
auth-pam-idle-timeout [integer]
auth-pam-validate-ip [off | on]
description [string]
fastcgi-timeout [integer]
hostname-lookup [double | off | on]
include [string]
log-level [alert | crit | debug | emerg | error | info | notice | warn]
redirect-http-to-https [disabled | enabled]
request-header-max-timeout [integer]
request-header-min-rate [integer]
request-header-timeout [integer]
request-body-max-timeout [integer]
request-body-min-rate [integer]
request-body-timeout [integer]
ssl-ca-cert-file [string]
ssl-certchainfile [string]
ssl-certfile [string]
ssl-certkeyfile [string]
ssl-ciphersuite [string]
ssl-include [string]
ssl-protocol [string]
ssl-port [integer]
ssl-verify-client [no | require | optional | optional-no-ca]
ssl-verify-depth [integer]
ssl-ocsp-enable [on | off]
ssl-ocsp-default-responder [string]
ssl-ocsp-override-responder [on | off]
ssl-ocsp-responder-timeout [integer]
ssl-ocsp-response-max-age [integer]
ssl-ocsp-response-time-skew [integer]
edit httpd
all-properties
non-default-properties
Display
list httpd
list httpd [option name]
show running-config httpd
1639
Traffic Management Shell (tmsh) Reference Guide
show running-config httpd [option name]
all-properties
non-default-properties
one-line
Description
You can use the httpd component to congure the HTTP daemon for the system.
Important: F5 Networks recommends that users of the Conguration utility exit the utility before changes
are made to the system using the httpd component. This is because making changes to the system using this
component causes a restart of the httpd daemon. Additionally, restarting the httpd daemon creates the
necessity for a restart of the Conguration utility.
Examples
modify httpd { ssl-certle [string] ssl-certkeyle [string] }
Changes the SSL certicate and the SSL key. Note that when you change the SSL key, you must also change
the SSL certicate.
modify httpd auth-pam-idle-timeout 43200
Sets the PAM idle timeout to half a day (in seconds).
modify httpd allow replace-all-with {172.27.0.0/255.255.0.0}
Replaces the existing list of hosts that can connect to the httpd daemon with the hosts in the range,
172.27.0.0/255.255.0.0.
Options
• allow
Congures IP addresses and hostnames for the HTTP clients from which the httpd daemon accepts
requests. The default value is All.
Warning: Using the value none resets the httpd daemon to allow all HTTP clients access to the system;
therefore, F5 Networks recommends that you do not use the value none.
• auth-name
Species the name for the authentication realm. The default value is BIG-IP.
• auth-pam-dashboard-timeout
Species whether idle timeout while viewing the dashboard is enforced or not. The default value is off.
• auth-pam-idle-timeout
Species the number of seconds of inactivity that can elapse before the GUI session is automatically
logged out. The default value is 1200 seconds.
• auth-pam-validate-ip
Species whether the check for consistent inbound IP for the entire web session is enforced or not. The
default value is on.
• description
User dened description.
• fast-cgitimeout
Species, in seconds, the timeout for FastCGI. The default value is 300 seconds.
1640
Sys
• hostname-lookup
The default value is off.
• include
The default value is none.
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the include option incorrectly, you
put the functionality of the system at risk.
• log-level
Species the minimum httpd message level to include in the system log. The default value is warn.
• redirect-http-to-https
Species whether the system should redirect HTTP requests targeted at the conguration utility to
HTTPS. The default value is disabled.
• request-header-max-timeout
Species, in seconds, the maximum time allowed to receive all of the request headers, if the
request-header-min-rate option is used, in which case the timeout is extended as more data arrives.
Ignored if request-header-min-rate is not used. A value of 0 means no limit. The default value is 40.
• request-header-min-rate
Species, in bytes per second, the minimum average rate at which the request headers must be received.
A value of 0 means no limit. The default value is 500.
• request-header-timeout
Species, in seconds, the time allowed to receive all of the request headers. A value of 0 means no limit.
If you use the request-header-min-rate option, this represents the initial value for the timeout, which
will be extended as more data arrives. The default value is 20.
Warning: This includes the time needed to complete the initial SSL handshake. If the user's browser is
congured to query certicate revocation lists and the CRL server is not reachable, the initial SSL
handshake may take a signicant time until the browser gives up waiting for the CRL.
• request-body-max-timeout
Species, in seconds, the maximum time allowed to receive all of the request body, if the
request-body-min-rate option is used, in which case the timeout is extended as more data arrives.
Ignored if request-body-min-rate is not used. A value of 0 means no limit. The default value is 0.
• request-body-min-rate
Species, in bytes per second, the minimum average rate at which the request body must be received.
A value of 0 means no limit. The default value is 500.
• request-body-timeout
Species, in seconds, the time allowed for reading all of the request body. This includes the time needed
to do any SSL renegotiation. A value of 0 means no limit. If you use the request-body-min-rate option,
this represents the initial value for the timeout, which will be extended as more data arrives. The default
value is 60.
• ssl-ca-cert-le
Species the name of the le that contains the SSL Certicate Authority (CA) certicate le. The default
value is none.
• ssl-certchainle
1641
Traffic Management Shell (tmsh) Reference Guide
Species the name of the le that contains the SSL certicate chain. The default value is none.
• ssl-certle
Species the name of the le that contains the SSL certicate. The default value is
/etc/httpd/conf/ssl.crt/server.crt.
Note that the path to the le must start with either /etc/httpd/conf/ssl.crt/ or /cong/httpd/conf/ssl.crt/,
unless the path is a relative path. If the path is a relative path, then it must start with conf/ssl.crt/.
• ssl-certkeyle
Species the name of the le that contains the SSL certicate key. The default value is
/etc/httpd/conf/ssl.key/server.key.
Note that the path to the le must start with either /etc/httpd/conf/ssl.key/ or /cong/httpd/conf/ssl.key/,
unless the path is a relative path. If the path is a relative path, then it must start with conf/ssl.key/.
When you change the key le, you must also change the certicate le. For example, use the following
command sequence to change the key: modify httpd { ssl-certle [string] ssl-certkeyle [string] }
• ssl-ciphersuite
Species the ciphers that the system uses. The default value is
"DEFAULT:!aNULL:!eNULL:!LOW:!RC4:!MD5:!EXP"
• ssl-include
The default value is none.
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the ssl-include option incorrectly,
you put the functionality of the system at risk.
• ssl-protocol
The list of SSL protocols to accept on the management console. A space-separated list of tokens in the
format accepted by the Apache mod_ssl SSLProtocol directive.
The default value is all -SSLv2 -SSLv3.
• ssl-port
The SSL port to run the management console. It is a number in the range of 1 and 65535.
The default value is 443.
• ssl-ocsp-default-responder
Species the default responder URI for OCSP validation. The default is http://localhost.localdomain.
The value for the default responder should always be preceded with http://.
• ssl-ocsp-enable
Species OCSP validation of the client certicate chain. The default is off.
• ssl-ocsp-override-responder
Species the force use of default responder URI for OCSP validation. The default is off.
• ssl-ocsp-responder-timeout
Species the maximum allowable time in seconds for OCSP response. The default is 300 seconds.
• ssl-ocsp-response-max-age
Species the maximum allowable age ("freshness") for OCSP responses. The default value (-1) does
not enforce a maximum age, which means that OCSP responses are considered valid as long as their
nextUpdate eld is in the future.
• ssl-ocsp-response-time-skew
1642
Sys
Species the maximum allowable time skew in seconds for OCSP response validation. The default is
300 seconds.
• ssl-verify-client
Species if the client certicate needs to be veried for SSL session establishment. The default is no.
• ssl-verify-depth
Species maximum depth of CA certicates in client certicate verication. The default is 10.
See Also
edit, list, modify, show, tmsh
hypervisor-info
Used inside of a vCMP guest to display proposed conguration information passed in from the vCMP
hypervisor.
Syntax
Access the hypervisor-info component within the sys module using the syntax in the following sections.
Display
show hypervisor-info
field-fmt
Description
You can use the hypervisor-info component to display vCMP guest conguration information proposed
by the vCMP hypervisor. Note that this component will only display information when used from inside a
vCMP guest. On any other BIG-IP system, the show command will produce no output.
These values will override the default values for any of the corresponding conguration items inside the
guest:
Proposed Address - The management IP, as congured via tmsh sys management-ip on appliances and
via tmsh sys cluster on clusters.
Proposed Gateway - The default gateway, as congured via tmsh sys management-route.
Proposed Hostname - The hostname, as congured via tmsh sys global-settings.
Proposed Netmask - The management netmask. See "Proposed Address" above.
Examples
show hypervisor-info
Displays hypervisor conguration information in default units.
Options
For information about the options that you can use with the command show, see help show.
1643
Traffic Management Shell (tmsh) Reference Guide
See Also
show, tmsh
icmp-stat
Displays and resets ICMP statistics on the BIG-IP system.
Syntax
Congure the icmp-stat component within the sys module using the syntax in the following section.
Modify
reset-stats icmp-stat
Display
show icmp-stat
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the icmp-stat component to display and reset ICMP statistics. The statistics you can view are
standard ICMP statistics, including ICMPv4 packets and errors, and ICMPv6 packets and errors.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys icmp-stat, tmsh
icontrol-soap
Congures the iControl SOAP daemon for the BIG-IP(r) system.
Syntax
Congure the icontrol-soap component within the sys module using the following syntax.
Create/Modify
modify icontrol-soap
allow [add | delete | none |replace-all-with] {
1644
Sys
All or IP address ...
}
edit icontrol-soap
all-properties
non-default-properties
Display
list icontrol-soap
list icontrol-soap [option name]
show running-config icontrol-soap
show running-config icontrol-soap [option name]
all-properties
non-default-properties
one-line
Description
You can use the icontrol-soap component to congure the iControl SOAP for the system.
Important: F5 Networks recommends that users of the Conguration utility exit the utility before changes
are made to the system using the icontrol-soap component. This is because making changes to the system
using this component causes a restart of the icontrol-soap daemon. Additionally, restarting the icontrol-soap
daemon creates the necessity for a restart of the Conguration utility.
Examples
modify icontrol-soap allow replace-all-with {9.9.9.9}
Reduces the allowed IP address that can access iControl SOAP to 9.9.9.9
Options
• allow
Congures IP addresses for iControl SOAP clients from which the icontrol-soap daemon accepts
requests. The value may be either a full IP address or a Perl Compatible Regular Expression to allow
connections from a specic subnet. The default value is All.
Warning: Using the value none resets the icontrol-soap daemon to allow all iControl SOAP clients
access to the system; therefore, F5 Networks recommends that you do not use the value none.
See Also
edit, list, modify, show, tmsh
ip-address
Displays the IP addresses currently associated with a conguration object on a BIG-IP(r) system.
1645
Traffic Management Shell (tmsh) Reference Guide
Syntax
Display the IP addresses associated with a BIG-IP system conguration object using the syntax in the
following section.
Display
show ip-address
[all-properties | field-fmt]
Description
You can use the ip-address component to display the location on the BIG-IP system of the IP addresses
associated with a conguration object. The system displays the following information:
• Entry
Displays the IP address and any associated conguration. For example, for a Local Trafc Manager
pool member, the entry is the member's IP address and port number, 10.1.1.1:80.
• Component
Displays the type of component associated with the IP address. For example, for a Local Trafc Manager
pool, the entry is ltm pool.
• Object-ID
Displays the name of a conguration object associated with the IP address. For example, for a Local
Trafc Manager pool named my_pool, the entry is my_pool.
• Property
When you specify the all-properties option, displays the name of the property that contains the IP
address value. Note that if the IP address is an object identier the system displays n/a.
Examples
show ip-address
Displays the IP addresses currently associated with a BIG-IP system conguration object.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
ip-stat
Displays and resets IP statistics on the BIG-IP system.
Syntax
Congure the ip-stat component within the sys module using the syntax in the following section.
1646
Sys
Modify
reset-stats ip-stat
Display
show ip-stat
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the ip-stat component to display and reset IP statistics. The statistics you can view are standard
IP statistics, including IPv4 and IPv6 packets, fragments, fragments reassembled, and errors.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys ip-stat, tmsh
iprep-status
Displays the status of an IP reputation database. In the BIG-IP(R) Conguration Utility, this database is
referred to as the IP Address Intelligence database.
Syntax
Display information about the iprep-status component within the sys module using the following syntax.
Display
show iprep-status
current-module
field-fmt
running-config
Description
You can use the iprep-status component to display status information about the IP reputation database.
The reputation database (referred to as IP Address Intelligence in the Cong Utility) is available from
third-party vendors. An IP intelligence database is a list of IP addresses that have a questionable reputation.
The status information returned includes:
- the date and time that the BIG-IP system last contacted the vendor server
- the date and time that the BIG-IP system last received an update
1647
Traffic Management Shell (tmsh) Reference Guide
- the total number of IP address in the database
- the number of IP addresses in the most recent update
Note: When the system has an IP Intelligence license and the database variable db iprep.autoupdate is
enabled (default), the database is automatically downloaded and stored in the binary le:
/var/IpRep/F5IpRep.dat
The database contains information that maps IP addresses or ranges of IP addresses to one or more reputation
categories. After every update, the IpRep data le is loaded from disk into the running conguration.
Examples
show iprep-status
Displays current status information for the IP reputation database.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
license
Manage the BIG-IP(r) system licensing information.
Syntax
Manage the license component within the sys module using the syntax in the following section.
Install
install license
add-on-keys { [key] ...}
license-server [ [host name] | [IP address] ]
license-server-port [number]
registration-key [key]
show-difference
verbose
Display
show license
detail
Description
You can use the license component to do the following:
1648
Sys
Display detailed licensing and version information for the system, including the registration key, licensing
dates, platform ID, suggested service check date, and the installed active modules.
Install and update the system license.
Examples
show license
Displays the system software licensing information.
show license detail
Displays the system software licensing information, including optional modules and active features.
install license
Reactivate an existing license.
Options
• add-on-keys
Species additional feature modules to be included in the license. If add-on keys are not specied the
system will use the add-on keys in the current license le.
• license-server
Species the host name or IP address of the license server. The default value is 65.61.115.202
(activate.f5.com).
• license-server-port
Species the IP port of the license server. The default value is 443.
• registration-key
Species the license registration key. If the registration key is not specied the system will use the
registration key in the current license le.
• show-difference
Displays a comparison between the existing license and the pending license, and prompts to allow the
user to keep the existing license or install the pending license.
• verbose
Display status as the license is being installed.
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
log
Displays various system log les.
Syntax
Congure the log component within the sys module using the syntax in the following sections.
1649
Traffic Management Shell (tmsh) Reference Guide
Display
show log
show log [audit | daemon | gtm | kernel | ltm | mail | messages |
security | tmm | user | webui]
lines [integer]
range [date range]
Description
You can use the log component to display various logs.
Examples
show log
Displays a list of logs that you can view.
show log gtm
Displays the Global Trafc Manager log.
show log gtm lines 100 range 2/19/2006:15:04:00--epoch
Displays no more than 100 lines of the Global Trafc Manager log that were logged before the 19th of
February 2006 at 3:04 pm.
Options
• audit
Displays a log of conguration changes.
• daemon
Displays the Unix daemon logs.
• gtm
Displays the Global Trafc Manager logs.
• kernel
Displays Linux Kernel messages.
• lines
Species how many lines of the log that you want the system to display at one time.
• ltm
Displays Local Trafc Manager logs.
• mail
Displays mail daemon logs.
• messages
Displays application messages.
• range
Species the date range of the log information that you want the system to display.
• security
Displays security-related messages.
1650
Sys
• tmm
Displays Trafc Manager Micro-kernel logs.
• user
Displays various user process logs.
• webui
Displays Conguration utility logs.
See Also
show, tmsh
log-rotate
Congures log rotation for the BIG-IP(r) system.
Syntax
Congure the log-rotate component within the sys module using the syntax in the following sections.
Modify
modify log-rotate
common-backlogs [integer]
common-include [string]
description [string]
include [string]
max-file-size [integer]
mysql-include [string]
syslog-include [string]
tomcat-include [string]
wa-include [string]
edit log-rotate
all-properties
non-default-properties
Display
list log-rotate
list log-rotate [option]
show running-config log-rotate
show running-config log-rotate [option]
all-properties
non-default-properties
one-line
Description
You can congure the system to rotate the log les after a specied length of time. This helps to clear the
hard drive of unneeded log les.
1651
Traffic Management Shell (tmsh) Reference Guide
Examples
modify log-rotate common-backlogs 7
Species that the system saves seven copies of the common log les.
list log-rotate all-properties
Displays the conguration of the log-rotate component.
Options
• common-backlogs
Species the number of logs that you want the system to save. Select a number from the valid range of
1 - 100. The default value is 24.
• common-include
The default value is none.
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the common-include option
incorrectly, you put the functionality of the system at risk.
• description
User dened description.
• include
The default value is none.
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the include option incorrectly, you
put the functionality of the system at risk.
• max-le-size
The max size of rotated log les in kB. The default value is 1024000.
• syslog-include
The default value is none.
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the syslog-include option incorrectly,
you put the functionality of the system at risk.
• tomcat-include
The default value is none.
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the tomcat-include option incorrectly,
you put the functionality of the system at risk.
• wa-include
The default value is none.
1652
Sys
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using this option. If you use the wa-include option incorrectly,
you put the functionality of the system at risk.
See Also
edit, list, modify, show, tmsh
mac-address
Displays all MAC addresses currently associated with a conguration object on a BIG-IP(r) system, including
all dynamically-discovered MAC addresses.
Syntax
Display the MAC addresses associated with a BIG-IP system conguration using the syntax in the following
section.
Display
show mac-address
field-fmt
Description
You can use the mac-address component to display the location on the BIG-IP system of the MAC addresses
associated with a conguration object. The system displays the following information, which identies the
location of the MAC address in the conguration.
• Entry
Displays the MAC address.
• Component
Displays the type of component associated with the MAC address, for example, net interface.
• Object-ID
Displays the name of a conguration object associated with the MAC address, for example, 2.1.
• Property
Displays the name of the property that contains the MAC address value. Note that if the MAC address
is an object identier the system displays n/a.
Examples
show mac-address
Displays all MAC addresses currently associated with a BIG-IP system conguration object.
Options
For information about the options that you can use with the command show, see help show.
1653
Traffic Management Shell (tmsh) Reference Guide
See Also
show, tmsh
management-dhcp
Congures dhcp settings for the management interface (MGMT).
Syntax
Congure the management-dhcp component within the sys module using the syntax in the following
sections.
Modify
modify management-dhcp [name]
client-id [string]
description [string]
hostname [string]
request-options [add | delete | modify | replace-all-with]
send-options [add | delete | modify | replace-all-with]
edit management-dhcp [name]
all-properties
Display
list management-dhcp
list management-dhcp [name]
show running-config sys management-dhcp
show running-config sys management-dhcp [name]
all-properties
one-line
Description
Species DHCP client settings for the management interface. These settings will be used to retrieve an IP
address for the management interface if mgmt-dhcp is enabled.
Examples
modify management-dhcp default request-options add ntp-servers
Adds ntp-servers to the lists of options requested by the management interface DHCP client.
Options
• client-id
Species the client identier to send to the DHCP server.
• description
User dened description.
1654
Sys
• hostname
Species the hostname to send to the DHCP server.
• request-options
Species the options to request from the DHCP server.
• send-options
Species the options to send to the DHCP server.
See Also
edit, list, modify, show, sys management-ip, sys management-route, tmsh
management-ip
Congures the ip address and netmask for the management interface (MGMT).
Syntax
Congure the management-ip component within the sys module using the syntax in the following sections.
Create/Modify
create management-ip [ip address/netmask]
create management-ip [ip address/prefixlen]
modify management-ip [ip address/prefixlen]
description
Display
list management-ip
show running-config management-ip
all-properties
one-line
Delete
delete management-ip [ip address/netmask]
delete management-ip [ip address/prefixlen]
Description
Species network settings for the management interface.
The management interface is available on all switch platforms and is designed for management purposes.
You can access the browser-based Conguration utility and command line conguration utility through the
management port. You cannot use the management interface in trafc management VLANs. You can
congure only one IP address on the management interface.
After you make any changes using the management-ip component, issue the following command sequence
to save the changes to the bigip_base.conf le: save sys cong.
1655
Traffic Management Shell (tmsh) Reference Guide
To congure management-ip rewall rules, see security rewall management-ip-rules.
Note: modify only allows modication of the description eld. If you wish to change the IP address of the
management interface, please see the example below.
Examples
create management-ip 10.2.3.4/255.255.0.0
Creates the IP address 10.2.3.4 on the management interface.
create management-ip 10.2.3.4/16
Creates the IP address 10.2.3.4 on the management interface.
delete sys management-ip 10.2.3.4/25; create sys management-ip 10.2.3.5/25
Changes the IP address of the management interface. Note: modify does not allow a user to change the IP
address directly.
Options
• [ip address/netmask]
Species the IPv4 address and netmask.
• [ip address/prexlen]
Species the IPv6 address and prex length.
• description
User dened description.
• dhcp-enabled
Species if the ip address has been congured by DHCP.
See Also
create, delete, list, modify, save, show, security rewall management-ip-rules, sys management-route, tmsh
management-ovsdb
Congures the OVSDB server.
Syntax
Congure the management-ovsdb component within the sys module using the syntax in the following
sections.
Modify
modify management-ovsdb
ca-cert-file [filename]
cert-file [filename]
cert-key-file [filename]
controller-addresses [IP address(es)]
description [string]
disabled
1656
Sys
enabled
log-level [level]
port [port number]
tunnel-local-address [IP address]
Display
list management-ovsdb
show running-config management-ovsdb
all-properties
one-line
ca-cert-file
cert-file
cert-key-file
controller-addresses
description
disabled
enabled
log-level
port
tunnel-local-address
Description
Species the congurations for the OVSDB server.
Examples
modify management-ovsdb controller-addresses add { 10.0.0.1 }
Species 10.0.0.1 as the controller address.
list management-ovsdb all-properties
Displays the OVSDB server congurations.
Options
• ca-cert-le
Species the name of the CA certicate le.
• cert-le
Species the name of the certicate le.
• cert-key-le
Species the name of the certicate key le.
• controller-addresses
Species the IP address(es) of the controller.
• disabled
Disables OVSDB management.
• enabled
Enables OVSDB management.
• log-level
Species the log level for OVSDB management. The log le is located at /var/tmp/vxland.out.
• port
1657
Traffic Management Shell (tmsh) Reference Guide
Species the OVSDB connection port.
• tunnel-local-address
Species the local endpoint address for the tunnels created by the controller. A valid IP address for the
tunnel local endpoint is required when OVSDB management is enabled.
• description
User dened description.
See Also
list, modify, save, show, tmsh
management-route
Congures route settings for the management interface (MGMT).
Syntax
Congure the management-route component within the sys module using the syntax in the following
sections.
Create/Modify
create management-route [name | default | default-inet6]
modify management-route [name | default | default-inet6]
description [string]
gateway [ip address]
mtu [number]
network [ip address/netmask]
edit management-route [ [ [name | default | default-inet6]
| [glob] | [regex] ] ... ]
all-properties
Display
list management-route
list management-route [ [ [name | default | default-inet6]
| [glob] | [regex] ] ... ]
show running-config management-route
show running-config management-route [ [ [name | default
| default-inet6] | [glob] | [regex] ] ... ]
all-properties
one-line
Delete
delete management-route [name]
1658
Sys
Description
Species route settings for the management interface. You must congure a route on the management
interface if you want to access the management network on the BIG-IP(r) system by connecting from another
network.
The management interface is available on all switch platforms and is designed for management purposes.
You can access the browser-based Conguration utility and command line conguration utility through the
management port. You cannot use the management interface in trafc management VLANs.
Examples
create management-route default gateway 10.10.10.254
Sets the management interface default gateway IP address to 10.10.10.254.
create management-route myMgmtRoute network 10.10.10.0/24 gateway 10.10.10.254
Creates a management route named myMgmtRoute for the subnet 10.10.10.0/24 whose gateway IP address
is 10.10.10.254.
modify management-route 10.10.10.0/24 gateway 172.24.74.62
Changes the management interface to subnet 10.10.10.0/24, and the gateway to 172.24.74.62.
Options
• default
Species that the system forwards packets to the destination through the default IP address and netmask,
0.0.0.0 0.0.0.0.
• default-inet6
Species that the system forwards packets to the destination through the default version 6.0 IP address
and netmask.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• [ip address/netmask]
Species the IP address and netmask through which the system forwards packets to the destination. You
can use either of these formats: 0.0.0.0/0 or 0.0.0.0 0.0.0.0.
• gateway
Species that the system forwards packets to the destination through the gateway with the specied IP
address.
• mtu
Species the maximum transmission unit (MTU) for the management interface. The value of the MTU
is the largest size that the BIG-IP system allows for an IP datagram passing through the management
interface.
• network
The subnet and netmask to be used for the route. This is an optional eld; if empty the name should be
of the form [ip address/netmask].
• regex
1659
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, edit, glob, list, modify, regex, show, sys management-ip, tmsh
mcp-state
Displays information about the mcpd daemon.
Syntax
Display information about the mcpd daemon using mcp-state component within the sys module using the
syntax in the following section.
Display
show mcp-state
field-fmt
Description
You can use the mcp-state component to display the current state of the mcpd daemon.
Examples
show mcp-state
Displays, in a table, information about the state of the mcpd daemon.
show mcp-state eld-fmt
Displays, in eld format, information about the state of the mcpd daemon.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
memory
Displays system memory information and statistics.
Syntax
Congure the memory component within the sys module using the syntax in the following sections.
1660
Sys
Display
show memory
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the memory component to display information about the system memory.
Examples
show memory gig
Displays memory statistics in gigabytes.
show memory raw
Displays raw memory statistics.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
ntp
Congures the Network Time Protocol (NTP) daemon for the BIG-IP(r) system.
Syntax
Congure the ntp component within the sys module using the following syntax.
Modify
modify ntp
description [string]
include [string]
restrict [add | delete | replace-all-with] {
[string] {
address [IP address]
default-entry [enabled | disable]
description [string]
ignore [enabled | disable]
kod [enabled | disable]
limited [enabled | disable]
low-priority-trap [enabled | disable]
mask [IP address]
no-modify [enabled | disable]
non-ntp-port [enabled | disable]
no-peer [enabled | disable]
no-query [enabled | disable]
no-serve-packets [enabled | disable]
1661
Traffic Management Shell (tmsh) Reference Guide
no-trap [enabled | disable]
no-trust [enabled | disable]
ntp-port [enabled | disable]
version [enabled | disable]
}
}
restrict none
servers [add | delete | replace-all-with] {
[hostname | IP address] ...
}
servers none
timezone [string]
edit ntp
all-properties
non-default-properties
Display
list ntp
list ntp [option]
show running-config ntp
show running-config ntp [option]
all-properties
non-default-properties
one-line
Description
You can use this component to congure the NTP servers for the system.
Examples
modify ntp servers add {192.168.1.245}
Adds the NTP server with the IP address, 192.168.1.245, to the system.
modify ntp servers replace-all-with {time.f5net.com}
Replaces the existing list of NTP servers with a single host, time.f5net.com.
modify ntp timezone "America/Los_Angeles"
Sets the system time to Pacic Standard Time.
modify ntp restrict add { basicrestrict { default-entry enable ignore enable } }
Adds a default restriction denying all packets.
Options
• description
User dened description.
• include
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using the include option. If you use this option incorrectly, you
put the functionality of the system at risk.
1662
Sys
• restrict
Species a set of access restrictions.
• address
The address for the entry. See also, the mask option. The default value is 0.0.0.0.
• default-entry
Species whether the entry is the default entry. The default value is disabled.
• description
User dened description.
• ignore
Species whether all packets will be ignored. The default value is disabled.
• kod
Species whether a kod (kiss of death) packet will be sent when an access violation occurs. The
default value is disabled.
• limited
Species whether service will be denied if packet spacing limits are violated. The default value is
disabled.
• low-priority-trap
Species whether lower priority traps will be overridden by normal priority traps. The default value
is disabled.
• mask
The mask for the entry. See also, the address option. The default value is 0.0.0.0.
• no-modify
Species whether ntpq and ntpdc queries that attempt to modify the server are allowed. The default
value is disabled.
• non-ntp-port
When enabled, the restrict entry will be matched only if the source port is not the standard NTP UDP
port (123). The default value is disabled.
• no-peer
Species whether packets will be denied if they mobilize a new association. The default value is
disabled.
• no-query
Species whether ntpq and ntpdc queries will be denied. The default value is disabled.
• no-serve-packets
Species whether all queries except ntpq and ntpdc will be denied. The default value is disabled.
• no-trap
Species whether to decline the mode 6 control message trap service to matching hosts. The default
value is disabled.
• no-trust
Species whether to reject packets that are not cryptographically authenticated. The default value
is disabled.
• ntp-port
1663
Traffic Management Shell (tmsh) Reference Guide
When enabled, the restrict entry will be matched only if the source port is the standard NTP UDP
port (123). The default value is disabled.
• version
Species whether packets will be rejected if they do not match the local NTP version. The default
values is disabled.
• servers
Congures NTP servers for the BIG-IP system.
• timezone
Species the time zone that you want to use for the system time.
See Also
edit, list, modify, show, tmsh
outbound-smtp
Congures outgoing email for the BIG-IP(r) system.
Syntax
Congure the outbound-smtp component within the sys module using the following syntax.
Modify
modify outbound-smtp
description [string]
mailhub [string]
edit outbound-smtp
all-properties
non-default-properties
Display
list outbound-smtp
list outbound-smtp [option]
show running-config outbound-smtp
show running-config outbound-smtp [option]
all-properties
non-default-properties
one-line
Description
You can use this component to congure the outgoing SMTP server that the system will use to send automated
email.
1664
Sys
Examples
modify outbound-smtp mailhub smtp.yoursite.com:587
Congures the TMOS system to send outgoing email through the specied SMTP server.
Options
• description
User dened description.
• mailhub
The SMTP server to use to send outgoing automated email.
See Also
edit, list, modify, tmsh
proc-info
Display CPU and memory usage for each process.
Syntax
Display proc-info component within the sys module using the syntax in the following section.
Display
show proc-info
show proc-info process_name
(default | field-fmt | all | kil | meg | gig | raw | exa | peta | tera |
zetta | yotta)
Description
Show proc-info displays CPU and memory usage for each process and the process associated module name.
This can be used to debug which process or module uses more resource.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
provision
Congures provisioning on the BIG-IP(r) system.
1665
Traffic Management Shell (tmsh) Reference Guide
Syntax
Congure the provision component within the sys module using the syntax in the following sections.
Modify
modify provision [afm | am | apm | asm | avr | fps | gtm | ilx | lc |
ltm | pem | swg | vcmp]
cpu-ratio [integer]
disk-ratio [integer]
level [custom | dedicated | minimum | nominal | none]
memory-ratio [integer]
edit provision
[ [ [afm | am | apm | asm | avr | fps | gtm | ilx | lc | ltm | pem |
swg | vcmp] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list provision
[ [ [afm | am | apm | asm | avr | fps | gtm | ilx | lc | ltm | pem |
swg | vcmp] | [glob] | [regex] ] ... ]
show running-config provision
[ [ [afm | am | apm | asm | avr | fps | gtm | ilx | lc | ltm | pem |
swg | vcmp] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Description
You can use the provision component to modify the allocation of resources to the licensed modules on your
system.
Examples
• modify provision asm level minimum
Provisions the minimum amount of resources for the BIG-IP Application Security Manager.
• list provision
Displays the current provisioning of the system.
• Using Transactions
• create / cli transaction
• modify / sys provision ltm level minimum
• modify / sys provision gtm level nominal
• submit / cli transaction
The previous four steps create a transaction to modify the provisioning of a unit to provision the Local
Trafc Manager at the minimum level and the Global Trafc Manager at the nominal level.
• create / cli transaction
• modify / sys provision ltm level none
1666
Sys
• modify / sys provision gtm level dedicated
• submit / cli transaction
Options
• afm
Species that you are provisioning the BIG-IP Advanced Firewall Manager. When the Advanced Firewall
Manager is provisioned, the tmsh module security is enabled.
• am
Species that you are provisioning the BIG-IP Acceleration Manager. When the Acceleration Manager
is provisioned, the tmsh module wam is enabled and more tmsh components under wom are available.
• apm
Species that you are provisioning the BIG-IP Access Policy Manager. When the Access Policy Manager
is provisioned, the tmsh module apm is enabled.
• asm
Species that you are provisioning the BIG-IP Application Security Manager. When asm is provisioned
the tmsh module asm is enabled.
• avr
Species that you are provisioning the BIG-IP Application Visibility and Reporting. When Application
Visibility and Reporting is provisioned the tmsh module analytics is enabled.
• cpu-ratio
Use this option only when the level option is set to custom. F5 Networks recommends that you do not
modify this option. The default value is none.
• disk-ratio
Use this option only when the level option is set to custom. F5 Networks recommends that you do not
modify this option. The default value is none.
• fps
Species that you are provisioning the BIG-IP Fraud Protection Service. When fps is provisioned the
tmsh module fps is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• gtm
Species that you are provisioning the BIG-IP Global Trafc Manager. When gtm is provisioned the
tmsh module gtm is enabled.
• ilx
Species that you are provisioning BIG-IP iRules Language Extensions.
• lc
Species that you are provisioning the BIG-IP Link Controller. When Link Controller is provisioned
the tmsh module gtm is enabled.
• level
Species the level of resources that you want to provision for a module. The options are:
• custom
1667
Traffic Management Shell (tmsh) Reference Guide
F5 Networks does not recommend that you specify this level.
• dedicated
Species that all resources are dedicated to the module you are provisioning. For all other modules,
the level option must be set to none.
• minimum
Species that you want to provision the minimum amount of resources for the module you are
provisioning.
• nominal
Species that you want to share all of the available resources equally among all of the modules that
are licensed on the unit.
• none
Species that you do not want to provision any resources for this module.
• ltm
Species that you are provisioning the BIG-IP Local Trafc Manager.
• memory-ratio
Use this option only when the level option is set to custom. F5 Networks recommends that you do not
modify this option. The default value is none.
• pem
Species that you are provisioning the BIG-IP Policy Enforcement Manager. When Policy Enforcement
Manager is provisioned the tmsh module pem is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• swg
Species that you are provisioning the BIG-IP Secure Web Gateway. When Secure Web Gateway is
provisioned the tmsh components apm url-lter and apm swg-scheme are enabled.
• vcmp
Species that you are provisioning the BIG-IP Virtual CMP. When Virtual CMP is provisioned the
tmsh module vcmp is enabled.
See Also
edit, glob, list, modify, regex, show, tmsh
pva-traffic
Displays and resets Packet Velocity(r) ASIC (PVA) trafc statistics for the system.
Syntax
Congure the pva-trafc component within the sys module using the following syntax.
1668
Sys
Modify
reset-stats pva-traffic
Display
show pva-traffic
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the pva-trafc component to display trafc statistics, including bits in and out, packets in and
out, current, maximum, and total connections, and other miscellaneous statistics.
The BIG-IP(r) system has one PVA accelerator; however, when you run the command show pva-trafc,
the system displays a PVA statistics entry for each Trafc Management Microkernel (TMM).
Examples
show pva-trafc
Displays PVA trafc statistics for the system.
show pva-trafc raw
Displays PVA trafc statistics for the system in raw data form.
Options
For information about the options that you can use with the command show, see help show.
For information about the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys tmm-trafc, sys trafc, tmsh
scriptd
Congure the scriptd daemon
Syntax
Congure the scriptd daemon within the sys module using the syntax in the following sections.
Modify
modify scriptd
log-level [alert | crit | debug | emerg | err | info | notice | warn]
max-script-run-time [seconds]
1669
Traffic Management Shell (tmsh) Reference Guide
Display
list scriptd
show running-config scriptd
all-properties
Description
You can use the scriptd component to congure the scriptd daemon. The scriptd daemon runs app application
template implementation scripts when an application service is created or updated (see sys application
template and sys application service).
Examples
list scriptd
Displays scriptd conguration.
modify scriptd max-script-run-time 120
Updates the maximum time, in seconds, that a script is allowed to run.
Options
• log-level
Species the syslog level at which scriptd will generate log messages.
• max-script-run-time
Species, in seconds, the maximum amount of time that a script is allowed to run before scriptd will
kill the script. The default value is 300. The minimum value is 5.
See Also
list, modify, show, sys application template, sys application service, tmsh
service
Manages services on the BIG-IP(r) system.
Syntax
Congure the service component within the sys module using the syntax in the following sections.
Modify
modify service [name]
[add | disable | enable | reinit | remove]
restart service [name]
start service [name]
1670
Sys
stop service [name]
force
Display
list service
list service [name]
show running-config service
show running-config service [name]
all-properties
show service
memstat
Description
You can use the service component to add, disable or enable, start, stop, restart, reinitialize, remove, or
display information about a service.
Note that the tmsh connection to mcpd will be dropped if you stop or restart the mcpd service. The next
tmsh command will prompt you to try again. Alternatively you can quit tmsh and login again.
Examples
list service
Displays information about the services available on the BIG-IP system.
restart service mcpd
Restarts the mcpd daemon.
Options
• add
Adds the specied service.
• disable
Disables the specied service.
• enable
Enables the specied service.
• memstat
Displays memory usage statistics for the specied service.
• reinit
Reinitializes the specied service.
• remove
Removes the specied service.
See Also
list, modify, restart, show, start, stop, tmsh
1671
Traffic Management Shell (tmsh) Reference Guide
smtp-server
Congure the SMTP server connection.
Syntax
Create or modify an SMTP server access conguration using the syntax in the following sections.
Create / Modify
modify smtp-server [name]
create smtp-server [name]
app-service [[string] | none]
[authentication-enabled | authentication-disabled]
encrypted-connection [none | tls | ssl]
local-host-name [string]
smtp-server-host-name [string]
smtp-server-port [integer]
from-address [string]
username [string]
password [string]
Display
list smtp-server
show running-config smtp-server
all-properties
Description
You can use the smtp-server component to congure an SMTP server connection.
Examples
list smtp-server
Displays the SMTP conguration.
modify smtp-server smtp1 authentication-enabled encrypted-connection ssl local-host-name
user password pass
Congures SMTP server connection with username=user and password=pass to be authenticated against
the SMTP server mail.server.com. SSL encryption will be used for all communication with the SMTP
server. Email messages will be sent out with the address [email protected] in the "Reply-To" address.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• [authentication-enabled | authentication-disabled]
Enables or disables authentication against the congured SMTP server.
1672
Sys
• encrypted-connection
Species which type of encrypted connection the SMTP server requires in order to send mail. The default
value is none.
• local-host-name
Species the host name used in SMTP headers in the format of a fully qualied domain name. This
setting does not refer to the BIG-IP system's Hostname.
• smtp-server-host-name
Species the SMTP server host name in the format of a fully qualied domain name.
• smtp-server-port
Species the SMTP port number. The default value is 25.
• from-address
Species the email address that the email is being sent from. This is the "Reply-to" address that the
recipient sees.
• username
Species the user name that the SMTP server requires when validating a user.
• password
Species the password that the SMTP server requires when validating a user. This password is stored
in an encrypted form.
See Also
list, create, modify, show, tmsh
snmp
Congures the simple network management protocol (SNMP) daemon for the BIG-IP(r) system.
Syntax
Congure the snmp component within the sys module using the following syntax.
Modify
modify snmp
agent-addresses [add | delete | replace-all-with] {
["agent:port"] ...
}
agent-addresses none
agent-trap [enabled | disabled]
allowed-addresses [add | delete | replace-all-with] {
[IP address]
}
allowed-addresses none
auth-trap [enabled | disabled]
bigip-traps [enabled | disabled]
communities [add | delete | modify | replace-all-with] {
[name] {
access [ro | rw]
community-name [string]
1673
Traffic Management Shell (tmsh) Reference Guide
description [string]
ipv6 [enabled | disabled]
oid-subset [string]
source [ default | [string] ]
}
}
communities none
description [string]
disk-monitors [add | delete | modify | replace-all-with] {
[name] {
description [string]
minspace [integer]
minspace-type [percent | size]
path [string]
}
}
disk-monitors none
include [string]
l2forward-vlan [all | add | delete | replace-all-with] {
[VLAN name] ...
}
l2forward-vlan none
load-max1 [integer]
load-max5 [integer]
load-max15 [integer]
process-monitors [add | delete | modify | replace-all-with] {
[name] {
description [string]
process [string]
min-processes [integer]
max-processes [ [integer] | infinity ]
}
}
process-monitors none
sys-contact [string]
sys-location [string]
sys-services [integer]
trap-community [string]
trap-source [IP address]
traps [add | delete | modify | replace-all-with] {
[name] {
auth-password [string]
auth-protocol [md5 | sha | none]
community [string]
description [string]
engine-id [ [number] | none ]
host [ [ip address] | [FQDN] | [ [protocol]:[ip address] ] |
[ [protocol]:[FQDN] ] ]
port [integer]
privacy-password [string]
privacy-protocol [aes | des | none]
security-level [auth-no-privacy | auth-privacy | no-auth-no-privacy]
security-name [string]
version [1 | 2c | 3]
}
}
traps none
users [add | delete | modify | replace-all-with] {
[user name] {
access [ro | rw]
auth-password [string]
auth-protocol [md5 | sha | none]
description [string]
oid-subset [string]
privacy-password [string]
privacy-protocol [aes | des | none]
security-level [auth-no-privacy | auth-privacy | no-auth-no-privacy]
username [string]
}
1674
Sys
}
users none
v1-traps [add | delete | modify | replace-all-with] {
[name] {
community [string]
description [string]
host [ [ip address] | [FQDN] | [ [protocol]:[ip address] ] |
[ [protocol]:[FQDN] ] ]
port [integer]
}
}
v1-traps none
v2-traps [add | delete | modify | replace-all-with] {
[name] {
community [string]
description [string]
host [ [ip address] | [FQDN] | [ [protocol]:[ip address] ] |
[ [protocol]:[FQDN] ] ]
port [integer]
}
}
v2-traps none
edit snmp
all-properties
non-default-properties
Display
list snmp
list snmp [option]
show running-config snmp
show running-config snmp [option]
all-properties
non-default-properties
one-line
Description
You can use the snmp component to congure the snmpd daemon for the BIG-IP system.
Important: F5 Networks recommends that users of the Conguration utility exit the utility before changes
are made to the system using the command sequence tmsh sys snmp. This is because making changes to
the system using this command causes a restart of the snmpd daemon. Likewise, restarting the snmpd
daemon creates the necessity for a restart of the Conguration utility.
Examples
modify snmp sys-contact admin@company.com
Modies the conguration to indicate that the person who administers the snmpd daemon for the system
can be reached using the email address, admin@company.com.
modify snmp sys-location "central ofce"
Modies the conguration to indicate that the physical location of the system is the central ofce.
modify snmp agent-trap disabled
Disables agent traps.
1675
Traffic Management Shell (tmsh) Reference Guide
modify snmp allowed-addresses add {10.10.0.0/255.255.240.0}
Adds a range of SNMP clients to the /etc/hosts.allow le.
modify snmp traps add { tv1 { version 1 community public host 192.168.1.240 port 162 } }
Adds an SNMP version 1 trapsess, tv1, to the system. The destination IP address of tv1 is 192.168.1.240,
the port is 162, and the community that has access to tv1 is public. The default port is 162.
modify snmp traps add { tv2 {version 2c community public host 192.168.1.241 port 162} }
Adds an SNMP version 2 trapsess, tv2, to the system. The destination IP address of tv2 is 192.168.1.241,
the port is 162, and the community that has access to tv2 is public. The default port is 162. The default
version is 2c (version 2).
modify snmp traps add { trap_v3_1 { version 3 host 192.168.1.242 port 162 security-level
auth-no-privacy security-name mySecurityName auth-protocol md5 auth-password myAuthPassword
} }
Adds an SNMP version 3 trapsess, trap_v3_1, with authentication capabilities to the system. The destination
IP address of trap_v3_1 is 192.168.1.242, the port is 162, the security level is the authentication without
privacy, the security name is mySecurityName, the authentication protocol is MD5, and the authentication
password is myAuthPassword. The default port is 162.
modify snmp traps add { trap_v3_2 { version 3 host 192.168.1.243 port 162 security-level auth-privacy
security-name mySecurityName auth-protocol sha auth-password myAuthPassword privacy-protocol
aes privacy-password myPrivacyPassword } }
Adds an SNMP version 3 trapsess, trap_v3_2, with authentication and privacy capabilities to the system.
