ACE - configuring script probes (tclsh)

Hey guys
I'm looking for exampels about writing script probes for the ACE module.
In the cisco's ACE configuration guide i already found one, but i'd be happy to have a few more. Does anybody knows where i can get some other examples?
cheers
patrick

Tach auch and Hello!
If you check the software section for the ACE Module you will find some ace scripts you can download.
http://www.cisco.com/cgi-bin/Software/Tablebuild/doftp.pl?ftpfile=cisco/crypto/3DES/lan/catalyst/6500/ace/ace_scripts.tgz&app=Tablebuild&status=showC2A
Viel Erfolg
Roble

Similar Messages

  • ACE TCL Script Probe for Websphere MQ

    Have anyone written a TCL script to probe MQ from the ACE?  Our app guys are saying that a Layer 4 probe (TCP port check) is generating errors in the QManager logs because there is no data exchange, just TCP connection setup, then tear-down.
    Thought I would check here to see if anyone has written a TCL Script for this before or has any other suggestions.
    Thanks!                  

    Hi,
    What do you need to check exactly on the server?  will be an specific uri?
    Cesar R
    ANS Team

  • ACE 4710 LDAP probe

    Folks,
    We'll be adding a farm this weekend to do some kind of balance for LDAP and LDAPs servers.
    I've been thinking about what would be the best way to probe that servers.
    I assume an generic TCP probe has to be created testing 389 and 636, but i honestly don't know what should i expect coming from the real servers.
    Does anyone have a LDAP farm in place or something like that.. ? I've found an script on the internet, but it seems a little bit further that what i can understand.. therefore i'm not really confident to use this.
    Thanks for any advices.
    Andre

