Modifying an "ssl-proxy-list" without disturbing the active sessions.

Hello,
I would like to know if it is possible to have two SSL modules installed in a CSS11503 with each one having it's own "ssl-proxy-list" ("ssl-proxy-list list1" and "ssl-proxy-list list2"), but the two lists (list1 and list2) are exactly the same.
I will explain my idea:
In normal situation the two "ssl-proxy-list" are active and the user's encrypted sessions are load balanced between the two SSL modules. But when we need to make a change to the "ssl-proxy-list", like changing a server's certificate, I would like to be able to suspend one service (type ssl-accel with the "ssl-proxy-list List1" attached to it for example) and wait for all active sessions to terminate before suspending the "ssl-proxy-list list1" for applying the changes.
Once the first "ssl-proxy-list" is updated I would make it active again and apply the same changes to the second "ssl-proxy-list".
Doing this this way I would like to be able to upgrade the servers's certificate during the working houres without disturbing the connected users...
Do you think this way of doing would be possible, or do you have an other solution to modify a "ssl-proxy-list" without disturbing the active running sessions ?
Thank you for your answer,
Best regards

Hi Francois,
An SSL proxy list may belong to multiple SSL services (one SSL proxy list per service), and an SSL service may belong to multiple content rules. You can apply the services to content rules that allow the CSS to direct SSL requests for content.
The CSS supports one active SSL service for each SSL module in the CSS, one SSL service per slot. You can configure more than one SSL service for a slot but only a single SSL service can be active at a time.
No modifications to an SSL proxy list are permitted on an active list. Suspend the list prior to making changes, and then reactivate the SSL proxy list once the changes are complete. Once you have modified the SSL proxy list, suspend the SSL service, reactivate the SSL proxy list, and then reactivate the SSL service.
You can use maximum 4 different certificates at a time.
Use the suspend command to suspend an active SSL proxy list.
To suspend an active SSL proxy list, enter:
(config-ssl-proxy-list[ssl_list1])# suspend
use the url below for your reference:
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v7.10/command/reference/CmdSSLC.html
Kind regards,
Sachin Garg
Senior Specialist Security
HCL Comnet Ltd.
http://www.hclcomnet.co.in
A-10, Sector 3, Noida- 201301
INDIA
Mob: +91-9911757733
Email: [email protected]

Similar Messages

  • Modifying an ssl-proxy-list

    Hi,
    I have 1 ssl-proxy-list with 3 virtual ssl servers defined. I also have the ssl-proxy-list added to several services. I need to add the following to each of the 3 servers:
    ssl-server 3 tcp server window 40960
    ssl-server 3 tcp virtual window 40960
    Sample of existing ssl-proxy-list:
    ssl-server 3
    ssl-server 3 rsakey DATA-test-su
    ssl-server 3 rsacert DATA-test-su
    ssl-server 3 vip address 10.1.5.14
    ssl-server 3 cipher rsa-with-rc4-128-md5 10.1.5.14 88
    ssl-server 3 urlrewrite 3 *
    ssl-server 3 ssl-queue-delay 0
    ssl-server 3 tcp virtual nagle disable
    My questions:
    1. When I suspend this list, is it best practice to do "no ssl-proxy-list LIST", modify in a notepad and re-paste or just add to each server ? and then re-activate (active) ?
    2. Do the order of the items in list matter, like in an ACL ?
    3. Will I require removing and re-adding it to each and every service that has it defined ?
    3. Due to the rsakey and rsacert, will this change require a reboot of the CSS ?
    Thank you in advance !!!
    M