The destination IP address of trap_v3_2 is 192.168.1.243, the port is 162, the security level is the
authentication and privacy, the security name is mySecurityName, the authentication protocol is SHA, the
authentication password is myAuthPassword, the privacy protocol is AES, and the privacy password is
myPrivacyPassword. The default port is 162.
modify snmp v1-traps add { ts { community public host 10.20.5.11 port 162 } }
Adds an SNMP version 1 trapsink, ts, to the system. The destination IP address of ts is 10.20.5.11, the port
is 162, and the community that has access to ts is public. The default port is 162.
modify snmp v2-traps add { t2s { community public host 10.20.5.12 port 162 } }
Adds an SNMP version 2 trap2sink, t2s, to the system. The destination IP address of t2s is 10.20.5.12, the
port is 162, and the community that has access to t2s is public. The default port is 162.
modify snmp users add { myUser1 { username myUser1 access ro security-level auth-no-privacy
auth-protocol md5 auth-password myAuthPassword privacy-protocol none } }
Adds an SNMP version 3 user with the user name, myUser1, to the system. The access to the management
information base (MIB) of myUser1 is read-only, the security level is the authentication without privacy,
the authentication protocol is MD5, and the authentication password is myAuthPassword.
modify snmp users add { myUser2 { username myUser2 oid-subset .1.3.6.1.4.1.3375 auth-protocol
md5 auth-password myAuthPassword privacy-protocol none } }
Adds an SNMP version 3 user with the user name, myUser2, to the system. The access to the management
information base (MIB) of myUser2 is read-only (by default) and restricted to every object below
.1.3.6.1.4.1.3375 object identier in the MIB tree, the security level is the authentication without privacy,
the authentication protocol is MD5, and the authentication password is myAuthPassword.
modify snmp users add { myUser3 { username myUser3 access ro security-level auth-privacy
auth-protocol sha auth-password myAuthPassword privacy-protocol des privacy-password
myPrivacyPassword } }
Adds an SNMP version 3 user with the user name, myUser3, to the system. The access to the management
information base (MIB) of myUser3 is read-only, the security level is the authentication and privacy, the
1676
Sys
authentication protocol is SHA, the authentication password is myAuthPassword, the privacy protocol is
DES, and the privacy password is myPrivacyPassword.
modify snmp users add { myUser4 { username myUser4 access ro security-level no-auth-no-privacy
auth-protocol none privacy-protocol none } }
Adds an SNMP version 3 user with the user name, myUser4, to the system. The access to the management
information base (MIB) of myUser4 is read-only without the authentication and privacy settings.
modify snmp communities add { community1 { community-name mycommunity access ro source
192.168.1.246 oid-subset 5 ipv6 disabled } }
Creates a community specication named community1 for the BIG-IP system. community1 includes a
community, named mycommunity, that provides read-only access to the host at 192.168.1.246. This host
cannot be an IPv6 address. The oid for this community is 5.
modify snmp communities add { new-name { community-name public source default oid-subset 1
access ro } }
Replaces the default community specication for the BIG-IP system. Using this command, the default
community includes a community, named public, that provides read-only access to the default host. The
oid for this community is 1.
modify snmp communities delete { mycommunity }
Deletes the community named mycommunity.
modify snmp load-max1 0 load-max5 0 load-max15 0
Disables monitoring of snmpd load average on the BIG-IP system.
Options
• agent-addresses
Indicates that the SNMP agent is to listen on the specied address. F5 Networks recommends that you
do not change this setting without fully understanding the impact of the change.
• agent-trap
Species, when enabled, that the snmpd daemon sends traps, for example, start and stop traps. The
default value is enabled.
• allowed-addresses
Congures the IP addresses of the SNMP clients from which the snmpd daemon accepts requests. An
SNMP client is a system that runs the SNMP manager software for the purpose of remotely managing
the BIG-IP system. The default value is 127.
• auth-trap
Species, when enabled, that the snmpd daemon generates authentication failure traps. The default
value is disabled.
• bigip-traps
Species, when enabled, that the BIG-IP system sends device warning traps to the trap destinations.
The default value is enabled.
• community
Congures a community for the snmpd daemon. Note that you must include a community key, and you
must enclose the attributes in braces.
The options are additive and include:
• access
1677
Traffic Management Shell (tmsh) Reference Guide
Species the community access level to the MIB. The access options are ro (read-only) or rw
(read-write). The default value is ro.
• community name
Species the name of the community that you are conguring for the snmpd daemon. This option
is required. The default value is public.
• description
User dened description.
• ipv6
Species to enable or disable IPv6 addresses for the community that you are conguring. The default
value is disabled.
• oid-subset
Species to restrict access by the community to every object below the specied object identier
(OID).
• source
Species the source addresses with the specied community name that can access the management
information base (MIB). The default value is default, which means allow any source address to
access the MIB.
• description
User dened description.
• disk-monitors
Checks the disks mounted at the specied path for available disk space.
The options are:
• description
User dened description.
• minspace
Species the minimum disk space threshold in either kBs or percentage based on the value of the
minspace-type option. If the available disk space is less than this amount, the associated entry in
the 1.3.6.1.4.1.2021.9.1.100 MIB table is set to (1) and a descriptive error message is returned to
queries of 1.3.6.1.4.1.2021.9.1.101.
• minspace-type
Species a minimum disk space measurement type of either size in kB, or percent. Note that the
value of the minspace option is based on the value of this option.
• path
Species the path to the disk that the system checks for disk space. This option is required.
• include
Warning: Do not use this parameter without assistance from the F5 Technical Support team. The system
does not validate the commands issued using the include parameter. If you use this parameter incorrectly,
you put the functionality of the system at risk.
• l2forward-vlan
Species the VLANs for which you want the snmpd daemon to expose Layer 2 forwarding information.
Layer 2 forwarding is the means by which frames are exchanged directly between hosts, with no IP
routing required. The default value is none.
1678
Sys
The options are:
• all
The snmpd daemon exposes Layer 2 forwarding information for all VLANS.
Warning: When you set this option to all, the system can create a very large table of statistics and
potentially affect system performance.
• none
Indicates that this option is not set.
Important: The default is not the same as setting this option to the string "none," which indicates
that you do not want the snmpd daemon to expose Layer 2 forwarding for any VLAN.
• VLAN name
Species the names of the VLANs for which the snmpd daemon exposes Layer 2 forwarding
information. The snmpd daemon overwrites the value of the sysL2ForwardAttrVlan object identier
(OID) with the specied VLAN names. Once you set this parameter, users cannot change the value
of the sysL2ForwardAttrVlan OID using the SNMP set method.
• load-max1
Species the maximum 1-minute load average of the machine. If the load exceeds this threshold, the
associated entry in the 1.3.6.1.4.1.2021.10.1.100 MIB table is set to (1) and a descriptive error message
is returned to queries of 1.3.6.1.4.1.2021.10.1.101.
Note that when you specify a 0 (zero) for all three of the load-max1, load-max5, and load-max15
options, the system does not monitor the load average.
• load-max5
Species the maximum 5-minute load average of the machine. If the load exceeds this threshold, the
associated entry in the 1.3.6.1.4.1.2021.10.1.100 MIB table is set to (1) and a descriptive error message
is returned to queries of 1.3.6.1.4.1.2021.10.1.101.
Note that when you specify a 0 (zero) for all three of the load-max1, load-max5, and load-max15
options, the system does not monitor the load average.
• load-max15
Species the maximum 15-minute load average of the machine. If the load exceeds this threshold, the
associated entry in the 1.3.6.1.4.1.2021.10.1.100 MIB table is set to (1) and a descriptive error message
is returned to queries of 1.3.6.1.4.1.2021.10.1.101.
Note that when you specify a 0 (zero) for all three of the load-max1, load-max5, and load-max15
options, the system does not monitor the load average.
• process-monitors
Species to check the machine to determine if the specied process is running. An error ag (1) and a
description message are passed to the 1.3.6.1.4.1.2021.2.1.100 and 1.3.6.1.4.1.2021.2.1.101 MIB columns
(respectively) if the specied program is not found in the process table as reported by /bin/ps -e.
F5 Networks recommends that you do not modify or delete system processes; however, you can add,
modify, or delete user-dened processes.
The options are:
• description
User dened description.
• max-processes
1679
Traffic Management Shell (tmsh) Reference Guide
Species the maximum number of instances of the process that can run. The default value is 1.
If you do not specify values for the min-processes and max-processes options, the max-processes
option is 1 by default.
• min-processes
Species the minimum number of instances of the process that can run. The default value is 1.
If you do not specify a value for the max-processes option, and the min-processes option is not
specied, the min-processes option is 0 (zero) by default.
• process
Species the name of the monitored process. The maximum length for a process name is 16 characters.
This option is required.
• sys-contact
Species the name of the person who administers the snmpd daemon for this system. The default value
is "Customer Name<admin@customer.com".
Note: If you enter a string that contains spaces, you must enclose the string in quotation marks and use
back slashes to escape the quotation marks (for example, \"John Doe\").
• sys-location
Describes this system's physical location. The default value is Network Closet 1.
Note: If you enter a string that contains spaces, you must enclose the string in quotation marks and use
back slashes to escape the quotation marks (for example, \"Engineering Lab\").
• sys-services
Species the value of the system.sysServices.0 object. The default value is 78.
• trap-community
Species the community name for the trap destination. The default value is public.
• traps
Congures the SNMP version 1, version 2, or version 3 trap destination. Note that you must include a
trapsess key, and you must enclose the attributes in braces.
The options are additive and include:
• auth-password
Species the authentication password, which must be at least eight characters long. This option is
valid only for SNMP version 3. If you enter the authentication password, the value of the
auth-protocol option cannot be set to none.
• auth-protocol
Species the authentication method to use to deliver the trap message. The default value is none.
You can specify the following authentication methods:
• md5
The system uses the message digest algorithm (MD5) to authenticate the trap message. This value
is valid only for SNMP version 3.
• none
The system does not authenticate the trap message. Note that if you use this value, you cannot
use the auth-password option. This value is invalid for SNMP version 3.
1680
Sys
• sha
The system uses the secure hash algorithm (SHA) to authenticate the trap message. This option
is valid only for SNMP version 3.
• community
Species a community that has access to the trap message. This option is required for SNMP version
1 and version 2 only.
• description
User dened description.
• engine-id
Species the unique authoritative security engine ID. This option is valid only for SNMP version 3.
The default value is none. You can nd the engine ID generated by the SNMP agent at
/cong/net-snmp/snmpd.conf on the BIG-IP system. Note that it is identied as oldEngineID in this
le.
• host
Species the trap destination that you are conguring, the IP address, FQDN, or either of these with
an embedded protocol, for example tcp:10.10.10.1 or tcp:www.f5.com. Note that you must congure
the DNS Server on the BIG-IP system. You can use the command sys dns to do this. This option is
required.
• port
Species the port for the trap destination that you are conguring. The default value is 162.
• privacy-password
Species the privacy password, which must be at least eight characters long. This option is valid
only for SNMP version 3. If you enter the privacy password, the value of the privacy-protocol
option cannot be set to none.
• privacy-protocol
Species the encryption/privacy method to use to deliver the trap message. The default value is
none.
You can specify the following privacy methods:
• aes
The system encrypts the trap message using Advanced Encryption Standard (AES). This value
is valid only for SNMP version 3.
• des
The system encrypts the trap message using Data Encryption Standard (DES). This value is valid
only for SNMP version 3.
• none
The system does not encrypt the trap message. Note that if you use this value, you cannot use
the privacy-password option.
• security-level
Species the security level to use to deliver the trap message. The default value is no-auth-no-privacy.
You can specify the following security levels:
• no-auth-no-privacy
Provides no authentication and no encryption for the trap message. This value is invalid for SNMP
version 3.
1681
Traffic Management Shell (tmsh) Reference Guide
• auth-no-privacy
Provides the authentication without encryption for the trap message. Species to use the value
of the auth-protocol option, but not the value of the privacy-protocol option. Note that if you
use this option, the value of the auth-protocol option cannot be set to none, and you must
congure a value for the auth-password option. This value is valid only for SNMP version 3.
• auth-privacy
Provides the authentication and encryption for the trap message. Species to use the value of the
auth-protocol and privacy-protocol options. Note that if you use this option, the value of the
auth-protocol and privacy-protocol options cannot be set to none, and you must congure a
value for the auth-password and privacy-password options. This option is valid only for SNMP
version 3.
• security-name
Species the security name the system uses to handle SNMP version 3 trap message. The default
value is none. This option is required for SNMP version 3.
• version
Species the security model to use. The options are 1 (version 1), 2c (version 2), or 3 (version 3).
The default value is 2c.
• trap-source
Species the source of the SNMP trap. The default value is none.
• users
Congures the users for which you are setting an SNMP version 3 access. Note that you must include
a user key, and you must enclose the attributes in braces.
The options are additive and include:
• access
Species the user access level to the management information base (MIB). The access options are
ro (read-only) or rw (read-write). The default value is ro.
• auth-password
Species the authentication password, which must be at least eight characters long. If you enter the
authentication password, the value of the auth-protocol option cannot be set to none.
• auth-protocol
Species the authentication method to use to deliver the SNMP message. This option is required.
You can specify the following authentication methods:
• md5
The system uses the message digest algorithm (MD5) to authenticate the SNMP message.
• none
The system does not authenticate the SNMP message. Note that if you use this value, you should
set the security-level to no-auth-no-privacy and you cannot use the auth-password option.
• sha
The system uses the secure hash algorithm (SHA) to authenticate the SNMP message.
• description
User dened description.
• oid-subset
1682
Sys
Species to restrict access by the user to every object below the specied object identier (OID).
• privacy-password
Species the privacy password, which must be at least eight characters long. If you enter the privacy
password, the value of the privacy-protocol option cannot be set to none.
• privacy-protocol
Species the encryption/privacy method to use to deliver the SNMP message. This option is required.
You can specify the following encryption methods:
• aes
The system encrypts the SNMP message using Advanced Encryption Standard (AES).
• des
The system encrypts the SNMP message using Data Encryption Standard (DES).
• none
The system does not encrypt the SNMP message. Note that if you use this value, you cannot use
the privacy-password option.
• security-level
Species the security level to use to deliver the SNMP message.
You can specify the following security levels:
• no-auth-no-privacy
Provides no authentication and no encryption for the SNMP message.
• auth-no-privacy
Provides the authentication without encryption for the SNMP message. Species to use the value
of the auth-protocol option, but not the value of the privacy-protocol option. Note that if you
use this option, the value of the auth-protocol option cannot be set to none, and you must
congure a value for the auth-password option.
• auth-privacy
Provides the authentication and encryption for the SNMP message. Species to use the value of
the auth-protocol and privacy-protocol options. Note that if you use this option, the value of
the auth-protocol and privacy-protocol options cannot be set to none, and you must congure
a value for the auth-password and privacy-password options.
• username
Species the name of the user who is using SNMP version 3 to access the management information
base (MIB). This option is required.
• v1-traps
Congures an SNMP version 1 trap destination. Note that you must include a version 1 trapsink key,
and you must enclose the attributes in braces.
The options are additive and include:
• community
Species the community name for the trap destination that you are conguring. This option is
required.
• description
User dened description.
1683
Traffic Management Shell (tmsh) Reference Guide
• host
Species the trap destination that you are conguring, the IP address, FQDN, or either of these with
an embedded protocol, for example tcp:10.10.10.1 or tcp:www.f5.com. Note that you must congure
the DNS Server on the BIG-IP system. You can use the command sys dns to do this. This option is
required.
• port
Species the port for the trap destination that you are conguring. The default value is 162.
• v2-traps
Congures an SNMP version 2 trap destination. Note that you must include a version 2 trap2sink key,
and you must enclose the attributes in braces.
The options are additive and include:
• community
Species the community name for the trap destination that you are conguring. This option is
required.
• description
User dened description.
• host
Species the trap destination that you are conguring, the IP address, FQDN, or either of these with
an embedded protocol, for example tcp:10.10.10.1 or tcp:www.f5.com. Note that you must congure
the DNS Server on the BIG-IP system. You can use the command sys dns to do this. This option is
required.
• port
Species the port for the trap destination that you are conguring. The default value is 162.
See Also
create, delete, edit, list, modify, show, tmsh
sshd
Congures the Secure Shell (SSH) daemon for the BIG-IP(r) system.
Syntax
Congure the sshd component within the sys module using the syntax in the following sections.
Modify
modify sshd
allow [add | delete | replace-all-with] {
[ [hostname] | [IP address] ] ...
}
allow none
banner [disabled | enabled]
banner-text [string]
inactivity-timeout [integer]
1684
Sys
include [string]
login [disabled | enabled]
log-level [debug | debug1 | debug2 | debug3 | error | fatal |
info | quiet | verbose]
port [integer]
edit sshd
all-properties
non-default-properties
Display
list sshd
list sshd [option]
show running-config sshd
show running-config sshd [option]
all-properties
non-default-properties
one-line
Description
You can use the sshd component to congure a secure channel between the BIG-IP system and other devices.
F5 Networks recommends that users of the Conguration utility exit the utility before changes are made to
the system using the sshd component. This is because making changes to the system using this component
causes a restart of the sshd daemon. Likewise, restarting the sshd daemon creates the necessity for a restart
of the Conguration utility.
Examples
modify sshd allow add {192.168.0.0/255.255.0.0}
Creates an initial range of IP addresses (192.168.0.0 with a netmask of 255.255.0.0) that are allowed to log
in to the system.
modify sshd allow add {192.168.1.245}
Adds the IP address, 192.168.1.245, to the existing list of IP addresses that are allowed to log in to the
system.
modify sshd login enabled
Enables SSH login to the system.
modify sshd inactivity-timeout 3600
Sets an inactivity timeout of 60 minutes for SSH logins to the system.
modify sshd log-level error
Sets the sshd message log level to ERROR.
modify sshd banner enabled banner-text "NOTICE: Improper use of this computer may result in
prosecution!"
Creates a banner that displays when a user attempts to log in to a system using SSH.
Note that you must enclose the banner text in double quotation marks, and then type single quotation marks
outside the double quotation marks. You can also use the backslash character to escape each quotation mark
as well as any other special characters that the system might process (for example, exclamation point !).
1685
Traffic Management Shell (tmsh) Reference Guide
Options
• allow
Congures servers in the /etc/hosts.allow le. The default value is all.
Warning: Using the value none resets the sshd daemon to allow all servers access to the system. F5
Networks recommends that you do not use the value none with the sshd component.
• banner
Enables or disables the display of the banner text eld when a user logs in to the system using SSH. The
default value is disabled.
• banner-text
When the banner option is enabled, species the text to include in the banner that displays when a user
attempts to log on to the system.
• inactivity-timeout
Species the number of seconds before inactivity causes an SSH session to log out. The default value
is 0 (zero) seconds, which indicates that inactivity timeout is disabled.
• include
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using the include option. If you use this option incorrectly, you
put the functionality of the system at risk.
• login
Enables or disables SSH logins to the system. The default value is enabled.
• log-level
Species the minimum sshd message level to include in the system log. The possible values are:
• debug - debug3
Indicates that the minimum sshd message level that the system logs is the specied debugging level
of messages.
• error
Indicates that the minimum sshd message level that the system logs is error.
• fatal
Indicates that the minimum sshd message level that the system logs is fatal.
• info
Indicates that the minimum sshd message level that the system logs is informational.
• quiet
Indicates that the system does not log sshd messages.
• verbose
Indicates that the system logs all sshd messages.
• port
Species the TCP port to run SSHD. It is a number in the range of 1 and 65535.
The default value is 22.
1686
Sys
See Also
edit, list, modify, show, tmsh
state-mirroring
Congures connection mirroring for a BIG-IP(r) system that is part of a redundant pair in a high availability
system.
Syntax
Congure the state-mirroring component within the sys module using the syntax in the following sections.
Modify
modify state-mirroring
addr [IP address]
peer-addr [IP address]
secondary-addr [IP address]
secondary-peer-addr [IP address]
state [enabled | disabled]
edit state-mirroring
all-properties
non-default-properties
Display
list state-mirroring
list state-mirroring [option]
show running-config state-mirroring
show running-config state-mirroring [option]
all-properties
non-default-properties
one-line
Description
You can use this component to congure connection mirroring on a system that is part of a redundant pair
in a high availability system.
Connection mirroring is the process of duplicating connections from the active system to the standby system.
Enabling this setting ensures a higher level of connection reliability, but it may also have an impact on
system performance.
Examples
modify state-mirroring state enabled addr 192.168.10.10 peer-addr 192.168.10.20
Enables and congures connection mirroring for a high availability system in which one BIG-IP system
has an IP address of 192.168.10.10, and its peer has an IP address of 192.168.10.20.
modify state-mirroring state enabled
1687
Traffic Management Shell (tmsh) Reference Guide
Re-enables connection mirroring for a system for which connection mirroring was disabled.
Options
• addr
Species the primary self-IP address on this unit to which the peer unit in this redundant pair mirrors
its connections. The default value is ::.
• peer-addr
Species the primary self-IP address on the peer unit to which this unit mirrors its connections. The
default value is ::.
• secondary-addr
Species another self-IP address on this unit to which the peer unit mirrors its connections when the
primary address is unavailable. The default value is ::.
• secondary-peer-addr
Species another self-IP address on the peer unit to which this unit mirrors its connections when the
primary peer address is unavailable. The default value is ::.
• state
Enables or disables connection mirroring. The default value is enabled.
See Also
edit, list, modify, show, tmsh
sync-sys-files
Syncs a pre-dened set of system les from a device.
Syntax
Sync a pre-dened set of system les within the sys module using the syntax shown in the following sections.
Run
run sync-sys-files
from [IP address]
Display
show sync-sys-files
Description
You can use the sync-sys-les component to sync system les listed in /usr/share/defaults/sys_le.spec
from a remote device. You can run this command only if the Administrator user role is assigned to your
user account.
1688
Sys
Examples
run sync-sys-les from 172.27.34.182
Syncs the list of les (as given in /usr/share/defaults/sys_le.spec) from the IP address 172.27.34.182.
show sync-sys-les
Shows the last sync time and the source device from where the les are synced.
Options
• from
Species the IP address used for conguration synchronization on the device from which you want to
sync system les.
syslog
Congures the BIG-IP(r) system log.
Syntax
Congure the syslog component within the sys module using the syntax in the following sections.
Modify
modify syslog
auth-priv-from [alert | crit | debug | emerg | err | info |
notice | warning]
auth-priv-to [alert | crit | debug | emerg | err | info |
notice | warning]
cron-from [alert | crit | debug | emerg | err | info |
notice | warning]
cron-to [alert | crit | debug | emerg | err | info | notice |
warning]
daemon-from [alert | crit | debug | emerg | err | info |
notice | warning]
daemon-to [alert | crit | debug | emerg | err | info | notice |
warning]
description [string]
include [string]
iso-date [enabled | disabled]
console-log [enabled | disabled]
kern-from [alert | crit | debug | emerg | err | info | notice |
warning]
kern-to [alert | crit | debug | emerg | err | info | notice |
warning]
local6-from [alert | crit | debug | emerg | err | info | notice |
warning]
local6-to [alert | crit | debug | emerg | err | info | notice |
warning]
mail-from [alert | crit | debug | emerg | err | info | notice |
warning]
mail-to [alert | crit | debug | emerg | err | info | notice |
warning]
messages-from [alert | crit | debug | emerg | err | info |
notice | warning]
messages-to [alert | crit | debug | emerg | err | info | notice |
warning]
remote-servers [ add | delete | modify | replace-all-with] {
1689
Traffic Management Shell (tmsh) Reference Guide
[name] {
host [hostname]
local-ip [IP address]
remote-port [port number]
}
}
remote-servers none
user-log-from [alert | crit | debug | emerg | err | info | notice |
warning]
user-log-to [alert | crit | debug | emerg | err | info | notice |
warning]
edit syslog
all-properties
non-default-properties
Display
list syslog
list syslog [option]
show running-config syslog
show running-config syslog [option]
all-properties
non-default-properties
one-line
Description
You can use the syslog component to congure the system log.
Examples
modify syslog auth-priv-from warning
Resets the lowest level of messages about user authentication that are included in the system log to messages
with a level of warning, error, critical, alert, and emergency.
modify syslog auth-priv-to warning
Resets the highest level of messages about user authentication that are included in the system log to messages
with a level of warning, error, critical, alert, and emergency.
Options
• auth-priv-from
Species the lowest level of messages about user authentication to include in the system log. The default
value is notice.
• auth-priv-to
Species the highest level of messages about user authentication to include in the system log. The default
value is emerg.
• cron-from
Species the lowest level of messages about time-based scheduling to include in the system log. The
default value is warning.
• cron-to
1690
Sys
Species the highest level of messages about time-based scheduling to include in the system log. The
default value is emerg.
• daemon-from
Species the lowest level of messages about daemon performance to include in the system log. The
default value is notice.
• daemon-to
Species the highest level of messages about daemon performance to include in the system log. The
default value is emerg.
• description
User dened description.
• host
Species the IP address of a remote server to which syslog sends messages. The default value is none.
• include
Warning: Do not use this option without assistance from the F5 Technical Support team. The system
does not validate the commands issued using the include options. If you use this option incorrectly, you
put the functionality of the system at risk.
• iso-date
Enables or disables the ISO date format for messages in the log les. The default value is disabled.
• console-log
Enables or disables logging emergency syslog messages to the console. The default value is enabled.
• kern-from
Species the lowest level of kernel messages to include in the system log. The default value is notice.
• kern-to
Species the highest level of kernel messages to include in the system log. The default value is emerg.
• local-ip
Species the IP address of the interface syslog binds with in order to log messages to a remote host. For
example, if you want syslog to log messages to a remote host that is connected to a VLAN, you set this
parameter to the self IP address of the VLAN.
• local6-from
Species the lowest error level for messages from the local6 facility to include in the log. The default
value is notice.
• local6-to
Species the highest error level for messages from the local6 facility to include in the log. The default
value is emerg.
• mail-from
Species the lowest level of mail log messages to include in the system log. The default value is notice.
• mail-to
Species the highest level of mail log messages to include in the system log. The default value is emerg.
• messages-from
Species the lowest level of messages about user authentication to include in the system log. The default
value is notice.
1691
Traffic Management Shell (tmsh) Reference Guide
• messages-to
Species the highest level of system messages to include in the system log. The default value is warning.
• remote-port
Species the port number of a remote server to which syslog sends messages. The default value is 514.
• remote-servers
Congures the remote servers, identied by IP address, to which syslog sends messages. The default
value is none.
• user-log-from
Species the lowest level of user account messages to include in the system log. The default value is
notice.
• user-log-to
Species the highest level of user account messages to include in the system log. The default value is
emerg.
See Also
edit, list, modify, show, tmsh
tmm-info
Displays information about the Trafc Management Microkernel (tmm) daemon.
Syntax
Display statistics for the tmm-info component within the sys module using the syntax in the following
section.
Display
show tmm-info
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the tmm-info component to display information about the tmm daemon. The purpose of this
daemon is to direct all application trafc passing through the BIG-IP(r) system.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys tmm-trafc, tmsh
1692
Sys
tmm-traffic
Displays Trafc Management Microkernel (tmm) statistics.
Syntax
Congure the tmm-trafc component within the sys module using the syntax in the following section.
Modify
reset-stats tmm-traffic
Display
show tmm-traffic
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
global
Description
You can use the tmm-trafc component to display tmm trafc statistics, including errors and redirected
connections. The purpose of this daemon is to direct all application trafc passing through the BIG-IP(r)
system.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys tmm-info, sys trafc, tmsh
traffic
Displays or resets trafc statistics for the system.
Syntax
Congure the trafc component within the sys module using the syntax in the following section.
Modify
reset-stats traffic
1693
Traffic Management Shell (tmsh) Reference Guide
Display
show traffic
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the trafc component to display trafc statistics, including for client, server, Packet Velocity(r)
ASIC (PVA), miscellaneous, and authorization trafc. You can also reset the trafc statistics to zero at any
time.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys pva-trafc, sys tmm-info, sys tmm-trafc, tmsh
ucs
Loads or saves a UCS (.ucs) le.
Syntax
Congure the ucs component within the sys module using the syntax in the following sections.
Modify
save ucs [file name]
no-private-key
passphrase
load ucs [file name]
include-chassis-level-config
no-license
no-platform-check
passphrase
reset-trust
delete ucs [ file name ]
Display
list ucs
show ucs [file name]
1694
Sys
Description
You can use the ucs component to save the running conguration of the system into a UCS le. Additionally,
you can modify the running conguration of the system by loading an existing UCS le.
When you save a UCS le, the le is saved to the default directory, /var/local/ucs.
When you load a UCS le in shell mode, the system searches for the le using the relative path to the default
directory (/var/local/ucs). When you load a UCS le in bash mode, the system searches the current directory
rst. If the le is not found in the current directory, the default directory is then searched.
Examples
save ucs myucs
Saves the running conguration of the system into the le myucs.ucs.
load ucs myucs
Modies the running conguration of the system by loading the conguration contained in the myucs.ucs
le.
delete ucs myucs
Delete myucs.ucs in the default directory, /var/local/ucs/.
list ucs
Displays existing UCS les in the default directory, /var/local/ucs/.
Options
• include-chassis-level-cong
During restore of the UCS le, include chassis level conguration that is shared among boot volume
sets. For example, cluster default conguration.
• no-private-key Indicates that the UCS le can be saved without private key information.
• passphrase
Species the passphrase that is necessary to load the specied UCS le.
• no-license
Performs a full restore of the UCS le and all the les it contains, with the exception of the license le.
The option must be used to restore a UCS on RMA devices (Returned Materials Authorization).
• no-platform-check
Bypasses the platform check and allows a UCS that was created using a different platform to be installed.
By default (without this option), a UCS created from a different platform is not allowed to be installed.
• reset-trust
When specied, the device and trust domain certs and keys are not loaded from the UCS. Instead, a new
set is regenerated.
See Also
load, list, save, show, tmsh
1695
Traffic Management Shell (tmsh) Reference Guide
version
Displays software version information for the BIG-IP(r) system.
Syntax
Display statistics for the version component within the sys module using the syntax in the following section.
Display
show version
detail
Description
You can use the version component to display the software version running on the system, including a list
of hotxes that you have applied to the system.
Examples
show version
Displays software version information.
show version detail
Displays more extensive software version information about the system, including the operating system
kernel information, and details about each hotx that you have applied to the system.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
1696
Sys
Sys Application
apl-script
Provides scripts that can be included by an application template.
Syntax
Congure the apl-script component within the sys application module using the syntax in the following
sections.
Edit
create apl-script [name]
modify apl-script [name]
apl-checksum [[string] | none]
apl-signature [[string] | none]
description [[string] | none]
ignore-verification [true | false]
edit apl-script [ [ [name] | [glob] | [regex] ] ... ]
all-properties
Display
list apl-script
list apl-script [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete apl-script [name]
Generate
Note: generate cryptographic signature or checksum based on apl script text.
generate sys application apl-script [name]
checksum
signature
Description
An APL script contains APL that can be directly included into application templates. APL scripts provide
a convenient way to build libraries of common presentation elements. For detailed description of application
presentation language elements, See help page of sys application template
Examples
The following is a fairly simple example of an APL script and a template that makes use of the APL script.
The APL script denes a user type that can then be used multiple times in different templates.
sys application apl-script com.f5.apl.example {
define string port validator "PortNumber"
}
sys application template example_template {
actions {
definition {
presentation {
include "com.f5.apl.example"
section my_section {
string address1
port portnum1
string address2
port portnum2
}
}
}
}
}
generate my_script checksum
Generate a checksum for the script text and add the checksum as a property.
generate my_script signature signing-key my_key
Generate a signature for the script text using the specied private key and add the signature as a property.
Note: For a script which includes a checksum or signature to successfully load, the script text contents must
match the stored checksum or signature.
To temporarily stop the verication of signature or checksum and still retain the checksum or signature,
the ignore-verication attribute must be set to true. This is done by editing the script and adding the
ignore-verication attribute.
To completely clear the signature or checksum, simply set the attribute script-signature or script-checksum
to empty string "". By doing so, the script will be processed as if it was never signed or checksumed.
modify apl-script my_script { description none script { } ignore-verication true script-checksum
74778e7b13016e0b9329a17f8d2da601 total-signing-status checksum verication-status checksum-veried
}
Options
You can use these options with the apl-script command:
• checksum
Generate a checksum for the script text and add the checksum to the script as a property. Only for use
with the generate command.
• description
User dened description.
• glob
1698
Sys Application
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• script
Contains the APL text that can be imported into application templates.
• signature
Generate a signature for the script text using the specied private key and add the signature to the script
as a property. Only for use with the generate command.
• signing-key
The private key to use for signing the script. Only for use with the signature option.
See Also
create, delete, edit, glob, list, modify, regex, sys application template and generate.
custom-stat
Provides derived statistics for iStats.
Syntax
Congure the custom-stat component within the sys application module using the syntax in the following
sections.
Edit
create custom-stat [key]
modify custom-stat [key]
app-service [[string] | none]
keyspace [string]
formula [string]
measure [string]
edit custom-stat [ [ [key] | [glob] | [regex] ] ... ]
all-properties
Display
list custom-stat
list custom-stat [ [ [key] | [glob] | [regex] ] ... ]
1699
Traffic Management Shell (tmsh) Reference Guide
Delete
delete custom-stat [key]
Description
Statistics are derived for objects in the given keyspace based on the given formula, producing the given
measure.
Examples
create sys application custom-stat myKey keyspace sys.application.service measure conns_per_min
formula "rate counter conns 60"
Creates a derived iStat.
Options
You can use these options with the custom-stat component:
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• formula
Species the rst token in the formula indicates the computation to be made. Currently only rates are
supported.
rate <source_measure_type> <source_measure_name>
<rate_window_in_seconds>
rate computes the rate of change of the source measure over the last <rate_window_in_seconds> seconds.
This is applicable only to numeric measures. The derived measure is of type gauge.
• keyspace
Species that a derived iStat will be computed for all objects in the given keyspace for which the formula
is computable (the source measure of the correct type exists).
• measure
Species the name of the derived measure to be created. The type of the derived measure is dependent
on the formula.
See Also
create, modify, sys application service
service
Congures trafc management application services.
1700
Sys Application
Syntax
Modify the service component within the sys application module using the syntax shown in the following
sections.
Create/Modify
create service [name]
modify service [name]
description [string]
device-group [[string] | default | non-default | none]
execute-action [name]
lists [add | delete | modify | replace-all-with] {
[name] {
value { [string]... }
value none
encrypted [yes | no]
}
}
lists none
strict-updates [disabled | enabled]
tables [add | delete | modify | replace-all-with] {
[name] {
column-names { [name] ... }
encrypted-columns { [name] ... }
rows { { row { [value] ... } row { [value] ... } ... } }
rows none
}
}
tables none
template [name]
traffic-group [[string] | default | non-default | none]
variables [add | delete | modify | replace-all-with] {
[name] {
value [string]
encrypted [yes | no]
}
}
variables none
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
}
}
edit service [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list service
list service [ [ [name] | [glob] | [regex] ] ... ]
show running-config service
show running-config service [ [ [name] | [glob] | [regex] ] ... ]
all-properties
1701
Traffic Management Shell (tmsh) Reference Guide
non-default-properties
one-line
partition
Note: Application Service objects are always created in a subfolder of the current folder. Make sure the
correct path is used to display the service. E.G list myapplication.app/myapplication
Delete
delete service [name]
Options
You can use these options with the service component:
• description
User dened description.
• device-group
Species the name of the device group to which the application service is assigned. If this property is
modied with the default keyword, the value of the parent folder or partition will be used and the
inherited-devicegroup property will be set to true.
• execute-action
Runs the specied template action associated with the service.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• lists
Provides the set of list variables and values that are passed to template scripts.
• metadata
Associates user dened data, each of which has name and value pair and persistence. The default value
is persistent, which means the data will be saved into the cong le.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• strict-updates
Species whether conguration objects contained in the application service can be directly modied
outside the context of the system's application service management interfaces.
• tables
Provides the set of table variables and values that are passed to template scripts.
• template
The template denes the conguration for the application service. Generic application service has no
template associated with it. This can be changed after the service has been created to move the service
to a new template. A templated application service can be converted to a generic application service by
setting new template to none or empty string. Similarly a generic application service can be made
templated by associating it with the existing template.
1702
Sys Application
• template-modied
Indicates that the application template used to deploy the service has been modied. The application
service should be updated to make use of the latest changes.
• template-prerequisite-errors
Indicates any missing prerequisites associated with the template that denes this application.
• trafc-group
The name of the trafc group that the application service is assigned to. If this property is modied with
the "default" keyword, the value of the parent folder or partition will be used and the
inherited-trafcgroup property will be set to true.
• variables
The set of atomic variables and values that are passed to template scripts.
See Also
create, delete, edit, glob, list, modify, regex, tmsh
template
Enables the creation of user-dened templates.
Syntax
Congure the template component within the sys application module using the syntax in the following
sections.
Create/Edit/Modify
create template [name]
modify template [name]
actions [add | delete | modify | replace-all-with] {
definition {
html-help [string]
implementation { [string] }
presentation { [string] }
role-acl [add | delete | modify | replace-all-with] {
[role]
}
role-acl none
run-as [string]
}
}
description [string]
requires-modules [add | delete | modify | replace-all-with] {
[string]
}
requires-bigip-version-max [string]
requires-bigip-version-min [string]
metadata
[add | delete | modify] {
[metadata_name ... ] {
value [ "value content" ]
persist [ true | false ]
1703
Traffic Management Shell (tmsh) Reference Guide
}
}
edit template [name]
Display
list template
list template [name]
Delete
delete template [name]
Generate
Note: generate cryptographic signature or checksum based on template elds - html-help, implemenation,
macro and presentation in denition section.
generate template [name]
checksum
signature
Save/Load
save template [name] file [filename]
load template [filename]
Description
Application templates allow a user to dene a custom interface for easily creating complex congurations.
The user can create multiple templates for various types of congurations. Once built, the user can use a
template to create an application, which is a specic set of conguration objects (such as Virtual IP addresses,
pools, and so forth), that work together to perform some task.
The template is composed of two primary parts, the presentation and the implementation.
The presentation section describes a form (a set of questions and user interface elements) that the user must
ll out in order to create an application.
The implementation section describes how the values collected from the user (the form variables) are used
to generate the actual conguration objects which are part of the application.
The presentation section of the template is written in a simple language called Application Presentation
Language or APL. The implementation section of the template is written in TCL and provides access to
tmsh scripting commands.
1704
Sys Application
Application Lifecycle
Before describing in detail how a template is written, it is important to explain how the resulting template
will be used. Since templates are used to create and edit applications, it makes sense to review the application
lifecycle.
Application Creation
The user selects which template to use for his application. The system presents an empty form, based on
the template's presentation script that the user lls out and submits. The system collects and stores the form
variables in a newly created application object. Conguration objects are generated based on the form
variables by the template's implementation script.
Application Editing
The user selects an existing application that he would like to change. The system reloads the form associated
with the template that was used to create the application and rells all form variables using the previous
user input, which is gathered from the application object. The user edits the form and submits it. The
template's implementation script is run again to compute a new set of conguration objects for the application.
The system alters the current conguration objects associated with the application to match the newly
computed set of conguration objects, including creating, modifying, and deleting objects as needed.
Application Deletion
The user selects an application to delete. All conguration objects associated with the application are
removed.
Application Template Language
The application template language describes the user interface presented to a user making a new application,
or editing an existing application. It describes what questions to ask, how the questions are presented (for
example, a free form eld or a list of options), and the names of the variables used to store the values the
user inputs.
It consists of a set of primitive form elements (string, choice, etc), a set of grouping and organization
constructs (section, table, etc), methods for hiding or displaying portions of the form based on the values
of other portions (optional), a method to associate human-readable text with various form elements (text)
and methods for creating user dened types(dene group, dene section, etc) for reuse of application
presentation language elements.
Primitive Elements
Primitive elements represent the actual user interface components. The system displays each primitive
element as part of the form, and associates it with a form variable. The following lists the basic primitive
types:
• choice
A list of options from which the user can select (a drop-down menu).
choice <var-name> [default "<def value>"] [display "<def value>"]
{"<choice1>", "<choice2>", ...}
• editchoice
Multiple choices are available that the user can select, or a new value can be entered if the choices are
not acceptable.
choice <var-name> [default "<def value>"] [display "<def value>"]
{"<choice1>", "<choice2>", ...}
1705
Traffic Management Shell (tmsh) Reference Guide
• multichoice
Similar to a basic choice element except that multiple items may be selected from the available choices.
choice <var-name> [default "<def value>"] [display "<def value>"]
{"<choice1>", "<choice2>", ...}
• password
Similar to a string element except the contents may be obscured to prevent others from seeing the value.
password <var-name> [default "<def value>"] [display "<def value>"] [required]
• string
A basic text box into which the user can enter an arbitrary string.
string <var-name> [default "<def value>"] [display "<def value>"] [required]
[validator "<validator name>"]
Each primitive element is associated with a variable name, which denes where the value collected by the
form is stored. In addition, primitive elements can have additional parameters such as a default value, a
validation method that provides for additional requirements (for example, the string must be an IP address).
The following denes the format for the string primitive values, using normal BNF syntax:
• default - A sensible default value to which the string is initialized when a new application is created.
• display - Directs the renderer how to display the element. This can be small, medium, large, xlarge,
or xxlarge.
• required - If present, a valid value must be entered before the application can be created.
• validator - The name of a well known validation method.
Section
The section construct is used to group form variables (primitives) into logical sections for display.
Each section is named, and header text can be dened for a section using the text construct.
Every variable must be inside a section. The format for a section is:
section <section-name> { <contents...> }
For example, to represent the data associated with a virtual IP:
section vip
{
string address
string port default "80" display "small"
}
Table
1706
Sys Application
The table construct is similar to section, except that it represents a grouping of elements that can be repeated
zero or more times. The syntax for table and section are identical.
table <list-name> { <contents...> }
For example, to collect a list of nodes from a user to populate a pool, you can add any number of nodes,
each of which has an address and port:
section pool
{
table members
{
string address
string port default "80" display "small"
}
}
The table above is displayed using a JavaScript-editing widget that enables you to add and remove pool
members. Each member contains two form variables: address and port.
Optional
The optional construct allows the form elements to be hidden or shown based on the state of other form
elements. The syntax of the optional construct is:
optional (<expr>) { <contents...> }
The expression in the optional construct is evaluated during the display of the form. The content section is
displayed or hidden, based on its value.
To dynamically hide parts of the presentation based on the answer to a earlier question, use the variable
name in the expression:
section chooseopts {
choice show_section_1 {"yes", "no"}
}
section section1
{
optional (chooseopts.show_section_1 == "yes")
{
string str
}
}
User Dened Types
The dene construct allows the creation of user-dened types out of primitive types. The dened type can
then be used multiple times independently at different places. This is especially useful in conjunction with
the include element because types can be dened in the included application presentation language script
and then used where necessary in the template. For more details on application presentation language script,
See help sys application apl-script.
1707
Traffic Management Shell (tmsh) Reference Guide
For example, user dened choice type can be dened as below and can be reused at multiple sections:
define choice yesno {
"Yes", "No"
}
section ssl_section {
yesno use_ssl
}
section optimizations {
yesno use_wa
yesno offload_ssl
}
The dene group construct allows the creation of user-dened type to allow the user to group multiple
elements of existing types together. The dened type can be reused multiple times independently similar
to the above.
For example IpAddress and port can be grouped into a user-dened type and reused in multiple sections:
define group addrport {
string addr required validator "IpAddress"
string port
}
section http_section {
addrport server
}
section sip_section {
addrport client
addrport server
}
Localization
The text element lets you dene the localized text labels for sections, table, row and other sub-elements.
For message element, body text can be localized in addition to the label. Similarly for the choice, editchoice
and multichoice element, display text associated with each choice value can be localized. The syntax for
the text element is:
text ["<locale>"] {
<section var_name> "<label>"
<section var_name>.<string or password var_name> "<label>"
<section var_name>.<message var_name> "<label>" "<body>"
<section var_name>.<choice, editchoice or multichoice var_name> "<label>"
{ "<display text1>" => "<choice1>", "<display text2>" => "<choice2>", ... }
}
Depending on the locale used (setting in the browser), particular text label, body text or choice display text
will be shown to the user.
For example, string, message and choice display texts can be localized as below.
section http
{
message intro
string address
string port default "80" display "small"
choice pools default "pool1" { "pool1", "pool2", "pool3" }
choice profile default "http" tcl {
1708
Sys Application
set choices "no\n"
append choices "http\n"
append choices [tmsh::run_proc f5.app_utils:get_items ltm profile
http]
return $choices
}
}
text {
vs "HTTP Application"
vs.intro "Introduction" "This template supports simple web server
implementations"
vs.address "What IP address do you want to use for this virtual server?"
vs.port "What port do you want to use for this virtual server?"
vs.pools "Use pool.." {"Internal" => "pool1", "Public cloud" => "pool2",
"Private data center" => "pool3" }
vs.profile "Use profile.." { "Do not use profile" => "no", "Use F5's
recommended profile" => "http" }
}
text "de_AU" {
vs "HTTP-Anwendung"
vs.intro "Einfuhrung "Diese vorlage unterstutzt einfache
web-server-implementierungen"
vs.address "Welche ip-adresse mochten Sie fur diesen virtuellen Server zu
verwenden?"
vs.port "Welchen port willst du fur diesen virtuellen Server zu verwenden?"
vs.pools "Verwenden pool.." {"intern" => "pool1", "Privat Rechenzentrum" =>
"pool3", "Offentliche Cloud" => "pool2" }
vs.profile "Mit profil.." { "Verwenden sie kein profil" => "no", "Verwenden
von F5 empfohlen profil" => "http" }
}
A user from Austria will see the german text, all other locales will see the default (locale-less) text.
While localizing choice value display text, users are allowed to use different ordering of choice values in
each locale. If TCL is used to populate the choices, then best effort is made to match what is returned in
the TCL to the given localized choice value. In the above example, the embedded TCL script for prole
will return two static choices (no and http) followed by the list of all http proles. These static choices are
localized, but not the other results. When the TCL results contain a mix of localized and non-localized
choices, the localized choices will always be listed rst in the order specied in the text element.
With the localization, message body and static choices will become optional in the declaration. If the message
body is provided in both the declaration and in text element, the body in the text element will override the
body in the variable declaration. Same applicable for the display text of choice value provided in declaration.
