712 00244 06 Appresponse Admin Guide.9.6 PDF

SteelCentral™ AppResponse
Administrators Guide
Release 9.6
Contacts
Riverbed Technology
680 Folsom St.
San Francisco CA, 94107 USA
General
Telephone: 415.247.8800
E-mail: info@riverbed.com
Web: http://www.riverbed.com
Technical Support
Telephone: 415.247.7381
E-mail: support@riverbed.com
This Documentation and Riverbed

This document and the accompanying product documentation describes the functions of the Riverbed software product(s)
(“SOFTWARE”) identified above (this document and the product documentation are collectively referred to as “DOCUMENTATION”).
Riverbed Technology, 199 Fremont St., San Francisco, California 94105 is the sole owner of all rights, title, and interest to the
DOCUMENTATION and SOFTWARE.
Nothing herein shall grant or imply a license to the DOCUMENTATION or SOFTWARE. The right to use the DOCUMENTATION and
SOFTWARE shall result only from entering into a Master Software License Agreement and a Software Usage Agreement, and paying
the applicable license fees.
Terms and Conditions of Use
Eligible Users
This document is subject to restrictions on use and distribution is intended solely for persons who are subject to the terms and conditions
of Riverbed’s Software Master License Agreement or persons authorized by Riverbed (“Eligible Users”). As a condition of being granted
access to and use of this document, each User represents that: i) the User is an Eligible User of a Licensee under a valid Riverbed Software
Master License Agreement or the User is authorized by Riverbed and ii) the User accepts the terms and conditions of Riverbed’s
Software Master License Agreement and the terms and conditions governing the use of this document.
Confidential Information
The User agrees that the DOCUMENTATION, including this document, are the proprietary property of Riverbed and constitutes a trade
secret of Riverbed. The User agrees that access to and use of this document does not grant any title or rights of ownership. The User
shall not copy or reproduce, in whole or in part, disclose or permit third parties access to this document without the prior written
consent of Riverbed. This document may not be stored, in whole or in part, in any media without the prior written consent of Riverbed.
Any unauthorized use of this document will be subject to legal action that may result in criminal and/or civil penalties against the User.
Intellectual Property and Proprietary Notices

© 2014 Riverbed Technology, Inc. All rights reserved.
Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks
used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written
consent of Riverbed Technology or their respective owners.
The absence of a patent or mark from the above notices does not constitute a waiver of intellectual property rights that OPNET
Technologies, Inc. has established in any of its products, service names or marks in use. Alteration, removal, obscuring, or destruction
of any proprietary legend, copyright, trademark, patent, or intellectual property notice contained in this document is prohibited.
Restricted Rights Legend

The DOCUMENTATION and SOFTWARE are subject to the restrictions on use and distribution in the Riverbed Software Master
License Agreement (for Agencies of the U.S. Government). Any use of the DOCUMENTATION or any SOFTWARE by an agency of the
U.S. Government or a direct contractor of an agency of the U.S. Government requires a valid Riverbed Software Master License
Agreement and Riverbed Software Usage Agreement.
For all users, this Software and Documentation are subject to the restrictions (including those on use and distribution) in Riverbed's
Master License Agreement. Use of this Software or Documentation requires a current Riverbed license and shall be governed solely by
the terms of that license. All other use is prohibited. For the U.S. Government and its contractors, the Software is restricted computer
software in accordance with Federal Acquisition Regulations as applied to civilian agencies and the Defense Federal Acquisition
Regulation Supplement as applied to military agencies. The Software and Documentation qualify as “commercial items,” “commercial
computer software,” and “commercial computer software documentation.”
No Warranty and Limitation of Liability