    The frame below, sent by the client 2 minutes and 64 seconds later, has values of 40 and 01 for the same fields.
    - - - - - - - - - - - - - - - - - - - - Frame 945 - - - - - - - - - - - - - - - - - - - -
    Frame Status Source Address Dest. Address Size Rel. Time Delta Time Abs. Time Summary
    945 [161.44.175.145] [208.184.140.161] 153 0:02:35.533 0.001.228 10/19/2001 04:00:09
    PM TCP: D=443 S=3464 ACK=1374357434 SEQ=105608315 LEN=99 WIN=9520
    ----- DLC Header -----
    DLC:
    DLC:
    DLC: Frame 945 arrived at 16:00:09.5404; frame size is 153 (0099 hex) bytes.
    DLC: Destination = Station Cisco107AC01
    DLC: Source = Station Xircm2229D27
    DLC: Ethertype = 0800 (IP)
    DLC:
    ----- IP Header -----
    IP:
    IP:
    IP: Version = 4, header length = 20 bytes
    IP: Type of service = 00
    IP: 000. .... = routine
    IP: ...0 .... = normal delay
    IP: .... 0... = normal throughput
    IP: .... .0.. = normal reliability
    IP: .... ..0. = ECT bit - transport protocol will ignore the CE bit
    IP: .... ...0 = CE bit - no congestion
    IP: Total length = 139 bytes
    IP: Identification = 63628
    IP: Flags = 4X
    IP: .1.. .... = don't fragment
    IP: ..0. .... = last fragment
    IP: Fragment offset = 0 bytes
    IP: Time to live = 128 seconds/hops
    IP: Protocol = 6 (TCP)
    IP: Header checksum = 53C8 (correct)
    IP: Source address = [161.44.175.145]
    IP: Destination address = [208.184.140.161]
    IP: No options
    IP:
    ----- TCP header -----
    TCP:
    TCP:
    TCP: Source port = 3464
    TCP: Destination port = 443 (Https)
    TCP: Sequence number = 105608315
    TCP: Next expected Seq number= 105608414
    TCP: Acknowledgment number = 1374357434
    TCP: Data offset = 20 bytes
    TCP: Flags = 18
    TCP: ..0. .... = (No urgent pointer)
    TCP: ...1 .... = Acknowledgment
    TCP: .... 1... = Push
    TCP: .... .0.. = (No reset)
    TCP: .... ..0. = (No SYN)
    TCP: .... ...0 = (No FIN)
    TCP: Window = 9520 --------------- > this line is of your interest
    TCP: Checksum = E691 (correct)
    TCP: No TCP options
    TCP: [99 Bytes of data]
    TCP:
    ADDR HEX ASCII
    0000: 00 00 0c 07 ac 01 00 80 c7 22 9d 27 08 00 45 00 | ......"'..E.
    0010: 00 8b f8 8c 40 00 80 06 53 c8 a1 2c af 91 d0 b8 | [email protected],
    0020: 8c a1 0d 88 01 bb 06 4b 74 7b 51 eb 07 ba 50 18 | ...Kt{Q.P.
    0030: 25 30 e6 91 00 00 80 61 01 03 01 00 48 00 00 00 | %0..a....H...
    0040: 10 8f 80 01 80 00 03 80 00 01 81 00 01 81 00 03 | ..........
    0050: 82 00 01 00 00 04 00 00 05 00 00 0a 83 00 04 84 | .............
    0060: 80 40 01 00 80 07 00 c0 03 00 80 00 00 09 06 00 | @...........
    0070: 40 00 00 64 00 00 62 00 00 03 00 00 06 83 00 04 | @..d.
    Hope this will bring some useful information to you regarding your case.
    Still if you want to discuss any thing in this regard kindly revert back me.
    I will be very happy if I can be part of any further assistance.
    Please do not hesitate to revert back any time.
    Till then ,
    Kind Regards,
    [email protected]

  • Help to modify the Release procedure without disturbing the existing class

    Hi All,
    We have a requirement to modify the existing workflow approval procedure for PR and PO to include a case, where the PO amount is less than certain value (say 100 EUR) and the material group is equal to certain value, then we need to include the approval levels L2 (defined for PR) and X2 (defined for PO).
    Taking the case for PO`s, please note the following information,
    Existing release Strategies & release Levels for PO are
    51          Level X4
    52          Level X4 + X3
    53          Level X4 + X3 + X2
    54          Level X4 + X3 + X2 +X1
    Characteristics used
    Total Net order Value
    Purchasing organization
    Order Type
    Purchasing Group
    Example : If the PO triggering a Release strategy 51 and if the conditions PO Value and Material Group satisfied then in addition to X4 system should send the PO  Approval to X2 also. Similarly if the Po triggering the Release strategy 52 then in addition to X4 + X3, approval from X2 also required (provided if the condition satisfies).
    Solutions tried
    1)  We can achieve the requirement by adding a dummy variable in the Characteristics and defining the new release strategy 55 with Level X4 + X2 and using the User Exit EXIT_SAPLEBND_002 .But we donu2019t want to touch the Characteristics and class because this is used by other companies also.
    2) Also we can add a characteristic Material group with value equal to the required value and define 2 new release strategies 55 with Level X4 + X2 and 56 with Level X4+ X3 +X2.For all the other release strategies we can maintain the material group value as blank. Since the characteristics used by many companies we donu2019t want this option also.
    Request your valuable suggestion to meet the above requirement, without disturbing the existing characteristics and Classes, would be highly appreciable.