The recommended syntax for choice, editchoice and multichoice element is to give just the choice values
in the variable declaration, and give the display text of the choices in the text element.
Tmsh Scripting Support
Once the user nishes editing an application, the form variables are saved, and the implementation section
of the associated template is run. The implementation section is an ordinary TCL script and can use the
standard set of tmsh scripting extensions. In addition, there are a few template-specic additions.
1709
Traffic Management Shell (tmsh) Reference Guide
First, access to the form variable is done using the syntax, where <section > is the name of the section to
which the variable belongs, and <name > is the name of the form variable:
$::<section>__<name>
Next, a table can be iterated over, and for each list element, the components of the list can be gathered using
the tmsh::get_eld_value command. For example, for the pool member example described in the section
regarding the list, you can use the following syntax:
foreach member $::pool__members {
set the_addr [tmsh::get_field_value $member address]
set the_port [tmsh::get_field_value $member port]
# Do something with the_addr and the_port
}
This means for variable access can also be used within a script macro. Expansion of a macro is done using
the tmsh::expand_macro command. Usage:
tmsh::expand_macro [macro] [name_value_pair_list]
The variables dened in the presentation are automatically available from within the macro. If additional
variables are needed from within the macro, they can be specied via name_value_pair_list. Variables
dened this way will take precendence over duplicate variables dened in the presentation.
Tmsh Built-In Variables
Specic details on application and application template is provided to implementation section using built-in
variables. Following are the variables available for use.
• tmsh::app_name
Stores the user-provided application name string.
• tmsh::app_name_path
Stores the path name of application in conguration database.
• tmsh::app_template_name
Stores the user-provided application template name including the path in conguration database.
• tmsh::app_template_action
Stores the application template action name.
Examples
The following template example shows both the presentation and implementation sections. (It lacks some
features, such as use of optional, defaults, validators, etc.)
presentation {
section basic
{
choice ssl_enabled { "true", "false" }
string addr
string more_stuff
table servers
1710
Sys Application
{
string addr
string port
string ratio
}
}
text
{
basic "Some example questions"
basic.ssl_enabled "Should SSL be enabled?"
basic.addr "What address should we use for the VIP?"
basic.servers.addr "Address"
basic.servers.port "Port"
}
}
implementation {
if { $::basic__ssl_enabled }
{
set profile_name [format "%s_%s" $tmsh::app_name clientssl]
tmsh::create ltm profile client-ssl $profile_name
append profile_name " http"
set destination "$::basic__addr:https"
set monitor https
}
else
{
set profile_name http
set destination "$::basic__addr:http"
set monitor http
}
set pool_name [format "%s_%s" $tmsh::app_name pool]
set members \{
foreach server $::basic__servers {
append members [tmsh::get_field_value $server addr]
append members ":"
append members [tmsh::get_field_value $server port]
append members " { ratio "
append members [tmsh::get_field_value $server ratio]
append members "}"
append members " "
}
append members \}
tmsh::create ltm pool $pool_name \
members replace-all-with $members \
monitor $monitor
set vs_name [format "%s_%s" $tmsh::app_name virtual]
1711
Traffic Management Shell (tmsh) Reference Guide
tmsh::create ltm virtual $vs_name \
destination $destination \
profiles replace-all-with "{ $profile_name }" \
snat automap \
pool $pool_name \
http-class none
}
generate my_app checksum
Generate a checksum for the template denition and add the checksum as a property.
generate my_app signature signing-key my_key
Generate a signature for the template denition using the specied private key and add the signature as a
property.
Note: For a template which includes a checksum or signature to succesfully load, the denition contents
must match the stored checksum or signature.
To temporarily stop the verication of signature or checksum and still retain the checksum or signature,
the ignore-verication attribute must be set to true. This is done by editing the script and adding the
ignore-verication attribute.
To completely clear the signature or checksum, simply set the attribute script-signature or script-checksum
to empty string "". By doing so, the script will be processed as if it was never signed or checksumed.
sys application template my_tmpl { actions { denition { html-help { <!-- insert html help text --> }
implementation { # insert tmsh script } presentation { # insert apl script } role-acl none run-as none } }
description "This is my template" ignore-verication true script-checksum
74778e7b13016e0b9329a17f8d2da601 total-signing-status checksum verication-status checksum-veried
}
Options
• actions
Adds, deletes, or replaces a set of template actions. You can congure the following options for an
action:
• html-help
The help for the application template action formatted as HTML.
• implementation
The script that is run to create the conguration objects associated with the application.
• name
The name of the application template action.
• presentation
The questions that must be answered to create an application from the template.
• role-acl
The list of roles that are allowed to run the action.
• run-as
The user account that will be used to run the implementation script. If no account is specied, the
script is run as the calling user.
• checksum
Generate a checksum for the template denition and add the checksum to the template as a property.
Only for use with the generate command.
1712
Sys Application
• signature
Generate a signature for the template denition using the specied private key and add the signature
to the template as a property. Only for use with the generate command.
• signing-key
The private key to use for signing the template. Only for use with the signature option.
• description
User dened description.
• metadata
Associates user dened data, each of which has name and value pair and persistence. The default value
is persistent, which saves the data into the cong le.
• partition
Displays the administrative partition within which the application template resides.
• prerequisite-errors
A message indicating if there are any errors with the prerequisites for the template on the current BIG-IP
system. If there are errors no applications can be created from this template. If there are no errors then
the template is valid.
• requires-modules
Adds, deletes, or replaces the list of modules that are required to be provisioned for this template to
work.
• requires-bigip-version-max
Species the maximum version of BIG-IP software required by this template.
• requires-bigip-version-min
Species the minimum version of BIG-IP software required by this template.
Third Party Tcl Library Usage
A selection of third party libraries have been tested to work within the CLI script environment. These include
MD5, BASE64, SHA1/SHA256, HTTP, TLS, TCL Perl, LDAP client, and XML parser. The TCL packages
can only reside in the /use/share/compat-tcl8.4 directory.
Important: Only these tested packages are supported currently.
The following example shows how the Tcl package command can make use of the XML parser:
cli script /Common/use_xml {
proc script::EStart {tag attlist args} {
array set attr $attlist
puts "Element \"$tag\" started with [array size attr] attributes"
}
proc script::PCData text {
1713
Traffic Management Shell (tmsh) Reference Guide
incr ::count [string length $text]
}
proc script::run {} {
namespace eval :: {
set count 0
}
puts "running use_xml...\n"
set pkg_name xml
if {[catch {package require $pkg_name 3.2}]} {
puts "No package found: $pkg_name!\n"
}
else {
puts "Found package: $pkg_name!\n"
set parser [xml::parser]
$parser configure -elementstartcommand script::EStart -characterdatacommand
script::PCData
set fp [open "/shared/test.xml" r]
set text [read $fp]
$parser parse $text
puts "The document contains $::count characters"
close $fp
}
}
Here are some additional examples:
cli script /Common/use_sha1 {
proc script::run {} {
set pkg_name sha1
if {[catch {package require $pkg_name}]} {
puts "No package found: $pkg_name!\n"
}
else {
puts "Found package: $pkg_name!\n"
puts "TCL does SHA1 now:"
puts [sha1::sha1 -hex "TCL does SHA1"]
}
}
cli script /Common/use_base64 {
proc script::run {} {
set pkg_name base64
if {[catch {package require $pkg_name}]} {
puts "No package found: $pkg_name!\n"
}
else {
puts "Found package: $pkg_name!\n"
set chemical [encoding convertto utf-8 "C\u2088H\u2081\u2080N\u2084O\u2082"]
set encoded [base64::encode $chemical]
set caffeine [encoding convertfrom utf-8 [base64::decode $encoded]]
puts "Caffeine: $caffeine"
}
}
See Also
edit, list, modify, show, tmsh, generate
1714
Sys Application
Sys Crypto
cert
Manage cryptographic certicates on the BIG-IP(r) system.
Syntax
Manage cryptographic cert s using the syntax in the following section.
Create
create cert [name]
city [string]
common-name [string]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
country [string]
email-address [string]
key [string]
lifetime [days]
organization [string]
ou [string]
state [string]
subject-alternative-name [string]
Install
install cert [name]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
from-editor
from-local-file [filename]
from-url [URL]
no-overwrite
Delete
delete cert [name]
Description
You can use the cert component to create, install, and delete cryptographic certicates, and bundles.
Examples
create cert example key testkey.key common-name "My Company Inc." country "US"
Generates a self signed certicate named "example.crt". A key with the specied name "testkey.key" in this
case must be installed on the system in order for this operation to succeed. The cert extension (".crt") will
be appended to the created cert name if it is not already provided in the name.
create cert /myfolder/example key testkey.key common-name "My Company Inc." country "US"
Similar to above, but creates the cert "example.crt" in the folder "/myfolder" instead of the default "/Common".
The specied folder "/myfolder" must already exist in order for this operation to succeed.
create cert server2 key server2.key common-name "My Company Inc." country "US" consumer
webserver
Generates a self-signed certicate named server2.crt. The consumer attribute, "webserver", is used to cause
the les to be placed directly in the path which can be found by the BIG-IP system httpd. A pre-existing
key named "server2.key" must exist in the web server's key path in order for this operation to succeed.
Please note that for non LTM consumer's key and cert names must be the same.
install cert example from-editor
Opens an interactive editor session into which can be pasted a certicate for import into the BIG-IP system.
A certicate le-object will be created with the name example which contains the contents saved from the
editor session.
install cert example from-local-le /tmp/example.crt
Obtains a certicate from the le located at /tmp/example.crt.
install cert example from-url http://example.com/example.crt
Obtains a certicate from a remote host, based on the URI specied.
delete cert example.crt
Deletes the certicate "example.crt" from the system.
Options
• city
Species the x509 city eld to be used in creation of the certicate.
• common-name
Species the x509 common-name to be used in creation of the certicate.
• consumer
Species the system component by which a certicate will be consumed. The default behavior is to
create le-objects for use by ltm components. This is the same as specifying "ltm" for this property. If
a component other than "ltm" is specied then les will be installed/created in locations where the
specied components can nd them. For example, for component "webserver", certicates will be placed
in the webservers ssl directories.
• country
Species the x509 country to be used in creation of the certicate. The country must be a 2 letter country
code.
• email-address
Species the x509 email-address to be used in creation of the certicate.
• from-editor
Species that the certicate should be obtained from a text editor session. This allows certicates to be
imported via cut-n-paste from another location as long as they are in a text representation.
• from-local-le
1716
Sys Crypto
Species a local le path from which a certicate is to be copied.
• from-url
Species a URI which is to be used to obtain a certicate for import into the system.
The URL syntax is protocol dependent. Supported schemes are "HTTP", "HTTPS", "FTP", "FTPS" &
"FILE."
• no-overwrite
Species option of not overwriting a certicate if it is in the scope.
• key
Species a key from which a certicate should be generated when using the create command.
• organization
Species the x509 organization to be used in creation of the certicate.
• ou
Species the x509 organizational unit to be used in creation of the certicate.
• state
Species the x509 state or province of the certicate.
• subject-alternative-name
Species standard X.509 extensions as shown in RFC 2459. Allowed values e.g. DNS:example.com,
See Also
create, install, delete, tmsh
check-cert
Examines certicates and displays or logs any that have expired on the BIG-IP(r) system.
Syntax
Run a check on the expiration date of LTM certicates, in the sys crypto module by using the syntax below.
Run
run check-cert [certificate-file-name]
log [enabled | disabled]
stdout [enabled | disabled]
verbose [enabled | disabled]
Description
You can use the check-cert command to check the expiration date of certicate(s) and print the results to
the screen and/or log them to /var/log/ltm.
Options
• log
1717
Traffic Management Shell (tmsh) Reference Guide
Species whether results should be logged or not. By default they will be logged.
• stdout
Species whether results should be printed to STDOUT or not. By default they will be printed.
• verbose
Species whether verbose output should be emitted or not, such as information about all certicates
being checked rather than just those which return unfavorable results. By default verbose output is
disabled.
Examples
run check-cert
Checks all certicate le-objects known by MCPD, and displays information about any certicates which
have expired or which are close to expiration. By default this information is printed to the screen and logged
to /var/log/ltm.
run check-cert default.crt
Runs the check on the specic certicate "default.crt"
run check-cert verbose
Displays expiration information about all certicates, not just those that have expired or have impending
expirations.
run check-cert log disabled
Prints the results to screen but does not log them.
run check-cert stdout disabled
Logs the results to /var/log/ltm, but does not print them to the screen.
See Also
run, tmsh
client
Manage remote crypto clients.
Syntax
Manage crypto client s using the syntax in the following section.
Create/Modify
create client [name]
modify client [name]
addr [ip address]
connection-reset
heartbeat [integer]
max-retries [integer | infinite]
port [integer]
profiles [add | delete | replace-all-with] { [profile_name ...] }
profiles [none]
1718
Sys Crypto
req-timeout [integer]
retry-interval [integer]
Display
list client
list client [ [ [name] | [globl] | [regex] ] ... ]
show client
show client [ [ [name] | [globl] | [regex] ] ... ]
Delete
delete client [name]
Description
You can use the client component to manage remote crypto clients.
Examples
create client example addr 10.1.1.1 port 12100 proles add { serverssl tcp }
Creates a remote crypto client named "example" that will use a remote crypto server with the IP address
"10.1.1.1" on port "12100". The remote crypto client will use SSL over a TCP connection to communicate
with the remote crypto server.
Options
• addr
Species the IP address of the remote crypto server.
• connection-reset
Resets the connection to the remote crypto server.
• heartbeat
Species the number of seconds to wait before sending a heartbeat request. A value of 0 disables the
sending of heartbeat requests. The default value is 30 seconds.
• max-retries
Species the maximum number of times to retry connecting to the remote crypto server.
If the maximum retries value is innite, the crypto client retries connecting until a connection is made.
The default value is innite.
• port
Species the port used by the remote crypto server.
• proles
Species a list of proles that the remote crypto client will use to communicate with remote the remote
crypto server.
• req-timeout
Species the timeout in milliseconds for crypto requests to complete. The default value is 5000
milliseconds.
1719
Traffic Management Shell (tmsh) Reference Guide
• retry-interval
Species the interval in seconds between attempts to connect to the remote crypto server. The default
value is 10 seconds.
See Also
create, delete, glob, list, modify, regex, tmsh
crl
Manage certicate revocation lists on the BIG-IP(r) system.
Syntax
Manage crl s using the syntax in the following section.
Install
install crl [name]
ca-file [filename]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
from-editor
from-local-file [filename]
from-url [URL]
Delete
delete crl [name]
Description
You can use the crl component to install, and delete certicate revocation lists. The le-objects created by
these operations can be used in other BIG-IP system conguration blocks such as ssl proles.
Examples
install crl example from-editor
Opens an interactive editor session into which can be pasted a crl for import into the BIG-IP system. A crl
le-object will be created with the name example which contains the contents saved from the editor session.
install crl example from-local-le /tmp/example.crl
Obtains a crl from the le located at /tmp/example.crl and installs it as example.crl. The crl extension (".crl")
will be appended to the installed crl name if it is not already provided in the name.
install crl /myfolder/myexample from-local-le /tmp/example.crl
Similar to above, but installs the crl "myexample.crl" in folder "/myfolder" instead of the default "/Common".
The specied folder "/myfolder" must already exist in order for this operation to succeed.
install crl example from-url http://example.com/example.crl
Obtains a crl from a remote host, based on the URI specied.
delete crl example.crl
1720
Sys Crypto
Deletes the certicate revocation list "example.crl" from the system.
Options
• consumer
Species the system component by which the certicate revocation list will be consumed. The default
behavior is to create le-objects for use by ltm components. This is the same as specifying "ltm" for
this property. If a component other than "ltm" is specied then les will be installed/created into locations
where the specied components can nd them. For example, for component "webserver", crls will be
placed in the webservers ssl directories.
• from-editor
Species that the crl should be obtained from a text editor session. This allows crls to be imported via
cut-n-paste from another location as long as they are in a text representation.
• from-local-le
Species a local le path from which the crl is to be copied.
• from-url
Species a URI which is to be used to obtain the crl for import into the conguration of the system.
The URL syntax is protocol dependent. Supported schemes are "HTTP", "HTTPS", "FTP", "FTPS" &
"FILE."
See Also
create, install, delete, tmsh
csr
Manage cryptographic certicate signing requests on the BIG-IP(r) system.
Syntax
Manage cryptographic CSR s using the syntax in the following section.
Create
create csr [name]
challenge-password [string]
city [string]
common-name [string]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
country [string]
email-address [string]
key [string]
organization [string]
ou [string]
state [string]
subject-alternative-name [string]
1721
Traffic Management Shell (tmsh) Reference Guide
Show
show csr
List
list csr [name]
Delete
delete csr [name]
Description
You can use the csr component to create, show, list and delete cryptographic certicate signing requests.
Examples
create csr example key testkey.key common-name "My Company Inc." country "US"
challenge-password "abcd"
Generates a certicate signing request named "example.csr" with provided common-name, country and
challenge-password attributes. A key with the specied name "testkey.key" in this case must be installed
on the system in order for this operation to succeed. The csr extension (".csr") will be appended to the
created csr name if it is not already provided in the name.
create csr /myfolder/example key testkey.key common-name "My Company Inc." country "US"
challenge-password "abcd"
Similar to above, but creates the csr "example.csr" in the folder "/myfolder" instead of the default "/Common".
The specied folder "/myfolder" must already exist in order for this operation to succeed.
create csr server2 key server2.key common-name "My Company Inc." country "US" consumer
webserver
Generates a certicate signing request named "server2.csr". The consumer attribute, "webserver", is used
to cause the les to be placed directly in the path which can be found by the BIG-IP system httpd. A
pre-existing key named "server2.key" must exist in the web server's key path in order for this operation to
succeed.
show csr
Shows the number of certicate signing requests installed in the system.
list csr example.csr
Lists all details of the certicate signing request "example.csr". A csr with the specied name "example.csr"
in this case must already be installed on the system in order for this operation to succeed.
delete csr example.csr
Deletes the certicate signing request "example.csr" from the system.
Options
• challenge-password
Species the PKCS#9 challenge-password eld to be used in creation of the certicate signing request.
1722
Sys Crypto
• city
Species the x509 city eld to be used in creation of the certicate signing request.
• common-name
Species the x509 common-name to be used in creation of the certicate signing request.
• consumer
Species the system component by which a certicate signing request will be consumed. The default
behavior is to create le-objects for use by ltm components. This is the same as specifying "ltm" for
this property. If a component other than "ltm" is specied then les will be installed/created in locations
where the specied components can nd them. For example, for component "webserver", certicate
signing requests will be placed in the webservers ssl directories.
• country
Species the x509 country to be used in creation of the certicate signing request. The country must be
a 2 letter country code.
• email-address
Species the x509 email-address to be used in creation of the certicate signing request.
• key
Species a key from which a certicate signing request should be generated when using the create
command.
• organization
Species the x509 organization to be used in creation of the certicate signing request.
• ou
Species the x509 organizational unit to be used in creation of the certicate signing request.
• state
Species the x509 state or province to be used in creation of the certicate signing request.
• subject-alternative-name
Species standard X.509 subject alternative extensions as shown in RFC 2459 to be used in creation of
the certicate signing request. Examples of allowed types are : DNS:example.com, IP:192.168.1.1,
See Also
create, show, list, delete, tmsh
key
Manage cryptographic keys and related objects on the BIG-IP(r) system.
Syntax
Manage cryptographic key s and related objects of the sys crypto module using the syntax in the following
section.
1723
Traffic Management Shell (tmsh) Reference Guide
Create
create key [name]
challenge-password [string]
city [string]
common-name [string]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
country [string]
curve-name [prime256v1 | secp384r1]
email-address [string]
key-size [512 | 1024 | 2048 | 4096]
key-type [dsa-private | ec-private | rsa-private]
lifetime [days]
organization [string]
ou [string]
passphrase [passphrase]
prompt-for-password
security-type [fips | normal | password | nethsm]
state [string]
subject-alternative-name [string]
Show
show key
List
list key
list key [name]
Install
install key [name]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
from-editor
from-local-file [filename]
from-url [URL]
no-overwrite
Delete
delete key [name]
Description
You can use the key component to create, show, list, install, and delete cryptographic keys, and associated
cryptographic objects. The le-objects created by these operations can be used in other BigIP conguration
blocks such as ssl proles.
Examples
create key mykey
1724
Sys Crypto
Generates a 2048-bit (default-sized) RSA key le object named "mykey.key". The appropriate extension
will be added to the generated key/cert if not already a part of the provided name.
create key mykey key-type ec-private curve-name prime256v1
Generates a prime256v1 curve name EC private key le object named "mykey.key". The appropriate
extension will be added to the generated key/cert if not already a part of the provided name.
create key /myfolder/mykey
Similar to above, but creates the key "mykey.key" in folder "/myfolder" instead of the default "/Common".
The specied folder "/myfolder" must already exist in order for this operation to succeed.
create key example gen-cert gen-csr common-name "My Company Inc." country "US"
Generates a 2048-bit (default-sized) RSA key le object named "example.key" and a self signed certicate
named "example.crt". Also, a certicate signing request will be printed to the console for use in obtaining
a signed certicate from a certicate authority if desired.
create key my gen-cert gen-csr prompt-for-password common-name "My Company Inc." country
"US"
Similar to above, creates key "my.key" but also prompts for a password to be used as a challenge password
in the certicate authority signing procedure.
create key server2 gen-cert gen-csr common-name "My Company Inc." country "US" consumer
webserver
Generates a key and self signed certicate identied by server2. The consumer attribute, "webserver", is
used to cause these les to be placed directly in the paths which can be found by the BigIP's httpd.
show key
Shows the number of keys installed in the system.
list key example.key
Lists all details of the key named "example.key". A key with the specied name "example.key" in this case
must already be installed on the system in order for this operation to succeed.
list key
Lists all details of all keys installed in the system.
install key example from-editor
Opens an interactive editor session into which can be pasted a key for import into the BigIP system. A key
le-object will be created with the name example which contains the contents saved from the editor session.
install key example from-local-le /tmp/example.key
Obtains a key from the le located at /tmp/example.key.
install key example from-url http://example.com/my.key
Obtains a key from a remote host, based on the URI specied.
delete key example.key
Deletes the key "example.key" from the system.
Options
• challenge-password
Species the challenge password to create the certicate request key.
• city
Species the x509 city eld to be used in creation of the certicate associated with the given key.
1725
Traffic Management Shell (tmsh) Reference Guide
• common-name
Species the x509 common-name to be used in creation of the certicate associated with the given key.
• consumer
Species the system component by which a key and/or associated cryptographic le will be consumed.
The default behavior is to create le-objects for use by ltm components. This is the same as specifying
"ltm" for this property. If a component other than "ltm" is specied then les will be installed/created
into locations where the specied components can nd them. For example, for component "webserver",
keys and certs will be placed in the webservers ssl directories.
• country
Species the x509 country to be used in creation of the certicate associated with the given key. The
country must be a 2 letter country code.
• curve-name
Species the curve name to be used in creation of elliptic curve (EC) key. This options applies only
when generating EC keys. Default value is prime256v1.
• email-address
Species the x509 email-address to be used in creation of the certicate associated with the given key.
• from-editor
Species that the key should be obtained from a text editor session. This allows keys to be imported via
cut-n-paste from another location as long as they are in a text representation.
• from-local-le
Species a local le path from which a key is to be copied.
• from-url
Species a URI which is to be used to obtain a key for import into the conguration of the system.
The URL syntax is protocol dependent. Supported schemes are "HTTP", "HTTPS", "FTP", "FTPS" &
"FILE."
• no-overwrite
Species option of not overwriting a key if it is in the scope.
• gen-certicate
Species that in addition to generating a key, a self-signed certicate will also be created. If this option
is specied then x509 attributes should also be specied. Minimally, you must also specify a
common-name.
• gen-csr
Species that a certicate signing request should be generated along with the key. The CSR will be
displayed to the terminal for the purposes of use in getting a certicate signed by an outside authority.
X509 attributes must also be specied.
• key-size
Species the size, in bits, of the key to be generated. This option does not apply when generating EC
keys.
• key-type
Species the type of cryptographic key to be generated. Default is rsa-private.
• lifetime
Species the certicate life time to be used in creation of the certicate associated with the given key.
• organization
1726
Sys Crypto
Species the x509 organization to be used in creation of the certicate associated with the given key.
• ou
Species the x509 organizational unit to be used in creation of the certicate associated with the given
key.
• prompt-for-password
Species that a password should be prompted for and then used as a challenge password in generation
of the CSR (Certicate Signing Request).
• security-type
Species the level of security used in storing the key in question. For example a security-type of FIPS
means that the key should be stored on a FIPS card if one is available.
• state
Species the x509 state or province of the certicate associated with the given key.
• passphrase
Species an optional passphrase with which the key has been protected. It may be used by consumers
of the key in the data-plane or control-plane to decrypt it.
• subject-alternative-name
Species standard X.509 extensions as shown in RFC 2459. Allowed values e.g. DNS:example.com,
See Also
create, install, show, list, delete, tmsh
master-key
Displays the conguration of the master key for the BIG-IP(r) system.
Syntax
Display the conguration of the master-key component within the sys crypto module using the syntax in
the following section.
Display
show master-key
field-fmt
Modify
modify master-key
prompt-for-password
1727
Traffic Management Shell (tmsh) Reference Guide
Run
run master-key diagnostic
Description
You can use the master-key command to manipulate the system master key. Users with the Administrator
role or the Certicate Manager role can set the key to a value of their choosing by using the
'prompt-for-password' option during a modify operation. All other roles, including Resource Administrators,
are prohibited from setting the master key.
Use the 'diagnostic' option of the run command to test the key integrity.
Examples
show master-key
Displays, in a table, information about the system's master key.
show master-key eld-fmt
Displays, in eld format, information about the system's master key.
run master-key diagnostic
Loads the device key. Uses the device key to decrypt the master key le to test the integrity of the keys.
On success, there is no output. There will be a response only if there is an error.
modify master-key prompt-for-password
Create a master-key based on a word or phrase of your choosing. You can use this to manually synchronize
several devices without having to copy keys between them.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
pkcs12
Install pkcs12 keys and certicates on the BIG-IP(r) system.
Syntax
Install keys and certicates from pkcs12 les using the syntax in the following section.
Install
install pkcs12 [name]
consumer
[enterprise-manager | iquery | iquery-big3d | ltm | webserver]
from-local-file [filename]
from-url [URL]
1728
Sys Crypto
key-passphrase
key-security-type
[fips | password | normal]
passphrase [passphrase]
no-overwrite
Description
You can use the pkcs12 component to install cryptographic keys and certicates from pkcs12 formatted
les. The le-objects created by these operations can be used in other BigIP conguration blocks such as
ssl proles.
Examples
install pkcs12 example from-local-le /tmp/example.p12
Obtains a pkcs12 from the le located at /tmp/example.p12, and installs the key and certicate from that
le as le-objects named "example.key" and "example.crt" respectively.
install pkcs12 /myfolder/example from-local-le /tmp/example.p12
Similar to above, but installs the key "example.key" and cert "example.crt" in folder "/myfolder" instead
of the default "/Common". The specied folder "/myfolder" must already exist in order for this operation
to succeed.
install pkcs12 example prompt-for-password from-local-le /tmp/example.p12
Same as above but also prompts for a password which is to be used to decrypt the pkcs12 le.
install pkcs12 my from-url http://example.com/my.p12
Obtains a pkcs12 le from a remote host, based on the URL specied.
install pkcs12 server consumer webserver from-local-le /tmp/example.p12
Obtains a pkcs12 le from /tmp/example.p12 and installs the key and certicate from that le as le-objects
that can be used by the "webserver". The consumer attribute, "webserver", is used to cause these les to be
placed directly in the paths which can be found by the BigIP's httpd.
Options
• consumer
Species the system component by which a key and associated certicate from a PKCS12 le will be
consumed. The default behavior is to create le-objects for use by ltm components. This is the same as
specifying "ltm" for this property. If a component other than "ltm" is specied then les will be
installed/created into locations where the specied components can nd them. For example, for component
"webserver", keys and certs will be placed in the webservers ssl directories.
• from-local-le
Species a local le path from which the contents of the PKCS12 are to be read.
• from-url
Species a URI which is to be used to obtain a PKCS12 for import into the conguration of the system.
The URL syntax is protocol dependent. Supported schemes are "HTTP", "HTTPS", "FTP", "FTPS" &
"FILE."
• key-passphrase
Species the passphrase to be used to encrypt the key.
• key-security-type
Species the security type of the key. Default is set to "normal".
1729
Traffic Management Shell (tmsh) Reference Guide
• passphrase
Species the passphrase to be used to decrypt the PKCS12 le.
• no-overwrite
Species option of not overwriting key/certicate if they are in the scope.
See Also
install, tmsh
server
Manage remote crypto servers.
Syntax
Manage crypto server s using the syntax in the following section.
Create/Modify
create server [name]
modify server [name]
addr [ip address]
clients [add | delete | replace-all-with] { [ip_addr/prefixlen ...] }
clients [none]
port [integer]
profiles [add | delete | replace-all-with] { [profile_name ...] }
profiles [none]
Display
list server
list server [ [ [name] | [globl] | [regex] ] ... ]
show server
show server [ [ [name] | [globl] | [regex] ] ... ]
Delete
delete server [name]
Description
You can use the server component to manage remote crypto servers.
Examples
create server example addr 10.1.1.1 port 12100 proles add { clientssl tcp }
Creates a remote crypto server named "example" that will listen for remote crypto clients on IP address
"10.1.1.1" and port "12100". The remote crypto server will use SSL over a TCP connection to communicate
with remote crypto clients.
1730
Sys Crypto
Options
• addr
Species the IP address of the remote crypto server.
• clients
Species a list of allowed client IP addresses and subnets. An empty list allows all clients.
• port
Species the port used by the remote crypto server.
• proles
Species a list of proles that the remote crypto server will use to communicate with remote crypto
clients.
See Also
create, delete, glob, list, modify, regex, tmsh
1731
Traffic Management Shell (tmsh) Reference Guide
Sys Crypto FIPs
by-handle
Manipulates FIPS 140 keys by-handle
Syntax
Manipulate FIPS 140 keys by-handle within the sys crypto ps module using the syntax in the following
section.
Delete
delete by-handle [handle]
Description
You can use the by-handle component to manage the FIPS 140 keys by-handle.
You can determine the handle of a FIPS 140 key using the following command:
show sys crypto ps
Examples
delete by-handle 101
Deletes a FIPS 140 key given by the handle 101.
Options
For information about the options that you can use with the delete command, see help delete.
See Also
show, tmsh
external-hsm
Description
You can use the external-hsm command to set parameters about the HSM vendor name and the password
to login to the external HSM hardware.
Congures parameters for external HSM FIPS hardware.
Syntax
Congures FIPS external-hsm within the sys crypto ps module using the syntax in the following section.
Create
create external-hsm
modify external-hsm vendor [thales | safenet | none]
modify external-hsm password [password]
modify external-hsm num-threads [no. of threads]
Display
list external-hsm
list external-hsm vendor
list external-hsm password
list external-hsm num-threads
Delete
delete external-hsm
key
Displays information about FIPS keys
Syntax
Display information about key component within the sys crypto ps module using the syntax in the following
section.
Display
show key [label]
field-fmt
all-properties
include-public-keys
Description
You can use the key command to view information about private and public keys contained in the FIPS
hardware.
Examples
show key
Displays the list of all private keys stored in the FIPS hardware and their meta-data.
show key example
Displays information specically about the FIPS private key(s) which match the label "example".
1734
Sys Crypto FIPs
show key eld-fmt
Displays, in eld format, information about private keys stored in the FIPS hardware.
show key all-properties
Displays all information about the FIPS contained private keys, including: handle, a numerical value used
by the FIPS hardware to identify individual keys; modulus-length, the cryptographic modulus length of
the key; and modulus, the modulus associated with the key, displayed as a string of hex octets separated
by colons.
show key include-public-keys
Displays the list of all private and public keys stored in the FIPS hardware and their meta-data. Note that
public keys are not displayed by default and need not exist for normal operation of FIPS hardware.
Options
include-public-keys
Species that public keys should be selected for output in addition to private.
For information about the options that you can use with the command show, see help show.
See Also
show, tmsh
1735
Traffic Management Shell (tmsh) Reference Guide
Sys Daemon Log Settings
clusterd
Changes the log-level of or displays information about the daemon clusterd.
Syntax
Congure the clusterd component within the sys daemon-log-settings module using the syntax in the
following sections.
Modify
modify clusterd
log-level [critical | debug | error | informational | notice |
warning]
edit clusterd
all-properties
non-default-properties
Display
list clusterd
all-properties
non-default-properties
one-line
Description
You can use the clusterd component to change the level of the messages about the clusterd daemon that
appear in the system logs. Additionally, you can display information about the daemon.
Examples
list clusterd
Displays information about the clusterd daemon.
modify clusterd log-level critical
Changes the level of the messages about the clusterd daemon that display in the system log to critical.
Options
• log-level
Species the level of log messages for the specied daemon that you want to display in the system log.
See Also
edit, list, modify, tmsh
csyncd
Changes the log-level of or displays information about the daemon csyncd.
Syntax
Congure the csyncd component within the sys daemon-log-settings module using the syntax in the
following sections.
Modify
modify csyncd
log-level [critical | debug | error | informational | notice |
warning]
edit csyncd
all-properties
non-default-properties
Display
list csyncd
all-properties
non-default-properties
one-line
Description
You can use the csyncd component to change the level of the messages about the csyncd daemon that
appear in the system logs. Additionally, you can display information about the daemon.
Examples
list csyncd
Displays information about the csyncd daemon.
modify csyncd log-level critical
Changes the level of the messages about the csyncd daemon that display in the system log to critical.
Options
• log-level
Species the level of log messages for the specied daemon that you want to display in the system log.
1738
Sys Daemon Log Settings
See Also
edit, list, modify, tmsh
icrd
Changes or displays the audit level of the daemon icrd.
Syntax
Congure the icrd component within the sys daemon-log-settings module using the syntax in the following
sections.
Modify
modify icrd
audit [ none | modifications | all ]
edit icrd
all-properties
non-default-properties
Display
list icrd
all-properties
non-default-properties
one-line
Description
You can use the icrd component to change the audit level of the icrd daemon.
Examples
list icrd
Displays audit log level of the icrd daemon.
modify icrd audit all
Changes the audit level of the icrd daemon to all. This means that all commands executed by the icrd
daemon get audited
Options
• audit
Species the audit level of log messages for the icrd daemon in the audit logs.
See Also
edit, list, modify, tmsh
1739
Traffic Management Shell (tmsh) Reference Guide
lind
Changes the log-level of or displays information about the daemon lind.
Syntax
Congure the lind component within the sys daemon-log-settings module using the syntax in the following
sections.
Modify
modify lind
log-level [critical | debug | error | informational | notice |
warning]
edit lind
all-properties
non-default-properties
Display
list lind
all-properties
non-default-properties
one-line
Description
You can use the lind component to change the level of the messages about the lind daemon that appear in
the system logs. Additionally, you can display information about the daemon.
Examples
list lind
Displays information about the lind daemon.
modify lind log-level critical
Changes the level of the messages about the lind daemon that display in the system log to critical.
Options
• log-level
Species the level of log messages for the specied daemon that you want to display in the system log.
See Also
edit, list, modify, tmsh
1740
Sys Daemon Log Settings
mcpd
Changes the log-level of or displays information about the daemon mcpd.
Syntax
Congure the mcpd component within the sys daemon-log-settings module using the syntax in the following
sections.
Modify
modify mcpd
audit [all | disabled | enabled | verbose]
log-level [alert | critical | debug | emergency | error |
informational | notice | panic | warning]
edit mcpd
all-properties
non-default-properties
Display
list mcpd
all-properties
non-default-properties
one-line
Description
You can use the mcpd component to change the level of the messages about the mcpd daemon that appear
in the system logs. Additionally, you can display information about the daemon.
Examples
list mcpd
Displays information about the mcpd daemon.
modify mcpd log-level critical
Changes the level of the messages about the mcpd daemon that display in the system log to critical.
Options
• audit
Enables or disables auditing for the mcpd daemon, and species verbose or all as the auditing level. The
default is disabled.
• log-level
Species the level of log messages for the specied daemon that you want to display in the system log.
1741
Traffic Management Shell (tmsh) Reference Guide
See Also
edit, list, modify, tmsh
tmm
Changes the log-level of or displays information about the Trafc Management Microkernel (tmm).
Syntax
Congure the tmm component within the sys daemon-log-settings module using the syntax in the following
sections.
Modify
modify tmm
arp-log-level [debug | error | informational | notice |
warning]
http-compression-log-level [debug | error | informational |
notice | warning]
http-log-level [debug | error | informational |
notice | warning]
ip-log-level [debug | informational | notice | warning]
irule-log-level [debug | error | informational |
notice | warning]
layer4-log-level [debug | informational | notice]
net-log-level [critical | debug | error | informational |
notice | warning]
os-log-level [alert | critical | debug | emergency |
error | informational | notice | warning]
pva-log-level [debug | informational | notice]
ssl-log-level [alert | critical | debug | emergency |
error | informational | notice | warning]
edit tmm
all-properties
non-default-properties
Display
list tmm
all-properties
non-default-properties
one-line
Description
You can use the tmm component to change the level of the messages about the tmm that appear in the
system logs. Additionally, you can display information about the tmm.
Examples
list tmm
1742
Sys Daemon Log Settings
Displays information about the tmm.
modify tmm http-compression-log-level critical
Changes the level of the messages about HTTP compression that display in the system log to warning.
Options
• arp-log-level
Species the lowest level of ARP messages from the tmm daemon to include in the system log. The
default value is warning.
• http-compression-log-level
Species the lowest level of HTTP compression messages from the tmm daemon to include in the
system log. The default value is error.
• http-log-level
Species the lowest level of HTTP messages from the daemon to include in the system log. The default
value is error.
• ip-log-level
Species the lowest level of IP address messages from the tmm daemon to include in the system log.
The default value is warning.
• irule-log-level
Species the lowest level of iRule messages from the tmm daemon to include in the system log. The
default value is warning.
• layer4-log-level
Species the lowest level of Layer 4 messages from the tmm daemon to include in the system log. The
default value is notice.
• net-log-level
Species the lowest level of network messages from the tmm daemon to include in the system log. The
default value is warning.
• os-log-level
Species the lowest level of operating system messages from the tmm daemon to include in the system
log. The default value is notice.
• pva-log-level
Species the lowest level of PVA messages from the tmm daemon to include in the system log. The
default value is informational.
• ssl-log-level
Species the lowest level of SSL messages from the tmm daemon to include in the system log. The
default value is warning.
See Also
edit, list, modify, tmsh
1743
Traffic Management Shell (tmsh) Reference Guide
Sys Disk
application-volume
Congures an application volume instance.
Syntax
Congure the application-volume component in the sys disk module using the syntax shown in the following
sections.
Display
show application-volume [name]
list application-volume [name]
Delete
delete application-volume [name]
Description
The application-volume component provides better granularity for managing disks. Physical disks can
now be shared by several application-volumes. An application-volume is physically conned to one
logical disk. The visibility of the application-volume can be conned to a particular software volume set
or it can be global. No application-volume properties are allowed to be modied through tmsh or iControl(r)
interfaces.
Examples
delete application-volume mysqldb_MD1.3
Deletes an application-volume named mysqldb_MD1.3.
show application-volume mysqldb_MD1.3
Displays the conguration details of the application-volume mysqldb_MD1.3 in a table.
Option
• logical-disk [name]
Species the name of the logical disk in which the application-volume will be created.
• owner [unassigned/datastor/mysql/vcmp]
Species the owner for which this application-volume is assigned. unassigned - is the default option
and means the volume is not in use and nobody owns it.
• preservability [discardable/precious]
Species the if application-volume can be discarded by software (for example, during module
provisioning). discardable - is the default option.
• resizeable [false/true]
Species the if application-volume can potentially be resized. false - is the default option.
• size [integer]
Species the size of the application-volume.
• volume-set-visibility-restraint [name]
Species the name of the volume set to which the application-volume is constrained, if any.
See Also
delete, show, list, tmsh, sys provision, sys disk logical-disk
directory
Manages resizing of system directories.
Syntax
Congure the directory component in the sys disk module using the syntax shown in the following sections.
Modify
modify directory [directory_name]
new-size [new_size]
Show
show directory
Description
The directory component assists in resizing system directories. It allows system administrators to increase
the size of 4 system directories (/cong, /shared, /var, /var/log). This allows more exible management of
the system resources and path for growing the directory sizes on case per case basis.
Examples
modify directory /shared new-size 35000
Increases the size of /shared system directory to 35 MiB.
show directory
Displays a table with currently scheduled directories for resizing. If there are no such directories the output
is empty.
See Also
modify, show, tmsh
1746
Sys Disk
logical-disk
Manages logical disks.
Syntax
Congure the logical-disk component in the sys disk module using the syntax shown in the following
sections.
Modify
modify logical-disk [name]
vg-reserved [integer]
mode [none/mixed/datastor]
Display
list logical-disk [name]
Description
The logical-disk component provides better granularity for managing disks. A physical disk can now be
shared by one or more logical disks. A logical disk is physically conned to one physical disk.
Examples
modify logical-disk foo mode mixed vg-reserved 200
Modies the logical disk foo mode property to mixed and the vg-reserved property size to 200 MiB.
list logical-disk foo
Displays the conguration details of the logical disk named foo.
Option
• mode [none/mixed/datastor/control]
Species the current mode of the logical disk. The options are:
• control - Indicates that the logical disk is part of a RAID array.
• datastor - Indicates that the entire disk is committed to the datastor module.
• mixed - Indicates that the disk contains multiple volumes for software and/or multiple volumes for
application data.
• none - Indicates that the disk is not in use. This is the default option.
• size [integer]
Species the size (MiB) of the logical disk.
• vg-free [integer]
Species the usable free space (MiB) available in the logical disk.
• vg-in-use [integer]
1747
Traffic Management Shell (tmsh) Reference Guide
Sys File
apache-ssl-cert
Manages an Apache SSL certicate le.
Syntax
Congure the apache-ssl-cert component within the sys le module using the syntax shown in the following
sections.
Create/Modify
create apache-ssl-cert [name]
modify apache-ssl-cert [name]
source-path [URL]
Display
list apache-ssl-cert
list apache-ssl-cert [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete apache-ssl-cert [name]
Description
You can use the apache-ssl-cert component to create, delete, list or modify an SSL certicate.
Examples
create apache-ssl-cert new-cert source-path http:/cert-server/cert_store/certs/cert1.crt
Downloads the certicate from the given URL into le-store, creates an SSL certicate le named new-cert,
and saves the given URL in the source-path attribute.
create apache-ssl-cert new-cert source-path le:/shared/save/cert1.crt
Species the location of the le on the local disk (use this when the le has already been created on the
local disk).
Supported Url Format
Supported URL schemes are HTTP, HTTPS, FTP, FTPS, and FILE.
Options
• bundle-certicates
Lists data about all the certicates in the bundle, if the certicate le is a bundle; otherwise, this eld
will be none.
• certicate-key-curve-name
Species the Elliptical Curve name of the crytpographic key associated with this certicate. This eld
will be set to none if an Elliptical Curve key is not present.
• certicate-key-size
Species the number of bits in the key associated with this certicate.
• checksum
Species a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• create-time
Species the time at which the le-object was created.
• created-by
Species the user who originally created the le-object.
• expiration-date
Species the date at which this certicate expires. Stored as a POSIX time.
• expiration-string
Species a string representation of the expiration date of the certicate.
• ngerprint
Species the cryptographic ngerprint of the certicate.
• is-bundle
Species whether the certicate le is a bundle (that is, whether it contains more than one certicate).
• issuer
Species X509 information of the certicate's issuer. If the cert is a bundle, this displays the issuer
information for the primary (rst) cert in the bundle.
• key-type
Species the type of cryptographic key associated with this certicate.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• partition
Species the administrative partition where the certicate resides.
• revision
Identies the latest revision of the le. The revision starts with 1 and gets incremented on each update.
• serial-number
Species the certicate's serial number.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
1750
Sys File
This attribute takes a URL, for example:
source-path http://cert-server/cert_store/certs/vs_132.crt
source-path https://cert-server/cert_store/certs/vs_132.crt
source-path ftp://username:password@server/cert_store/certs/vs_132.crt
• subject
Species X509 information of the certicate's subject. If the cert is a bundle, this displays the subject
information for the primary (rst) cert in the bundle.
• subject-alternative-name
Species a standard X.509 extension as shown in RFC 2459.
• updated-by
Species the user who last updated the le-object.
• version
Species the X509 version of the certicate.
See Also
create, delete, glob, list, ltm prole client-ssl, ltm prole server-ssl, modify, regex, tmsh
data-group
Manages an external data group le.
Syntax
Manage the data-group component within the sys le module using the syntax shown in the following
sections.
Create/Modify
create data-group [name]
modify data-group [name]
app-service [[string] | none]
data-group-description [string]
data-group-name [name]
separator [string]
source-path [URL]
type [integer | ip | string ]
edit data-group [ [ [name] | [glob] | [regex] ] ... ]
Display
list data-group
list data-group [ [ [name] | [glob] | [regex] ] ... ]
1751
Traffic Management Shell (tmsh) Reference Guide
Delete
delete data-group [name]
Description
You can use the data-group component to create, edit, delete, list or modify an external data group le.