    Hi Andre,
    You can use scripted ldap probe (LDAP_PROBE) available with ACE. It sends an anonymous bind request and check for bind success.
    probe tcp LDAPS_Probe
      port 636
    probe tcp LDAP_Probe
      port 389
    This is how you can apply the script for LDAP port 389.
    script file 1 LDAP_PROBE
    probe scripted LDAP_PROBE_389
    interval 5
    passdetect interval 30
    receive 5
    script LDAP_PROBE
    serverfarm host SF-LDAP-389
    description SF LDAP Port 389
    predictor leastconns
    probe LDAP_PROBE_389
    rserver LDAP-RS1-389
    inservice
    The only supported LDAP probe on the ACE module is the unsecure scripted probe,
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/configuration/slb/guide/script.html#wp1111558
    The pre-made TCL script probes available from the Software download page also contains an LDAP probe that you can use to verify the health of the LDAP servers.
    The ace_scripts.tgz zip file contains these scripts and is located at this URL:
    http://www.cisco.com/pcgi-bin/tablebuild.pl/cat6500-ace
    To unzip this file, use the gunzip command in Exec mode,
    http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/slb/guide/script.html#wp1107470
    For your convenience, the following sample scripts for the ACE are available to support the TCL feature and are supported by Cisco TAC:
    •CHECKPORT_STD_SCRIPT
    •ECHO_PROBE_SCRIPT
    •FINGER_PROBE_SCRIPT
    •FTP_PROBE_SCRIPT
    •HTTP_PROBE_SCRIPT
    •HTTPCONTENT_PROBE
    •HTTPHEADER_PROBE
    •HTTPPROXY_PROBE
    •IMAP_PROBE
    •LDAP_PROBE -----------------> "The LDAP probe you are looking for"
    •MAIL_PROBE
    •POP3_PROBE
    •PROBENOTICE_PROBE
    •RTSP_PROBE
    •SSL_PROBE_SCRIPT
    •TFTP_PROBE
    Also remember that the binding request should be send as a binary and not via ASCII. To get a packet capture of a succeessful credential binding request with username and password and then convert this to HEX value and insert it in the script.
    The easiest way is to capture a packet with the authentication credentials and then replace the hex bind string in the example.
    The alternative is to handcode the BER coded ASN.1 data string - which while more fun is time consuming. The remainder of the script can stay the same.
    You can do this on an ACE module. You have to be aware that 300c02010160 in the example script string is a sort of "header" that holds the request id (1). This will be different in your packet capture.
    If you look at the decomposition of the example you'll be able to see how it is put together and what you need to change.
    0x30 The start of a universal constructed sequence
    0x0c The length of the sequence minus the tag and length bytes = 12 bytes
    0x02 Next field is an integer
    0x01 The length of the next field (1 byte)
    0x01 Value (this is the message ID)
    0x60 Application, number 0, use RFC2251 to decode. This is a Bind Request
    0x07 Length of data to follow.
    0x02 Integer
    0x01 Length 1
    0x03 3 - this is the LDAP version.
    0x04 String
    0x00 Length 0
    0x80 Simple Authentication
    0x00 Length 0
    Just keep the id the same in the unbind.
    The string I use is:
    302d02010160280201030418636e3d41636550726f78792c6f3d556e69766572736974798009ffffffffffffffffff
    where I've replaced the 9 character password with 9*x'ff'.
    The username for binding is AceProxy.  If you want to use the same script then create that username and set the password in the string above (in hex).  If for example you set the password to Example12 then you need to set the 9*x'ff' to '4578616d706c653132' - which is the hex representation of the ASCII.
    Note that if you use fewer or more than 9 characters then you'll need to change other values in the string because they refer to lengths.
    You need to create a copy of the standard LDAP probe into your own file and then replace the hex string in the "puts" line which you identified above with the new string.
    Then copy the file to the ACE:
    ace1/ldap# copy ftp: disk0:
    Enter source filename[]? My-LDAP_PROBE
    Enter the destination filename[]? [My-LDAP_PROBE]
    Enter hostname for the ftp server[]?
    1.2.3.4
    Enter username[]? anonymous
    Enter the file transfer mode[bin/ascii]: [bin]
    Password:
    Passive mode on.
    Hash mark printing on (1024 bytes/hash mark).
    In the context create a scripted probe definition:
    probe scripted PROBE-LDAP-389
      interval 60
      receive 20
      script My-LDAP_PROBE
    Load the script into the context:
    script file 10 My-LDAP_PROBE
    And then add it to the serverfarm:
    serverfarm host FARM-LDAP
      probe PROBE-LDAP-389
    The manual implies that you can pass arguments to a scripted probe, but you would then have to build the hex string dynamically - taking care that all the length values were correct.
    This should be enough to enable you to implement the script.
    Find another example on this
    URL:http://scuq.abyle.org/?page_id=201
    #!name = ADV_LDAP_PROBE
    #### > user for linux tclsh !/usr/bin/tclsh8.4
    # Stefan Nistelberger
    # changes to cisco's original probe
    # * username and password with ldap simple bind (dynamically generated packets)
    # * unable to connect exception handling
    # * debug message for invalidCredentials
    # debug procedure
    # set the EXIT_MSG environment variable to help debug
    # also print the debug message when debug flag is on
    proc ace_debug { msg } {
        global debug ip port EXIT_MSG
        set EXIT_MSG $msg
        if { [ info exists ip ] && [ info exists port ] } {
            set EXIT_MSG "[ info script ]:$ip:$port: $EXIT_MSG "
        if { [ info exists debug ] && $debug } {
            puts $EXIT_MSG
    # main
    # parse cmd line args and initialize variables
    ## set debug value
    set debug 1
    if { [ regsub -nocase "DEBUG" $argv "" argv] } {
        set debug 1
    ace_debug "initializing variable"
    set EXIT_MSG "Error config:  script ADV_LDAP_PROBE \[DEBUG\]"
    set ip $scriptprobe_env(realIP)
    set port "0"
    set ldap_start "30"
    set ldap_bindheader "02010160"
    set ldap_bind "0201"
    set ldap_version "02"
    set ldap_gap1 "04"
    set ldap_gap2 "80"
    set ldap_bindheader_len 5
    set base_len 0c
    set ldap_simple_auth "8007"
    proc toASCII { char } {
       scan $char %c value
       return [format %-x $value]
    set username [ lindex $argv 0 ]
    set hexusername ""
    set password [ lindex $argv 1 ]
    set hexpassword ""
    foreach char [split $username ""] {
         set hexchar [toASCII $char]
         append hexusername $hexchar
    foreach char [split $password ""] {
         set hexchar [toASCII $char]
         append hexpassword $hexchar
    set username_len [string length $username]
    ace_debug $username_len
    set password_len [string length $password]
    ace_debug $password_len
    set base_len [expr 0x$base_len]
    set seq_len [expr $username_len + $password_len + $base_len]
    set sub_seq_len [expr $seq_len - $ldap_bindheader_len]
    set seq_len [format %02x $seq_len]
    set sub_seq_len [format %02x $sub_seq_len]
    set hexldapbindpckt ""
    append hexldapbindpckt $ldap_start
    append hexldapbindpckt "$seq_len"
    append hexldapbindpckt $ldap_bindheader
    append hexldapbindpckt $sub_seq_len
    append hexldapbindpckt $ldap_bind
    append hexldapbindpckt $ldap_version
    append hexldapbindpckt $ldap_gap1
    append hexldapbindpckt [format %02x $username_len]
    append hexldapbindpckt $hexusername
    append hexldapbindpckt $ldap_gap2
    append hexldapbindpckt [format %02x $password_len]
    append hexldapbindpckt $hexpassword
    # if port is zero the use well known ldap port 389
    if { $port == 0 } {
        set port 389
    #ace_debug $hexldapbindpckt
    # PROBE START
    set errorcode [catch {
            set sock [ socket $ip $port ]
    } msg ]
    if {$errorcode != 0} {
            ace_debug $msg
            exit 30002
    fconfigure $sock -buffering line -translation binary
    # anonymous bind request
    #puts -nonewline $sock [ binary format "H*" 300c020101600702010304008000 ]
    puts -nonewline $sock [ binary format "H*" $hexldapbindpckt ]
    set code "ffffff"
    flush $sock
    ace_debug "bef"
    set line [read $sock 22]
    ace_debug "aft"
    binary scan $line H* res
    binary scan $line @15H6 code
    close $sock
    #  make probe fail by exit with 30002 if ldap reply code != success code  0x0a0100
    if {  $code != "0a0100" } {
        if {  $code == "0a0131" } {
            ace_debug " probe failed : expect response code \'0a0100\' but received
    \'$code\' = invalidCredentials"
        } else {
            ace_debug " probe failed : expect response code \'0a0100\' but received
    \'$code\'"
        exit 30002
    ## make probe success by exit with 30001
    ace_debug "probe success"
    exit 30001
    URL for reference:
    https://cisco-support.hosted.jivesoftware.com/thread/132800?decorator=print&displayFullThread=true
    HTH
    Sachin Garg