    >
    MadhanRaj S wrote:
    But we cannot use those because these are used by other companies of the same organization.
    >
    > We need a solution other than these two options with out disturbing the existing charecteristics and class.
    It looks to me like you need a new release strategy for the company that is different. This is a perfectly normal way to use release strategies and is exactly what they are designed for.
    Cheers,
    Mike

  • Can i have two internet connections connected to two airport extremes separately without disturbing the home sharing option.

    can i have two internet connections connected to two airport extremes separately without disturbing the home sharing option. i want to have both the airport extremes to use a single imac for streaming music or video to my apple tv's at different places where one apple tv is in the range of one airport extreme.it's not a problem if both airport extremes have different wifi id's with separate internet.The imac which i use for streaming the music and videos is only in the range of only one airport extreme.is it possible if i can stream music or videos to my apple tv which is not in the range of same airport extreme which i use for imac but in the range of other airport extreme.
    Finally what i need is i want to use two internet networks as my highest possible internet bandwidth is about 1mbps.and i know that i cant mix both the networks and make it as 2mbps.

    Yes, that is possible. Please check out the following Apple Support article for details on how.

  • Alternate fact table without disturbing the existing fact table in EIS

    I have a question in EIS, how to load or work with alternate fact table, without disturbing the existing fact table, pls provide me with some procedure and steps
    thank u in advance
    sunil

    Yes you can have multiple models and metaoutlines load one cube. I've done it before. The trick is you ahve one "master" metaoutline that you put all the measures in (even if they are manually added. You use that to build the cube. Then you can have multiple metaoutlines build different measures within the cube. The idea is you have to have them update different intersections or the last one in will be what you get. I have a client that gets sales info from one source, shipment info from a different relational source . in all I have 10 differnt models and metaoutlines that build one cube. you just lump the load statements into one CBS file. It works great (or as great as EIS works). The biggest issue is timing to make sure all the sources are available when the load is going to be doe. Of course you could build different parts at different times.

  • Remove Structured Anchored Frame  without disturbing the XML Structure - Reg.

    Dear All,
    Please any one help me!, How to remove the xml Structured Anchored Frame without disturbing the XML Structure.
    Manually If I'm removing the XML Structured Anchored Frame, the XML Structured is gone.
    I tried so many ways.  If  I am removing manually in Grouped Frame, then this problem is not happens.
    I mean, Create 2 separate frames Move any xml structured contents to that frames. Group that 2 frames and make it anchored.
    Now you can remove that anchored, this xml Structure is not disturbing (I mean not removed).
    If I did the same in above method for Single Text Frame, this xml Structure is gone.
    Kindly any one person resolve this problem, Thanks in advance!!!
    Note:
    (1) I tried through in InDesign CS6 Plug-In, this is working perfectly. But I need in Javascript to do this.
    Thanks & Regards
    T.R.Harihara SudhaN

    Hm – if you can do it with a Group object, why don't you wrap around a group object?
    With ExtendScript it's quite possible to create Groups with only one single object.
    If we have a text frame selected, you could add a "helper" rectangle to the spread.
    Group the text frame and the rectangle, then remove the rectangle from the group.
    Now you have a Group with a single text frame.
    var myTextFrame = app.selection[0];
    var myHelperRectangle = app.documents[0].layoutWindows[0].activeSpread.rectangles.add();
    var myGroup = app.documents[0].layoutWindows[0].activeSpread.groups.add([myTextFrame,myHelperRectangle]);
    myGroup.rectangles[0].remove();
    app.documents[0].select(myGroup);
    Uwe

  • Display the current item in the list without advancing the iteration using

    This is my directions.
    Display the current item in the list without advancing the iteration using only iterator methods.
    I can't seem to figure this one out when the only methods available are hasNext();, next();, hasPrevious();, previous();, add();, remove();. and set();, and nextIndex();. Can someone please give me advice on this one?
    Thanks a bunch!!!!