Examples
create data-group new-dg source-path http:/le-server/data-groups/acl.class type string
Downloads the data-group le from the given URL into le-store, creates an external-data-group le named
new-dg, and saves the given URL in the source-path attribute.
create data-group new-dg source-path http:/le-server/data-groups/acl.class type string
data-group-name dg data-group-description "created for rule xyz"
Downloads the data-group le from the given URL into le-store, creates an external-data-group le named
new-dg, saves the given URL in the source-path attribute, and creates an external data group within the
ltm data-group module named dg with the given description.
create data-group new-dg source-path le:/shared/save/Test.cls type ip
Species the location of the le on the local disk (use this when the le has already been created on the
local disk).
Supported Url Format
Supported URL schemes are HTTP, HTTPS, FTP, FTPS, and FILE.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• checksum
Species a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• created-by
Species the user who originally created the le-object.
• create-time
Species the time at which the le-object was created.
• data-group-description
Species the description of the external data group that will be created within the ltm data-group
module and reference the given data group le. This is optional in the create command.
• data-group-name
Species the name of the external data group that will be created within the ltm data-group module
and reference the given data group le. This is optional in the create command.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
1752
Sys File
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
The latest revision of the le. The revision starts with 1 and gets incremented on each update.
• separator
Species a separator to use when dening the data group. The default value is :=.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
This attribute takes a URL, for example:
source-path http://le-server/data-groups/AUL_1.cls
source-path https://le-server/data-groups/CNN.x
source-path ftp://username:password@server/data-groups/latest.class
• type
Species the kind of data in the group. This option is required by the create command.
Possible values for type are:
• integer
• ip
• string
• updated-by
Species the user who last updated the le-object.
See Also
create, delete, edit, glob, list, ltm data-group external, modify, regex, tmsh
device-capabilities-db
Manages a device capabilities DB le.
Syntax
Congure the device-capabilities-db component within the sys le module using the syntax shown in the
following sections.
Create/Modify
create device-capabilities-db [name]
modify device-capabilities-db [name]
source-path [URL]
1753
Traffic Management Shell (tmsh) Reference Guide
Display
list device-capabilities-db
list device-capabilities-db [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete device-capabilities-db [name]
Description
You can use the device-capabilities-db component to create, delete, list or modify an device capabilities
DB le.
Examples
create device-capabilities-db dcdb source-path le:/shared/images/dcdb
Loads the device capabilities le from the given path on the local disk into le-store and creates an le
named dcdb.
Options
• checksum
A cryptographic hash or checksum of the le contents for use in verication of le integrity.
• create-time
Species the time at which the le-object was created.
• created-by
Species the user who originally created the le-object.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
Species the latest revision of the le. The revision starts with 1 and gets incremented on each update.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [path]
This attribute takes an absolute path on the local disk, for example:
source-path le:/shared/images/lename
• updated-by
Species the user who last updated the le-object.
1754
Sys File
See Also
create, delete, glob, list, modify, regex, tmsh
external-monitor
Manages an external monitor le.
Syntax
Manage the external-monitor component within the sys le module using the syntax shown in the following
sections.
Create/Modify
create external-monitor [name]
modify external-monitor [name]
app-service [[string] | none]
source-path [URL]
edit external-monitor [ [ [name] | [glob] | [regex] ] ... ]
Display
list external-monitor
list external-monitor [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete external-monitor [name]
Description
You can use the external-monitor component to create, edit, delete, list or modify an external-monitor le.
Examples
create external-monitor new-mon source-path http:/le-server/external-monitors/mon_app1
Downloads the monitor le from the given URL into le-store, creates an external-monitor le named
new-mon, and saves the given URL in the source-path attribute.
create external-monitor new-mon source-path le:/shared/save/Test.mon
Species the location of the le on the local disk (use this when the le has already been created on the
local disk).
Supported Url Format
Supported URL schemes are HTTP, HTTPS, FTP, FTPS, and FILE.
1755
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• checksum
Species a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• created-by
Species the user who originally created the le-object.
• create-time
Species the time at which the le-object was created.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
The latest revision of the le. The revision starts with 1 and gets incremented on each update.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
This attribute takes a URL, for example:
source-path http://le-server/external-monitors/monitor_service
source-path https://le-server/external-monitors/custom_mon.1
source-path ftp://username:password@server/external-monitors/tested.mon
• updated-by
Species the user who last updated the le-object.
See Also
create, delete, edit, glob, list, ltm monitor external, modify, regex, tmsh
ifile
Manages an iFile le.
Syntax
Manage the ile component within the sys le module using the syntax shown in the following sections.
1756
Sys File
Create/Modify
create ifile [name]
modify ifile [name]
app-service [[string] | none]
source-path [URL]
edit ifile [ [ [name] | [glob] | [regex] ] ... ]
Display
list ifile
list ifile [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete ifile [name]
Description
You can use the ile component to create, edit, delete, list or modify an iFile le.
Examples
create ile new-ile source-path http:/tmp/text.txt
Downloads the iFile le from the given URL into le-store and creates an ile le named new-ile. Saves
the given URL in the source-path attribute.
Supported URL schemes are "HTTP", "HTTPS", "FTP", "FTPS" & "FILE"
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• checksum
A cryptographic hash or checksum of the le contents for use in verication of le integrity.
• created-by
Species the user who originally created the le-object.
• create-time
Species the time at which the le-object was created.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
1757
Traffic Management Shell (tmsh) Reference Guide
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
The latest revision of the le. The revision starts with 1 and gets incremented on each update.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
This attribute takes a URL, for example:
source-path http://le-server/iles/AUL_1.cls
source-path https://le-server/iles/CNN.x
source-path ftp://username:password@server/iles/latest.class
• updated-by
Species the user who last updated the le-object.
See Also
create, delete, edit, glob, list, ltm ile, modify, regex, tmsh
rewrite-rule
Manages a HTML content rewrite rule.
Syntax
Congure the rewrite-rule component within the sys le module using the syntax shown in the following
sections.
Create/Modify
create rewrite-rule [name]
modify rewrite-rule [name]
local-path [URL]
edit rewrite-rule [ [ [name] | [glob] | [regex] ] ... ]
Display
list rewrite-rule
list rewrite-rule [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete rewrite-rule [name]
1758
Sys File
Description
You can use the rewrite-rule component to create, edit, delete, list or modify a HTML content rewrite rule.
Examples
create rewrite-rule new-rule local-path /shared/tmp/my_rewrite_rule
Creates a new HTML content rewrite rule using le located by local-path and saves path in the local-path
attribute.
Options
• checksum
Species a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• created-by
Species the user who originally created the le-object.
• create-time
Species the time at which the le-object was created.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
Species the latest revision of the le. The revision starts with 1 and gets incremented on each update.
• size
Species the size (in bytes) of the le associated with this le object.
• local-path [path]
This attribute takes a path, for example:
local-path /shared/tmp/my_rewrite_rule
• updated-by
Species the user who last updated the le-object.
See Also
create, delete, edit, glob, list, ltm prole html, modify, regex, tmsh
ssl-cert
Manages a SSL certicate le.
Syntax
Congure the ssl-cert component within the sys le module using the syntax shown in the following
sections.
1759
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create ssl-cert [name]
modify ssl-cert [name]
app-service [[string] | none]
source-path [URL]
edit ssl-cert [ [ [name] | [glob] | [regex] ] ... ]
Display
list ssl-cert
list ssl-cert [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete ssl-cert [name]
Description
You can use the ssl-cert component to create, edit, delete, list or modify an SSL certicate.
Examples
create ssl-cert new-cert source-path http:/cert-server/cert_store/certs/cert1.crt
Downloads the certicate from the given URL into le-store, creates an SSL certicate le named new-cert,
and saves the given URL in the source-path attribute.
create ssl-cert new-cert source-path le:/shared/save/cert1.crt
Species the location of the le on the local disk (use this when the le has already been created on the
local disk).
Supported Url Format
Supported URL schemes are HTTP, HTTPS, FTP, FTPS, and FILE.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• bundle-certicates
Species a list of data about all the certicates in the bundle, if the certicate le is a bundle; otherwise,
this eld will be none.
• certicate-key-size
Species the number of bits in the key associated with this certicate.
• checksum
1760
Sys File
Species a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• create-time
Species the time at which the le-object was created.
• created-by
Species the user who originally created the le-object.
• expiration-date
Species the date at which this certicate expires. Stored as a POSIX time.
• expiration-string
Species a string representation of the expiration date of the certicate.
• ngerprint
Species the cryptographic ngerprint of the certicate.
• is-bundle
Species whether the certicate le is a bundle (that is, whether it contains more than one certicate).
• issuer
Species X509 information of the certicate's issuer. If the cert is a bundle, this displays the issuer
information for the primary (rst) cert in the bundle.
• key-type
Species the type of cryptographic key associated with this certicate.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
Species the latest revision of the le. The revision starts with 1 and gets incremented on each update.
• serial-number
Species the certicate's serial number.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
This attribute takes a URL, for example:
source-path http://cert-server/cert_store/certs/vs_132.crt
source-path https://cert-server/cert_store/certs/vs_132.crt
source-path ftp://username:password@server/cert_store/certs/vs_132.crt
• subject
Species X509 information of the certicate's subject. If the cert is a bundle, this displays the subject
information for the primary (rst) cert in the bundle.
• subject-alternative-name
Species a standard X.509 extension as shown in RFC 2459.
• updated-by
1761
Traffic Management Shell (tmsh) Reference Guide
Species the user who last updated the le-object.
• version
Species the X509 version of the certicate.
See Also
create, delete, edit, glob, list, ltm prole client-ssl, ltm prole server-ssl, modify, regex, tmsh
ssl-crl
Manages a SSL CRL le.
Syntax
Congure the ssl-crl component within the sys le module using the syntax shown in the following sections.
Create/Modify
create ssl-crl [name]
modify ssl-crl [name]
app-service [[string] | none]
source-path [URL]
edit ssl-crl [ [ [name] | [glob] | [regex] ] ... ]
Display
list ssl-crl
list ssl-crl [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete ssl-crl [name]
Description
You can use the ssl-crl component to create, edit, delete, list or modify an SSL CRL le.
Examples
create ssl-crl new-crl source-path http:/cert-server/cert_store/CRLs/latest.crl
Downloads the CRL le from the given URL into le-store, creates an SSL CRL le named new-crl, and
saves the given URL in the source-path attribute.
create ssl-crl new-crl source-path le:/shared/save/copy_10.crl
Species the location of the le on the local disk (use this when the le has already been created on the
local disk).
1762
Sys File
Supported Url Format
Supported URL schemes are HTTP, HTTPS, FTP, FTPS, and FILE.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• checksum
Species a cryptographic hash or checksum of the le contents for use in verication of le integrity.
• created-by
Species the user who originally created the le-object.
• create-time
Species the time at which the le-object was created.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• revision
Species the latest revision of the le. The revision starts with 1 and gets incremented on each update.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
This attribute takes a URL, for example:
source-path http://cert-server/cert_store/CRLs/backup_10.crl
source-path https://cert-server/cert_store/CRLs/jan_2010.crl
source-path ftp://username:password@server/cert_store/CRLs/latest.crl
• updated-by
Species the user who last updated the le-object.
See Also
create, delete, edit, glob, list, ltm prole client-ssl, ltm prole server-ssl, modify, regex, tmsh
ssl-key
Manages a SSL certicate key le.
Syntax
Congure the ssl-key component within the sys le module using the syntax shown in the following sections.
1763
Traffic Management Shell (tmsh) Reference Guide
Create/Modify
create ssl-key [name]
modify ssl-key [name]
app-service [[string] | none]
source-path [URL]
passphrase [passphrase]
edit ssl-key [ [ [name] | [glob] | [regex] ] ... ]
Display
list ssl-key
list ssl-key [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete ssl-key [name]
Description
You can use the ssl-key component to create, edit, delete, list or modify an SSL certicate key le.
Examples
create ssl-key new-key source-path http:/cert-server/cert_store/certs/cert1.key
Downloads the certicate-key le from the given URL into le-store and creates an SSL certicate key
le named new-key. Saves the given URL in the source-path attribute.
create ssl-key new-key source-path le:/shared/save/cert1.key
Species the location of the le on the local disk. Use this when the le has already been created on the
local disk.
Supported Url Format
Supported URL schemes are HTTP, HTTPS, FTP, FTPS, and FILE.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• checksum
A cryptographic hash or checksum of the le contents for use in verication of le integrity.
• create-time
Species the time at which the le-object was created.
• created-by
Species the user who originally created the le-object.
1764
Sys File
• key-size
Species the size of the cryptographic key associated with this le object, in bits.
• key-type
Species the cryptographic type of the key in question. That is, which algorithm this key is compatible
with.
The options are:
• rsa-private
The key is an RSA private key.
• dsa-private
The key is a DSA based private key.
• last-update-time
Species the last time at which the le-object was updated/modied.
• mode
Species the UNIX le permissions mode for the le associated with this le-object as a numerical
value.
• passphrase [passphrase]
Species an optional passphrase with which the key has been protected. It may be used by consumers
of the key in the data-plane or control-plane to decrypt it.
• revision
Species the latest revision of the le. The revision starts with 1 and gets incremented on each update.
• security-type
Species the type of security used to handle or store the key.
The options are:
• normal
The key resides in a standard form on the le-system. This is the default value.
• ps
The key is protected by a FIPS device on the system and is only applicable to devices with FIPS
support.
• password
Species that the key is protected by a passphrase and stored in encrypted form.
• nethsm
The key is protected by a FIPS device outside the system.
• size
Species the size (in bytes) of the le associated with this le object.
• source-path [URL]
This attribute takes a URL, for example:
source-path http://cert-server/cert_store/certs/vs_132.key
source-path https://cert-server/cert_store/certs/vs_132.key
source-path ftp://username:password@server/cert_store/certs/vs_132.key
1765
Traffic Management Shell (tmsh) Reference Guide
• updated-by
Species the user who last updated the le-object.
See Also
create, delete, edit, glob, list, ltm prole client-ssl, ltm prole server-ssl, modify, regex, tmsh
1766
Sys File
Sys FPGA
firmware-config
Congures the FPGA rmware to be used by the system.
Syntax
Congure the rmware-cong component within the sys fpga module using the syntax shown in the
following sections.
Modify
modify firmware-config
type [ l4-performance-fpga | l7-intelligent-fpga | standard-balanced-fpga
]
Display
list firmware-config
all-properties
non-default-properties
one-line
Description
You can use the rmware-cong component to congure the PFGA rmware type to use.
Examples
list rmware-cong
Displays properties of the current FPGA rmware conguration.
modify rmware-cong type
Modify the type of the current FPGA rmware conguration. The default is standard-balanced-fpga.
Options
• type
The type for FPGA rmware current used on the system.
l4-performance-fpga: High throughput fpga rmware. l7-intelligent-fpga: eFAD and L7 intelligent fpga
rmware. standard-balanced-fpga: The balanced standard fpga rmware.
See Also
list, modify, tmsh, fpga
info
Displays current FPGA (Field-Programmable Gate Array) rmware information on the system.
Syntax
Displays current info component within the sys fpga module using the syntax in the following section.
Display
show info
all-properties
field-fmt
Description
You can use the info component to display the current FPGA rmware information on the system.
Examples
show info
Displays current FPGA (Field-Programmable Gate Array) rmware information on the system
See Also
show, tmsh, fpga
1768
Sys FPGA
Sys iCall
event
Generate an Event on the BIG-IP(r) system.
Syntax
Generate the event component within the sys icall module using the syntax shown in the following sections.
Generate
generate event
name [string]
context {
{
name [string]
value [string}
}
}
Description
You may use the generate event command to construct a free-form Event in the system which will be sent
to interested Event Handlers.
Examples
generate event name EMPLOYEE context { { rst_name Sam } { last_name Shepard } }
Construct an event named "EMPLOYEE" that contains two pieces of information as name/value pairs. An
Event Handler must be subscribed to the event by the name "EMPLOYEE" or by both event name and all
the contexts in a context group.
Options
• context
Species a set of name/value pairs that convey the information of the Event.
• name
The Events name; does not have to be unique, but may not be empty.
See Also
create, delete, edit, list, modify, show, sys icall event-handler, sys icall script, tmsh
istats-trigger
Congure an iStats trigger to generate a user dened event for the iCall feature on the BIG-IP(r) system.
Syntax
Modify the istats-trigger component within the sys icall module using the syntax shown in the following
sections.
Create/Modify
create istats-trigger [name]
modify istats-trigger [name]
description [string]
duration [integer]
event-name [string]
istats-key [string]
range-max [integer]
range-min [integer]
repeat [integer]
mv istats-trigger [ [ [source-name] [destination-name] ] |
[ [name] to-folder [folder-name] ] |
[ [name...name] to-folder [folder-name] ] ]
to-folder
Display
list istats-trigger
list istats-trigger [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete istats-trigger [name]
Description
You can create an istats-trigger to automatically generate a Control Plane iRules event under the conditions
specied in the properties.
Examples
mv istats-trigger /Common/my_istats_trigger to-folder /Common/my_folder
Moves an istats-trigger named my_istats_trigger to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• description
1770
Sys iCall
A user dened description of the item.
• duration
Duration in seconds. The value "0" means trigger instantly when in range.
• event-name
The name of the event that will be generated.
• istats-key
Specify the items and thresholds to dene when this istats-trigger will generate an event.
• range-max
Trigger event only if value is less-than-or-equal to range-max.
• range-min
Trigger event only if value is greater-than-or-equal to range-min. Note that if 0 is included in the specied
range, then the iStats key must be explicitly initialized with istats set [key] 0 in order for the trigger to
re.
• repeat
Repeat interval in seconds. The value "none" means do not resend the event unless the value falls outside
the range and then re-enters it.
• to-folder
An istats-trigger can be moved to any folder under /Common, but conguration dependencies may
restrict it from moving out of /Common.
See Also
create, delete, edit, list, modify, mv, show, sys icall event, sys icall event-handler, sys icall script, tmsh
publisher
Show the services publishing events on a BIG-IP(r) system
Syntax
Show the available publishers within the sys icall module using the syntax shown in the following sections.
Display
show publisher [ field-fmt ]
show publisher [ [ [name] | [glob] | [regex] ] ... ] [ field-fmt ]
Description
This command lets you display the publishers on the system, as well as the events that they publish and the
contexts that those events are guaranteed to contain.
By default these are shown in a tabular form; use the eld-fmt option to show them in a format similar to
listing other objects in tmsh.
If a published event includes no contexts, then a single line will be shown with a - in the context column.
If a publisher publishes no events, then a single line will be shown with a - in the event column.
1771
Traffic Management Shell (tmsh) Reference Guide
Options
• eld-fmt
By default, the events will be shown in a tabular format. This overrides the command to print the
publishers in object format like the list command does for other objects.
See Also
show, tmsh, sys icall event, sys icall handler periodic, sys icall handler perpetual, sys icall handler triggered,
sys icall istats-trigger, sys icall script
script
Manage a Tcl script used by handlers during execution on the BIG-IP(r) system.
Syntax
Manage the script component within the sys icall module using the syntax shown in the following sections.
Create/Modify/Edit
create script [name]
modify script [name]
edit script [name]
definition
description [string]
events [add | delete | modify | replace-all-with] {
[event name] {
contexts [add | delete | modify | replace-all-with] {
[context name]
}
}
}
mv script [ [ [source-name] [destination-name] ] |
[ [name] to-folder [folder-name] ] |
[ [name...name] to-folder [folder-name] ] ]
to-folder
Display
list script
list script [name]
Delete
delete script [name]
Note: You must remove all references to the icall script before deletion.
1772
Sys iCall
Description
You can use this script component to manage Tcl scripts which are used by event handlers upon execution.
Caution: if you add a handler to a shared conguration on a set of BIG-IP appliances, then care must be
used in making changes to conguration items. A handler's script which makes cong changes on more
than one device may cause inconsistencies that must be manually resolved.
Examples
create script my_script1
Create a new icall script item called "my_script1". Upon pressing enter, the user will enter the text editor
in order to edit the Tcl script. Note that this conguration item may only be modied while in the edit view.
mv script /Common/my_script to-folder /Common/my_folder
Moves an icall script named my_script to a folder named my_folder, where my_folder has already been
created and exists within /Common.
Options
• denition
Holds the Tcl code.
• description
User dened description.
• events
Register events with the system that this script creates.
• to-folder
An icall script can be moved to any folder under /Common, but conguration dependencies may restrict
it from moving out of /Common.
Event Accessors
In addition to all the tmsh:: commands provided by the system to use in the Tcl scripts (please see help cli
script), the commands below are provided to access event specic information.
Hint: When you use a tmsh:: command, call it inside of Tcl catch to receive any error messages returned,
and to allow the script to exit gracefully if needed. Without Tcl catch, the script may crash and end the
process.
The following Tcl variables may be used in triggered handlers. (The $ is not part of the variable name but
is the lookup operator for the Tcl variable.):
$EVENT::context([name])
An array variable containing the value of each context, keyed by the context name.
$EVENT::creation_time
The date and time the event was generated.
$EVENT::event_name
The name of the event that was generated.
$EVENT::handler_name
The name of the event handler that matched the event being handled.
$EVENT::script_name
1773
Traffic Management Shell (tmsh) Reference Guide
The name of the currently running script.
For use in perpetual handlers:
EVENT::get_next [ -timeout [milliseconds] ]
The timeout parameter is optional. If the timeout is set, then EVENT::get_next will return 0 if no event
matches before the timeout hits. Otherwise, the EVENT::get_next will return 1, and the above variables
in the EVENT:: namespace will be replaced with the data from the new event.
Script Examples
The following script will print out all the information of an event.
puts "*** start of event ***"
foreach var [info vars EVENT::*] { set varname [namespace tail $var] if { [array exists $var] } { puts
"$varname: " foreach { k v } [array get $var] { ;#k = key v = value puts "$k:$v" } } else { puts "$varname:
[set $var]" } }
The next script will allow events to hold bash commands and have the script execute them. The script would
be required to run inside an event handler that subscribed to the appropriate event and ltered on the words
"utility" and "arguments".
set bash_cmd $EVENT::context(utility) append bash_cmd " " $EVENT::context(arguments)
if { [catch { exec /bin/bash -c $bash_cmd } result] } { puts "error executing bash command: $bash_cmd"
} else { puts $result }
See Also
cli script, create, delete, edit, list, modify, show, sys icall event, sys icall event-handler, tmsh
1774
Sys iCall
Sys iCall Handler
periodic
Make or congure a periodic handler for the BIG-IP(r) system.
Syntax
Modify the periodic component within the sys icall handler module using the syntax shown in the following
sections.
Create/Modify
create periodic [name]
modify periodic [name]
arguments {
{
name [string]
value [string]
}
...
}
description [string]
first-occurrence [date/time]
interval [integer]
last-occurrence [date/time]
script [script name]
status [active | inactive]
mv periodic [ [ [source-name] [destination-name] ] |
[ [name] to-folder [folder-name] ] |
[ [name...name] to-folder [folder-name] ] ]
to-folder
Display
list periodic
list periodic [ [ [name] | [glob] | [regex] ] ... ]
show periodic
show periodic [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete periodic [name]
Description
You can create a periodic handler to run scripts automatically based on clock time.
Examples
create periodic my_handler1 script script1 rst-occurrence now+1h interval 45 arguments { { name
user value j.han } { name role value manager } }
Create a new periodic handler that will execute script1 every 45 seconds. The handler will wait one hour
before beginning, but continue to execute indenitely. Each 45 seconds, when the script executes, the
provided arguments will be passed into the script as EVENT::context(<name>) data.
mv periodic /Common/my_periodic to-folder /Common/my_folder
Moves a periodic icall handler named my_periodic to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• arguments
Species a set of name/value pairs that will be passed to the script at the start of each execution on each
interval.
The use of arguments is optional and may be changed at any time.
• description
A user dened description of the item.
• rst-occurrence
A specic date and time for this handler to begin executing. If not specied, the current date and time
of creation will be used.
• interval
The number of seconds between each time this handler should execute.
• last-occurrence
A specic date and time for this handler to stop executing. If not specied, the script will run indenitely.
• script
The iCall Tcl script the handler when execute at each time interval. Note that this script must be an
object in sys icall script; a cli script will not work.
• status
Specify either active or inactive. Active is the default value.
When the handler status is active, the handler accepts events and executes the script as expected. However,
when the status is inactive, the handler will no longer accept incoming events and the script will not
execute. Use the inactive status when you wish to keep the handler as a conguration item and do not
wish to delete it, but also do not wish the handler to run.
• to-folder
A periodic icall handler can be moved to any folder under /Common, but conguration dependencies
may restrict it from moving out of /Common.
See Also
create, delete, edit, list, modify, mv, show, sys icall event, sys icall script, tmsh
1776
Sys iCall Handler
perpetual
Make or congure a perpetual handler for the BIG-IP(r) system.
Syntax
Modify the perpetual component within the sys icall handler module using the syntax shown in the following
sections.
Create/Modify
create perpetual [name]
modify perpetual [name]
description [string]
script [script name]
status [active | inactive | suspend ]
subscriptions [add | delete | modify | replace-all-with] {
[subscription name] {
event-name [event name]
filters [add | delete | modify | replace-all-with] {
[filter name] {
value [string]
match-algorithm [accept-all | exact | glob | regex | subnet]
}
}
}
}
restart perpetual [name]
start perpetual [name]
stop perpetual [name]
mv perpetual [ [ [source-name] [destination-name] ] |
[ [name] to-folder [folder-name] ] |
[ [name...name] to-folder [folder-name] ] ]
to-folder
Display
list perpetual
list perpetual [ [ [name] | [glob] | [regex] ] ... ]
show perpetual
show perpetual [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete perpetual [name]
Description
You can create a perpetual handler to run continuously executing code and to receive events by specifying
subscriptions.
1777
Traffic Management Shell (tmsh) Reference Guide
Examples
create perpetual my_handler1 script script1 subscriptions add { sub1 { event-name LTM_POOL_UP
} }
Creates a new perpetual handler run the program dened in "script1". Anytime an event called
"LTM_POOL_UP" is generated in the system, a copy will be sent to my_handler1.
mv perpetual /Common/my_perpetual to-folder /Common/my_folder
Moves a perpetual icall handler named my_perpetual to a folder named my_folder, where my_folder has
already been created and exists within /Common.
Options
• description
A user dened description of the item.
• script
The iCall Tcl script the handler will execute upon creation. The user is responsible for creating a script
with perpetual execution. If the script is changed, the handler will not change its executing code until
the handler is restarted or put into inactive and then active status.
Note that this script must be an object in sys icall script; a cli script will not work.
• status
Specify active, inactive, or suspend. Active is the default value.
Inactive status indicated that the handler is to no longer execute and to no longer receive events. The
handler's state is lost and all pending events are deleted. Use this status to eliminate a handler in the
system but to keep its information stored.
The handler may also be set to suspend which will keep the handler script executing, but the system will
send no new events to the handler. Events waiting to be processed remain in queue.
• subscriptions
Create one or more subscription items to specify the conditions of this handler's execution. The handler
subscribes generally to events by the event name, and specically to data by using lters. The use of
lters is optional.
The handler will be sent events by the system as dened by the subscription property, but the code inside
the handler must use EVENT::get_next function in order to receive the data into the handler. See sys
icall script for more information.
• to-folder
A perpetual icall handler can be moved to any folder under /Common, but conguration dependencies
may restrict it from moving out of /Common.
See Also
create, delete, edit, list, modify, mv, show, sys icall event, sys icall script, tmsh
triggered
Make or congure an event-triggered handler for the BIG-IP(r) system.
1778
Sys iCall Handler
Syntax
Modify the triggered component within the sys icall handler module using the syntax shown in the following
sections.
Create/Modify
create triggered [name]
modify triggered [name]
description [string]
script [script name]
status [active | inactive]
subscriptions [add | delete | modify | replace-all-with] {
[subscription name] {
event-name [event name]
filters [add | delete | modify | replace-all-with] {
[filter name] {
value [string]
match-algorithm [accept-all | exact | glob | regex | subnet]
}
}
}
}
mv triggered [ [ [source-name] [destination-name] ] |
[ [name] to-folder [folder-name] ] |
[ [name...name] to-folder [folder-name] ] ]
to-folder
Display
list triggered
list triggered [ [ [name] | [glob] | [regex] ] ... ]
show triggered
show triggered [ [ [name] | [glob] | [regex] ] ... ]
Delete
delete triggered [name]
Description
You can create a triggered handler to automatically run a script when a specied event occurs.
Examples
create triggered my_handler1 script script1 subscriptions add { pools { event-name LTM_POOL_UP
lters add { pool_name { value pool1 } node_name { value node1 } } } }
Creates a new triggered handler that will execute the script called "script1" when an event called
"LTM_POOL_UP" is generated in the system and contains the contexts { pool_name, pool1 } and {
node_name, node1 }.
mv triggered /Common/my_triggered to-folder /Common/my_folder
Moves a triggered icall handler named my_triggered to a folder named my_folder, where my_folder has
already been created and exists within /Common.
1779
Traffic Management Shell (tmsh) Reference Guide
Options
• description
A user dened description of the item.
• script
The iCall Tcl script the handler will execute when invoked by an appropriate event. Note that this script
must be an object in sys icall script; a cli script will not work.
• status
Specify either active or inactive. Active is the default value.
When the handler status is active, the handler accepts events and executes the script as expected. However,
when the status is inactive, the handler will no longer accept incoming events and the script will not
execute. Use the inactive status when you wish to keep the handler as a conguration item and do not
wish to delete it, but also do not wish the handler to run.
• subscriptions
Specify one or more subscriptions to dene the conditions of this handler's execution. The handler
subscribes generally to events by the event name, and specically to data by using lters. The use of
lters is optional.
A handler that species more than one subscription will execute when any one subscription is matched
to an event.
• to-folder
A triggered icall handler can be moved to any folder under /Common, but conguration dependencies
may restrict it from moving out of /Common.
See Also
create, delete, edit, list, modify, mv, show, sys icall event, sys icall script, tmsh
1780
Sys iCall Handler
Sys IPFIX
destination
Displays or resets statistics for IPFIX log destinations.
Syntax
Specify the destination within the sys ipx module using the syntax in the following section.
Modify
reset-stats destination [name]
Display
show destination [name]
Description
You can use the destination component to display IPFIX destination statistics, like Templates and Data
Record counts. You can also reset the IPFIX destination statistics to zero at any time.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys log-cong destination ipx, sys ipx irules, sys ipx element, tmsh
element
Congures element for IPFIX logging.
Syntax
Congure the IPFIX component within the sys ipx module using the syntax shown in the following
sections.
Create/Modify
create element [name]
modify element [name]
all
app-service [[string] | none]
data-type
[ boolean | datetime-microseconds |
datetime-milliseconds | datetime-nanoseconds |
datetime-seconds | float32 | float64 |
ipv4-address | ipv6-address | macaddress |
octetarray | signed16 | signed32 | signed64 |
signed8 | string |
unsigned16 | unsigned32 |
unsigned64 | unsigned8 ]
description [string]
enterprise-id [integer]
id [integer]
size [integer]
Display
list element
list element [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete element [name]
Note: Default elements loaded at boot time may not be deleted.
Description
You can use the element component to congure elements for the IPFIX logging interface.
Examples
create element myelement id 345 enterprise-id 543 data-type string size 128
Creates a element named myelement with element id 345, enterprise-id 543, data-type string and data size
of 128.
delete element myelement
Deletes the element named myelement.
list element myelement
Displays properties of the element named myelement.
Options
• all
Species that you want to modify all of the existing components of the specied type.
1782
Sys IPFIX
• app-service
Species the name of the application service to which the element belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the element. Only the application service can modify or delete the element.
• data-type
Species the data type of the element.
• description
User dened description.
• enterprise-id
Species the enterprise-id for the IPFIX element being congured between 0 and 4294967295. An
enterprise id value of 0 is used to dene standardized IANA Information Elements.
• id
Species the element id for the IPFIX element being congured between 1 and 65535. Values greater
than 32767 will be considered NETFLOW-only Information Elements; since the high bit of the 16-bit
value is set for those values.
• size
Species the IPFIX element data size between 1 and 1900 for data-types octetarray and string. The
default is 0; and means variable for these two data-types.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique alphanumeric name for the component. Preferably camel casing. This option is
required for the commands create, delete, and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, modify, regex, tmsh
irules
Displays or resets statistics for irules that use IPFIX logging destinations.
Syntax
Specify the irules component within the sys ipx module using the syntax in the following section.
Modify
reset-stats irules
1783
Traffic Management Shell (tmsh) Reference Guide
Display
show irules
Description
You can use the irules component to display a global set of statistics for the iRules that use IPFIX
destinations, like memory allocation and outstanding counts for templates, messages and destinations. You
can also reset the IPFIX iRules statistics to zero at any time.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys log-cong destination ipx, sys ipx destination, sys ipx element, tmsh
1784
Sys IPFIX
Sys Log Config
filter
Congures the lter component which lters out log messages for distribution by the publisher component.
Syntax
Congure the lter component within the sys log-cong module using the syntax shown in the following
sections.
Create/Modify
create filter [name]
modify filter [name]
all
app-service [[string] | none]
description [string]
level [ alert | crit | debug | emerg | err | info | notice | warn ]
message-id [ 8 digit hex number | none ]
publisher [[string] | none]
source [ accesscontrol | accessperrequest | adapt | alertd | all |
apmacl | arp | avr |
based | bcm56xxd | bdosd | big3d | big3dshim | bigd | bigdb
| bigdbd | bigpipe |
bigstart | bp | checkcert | chmand | cifs | clusterd | coapi
| common |
common-f5logging | common-fpdd | config-db | connapi | cs |
cssd | csyncd |
daemon | deflate | devmgmtd | diameter | dmon | dosprotect |
dummy | dwbld |
eca | em-admin | em-alert | em-clientlib | em-common | em-device
| em-discovery |
em-file | em-lib | em-report | em-stats | em-swim | errdefsd
| eventd | evrouted |
fflag | fips | firewall-FQDN | fix | get-dossier | gtmd | gtp
| guestagentd | ha |
ha-table | halmsg | hostagentd | http | hwctl | hwpd | icrd
| ip | ipfix |
ipfix-proxy | ipfixirules | iprepd | ipsec | isession | istatsd
| ivs | lacpd |
layer4 | libhal | lind | lldpd | lopd | lsn | lsnapi |
mamidbridged | map |
mapi | mcp | mcpd | mgmt-acld | mr | mrsip | msgbusd | mysqlhad
| net |
network | no-source | packet-filter | pccd | pcp | pem | pfmand
| pgadmind |
pkcs11d | pktclass | plugin | policy | portal-access | pptp
| probe-plusplus |
promptstatusd | pva | pvad | radius | ramcache | rba | rewrite
| rtsp | rules |
saspd | scim | scriptd | sctp | sdmd | sflow | shell | shmmapd
| snmp | sod |
spolicy | ssl | sso | stated | statsd | statusd | stpd |
subagents | swg |
syscall | system-check | tamd | tcl-checker | tcpdump | tftp
| tmm | tmm-tcp |
tmrouted | tmsh | ts | tunnel | urlc | urldb | urldbmgrd |
vcmpd | vxland |
websso | woc-plugin | wr-urldbd | xconfig | xdb | zfd | zxfrd
]
Display
list filter
list filter [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete filter [name]
Description
You can use the lter component to congure the lters for the common logging interface.
Examples
create lter my_lt publisher my_pub
Creates a lter named my_lt with the publisher my_pub.
delete lter my_lt
Deletes the lter named my_lt.
list lter my_lt
Displays properties of the lter named my_lt.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the lter belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the lter. Only the application service can modify or delete the lter.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• level
The minimum severity level of logs to be ltered. The severity levels in increasing order are debug,
info, notice, warn, err, crit, alert, and emerg. The default value is debug.
• message-id
1786
Sys Log Config
A renement for ltering out specic logs. The default value is none. This is an eight digit hex number.
The proper hex value can be obtained from an existing log message by extracting the eight digit value.
For example, the message-id for the example log message below is highlighted.
Oct 9 15:38:20 bigip1 notice mcpd[21498]: 01070410:5: Removed subscription with subscriber id
logstatd
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• publisher
A publisher to send ltered log messages. The default value is none.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• source
The stream of log messages that will be ltered by the created/modied lter. The default value is all.
See Also
create, delete, glob, list, modify, regex, tmsh
publisher
Congures lists of destinations for the common logging interface.
Syntax
Congure the publisher component within the sys log-cong module using the syntax shown in the following
sections.
Create/Modify
create publisher [name]
modify publisher [name]
all
app-service [[string] | none]
description [string]
destinations [add | delete | none | replace-all-with] {
[ [destinations] ]
}
Display
list publisher
list publisher [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
1787
Traffic Management Shell (tmsh) Reference Guide
Delete
delete publisher [name]
Note: You must remove all references to a publisher before you can delete the publisher. Default publishers
may not be deleted.
Description
You can use the publisher component to congure publishers for the common logging interface.
Examples
create publisher my_pub destinations add { destination_1 destination_2 }
Creates a publisher named my_pub with two destinations, destination_1 and destination_2.
delete publisher my_pub
Deletes the publisher named my_pub.
list publisher my_pub
Displays properties of the publisher named my_pub.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the publisher belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the publisher. Only the application service can modify or delete the publisher.
• description
User dened description.
• destinations
Adds, deletes, or replaces a set of destinations.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, modify, regex, tmsh
1788
Sys Log Config
Sys Log Config Destination
alertd
Modify the AlertD destination.
Syntax
Modify the AlertD component within the sys log-cong destination module using the syntax shown in the
following sections.
Modify
modify alertd [name]
options:
all
description [string]
Display
list alertd
list alertd [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Note: There is only one AlertD destination, alertd; this destination cannot be created or deleted.
Description
You can use this destination component to modify the AlertD destination for the common logging interface.
There is only one AlertD destination; it cannot be deleted. You can use this destination to send logs directly
to the AlertD daemon, bypassing syslog-ng.
Examples
list alertd alertd
Displays properties of the AlertD destination.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the modify command.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
glob, list, modify, regex, tmsh
arcsight
Formats incoming logs into the ArcSight format for delivery by a forwarding destination.
Syntax
Congure the ArcSight component within the sys log-cong destination module using the syntax shown
in the following sections.
Create/Modify
create arcsight [name]
modify arcsight [name]
all
app-service [[string] | none]
description [string]
forward-to [string]
Display
list arcsight
list arcsight [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete arcsight [name]
Note: You must remove all references to a destination before you can delete the destination. Default
destinations may not be deleted.
1790
Sys Log Config Destination
Description
You can use this destination component to create ArcSight formatting destinations for the common logging
interface. ArcSight log destinations currently only deliver log messages from the Network Firewall Module
or the Application Security Module.
Examples
create arcsight my_dest forward-to another_dest
Creates an ArcSight destination named my_dest which forwards to another destination another_dest.
another_dest must be a Local Syslog, Local Database, Remote Syslog, or Remote High Speed Log destination.
delete arcsight my_dest
Deletes the destination named my_dest. Destinations cannot be deleted when in use by a publisher.
list arcsight my_dest
Displays properties of the destination named my_dest.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the destination belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the destination. Only the application service can modify or delete the destination.
• description
User dened description.
• forward-to
Species a Local Syslog, Local Database, Remote Syslog, or Remote High Speed Log destination. This
is required for the create and modify commands.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, modify, regex, tmsh
1791
Traffic Management Shell (tmsh) Reference Guide
ipfix
Formats log messages into IPFIX messages and sends them to a specied pool of IPFIX Collectors
Syntax
Create/Modify
create ipfix [name]
modify ipfix [name]
all
app-service [[string] | none]
description [string]
pool-name [string]
protocol-version [ipfix | netflow-9]
template-delete-delay [integer]
template-retransmit-interval [integer]
transport-profile [profile name]
serverssl-profile [profile name]
Display
list ipfix
list ipfix [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete ipfix [name]
Note: You must remove all references to a destination before you can delete the destination. Default
destinations may not be deleted.
Description
You can use this destination component to create IPFIX forwarding destinations for the common logging
interface.
The IPFIX protocol is designed for logging IP-transmission events. RFC 5101
(http://tools.ietf.org/html/rfc5101) species the protocol, and RFC 5102 (http://tools.ietf.org/html/rfc5102)
describes the information model for IPFIX logs. IPFIX logs are raw, binary-encoded strings with their elds
and eld lengths dened by IPFIX templates. IPFIX collectors are external devices that can receive IPFIX
templates and use them to interpret IPFIX logs.
Examples
create ipx my_dest pool-name my_pool
Creates a destination named my_dest which sends IPFIX messages to the pool named my_pool.
delete ipx my_dest
1792
Sys Log Config Destination
Deletes the destination named my_dest. Destinations cannot be deleted when in use by a publisher or another
destination.
list ipx my_dest
Displays properties of the destination named my_dest.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the destination belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the destination. Only the application service can modify or delete the destination.
• description
A user dened description for this logging destination.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• pool-name
Species the LTM pool that receives messages from the IPFIX destination. This option is required for
the create command. The pool should contain one or more IPFIX collectors; use the ltm pool component
to set up an LTM pool.
• protocol-version
Species the protocol version used to encode IPFIX messages sent by this logging destination. The
possible values are ipx and netow-9. The default is ipx.
• template-delete-delay
This feature is not implemented.
• template-retransmit-interval
Species the time interval, in seconds, after which this IPFIX logging destination must resend all active
IPFIX Templates to the pool of IPFIX collectors.
The logging destination periodically retransmits all of its IPFIX templates at the interval you set in this
property. These retransmissions can be helpful if the transport-prole is UDP, a lossy transport
mechanism. They can also be useful for debugging a network session with a network analyzer, such as
Wireshark.
The default value is 30 seconds.
• transport-prole
Species the name of a prole for the transport protocol to be used by this IPFIX logging destination.
You can use any existing TCP-based or UDP-based prole. The default value is the default udp prole.
You can use the ltm prole tcp command (see ltm prole tcp) to create a TCP prole, or ltm prole
udp (see ltm prole udp) to create a UDP prole.
• serverssl-prole
1793
Traffic Management Shell (tmsh) Reference Guide
Species the name of a server-side SSL prole to be used by this IPFIX Log Destination. The default
is not to use a server-side SSL prole. If one is specied, the IPFIX Log Destination must be congured
to use TCP as the transport protocol, and will use SSL over TCP to communicate with the congured
IPFIX collectors.
You can use the ltm prole server-ssl command (see ltm prole server-ssl) to create a server-side SSL
prole.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
ltm pool, ltm prole tcp, ltm prole udp, create, delete, glob, list, modify, regex, tmsh
local-database
Modify the Local Database destination.
Syntax
Modify the Local Database component within the sys log-cong destination module using the syntax
shown in the following sections.
Modify
modify local-database [name]
options:
all
description [string]
Display
list local-database
list local-database [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Note: There is only one Local Database destination, local-db. This destination cannot be created or deleted.
Description
You can use this destination component to modify the Local Database destination for the common logging
interface. There is only one Local Database destination that cannot be deleted.
Examples
list local-database local-db
Displays properties of the Local Database destination.
1794
Sys Log Config Destination
Options
• all
Species that you want to modify all of the existing components of the specied type.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the modify command.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
glob, list, modify, regex, tmsh
local-syslog
Congures the Local Syslog destination.
Syntax
Modify the Local Syslog component within the sys log-cong destination module using the syntax shown
in the following sections.
Modify
modify local-syslog [name]
options:
all
default-facility [ local0 | local1 | local2 | local3 | local4 | local5 |
local6 | local7 ]
default-severity [ alert | crit | debug | emerg | err | info | notice | warn
]
description [string]
Display
list local-syslog
list local-syslog [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
1795
Traffic Management Shell (tmsh) Reference Guide
Note: There is only one Local Syslog destination, local-syslog. This destination cannot be created or
deleted.
Description
You can use this destination component to modify the Local Syslog destination for the common logging
interface.There is only one Local Syslog destination which cannot deleted.
Examples
list local-syslog local-syslog
Displays properties of the Local Syslog destination.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• default-facility
Species the facility given to log messages received that do not already have one. The default value is
local0. The options are local0, local1, local2, local3, local4, local5, local6, and local7.
• default-severity
Species the severity given to log messages received that do not already have one. The default value is
info. The options are debug, info, notice, warn, err, crit, alert, and emerg.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the modify command.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
glob, list, modify, regex, tmsh
management-port
Sends received messages to a specied IP address and port through the management interface.
Syntax
Congure the Management Port Log component within the sys log-cong destination module using the
syntax shown in the following sections.
1796
Sys Log Config Destination
Create/Modify
create management-port [name]
modify management-port [name]
all
app-service [[string] | none]
description [string]
ip-address [ ip address ]
port [ port ]
protocol [ tcp | udp ]
Display
list management-port
list management-port [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete management-port [name]
Note: You must remove all references to a destination before you can delete the destination. Default
destinations may not be deleted.
Description
You can use this destination component to create Management Port Log forwarding destinations for the
common logging interface.
Examples
create management-port my_dest ip-address 1.2.3.4 port 99 protocol udp
Creates a destination named my_dest which forwards to the address 1.2.3.4:99 using the UDP protocol.
delete management-port my_dest
Deletes the destination named my_dest. Destinations cannot be deleted when in use by a publisher or another
destination.
list management-port my_dest
Displays properties of the destination named my_dest.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the destination belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the destination. Only the application service can modify or delete the destination.