ALL INFORMATION PROVIDED IN THIS USER MANUAL IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND EITHER
EXPRESS OR IMPLIED INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR
A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. No representations by Riverbed, such as statements of capability, suitability
for use, accuracy or performance, shall be a warranty by Riverbed, or bind Riverbed or vary any term or condition of any Software
Master License Agreement, unless contained in written agreement and signed by Riverbed and any other party or parties to such
Software Master License Agreement.
In no event shall Riverbed be liable for any incidental, indirect, special, or consequential damages whatsoever (including but not limited
to lost profits arising out of or relating to this document or the information contained herein) even if Riverbed has been advised, knew,
or should have known of the possibility of such damages.
THE USER UNDERSTANDS AND ACCEPTS THAT RIVERBED SHALL NOT BE LIABLE FOR DAMAGES WHICH ARE: (i)
INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR CONSEQUENTIAL, OR (ii) THE RESULT FROM LOSS OF USE, DATA, OR
PROFITS, OR (iii) FROM THE USE OF THE SOFTWARE AND DOCUMENTATION, WHETHER BROUGHT IN AN ACTION OF
CONTRACT, TORT, OR OTHERWISE, EVEN IF RIVERBED WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Export Controls
Any User of the DOCUMENTATION including this document shall comply with the laws of the United States, including the provisions
of the U.S. Department of Commerce, Bureau of Industry Security (“BIS”), Export Administration Regulations (EAR), the U.S. Department
of State, International Traffic in Arms Regulations, and the U.S. Department of Treasury, Office of Foreign Assets Control, regarding the
export, re-export and disclosure of the DOCUMENTATION or the SOFTWARE. Any export, re-export or disclosure of the
DOCUMENTATION or the SOFTWARE shall be subject to the prior written consent of Riverbed. Users shall not remove any
Destination Control Notices provided by Riverbed from the DOCUMENTATION or the SOFTWARE.
Destination Control Statement

The DOCUMENTATION and the SOFTWARE were manufactured in the United States by Riverbed. The initial export of the
DOCUMENTATION and the SOFTWARE from the United States, and any subsequent relocation or re-export to another country shall
comply with the laws of the United States relating to the export of technical data, equipment, software, and know-how. Any diversion
contrary to the laws of the United States is prohibited.
Riverbed Technology
680 Folsom Street
San Francisco, CA 94107
Phone: 415.247.8800
Fax: 415.247.8801 712-00244-03
Web: http://www.riverbed.com
Contents
Chapter 1 - Administration and Maintenance ....................................................................................... 11

Audit Log ..................................................................................................................................................... 13
Exporting Audit Log Data Using Web URLs and CLI Commands.............................................. 15
Export via Web URL .................................................................................................................... 15
Export via CLI............................................................................................................................... 16
Appliance Information Window .............................................................................................................. 17
Using the Command Line Interface ......................................................................................................... 18
Accessing the Command Line Interface........................................................................................... 18
Administration > System Web Interface.................................................................................................. 20
Accessing the Administration > System Web Interface ................................................................. 21
User Accounts in the Web Interface........................................................................................... 21
Managing User Accounts .......................................................................................................................... 23
Local Accounts ..................................................................................................................................... 23
Global Accounts................................................................................................................................... 23
RADIUS Accounts ............................................................................................................................... 23
Setting Up the RADIUS Server................................................................................................... 24
Order of Authentication .............................................................................................................. 25
Restricting User Access....................................................................................................................... 26
User Admin Manager................................................................................................................................. 27
Account Privileges............................................................................................................................... 29
Role-Based Access Control ........................................................................................................................ 30
Important Notes................................................................................................................................... 30
Create/Edit a Role............................................................................................................................... 31
Assign Roles to a User ........................................................................................................................ 32
Cisco Access Control Server (ACS): Additional Requirement...................................................... 32
Configuring Network Parameters............................................................................................................ 33
Configuring Outgoing Email Parameters ............................................................................................... 34
Customizing Sender Names of Outgoing Emails ........................................................................... 34
Configuring an Appliance to Send Emails Using an SMTP Relay............................................... 36
Running Diagnostics and Viewing Error Logs....................................................................................... 37
Checking the Factory Settings................................................................................................................... 38
Halting or Rebooting the Appliance from the CLI ................................................................................ 39
SteelCentral AppResponse/Release 9.6 5

Contents
Setting Up Private-Address to AS-Number Maps................................................................................. 40