  • ACE configuration using GUI

    Hi all,
    i configured ACE in multi context for failover. then i configured primary ACE using GUI after configuring server farm and click DM sync and SYNC all.Then i checked secondary ACE whether configuration is synced but its not sync with secondary.what might be the problem.

    do a 'show ft group detail' and make sure you have config synch enabled
    "Running cfg sync enabled : Enabled"
    If not, you need to turn it on.
    Also check the status.
    "Running cfg sync status "
    Sometimes it is enabled but not working because files can't be synched like ssl keys/certs or script probes.
    Gilles.

  • ACE TCL Script to retrieve Cookie

    I am in need to to do a post instead of a Get with a probe. So I have configured a TCL script to perform this. The issue I have is that I also need to parse the Cookie instead of the http1. response. Any ideas? Or does anyone have a variable indetifiers for TCL scripting that Cisco uses?
    Thank you,
    Tim

    HI Thulin,
    Health probe scripts have access to many configured items through a predefined TCL array. The most common use of this array is to find the current real server IP addresses of the suspect during any particular launch of the script.
    Whenever the ACE executes a script probe, a special array called scriptprobe_env is passed to the script. This array holds important parameters that may be used by the script.
    Member name Content
    realIP
    Suspect IP address
    realPort
    Suspect IP port
    intervalTimeout
    Configured probe interval in seconds
    openTimeout
    Configured socket open timeout for this probe (tbd)
    recvTimeout
    Configured socket receive timeout for this probe
    failedTimeout
    Configure failed timeout
    retries
    Configured retry count
    healthStatus
    Current suspect health status
    contextID
    The ID for the context running this script
    failedRetries
    Consecutive successful retries on a failed server before marking it as passed
    isRouted
    Boolean to determine if this IP address is a routed address
    pid
    Process identifier of the TCL process
    runID
    Pointer to the event structure (em_event_t)
    Kindly refer to the following url to get more info regarding your tcl variables:
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A1/configuration/slb/guide/script.html#wp1082112
    http://www.cisco.com/univercd/cc/td/doc/solution/dc_ap11i.pdf
    http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/ace/ace_301/slbgd/script.pdf
    Regards,
    Sachin Garg

  • Why does unchecking the "use automatic configuration script" box on Internet Explorer 8 fix connectivity errors?