1797
Traffic Management Shell (tmsh) Reference Guide
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• ip-address
Species the IP address that will receive messages from the specied destination.
• port
Species the port of the IP address that will receive messages from the specied destination.
• protocol
Species the protocol used to send messages to the specied destination. The default value is tcp. The
options are tcp and udp.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, modify, regex, tmsh
remote-high-speed-log
Sends received messages to a specied pool.
Syntax
Congure the Remote High Speed Log component within the sys log-cong destination module using the
syntax shown in the following sections.
Create/Modify
create remote-high-speed-log [name]
modify remote-high-speed-log [name]
all
app-service [[string] | none]
description [string]
distribution [ adaptive | balanced | replicated ]
pool-name [ string ]
protocol [ tcp | udp ]
1798
Sys Log Config Destination
Display
list remote-high-speed-log
list remote-high-speed-log [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete remote-high-speed-log [name]
Note: You must remove all references to a destination before you can delete the destination. Default
destinations may not be deleted.
Description
You can use this destination component to create Remote High Speed Log forwarding destinations for the
common logging interface.
Examples
create remote-high-speed-log my_dest pool-name my_pool
Creates a destination named my_dest which forwards to the pool my_pool.
delete remote-high-speed-log my_dest
Deletes the destination named my_dest. Destinations cannot be deleted when in use by a publisher or another
destination.
list remote-high-speed-log my_dest
Displays properties of the destination named my_dest.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the destination belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the destination. Only the application service can modify or delete the destination.
• description
User dened description.
• distribution
Species the distribution method used by the Remote High Speed Log destination to send messages to
pool members. The default method is adaptive: connections to pool members will be added as required
to provide enough logging bandwidth. This can have the undesirable effect of logs accumulating on
only one pool member when it provides sufcient logging bandwidth on its own. balanced sends each
successive log to a new pool member, balancing the logs among them according to the pool's load
balancing method. replicated replicates each log to all pool members, for redundancy.
• glob
1799
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• pool-name
Species the ltm pool that receives messages from the Remote High Speed Log destination. This option
is required for the create command.
• protocol
Species the protocol used to send messages to the specied pool. The default value is tcp. The options
are tcp and udp.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, modify, regex, tmsh
remote-syslog
Congures Remote Syslog destinations to format log messages into Syslog format and forward them to a
Remote High-Speed Log destination.
Syntax
Congure the Remote Syslog component within the sys log-cong destination module using the syntax
shown in the following sections.
Create/Modify
create remote-syslog [name]
modify remote-syslog [name]
all
app-service [[string] | none]
default-facility [ local0 | local1 | local2 | local3 | local4 | local5 |
local6 | local7 ]
default-severity [ alert | crit | debug | emerg | err | info | notice | warn
]
description [string]
format [ legacy-bigip | rfc3164 | rfc5424 ]
remote-high-speed-log [string]
Display
list remote-syslog
list remote-syslog [ [ [name] | [glob] | [regex] ] ... ]
all-properties
1800
Sys Log Config Destination
non-default-properties
one-line
Delete
delete remote-syslog [name]
Note: You must remove all references to a destination before you can delete the destination. Default
destinations may not be deleted.
Description
You can use this destination component to create Remote Syslog formatting destinations for the common
logging interface.
Examples
create remote-syslog my_dest remote-high-speed-log another_dest
Creates a destination named my_dest which forwards to another destination another_dest. another_dest
may not be another Remote Syslog destination.
delete remote-syslog my_dest
Deletes the destination named my_dest. Destinations cannot be deleted when in use by a publisher or another
destination.
list remote-syslog my_dest
Displays properties of the destination named my_dest.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the destination belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the destination. Only the application service can modify or delete the destination.
• default-facility
Species the facility given to log messages received that do not already have a facility listed. The default
value is local0. The options are local0, local1, local2, local3, local4, local5, local6, and local7.
• default-severity
Species the severity given to log messages received that do not already have a severity listed. The
default value is info. The options are debug, info, notice, warn, err, crit, alert, and emerg.
• description
User dened description.
• format
Species the syslog format received messages are formatted into. The default value is rfc3164. The
options are legacy-bigip, rfc3164, and rfc5424. For more information, see the respective RFCs.
• glob
1801
Traffic Management Shell (tmsh) Reference Guide
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• remote-high-speed-log
Species the forwarding destination to send logs in the syslog format. This option is required for the
create command. It may only be a remote high speed log destination or a management port destination.
See Also
create, delete, glob, list, modify, regex, tmsh
splunk
Congures Splunk formatting destinations to format incoming log messages into the Splunk format.
Syntax
Congure the Splunk component within the sys log-cong destination module using the syntax shown in
the following sections.
Create/Modify
create splunk [name]
modify splunk [name]
all
app-service [[string] | none]
description [string]
forward-to [string]
Display
list splunk
list splunk [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
Delete
delete splunk [name]
1802
Sys Log Config Destination
Note: You must remove all references to a destination before you can delete the destination. Default
destinations may not be deleted.
Description
You can use this destination component to create Splunk formatting destinations for the common logging
interface.
Examples
create splunk my_dest forward-to another_dest
Creates a destination named my_dest which forwards to another destination another_dest. another_dest
must be a Local Syslog, Local Database, Remote Syslog, or Remote High Speed Log destination.
delete splunk my_dest
Deletes the destination named my_dest.
list splunk my_dest
Displays properties of the destination named my_dest. Destinations cannot be deleted when in use by a
publisher.
Options
• all
Species that you want to modify all of the existing components of the specied type.
• app-service
Species the name of the application service to which the destination belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the destination. Only the application service can modify or delete the destination.
• description
User dened description.
• forward-to
Species a Local Syslog, Local Database, Remote Syslog, or Remote High Speed Log destination to
receive Splunk formatted log messages. This is required for the creation of a Splunk destination.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, modify, regex, tmsh
1803
Traffic Management Shell (tmsh) Reference Guide
Sys Performance
all-stats
Resets or displays all performance statistics.
Syntax
Reset or display all performance statistics for the system within the sys_performance module using the
syntax in the following sections. On VIPRION(r) systems, displaying performance statistics on a secondary
blade is not supported.
Modify
reset-stats all-stats
Display
show all-stats
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(detail | historical)
Description
You can use the all-stats component to reset or display all system performance statistics.
Note that tmsh only displays performance statistics when you explicitly request them.
Examples
show all-stats detail
Displays detailed information about system performance in the system default units.
reset-stats all-stats
Resets all performance statistics for the system.
Options
For information about the options that you can use with the command show, see help show.
For information about the options that you can use with the command reset-stats, see help reset-stats.
See Also
reset-stats, show, sys performance connections, sys performance gtm, sys performance ramcache, sys
performance system, sys performance throughput, tmsh
connections
Displays connection performance information.
Syntax
Display statistics for the connections component within the sys performance module using the syntax in
the following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is
not supported.
Display
show connections
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(detail | historical)
Description
You can use the connections component to display information about system performance, including details
about new and active connections and HTTP requests.
You can reset the connection performance statistics using the all-stats component.
Examples
show connections gig detail
Displays detailed information about connection performance in gigabytes.
show connections historical
Displays historical performance information about connections.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance gtm, sys performance ramcache, sys performance system,
sys performance throughput, tmsh
dnsexpress
Displays performance information for the DNS-Express.
Syntax
Display statistics for the dnsexpress component within the sys performance module using the syntax in
the following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is
not supported.
1806
Sys Performance
Display
show dnsexpress
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(historical)
Description
You can use the dnsexpress component to display information about system performance, including the
number of queries, responses, zone transfer messages, and NOTIFYs.
Examples
show dnsexpress historical
Displays historical performance information for DNS-Express.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance connections, sys performance ramcache, sys performance
system, sys performance throughput, tmsh
dnssec
Displays performance information for the DNSSEC signing.
Syntax
Display statistics for the dnssec component within the sys performance module using the syntax in the
following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is not
supported.
Display
show dnssec
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(historical)
Description
You can use the dnssec component to display information about system performance, including the number
of queries for specic DNSSEC types and zone transfer signing.
Examples
show dnssec historical
Displays historical performance information for DNSSEC signing.
1807
Traffic Management Shell (tmsh) Reference Guide
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance connections, sys performance ramcache, sys performance
system, sys performance throughput, tmsh
gtm
Displays performance information for the Global Trafc Manager.
Syntax
Display statistics for the gtm component within the sys performance module using the syntax in the
following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is not
supported.
Display
show gtm
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(detail | historical)
Description
You can use the gtm component to display information about system performance, including details about
the Global Trafc Manager, including number of requests, resolutions, persisted connections, and those
returned to DNS.
You can reset the Global Trafc Manager performance statistics using the all-stats component.
Examples
show gtm detail
Displays detailed performance information about the Global Trafc Manager in the system default units.
show gtm historical
Displays historical performance information about the Global Trafc Manager.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance connections, sys performance ramcache, sys performance
system, sys performance throughput, tmsh
1808
Sys Performance
ramcache
Displays RAM cache performance information.
Syntax
Display statistics for the ramcache component within the sys performance module using the syntax in the
following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is not
supported.
Display
show ramcache
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
historical
Description
You can use the ramcache component to display RAM cache utilization information.
You can reset the RAM cache performance statistics using the all-stats component.
Examples
show ramcache default
Displays ramcache performance information in the system default units.
show ramcache historical
Displays historical ramcache performance information.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance connections, sys performance gtm, sys performance
system, sys performance throughput, tmsh
system
Displays system performance information.
Syntax
Display statistics for the system component within the sys performance module using the syntax in the
following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is not
supported.
1809
Traffic Management Shell (tmsh) Reference Guide
Display
show system
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(detail | historical)
Description
You can use the system component to display CPU and memory usage information.
You can reset the system performance statistics using the all-stats component.
Examples
show system detail
Displays detailed system performance information in the system default units.
show system historical
Displays historical system performance information.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance connections, sys performance gtm, sys performance
ramcache, sys performance throughput, tmsh
throughput
Displays performance information about trafc throughput.
Syntax
Display statistics for the throughput component within the sys performance module using the syntax in
the following section. On VIPRION(r) systems, displaying performance statistics on a secondary blade is
not supported.
Display
show throughput
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
(detail | historical)
Description
You can use the throughput component to display information about trafc throughput, including client,
server, compression, and SSL transactions.
You can reset the throughput performance statistics using the all-stats component.
1810
Sys Performance
Examples
show throughput gig detail
Displays detailed throughput performance information in gigabits per second.
show throughput historical
Displays historical throughput performance information.
Options
For information about the options that you can use with the command show, see help show.
See Also
show, sys performance all-stats, sys performance connections, sys performance gtm, sys performance
ramcache, sys performance system, tmsh
1811
Traffic Management Shell (tmsh) Reference Guide
Sys Raid
array
Congures an array of hard disks on the BIG-IP(r) system.
Syntax
Congure the array component within the sys raid module using the syntax in the following sections.
Modify
modify array [name] [ [add | remove] [hard disk name] ]
Display
show array
show array [name]
field-fmt
Description
You can use the array component to add a hard disk to or remove a hard disk from an array of disks, or to
display information about an array of disks.
Examples
show array
Displays information about all of the arrays that are congured on the system.
modify array MD1 remove HD2
Removes hard disk, HD2 from array, MD1.
Options
• hard disk name
Species the name of the hard disk that you want to add to or remove from the array. This option is
required for the command modify.
• name
Species the name of the array. This option is required for the command modify.
See Also
modify, show, tmsh
bay
Manages a BIG-IP(r) system disk drive bay.
Syntax
Manage the bay component within the sys raid module using the syntax in the following sections.
Modify
modify bay [1 | 2]
flash-led
no-flash-led
Display
show bay [1 | 2]
field-fmt
Description
You can use the bay component to display information about a system bay, signal the LED on a bay to
ash, or signal the LED on a bay to stop ashing. The LED is helpful for identifying the location of a
specic disk, see sys raid disk.
Examples
modify bay 1 ash-led
Signal the system to make the LED on bay 1 ash.
show bay
Displays information about the system bay.
show bay eld-fmt
Displays information about the system bay in a eld format.
Options
• ash-led
Signal the LED on the bay to ash.
• no-ash-led
Signal the LED on the bay to stop ashing.
For information about the eld-fmt option, see help show.
See Also
show, sys raid disk, tmsh
1814
Sys Raid
disk
Displays information about the BIG-IP(r) system disks.
Syntax
Display information about the disk component within the sys raid module using the syntax in the following
sections.
Display
show disk [name]
field-fmt
all-properties
Description
You can use the disk component to display information about the system disks including name, serial
number, and whether the disk is a member of an array of disks. When "all-properties" option is specied,
the media wear-out information of the disk is also shown. This include the wear-out indicator, space available,
power-on hours, and estimated remaining life.
Examples
show disk
Displays information about all of the system disks.
show disk HD1 eld-fmt
Displays information, in a eld format, about disk, HD1.
show disk SSD1 all-properties
Displays all information (including the media wear-out information) about disk, SSD1.
Options
• name
Species the name of the disk for which you want to display information.
See Also
show, tmsh
1815
Traffic Management Shell (tmsh) Reference Guide
Sys Sflow
receiver
Manages sFlow receivers congured on the BIG-IP system.
Syntax
Congure the receiver component within the sys sow module using the syntax shown in the following
sections.
Create/Modify
create receiver [name]
modify receiver [name]
address [ip address]
app-service [[string] | none]
description [string]
max-datagram-size [integer]
port [ip port]
state [disabled | enabled]
Display
list receiver
list receiver [ [ [name] | [glob] | [regex] ] ... ]
all-properties
one-line
Delete
delete receiver [name]
Description
You can use the receiver component to create, delete, list, or modify an sFlow receiver object on the BIG-IP
system.
Note: You can add an sFlow receiver to the BIG-IP system, only if you are assigned either the Resource
Administrator or Administrator user role.
Examples
create receiver my_receiver address 10.10.10.10
Creates an sFlow receiver object named my_receiver with an IP address of 10.10.10.10, where the port,
max-datagram-size, and state options are set to default values.
create receiver my_receiver address 10.20.10.20 port 1234 state enabled
Creates an sFlow receiver object named my_receiver with an IP address of 10.20.10.20, a port of 1234,
and the max-datagram-size option set to default value. The state of the receiver is enabled.
modify receiver my_receiver state enabled
Changes the state of sFlow receiver object named my_receiver to enabled.
Options
• address
Species the IP address on which the sFlow receiver listens for UDP datagrams. This option is required
for the create command.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• max-datagram-size
Species the maximum size in bytes of the UDP datagram the sFlow receiver accepts. The default value
is 1400.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• port
Species the port on which the sFlow receiver listens for UDP datagrams. The default value is the
standard sFlow port, 6343.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• state
Species the state of the receiver. The sFlow samples will be collected and sent to the receiver when
enabled. The default value is disabled.
See Also
create, delete, glob, list, modify, regex, tmsh
1818
Sys Sflow
Sys Sflow Data Source
http
Displays the status of all HTTP sFlow data sources on the BIG-IP system.
Syntax
Display the status of http component within the sys sow data-source module using the syntax shown in
the following sections.
Display
show http
all-properties
field-fmt
Description
You can use the http component to display the current status of all HTTP sFlow data sources on the BIG-IP
system.
Examples
show http
Displays the current status of all HTTP sFlow data sources.
See Also
show, tmsh
interface
Displays the status of all sFlow data sources (interfaces) on the BIG-IP system.
Syntax
Display the status of interface component within the sys sow data-source module using the syntax shown
in the following sections.
Display
show interface
all-properties
field-fmt
Description
You can use the interface component to display the current status of all sFlow data sources (interfaces) on
the BIG-IP system.
Examples
show interface
Displays the current status of all sFlow data sources (interfaces).
See Also
show, tmsh
system
Displays the status of the system sFlow data sources on the BIG-IP system.
Syntax
Display the status of system component within the sys sow data-source module using the syntax shown
in the following sections.
Display
show system
all-properties
field-fmt
Description
You can use the system component to display the current status of the system sFlow data sources on the
BIG-IP system.
Examples
show system
Displays the current status of the system sFlow data sources.
See Also
show, tmsh
vlan
Displays the status of all sFlow data sources (VLANs) on the BIG-IP system.
1820
Sys Sflow Data Source
Syntax
Display the status of vlan component within the sys sow data-source module using the syntax shown in
the following sections.
Display
show vlan
all-properties
field-fmt
Description
You can use the vlan component to display the current status of all sFlow data sources (VLANs) on the
BIG-IP system.
Examples
show vlan
Displays the current status of all sFlow data sources (VLANs).
See Also
show, tmsh
1821
Traffic Management Shell (tmsh) Reference Guide
Sys Sflow Global Settings
http
Manages the global HTTP sFlow conguration on the BIG-IP system.
Syntax
Congure the http component within the sys sow global-settings module using the syntax shown in the
following sections.
Modify
modify http
description [string]
poll-interval [integer]
sampling-rate [integer]
Display
list http
all-properties
non-default-properties
one-line
Description
You can use the http component to modify or list the global HTTP sFlow conguration on the BIG-IP
system.
Note: You can modify the global HTTP sFlow conguration on the BIG-IP system, only if you are assigned
either the Resource Administrator or Administrator user role.
Examples
modify http poll-interval 60 sampling-rate 1500
Sets the poll-interval to 60 seconds and the sampling-rate to 1500 packets for all monitored HTTP data
sources on the BIG-IP system.
Options
• description
User dened description.
• poll-interval
Species the maximum interval in seconds between polling by the sFlow agent of all monitored HTTP
data sources on the BIG-IP system. The default value is 10.
• sampling-rate
Species the ratio of packets observed at all HTTP data sources to the samples generated. For example,
a sampling rate of 2000 species that 1 sample will be randomly generated for every 2000 packets
observed. The default value is 1024.
See Also
list, modify, tmsh
interface
Manages the global sFlow conguration for interfaces on the BIG-IP system.
Syntax
Congure the interface component within the sys sow global-settings module using the syntax shown
in the following sections.
Modify
modify interface
description [string]
poll-interval [integer]
Display
list interface
all-properties
non-default-properties
one-line
Description
You can use the interface component to modify or list the global sFlow conguration for interfaces on the
BIG-IP system.
Note: You can modify the global sFlow conguration for interfaces on the BIG-IP system, only if you are
assigned either the Resource Administrator or Administrator user role.
Examples
modify interface poll-interval 60
Sets the poll-interval to 60 seconds for all monitored data sources (interfaces) on the BIG-IP system.
Options
• description
User dened description.
• poll-interval
1824
Sys Sflow Global Settings
Species the maximum interval in seconds between polling by the sFlow agent of all monitored data
sources (interfaces) on the BIG-IP system. The default value is 10.
See Also
list, modify, tmsh
system
Manages the global system sFlow conguration on the BIG-IP system.
Syntax
Congure the system component within the sys sow global-settings module using the syntax shown in
the following sections.
Modify
modify system
description [string]
poll-interval [integer]
Display
list system
all-properties
non-default-properties
one-line
Description
You can use the system component to modify or list the global system sFlow conguration on the BIG-IP
system.
Note: You can modify the global system sFlow conguration on the BIG-IP system, only if you are assigned
either the Resource Administrator or Administrator user role.
Examples
modify system poll-interval 60
Sets the poll-interval to 60 seconds for the system data sources on the BIG-IP system.
Options
• description
User dened description.
• poll-interval
Species the maximum interval in seconds between polling by the sFlow agent of the system data sources
on the BIG-IP system. The default value is 10.
1825
Traffic Management Shell (tmsh) Reference Guide
See Also
list, modify, tmsh
vlan
Manages the global sFlow conguration for VLANs on the BIG-IP system.
Syntax
Congure the vlan component within the sys sow global-settings module using the syntax shown in the
following sections.
Modify
modify vlan
description [string]
poll-interval [integer]
sampling-rate [integer]
Display
list vlan
all-properties
non-default-properties
one-line
Description
You can use the vlan component to modify or list the global sFlow conguration for VLANs on the BIG-IP
system.
Note: You can modify the global sFlow conguration for VLANs on the BIG-IP system, only if you are
assigned either the Resource Administrator or Administrator user role.
Examples
modify vlan poll-interval 60 sampling-rate 1500
Sets the poll-interval to 60 seconds and the sampling-rate to 1500 packets for all monitored data sources
(VLANs) on the BIG-IP system.
Options
• description
User dened description.
• poll-interval
Species the maximum interval in seconds between polling by the sFlow agent of all monitored data
sources (VLANs) on the BIG-IP system. The default value is 10.
• sampling-rate
1826
Sys Sflow Global Settings
Species the ratio of packets observed at all data sources (VLANs) to the samples generated. For example,
a sampling rate of 2000 species that 1 sample will be randomly generated for every 2000 packets
observed. The default value is 2048.
See Also
list, modify, tmsh
1827
Traffic Management Shell (tmsh) Reference Guide
Sys Software
block-device-image
Manages F5 Networks block device software images.
Syntax
Install, display information about, using the syntax in the following sections.
Install
install
create-volume
image [name]
reboot
volume [name]
Display
list block-device-image
list block-device-image [ [ [ name [/slot_id] ] | [glob] | [regex] ] ... ]
build
build-date
checksum
device-agent
file-size
last-modified
one-line
product
resource-id
verified
version
Description
You can use the block-device-image component to install images from block devices onto a volume, or
view information about available block-device-images.
Installing A Software Block-Device-Image
Before you begin installing a block-device-image, the image must be be made available to the system. As
of this writing, block device images are only available from within a VCMP guest via a virtual cdrom
service. A VCMP host administrator must have provided the images for use by the guest as part of there
administration of the VCMP host.
From tmsh, you can use show sys software status to see all of the available disk volumes where you can
install the image. You can install the image le in any volume that is not active.
Then use the install command with this component to install the image to an unused volume. You can use
the create-volume option if you want to create a new volume. The installation takes some time; you can
use show sys software status repetitively to watch the progress of the installation. To put the newly installed
software into active service, use the reboot option in the install command, or use the reboot volume
vol-name command after the install command completes.
Note: You use the slot_id option only for chassis systems and only when displaying the values for the options
of a specic block-device-image. You do not use the slot_id option when installing or deleting an
block-device-image, because these commands operate on all blades or the entire system.
Conrming An Block-Device-Image Installation
You can use show sys version to conrm that the system is running the new software version. If this is a
new module for the current system, you may need to use show sys license and/or install sys license to
update your license. For a new module, you may also need to provision CPU, memory, and disk space for
the module with the sys provision component.
Examples
install block-device-image BIGIP-11.4.1.608.0.iso volume HD1.1 reboot
Attempts to install the specied block-device-image, BIGIP-11.4.1.608.0.iso, onto HD1.1. Note: If the
installation is successful, the machine reboots into the newly installed block-device-image.
list block-device-image BIGIP-11.4.1.608.0.iso
Displays information about the specied block-device-image, build 608.0 of BIG-IP version 11.4.1.
list block-device-image */1
Displays information about all of the block-device-images located on the rst slot.
Options
• build
Displays the build number of the block-device-image.
• build-date
Displays the date on which the block-device-image was built.
• checksum
Displays the checksum of the block-device-image. You can use this option to verify the integrity of the
block-device-image.
• create-volume
Creates a new volume using the name specied with the volume option. Mirrored volume names must
begin with the prex MD1.. Mirrored volumes are available only on systems that support RAID, see
sys raid.
• device-agent
Displays the name of the service which is responsible for managing the type of block device on which
a give image is available. vcmp-virtual-cdrom is the device-agent which allows VCMP guests to install
images that reside in the host system, via a virtual cdrom device.
• le-size
Displays the size of the block-device-image le in megabytes.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• last-modied
Displays the date the le was last modied.
1830
Sys Software
• name
Species the name of the block-device-image that you want to install or delete.
• product
Displays the F5 Networks product the block-device-image contains.
• reboot
Species that the system reboots immediately after a successful installation.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• resource-id
Displays the resource-id string corresponding to software image in question. This string is used to identify
the image for use in interacting with the device agent that is responsible for management of the resource.
In the case of the vcmp-virtual-cdrom device-agent the resource-id is used by the live installation
daemon when requesting that the hypervisor make images available, before the installation can proceed.
• veried
When set to yes, indicates that the block-device-image is authentic.
• version
Displays the version number of the product this block-device-image contains.
• volume
Species the name of the volume on which you want to install the block-device-image, or from which
you want to delete the block-device-image.
Note: You cannot install software on the active volume.
See Also
delete, glob, install, list, reboot, regex, sys software block-device-hotx, sys software hotx, sys software
image, tmsh, show, sys software status, sys version, sys license, sys provision
block-device-software-hotfix
Manages F5 Networks block device software hotxes.
Syntax
Install, or display information about using the syntax in the following sections.
Install
install block-device-hotfix [name] volume [name]
create-volume
reboot
1831
Traffic Management Shell (tmsh) Reference Guide
Display
list block-device-hotfix
list block-device-hotfix [ [ [ name [/slot_id] ] | [glob] | [regex] ] ... ]
build
checksum
device-agent
id
one-line
product
title
resource-id
verified
version
Description
You can use the block-device-hotx component to install a block-device-hotx onto a volume, or view
information about available block-device-hotxes.
Use the create-volume option with the block-device-hotx component to create new volumes.
Note: You use the slot_id option only for chassis systems and only when displaying the values for the options
of a specic block-device-hotx. You do not use the slot_id option when installing or deleting a
block-device-hotx, because these commands operate on all blades or the entire system.
Examples
list block-device-hotx Hotx-BIGIP-11.4.0-2419.0-HF3.iso
Displays information about the specied block-device-hotx, BIGIP-9.6.1-824.0-HF3.im.
list block-device-hotx */1
Displays information about the all the block-device-hotxes on the rst slot.
install block-device-hotx Hotx-BIGIP-11.4.0-2419.0-HF3.iso volume HD1.1 reboot
Attempts to install the specied block-device-hotx, Hotx-BIGIP-11.4.0-2419.0-HF3.iso, onto HD1.1.
Note: If the installation is successful, and you used the reboot option, as in this example, the machine
reboots into the newly installed block-device-hotx.
Options
• build
Displays the build number of the block-device-hotx.
• checksum
Displays the checksum of the block-device-hotx.
• create-volume
Create a new volume using the name specied with the volume option. Mirrored volume names must
begin with the prex MD1.. Mirrored volumes are available only on systems that support RAID, see
sys raid.
• device-agent
1832
Sys Software
Displays the name of the service which is responsible for managing the type of block device on which
a give hotx is available. vcmp-virtual-cdrom is the device-agent which allows VCMP guests to install
hotxes that reside in the host system, via a virtual cdrom device.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species the name and sequential ID of the block-device-hotx that you want to install or delete.
• product
Displays the F5 Networks product this block-device-hotx contains.
• reboot
Species that the system reboots immediately after a successful installation.
• resource-id
Displays the resource-id string corresponding to software block-device-hotx in question. This string
is used to identify the image for use in interacting with the device agent that is responsible for management
of the resource. In the case of the vcmp-virtual-cdrom device-agent the resource-id is used by the live
installation daemon when requesting that the hypervisor make hotxes available before the installation
can proceed.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• slot_id
Species the number of the slot on a chassis system that contains the block-device-hotx about which
you want to display information.
• title
Displays a textual description of the block-device-hotx.
• veried
When set to yes, indicates that the block-device-hotx is authentic.
• version
Displays the version number of the product the block-device-hotx contains.
• volume
Species the name of the volume on which you want to install the block-device-hotx, or from which
you want to delete the block-device-hotx.
See Also
delete, glob, install, list, regex, sys software block-device-image, sys software hotx, sys software image,
tmsh
hotfix
Manages F5 Networks software hotxes.
1833
Traffic Management Shell (tmsh) Reference Guide
Syntax
Install, display information about, or delete a hotx using the syntax in the following sections.
Install
install hotfix [name] volume [name]
create-volume
reboot
Display
list hotfix
list hotfix [ [ [ name [/slot_id] ] | [glob] | [regex] ] ... ]
build
checksum
id
one-line
product
title
verified
version
Delete
delete hotfix [ [name] ... ]
all
Description
You can use the hotx component to install a hotx onto a volume, view information about available
hotxes, or delete unwanted hotxes.
Use the create-volume option with the hotx component to create new volumes.
Note: You use the slot_id option only for chassis systems and only when displaying the values for the options
of a specic hotx. You do not use the slot_id option when installing or deleting a hotx, because these
commands operate on all blades or the entire system.
Examples
list hotx Hotx-BIGIP-9.6.1-824.0-HF3.im
Displays information about the specied hotx, BIGIP-9.6.1-824.0-HF3.im.
list hotx */1
Displays information about the all the hotxes on the rst slot.
install hotx Hotx-BIGIP-9.6.1-824.0-HF3.im volume HD1.1 reboot
Attempts to install the specied hotx, BIGIP-9.6.1-824.0-HF3.im, onto HD1.1.
Note: If the installation is successful, and you used the reboot option, as in this example, the machine
reboots into the newly installed hotx.
1834
Sys Software
Options
• build
Displays the build number of the hotx.
• checksum
Displays the checksum of the hotx. You can use this option to verify the integrity of the hotx.
• create-volume
Create a new volume using the name specied with the volume option. Mirrored volume names must
begin with the prex MD1.. Mirrored volumes are available only on systems that support RAID, see
sys raid.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species the name and sequential ID of the hotx that you want to install or delete.
• product
Displays the F5 Networks product this hotx contains.
• reboot
Species that the system reboots immediately after a successful installation.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• slot_id
Species the number of the slot on a chassis system that contains the hotx about which you want to
display information.
• title
Displays a textual description of the hotx.
• veried
When set to yes, indicates that the hotx is authentic.
• version
Displays the version number of the product the hotx contains.
• volume
Species the name of the volume on which you want to install the hotx, or from which you want to
delete the hotx.
See Also
delete, glob, install, list, regex, sys software image, tmsh
1835
Traffic Management Shell (tmsh) Reference Guide
image
Manages F5 Networks software images.
Syntax
Install, display information about, or delete a software image using the syntax in the following sections.
Install
install
create-volume
image [name]
reboot
volume [name]
Display
list image
list image [ [ [ name [/slot_id] ] | [glob] | [regex] ] ... ]
build
build-date
checksum
file-size
last-modified
one-line
product
verified
version
Delete
delete image [ [ [name] ... ] | [all] ]
Description
You can use the image component to install images onto a volume, view information about available images,
or delete unwanted images.
Installing A Software Image
Before you begin installing an image, you must download the image le into the /shared/images directory.
You can nd new software images at http://downloads.f5.com. We recommend downloading both the .iso
le and the .md5 le. Download the le (or les) to your local machine, then transfer it to the /shared/images
directory on the BIG-IP(r). Use the Manager (GUI) interface to make this transfer, or quit tmsh to the Unix
command line and use scp or a similar Unix command.
If you downloaded the .md5 le, you can use the Unix md5sum command to check the MD5 hash of the
.iso le, and you can compare it to the contents of the .md5 le. They should match. If they do not, retry
the download and/or transfer of the .iso le.
From tmsh, you can use show sys software status to see all of the available disk volumes where you can
install the .iso le. You can install the .iso le in any volume that is not active.
1836
Sys Software
Then use the install command with this component to install the .iso le to an unused volume. You can use
the create-volume option if you want to create a new volume. The installation takes some time; you can
use show sys software status repetitively to watch the progress of the installation. To put the .iso le into
active service, use the reboot option in the install command, or use the reboot volume vol-name command
after the install command completes.
Note: You use the slot_id option only for chassis systems and only when displaying the values for the options
of a specic image. You do not use the slot_id option when installing or deleting an image, because these
commands operate on all blades or the entire system.
Conrming An Image Installation
You can use show sys version to conrm that the system is running the new software version. If this is a
new module for the current system, you may need to use show sys license and/or install sys license to
update your license. For a new module, you may also need to provision CPU, memory, and disk space for
the module with the sys provision component.
Examples
install image BIGIP-10.0.0.5376.0.iso volume HD1.1 reboot
Attempts to install the specied image, BIGIP-10.0.0.5376.0.iso, onto HD1.1. Note: If the installation is
successful, the machine reboots into the newly installed image.
list image BIGIP-10.0.0.5376.0.iso
Displays information about the specied image, build 5376.0 of BIG-IP version 10.0.0.
list image */1
Displays information about all of the images located on the rst slot.
Options
• build
Displays the build number of the image.
• build-date
Displays the date on which the image was built.
• checksum
Displays the checksum of the image. You can use this option to verify the integrity of the image.
• create-volume
Creates a new volume using the name specied with the volume option. Mirrored volume names must
begin with the prex MD1.. Mirrored volumes are available only on systems that support RAID, see
sys raid.
• le-size
Displays the size of the image le in megabytes.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• last-modied
Displays the date the le was last modied.
• name
Species the name of the image that you want to install or delete.
1837
Traffic Management Shell (tmsh) Reference Guide
• product
Displays the F5 Networks product the image contains.
• reboot
Species that the system reboots immediately after a successful installation.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• veried
When set to yes, indicates that the image is authentic.
• version
Displays the version number of the product this image contains.
• volume
Species the name of the volume on which you want to install the image, or from which you want to
delete the image.
Note: You cannot install software on the active volume.
See Also
delete, glob, install, list, reboot, regex, sys software hotx, tmsh, show, sys software status, sys version, sys
license, sys provision
signature
Manages F5 Networks software signatures.
Syntax
Display information about, or delete a signature using the syntax in the following sections.
Display
list signature
list signature [ [ [ name [/slot_id] ] | [glob] | [regex] ] ... ]
one-line
Delete
delete signature [ [name] ... ]
all
1838
Sys Software
Description
You can use the signature component to view information about available signatures, or delete unwanted
signatures.
Note: You use the slot_id option only for chassis systems and only when displaying the values for the options
of a specic signature. You do not use the slot_id option when deleting a signature, because these commands
operate on all blades or the entire system.
Examples
list signature BIGIP-11.5.0.0.0.135.iso.sig
Displays information about the specied signature, BIGIP-11.5.0.0.0.135.iso.sig.
list signature */1
Displays information about the all the signatures on the rst slot.
Options
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• slot_id
Species the number of the slot on a chassis system that contains the hotx about which you want to
display information.
See Also
delete, glob, list, regex, sys software image, tmsh
status
Displays the status of a BIG-IP(r) system software installation.
Syntax
Display information about the status component within the sys software module using the following syntax.
Display
show status
field-fmt
Description
You can use the status component to display the status of the software installation, including whether the
system is active, the name of the product being installed, the software version and build number of the
software, and the slot and volume on which the software is installed.
1839
Traffic Management Shell (tmsh) Reference Guide
After you use the install sys software image command (see install and sys software image) to install a new
software image, you can use this command to monitor the progress of the installation. A percentage meter
appears in the Status column.
Examples
show status
Displays the status of the software installation in a table.
show status field-fmt
Displays the status of the software installation separately for each volume on the system.
root@(big-ip1)(cfg-sync Standalone)(Active)(/Common)(tmos)# quit
[root@big-ip1:Active:Standalone] images # watch tmsh show sys software status
Launches the Unix watch command from the Unix command line. The command produces auto-updating
output similar to this:
Every 2.0s: tmsh show sys software status Thu Oct 18 14:04:04
2012
-----------------------------------------------------------------
Sys::Software Status
Volume Product Version Build Active Status
-----------------------------------------------------------------
HD1.1 EM 3.2.0 222.0 no installing 6.000 pct
HD1.2 EM 3.2.0 150.0.465 yes complete
HD1.3 EM 3.2.0 67.0 no complete
Where the "installing 6.000 pct" status increases until it eventually changes to "complete." It changes to a
specic failure message if there is an issue.
Options
• eld-fmt
Species to display the software status for each volume in a eld format, rather than in a table.
See Also
show, tmsh
1840
Sys Software
update
Displays the BIG-IP(r) update check schedule settings.
Syntax
Display and modify the update component within the sys software module using the syntax in the following
section.
Modify
modify update
auto-check
frequency
Display
list update
all-properties
one-line
Description
You can use the update component to display or modify the conguration of the update check feature.
Examples
list update
Displays update check conguration information for the system.
modify update frequency monthly
Modify the frequency of update checks to monthly.
modify update auto-check disabled
Disable the auto update check feature.
Options
• auto-check
Set this to enabled in order to turn on the auto update check feature. disabled turns the feature off.
• check-status
This read-only eld displays the result of the last update check.
• errors
This read-only eld displays the number of consecutive errors detected by update checking.
• frequency
The frequency of update checks can be one of daily, weekly, or monthly.
For information about the options that you can use with the command list, see help list.
1841
Traffic Management Shell (tmsh) Reference Guide
See Also
list, tmsh
update-status
Displays the BIG-IP(r) update check results.
Syntax
Display the results of an update check contained in the update-status component within the sys software
module using the syntax in the following section.
Display
list update-status
Options:
all-properties
one-line
[update type] (e.g. RELEASE)
Description
You can use the update-status component to display the results of the update check feature.
Examples
list update-status
Displays all update check information for the system.
list update-status GEOLOC all-properties one-line
Displays all update check information for the GEOLOC update type on one line.
list update-status last-checked-version
Displays the last checked version for all update types.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• available
This is the le name of the available update.
• check-user
This is the system user that last executed the update check.
• label
1842
Sys Software
This is the label used when displaying the status on the GUI.
• last-checked
This is the last time this update type was checked.
• last-checked-auto-mode
This is false if the last time this update type was checked was performed manually.
• last-checked-version
This is the version found at the last time this update type was checked.
• progress-status
This is the state of the update check.
• supplement
This is the le name of the supplemental le.
• url
This is the URL linking to the available update.
• url-supplement
This is a URL linking to a le supplemental to the available update.
For information about the options that you can use with the command list, see help list.
See Also
list, tmsh
volume
Manages software volumes on the BIG-IP(r) system.
Syntax
Delete, reboot into, or display information about a hard drive volume using the syntax in the following
sections.
Reboot
reboot volume [name]
Display
list volume
list volume [ [ [name].[slot_id] ] | [glob] | [regex] ] ... ]
show running-config
show running-config [ [ [name].[slot_id] ] | [glob] | [regex] ] ... ]
active
active-requested
all-properties
basebuild
build
1843
Traffic Management Shell (tmsh) Reference Guide
edition
media [media] [size] [default-boot-location]
one-line
product
status
version
Delete
delete volume [name]
Description
You can use the volume component to view information about congured volumes, delete unwanted
volumes, and reboot the device to a specic volume.
Volumes are created using the install command. See help sys software image and the option create-volume.
Deleting or rebooting into a volume on a VIPRION system affects the entire chassis; therefore, you do not
need to specify the slot number.
Examples
list volume */1
Displays the details of all the volumes located on the rst slot in a chassis.
delete volume HD1.5
Deletes the volume named HD1.5.
reboot volume HD1.1
Boots into volume HD1.1 if that volume is not already active. If the volume has an image actively being
installed on it, the reboot occurs when the installation is complete.
Options
• active
Species if this volume is being run.
• active-requested
Species if this volume should be active once its status is complete. The system associates this setting
with either the active volume or the volume that is going to become active when its status is complete.
If active-requested is set on a volume that is not presently active, the system reboots into the volume
when the volume status is complete. As an example, install sys software image BIGIP-10.1.0.3341.0.iso
volume HD1.2 reboot will cause active-requested to be set on volume HD1.2, and the system will
reboot into volume HD1.2 when the installation is complete. This value is read-only.
• basebuild
Displays the build number of either the hotx presently applied to the system or the original build.
• build
Displays the original build number (before any hotxes).
• edition
Displays a textual description of the image. You can use this option to specify the hotx you want to
install.
• media
1844
Sys Software
Displays a description of the physical media on which the volume exists. The options are:
• media
The type of physical device on which the volume exists, for example, hard drive (hd) or compact
ash (cf).
• size
The space on the slot reserved for the volume.
• default-boot-location
Species the volume into which the system boots if the slot resets.
• name
Species the name of the volume you are conguring. Volume names are in the format HDX.Y, CFX.Y,
or MDX.Y, where X is the hard drive index (HDX), compact ash index (CFX), or RAID index (MDX)
(on systems that support RAID), and Y is the volume number on that drive.
• product
Displays the F5 Networks product that is installed on the volume.
• reboot
Reboots the system into the specied volume.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• status
Displays the installation status of the volume. The options are complete or installing.
• version
Displays the version number of the software installed on the volume.
See Also
delete, glob, install, list, reboot, regex, sys software hotx, sys software image, sys raid, tmsh
1845
Traffic Management Shell (tmsh) Reference Guide
Sys URL DB
download-result
Lists download result for URL Master and RTSU DB.
Syntax
List download-result component within the <sys url-db> module using the syntax shown in the following
sections.
Display
The download-result consists of the object name (/Common/masterdb or /Common/rtsudb),and version.
These objects are created by BIGIP and cannot be modied or deleted.
list url-db download-result [masterdb | rtsudb]
all-properties
non-default-properties
one-line
list url-db download-result masterdb
db-version [integer]
ret-code 0
list url-db download-result rtsudb
db-version [integer]
ret-code 0
Description
Lists download result for Master URL database and Real-Time Security Update (RTSU). These objects are
created after the rst successful download and updated after every download.
Options
• db-version
Species database version for URL Master or Real-Time Security Update DB.
• ret-code
Species the download result status and always zero now.
See Also
sys url-db download-schedule sys url-db url-category
download-schedule
Congures download schedule for URL Master DB.
Syntax
Congure a download-schedule component within the <sys url-db> module using the syntax shown in the
following sections.
Modify
The download-schedule consists of the object name (/Common/urldb), download start time (start-time),
download end time (end-time) and status. You can have only one download schedule and the download
occurs daily.
modify url-db download-schedule urldb
start-time [HH::MM]
end-time [HH::MM]
download-now [true | false]
status true | false]
Display
list url-db download-schedule urldb
all-properties
non-default-properties
one-line
Description
Congures download schedule for Master URL database.
Examples
modify download-schedule urldb { start-time 2:00 end-time 4:00 }
Modify the download schedule for Master DB download schedule between 2:00 AM and 4:00 AM. Other
downloads such as RTSU (Real-Time Security Update) and ACE (Advanced Classication Engine) DB
download occurs at regular intervals.
modify download-schedule urldb { start-time 20:00 end-time 22:00 }
Modify the download schedule for Master DB download schedule between 8:00 PM and 10:00 AM.
modify download-schedule urldb { download-now true }
Master DB Download starts in few minutes after issuing this command. The download-now will be set to
false after successful download.
modify download-schedule urldb { status false }
By setting the status ag to false, download (Master and other DB) will not occur any more.
Options
• download-now
1848
Sys URL DB
Species to start download in few minutes and no need to wait for the scheduled window.
• end-time
Shows download end time. Download will start between scheduled start time and end time.
• start-time
Shows download start time. Download will start between scheduled start time and end time.
• status
Shows the download status is enabled. By turning to false, download will not occur.
See Also
sys url-db download-result sys url-db url-category
url-category
Congures URL categories for URL classication and ltering
Syntax
Congure a url-category component within the <sys url-db> module using the syntax shown in the following
sections.
Create/Modify
Each url-category consists of the object name (/Common/Business_and_Economy), a display-name ("Business
and Economy") which is a more user-friendly category name, and a category number. The hundreds and
thousands of URLs under a url-category are stored in a database. You can create your own url-category
(custom category) and you can add more URLs to an existing category (recategorization).
create url-db url-category [name]
display-name [string]
description [string]
initial-disposition [integer]
is-security-category [string]
parent-cat-number [integer]
severity-level [integer]
urls [add | delete | modify | replace-all-with] {
[string]
}
modify url-db url-category [name]
initial-disposition [integer]
is-security-category [string]
parent-cat-number [integer]
severity-level [integer]
urls [add | delete | modify | replace-all-with] {
[string]
}
1849
Traffic Management Shell (tmsh) Reference Guide
Display
list url-category
list url-category [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
one-line
partition
Description
Congures a url-category
NOTE: When you create a new url-category, you must provide a display-name. However, after creation it
cannot be changed to another value. The system will provide a cat-number for your newly created
url-category. The number is an integer greater than 1900. The url-category you create is considered to be
a custom URL category, and so the is-custom ag will be set to true.
NOTE: The only change you can make to a system provided url-category is to add one or more URLs to
its list of URLs. This is called recategorization, and the is-recategory ag will be set to true. You need to
do this if the URL does not already exist in the database.
Examples
create url-category my-own-url-cat display-name "My Own URL Category" urls add { http://a.url.com
http://www.another.url.org }
Creates a new url-category. The new url-category you create is known as a custom category, as opposed to
a system provided url-category. In this case, you must specify the display-name and at least one URL.
modify url-category my-own-url initial-disposition 4 parent-category 0
Modify the initial-disposition and parent-category in a customized url-category.
modify url-category Business_and_Economy urls add { http://www.theneomarxist.com }
Modify a system provided url-category by adding a URL to it. This action is called recategorization. The
url-category is recategorized.
Options
• cat-number
Shows a unique category number. Custom URL categories have numbers greater than 1900. This is a
read-only attribute.
• description
Species a unique description for the URL category.
• display-name
Species a user-friendly name that describes what the URL category represents. This attribute cannot
be changed after creation.
• initial-disposition
Species the action to be taken when a certain URL category is not listed in any url-lter.
• is-custom
This ag is set by the system when you create your own URL category. This attribute is read-only.
• is-security-category
This ag is not being used. This attribute is read-only.
1850
Sys URL DB
Util
ccmode
set Common Criteria mode and a subset of conguration defaults required for a Common-Criteria-compliant
BIGIP system.