Configuring SYSLOG Alert Destinations................................................................................................ 41
Traceroute Parameters................................................................................................................................ 43
Automated and Manual Traceroutes ................................................................................................ 43
Traceroute Types .................................................................................................................................. 43
Configuring Traceroute Parameters.................................................................................................. 44
SNMP Traps................................................................................................................................................. 45
Configuring SNMP.............................................................................................................................. 45
Diagnostics in the Web Interface ............................................................................................................. 47
Bundles.................................................................................................................................................. 47
Subscription.......................................................................................................................................... 49
Reports ........................................................................................................................................... 49
Alerts .............................................................................................................................................. 50
Settings .................................................................................................................................................. 51
SNMP Alert Descriptions ................................................................................................................... 52
User-Defined Alerts ..................................................................................................................... 52
Hardware Alerts ........................................................................................................................... 53
Software Alerts ............................................................................................................................. 55
Unused Alerts ............................................................................................................................... 59
Status ..................................................................................................................................................... 60
Log Viewer............................................................................................................................................ 60
Halting or Rebooting the Appliance from the Web Interface............................................................... 61
Configuring Traffic Filters ......................................................................................................................... 62
Configuring Network Ports ...................................................................................................................... 64
Managing Software Licenses..................................................................................................................... 65
Licensing a New Appliance ............................................................................................................... 65
Adding a License ................................................................................................................................. 66
Activating an Extended Feature ........................................................................................................ 66
Moving Licenses from One Appliance/Director to Another........................................................ 67
Diagnostics Bundles ................................................................................................................................... 69
Creating a Diagnostics Bundle .......................................................................................................... 69
Deleting a Diagnostics Bundle........................................................................................................... 69
Downloading a Diagnostics Bundle ................................................................................................. 69
Removing Residual Data from Appliance Disk Drives ........................................................................ 70
Rollback Utility .................................................................................................................................... 70
Diskwipe Utility................................................................................................................................... 70
Important Notes................................................................................................................................... 70
Rollback and Diskwipe Procedure.................................................................................................... 71
Running DiskWipe in Stand-Alone Mode ....................................................................................... 72
ResetData Utility.................................................................................................................................. 73
Application Stream Analysis (ASA) Configuration............................................................................... 74
ASA Boost ............................................................................................................................................. 74
Calculation of Round Trip Times ...................................................................................................... 76
VXLAN Decoding................................................................................................................................ 76
Ignore Wire Length When Calculating Sizes for Pre-Sliced Packets............................................ 77
6 SteelCentral AppResponse/Release 9.6

Contents
Password Complexity Support................................................................................................................. 78

Enable / Configure Password Complexity...................................................................................... 78
Change a Password ............................................................................................................................. 80
Lock a User Account ........................................................................................................................... 81
IPv6 Support................................................................................................................................................ 82
How to Set Up IPv6 on an Appliance ...................................................................................................... 83
Verify Appliance Performance........................................................................................................... 83
Enable IPv6 on the Appliance............................................................................................................ 83
Verify Appliance Health with IPv6 Enabled ................................................................................... 85
What You Need to Know About IPv6 Support in AppResponse ........................................................ 86
Chapter 2 - Installing the Appliance ...................................................................................................... 89

Pre-installation Information ...................................................................................................................... 90
AppResponse Appliance Overview ................................................................................................. 90
AppResponse Appliance Models ...................................................................................................... 91
Physical Configurations...................................................................................................................... 91
Internal Addresses List................................................................................................................ 93
Single Span Port............................................................................................................................ 96
Dual Span Port .............................................................................................................................. 96
Copper/Fiber Tap................................................................................................................................ 97
Network Placement Considerations ................................................................................................. 97
Network Coverage ....................................................................................................................... 97
Span Port Physical Configuration.............................................................................................. 97
Traffic Volume ............................................................................................................................... 97
Traffic Symmetry .......................................................................................................................... 97
Modified Frame Formats............................................................................................................. 98
Encryption, Tunneling and Encapsulation ............................................................................... 98
Network Address Translation .................................................................................................... 99
Security .......................................................................................................................................... 99
Additional Information ...................................................................................................................... 99
BGP and the AppResponse Appliance...................................................................................... 99
Firewall Configuration ................................................................................................................ 99
Installation Preparation Sheet ................................................................................................................. 103
Installing the Appliance........................................................................................................................... 104
AppResponse Appliance Material Inventory................................................................................ 104
AppResponse-1200 Appliance.................................................................................................. 105
AppResponse-4100-S16 Expansion Chassis ........................................................................... 117
AppResponse Expansion Chassis 200 ..................................................................................... 118