    As long as I have been in the job and we have been using IE as our browser, we have controlled the proxy settings with an automatic configuration file.
    Recently, with IE8 on WinXP and Win7, we have had situations with the user getting various connectivity errors. By unchecking the "use automatic configuration script" box, they start working. But we don't change anything else.
    These error are not consistent from machine to machine.
    We are in a AD Domain environment
    These are the two errors I have documented.
    Error: 5
    Description: The 'Microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine.
    Access to resrouce is forbidden by server while attempting to access server at
    http://content.mpl.org/cgi-bin/admin/pwtest.exe?CISOVER=60.
    Please check the permissions to the file on th eserver.
    Two very different problems. Both somehow fixed by unchecking the box.
    The config file itself has not been changed in over a year.
    Can anyone explain why unchecking this box, but not making any other changes to the proxy settings would fix connectivity problems? These are all external sites that need to go through the proxy.
    Thanks.

    Hi,
    You can use the steps in the following thread to disable this option:
    uncheck "use automatic configuration script" in IE LAN settings 
    http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/05a7c683-075e-435c-8583-da8fd3559cf2
    Or try to
    reset Internet Explorer settings and select use automatic configuration script to see whether it could work.
    Hope this helps.
    Vincent Wang
    TechNet Community Support

  • ACE Configuration (urgent)

    I am facing problem with ACE configuration. I want to redirect 443 traffic to my Proxy Server.
    But I am not able to do this. I want to redirect only subnet 192.168.80.0/24
    I have the following configuration
    access-list BC line 8 extended permit tcp host 192.168.80.89 any eq https
    access-list BC line 16 extended permit tcp host 192.168.80.62 any eq https
    probe tcp PROBE_TCP_443
      port 443
      interval 15
      passdetect interval 60
      open 1
    serverfarm host SF_BCPR_https
      transparent
      probe PROBE_TCP_443
      rserver RS_BCPR01
        inservice
      rserver RS_BCPR02
        inservice
    sticky ip-netmask 255.255.255.255 address source STICKY-SOURCE-HTTPS
      replicate sticky
      serverfarm SF_BCPR_https
    class-map match-all CM_SF_BCPR_HTTPS
      2 match access-list BC
    policy-map type loadbalance http first-match PM_LB_SF_BCPROXY_https
      class class-default
        sticky-serverfarm STICKY-SOURCE-HTTPS
    ==================================================================================
    policy-map multi-match PM_MAIN_BCPROXY
        class CM_SF_BCPR_HTTPS
        loadbalance vip inservice
        loadbalance policy PM_LB_SF_BCPROXY_https
        loadbalance vip icmp-reply active
        appl-parameter http advanced-options PARAMAP_CASE
    ==================================================================================
    interface vlan 300
      description ACE-INSIDE CONTEXT RACK1
      ip address 192.168.0.65 255.255.255.224
      alias 192.168.0.73 255.255.255.224
      peer ip address 192.168.0.66 255.255.255.224
      no normalization
      mac-address autogenerate
      no icmp-guard
      access-group input acl-in
    access-list BC line 8 extended permit tcp host 192.168.80.89 any eq https
    access-list BC line 16 extended permit tcp host 192.168.80.62 any eq https
      service-policy input PM_MAIN_BCPROXY
      no shutdown
    I am getting error.
    DC-ACE01/Rack1(config-cmap)# 10 match access-list BC
    Error: Class-map is being used for virtual server definition
    =======================================================================
    Only if I am putting
    class-map match-all CM_SF_BCPR_HTTPS
      2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq https
    Then only it is working but I dont have to have this policy to be applied on all the users only one subnet I want to have under HTTPS policy.
    Please let me know how can I apply the policy only on specific subnet so that port 443 traffic can be redirect and rest of all subnets can go direclty to Internet.
    Waiting for reply.
    Thanks in Advance.