Syntax
ccmode
Description
Use this command to set a subset of defaults that are required for a Common-Criteria-compliant system.
Run this command ONLY if you are creating a Common-Criteria-compliant BIG-IP system, or have
otherwise determined that all of the changes are desirable for your BIG-IP conguration. Note that there
are runtime changes triggered by this command.
Running the ccmode command is an essential part of the conguration changes required to congure a
BIG-IP system as Common-Criteria-compliant. This command changes the base conguration in several
ways, including:
• dening the minimum required password policy
• dening the allowed cipher sets for SSL/TLS
• disabling some features excluded from the evaluation and therefore not permitted to be used in a compliant
system
• setting several DB variables, including the Security.CommonCriteria variable, an indicator from which
other runtime changes are triggered.
While running this script is essential to creating a Common-Criteria-compliant system, it is not sufcient.
Customers wishing to congure compliant systems must consult the conguration Guidance documentation
provided when the evaluation is complete, and follow its instructions to completely congure the BIG-IP.
This command has no facility for "undoing" the changes it makes. Instead, the administrator must reverse
or revise all of the individual commands, reset the DB variables to their defaults, save the new conguration,
and restart the BIG-IP.
diadb
Run the diadb command to display, lter or delete dia persistence entries.
Syntax
run util diadb <option>
Options:
-h, --help
-v, --verbose
-r, --router <diarouter-profile>
-k, --key <key>
-d, --delete --router <diarouter-profile> --key <key> --type <type> --ipproto
<proto>
Description
The diadb utility allows users to display, lter or delete Diameter persistence entries.
Examples
run util diadb
Shows all Diameter persistence entries. The output displays persistence type, key, originator, destination,
timeout, protocol. The key is prexed with persistence type i.e. 'A' for AVP persistence or 'O' for custom
persistence. The timeout value displayed is in seconds.
run util diadb -h run util diadb --help Shows the help.
run util diadb -v run util diadb --verbose The output displays the destination transport conguration and
pool name in addition to the default values. The transport name is prexed with the transport transport type,
'tc:' for transport cong or 'vs:' for virtual server
run util diadb -r /Common/diarouter-prole run util diadb --router /Common/diarouter-prole
Shows Diameter persistence entries for the routing instance 'diarouter-prole' parameter.
run util diadb -d -r /Common/diarouter-prole -k key1 -t A -p TCP run util diadb --delete --router
/Common/diarouter-prole --key key1 --type A -ipproto TCP
Delete the Diameter persist record matching key 'key1', type 'A' (AVP), ip-proto 'TCP' and router prole
'/Common/diarouter-prole'. The type value is either 'A' for AVP persistence or 'O' for custom persistence.
The ipproto value is either TCP, SCTP.
See Also
run, tmsh
dnat
command providing reverse and forward mapping for deterministic NAT (DNAT)
1854
Util
Syntax
Run the dnat utility from within the util module using the following syntax:
run util dnat [<options>] [<address>[:<port>]]
Description
The dnat utility allows the calculation of forward and reverse source address and port mapping for the
deterministic mode of Large Scale NAT.
Examples
dnat 10.0.0.1 --action forward Shows a list of translation address/port pairs that might be used for a
subscriber at 10.0.0.1, using the DNAT states contained in /var/log/ltm.
dnat 173.240.102.139:5678 Performs a reverse mapping back to the subscriber address for the connection
from 173.240.102.139:5678, using the DNAT states contained in /var/log/ltm.
dnat --start_time '2012-09-27 06:30:00' --end_time '2012-09-27 12:10:00' 173.240.102.139:5678 Same
as the previous example, but only shows the subscriber addresses that used the translation within the specied
time range.
dnat --start_time '2012-09-27 06:30:00' --end_time '2012-09-27 12:10:00' --le /var/log/test
173.240.102.139:5678 Same as the previous example, but use the DNAT states contained in /var/log/test
dnat --le /var/log/test Shows summary information, using the DNAT states contained in /var/log/test
dnat --action summary --start_time '2012-09-27 06:30:00' --end_time '2012-09-27 12:10:00' Shows
summary information, using the DNAT states within the specied time range.
Options
• client_addr or --client_addr <ip_address>
Used to provide the subscriber address for forward mappings (--action forward), and the translation
address for reverse mappings (--action reverse).
• client_port or --client_port <port>
Used to provide the subscriber port for forward mappings (--action forward), and the translation port
for reverse mappings (--action reverse).
• end_time or --end_time <time>
End time of search range. User can specify the time format via the --time-format switch. The time
format defaults to ' YYYY-MM-DD HH:MM:SS.'
• start_time or --start_time <time>
Start time of search range. User can specify the time format via the --time-format switch. The time
format defaults to ' YYYY-MM-DD HH:MM:SS.'
• --action <summary|forward|reverse|reverse_addr>
Specify the action to be taken: summary, forward, reverse, reverse_addr. Default: reverse when
supplied with client_addr, summary otherwise.
• summary
Provides summary information on the parsed deterministic NAT conguration snippet.
• reverse
1855
Traffic Management Shell (tmsh) Reference Guide
Returns possible subscriber address for the provided client address and client port (as translation
end-point).
• forward
Returns possible translation end-points for the provided client address (as subscriber address).
• reverse_addr
Returns possible subscriber addresses for the provided client address (as translation address).
• --le /var/log/ltm
Read DNAT state from le (default: /var/log/ltm)
• --time_format <time_fmt>
Timestamp parse format for --start_time or --end_time (default: ' %F %T %Z ', this yields
'YYYY-MM-DD HH:MM:SS', with timezone being optional.)
• --all
Display all entries, even if there are duplicates (default disabled).
• --version
Display version and DAG information.
See Also
run, tmsh, date
finalize-custom-ami
Utility to clean-up and prepare the custom AMI for Autoscaling on AWS.
Syntax
Run the nalize-custom-ami utility from within the util module using the following syntax:
run util finalize-custom-ami
Description
The nalize-custom-ami utility runs the nal clean-up steps to prepare the instance for being packaged as
a custom AMI that could be autoscaled in AWS. This is a BIG-IP VE on AWS specic utility tool that
shouldn't be run on other platforms. This should be used according to supporting documentation provided
by F5.
All the output is reported on standard output.
Examples
run util nalize-custom-ami
See Also
run, tmsh
1856
Util
lsndb
Run the lsndb command to view Large Scale NAT persistence entries, inbound mappings, client connection
counts, and PCP mappings.
Syntax
run util lsndb <command> <object>
Commands:
del[ete]
list
summary
Objects:
all
client
inbound[-mapping]
pba
pcp
filters
persist[ence]
all
Description
The lsndb utility allows users to view LSN persistence mappings, inbound mappings, PCP mappings, client
connection counts and port block entries. Persistence, inbound and PCP mappings can also be deleted using
this utility.
Examples
run util lsndb delete all
Delete all LSN persistence mappings, inbound mappings and PCP mappings.
run util lsndb del inbound
Delete all LSN inbound mappings.
run util lsndb delete pcp
Delete all PCP mappings.
run util lsndb delete persist
Delete all LSN persistence entries.
run util lsndb list all
Shows all LSN persistence mappings, inbound mappings, PCP mappings, client connection counts and port
block entries.
run util lsndb list client
Shows all LSN client connection counts. Each line will display the client IP address and the number of
connections used by the client. Connection counts are only available for LSN pools with a non-zero client
connection limit.
1857
Traffic Management Shell (tmsh) Reference Guide
run util lsndb list inbound
Shows all LSN inbound mappings. Each line will display the translation IP address, the client IP address,
the DS-Lite tunnel (if congured) and the age of the mapping.
run util lsndb list pba
Shows all LSN port block entries. Each line will display the client IP address, the port block used and the
time that the entry will persist in the database (TTL).
run util lsndb list pcp
Shows all PCP mappings. PCP clients send MAP requests to map their private IP address and port to a
public IP address and port. The BIG IP system uses those mappings as NAT entries. Each line will display
the client IP address, the external address used and the age of the mapping.
run util lsndb list lters
Shows all LSN lters for inbound mappings. Each line will display the <LSN> inbound mappings along
with lter's remote peer IP address and prex length.
run util lsndb list persist
Shows all LSN persistence entries. Each line will display the client IP address, the translation address used
and the time that the entry will persist in the database (TTL).
run util lsndb summary all
Show summary for all LSN persistence mappings, inbound mappings and port block entries.
run util lsndb summary inbound
Show summary for all LSN inbound mapping entries.
run util lsndb summary pba
Show summary for all LSN port block entries.
run util lsndb summary persist
Show summary for all LSN persistence entries.
Options
• delete
Delete all objects of the specied type. Client connection counts and port block entries cannot be deleted.
• list
Display all objects of the specied type.
• summary
Display summary information of the specied type.
Object types are:
• all = all available object types.
• client = LSN client counts (list only).
• inbound = LSN inbound mapping entries.
• pba = LSN port block entries.
• pcp = PCP mappings entries.
• persist = LSN translation persist entries.
1858
Util
See Also
run, tmsh
platform_check
Runs platform diagnostics utility
Syntax
Run the platform_check utility from within the util module using the following syntax:
run util platform_check <test suite>
Description
The platform_check utility runs the diagnostics to verify correct functionality of platform components.
This should be used according to supporting documentation provided by F5.
Output is provided on standard output as well as /var/log/platform_check. Running platform_check with
the -h argument will produce available argument listing.
Examples
run util platform_check
Runs all appropriate diagnostics for this platform.
run util platform_check disk
Runs only the disk suite of diagnostics.
See Also
run, tmsh
sipdb
Run the sipdb command to view SIP persistence entries.
Syntax
run util sipdb <option>
Options:
-h, --help
-v, --verbose
-r, --router <siprouter-profile>
-k, --key <key>
-d, --delete -r, --router <siprouter-profile> -k, --key <key> -t, --type <type>
-p, --ipproto <proto>
1859
Traffic Management Shell (tmsh) Reference Guide
Description
The sipdb utility allows users to view or delete SIP persistence entries.
Examples
run util sipdb
Shows all SIP persistence entries. The output displays key, type, originator, destination, timeout, protocol.
The key is prexed with persistence type i.e. 'C' for call-id persistence, 'S' for source address persistence,
'O' for custom persistence. The timeout value displayed is in seconds.
run util sipdb -h run util sipdb --help Shows the help.
run util sipdb -v run util sipdb --verbose The output displays the destination transport conguration and
pool name in addition to the default values. The transport name is prexed with the transport transport type,
'tc:' for transport cong or 'vs:' for virtual server
run util sipdb -r /Common/siprouter-prole run util sipdb --router /Common/siprouter-prole
Shows SIP persistence entries for the routing instance 'siprouter-prole' parameter.
run util sipdb -d -r /Common/siprouter-prole -k key1 -t C -p UDP run util sipdb --delete --router
/Common/siprouter-prole --key key1 --type C -ipproto UDP
Delete the SIP persist record matching key 'key1', type 'C' (call-ID), ip-proto 'UDP' and router prole
'/Common/siprouter-prole'. The type value is either 'C' for call id persistence, 'S' for source address
persistence or 'O' for custom persistence. The ipproto value is either UDP or TCP.
See Also
run, tmsh
ssh-keyswap
Run the ssh-keyswap command to manage SSH keys on the BIG-IP.
Syntax
run util ssh-keyswap <option>
Options:
-genkeys
-checklinks
-delkeys
Description
The ssh-keyswap utility allows users to generate and delete SSH keys, and check that they are linked
properly.
Examples
run util ssh-keyswap -genkeys
1860
Util
Create new local SSH keys and update hosts.
run util ssh-keyswap -checklinks
Check symlinks and make sure they are correct.
run util ssh-keyswap -delkeys
Zeroize and delete local SSH keys when CC mode is enabled.
See Also
run, tmsh
test-monitor
Runs an external monitor and displays the inputs to and output from the monitor.
Syntax
Run the test-monitor utility from within the util module using the following syntax:
run util test-monitor <monitor-name> address <ip-address> port <port>
Description
The test-monitor utility runs a single instance of a monitor against the specied ip-address: port. The
utility output shows the environment, command-line arguments, and resulting messages on stdout and stderr.
Internal monitors are not supported.
Examples
run util test-monitor monitorA address 10.10.10.4 port 80
Runs a monitor on the IP address 10.10.10.4 and port 80.
See Also
run, tmsh
1861
Traffic Management Shell (tmsh) Reference Guide
VCMP
global
Display global vCMP system statistics.
Syntax
Congure the global component within the vcmp module using the following syntax.
Display
show global
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
Use the global component within the vcmp module to display high-level vCMP system statistics on a
per-slot basis. These are statistics that are not associated with any particular vCMP guest or virtual-disk.
Examples
show vcmp global
Display all global vCMP system statistics.
Options
For information about the options that you can use with the show command, see help show.
See Also
tmsh, show, vcmp guest, vcmp virtual-disk
guest
Congures a cluster of virtual machines (VMs) that run on one or all slots. This cluster is known as a vCMP
guest.
Syntax
Congure the guest component within the vcmp module using the syntax in the following sections.
Create
create guest [name]
modify guest [name]
hostname [hostname]
app-service [[string] | none]
initial-hotfix [hotfix-filename]
initial-image [image-filename]
management-gw [ip-address]
management-ip [ip-address/netmask | ip-address/prefixlen]
management-network [bridged | isolated]
slots [integer]
traffic-profile [vcmp-traffic-profile-name]
min-slots [integer]
allowed-slots {
[slot ID] ...
}
cores-per-slot [integer]
state [configured | provisioned | deployed]
virtual-disk [filename]
vlans [add | delete | replace-all-with] {
[VLAN name] ...
}
capabilities [add | delete | modify | replace-all-with] {
[capability Id] [ { value [integer] } ]
}
Display
list guest
show guest
options:
all-properties
status
Delete
delete guest [name]
Description
Manage vCMP guests running on this host.
Examples
list vcmp guest
Lists the current conguration of all guests.
show vcmp guest
Displays detailed information regarding the state and progress of all guests.
show vcmp guest status
Displays the running state of all guests, including each guest's prompt status.
1864
VCMP
show vcmp guest all-properties
Displays greater detailed statistics and information on all guests.
create vcmp guest my_guest slots 4 min-slots 2 management-ip 192.168.45.12/24 management-gw
192.168.45.254 initial-image BIGIP-11.0.0.2400.0.iso
Creates a guest that should span four slots, but must span at least two, with the given management IP and
gateway, and with the image le BIGIP-11.0.0.2400.0.iso, which is used to install TMOS on the guest's
virtual disks. By default, this guest is in the congured state and has a management network in Bridged
mode.
modify vcmp guest my_guest state provisioned
Moves the guest into the provisioned state, which causes the host to assign the guest to slots, allocate
hardware resources to the guest from those slots, and create virtual disks for the guests on those slots.
<modify vcmp guest my_guest state deployed>
Moves the guest into the deployed state, which causes the host to start and maintain VMs on each slot that
the guest has been assigned to.
modify vcmp guest my_guest state congured
Moves the guest back to the congured state, which causes all of its VMs to shut down and the hardware
to be deallocated. The guest is unassigned from all slots. The guest's virtual disks will remain on the host.
modify vcmp guest my_guest trafc-prole ftyMbpsSLAProle
Adds a trafc-prole named ftyMbpsSLAProle to the guest in question, which is congured under
vcmp trafc-prole.
Options
• app-service
Species the name of the application service to which the guest belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the guest. Only the application service can modify or delete the guest.
• hostname
Assigns the specied host name to the guest. The host name must be a FQDN. If none is given, the
default of "<guest_name>.localdomain" is used. If the guest's name contains characters that are not
allowed in a FQDN, then "localhost.localdomain" is used.
This is only a suggested value and may be changed on the guest itself. If the guest ever reverts to the
default host name, this suggested host name is used instead of the normal system default.
• initial-hotx
Species which hotx image to install on newly created virtual disks for this guest. This image is only
used when initially creating the virtual disks. After initial creation, the typical live-install process should
be used on the guest to manage software upgrades. The image lename must match a veried software
image le that exists in the /shared/images directory, otherwise the guest will sit in a wait state on any
slot that is missing the hotx image until that image is added.
This eld is required if the guest state is provisioned or deployed, otherwise it can be left blank.
• initial-image
Species which software image to install on newly created virtual disks for this guest. This image is
only used when initially creating the virtual disks. After initial creation, the typical live-install process
should be used on the guest to manage software upgrades. The image lename must match a veried
software image le that exists in the /shared/images directory, otherwise the guest will sit in a wait
state on any slot that is missing the software image until that image is added.
1865
Traffic Management Shell (tmsh) Reference Guide
This eld is required if the guest state is provisioned or deployed, otherwise it can be left blank.
• management-gw
Species the IP address of the default gateway for the management network. This IP address is only a
suggested value and can be changed on the guest itself. If the guest ever reverts to the default management
gateway, the suggested gateway is used instead of the normal system default.
This eld is required if the guest's management-network is bridged, otherwise it can be left blank.
• management-ip
Species the management IP address and netmask to assign to the guest. This address oats to the
primary slot of the guest.
This is only a suggested value and can be changed on the guest itself. If the guest ever reverts to the
default management IP address, the suggested IP address is used instead of the normal system default.
This eld is required if the guest's management-network is bridged, otherwise it can be left blank.
• management-network
Species the management network mode for this guest. When in Bridged mode, the management
interfaces on the guest's VMs are bridged to the physical management interfaces on the host blades. This
enables the guest to communicate with networks attached to these physical interfaces, the host itself,
and other guests in Bridged mode.
In Isolated mode, the management interfaces of the guest's VMs are completely disconnected. The only
way to manage such a guest is by connecting to the console on each of the guest's VMs by using the
/usr/bin/vconsole utility or by connecting through a congured self IP on a guest's VLAN.
The default value is Bridged.
• ssl-mode
Species the SSL mode for this guest. When in shared mode the guest shares the available non-dedicated
ssl resources with other guests that are in shared mode. when in dedicated mode the guest receives
dedicated SSL hardware resources proportional to number of vcpu cores. When in none mode the guest
receives no hardware ssl resources. The default value is shared.
• slots
Species the number of slots to which this guest should be assigned. This number must be greater than
zero and no bigger than the cluster size. The host will attempt to assign the guest up to this number of
slots.
Note that this property can be changed while the guest is in any state. While in the congured state,
modifying the slots property has no effect, since the guest has not yet been assigned to any slots. While
in the provisioned state, decreasing this eld will cause the guest to be unassigned from enough slots
to honor the new value. The host will unassign the guest rst from slots that have the most allocated
resources. When a guest's slots value is increased, the host attempts to assign the guest to as many slots
as possible, up to the new slots value. This same behavior occurs when modifying the property while
the guest is in the deployed state, except that running VMs are shut down on any slots that the guest is
unassigned from, and new VMs are deployed on any slots to which the guest has been newly assigned.
The default value is 1.
• trafc-prole
Species a trafc-prole to be used in dening characteristics of trafc which transits the guest's
data-plane. For instance a trafc-prole with a color-policer on it that limits the network throughput
of the guest may be applied to enforce service agreements between a host admin and a guest user, or to
help mitigate network level DOS of other guests in the system.
• min-slots
1866
VCMP
This eld dictates the number of slots that the guest must be assigned to. If at the end of any allocation
attempt the guest is not assigned to at least this many slots, the attempt fails and the change that initiated
it is reverted. A guest's min-slots value cannot be greater than its slots value.
The default value is 1.
• allowed-slots
This list contains those slots that the guest is allowed to be assigned to. When the host determines which
slots this guest should be assigned to, only slots in this list will be considered. This is a good way to
force guests to be assigned only to particular slots, or, by conguring disjoint allowed-slots lists on two
guests, that those guests are never assigned to the same slot.
By default this list includes every available slot in the cluster. This means by default the guest is allowed
to be assigned to any slot.
• cores-per-slot
This value dictates how many cores a guest is allocated from each slot that it is assigned to. Possible
values are dependent on the type of blades being used in this cluster. Use tab-completion to see a list of
possible values on the current system.
The default cores-per-slot value depends on the type of blades being used in this cluster.
• state
Guests are put into the congured state by default. In this state, the conguration for the guest exists
on the host, but none of the guest's VMs are running and no hardware resources (for example: CPU
cores, memory) are allocated to it. When the guest moves to the provisioned state, hardware resources
are allocated to it, and if not already present, virtual disks are created, and the initial-image is installed
onto them. In the deployed state, the vcmpd daemon on the host blades use the allocated resources to
launch the VMs. Note that moving from the congured state to the deployed state implies the actions
that occur in the provisioned state. To shut down a guest's VMs without de-allocating its hardware
resources, move the guest from the deployed state to the provisioned state. Moving a guest to the
congured state causes its hardware resources to be deallocated. This does not cause the guest's virtual
disks to be deleted. They persist on disk and are reused when the vCMP moves back to the provisioned
/ deployed states.
• virtual-disk
Species the lename of the virtual disk to use for this guest's VMs. If the lename does not end in
.img, it is appended. When the guest moves to a state in which virtual disks need to be provisioned
(provisioned or deployed), a new virtual disk image will be created for the guest with this given lename
on each slot that the guest is assigned to and does not already have a virtual disk image. The initial-image
is used when creating and installing new virtual disk images. If this eld is left blank when virtual disk
images need to be provisioned for this guest, a default value of "<guest_name>.img" is assigned. If a
virtual disk by that name already exists, then an error is thrown. This prevents virtual disks from
accidentally being reused by this assigning of default virtual disk lenames.
• capabilities
This list contains the various capability ags and an optional value associated with the guest. The possible
capability ags are: appliance-mode, stats-isolated-mode, and host-software-only-mode. The value
attributes for these capability ags are currently ignored and may be omitted. The capabilities may be
added or removed from a vCMP guest in any state.
The appliance-mode capability disables root and bash access to the guest.
The stats-isolated-mode capability prevents some guest statistics from being sent to the hypervisor.
The host-software-only-mode capability prevents the guest from installing images and hotxes other
than those provided by the hypervisor.
1867
Traffic Management Shell (tmsh) Reference Guide
See Also
create, delete, list, modify, show, tmsh, vcmp global, vcmp virtual-disk
traffic-profile
Congures a trafc-prole, which can be applied to a vCMP guest to control characteristics of data-plane
network trafc to the guest.
Syntax
Congure the trafc-prole component within the vcmp module using the syntax in the following sections.
Create
create traffic-profile [name]
modify traffic-profile [name]
color-policer [color-policer-name]
Display
list traffic-profile
options:
all-properties
Delete
delete traffic-profile [name]
Description
Manage vCMP trafc-proles running on this host.
Examples
list vcmp trafc-prole
Lists the current conguration of all trafc-proles.
create vcmp trafc-prole ftyMbpsSLAProle color-policer ftyMpbsLimiter
Creates a trafc-prole which makes use of the color-policer ftyMpbsLimiter.
Options
• color-policer
Species the color based policer for metering and shaping trafc destined to a guests data-plane.
1868
VCMP
See Also
create, delete, edit, glob, list, modify, regex, show, tmsh
vdisk
Manages the vCMP virtual disks available on this hypervisor.
Syntax
Congure the vdisk component within the vcmp module using the syntax in the following sections.
Display
list vdisk
options:
all-properties
show vdisk
Delete
delete vdisk [name]
Description
The vdisk component is used to list and delete virtual disks that are used by vCMP guests. Virtual disks
are automatically created by vcmpd when guests move to the Provisioned state and do not already have
virtual disks attached to them. This is the only way that virtual disks are created. Virtual disks that are not
attached to any guest can be deleted. Virtual disks not already in use can be explicitly attached to vCMP
guests.
Examples
list vcmp vdisk
Lists all virtual disks currently available.
delete vcmp vdisk my_vdisk
Deletes the virtual disk named my_vdisk. Note that this is only valid if the vdisk is not currently attached
to any vCMP guest.
See Also
create, delete, list, modify, tmsh
1869
Traffic Management Shell (tmsh) Reference Guide
virtual-disk
Manages the vCMP virtual disks available on this hypervisor.
Syntax
Congure the virtual-disk component within the vcmp module using the syntax in the following sections.
Display
list virtual-disk
show virtual-disk
options:
all-properties
show virtual-disk
Delete
delete virtual-disk [name]
Description
The virtual-disk component is used to list and delete virtual disks that are used by vCMP guests. Virtual
disks are automatically created by vcmpd when guests move to the Provisioned state and do not already
have virtual disks attached to them. This is the only way that virtual disks are created. Virtual disks that are
not attached to any guest can be deleted. Virtual disks not already in use can be explicitly attached to vCMP
guests.
Examples
list vcmp virtual-disk
Lists all virtual disks currently available.
delete vcmp virtual-disk my_vdisk
Deletes the virtual disk named my_vdisk. Note that this is only valid if the virtual-disk is not currently
attached to any vCMP guest.
See Also
create, delete, list, modify, tmsh
1870
VCMP
virtual-disk-template
Manages the vCMP virtual disk templates available on this hypervisor.
Syntax
Congure the virtual-disk-template component within the vcmp module using the syntax in the following
sections.
Display
list virtual-disk-template
options:
all-properties
Delete
delete virtual-disk-template [name]
Description
The virtual-disk-template component is used to list and delete virtual disk templates that are used to create
new virtual disk images for vCMP guests. Virtual disk templates are automatically created by vcmpd when
guests move to the Provisioned state and a virtual disk template with the version being installed to the
guest's virtual disk image doesn't already exist. This is the only way that virtual disk templates are created.
Deleting virtual disk templates frees up space but will slow down future virtual disk image installs of that
version; the virtual disk template will need to be rst re-created.
Examples
list vcmp virtual-disk-template
Lists all virtual disk templates currently available.
delete vcmp virtual-disk-template my_vdisk
Deletes the virtual disk template named my_vdisk. Note that this is only valid if the virtual-disk-template
is not currently attached to any vCMP guest.
See Also
tmsh vcmp virtual-disk
1871
Traffic Management Shell (tmsh) Reference Guide
VCMP Health
ha-status
Display vCMP guest high availability (HA) status.
Syntax
Display guest HA status using the following syntax.
Display
show ha-status
Description
Use the ha-status component within the vcmp health module to display HA status information about the
vCMP guests deployed on this system. This is similar to running tmsh show sys ha-status inside of a guest.
Examples
show vcmp healh ha-status
Display HA status status for all guests.
show vcmp health ha-status my_guest
Display HA status status for a single guest; "my_guest".
Options
For information about the options that you can use with the show command, see help show.
module-provision
Display vCMP guest module provisioning status.
Syntax
Display guest module provisioning status using the following syntax.
Display
show module-provision
Description
Use the module-provision component within the vcmp health module to display module provisioning
status information about the vCMP guests deployed on this system. This will show you which modules are
provisioned in a guest and at what level.
Examples
show vcmp healh module-provision
Display module provisioning status for all guests.
show vcmp health module-provision my_guest
Display module provisioning status for a single guest; "my_guest".
Options
For information about the options that you can use with the show command, see help show.
prompt
Display vCMP guest prompt status.
Syntax
Display guest prompt status using the following syntax.
Display
show prompt
Description
Use the prompt component within the vcmp health module to display the per-slot command-line prompts
for the vCMP guests deployed on this system. These are the same prompts that one would see when logging
into a guest via SSH. Example: "bigip.mydomain.com:/S1-green-P:Active:Standalone"
Examples
show vcmp healh prompt
Display prompt status for all guests.
show vcmp health prompt my_guest
Display prompt status for a single guest; "my_guest".
Options
For information about the options that you can use with the show command, see help show.
1874
VCMP Health
software
Display vCMP guest software status.
Syntax
Display guest software status using the following syntax.
Display
show software
Description
Use the software component within the vcmp health module to display software status information about
the vCMP guests deployed on this system. This is similar to running tmsh show sys software inside the
guest.
Examples
show vcmp healh software
Display software status for all guests.
show vcmp health software my_guest
Display software status for a single guest; "my_guest".
Options
For information about the options that you can use with the show command, see help show.
1875
Traffic Management Shell (tmsh) Reference Guide
WAM
ad-policy
Congures an ad policy for WebAccelerator for use in ad insertion.
Syntax
Congure the ad-policy within the wam module using the syntax shown in the following sections.
Create/Modify
create ad-policy [name]
modify ad-policy [name]
ad-insertion-order [random | sequential]
ads [add | delete | modify] {
[name] {
url [url]
preroll [yes | no]
}
}
description [string]
Display
list ad-policy [name ...]
Delete
delete ad-policy [name ...]
Description
You can use the ad-policy component to manage the WebAccelerator ad policies. An ad policy denes
how the ad insertion is to be performed while processing video resources. Individual ad urls can be congured
in the ad-policy along with the insertion order.
Examples
create wam ad-policy my_ad_policy ads add { my_ad1 { preroll yes url
http://www.example.com/ad1.m3u8 } }
Creates an ad policy named my_ad_policy with an ad named my_ad1 for the url
http://www.example.com/ad1.m3u8 and as a preroll candidate.
list wam ad-policy my_ad_policy
Displays properties of the ad policy named my_ad_policy.
delete wam ad-policy my_ad_policy
Deletes the ad policy named my_ad_policy.
Options
• ad-insertion-order
Species whether the ads are to be inserted randomly or in the order specied in the policy.
• ads
Species the collection of ads.
• description
User dened description of an ad policy.
Ad Options
• url
Species the url of the ad.
• preroll
Species that the ad is a candidate for preroll insertion. Preroll ad is inserted at the beginning of the
playist.
See Also
create, delete, edit, list, modify, show, tmsh
application
Congures application for WebAccelerator.
Syntax
Congure the application component within the wam module using the syntax shown in the following
sections.
Create/Modify
create application [name]
modify application [name]
app-service [[string] | none]
code [number]
content-expiration-time [date and time]
description [string]
hosts [add | delete | modify | replace-all-with] {
[ [host name] | [glob] ] {
app-service [[string] | none]
code [number]
subdomain-number-of-http [number]
subdomain-number-of-https [number]
subdomain-prefix [string]
}
}
ibr-adaptive-lifetime [number]
ibr-default-lifetime [number]
ibr-prefix [string]
1878
WAM
info-header [none | standard | debug]
multibox [disabled | farm | symmetric]
policy [name]
perf-monitor [enabled | disabled]
perf-monitor-data-retention-period [number]
collect-roi-statistics [ enabled | disabled ]
send-metadata [never | always | uncompressed]
roi-report-email-addresses { string }
roi-report-frequency [ every-month | every-week ]
roi-report-name [string]
roi-report-next-time [date and time]
roi-report-smtp-config [ smtp configuration object name ]
roi-report-collect-statistics { caching-bytes-saved | client-ibred-links
|
compression-bytes-saved | icc-refed-links | inlined-links |
caching-requests-saved | client-ibred-links-recd | icc-inlined-links
|
image-opt-bytes-saved | minification-bytes-saved }
edit application [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
reset-stats application
reset-stats application [ [ [name] | [glob] | [regex] ] ... ]
Display
list application [name ...]
show running-config application [name ...]
all-properties
non-default-properties
partition
predefined
show application
show application [name]
all-properties
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
field-fmt
Delete
delete application [name ...]
Note: You must remove all references to an application before you can delete it.
Description
You can use the application component to congure the host map, select policies, and set application wide
parameters that affect WebAccelerator behavior.
1879
Traffic Management Shell (tmsh) Reference Guide
Examples
create application my_app hosts add { host1.com host2.com } policy my_local_policy
Creates a WebAccelerator application with a host map consisting of two hosts, host1.com and host2.com,
and a local policy set to my_local_policy.
modify application my_app remote-policy my_remote_policy
Sets my_remote_policy as the remote policy for application my_app.
modify application my_app modify hosts { host1.com { subdomain-number-of-http 3 subdomain-prex
abcd } }
Sets the number of subdomain hosts to 3 and the subdomain prex to abcd for host host1.com of
WebAccelerator application my_app.
modify application my_app roi-report-name "my_report" roi-report-frequency monthly
roi-report-smtp-cong smtp-cong roi-report-collect-statistics add { caching_bytes_saved
caching_requests_saved }
Sets the ROI report name to my_report. The ROI report is set to be sent monthly, and the next time to send
used to send the ROI report will be the predened conguration of name smtp-cong. The ROI report will
contain the statistics specied by roi-report-collect-statistics, which in this case would be caching_bytes_saved
and caching_requests_saved.
delete application my_app
Deletes WebAccelerator application my_app.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• code
Species a numeric non-zero code of the application or application host, which is used for troubleshooting
and performance reporting. Each application or application host must have a unique code. If not supplied,
it will be generated by the system. Use the keyword generate to specify that the system generate a new
unique code.
• content-expiration-time
Species the date and time that limits how old cached documents can be to still be served from the
cache. All documents older than this date and time are considered expired. For example, the following
example expires all cached documents of the application my_app:
modify application my_app content-expiration-time now
• description
Species the object type description.
• hosts
Species the list of domain names (host names) that might appear in HTTP requests for your Web
application. These are the same host names that DNS has mapped to the server machine on which your
WebAccelerator system is running. To map a group or range of requested host names to a single
destination host, you can use an asterisk (*) as a wildcard for the rst part of the host name.
• ibr-adaptive-lifetime
1880
WAM
Species the adaptive lifetime for Intelligent Browser Referencing in seconds. The default value is
864000 (10 days).
• ibr-default-lifetime
Species the lifetime for Intelligent Browser Referencing in seconds. The default value is 15724800 (6
months).
• ibr-prex
Species a prex for the Intelligent Browser Referencing tag. The default value is ";wa".
• info-header
Enables and controls the appearance of HTTP header X-WA-Info: in responses from WebAccelerator.
This header can be used for troubleshooting the WebAccelerator system and for tuning policies. The
possible values are:
• debug
HTTP header X-WA-Info: is included into responses with standard information, with some additional
values to aid WebAccelerator troubleshooting.
• none
HTTP header X-WA-Info: is not included into responses.
• standard
HTTP header X-WA-Info: is included into responses with standard information, such as S-code,
policy, and node codes, etc.
•
• multibox
Species which type of multibox support is required for this application, if any. Options are disabled,
for deployments with an independent WebAccelerator; farm, for farm deployments; and symmetric,
for symmetric deployments. When this is not disabled, the application should be shared by a cong
sync device group containing all devices in the deployment. It enables the broadcast of invalidation
messages to other devices in the device group, and, when set to symmetric, also enables symmetric
processing of trafc.
• partition
Displays the administrative partition within which the application resides.
• perf-monitor
Species whether performance monitoring for this application is enabled. Enabling performance
monitoring on many applications may affect the overall performance of WebAccelerator. The default
value is disabled.
• perf-monitor-data-retention-period
Species the time period in days for how long the performance data must be preserved. The default
value is 30 days.
• collect-roi-statistics
Species whether ROI statistics collection for this application is enabled. The default value is disabled.
• roi-report-name
Species the name of ROI statistics report if the statistics collection is enabled and report generation is
desired.
• roi-report-frequency
Species the frequency of ROI statistics report, if the statistics collection is enabled and report generation
is desired. The options are every week or month.
1881
Traffic Management Shell (tmsh) Reference Guide
• roi-report-email-addresses
Species the email-addresses to which ROI statistics report will be sent.
• roi-report-next-time
Species the next time when the ROI statistics report will be sent.
• roi-report-smtp-cong
Species the smtp conguration that will be used to send the scheduled ROI report over email.
• roi-report-collect-statistics
Species which statistics are to be included in the ROI statistics report.
• policy
Species the acceleration policy to which you want to assign the new Web application.
• predened
Displays if this application is predened.
• send-metadata
Species when Etag HTTP headers will be included into responses. The default value is always.
• always
Etag HTTP headers will always be included into responses.
• never
Etag HTTP headers will not be included into responses.
• uncompressed
Metadata HTTP headers will be included only if response is uncompressed.
•
• subdomain-number-of-http
Species the number of HTTP subdomains that you want the WebAccelerator system to generate. The
WebAccelerator system uses these additional subdomains only on embedded URLs or links that request
images or scripts. The default value is 0.
• subdomain-number-of-https
Species the number of HTTPS subdomains that you want the WebAccelerator system to generate. The
WebAccelerator system uses these additional subdomains only on embedded URLs or links that request
images or scripts. The default value is 0.
• subdomain-prex
Species the prex that you want the system to assign to the subdomains. The default value is wa.
For example, if the Requested Host is www.siterequest.com, and you select 2 from the HTTP Subdomains
box and type w a in the Subdomain Prex box, the WebAccelerator system changes the domain on
qualifying embedded URLs and links to use the following domains:
• wa1.www.siterequest.com
• wa2.www.siterequest.com
•
Note: You must congure DNS with these entries, and they must map to the same IP address as the
base origin server (www.siterequest.com in this example).
1882
WAM
See Also
create, delete, edit, glob, list, modify, regex, reset-stats, show, tmsh
domain-list
Congures a list of domains for WebAccelerator for use in inserting DNS prefetch tags.
Syntax
Congure the domain-list component within the wam resource module using the syntax shown in the
following sections.
Create/Modify
create domain-list [name]
modify domain-list [name]
app-service [[string] | none]
description [[string] | none]
domains
[add | delete | none| replace-all-with] {
[string] ...
}
Display
list domain-list [name ...]
Delete
delete domain-list [name ...]
Description
You can use the domain-list component to manage the domain list resources used by the WebAccelerator
DNS prefetching feature. A domain-list must be created, then added to the appropriate domain-lists on a
WebAccelerator policy node in order for the domains within the domain list to be inserted into a document.
Examples
create domain-list my_domain_list domains add {example.com example2.com}
Creates a domain list resource for the domains example.com and example2.com for use in inserting DNS
prefetch tags.
list domain-list my_domain_list
Displays properties of the domain-list resource named my_domain_list.
delete domain-list my_domain_list
Deletes the domain-list resource named my_domain_list.
1883
Traffic Management Shell (tmsh) Reference Guide
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• domains
Species the domains described by the domain list resource.
See Also
create, delete, edit, list, modify, show, tmsh
object-type
Congures object types for WebAccelerator.
Syntax
Congure the object-type component within the wam module using the syntax shown in the following
sections.
Create/Modify
create object-type [name]
modify object-type [name]
app-service [[string] | none]
code [ [number] | generate]
compression [disabled | policy-controlled]
description [string]
extensions [add | delete | modify | replace-all-with] {
[document extension]
...
}
mime-types [add | delete | modify | replace-all-with] {
[MIME type]
...
}
symmetric-compression [ disabled | enabled ]
edit object-type [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
Display
list object-type [ [ [name] | [glob] | [regex] ] ... ]
show running-config object-type [ [ [name] | [glob] | [regex] ] ... ]
all-properties
non-default-properties
group
1884
WAM
partition
predefined
Delete
delete object-type [name ...]
Description
You can use the object-type component to manage recognized types of objects. These object types are used
to classify documents processed by WebAccelerator. A document can be classied by its le extension or
MIME type.
Examples
create object-type documents.abcd extensions add { abc abcd } mime-types add { text/abcd text/x-abcd
}
Creates a WebAccelerator object type named documents.abcd that includes all documents with extensions
.abc or .abcd, and MIME types text/abcd or text/x-abcd.
delete object-type documents.abcd
Deletes the pool named documents.abcd.
list object-type documents.abcd
Displays properties of the object-type named documents.abcd.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• code
Species the numeric non-zero code of the object type, which is used troubleshooting and performance
reporting. Each object type must have unique code. If not supplied, it will be generated by the system.
Use keyword generate to have the system generate a new unique code.
• compression
Species if this object type supports compression and when it can be enabled. The default value is
disabled.
Valid values are:
• disabled
Never compresses the response. If you use this option, be aware that it overrides any compression
setting congured for the assembly rule that the WebAccelerator system matches to the specied
object type. You should use this option only if you want the WebAccelerator system to ignore
assembly rules for the specied object type.
• policy-controlled
Species that compression is controlled by WebAccelerator policy. The compression setting is
specied in the assembly rule that the WebAccelerator system matched for this object type. In most
cases, you should use this option.
1885
Traffic Management Shell (tmsh) Reference Guide
• description
Species the object type description.
• extensions
Species the extension the WebAccelerator system should nd in the le name or Content-Disposition
header of the response, in order to match to the specied object type.
• group
Displays the group portion of the name.
• mime-types
Species the MIME-types that the WebAccelerator system should nd in the Content-Type header of
the response, in order to match to the specied object type.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify. The name of the object type must be in form group.type where group is used to organize
object type based on common usage pattern. for example, documents, binary, pages. The type is
used to uniquely identify the object type within a group.
• partition
Displays the administrative partition within which the object type resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by
an at sign (@[regular expression]) to indicate that the identier is a regular expression. See help
regex for a description of regular expression syntax.
• symmetric-compression
Species whether this object type will be compressed on the WAN link in a symmetric multibox
deployment.
See Also
create, delete, edit, list, modify, show, tmsh
policy
Congures an acceleration policy for WebAccelerator.
Syntax
Congure the policy component within the wam module using the syntax shown in the following sections.
Create/Modify
create policy [name]
modify policy [name]
app-service [[string] | none]
code [integer]
copy-from [name]
description [string]
nodes [add | delete | modify | replace-all-with] {
1886
WAM
[name] {
always-proxy [yes | no]
app-service [[string] | none]
assembly-compression [enable | disable]
assembly-compression-ows [enable | disable]
assembly-concatenation [enable | disable]
assembly-concatenation-sets [string ] ...
assembly-css-inlining [enable | disable]
assembly-css-inlining-urls [string ] ...
assembly-css-reorder [enable | disable]
assembly-css-reorder-cache-size [integer]
assembly-css-reorder-urls [string ] ...
assembly-dns-prefetch [enable | disable]
assembly-dns-prefetch-domain-lists [add | delete | replace-all-with]
{
[string] ...
}
assembly-dns-prefetch-https-enable [enable | disable]
assembly-dns-prefetch-https-automatic [enable | disable]
assembly-ibr [enable | disable]
assembly-image-inlining [enable | disable]
assembly-image-inlining-max-size [integer]
assembly-image-inlining-urls [string ] ...
assembly-js-inlining [enable | disable]
assembly-js-inlining-urls [string ] ...
assembly-js-reorder [enable | disable]
assembly-js-reorder-cache-size [integer]
assembly-js-reorder-urls [string ] ...
assembly-intelligent-client-cache [enable | disable]
assembly-icc-force [enable | disable]
assembly-icc-image-max-size [integer]
assembly-icc-css-inlining-max-size [integer]
assembly-icc-js-inlining-max-size [integer]
assembly-icc-max-num-urls [integer]
assembly-icc-min-client-expiry [integer]
assembly-minification [enable | disable]
assembly-multiconnect [enable | disable]
assembly-on-proxies [enable | disable]
assembly-pdf-linearization [enable | disable]
cache-complete-only [enable | disable]
cache-first-hit [yes | no]
cache-mode [memory-and-disk | memory-only]
cache-priority [low | medium | high]
cache-stand-in-period [integer]
code [integer]
coherency [blade | cluster]
defaults-from [name]
description [string]
jpeg-quality-is-relative [yes | no]
jpeg-quality [integer]
jpeg-strip-keeps-copyright [yes | no]
jpeg-strip-exif [no | yes | if-safe | make-safe]
jpeg-sampling factor [preserve | 1x1 | 2x1 | 1x2 | 2x2]
jpeg-progressive-encoding [yes | no]
jpegxr-quality [integer]
lifetime-cache-control-extensions
[add | delete | replace-all-with] {
[string] ...
}
lifetime-cache-control-extensions none
lifetime-cache-max-age [integer]
lifetime-honor-ows [yes | no]
lifetime-honor-ows-values
[add | delete | replace-all-with] {
[all-values | no-cache | no-store | no-transform |
max-age | must-revalidate | private | proxy-revalidate |
s-maxage] ...
}
lifetime-honor-ows-values none
1887
Traffic Management Shell (tmsh) Reference Guide
lifetime-honor-request [yes | no]
lifetime-honor-request-values
[add | delete | replace-all-with] {
[all-values | no-cache | no-store | no-transform |
max-age | max-stale | min-fresh] ...
}
lifetime-honor-request-values none
lifetime-http-heuristic [percentage]
lifetime-insert-no-cache [yes | no]
lifetime-preserve-response [yes | no]
lifetime-preserve-response-values
[add | delete | replace-all-with] {
[all-values | no-cache | no-store | no-transform |
max-age | must-revalidate | private | proxy-revalidate |
s-maxage | custom-extension] ...
}
lifetime-preserve-response-values none
lifetime-response-max-age [integer]
lifetime-response-s-maxage [integer]
lifetime-stand-in-codes
[add | delete | replace-all-with] {
[HTTP response code] ...
}
lifetime-stand-in-codes none
lifetime-use-heuristic [yes | no]
object-max-size [integer | from-profile]
object-min-size [integer | from-profile]
optimize-for-client [yes | no]
options { [hidden | nodelete | nowrite] ...}
order [integer]
response-codes-cached
[add | delete | replace-all-with] {
[HTTP response code] ...