    After thinking briefly about an ugly megillah that would detect whether or not you've ever called Iterator.next(), which is what is required for a bulletproof solution, I've decided after looking at the documenation that in fact the problem is not valid.
    It's as simple as this: the Javadoc says 'a ListIterator has no current element'.
    Tell your professor.

  • How to clear a cursor list without clearing the first row??

    Hi all, good to see ya ...
    I'm having this problem , that i'm using the first row ín a cursor list as a cursor in another graph. The rest of the rows are used as test sets i can add. So  when finnish with the tests if some was set, i have to delete or clear the cursorlist(but only the tests and not the first wich is the pointcursor) byy using the graphs cursor list proberty node ' Crsr.List '  and initialising it as showed in picture 1.
    Picture 2 shows the cursor list with some test and the cursor name (point cursor) and properties at  top. These properties are directly copied to another graph cursor list also at the top and there the point cursor is used as the cursor. The tests are also copied to the other graph cursor list, but when deleting the tests by 'clear button' all data are cleared also the point cursor. That is my problem.
    so the question is, how can i clear a cursor list without clearing the first raw and its proberties. any suggestions would be much help for me.
    Regards
    Zamzam 
    HFZ
    Attachments:
    Cursor Palette Front panel.JPG ‏25 KB
    cursor paletteA.JPG ‏66 KB
    Cursor paletteB.JPG ‏77 KB

    Zamzam
    The cursor list is just an array so you can delete the elements that you don't want.
    David
    Message Edited by David Crawford on 06-15-2006 12:46 PM
    Attachments:
    Delete Cursors.jpg ‏8 KB

  • How Do I go directly to Desktop without disturbing the Opened pages? I am using Lion OS

    How Do I go directly to Desktop without disturbing the Opened pages? I am using Lion OS

    You can tap one of the keyboard Function (F) keys. Without knowing which keyboard you use it 's a little difficult to say. If you don't have a keyboard shortcut to do that, create one in System Preferences - Keyboard. I have my F6 key set to take me directly to the desktop. However the way your question is phrased I'm not positive that is what you are asking.

  • How can I back into the main screen without using the activator bottom?

    How can I back into the main screen without using the activator bottom?

    I assume you mean the HOME button. You cannot. The HOME button is the only way to exit an app.

  • What is a "logged in user" on the "Active Sessions" report in CF8 Server Monitor?

    I was looking at the Active Sessions Report (The Chart View) and saw I have more "logged in users" than "active sessions".
    I had expected them to be nearly the same.    It's on our Intranet where I log users in (using cflogin and cfloginuser) at the begining of their session and users should be logged when the session ends.
    I couldn't find a detailed explaination of what a "logged in user" means.   There is a chance that the same user is logged into a nested application as well as the Intranet, but I don't think that is what I'm seeing.
    I also don't see a way to get a list of what CF is counting as a logged in user.  I can only see a way to get the total count.
    Any help is appreciated. 
    Thanks,
    Jeff

    Thank you Michael for the reply, but I don't think that is the issue.
    When a user opens their browser on the intranet, a session begins and they are logged in (using the cflogin and cfloginuser).    If they close their browser, the session should hang around for 20 min. (per the server setting).   I am assuming this is still considered an "Active Session" since I can see this behavior in the report.
    At first, the Active Sessions and Logged In Users are exactly the same.   When the sessions start to time out, the active sessions are reduced,  but the Logged In Users remain the same.    Then,  after a while, they start to move together.  So I have more Logged In Users than Active Sessions.
    I left the Server Monitor open last night and for most of the night, I had 0 sessions, but 57  "logged in users".   This morning, as people opened their browsers, the Active Sessions and Logged In Users moved together.   The gap of 57 looks consistent.
    It looks like people are remaining logged in after their session ended.
    I am really looking for a detailed explaination of "active session" and/or "logged in user" as used in the server monitor.  It would be really nice to find a way to list the details about each item counted in the "logged in user" and not just the total count. 
    Thanks Again for your reply.
    jsm