Contents
AppResponse Expansion Chassis 300 ..................................................................................... 119

Back Panel Ports ......................................................................................................................... 120
Front Panel Ports ........................................................................................................................ 121
Additional Items......................................................................................................................... 123
Installing an AppResponse Appliance: Workflow Description.................................................. 124
Step 1: Rackmount and Wire the AppResponse Appliance ................................................. 125
Step 2a: Wiring for Span Port Physical Configuration.......................................................... 126
Step 2b: Wiring for Copper/Fiber Tap Physical Configuration .......................................... 127
Configuring the Appliance...................................................................................................................... 128
Command Line Interface.................................................................................................................. 128
Step 3: Initial Setup using the CLI............................................................................................ 129
Administration > System Web Interface ........................................................................................ 130
Accessing the Administration > System Web Interface....................................................... 130
Step 4: Completing Setup using the Administration > System Web Interface.................. 131
Quitting the Web Interface ........................................................................................................ 134
Installation and Configuration Complete............................................................................... 135
Updating the Software ............................................................................................................................. 136
Safety Warnings ........................................................................................................................................ 136
Important Notes about Installing, Connecting, and Rebooting AppResponse Appliances .......... 136
Placing and Installing the Appliance.............................................................................................. 137
Connecting Fiber Ports for Monitoring Interface on the Appliance .......................................... 138
Guidelines for Powering Down or Rebooting an AppResponse Appliance ............................ 140
Chapter 3 - Verifying Appliance Operations ....................................................................................... 141

AppResponse Appliance ......................................................................................................................... 142
Checking Time and Date .................................................................................................................. 142
Verifying Ethernet Configuration.................................................................................................... 142
Verifying Diagnostic Reporting, SNMP, and Backup Server Configuration.................................... 144
Verifying that Manual Diagnostic Reporting is Operational ...................................................... 144
Verifying that SNMP is Operational ............................................................................................... 144
Verifying Backup Server Configuration ......................................................................................... 144
Desktop Console ....................................................................................................................................... 145
Viewing Traffic Flow ......................................................................................................................... 145
Verifying Desktop Time and Date ................................................................................................... 145
Verifying that DNS is Operating on the Desktop ......................................................................... 145
Verifying that BGP Peering is Operating ....................................................................................... 145
Disk Alert Pop-Up Window in Desktop Console ......................................................................... 145
Chapter 4 - Backup and Recovery of Appliance Data ........................................................................ 147

Backup and Recovery............................................................................................................................... 148
Pre-Configuration Tasks and Verifications .................................................................................... 151
Defining Backup Servers .................................................................................................................. 152
Scheduling a Backup ......................................................................................................................... 154
Performing an On-Demand Backup ............................................................................................... 158
Viewing a List of Backups ................................................................................................................ 160
Performing a Recovery ..................................................................................................................... 161
Restoring a Backup to a Different Appliance ......................................................................... 163

Contents
Best Practices and Guidelines for Backup and Recovery.................................................................... 165

Recommendation: Use SSH If Possible .......................................................................................... 165
Estimating Backup/Recovery Times .............................................................................................. 165
Recovery Guidelines ......................................................................................................................... 165
Troubleshooting Common Issues with Backup and Recovery .......................................................... 167
Fast Recovery............................................................................................................................................. 168
About the Data Restored in a Fast Recovery ................................................................................. 168
General Workflow ............................................................................................................................. 169
Important Notes ................................................................................................................................ 169
Performing a Fast Recovery .................................................................................................................... 171
Troubleshooting Fast Recoveries ............................................................................................................ 173
Not Enough Disk Space on Target Appliance ........................................................................ 173
Appendix A - Software Updates from the Administration > System Web UI ....................................175
Updating an Appliance that has Internet Access.......................................................................... 175
Updating from a Custom URL ........................................................................................................ 176
Updating from a Local Host ............................................................................................................ 176
Software Update Options ................................................................................................................. 177
Updating Software on a Director .................................................................................................... 177
Deleting Old Releases ....................................................................................................................... 177
Appendix B - Removing Residual Data from Appliance Disk Drives.................................................179