    Hi, if this is your current configuration in last message - it's wrong, should be :
    class-map match-all CM_SF_BCPR_HTTPS
      2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq https
    policy-map type loadbalance http first-match PM_LB_SF_BCPROXY_https
      match IT source-address 192.168.80.0 255.255.255.0  <----- If you want to redirect 192.168.80.0/24
        sticky-serverfarm STICKY-SOURCE-HTTPS
    And then in Layer 4 (multi-match policy)
    policy-map multi-match PM_MAIN_BCPROXY
        class CM_SF_BCPR_HTTPS
        loadbalance vip inservice
        loadbalance policy PM_LB_SF_BCPROXY_https
        loadbalance vip icmp-reply active
        appl-parameter http advanced-options PARAMAP_CASE
    However you need to be aware - with such configuration all other traffic to port 443 will be dropped.
    The one of the options can be to add forward action to class default in Layer 7 map , like this :
    policy-map type loadbalance http first-match PM_LB_SF_BCPROXY_https
      match IT source-address 192.168.80.0 255.255.255.0  <----- If you want to redirect 192.168.80.0/24
        sticky-serverfarm STICKY-SOURCE-HTTPS
    class class-default  <--- additional configuration
    forward
    In this case traffic to port 443 from other than 192.168.80.0/24 sources won't be dropped but will be just forwarded to destination.

  • ACE Appliance HTTP Probe with "POST" query

    Does the ACE support HTTP Probe with a "POST" query?
    Thanks
    Joe

    Hi Joe,
    The ACE only supports GET and HEAD
    Here is the documentation related to this:
    http://www.cisco.com/en/US/customer/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/slb/guide/probe.html#wp1031485
    Cesar R

  • ACE# sh script code - Error: Called API is invalid or non-existant

    What is this ??
    ACE# dir disk0:
       2846 Jun 14 2010 15:40:33 NORDICID_PROBE
    ACE# sh script code NORDICID_PROBE
    Error: Called API is invalid or non-existant
    Hardware is ACE-4710-K9 and software A3(2.7)
    The probe itself is functioning ok according to show probe detail.
    However show script script_name probe_name -counters all remain at zero for some reason. This wasn't the case on the previously use ACE software.
    To my recollection the command show script code has worked successfully before on the same ACE software. Not 100% sure though, but it definitely worked on the previous software we ran on the ACE.

    Hi Timo,
    You could be hitting CSCtu33866 (see
    http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtu33866 for more details)
    If you are really hitting this bug, a reboot should fix the issue.
    I hope this helps
    Daniel

  • Configuring HTTP Probe

    Hi All,
    I want to configure a new HTTP Probe. The application server was installed with the following URL: http://lta43:8011/HealthApp/health.txt
    The goal is ACE can monitor this URL.
    What would be the way to configure the Probe in the ACE?
    Regards,
    Jaime.

    Hi Jaime,
    The minimum configuration you would need is the following:
    probe http
      port 8011
      request method get url /HealthApp/health.txt
      expect status 200 200
    As you can see, I didn't configure the hostname of the server anywhere. That's because the probe will be associated to a real server, and the IP address will be the one of the server it's checking.
    There are also several other parameters you can configure the probe, such as timers or headers to be inserted into the request, so I would recommend you to have a look at the relevant chapter of the configuration guide:
    http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA2_3_0/configuration/slb/guide/probe.html
    Daniel

  • ACE - removing script from ACE memory

    Hi,
    I played with scripted probes and now I can't remove script from ACE memory... because I have no 'script file NN SCRIPT_NAME' in my running config, therefore I can't remove script from memory with 'no script file NN'.
    When I try delete file from disk0: and upload modified file (with the same file name), 'sh file disk0:SCRIPT_NAME' shows correct file content, but 'sh script code SCRIPT_NAME' is wrong (because script is loaded in memory).
    How it's possible to unload script from memory if no 'script file NN script_name' in running config exists?
    martin

    Martin,
    this is a bug.
    The 'no script file ' should be enough to remove the script from memory.
    I checked the code and this is something that can easily be fixed.
    I will submit a new ddts.
    Thanks for pointing this issue to us.
    Gilles.

  • Use System Proxy Settings - when this is selected in FF v3.6.6, does it adhere to the same local IE proxy setting? We use a pac file configured in "Use automatic configuration script."

    Does anyone know what Firefox looks at locally on the PC when the "Use System Proxy Settings" setting is selected? It appears to be the default setting, recently changed from "No Proxy" of versions past...
    Our company uses a pac file specified in IE under "Use automatic configuration script" - with this new default, does it adhere to the same setting in:
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

    I may be wrong but I think that the "Use System Proxy Settings" makes sense only on Linux and generally speaking "other OSes". As far as I know there is no generic proxy settings in Windows operating system.
    The one I know is in the registry part of Internet Explorer.
    So in my understanding in Windows, Use System Proxy Settings = No Proxy

  • Configuring Health Probe for Server Farm

    If I have a server farm with real servers listening on port 8888 and I apply an HTTP-type health probe with no port number specified, will the ACE know to probe the servers at 8888 or will it try to probe port 80?