  • Changing the Modified Date of a List Item using the SharePoint Client Object Model (C#) with Contribute Permission

    I have a small snippet of code that I use to update the Modified Date of a list item and it works great for users with Full Control permissions.  However, for users with just Contribute access to the site the code doesn't work.  Instead, SharePoint
    just updates the Modified Date to now.
    I did some testing, and narrowed down the specific permission level that allows updating of Modified dates and oddly enough, it's the "Manage Permissions" level.
    Has anyone run into this issue? If so, how do I work around this and update the Modified date as a user with only Contribute access to a site/library?
    Here's the code:
    DateTime Test = new DateTime(2012, 5, 4);
    ListItem li = list.GetItemById(itemID);
    li["Modified"] = Test;
    li.Update();
    ct.ExecuteQuery();
    Thanks,
    Max

    Hello,
    As a workaround you can pass admin credential in your code because as per my knowledge contributor can't update default columns like: created by, modified by, modified, created.
    ClientContext clientContext = newClientContext(siteUrl);
    ClientContext.Credentials = newNetworkCredential(UserName, Password, Domain);
    Hope it could help
    Hemendra:Yesterday is just a memory,Tomorrow we may never see
    Please remember to mark the replies as answers if they help and unmark them if they provide no help

  • Clicking on a column without disturbing the existing selection

    Hello good people,
    I am still getting used to Swing and my question may be really silly. Thanks in advance for helping me out!
    I have a JTable in which one of the columns has checkboxes. Using Ctrl+select, one can select multiple rows. Clicking without ctrl, unselects the previous selection. This is all good and default behavior. However, I would like to be able to click on one of the checkboxes in one of the selected rows and not disturb the selection. My target is to enable/disable the checkboxes of all the selected rows.
    Basically, my question is: How do I not disturb the selection if a user clicks in one of the already selected rows and the checkbox column. In other words, if I clicked on the cell (r, c) where row r is already selected and column 'c' is the checkbox column, I would like to retain the selection.
    Thanks,

    what I meant was if you click on the flag cell of one of the selected rows, all the rows (emails) will be flaggedIn my version of Outlook (which is really old) only the row you click on will be flagged and the other rows are deselected.
    But you could try adding a MouseListener to the table. When a mousePressed event is received you could save all the selected rows. You would also add a TableModelListener to the TableModel. Whenever the flag field is selected you could then loop through all the saved selected row and set the flag. You would want to remove the TableModelListener before you start the loop to prevent multiple table model events from being generated. Then when the loop finishes you would need to add the listener back to the model.
    However, this is not a very good solution since it depends on the mousePressed event firing before the ListSelectionModel is updated.

  • Adding additional song lists without erasing the previous content in the iPhone.

    Hi
    Is there a way to add additonal songs in the iPhone without deleting the songs already stored in the iPhone.
    The problem is that most of the original songs stored in the PC has been erased in order to free up hard disk space.
    Hence everytime when I link up the iPhone to the PC in order to add additional songs, the iPhone would sync itself to the iTune and erase what's already in the iPhone only to store the new songs.
    If possible, I'd like to add not just single song multiple times but rather lists of songs in multiple folders at a time.
    Thank you for your help.

    You need to deauthorize your previous laptop and start using the new mac book. However, the songs will be erased as it only allow to sync with one iTunes at one time. I'm scared you have to add those songs from back up. Your photos also will be deleted if you choose to sync with new mac book. For contact and calendar, you will have the option to merge or to erase.

  • Compiling a package without disturbing the load process

    Hi,
    I need to compile a package, with the changes, in the database without stopping the load process that is using this package. Please let me know if any one has any ideas.
    Thanks

    sdk11 wrote:
    Hi,
    I need to compile a package, with the changes, in the database without stopping the load process that is using this package. Please let me know if any one has any ideas.
    ThanksIf you mean: "I need to create or replace a package", while some session is still running code of that package.
    Then sorry: nocando.
    Unless you are on 11.2, in which case you could (with the necessary preparation/configuration done first) create a new version of the package in another edition than the session is using. But the session will have to finish its work using the package as-is currently.

Maybe you are looking for