}
viewstate-cache [yes | no]
viewstate-cache-size [integer]
viewstate-tag [string]
video-optimization-fast-start [enable | disable]
video-optimization-max-bitrate [integer]
video-optimization-insert-ad [enable | disable]
video-optimization-preroll-ad [enable | disable]
video-optimization-ad-frequency [integer]
video-acceleration-ad-policy [string]
webp-quality [integer]
matching [add | modify | delete | replace-all-with] {
[host | path | extension | method:[name] |
query-param:[name] | unnamed-query-param:[name] |
path-segment:[name] | cookie:[name] |
user-agent | referrer | protocol | header:[name] |
client-ip | content-type] {
app-service [[string] | none]
arg-alias [string]
arg-direction [left-to-right | right-to-left]
arg-name [string]
arg-ordinal [number]
description [string]
value-case-sensitive [yes | no]
values [add | modify | delete | replace-all-with] {
[ [regex] | [string] ] {
app-service [[string] | none]
can-be-empty [yes | no]
can-be-missing [yes | no]
invert-match [yes | no]
}
}
values none
}
}
matching none
1888
WAM
optimize-image [none | to-jpeg | to-gif | to-png | to-tiff]
png-256-colors [yes | no]
request-queueing [enable | disable]
variation [add | modify | delete | replace-all-with] {
[host | extension | method:[string] |
query-param:[name] | unnamed-query-param:[name] |
path-segment:[name] | cookie:[name] |
user-agent | referrer | protocol | header:[name] |
client-ip ] {
app-service [[string] | none]
arg-alias [string]
arg-all [yes | no]
arg-ambiguous-as-unnamed [yes | no]
arg-direction [left-to-right | right-to-left]
arg-name [string]
arg-ordinal [number]
description [string]
value-case-sensitive [yes | no]
values [add | modify | delete | replace-all-with] {
[ [regex] | [string] ] {
app-service [[string] | none]
cache-as [same | different]
can-be-empty [yes | no]
can-be-missing [yes | no]
invert-match [yes | no]
match-all [yes | no]
}
}
values none
}
}
variation none
[ proxy | proxy-override ]
[add | modify | delete | replace-all-with] {
[host | extension | method:[name] |
query-param:[name] | unnamed-query-param:[name] |
path-segment:[name] | cookie:[name] |
user-agent | referrer | protocol | header:[name] |
client-ip] {
app-service [[string] | none]
arg-alias [string]
arg-direction [left-to-right | right-to-left]
arg-name [string]
arg-ordinal [number]
description [string]
value-case-sensitive [yes | no]
values [add | modify | delete | replace-all-with] {
[ [regex] | [string] ] {
app-service [[string] | none]
can-be-empty [yes | no]
can-be-missing [yes | no]
invert-match [yes | no]
}
}
values none
}
}
[ proxy | proxy-override ] none
substitutions [add | modify | delete | replace-all-with] {
[name] {
app-service [[string] | none]
description [string]
dst-alias [string]
dst-direction [left-to-right | right-to-left]
dst-name [string]
dst-ordinal [number]
dst-type [query-param | unnamed-query-param | path-segment]
dst-urls [add | delete | replace-all-with] {
[URI] ...
1889
Traffic Management Shell (tmsh) Reference Guide
}
dst-urls none
src-alias [string]
src-direction [left-to-right | right-to-left]
src-name [string]
src-ordinal [number]
src-type
[ randomizer | request-url | query-param |
unnamed-query-param | path-segment ]
src-url [absolute | relative]
}
}
substitutions none
invalidations [add | modify | delete | replace-all-with] {
[name] {
active [yes | no]
app-service [[string] | none]
broadcast [no | yes]
description [string]
cache-content [add | modify | delete | replace-all-with] {
[host | path | extension | method:[name] |
query-param:[name] | unnamed-query-param:[name] |
path-segment:[name] | cookie:[name] |
user-agent | referrer | protocol | header:[name] |
client-ip] {
app-service [[string] | none]
arg-alias [string]
arg-direction [left-to-right | right-to-left]
arg-name [string]
arg-ordinal [number]
description [string]
value-case-sensitive [yes | no]
request-data-alias [string]
request-data-direction [left-to-right | right-to-left]
request-data-name [string]
request-data-ordinal [number]
request-data-type
[ host | path | extension | method |
query-param | unnamed-query-param |
path-segment | cookie | user-agent |
referrer | protocol | header |
client-ip ]
values [add | modify | delete | replace-all-with] {
[ [regex] | [string] ] {
app-service [[string] | none]
can-be-empty [yes | no]
can-be-missing [yes | no]
invert-match [yes | no]
}
}
values none
}
}
}
}
}
partition [name]
publish-build [integer]
publish-comment [string]
published-on [date]
Note: Policies can be created only in the Drafts folder. This is required to support publishing functionality.
You may create multiple Drafts folders, one for each folder where published policies are going to reside.
1890
WAM
Display
list policy [name ...]
show running-config policy [name ...]
all-properties
non-default-properties
partition
predefined
state
Delete
delete policy [name ...]
Save/Load
save policy [name]
load policy [name]
overwrite
file [filename]
Publish
publish policy [name]
publish-comment [string]
publish-build [integer]
Note: Published policies can be deleted, but cannot be modied. The only way to update a published policy
is to edit and then publish its development version.
Description
You can use the policy component to manage WebAccelerator acceleration policies. An acceleration policy
is a collection of dened rule parameters that dictate how the WebAccelerator system handles HTTP requests
and responses. The WebAccelerator system uses two types of rules to manage content: matching rules and
acceleration rules. Matching rules are used to classify requests by object type and match the request to a
specic acceleration policy. Once matched to an acceleration policy, the WebAccelerator system applies
the associated acceleration rules to manage the requests and responses. There are multiple types of acceleration
rules: variation, proxy, proxy override, parameter value substitution, and invalidation. The WebAccelerator
system ships with several predened acceleration policies that are optimized for specic Web applications,
in addition to several non-application specic policies for general delivery and one for an optional symmetric
deployment.
Examples
Note: For the following examples, the current folder is assumed to be set to /Common.
create policy "Drafts/My Policy"
Creates a new empty policy named My Policy in the folder /Common/Drafts.
create policy "Drafts/My Policy" copy-from "/Common/Generic Policy - Complete"
1891
Traffic Management Shell (tmsh) Reference Guide
Creates a new policy My Policy in the folder /Common/Drafts by copying standard system policy
/Common/Generic Policy - Complete.
modify policy "Drafts/My Policy" copy-from "/Common/Generic Policy - Complete"
Modies the policy My Policy by overwriting it with standard system policy /Common/Generic Policy -
Complete.
modify policy "Drafts/My Policy" nodes add { "My Node" { default-from Site }}
Adds a new node My Node as the child node of the node Site.
modify policy "Drafts/My Policy" nodes modify { "My Node" { matching add { content-type { values
add { pages.other }}}}}
Adds a new matching rule into the node My Node. The rule will match content type of the requests to WAM
object type pages.other.
publish policy "Drafts/My Policy" publish-comment "Added new node My Node"
Publishes the policy My Policy.
modify policy "Drafts/My Policy" nodes delete { "My Node" }
Deletes the node My Node from the policy My Policy.
delete policy "My Policy"
Deletes the policy My Policy.
save policy "My Policy" le policy.txt
Saves the policy My Policy into the le /var/local/wam/policy.txt.
load policy "Drafts/My Policy" overwrite le /tmp/policy.txt
Loads the policy My Policy from the le /tmp/policy.txt and overwrites the policy if it already exists.
Policy Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• code
Species a numeric non-zero code of the policy that is used for troubleshooting and performance
reporting. Each policy must have a unique code. If not supplied, it will be generated by the system. Use
the keyword generate to specify that the system generate a new unique code.
• copy-from
Species the name of an existing policy from which to copy all conguration options. If this eld is
used in the modify command, the conguration options of the existing policy will be replaced with the
new ones. The code, state, publish-build, publish-comment, and published-at options are not updated.
• description
User dened description of a policy.
• nodes
Species the collection of policy nodes. Matching rules and acceleration rules for acceleration policies
are organized on the Policy Tree, which consists of nodes. The structure of the Policy Tree supports a
parent-child relationship. This enables you to easily randomize rules. That is, because a leaf node in a
Policy Tree inherits all the rules from its root node and branch node, you can quickly create multiple
leaf nodes that contain the same rule parameters by creating a branch with multiple leaf nodes. If you
1892
WAM
override or create new rules at the branch node level, the WebAccelerator system reproduces those
changes to the associated leaf nodes.
• partition
Displays the administrative partition within which the policy resides.
• publish-build
Species the policy build version that was used during policy publishing. If not specied, this number
is automatically incremented by the WebAccelerator system.
• publish-comment
Species the user supplied comment that describes the changes in the policy that is being published.
• published-on
Species the date and time when this policy was last published.
• le
Species the le name where the policy is going to be saved or loaded from. If a full path is not specied,
it is set to /var/local/wam directory.
• overwrite
Species that the policy le for the save command or the policy component for the load command can
be overwritten if it exists.
Node Options
• always-proxy
Species that all requests matching this node must be proxied. If it enabled, proxy rules are not used,
even if congured. proxy-override rules still apply.
• app-service
Species the name of the application service to which this node belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete this node. Only the application service can modify or delete this node.
• assembly-compression
Species, when enabled, that the WebAccelerator system compresses content for responses, using
gzip-encoding. Note that to use this feature, you must set the compress value for the response's object
type in the corresponding object-type component, and the client must be able to accept gzip-encoded
content. The default value is enabled.
• assembly-compression-ows
Species, when enabled, that the WebAccelerator system requests gzip-encoded or deate-encoded
content from the origin Web server. Note that the origin Web server will comply only if it supports
compression, otherwise it will reply with uncompressed content. The default value is disabled.
• assembly-concatenation
Species, when enabled, that the WebAccelerator system will perform JavaScript/CSS concatenation
in HTML documents. The URLs that may be concatenated are specied using the
assembly-concatenation-sets option. See the WebAccelerator documentation for more details. The
default value is disabled.
• assembly-concatenation-sets
Species the concatenation sets that are active for this node. If a URL in the HTML document that
belongs to one of the enabled sets is found, it will transformed with concatenation using the URL of the
congured set. This is an ordered set, and if the URL exists in multiple active concatenation sets, the
rst set specied by this option will be used. See the WebAccelerator documentation for more details.
1893
Traffic Management Shell (tmsh) Reference Guide
• assembly-css-inlining
Species, when enabled, that the WebAccelerator system will inline CSS URLs in HTML documents.
The CSS URLs that may be inlined are specied using the assembly-css-inlining-urls option. See the
WebAccelerator documentation for more details. The default value is disabled.
• assembly-css-inlining-urls
Species the CSS URLs that may be inlined.
• assembly-css-reorder
Species, when enabled, that the WebAccelerator system will reorder CSS URLs to the HEAD section
of HTML documents. The CSS URLs that may be reordered are specied using the
assembly-css-reorder-urls option. See the WebAccelerator documentation for more details. The default
value is disabled.
• assembly-css-reorder-cache-size
Species the size of the intermediate cache used to store CSS URLs being reordered. Increasing the size
of this cache allows more CSS URLs to be reordered. The default value is 8kB. The maximum value is
8kB.
• assembly-css-reorder-urls
Species the CSS URLs that may be reordered. The URLs must be fully-qualied and whitespace used
to separate URLs. The URLs must correspond to WebAccelerator URL resources created by the command
create wam resource url. See the help for wam resource url.
• assembly-dns-prefetch
Species, when enabled, that the WebAccelerator system manipulates an HTML document to add DNS
prefetch tags at the end of the head. The DNS prefetch tags added are the combined list of domain lists
specied in assembly-dns-prefetch-domain-lists. DNS prefetch tags will not be inserted in the following
conditions: when DNS prefetching is explictly disabled in the document, either by an HTTP header or
by a meta-tag in the head of the HTML document; when the connection is served over HTTPS without
assembly-dns-prefetch-https-enable enabled; or when the connection is to a client browser that does
not support DNS prefetching.
In a document, most browsers will perform DNS prefetching on all domains linked with an HREF. This
will speed up performance by having the browser cache possible DNS resolutions before a client clicks
on a link, but DNS prefetching cannot automatically occur when a link is created through other means
(such as javascript). Inserting DNS prefetch tags addresses this issue.
The default value is disabled.
• assembly-dns-prefetch-domain-lists
Species the lists of domains that will be inserted into a document. The domain lists must correspond
to WebAccelerator domain list resources created by the command create wam resource domain-list.
See the help for wam resource domain-list.
• assembly-dns-prefetch-https-enable
Species, when enabled, that the WebAccelerator system manipulates an HTML document to add DNS
prefetch tags at the end of the head when a document is served over HTTPS when the client browser
supports DNS prefetching. By default, most browsers that support DNS prefetching will not do any
DNS prefetching on pages served over HTTPS. Enabling assembly-dns-prefetch-https-enable will
insert a meta-header that will turn on DNS prefetching on the page and a meta-header turning of DNS
prefetching for the rest of the page. DNS prefetching cannot be turned on for the rest of an HTML
document once the meta-header turning of DNS prefetching is reached.
DNS prefetching is turned off on most browsers serving pages over HTTPS by default as a security
measure. DNS prefetching can be used to track which pages are seen over HTTPS by watching the
domain resolution requests sent out by the client. According to DNS prefetch standards currently, turning
on DNS prefetching on a page will cause all links in the page to have their domains prefetched. This is
1894
WAM
mitigated by this option with the insertion of an HTTP meta-header turning off DNS prefetching after
the DNS tags inserted by the WebAccelerator system. Turning on DNS prefetching for the rest of the
page in a request served over HTTPS can be done with the assembly-dns-prefetch-https-automatic
option.
The default value is disabled.
• assembly-dns-prefetch-https-automatic
Species, when enabled, that the WebAccelerator system will not insert a meta-tag into an HTML
document served over HTTPS turning off DNS prefetching for the rest of a page. By default, most
browsers that support DNS prefetching will not do any DNS prefetching on pages served over HTTPS.
assembly-dns-prefetch-https-enable must be enabled for this option to work.
The default value is disabled.
• assembly-ibr
Species, when enabled, that the WebAccelerator system manipulates the Web browser cache to reduce
requests to your site for relatively static content, such as images and style sheet (CSS) les. The default
value is enabled.
• assembly-image-inlining
Species, when enabled, that the WebAccelerator system will inline image URLs in CSS documents.
The image URLs that may be inlined are specied using the assembly-image-inlining-urls option. See
the WebAccelerator documentation for more details. The default value is disabled.
• assembly-image-inlining-max-size
Species the maximum size of the image that is allowed to be inlined. The default value is 2kB. The
maximum value is 8kB.
• assembly-image-inlining-urls
Species the image URLs that may be inlined.
• assembly-js-inlining
Species, when enabled, that the WebAccelerator system will inline JS URLs in HTML documents.
The JS URLs that may be inlined are specied using the assembly-js-inlining-urls option. See the
WebAccelerator documentation for more details. The default value is disabled.
• assembly-js-inlining-urls
Species the JS URLs that may be inlined.
• assembly-js-reorder
Species, when enabled, that the WebAccelerator system will reorder JavaScript URLs to the end of
HTML documents. The JavaScript URLs that may be reordered are specied using the
assembly-js-reorder-urls option. See the WebAccelerator documentation for more details. The default
value is disabled.
• assembly-js-reorder-cache-size
Species the size of the intermediate cache used to store JavaScript URLs being reordered. Increasing
the size of this cache allows more JavaScript URLs to be reordered. The default value is 8kB. The
maximum value is 8kB.
• assembly-js-reorder-urls
Species the JavaScript URLs that may be reordered. The URLs must be fully-qualied and whitespace
used to separate URLs. The URLs must correspond to WebAccelerator URL resources created by the
command create wam resource url. See the help for wam resource url.
• assembly-intelligent-client-cache
1895
Traffic Management Shell (tmsh) Reference Guide
Species, when enabled, that the WebAccelerator system will Intelligent Client Cache HTML documents.
See the WebAccelerator documentation for more details. The default value is disabled.
• assembly-icc-force
Species, when enabled, that the WebAccelerator system will Intelligent Client Cache HTML documents,
even if the client does not support HTML5 localstorage. See the WebAccelerator documentation for
more details. The default value is disabled.
• assembly-icc-image-max-size
Species the maximum size of the image that is allowed to be inlined as part of Intelligent Client Caching.
The default value is 32kB. The maximum value is 50kB.
• assembly-icc-css-max-size
Species the maximum size of the CSS that is allowed to be inlined as part of Intelligent Client Caching.
The default value is 50kB. The maximum value is 1024kB.
• assembly-icc-js-max-size
Species the maximum size of the JS that is allowed to be inlined as part of Intelligent Client Caching.
The default value is 50kB. The maximum value is 1024kB.
• assembly-icc-max-num-urls
Species the maximum number of links in an HTML document that are allowed to be inlined as part of
Intelligent Client Caching. The default value is 10. The maximum value is 100.
• assembly-icc-min-client-expiry
Species the minimum client expiry of a resource that is allowed to be inlined as part of Intelligent
Client Caching. The default value is 2days.
• assembly-minication
Species, when enabled, that the WebAccelerator system will minify JavaScript and CSS.
• assembly-multiconnect
Species, when enabled, that the WebAccelerator system modies embedded URLs with unique
sub-domains that prompt the browser to open more persistent connections for each supported protocol
(HTTP or HTTPS). To use this feature, you must congure DNS with the additional domains and map
those domains to the same IP address as the base origin server. The default value is enabled.
• assembly-on-proxies
Species, when enabled, that the WebAccelerator system applies the Content Compression and Intelligent
Browser Referencing features (if enabled) to content served to clients, even if the content is not served
from the WebAccelerator system's cache. Enable this option if you are using the Content Compression
or Intelligent Browser Referencing features. The default value is enabled.
• assembly-pdf-linearization
Species, when enabled, that the WebAccelerator system applies linearization on PDF documents, if
the documents match the node matching rules. PDF linearization transforms the document to include
the index of the pages in the beginning. This allows Web browsers to load and show specic pages
rather than a whole document. See the WebAccelerator documentation for more details. The default
value is disabled.
• optimize-image
Species whether image optimization should be applied and the format conversion to use. Each of the
4 supported formats (JPEG, PNG, GIF, TIFF) can be converted to any of the others. Images using a
capability unique to one format may lose that feature when converted to a format that does not support
it. (For example, animated GIFs or multipage-TIFFs will have only the rst image when converted to
PNG or JPEG). Transparency will be lost when converting from GIF or PNG to JPEG. TIFF is a container
for many different image formats so the results will be best-effort and may not list completely.
1896
WAM
A converted image will likely have a different number of bytes after conversion. Some conversions are
likely to produce fewer bytes; however, a requested conversion will be done even if it results in more
bytes (for consistency). For example, you may want to offer multiple formats of an image without storing
them all on a server.
A correct Content-Type header will be generated for converted images, but HTML les will not be
rewritten.
• optimize-for-client Species whether to allow conversion to a format and/or size which is optimum
for the specic client making the request but which, if saved by that client and later sent elsewhere,
might not be appropriate.
• webp-quality WebP is a "lossy" compression format. This means when you convert an image to a WebP
and then convert it back, you will not get back exactly the same image you started with. Compression
changes the amount of information stored (and therefore the number of bytes), but not the image
dimensions (the number of pixels). The webp-quality attribute represents the absolute quality of the
WebP produced. Compression (quality) is represented as a number between 1-100 where 1 is minimal
quality, but small, and 100 is high-quality, but large. For most images, useful values of quality will be
from about 30-70.
• jpegxr-quality JPEG-XR is a "lossy" compression format. This means when you convert an image to
a JPEG-XR and then convert it back, you will not get back exactly the same image you started with.
Compression changes the amount of information stored (and therefore the number of bytes), but not the
image dimensions (the number of pixels). The jpegxr-quality attribute represents the absolute quality
of the JPEG-XR produced. Compression (quality) is represented as a number between 1-100 where 1
is minimal quality, but small, and 100 is high-quality, but large. For most images, useful values of quality
will be from about 5-30.
• jpeg-quality-is-relative =item jpeg-quality
JPEG is a "lossy" compression format. This means when you convert an image to a JPEG and then
convert it back, you will not get back exactly the same image you started with. Compression changes
the amount of information stored (and therefore the number of bytes), but not the image dimensions (the
number of pixels). When jpeg-quality-is-relative is set to no, the jpeg-quality attribute represents the
absolute quality of the JPEG produced. Compression (quality) is represented as a number between 1-100
where 1 is minimal quality, but small, and 100 is high-quality, but large. For most images, useful values
of quality will be from about 30-100. Because information once lost cannot be regained, converting a
low-quality JPEG to a higher quality is pointless and image optimization will prevent that (by not
changing the original to a higher JPEG quality).
You might be unable to choose a specic absolute quality for JPEG images. When jpeg-quality-is-relative
is set to yes, the relative JPEG quality setting is enabled. In this case, jpeg-quality is a percentage (a
number between 1-100) that when multiplied by each JPEG's original quality, becomes its optimized
quality.
• jpeg-strip-exif
JPEG les have a header (called EXIF) that contains optional data such as a date, time, camera model,
exposure settings, and so on. The EXIF header can also contain a color prole, which is required when
included. EXIF headers can be small or large. Unless they contain a color prole, they do not affect
displaying the image, and so can be removed if the loss of the information they contain is acceptable.
There are four options for this setting:
• no
Leaves any EXIF headers alone.
• yes
Always strips EXIF headers.
• if-safe
Only strips EXIF headers if they do not have color proles (ensures that images display properly).
1897
Traffic Management Shell (tmsh) Reference Guide
• make-safe
Applies the color prole and then strips the EXIF header (typically decreases image le size).
Applying a color prole requires additional CPU time.
• jpeg-strip-keeps-copyright This setting affects the meaning of jpeg-strip-exif. If it is set, stripping the
EXIF header will strip everything except the Copyright notice (if one is present).
• jpeg-sampling-factor
Sets the sampling factor to be used when producing JPEG images. The default value is preserve, which
matches the original le. You can also explicitly specify this option, as it can sometimes improve
compression.
• jpeg-progressive-encoding
When enabled, progressive encoding will be used in JPEG images. For large JPEG les, this can improve
compression. When this is enabled, it will be applied only if the le is large enough to improve
compression.
• png-256-colors
It is often possible to signicantly reduce the size of PNG les without changing their appearance very
much by reducing the number of colors to 256 optimally selected values. This optimization is enabled
when png-256-colors is set to yes.
• cache-complete-only
Species, when enabled, that the WebAccelerator system caches HTML pages only if the HTML code
within the page contains begin and end tags. When disabled, the WebAccelerator system reviews HTTP
response headers to determine if the information contained on the page is complete. The default value
is enabled.
• cache-rst-hit
Species that the rst response should be cached according to the policy caching settings. When this is
off, the response is cached when more than one request for the document has been seen. Turning this
on can reduce cache churn for unpopular documents. The default value is no.
• cache-mode
Species how where the cached documents will be stored. The default value is memory-and-disk.
Possible values are:
• memory-and-disk
The cached documents will be stored in memory or on disk.
• memory-only
The cached documents will be stored in memory only.
• cache-priority
Species the cache admission priority of documents matching the policy node. Documents with high
priority are more likely to be admitted into the cache. The default value is medium. Possible values are:
• low
Documents will have low priority.
• medium
Documents will have medium priority.
• high
Documents will have high priority.
1898
WAM
• cache-stand-in-period
Species the amount of time that the WebAccelerator system continues to serve content from cache if
the origin Web server does not respond to the WebAccelerator system's requests for fresh content. The
default value is 0 (zero), which means the WebAccelerator system responds to requests for expired
content with a HTTP 404 error.
• code
Species a numeric non-zero code for the node that is used for troubleshooting and performance reporting.
All nodes must have unique codes within the policy. If not supplied, the code will be generated by the
system. Use the keyword generate to specify that the system generate a new unique code.
• coherency
Species if the WebAccelerator system will attempt to keep content matching the associated node in
sync across the blades of a cluster. The default behavior is to keep content in sync.
• blade
The cached documents will not be kept coherent across blades. This causes each blade to have its
own copy of a given cached document.
• cluster
The cached documents will be kept coherent across blades. This causes the cluster to have single
version of a given cached document.
• defaults-from
Species the node that you want to use as the parent node. Your new node inherits all options and values
from the parent node specied. The default value is none, which means this is a root node.
• description
User dened description of a node.
• invalidations
Species the collection of invalidations rules. Invalidations rules enable you to expire cached content
before it has reached its time-to-live (TTL) value. This is useful when content updates are event-driven,
such as when an item is added to a shopping cart, a request contains a new auction bid, or a poster has
submitted content on a forum thread. Invalidations rules can be created only on leaf nodes.
• lifetime-cache-control-extensions
Enables you to congure extension tokens to be added to the cache-control header of HTTP response.
The WebAccelerator system does not process any of these extensions. It is possible that the origin Web
server will send cache-control extensions as well. You can choose whether to preserve them by including
the custom-extension in the lifetime-preserve-response-values list.
• lifetime-cache-max-age
Species the amount of time that the WebAccelerator system serves content from the cache before
requesting fresh content from the origin Web server. The default value is 4 hours.
• lifetime-honor-ows
Species, if enabled, that the WebAccelerator system honors certain cache-control directives from the
origin Web server response to determine cache lifetime. The default value is disabled.
• lifetime-honor-ows-values
Species which Cache-Control directive from the origin Web server response will determine cache
lifetime. Available directives are all-values, private, no-cache, no-store, must-revalidate,
proxy-revalidate, max-age, s-maxage, and expires. This option is only effective if lifetime-honor-ows
is enabled.
• lifetime-honor-request
1899
Traffic Management Shell (tmsh) Reference Guide
Species, if enabled, that the WebAccelerator system honors certain Cache-Control directives from the
client's browser request to determine cache lifetime. The default value is enabled.
• lifetime-honor-request-values
Species which cache-control directive from client's browser request will determine cache lifetime.
Available directives are all-values, no-cache, no-store, max-age, max-stale, and min-fresh. This option
is only effective if lifetime-honor-request is enabled. The default values are max-age, max-stale, and
min-fresh.
• lifetime-http-heuristic
Species the percentage, based on the HTTP Last-Modied header, that the WebAccelerator system
uses to compute TTL values for cached content. For example, if content was modied 30 days ago and
the lifetime-http-heuristic option is set to 50%, the WebAccelerator system caches the content for 15
days. This option is applicable only if you use the HTTP Last-Modied headers to identify content
lifetime. The default value is 50%. This option is effective only if lifetime-use-heuristic is enabled.
• lifetime-insert-no-cache
Species, when enabled, that the WebAccelerator system inserts a no-cache directive into the HTTP
Cache-Control header, which stops the client's browser from locally caching content. This value overrides
the HTTP Cache-Control header cache directives sent to the client by the origin Web server.
• lifetime-preserve-response
Species, if enabled, that the WebAccelerator system preserves certain Cache-Control directives from
the origin Web server and includes them into client's browser response. The default value is enabled.
• lifetime-preserve-response-values
Species which Cache-Control directive from the origin web server response will be preserved in
response to the client's web browser. Available directives are all-values, private, no-cache, no-store,
must-revalidate, proxy-revalidate, max-age, s-maxage, expires, and custom-extension. This option
is only effective if lifetime-preserve-response is enabled. The default value is all-values.
• lifetime-response-max-age
Species, when enabled, the amount of time that the client's browser should locally store content. This
value overrides the max-age and expires the directives in the HTTP Cache-Control header that are sent
to the client by the origin web server, only if the new value for the max-age is greater than the value
supplied by the origin web server. Modify this value only if there is an acceptable trade off between the
freshness of the content served to clients and overall site performance.
• lifetime-response-s-maxage
Species, when enabled, the amount of time that the client's browser should locally store shared content.
This value overrides the s-maxage and expires the directives in the HTTP Cache-Control header that
are sent to the client by the origin web server, only if the new value for the s-maxage is greater than the
value supplied by the origin web server. Modify this value only if there is an acceptable trade off between
the freshness of the shared content served to clients and overall site performance.
• lifetime-stand-in-codes
Species that the WebAccelerator system is allowed to serve stale content from the cache if it is not
able to re-validate its freshness with the origin web server. The WebAccelerator system serves invalid
content to the downstream proxies or clients if the response code from the origin web server matches
one of codes specied with this option. This option is effective only if cache-stand-in-period has a
non-zero value. The default values are 404, 500, and 504.
• lifetime-use-heuristic
Species, when enabled, that the WebAccelerator system uses the percentage from lifetime-use-heuristic
option to compute TTL values for cached content. The default value is no.
• matching
1900
WAM
Species the collection of matching rules. The rules consist of the HTTP request data type parameters
that the WebAccelerator system uses to match an incoming HTTP request to a specied node. The
following types of HTTP parameters are available for matching rules: host, path, extension,
query-param, unnamed-query-param, path-segment, cookie, user-agent, referrer, protocol, method,
header, client-ip, and content-type.
• object-min-size
Species the minimum object size required in order for content matching the associated node to eligible
for caching. The default behavior is to use the minimum object size specied by the associated
web-acceleration prole.
• object-max-size
Species the maximum object size allowed for content matching the associated node in order to eligible
for caching. The default behavior is to use the maximum object size specied by the associated
web-acceleration prole.
• order
Species the order of the node in the Policy Tree. All nodes in the policy must have an order. The order
numbers are sequential, staring from 2. Orders 0 and 1 are reserved for internal use. The child node
orders must be greater than the order of their parent node. You can change the order of the nodes by
updating the order option of the node that you would like to move. The system honors the specied
order if it falls within the range of sibling node orders. Otherwise, the system picks the closest valid
order number. The remaining nodes are automatically re-ordered to free requested order number. The
node order is also used as a last resort to determine which node to use when multiple nodes match the
request. The node with a lower order wins. New nodes have their order assigned automatically to make
them last among their siblings.
• proxy
Species the collection of proxy rules. In general, proxy rules options are relevant to only requests that
match their node, rather than to matched responses. The following types of HTTP parameters are available
for proxy rules: host, query-param, unnamed-query-param, path-segment, cookie, user-agent,
referrer, protocol, method, header, and client-ip.
• proxy-override
Species the collection of proxy override rules. You can dene proxy override rules and associated
conditions under which the WebAccelerator system should ignore proxing rules options. The following
types of HTTP parameters are available for proxy override rules: host, query-param,
unnamed-query-param, path-segment, cookie, user-agent, referrer, protocol, method, header, and
client-ip.
• request-queueing
Species, when enabled, that the WebAccelerator system will queue requests for expired or new
documents and proxy fewer requests to the origin web server (OWS). If the response is cachable, the
response will be served to all waiting requests; if not, the waiting requests will proxy normally.
• response-codes-cached
Species the collection of HTTP response codes that determine whether the WebAccelerator system
should cache the content. The valid codes are 300, 301, 302, 307, and 410. The codes 200, 201, 203,
and 207 are included into the list implicitly. The default values are 300 and 301.
• substitutions
Species the collection of parameter value substitution rules. Some requested pages include hyperlinks
that require that specic information appear in the response. You can congure parameter value
substitution so that when a query parameter contains identication information for a sites visitors, it
prompts the WebAccelerator system to serve different content for the request, based on the specic
visitor. Conversely, if parameter value substitution is not congured, the WebAccelerator system uses
1901
Traffic Management Shell (tmsh) Reference Guide
the value that it cached for the original request, for all subsequent requests after the rst, even if the
subsequent requests have different values that should be used in the response.
If you congure parameter value substitution, the WebAccelerator system changes the targeted parameters
value on the page served from the cache, so that the parameter you specify appears on the URL embedded
in that page.
• variation
Species the collection of variation rules. When the WebAccelerator system caches responses from the
origin web server, it uses certain HTTP request parameters to create a Unique Content Identier (UCI).
The WebAccelerator system stores the UCI in the form of a compiled response and uses the UCI to
easily match future requests to the correct content in its cache. You can congure variation rules to add
or modify the parameters on which the WebAccelerator system bases its caching process. If the
WebAccelerator system receives two requests that are identical except for the value of a query parameter
dened in the variation rule, it creates a different UCI for each, and caches each response under its
unique UCI. The following types of HTTP parameters are available for variation rules: host,
query-param, unnamed-query-param, path-segment, cookie, user-agent, referrer, protocol, method,
header, and client-ip.
• viewstate-cache
Species, when enabled, that the WebAccelerator system accelerates requests and responses for Web
form objects that are generated by ASP.NET web applications. Because the le size of forms can be
signicant, the WebAccelerator system is able to cache and substitute values, thus reducing the le size
and achieving faster performance.
• viewstate-cache-size
Species the size of the ViewState object cache in kilobytes. The default value is 100 kilobytes.
• viewstate-tag
Species the name of the web form eld where the ViewState object is stored. The default value is
__VIEWSTATE.
• video-optimization-fast-start
Species when enabled, that the WebAccelerator system optimizes video by prefetching.
• video-optimization-max-bitrate
Species, the maximum bitrate of video that can be allowed in kilobits per sec. The default vaule is 0.
• video-optimization-insert-ad
Species, when enabled, that the WebAccelerator system can insert ad into the video.
• video-optimization-preroll-ad
Species, when enabled, that the WebAccelerator system can insert ad at the beginning of the video.
• video-optimization-ad-frequency
Species the frequency of ad insertion. Units in seconds.
• video-optimization-ad-policy
Species the ad policy applicable when processing the video.
• type
Displays the node type. The possible types are:
• branch
The branch nodes exist only for the purpose of propagating rule parameters to leaf nodes. The
WebAccelerator system does not perform matching against branch nodes. Branch nodes can have
multiple leaf (child) nodes, as well as child branch nodes.
1902
WAM
• leaf
A leaf node inherits rule parameters from its parent branch node. The WebAccelerator system
performs matching only against leaf nodes, and then applies the leaf nodes corresponding acceleration
rules to the request.
Http Parameters
Both matching and acceleration rules are identied by the type, and optionally, by the name of HTTP
parameters that are used inside the rules. The following types of HTTP parameters are available:
• content-type
A rule that uses the content-type parameter is based on type denitions in the object-type components.
Unlike the HTTP request data types, a matching rule based on content type is specic to the content
type parameter that the WebAccelerator system generates for a response. You specify the regular
expression that you want a response's content type to match.
• client-ip
A rule that uses the client IP parameter is based on the IP address of the client making the request. The
IP address, however, may not always be the address of the client that originated the request. For example,
if the client goes through a proxy server, the IP address is the IP address of the proxy server, rather than
the client IP address that originated the request. If several clients use a specic proxy server, they all
appear to come from the same IP address.
• cookie:[name]
A rule that uses the cookie parameter is based on a particular cookie that you identify by name, and for
which you provide a value to match against. This value is usually literal and must appear on the cookie
in the request or in a regular expression that matches the request's cookie that appears on the cookie
HTTP request headers. These are the same names you use to set the cookies, using the HTTP Set-Cookie
response headers. The HTTP request can contain multiple cookies, and the rule identier must include
the name of the cookie separated with colon (:).
• extension
A rule that uses the extension parameter is based on the value that follows the far-right period, in the
far-right segment key of the URL path.
• header:[name]
A rule that uses the header parameter is based on a particular header that you identify by name and for
which you provide a value to match against. You can use an HTTP request data type header parameter
to create rules based on any request header other than one of the recognized HTTP request data types.
The HTTP request can contain multiple headers, and the rule identier must include the name of the
header separated with colon (:).
• host
A rule that uses the host parameter is based on the value provided for the HTTP Host request header
eld. This header eld describes the DNS name that the HTTP request is using.
• method
A rule that uses the method parameter is based on whether the request uses the GET or POST method.
• query-param:[name]
A rule that uses the query parameter is based on a particular query parameter that you identify by name
and for which you provide a value to match against. The value is usually literal and must appear on the
query parameter in the request, or in a regular expression that matches the requests query parameter
value. The query parameter can be in a request that uses GET or POST methods. The HTTP request can
contain multiple query parameters, and the rule identier must include the name of the header separated
with colon (:).
1903
Traffic Management Shell (tmsh) Reference Guide
• path
A rule that uses the path parameter is based on the path portion of the URI. The path is dened as
everything in the URL after the host and up to the end of the URL, or up to the question mark (whichever
comes rst).
• path-segment:[name]
A segment is the portion of a URI path that is delimited by a forward slash (/). For example, in the path:
/apps/search/full/complex.jsp, apps, search, full, and complex.jsp all represent path segments. The path
can contain multiple segments so the rule identier must include the name of the segment separated
with colon (:). The name can be a segment ordinal or some other string to distinguish it from other
segments rules in the same node.
• protocol
A rule that uses the protocol parameter is based on whether the request uses the HTTP or HTTPS protocol.
• referrer
A rule that uses the referrer parameter is based on the value provided for the HTTP Referer in the request
header. (Note the misspelling of Referer. This spelling is dened for this request header in all versions
of the HTTP specication.) This header provides the URL location that referred the client to the page
that the client is requesting. You do not typically base rules on the Referer request header, unless you
want your sites behavior to be dependent on the specic referrer. For example, one implementation
would be for sites that provide different branding for their pages based on the user's web portal or search
engine.
• unnamed-query-param:[name]
An unnamed query parameter is a query parameter that has no equal sign. That is, only the query
parameter value is provided in the URL of the request. The HTTP request may contain multiple unnamed
query parameters so the rule identier must include the name of it separated with colon (:). The name
can be the ordinal of unnamed query parameter or some other string that can make it distinguishable
from other unnamed query parameter rules in the same node.
• user-agent
A rule that uses the user agent parameter is based on the value provided for the HTTP User-Agent in
the request header, which identies the browser that sent the request.
Rule Options
• active
Species, when enabled, that the invalidation trigger rule is enabled. You can use this option to disable
a specic invalidation trigger rule temporary, without removing it from the policy.
• arg-all
Species, when enabled, that the rule matches all HTTP parameters of this type rather than one identied
by arg-name or arg-ordinal. This option is applicable to variation rules query-param,
unnamed-query-param, path-segment, cookie, and header. Such rules serve as a fallback case for
dening document variation. All root nodes must include one variation rule of each type with this option
enabled. The default value is disabled.
• arg-alias
• src-alias
• dst-alias
• request-data-alias
Species the user supplied alias for rules that use ordinals to identify HTTP request data. These include
the unnamed-query-param and path-segment rules. The src-alias and dst-alias options are used in
1904
WAM
parameter value substitution rules to dene aliases for the source and target denitions correspondingly.
The request-data-alias option denes an alias for the invalidation trigger rules.
• arg-direction
• src-direction
• dst-direction
• request-data-direction
Species the direction that the WebAccelerator system uses to count the ordinal of path-segment. The
src-direction and dst-direction options are used in parameter value substitution rules to dene the
ordinal direction for the source and target denitions correspondingly. The request-data-direction
option denes the ordinal direction for the invalidation trigger rules. The default value is left-to-right.
The possible values are:
• left-to-right
The path segment is counted form left to right.
• right-to-left
The path segment is counted form right to left.
• arg-name
• src-name
• dst-name
• request-data-name
Species the name of the parameter type for query-param, cookie, and header. If not specied,
arg-name option is initialized from the rule name. This option is not effective if arg-all is enabled. The
src-name and dst-dst options are used in parameter value substitution rules to dene the parameter
name for the source and target denitions correspondingly. The request-data-name option denes the
parameter name for the invalidation trigger rules.
• arg-ordinal
• src-ordinal
• dst-ordinal
• request-data-ordinal
Species, in the form of a number, the location of a parameter for unnamed-query-param and
path-segment rules. The numbering starts at 1 and follows the direction specied in the corresponding
direction option. This option is not effective if arg-all is enabled. The src-ordinal and dst-ordinal
options are used in parameter value substitution rules to dene the parameter ordinal for the source and
target denitions correspondingly. The request-data-ordinal option denes the parameter ordinal for
the invalidation trigger rules.
• broadcast
Species whether a triggered invalidation rule is broadcast to other members of a multibox deployment.
This option is only effective when the application using this policy has multibox set to farm or
symmetric.
• cache-content
Species the parameter for which the WebAccelerator system must obtain fresh content when the
invalidations rule is triggered. The available request types are: host, path, extension, query-param,
unnamed-query-param, path-segment, cookie, user-agent, referrer, protocol, method, header, and
client-ip.
1905
Traffic Management Shell (tmsh) Reference Guide
Note: You must select and congure the path parameter for the cached content to invalidate, or the
invalidations rule will fail to trigger. All other parameters are optional.
• description
User-dened description of a rule.
• dst-type
Species the HTTP parameter type to use as target denition for the request value substitution rule. A
target denition contains a value in the embedded URL that you want the WebAccelerator system to
replace with the value that you specied for the source denition, during assembly. The possible values
are:
• path-segment
Species that the WebAccelerator system targets the URL parameter, as specied by the dst-ordinal
and dst-direction you dene.
• query-param
Species that the WebAccelerator system targets the URL parameter, as specied by the dst-name
you dene.
• unnamed-query-param
Species that the WebAccelerator system substitutes the URL parameter, as specied by the
dst-ordinal you dene.
• dst-urls
Species the collection of URLs in the request for which you want the WebAccelerator system to replace
content.
• request
Species a parameter in the request that triggers the invalidations rule. The available request types are:
host, path, extension, query-param, unnamed-query-param, path-segment, cookie, user-agent,
referrer, protocol, method, header, and client-ip.
Note: You must select and congure the path parameter for the request header criteria, or the
invalidations rule will fail to trigger. All other parameters are optional.
• request-data-type
Species the HTTP request parameter value that the WebAccelerator system should nd in its cache
and for which it should request updated content from the origin Web server. The default value is
undened.
The following types of HTTP parameters are available:
• host
• query-param
• unnamed-query-param
• path-segment
• cookie
• user-agent
• referrer
• header
• client-ip
1906
WAM
Species that the WebAccelerator system should use the corresponding value from the request that
triggered the invalidation. Additional data, if required to identify the value, must be specied in the
request-data-name, request-data-ordinal, and request-data-direction options. The values option
is ignored.
• undened
Species that the WebAccelerator system should not use any values from the request that triggered
the invalidation. You must add a value into the values option with which to compare the cached
content.
• src-type
Species the HTTP parameter type to use as source denition for the request value substitution rule. A
source denition contains the value that the WebAccelerator system embeds in the URL, in place of the
cached (target denition) value, during substitution. Typically, the source denition is a specic request
element, such as a particular query parameter; however, you can specify another source type, such as a
random number. The possible values are:
• path-segment
Species that the WebAccelerator system substitutes the URL parameter, as specied by the
src-ordinal and src-direction options you dene.
• query-param
Species that the WebAccelerator system substitutes the URL parameter, as specied by the src-name
option you dene.
• randomizer
Species that the WebAccelerator system generates a random number and places that number on
the targeted location in an embedded URL.
• request-url
Species that the WebAccelerator system is limited to target-specic URLs embedded in a page, as
dened in the prex that an embedded URL must match before the WebAccelerator system performs
substitution. If you use the request URL as the source, the WebAccelerator system uses the entire
request URL as the value to substitute.
• unnamed-query-param
Species that the WebAccelerator system substitutes the URL parameter, as specied by the
src-ordinal option you dene.
• src-url
Species whether the request URL is a relative URL or an absolute URL. The default value is absolute.
• value-case-sensitive
Species, when enabled, that the HTTP parameter must be matched against supplied value(s) in case
sensitive manner. The default value is no.
• values
Values are a collection of rule parameters that enable you to specify different parameter values for the
same rule. Most rules allow only one value, while variation rules support multiple values. Each value
can prompt a different behavior by the WebAccelerator system. All variation rules must include at least
one value with match-all option enabled. A value can be represented by actual string, regex, or multiple
strings, or regexes separated by space ( ).
Rule Value Options
• can-be-empty
1907
Traffic Management Shell (tmsh) Reference Guide
Species, when enabled, that the dened HTTP request parameter is included in the request, but has no
value (is an empty string). The default value is no.
• can-be-missing
Species, when enabled, that the dened HTTP request parameter is absent from the request. The default
value is no.
• invert-match
Species, when enabled, that the dened HTTP request parameter does not match the associated regular
expression that you dened. The default value is no.
• match-all
Species, when enabled, that the dened HTTP request parameter matches all possible values. This
option is available only for variation rule values as a fallback case. Each variation rule must have at least
one value with this option enabled. The default value is no.
• cache-as
Species whether the associated value should prompt the WebAccelerator system to reply to matched
requests with the same or different content. This option is available only for variation rule values.
See Also
create, delete, edit, list, modify, show, tmsh
roi-statistics
Provides ROI statistics for WAM application.
Syntax
Provides ROI statistics for congured application within the wam module.
Display
show roi-statistics
show roi-statistics [application-name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
Description
You can use the roi-statistics component to view the ROI statistics of congured WAM application.
Examples
show roi-statistics my_application
The show command will display ROI statistics for the congured WAM application.
See Also
show, tmsh
1908
WAM
WAM Resource
concat-set
Congures concatenation sets for WebAccelerator for use in JavaScript/CSS concatenation
Syntax
Congure the concat-set within the wam resource module using the syntax shown in the following sections.
Create/Modify
create concat-set [name]
modify concat-set [name]
app-service [[string] | none]
url [url]
type [css|js]
members [string ] ...
Display
list concat-set [name ...]
Delete
delete concat-set [name ...]
Description
You can use the concat-set component to manage the concatenation sets used by the WebAccelerator
JavaScript and CSS concatenation feature. A concatenation set must be created, then enabled and activated
in the conguration on a WebAccelerator policy node.
Examples
create concat-set testSet url http://www.example.com/concatSet.css type css
Creates a set whose URL will be http://www.example.com/concatSet.css for use in concatenation.
list concat-set testSet
Displays properties of the concatenation set named testSet.
delete concat-set testSet
Deletes concatenation set named testSet.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• url
Species the URL that will be used to generate the concatenated link.
• type
Either "css" or "js". Species whether the set is to be used for CSS or JavaScript concatenation.