    Hi,
    Yes it should inherit the port from the real servers defined in the serverfarm. This gives you the flexibility to associate same probe with different serverfarms probing different servers on different ports. This is probe port inheritance feature which is there in ACE.
    Regards,
    Kanwal

  • L7 ace configuration replace Apache AJP

    Hi team
    i am trying to use teh ACE to replace an apache based load balancer in an jboss application cluster. I am using L7 loadbalancing to load balance between multiple components. the way these jboss application servers work with apache is that ---
    When the jboss application starts up on the on application cluster, it issues a GET opencase/webservices/config-service?wsdl to the loadbalancer IP
    The apache based LB in turn talks to the same box on port 8009 via ajp retrieves the configuration file and provides it back to the application on port 80
    And after 2 has completed the Jboss application comes up. Basically to start the application the Apache loadbalacer will accept requests from the its target list and load balance the request back to them itself
    Not sure how i can use the ACE to accomplish this.
    attached are my topology (logical) and the ace configuration. from my topology file -- the net-cms-1 will issue a get request to teh VIP (on the ace), the ACE accepts the connection but soon resets it.
    Can anyone please help.
    Thanks in advance

    I don't know if the problem I had will help see the link below
    https://supportforums.cisco.com/thread/2149204?tstart=90

  • Trying to use a proxy server automatic configuration script

    I have just started a new course and my university require every machine that connects to use a proxy configuration script and I am having a spot of bother getting it all set up.
    I have managed to get Firefox set up using the script (I was given a URL for the script and was able to get point the firefox settings at it.) Whilst this allows me to browse the web whilst on campus, it does not allow me to sync all my work to my git, svn and backup server, or in other words, anything that requires an internet connection.
    I am currently using Gnome 3, however, if it is easier to use this kind of thing, then I can switch off to another WM.
    If it helps, the URL for the config file is located here:  http://www-config.strath.ac.uk/proxy.config
    Thanks in advance for any help that can be offered.
    Edit: I tried sticking the url into the Proxy configuration URL bit in the Network settings screen, but that either doesn't work, or I don't know what I am doing (In all fairness, one is just as likely as the other)
    Last edited by nimmo (2011-09-02 21:46:21)

    Ah, I hadn't noticed it giving different contents when you grabbed it when off campus...
    I have  a copy that I downloaded yesterday here:
    function FindProxyForURL(url, host) {
    if (
    isInNet(dnsResolve(host),"130.159.0.0","255.255.0.0")
    || isInNet(dnsResolve(host),"10.0.0.0", "255.0.0.0")
    || isPlainHostName(host)
    || dnsDomainIs(host, "localhost")
    || isInNet(dnsResolve(host),"127.0.0.1","255.255.255.255")
    ) return "DIRECT";
    else if (
    shExpMatch(url, "http://www.gownhire.co.uk/*")
    || shExpMatch(url, "http://www.edeandravenscroft.co.uk/*")
    || shExpMatch(url, "http://launch01.strath.youth-unlimited.com/*")
    ) return "PROXY dangermouse.net.strath.ac.uk:8080";
    else if (
    shExpMatch(url, "http://*.facebook.com/*")
    || shExpMatch(url, "https://*.facebook.com/*")
    || shExpMatch(url, "http://*.fbcdn.net/*")
    || shExpMatch(url, "https://*.fbcdn.net/*")
    || shExpMatch(url, "http://*.bebo.com/*")
    || shExpMatch(url, "https://*.bebo.com/*")
    || shExpMatch(url, "http://*/gateway/gateway.dll*")
    || shExpMatch(url, "https://*/gateway/gateway.dll*")
    ) return "PROXY zloty-p.net.strath.ac.uk:8080";
    else return "PROXY tambala-p.net.strath.ac.uk:8080; PROXY kwacha-p.net.strath.ac.uk:8080; PROXY rouble-p.net.strath.ac.uk:8080";
    [rant]
    Looking more closely at the contents of that file, I am starting to be less impressed with the wireless service. At St Andrews I just had to install a certificate and setting up a WPA2-Enterprise profile and that was that, none of this logging into a web portal as if I was in a coffee shop hotspot nonsense.
    [/rant]

Maybe you are looking for