• members
Species the members of this set. The set members are the URL resources that are dened by the wam
resource url.
See Also
create, delete, edit, list, modify, tmsh
domain-list
Congures a list of domains for WebAccelerator for use in inserting DNS prefetch tags.
Syntax
Congure the domain-list component within the wam resource module using the syntax shown in the
following sections.
Create/Modify
create domain-list [name]
modify domain-list [name]
app-service [[string] | none]
description [[string] | none]
domains
[add | delete | none| replace-all-with] {
[string] ...
}
Display
list domain-list [name ...]
Delete
delete domain-list [name ...]
1910
WAM Resource
Description
You can use the domain-list component to manage the domain list resources used by the WebAccelerator
DNS prefetching feature. A domain-list must be created, then added to the appropriate domain-lists on a
WebAccelerator policy node in order for the domains within the domain list to be inserted into a document.
Examples
create domain-list my_domain_list domains add {example.com example2.com}
Creates a domain list resource for the domains example.com and example2.com for use in inserting DNS
prefetch tags.
list domain-list my_domain_list
Displays properties of the domain-list resource named my_domain_list.
delete domain-list my_domain_list
Deletes the domain-list resource named my_domain_list.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• domains
Species the domains described by the domain list resource.
See Also
create, delete, edit, list, modify, show, tmsh
url
Congures a URL resource for WebAccelerator for use in reordering whitelists
Syntax
Congure the url component within the wam resource module using the syntax shown in the following
sections.
Create/Modify
create url [name]
modify url [name]
app-service [[string] | none]
url [url]
type [css|js]
1911
Traffic Management Shell (tmsh) Reference Guide
Display
list url [name ...]
Delete
delete url [name ...]
Description
You can use the url component to manage the URL resources used by the WebAccelerator JavaScript and
CSS reordering features. A URL resource must be created, then added to the appropriate whitelist on a
WebAccelerator policy node in order for the corresponding URL to be reordered.
Examples
create url test.css url http://www.example.com/test.css type css
Creates a URL resource for the URL http://www.example.com/test.css for use in CSS reordering whitelists.
list url test.css
Displays properties of the URL resource named test.css.
delete url test.css
Deletes the URL resource named test.css.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• url
Species the URL described by the URL resource.
• type
Either "css" or "js". Species whether the URL resource is to be used for CSS or JavaScript reordering.
See Also
create, delete, edit, list, modify, show, tmsh
1912
WAM Resource
WOM
advertised-route
Congures a route advertised by the local endpoint to remote endpoints for WAN optimization.
Syntax
Congure the advertised-route component within the wom module using the syntax in the following
sections.
Create/Modify
create advertised-route [name]
modify advertised-route [name | all]
app-service [[string] | none]
description [string]
dest [ip address/netmask]
include [disabled | enabled]
label [value]
metric [integer]
origin [configured | discovered | manually-saved | persistable]
Display
list advertised-route
show advertised-route
all
all-properties
app-service
running-config
non-default properties
one-line
Delete
delete advertised-route [name]
Description
You can use the advertised-route component to congure a subnet that the system can reach through the
local endpoint. You can specify a netmask or use slash format.
Routes are advertised to all connected WAN Optimization Managers. The remote endpoints use the subnet
conguration information to determine peer routing and optimization actions.
Examples
list advertised-route all
Displays all endpoint advertised routes for the local WAN Optimization Manager.
delete advertised-route adv_rt2
Deletes the advertised route adv_rt2.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• dest
Species the IP address and netmask of the advertised route.
• include
Enables or disables the inclusion of this route in the optimization of trafc. This option allows you to
dene a subset of IP addresses to exclude from optimization within a larger included subnet. An excluded
endpoint advertised route must be a valid address range subset of an included endpoint advertised route.
The default is enabled.
• label
Species an optional descriptive label for this route.
• metric
Species a routing number to select between WAN Optimization Manager pairs. The higher the number,
the more expensive the route in terms of resources. Not currently implemented.
• origin
Species whether the route was discovered automatically or congured manually. You can change the
origin from discovered to persistable, if you want to save the route to the le bigip_local.conf when
you use the command save cong. After you run the command save cong, this attribute changes to
manually saved. Endpoints that have the attribute discovered are not saved to the le bigip_local.conf.
The options are:
• congured
Indicates that you manually congured this route. The system automatically sets this value, and you
cannot change it.
• discovered
Indicates that the system automatically discovered this route. Note that route for which the value of
the origin property is discovered are not saved to the le bigip_local.conf.
• manually-saved
After you run the command save / sys cong, the value of the origin property that was set to
persistable changes to manually-saved. Note that after the system changes the value to
manually-saved, you cannot change it again.
• persistable
Change the origin from discovered to persistable, if you want to save the route to the le
bigip_local.conf when you use the command save / sys cong.
1914
WOM
See Also
create, delete, list, wom local-endpoint, modify, wom remote-endpoint, wom server-discovery, show, tmsh
deduplication
Congures symmetric data deduplication for WAN optimization.
Syntax
Congure the deduplication component within the wom module using the syntax in the following sections.
Modify
modify deduplication
codec [sdd-v2 | sdd-v3]
[disabled | enabled]
max-endpoint-count [integer]
Display
list deduplication
show running-config deduplication
dictionary-size
one-line
Description
You can use the deduplication component to congure symmetric data deduplication, which compresses
data over the WAN by identifying and removing repetitive data patterns.
Examples
list deduplication
Displays all the deduplication settings.
modify deduplication max-endpoint-count 4
Sets the maximum number of remote endpoints to 4.
Options
• codec
Species which algorithm the system uses for deduplication.
The options are:
• sdd-v2
Used for low number of spokes, such as for data center to data center replication.
• sdd-v3
Used for high number of spokes, such as for connecting multiple remote sites or mesh topologies.
1915
Traffic Management Shell (tmsh) Reference Guide
• dictionary-size
Displays the current size of the dictionary, which deduplication uses to look up byte patterns.
• [disabled | enabled]
Enables or disables deduplication. The default value is enabled. Note that if you enable or disable
deduplication, you must then restart the BIG-IP WOM system using bigstart restart, or the change
takes effect the next time the BIG-IP device reboots.
• max-endpoint-count
Species the maximum number of concurrent remote endpoints supported by symmetric data
deduplication. For codec sdd-v3, the system sets the value at 128.
See Also
sys datastor, list, modify, show, tmsh, wom prole isession,
diagnose-conn
Diagnoses network connection problems.
Syntax
run diagnose-conn
Description
You can use the diagnose-conn component within the wom module to display diagnostic information about
network connections.
See Also
run, tmsh, wom verify-cong
endpoint-discovery
Congures automatic discovery of remote endpoints for WAN optimization.
Syntax
Congure the endpoint-discovery component with the wom module using the syntax in the following
sections.
Modify
modify endpoint-discovery
auto-save [disabled | enabled]
description [string]
discoverable [disabled | enabled]
discovered-endpoint [disabled | enabled]
icmp-max-requests [integer]
1916
WOM
icmp-min-backoff [integer]
icmp-num-retries [integer]
max-endpoint-count [integer]
mode [disable | enable-all | enable-icmp | enable-tcp]
reset-stats endpoint-discovery
Display
list endpoint-discovery
show running-config endpoint-discovery
all-properties
non-default-properties
one-line
show endpoint-discovery
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Description
You can use the endpoint-discovery component to specify parameters for automatically discovering remote
endpoints for WAN optimization. These endpoints are congured WAN Optimization Managers on remote
BIG-IP(r) systems that advertise themselves to the congured WAN Optimization Manager on the local
BIG-IP system.
Examples
modify endpoint-discovery max-endpoint-count 10
Limits the number of remote endpoints that can be discovered to ten. After discovering ten remote endpoints,
the WOM stops sending probe messages.
list endpoint-discovery all-properties
Displays the conguration parameters for the discovery of remote endpoints.
Options
• auto-save
Species whether the system automatically saves remote endpoints that it discovers. The default value
is enabled.
• description
User dened description.
• discoverable
Species whether the WAN Optimization Manager responds to probe messages it receives from WAN
Optimization Managers on remote BIG-IP systems. The default value is enabled.
• discovered-endpoint
Species whether the WAN Optimization Manager sends out probe messages to discover other WAN
Optimization Managers on remote BIG-IP systems in the network. The default value is enabled.
• icmp-max-requests
1917
Traffic Management Shell (tmsh) Reference Guide
Species the maximum number of ICMP probe message requests, after which the system stops sending
probe message requests until at least one message is cleared from the queue by either a timeout or a
response. The default value is 1024.
• icmp-min-backoff
Species the maximum number of seconds to wait before abandoning an ICMP probe message request
and resending it. The range is from 0 to 255. The default value is 5.
• icmp-num-retries
Species the maximum number of times the system sends an ICMP probe message request for a single
ow. The range is from 0 to 255. The default value is 10.
• max-endpoint-count
Species the highest number of endpoints for the system to discover before it stops sending probe
messages. The range is from 0 to 255. The default value is 0, which indicates no limit.
• mode
Species the type of probe messages the system should send. The default value is enable-all.
The options are:
• disable
Turns off probe messages.
• enable-icmp
Sends only ICMP probe messages.
• enable-tcp
Sends only TCP probe messages.
• enable-all
Sends both ICMP and TCP probe messages.
See Also
list, modify, show, tmsh, wom local-endpoint, wom remote-endpoint, wom server-discovery
local-endpoint
Congures the local endpoint for the WAN Optimization Manager.
Syntax
Congure the local-endpoint component within the wom module using the following syntax.
Create/Modify
create local-endpoint
modify local-endpoint
addresses [add | delete | replace-all-with] {
[ip address]
}
addresses none
allow-nat [disabled | enabled]
1918
WOM
description [string]
endpoint [disabled | enabled]
internal-forwarding [disabled | enabled]
ip-encap-mtu [unsigned integer]
ip-encap-profile [none | profile name]
ip-encap-type [gre | ipip | ipsec | none]
no-route [drop | passthru]
server-ssl [none | profile name]
snat [local | none | remote]
tunnel-port [unsigned integer]
Display
list local-endpoint
show local-endpoint
show running-config local-endpoint
all-properties
non-default-properties
one-line
Delete
delete local-endpoint
Description
You can use the local-endpoint component to modify the settings for the local endpoint for the WAN
Optimization Manager on the local BIG-IP(r) system.
Examples
modify local-endpoint allow-nat disabled
Disables the allow-nat option, specifying that the system does not accept connections for trafc behind a
Network Address Translation (NAT) device.
list local-endpoint all-properties
Displays all of the properties of the local-endpoint component.
Options
• addresses
Species a single IP address the system uses for the local endpoint. The IP address must be in the same
subnet as a self IP address on the BIG-IP(r) system.
• allow-nat
When enabled, species that the system accepts connections for trafc behind a Network Address
Translation device. The default value is enabled.
• description
User dened description.
• endpoint
When enabled, species that the local endpoint is available for initiating and receiving optimized trafc.
The default value is enabled.
To turn off WAN optimization on this endpoint, use disabled.
1919
Traffic Management Shell (tmsh) Reference Guide
• internal-forwarding
When enabled, species that the local endpoint is available for forwarding internal trafc to remote
endpoints. The default value is disabled.
This parameter works only if internal-forwarding for remote-endpoint is set to default.
• ip-encap-mtu
Species the maximum transfer unit for IP encapsulated trafc.
• ip-encap-prole
Species the name of the prole with the encapsulation settings. This prole must be of the type specied
for the setting ip-encap-type.
• ip-encap-type
Species the type of IP layer encapsulation to perform on iSession(tm) trafc.
The default value is none. The options are:
• gre
The system uses the Generic Routing Encapsulation (GRE) tunneling protocol.
• ipip
The system uses the IP over IP (IPIP) tunneling protocol.
• ipsec
The system uses IP security (IPsec) encapsulation.
• none
No IP encapsulation takes place.
• no-route
Species what the system does with trafc for which there is no remote endpoint to complete the iSession
connection.
The default value is passthru. The options are:
• drop
The system terminates the trafc ow.
• passthru
The trafc ow continues without an iSession connection.
• server-ssl
Species the default server SSL prole the system uses for all encrypted outbound connections. The
default value is none.
• snat
Species the IP address the system uses for incoming trafc as the source IP address of the TCP
connection between the WAN Optimization Manager and the server.
The default value is none. The options are:
• local
The system uses the endpoint IP address closest to the destination. Use this setting to make sure the
return route also goes through the BIG-IP system, so that both sides of the connection can be
optimized. This setting is useful if responses returning from the server to the client would not normally
pass through the BIG-IP system.
1920
WOM
• none
The system uses the original connecting client IP address.
• remote
The system uses the source IP address of the incoming iSession connection. Use this setting when
an appliance that uses NAT is located between the WAN Optimization endpoints.
• tunnel-port
Species the number of the port on the local endpoint that the WAN Optimization Manager uses for
control connections. The port must have access through the rewall. The range is from 1 to 65535. The
default value is 443.
See Also
list, modify, show, tmsh, wom advertised-route, wom remote-endpoint
remote-endpoint
Congures one or more remote endpoints for the WAN Optimization Manager.
Syntax
Congure the remote-endpoint component within the wom module using the following syntax.
Create/Modify
create remote-endpoint [name]
modify remote-endpoint [name]
address [ip address]
allow-routing [disabled | enabled]
app-service [[string] | none]
dedup-action [none | cache-refresh]
description [string]
endpoint [disabled | enabled]
internal-forwarding [default | disabled | enabled]
ip-encap-mtu [unsigned integer]
ip-encap-profile [none | profile name]
ip-encap-type [default | gre | ipip | ipsec | none]
origin [configured | discovered | manually-saved | persistable]
server-ssl [none | profile name]
snat [default | local | none | remote]
tunnel-encrypt [disabled | enabled]
tunnel-port [unsigned integer]
reset-stats remote-endpoint
Display
list remote-endpoint
list remote-endpoint [name]
show running-config remote-endpoint
show running-config remote-endpoint [name]
all-properties
dedup-codec
1921
Traffic Management Shell (tmsh) Reference Guide
non-default-properties
one-line
show remote-endpoint
show remote-endpoint [name]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Delete
delete remote-endpoint [name]
Note: If you delete a remote endpoint without also disabling the endpoint-discovery component, the remote
endpoint may reappear as it is rediscovered. To remove a remote endpoint from trafc initiated by this
WAN Optimization Manager, set the endpoint option of the remote-endpoint component to disabled.
Description
You can use the remote-endpoint component to create, modify, or delete a remote endpoint for trafc from
the local WAN Optimization Manager.
Examples
modify remote-endpoint 13.16.0.5 endpoint disabled
Disables the WAN optimization connection to the remote endpoint that is named 13.16.0.5.
list remote-endpoint all-properties
Displays all the properties of all the remote endpoints for trafc from the local WAN Optimization Manager.
Options
• allow-routing
Species whether there is a route from the local endpoint to this remote endpoint through which the
local endpoint can establish connections. The default value is enabled.
• address
Species the IP address of the remote endpoint.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• description
User dened description.
• dedup-action
Clears the cache used for symmetric data deduplication on the specied remote endpoint and immediately
resets the value to none.
• dedup-codec
Displays the deduplication codec used by the remote endpoint: sdd-v2 or sdd-v3.
• endpoint
1922
WOM
When enabled, species that trafc can be optimized between the local and remote endpoints. The
default value is enabled.
Note: Disabling a remote endpoint affects only the connection between the local endpoint and this
remote endpoint.
• internal-forwarding
When enabled, species that the remote endpoint is available for forwarding internal trafc.
When disabled, species that the remote endpoint is NOT available for forwarding internal trafc.
When default, species that forwarding internal trafc is managed by the
local-endpoint.internal-forwarding setting.
The default value is default.
• ip-encap-mtu
Species the maximum transfer unit for IP encapsulated trafc. The default value is 0.
• ip-encap-prole
Species the name of a prole with encapsulation settings. This prole must be of the type specied
for the setting ip-encap-type.
• ip-encap-type
Species the type of IP layer encapsulation performed on iSession trafc.
The default value is default. The options are:
• default
The system uses the ip-encap-type value set for the local endpoint.
• gre
The system uses the Generic Routing Encapsulation (GRE) tunneling protocol.
• ipip
The system uses the IP over IP (IPIP) tunneling protocol.
• ipsec
The system uses IP security (IPsec) encapsulation.
• none
No IP encapsulation takes place.
• origin
Species whether the remote endpoint was discovered automatically or congured manually.
The options are:
• congured
Indicates that you manually congured this remote endpoint. The system automatically sets this
value, and you cannot change it.
• discovered
Indicates that the system automatically discovered this remote endpoint. Note that endpoints for
which the value of the origin property is discovered are not saved to the le bigip_local.conf.
• manually-saved
1923
Traffic Management Shell (tmsh) Reference Guide
After you run the command save / sys cong, the value of the origin property that was set to
persistable changes to manually-saved. Note that after the system changes the value to
manually-saved, you cannot change it again.
• persistable
Change the origin from discovered to persistable, if you want to save the endpoint to the le
bigip_local.conf when you use the command save / sys cong.
• server-ssl
Species the server SSL prole the system uses to connect to this remote endpoint. This setting overrides
the server-ssl setting for the local-endpoint component. The default value is none.
• snat
Species the IP address the system uses as the source IP address of the TCP connection between the
WAN Optimization Manager and the server.
The default value is default. The options are:
• default
The system uses the snat value set for the local-endpoint component.
• local
The system uses the endpoint IP address closest to the destination. Use this setting to make sure the
return route also goes through the BIG-IP system, so that both sides of the connection can be
optimized. This setting is useful if responses returning from the server to the client would not normally
pass through the BIG-IP system.
• none
The system uses the original connecting client IP address.
• remote
The system uses the source IP address of the incoming iSession connection. Use this setting when
an appliance that uses NAT is located between the WAN Optimization Manager endpoints.
• tunnel-encrypt
Enables or disables encryption of trafc passing between the two WAN Optimization Managers. The
default value is enabled
• tunnel-port
Species whether to use a specic port for trafc optimized to this endpoint or to use port transparency
(0). The default value is 443.
See Also
create, delete, list, modify, show, tmsh, wom advertised-route, wom local-endpoint
remote-route
Displays the destination routes learned from the remote endpoints.
Syntax
Display the remote-route component within the wom module using the syntax in the following section.
1924
WOM
Display
show remote-route
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
detail
Description
You can use the remote-route component to view the subnets that the system can reach through the remote
endpoint(s). The system can optimize trafc destined for these subnets.
Examples
show remote-route
Displays the subnets reachable through the remote endpoint(s) congured on the WAN Optimization
Manager.
show remote-route detail
Displays detailed information about the remote endpoint(s) through which the displayed subnets can be
reached.
See Also
show, tmsh, wom advertised-route, wom remote-endpoint, wom server-discovery,
server-discovery
Congures the dynamic discovery of servers that can be reached through the local endpoint and the routes
to reach them.
Syntax
Congure the server-discovery component within the wom module using the syntax in the following
sections.
Modify
modify server-discovery
auto-save [disabled | enabled]
description [string]
filter-mode [exclude | include]
idle-time-limit [integer]
ip-ttl-limit [integer]
max-server-count [integer]
min-idle-time [integer]
min-prefix-length-ipv4 [integer]
min-prefix-length-ipv6 [integer]
mode [disabled | enabled]
rtt-threshold [integer]
subnet-filter [add | delete | none | replace-all-with] {
[ip address]
}
time-unit [days | hours | minutes]
1925
Traffic Management Shell (tmsh) Reference Guide
Display
list server-discovery
show running-config server-discovery
all-properties
auto-save
current-module
description
filter-mode
idle-time-limit
ip-ttl-limit
max-server-count
min-idle-time
min-prefix-length-ipv4
min-prefix-length-ipv6
mode
non-default-properties
one-line
rtt-threshold
subnet-filter
time-unit
Description
You can use the server-discovery component to congure the dynamic discovery of servers and the routes
to reach them through the local endpoint. The local endpoint advertises these routes to any remote endpoints
to which it is connected.
Examples
list server-discovery all-properties
Displays the settings for dynamic discovery of advertised routes.
modify server-discovery mode disabled
Disables the dynamic discovery of advertised routes.
Options
• auto-save
Species whether the system automatically saves the subnets that it discovers that can reached through
the local endpoint. The default value is enabled.
• description
User dened description.
• lter-mode
Species whether the subnets you add using the attribute subnet-lter are excluded from or included
in the discovery of advertised routes. If you specify include, and do not specify any IP addresses, no
subnets are discovered. The default is exclude with no IP addresses specied, which means that all
advertised routes that conform to the specied attributes are discovered.
• idle-time-limit
Species the maximum length of time a route can be idle without being removed from discovery. The
default value is 0. Use the attribute time-unit to set the unit of measure. Use the attribute min-idle-time
to set the minimum length of idle time.
• ip-ttl-limit
1926
WOM
Species the number of network segments on which a packet is allowed to travel before the route is
removed from discovery. The more routers a packet travels through, the smaller the ip ttl value is. The
range is 0 to 255. The default value is 5.
• max-server-count
Species the highest number of servers the system discovers before it stops looking. The default value
is 50.
• min-idle-time
Species the minimum length of time a route must be idle before being removed from discovery. The
default value is 0, which indicates that idle time is not considered in discovery. Use the attribute time-unit
to set the unit of measure. Use the attribute idle-time-limit to set the maximum length of idle time.
• min-prex-length-ipv4
Species the minimum prex length for route aggregation in IPV4 networks. The range is 0 to 32. The
default value is 32.
• min-prex-length-ipv6
Species the minimum prex length for route aggregation in IPV6 networks. The range is 0 to 128. The
default value is 128.
• mode
Enables or disables the dynamic discovery of servers that can be reached through the local endpoint.
For server discovery to take place, the setting mode of the component wom endpoint-discovery must
not be set to disabled.
• rtt-threshold
Species that the system does not add servers it discovers with a round-trip time greater than this value,
in milliseconds. The default value is 10.
• subnet-lter
Species the IP addresses of the subnets to include in or exclude from the discovery of advertised routes,
depending on the setting you selected for the attribute lter-mode. The default is none. If you selected
include for the attribute lter-mode, and do not specify any IP addresses, no subnets are discovered.
• time-unit
Species the unit of measure (days, hours, or minutes) for the length of idle time specied using the
attributes idle-time-limit and min-idle-time.
See Also
list, modify, show, tmsh, wom advertised-route, wom endpoint-discovery, wom local-endpoint, wom
remote-route
verify-config
Checks the WAN Optimization Manager conguration.
Syntax
run verify-cong
1927
Traffic Management Shell (tmsh) Reference Guide
WOM Profile
cifs
Congures a Common Internet File System (CIFS) prole.
Syntax
Congure the cifs component within the wom prole module using the syntax shown in the following
sections.
Create/Modify
create cifs [name]
modify cifs [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
fast-close [disabled | enabled]
fast-set-file-info [disabled | enabled]
office-2003-extended [disabled | enabled]
read-ahead [disabled | enabled]
record-replay [disabled | enabled]
write-behind [disabled | enabled]
Display
list cifs
list cifs [ [ [name] | [glob] | [regex] ] ... ]
show running-config cifs
show running-config cifs [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
show cifs
show cifs [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Delete
delete cifs [name]
Description
You can use the cifs component to manage a CIFS prole.
Examples
create cifs my_cifs_prole
Creates a CIFS prole named my_cifs_prole using the system defaults.
modify cifs my_cifs_prole fast-close disabled
Turns off fast-close for the CIFS prole named my_cifs_prole.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the prole that you want to use as the parent prole. The new prole inherits all settings and
values from the parent prole specied. The default value is cifs.
• description
User dened description.
• fast-close
Species whether the system speeds up le close operations by fullling them through the WAN
Optimization Manager closer to the request initiator. The default value is enabled.
• fast-set-le-info
Species whether the system speeds up le metadata change requests by fullling the requests through
the WAN Optimization Manager closer to the request initiator. The default value is enabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• ofce-2003-extended
Species whether the system performs read-ahead operations based on parsing the Microsoft CDF le
and understanding its structure. The default value is enabled.
• partition
Displays the administrative partition within which the component resides.
• read-ahead
Species whether the system speeds up CIFS le downloads by prefetching the le data on the WAN
Optimization Manager closer to the request initiator. The default value is enabled.
• record-replay
Species whether the system opens CIFS les faster by performing more intelligent read-ahead operations.
The default value is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
1930
WOM Profile
• write-behind
Species whether the system speeds up CIFS le uploads to the server by fullling write requests
through the WAN Optimization Manager closer to the request initiator. The default value is enabled.
See Also
create, delete, glob, list, ltm virtual, modify, regex, show, tmsh
isession
Congures an iSession prole.
Syntax
Congure the iSession component within the wom prole module using the following syntax.
Create/Modify
create isession [name]
modify isession [name]
adaptive-compression [disabled | enabled]
app-service [[string] | none]
compression [disabled | enabled]
compression-codecs [add | delete | none | replace-all-with] {
bzip2
deflate
lzo
}
data-encryption [disabled | enabled]
deduplication [disabled | enabled]
defaults-from [ [name] | none]
deflate-compression-level [integer]
description [string]
mode [disabled | enabled]
port-transparency [disabled | enabled]
reuse-connection [disabled | enabled]
target-virtual [none | host-match-all | host-match-no-isession |
virtual-match-all]
reset-stats isession
reset-stats isession [ [ [name] | [blog] | [regex] ] ... ]
Display
list isession
list isession [ [ [name] | [glob] | [regex] ] ... ]
show running-config isession
show running-config isession [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
1931
Traffic Management Shell (tmsh) Reference Guide
one-line
partition
show isession
show isession [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
field-fmt
global
Delete
delete isession [name]
Description
You can use the isession component to manage an iSession prole.
Examples
create isession my_isession_prole defaults-from isession
Creates an iSession prole named my_isession_prole using the system defaults.
modify isession my_isession_prole deduplication disabled
Turns off deduplication for the iSession prole named my_isession_prole.
Options
• adaptive-compression
Enables or disables the automatic selection of the optimal compression algorithm for the current trafc,
based on link speed. The system can use only compression algorithms that are specied. The default
value is enabled.
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• compression
Enables or disables the compression of data according to the methods you select for the attribute
compression-codecs. The default value is enabled.
• compression-codecs
Species the codecs to use for compression. The following codecs are available:
• bzip2
Species the use of the bzip2 compression algorithm, which improves compression ratios on
low-bandwidth data links.
• deate
Species the use of the Deate data compression algorithm.
• lzo
Species the use of the Lempel-Ziv-Oberhumer (LZO) data compression algorithm.
1932
WOM Profile
• data-encryption
Enables or disables encryption of the trafc on the outbound connection. If you select enabled, the
system uses the SSL proles specied on the local and remote endpoints of the iSession connection.
The default value is disabled.
• deduplication
Enables or disables data deduplication, which replaces previously transmitted data with references, thus
reducing the amount of bandwidth needed to transfer data over the WAN. The default value is enabled.
• defaults-from
Species the prole that you want to use as the parent prole. The new prole inherits all settings and
values from the parent prole specied. The default value is isession.
• deate-compression-level
Species the level of compression, if deate-compression is specied and adaptive-compression is
disabled. The range is 1 to 9. A higher value causes the CPU to spend more time looking for matches,
which may result in better compression. The default value is 1.
• description
User dened description.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• mode
Enables or disables the use of this prole for WAN optimization trafc. The default value is enabled.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• partition
Displays the administrative partition within which the component resides.
• port-transparency
Enables or disables the preservation of the destination port specied by the client over the WAN. The
default value is enabled.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
• reuse-connection
Enables or disables the saving and reuse of connections between the local and remote WAN Optimization
Managers. The default value is enabled.
• target-virtual
For terminated iSession trafc, species the matching criteria that a client-side BIG-IP system uses to
select a target virtual server on the server-side BIG-IP system.
The default value is virtual-match-all. The options are:
• none
Species that the system sends the terminated iSession trafc directly to the server.
• host-match-all
1933
Traffic Management Shell (tmsh) Reference Guide
Species that the system selects the closest match from all the host virtual servers.
• host-match-no-isession
Species that the system matches only host virtual servers with no iSession prole.
• virtual-match-all
Species that the system selects the closest match from all the virtual servers.
See Also
create, delete, glob, list, ltm virtual, modify, regex, reset-stats, show, tmsh, wom local-endpoint, wom
remote-endpoint
mapi
Congures a Messaging Application Program Interface (MAPI) prole.
Syntax
Congure the mapi component within the wom prole module using the following syntax.
Create/Modify
create mapi [name]
modify mapi [name]
app-service [[string] | none]
defaults-from [ [name] | none]
description [string]
discover-exchange-servers [disabled | enabled]
native-compression [disabled | enabled]
Display
list mapi
list mapi [ [ [name] | [glob] | [regex] ] ... ]
show running-config mapi
show running-config mapi [ [ [name] | [glob] | [regex] ] ... ]
all-properties
app-service
non-default-properties
one-line
partition
show mapi
show mapi [ [ [name] | [glob] | [regex] ] ... ]
(default | exa | gig | kil | meg | peta | raw | tera | yotta | zetta)
Delete
delete mapi [name]
1934
WOM Profile
Description
You can use the mapi component to manage a MAPI prole.
Examples
create mapi my_mapi_prole
Creates a MAPI prole named my_mapi_prole using the system defaults.
modify mapi my_mapi_prole native-compression enabled
Turns on native-compression for the MAPI prole named my_mapi_prole.
Options
• app-service
Species the name of the application service to which the object belongs. The default value is none.
Note: If the strict-updates option is enabled on the application service that owns the object, you cannot
modify or delete the object. Only the application service can modify or delete the object.
• defaults-from
Species the prole that you want to use as the parent prole. The new prole inherits all settings and
values from the parent prole specied. The default value is mapi.
• description
User dened description.
• discover-exchange-servers
Enables or disables the automatic discovery of the Microsoft Exchange servers in the network and
creation of a virtual server for each one discovered. The default value is disabled.
• glob
Displays the items that match the glob expression. See help glob for a description of glob expression
syntax.
• name
Species a unique name for the component. This option is required for the commands create, delete,
and modify.
• native-compression
Enables or disables native Microsoft Exchange compression. The default value is disabled.
• partition
Displays the administrative partition within which the component resides.
• regex
Displays the items that match the regular expression. The regular expression must be preceded by an at
sign (@[regular expression]) to indicate that the identier is a regular expression. See help regex for a
description of regular expression syntax.
See Also
create, delete, glob, list, ltm virtual, modify, regex, show, tmsh
1935
Traffic Management Shell (tmsh) Reference Guide
Index
A
aaa-active-directory component 267
aaa-client-cert component 269
aaa-crldp component 271
aaa-http component 272
aaa-ldap component 273
aaa-ocsp component 276
aaa-radius component 278
aaa-securid component 279
access component 343
access-policy component 265
acct-radius component 281
acct-tacacsplus component 282
acl component 209
action component 1449
active-directory component 219
active-directory-trusted-domains component 221
address-list component 1527
add-to-trust component 509
admin-partitions component 477
ad-policy component 1877
advertised-route component 1913
alertd component 1789
alg-log-profile component 673
all-stats component 1805
analytics component 1051, 1411
apache-ssl-cert component 1749
apl-script component 1697
apm-auth component 445
apm-avr-config component 212
application component 779, 795, 1878
application-volume component 1745
app-tunnel component 361
arcsight component 1790
arp component 1229
array component 1813
artifact-resolution-service component 403
autoscale-group component 1605
B
Base configuration
saving and loading 33
basic component 407
bay component 1814
bigip component 581
bigip-link component 584
blacklist-category component 1577
block-device-image component 1829
block-device-software-hotfix component 1831
bot-signature-category component 1496
bot-signature component 1495
by-handle component 1733
C
cached-certs component 801
category component 780
ccmode component 1853
cd component 57
cert component 510, 1715
certificate-authority component 1059
cert-ldap component 446
check-cert component 1717
cifs component 1929
citrix-client-bundle component 389
citrix-client-package-file component 391
citrix component 387
class component 1335
classification component 1061
client component 1718
client-ldap component 1062
client-rate-class component 363
client-ssl component 1064
client-traffic-classifier component 366
clock component 1606
cluster component 1606
clusterd component 1737
cmetrics component 1231
color-policer component 1338
concat-set component 1909
config-change-log component 1529
config component 1608
config-diff component 1613
config-sync component 513
Configuration files
storing and saving 33
connection component 847, 1614
connections component 1806
connectivity component 348
console component 1616
container-stat component 1530
cookie component 1023
cp component 58
cpu component 1617
create component 59
crl component 1720
crldp component 223
crldp-server component 749
csr component 1721
csyncd component 1738
current-state component 1531
customdb component 1225
customdb-file component 1226
customization-group component 265
custom-stat component 1699
D
daemon-ha component 1617
dag-globals component 1232
datacenter component 537
data-group component 1751
datastor component 1619
db component 1621
1937
Index
decision-box component 284
deduplication component 1915
default-config component 1622
default-node-monitor component 675
delete component 59
dest-addr component 1026
destination component 1781
device-capabilities-db component 1753
device component 514
device-config component 1497
device-group component 517
device-stats component 1489
device-sync component 435
dhcpv4 component 1075
dhcpv6 component 1080
diadb component 1853
diagnose-conn component 1916
diameter-avp component 1425
diameter component 893, 1084
diameter-endpoint component 1417
directory component 1746
disk component 1815
distributed-app component 539
dnat component 1854
dns component 896, 1088, 1623
dnsexpress component 1806
dns-express-db component 809
dns-logging component 1092
dnssec component 1807
domain-list component 1883, 1910
download-result component 1847
download-schedule component 1848
drop-policy component 1340
dtos component 1451
dynamic-acl component 285
E
edit component 60
element component 1781
ending-allow component 286
ending-deny component 288
ending-redirect component 289
endpoint-check-machine-cert component 291
endpoint-check-software component 293
endpoint-discovery component 1916
endpoint-linux-check-file component 296
endpoint-linux-check-process component 298
endpoint-mac-check-file component 300
endpoint-mac-check-process component 302
endpoint-machine-info component 304
endpoint-management-system component 225
endpoint-windows-browser-cache-cleaner component 305
endpoint-windows-check-file component 307
endpoint-windows-check-process component 310
endpoint-windows-check-registry component 312
endpoint-windows-group-policy component 314
endpoint-windows-info-os component 315
endpoint-windows-protected-workspace component 317
engine-update component 1465
epsec-package component 257
etherip component 1349
event component 1769
eviction-policy component 676
exchange component 355
exit component 62
external component 586, 803, 901
external-hsm component 1733
external-logon-page component 319
external-monitor component 1755
F
failover component 1624
failover-status component 520
fasthttp component 1094
fastl4 component 1099
feature-module component 1626
fec component 1350
fec-stat component 1353
feed-list component 1578
file-type component 1569
filter component 1785
finalize-custom-ami component 1856
firepass component 588, 904
firmware-config component 1767
fix component 1105
fix-connection component 1627
folder component 1628
format-script component 1445
form-based component 409
form-basedv2 component 412
forwarding-endpoint component 1375
fqdn-entity component 1531
fqdn-info component 1532
ftp component 591, 907, 1107
G
gateway-icmp component 594, 910
general component 571, 848
generate component 62
generation component 839
geneve component 1354
geoip component 1630
global component 1863
global-fqdn-policy component 1533
global-policy component 1581
global-profile component 1490
global-rules component 1534
global-settings component 477, 817, 819, 1029, 1307, 1631
gre component 1356
gtm component 1808
gtp component 597, 1109
guest component 1863
gx component 1431, 1452
gy component 1454
H
ha-group component 1634
hardware component 1637
hash component 1030
ha-status component 1637, 1873
1938
Index
help component 63
history component 479
host-info component 1638
hotfix component 1833
hsl component 1455
html component 1111
http2 component 1126
httpclass-asm component 436
http component 228, 599, 914, 1113, 1819, 1823
http-compression component 1122
httpd component 1639
http-header-modify component 320
http-method component 435
https component 602, 918
hypervisor-info component 1643
I
icap component 1128
icmp component 923
icmp-stat component 1644
icontrol-soap component 1644
icrd component 1739
ifile component 681, 1756
iiop component 1130
ike-daemon component 1321
ike-evt-stat component 1233
ike-msg-stat component 1234
ike-peer component 1322
ike-sa component 1326
image component 1836
image-file component 265
imap component 606, 926
inband component 929
info component 1583, 1768
insert-content component 1412
install component 64
interception-endpoint component 1378
interface component 1235, 1819, 1824
interface-cos component 1239
internal component 805
ip-address component 1645
ipfix component 1792
ipip component 1358
ipother component 1132
iprep-status component 1647
ipsec component 1360
ipsec-policy component 1327
ipsec-sa component 1330
ip-stat component 1646
ipv6-leasepool component 368
iquery component 542
irule component 1380
irule-event component 323
irules component 1783
isession component 1931
istats-trigger component 1770
K
kerberos component 231, 325, 419
kerberos-delegation component 751
kerberos-keytab-file component 232
key component 521, 833, 840, 1723, 1734
L
ldap component 234, 451, 609, 753, 932
ldns component 543
leasepool component 370
license component 213, 1648
lind component 1740
link component 543
list component 64
listener component 547, 1382
load-balancing component 574
load component 66
Loading the system configuration 33
local-database component 1794
local-endpoint component 1918
local-profile component 1492
local-syslog component 1795
log component 1649
logging component 327
logical-disk component 1747
login-failures component 455
logon-page component 328
log-rotate component 1651
log-setting component 214
lsndb component 1857
lsn-log-profile component 682
lsn-pool component 685
M
mac-address component 1653
machine-account component 261
management-dhcp component 1654
management-ip component 1655
management-ip-rules component 1536
management-ovsdb component 1656
management-port component 1796
management-route component 1658
mandatory-header component 1569
manual-security-association component 1331
map-8021p component 1308
map component 1361
map-dscp component 1309
mapi component 1934
master-key component 1727
matching-rule component 1542
mblb component 1134
mcpd component 1741
mcp-state component 1660
memory component 1660
message-box component 331
metrics component 576
metrics-exclusions component 578
modify component 66
module-provision component 1873
module-score component 936
mroute component 1240
msg component 834
msrdp component 1034
1939
Index
mssql component 612, 939, 1137
multicast-globals component 1241
mv component 67
mysql component 616, 943
N
nameserver component 809, 835
nat component 691
ndp component 1242
network-access component 371
network-storage-field component 1587
network-whitelist component 1505
nntp component 619, 946
node component 693
ntlm-auth component 263
ntlm component 1139
ntlmv1 component 422
ntlmv2 component 424
ntp component 1661
O
oam component 236, 333
object-type component 1884
ocsp component 239
ocsp-responder component 757
ocsp-stapling-params component 1141
ocsp-stapling-responses component 799
on-demand-compilation component 1543
on-demand-rule-deploy component 1544
one-connect component 1144
oracle component 622, 950
outbound-smtp component 1664
P
packet-filter component 1244
packet-filter-trusted component 1248
partition component 456
password component 457
password-policy component 458
path component 552
pcp component 1147
peer component 853, 865, 877
periodic component 1775
perpetual component 1777
persist component 553
persist-records component 1036
pkcs12 component 1728
platform_check component 1859
policy component 438, 697, 1293, 1384, 1545, 1584, 1886
policy-item component 266
policy-strategy component 708
pool component 712
pop3 component 625, 953
portal-access component 378
port-list component 1550
port-mirror component 1250
port-misuse-policy component 1552
postgresql component 628, 956
ppp component 1363
pptp component 1150
predefined-policy component 441
preference component 480
priority-group component 1302
private component 505
prober-pool component 554
proc-info component 1665
profile component 761, 1466, 1508, 1570, 1587
prompt component 1874
protocol component 866
protocol-dns-storage-field component 1601
protocol-sip-storage-field component 1601
provision component 1665
publish component 68
publisher component 1771, 1787
pva-traffic component 1668
pwd component 69
Q
qoe component 1152
quest component 392
queue component 1342
quit component 69
quota-mgmt component 1413
R
radius-aaa component 1419
radius-accounting component 634, 963
radius-avp component 1428
radius component 242, 460, 631, 763, 960, 1153, 1435, 1457
radius-server component 462, 766
ramcache component 1155, 1809
rating-group component 1441
rdp component 395
real-server component 637, 967
reboot component 69
receiver component 1817
region component 556
remote-desktop component 357
remote-endpoint component 1921
remote-format component 1602
remote-high-speed-log component 1798
remote-role component 464
remote-route component 1924
remote-syslog component 1800
remote-user component 467
remove-from-trust component 523
report component 91, 97, 103, 107, 111, 115, 119, 123, 127,
131, 135, 139, 145, 151, 155, 159, 163, 171, 175, 179, 183,
187, 191, 195, 199, 205
request-adapt component 1156
request-log component 1159
reset-stats component 70
resolver component 820, 1313
resource-assign component 335
response-adapt component 1162
response-code component 442
restart component 72
rewrite component 1164
rewrite-rule component 1758
1940
Index
roi-statistics component 1908
root module for tmsh 33
route component 855, 868, 879, 1251
route-domain component 1254
route-domain-selection component 336
router-advertisement component 1257
router component 859, 870, 885
rpc component 969
rrset component 837
rst-cause component 1260
rtsp component 1168
rule component 559, 722
rule-list component 1554
rule-stat component 1563
run component 72
Running configuration 33
S
saml component 245, 426
saml-idp-connector component 249
saml-resource component 430
saml-sp-connector component 431
sandbox component 380
sasp component 972
save component 76
Saving the running configuration 33
schedule component 1563
scheduled-report component 100
script component 485, 1772
scriptd component 1669
scripted component 639, 975
sctp component 1172
securid component 252
self-allow component 1264
self component 1261
send-mail component 76
server component 561, 1730
server-discovery component 1925
server-ldap component 1175
server-ssl component 1177
service-chain-endpoint component 1399
service component 1670, 1700
service-policy component 1266
session component 861, 887
sessiondb component 1402
settings component 1461
shaping-policy component 1345
shared component 507
show component 76
shutdown component 79
signature component 1838
signature-definition component 782
signatures component 786
signatures-update component 1486
signature-update-schedule component 784
signature-version component 785
sip component 642, 978, 1038, 1185
sipdb component 1859
smb component 982
smtp component 646, 986, 1189
smtps component 1191
smtp-server component 1672
snat component 725
snatpool component 730
snat-translation component 728
sniff-updates component 524
snmp component 648, 1673
snmp-dca-base component 991
snmp-dca component 989
snmp-link component 651
soap component 654, 994
socks component 1193
software component 1875
software-status component 258
source-addr component 1041
source component 469
spdy component 1195
splunk component 1802
spm component 1421
spva-stats component 1522
sshd component 1684
ssh-keyswap component 1860
ssl-cc-ldap component 768
ssl-cert component 1759
ssl component 1044
ssl-crl component 1762
ssl-crldp component 771
ssl-key component 1763
ssl-ocsp component 774
stale-rules component 169
start component 80
state-mirroring component 1687
statistics component 1198
status component 1839
stop component 80
storage-field component 1603
Stored configuration files 33
stp component 1267
stp-globals component 1270
stream component 1200
submit component 81
subscriber-activity-log component 1414
subscriber-attribute component 1407
subscriber component 1405, 1458
subscribers component 1410
swg-scheme component 216
sync-status component 525
sync-sys-files component 1688
syslog component 1689
system component 1809, 1820, 1825
System configuration
loading and saving 33
T
tacacs component 470, 775
tacacsplus component 254, 338
tcp component 657, 997, 1203
tcp-echo component 1002
tcp-half-open component 660, 1005
template component 1703
test-monitor component 1861
tethering component 1459
1941
Index
tftp component 1211
throughput component 1810
time component 81
timer-policy component 1272
tmm component 1742
tmm-info component 1692
tmm-traffic component 1693
tmsh component 84
tmsh hierarchy
working within 33
topology component 567
traffic-class component 732
traffic component 570, 1693
traffic-control component 850
traffic-group component 525, 1303
traffic-priority component 1311
traffic-profile component 1868
traffic-selector component 1333
transaction component 501
transparent component 824
transport-config component 856, 873, 881
triggered component 1778
trunk component 1276
trust-domain component 528
tsig-key component 811
tunnel component 1317, 1365
U
ucs component 1694
udp component 663, 1008, 1213
udp-portlist component 1524
universal component 1047
update component 1841
update-signatures component 787
update-status component 1842
url-category component 789, 796, 1849
url-cat-policy component 787
urlcat-query component 734
url component 1911
urldb-feed-list component 790
urldb-file component 792
url-filter component 217
user component 472
user-domain component 1566
user-list component 1567
V
v6rd component 1368
validating-resolver component 827
variable-assign component 339
vdi component 358
vdisk component 1869
verify-config component 1927
version component 503, 1696
virtual-address component 743
virtual component 735
virtual-disk component 1870
virtual-disk-template component 1871
virtual-location component 1012
vlan-allowed component 1284
vlan component 1280, 1318, 1820, 1826
vlan-group component 1285
vmware-view component 399
volume component 1843
vxlan component 1370
W
wa-cache component 1216
wap component 666, 1015
watch-devicegroup-device component 531
watch-sys-device component 532
watch-trafficgroup-device component 534
wccp component 1288, 1372
web-acceleration component 1217
webapp-language component 442
web-security component 1220
webtop component 382
webtop-link component 385
windows-group-policy-file component 266
wmi component 669, 1019
X
xml component 1221
Z
zone component 813, 843
1942
Index