Rollback Utility ......................................................................................................................................... 179
Diskwipe Utility................................................................................................................................. 179
Important Notes................................................................................................................................. 180
Rollback and Diskwipe Procedure.................................................................................................. 180
Running DiskWipe in Stand-Alone Mode ............................................................................................ 181
ResetData Utility ....................................................................................................................................... 182
Appendix C - Software Updates Using the CLI....................................................................................183

Important Notes................................................................................................................................. 183
release-update Commands ....................................................................................................... 183
release-current Command ...................................................................................................... 185
Appendix D - Berkeley Packet Filter Syntax ........................................................................................187

Tcpdump Expressions .............................................................................................................................. 187
Tcpdump Primitives and Qualifiers................................................................................................ 187
Allowable Primitives......................................................................................................................... 188
Combining Primitives ....................................................................................................................... 190
Appendix E - Expansion Chassis Setup and Administration.............................................................191

Important Notes and Warnings .............................................................................................................. 191
Expansion Chassis Compatibility by Appliance Model .............................................................. 192

Contents
Installing and Configuring an Expansion Chassis............................................................................... 192

Step 1: Connect the Appliance and Expansion Chassis ............................................................... 193
Step 2: Set Up the Expansion Chassis Disks .................................................................................. 199
Viewing RAID Status on the Appliance ................................................................................................ 200
raid Utility .......................................................................................................................................... 200
tw_cli Utility (4200 and 5000 Appliances Only)............................................................................ 202
Troubleshooting Expansion Chassis Operations.................................................................................. 202
Issue: (File System) Does Not Exist or Is Not Mounted............................................................... 202
Configuring Storage on Expansion Chassis.......................................................................................... 202
Removing an Expansion Chassis............................................................................................................ 203
Index ....................................................................................................................................................... 205

CHAPTER 1 Administration and Maintenance
With the AppResponse Appliance installed, you can now focus on more advanced configuration and
maintenance (see “Installing the Appliance” on page 89). The configuration procedures covered in this
chapter are used to manage advanced features of the appliance, but are not required for basic operation of
the system. These procedures can be performed at any time after initial installation of the appliance.
Note: This manual was last updated on September 20, 2015. Because release notes and other documentation
is sometimes updated after the product documentation is distributed, it is good practice to visit the
Riverbed website to check for the latest version of the Release Notes and this and other manuals. Go to
https://support.riverbed.com, then navigate to the AppResponse Appliance page.
For more information, see:

 “Audit Log” on page 13
 “Appliance Information Window” on page 17
 “Using the Command Line Interface” on page 18
 “Administration > System Web Interface” on page 20
 “Managing User Accounts” on page 23
 “Role-Based Access Control” on page 30
 “Configuring Network Parameters” on page 33
 “Configuring Outgoing Email Parameters” on page 34
 “Running Diagnostics and Viewing Error Logs” on page 37
 “Checking the Factory Settings” on page 38
 “Halting or Rebooting the Appliance from the CLI” on page 39
 “Setting Up Private-Address to AS-Number Maps” on page 40
 “Configuring SYSLOG Alert Destinations” on page 41
 “Traceroute Parameters” on page 43
 “SNMP Traps” on page 45
 “Diagnostics in the Web Interface” on page 47
 “Halting or Rebooting the Appliance from the Web Interface” on page 61
SteelCentral AppResponse 11
Administration and Maintenance
 “Configuring Traffic Filters” on page 62

 “Configuring Network Ports” on page 64
 “Managing Software Licenses” on page 65
 “Diagnostics Bundles” on page 69
 “Removing Residual Data from Appliance Disk Drives” on page 70
 “Application Stream Analysis (ASA) Configuration” on page 74
 “Password Complexity Support” on page 78

Audit Log
The Audit Log (View > Log > Audit Log) maintains a list of significant events that have occurred on the
system. The Audit Log of a Domain Director maintains a list of events related to configuration distribution
(see “Distributing Configuration Information” on page 717 of the AppResponse Director User Guide). The
following events are recorded in the Audit Log:
 New, changed or deleted configuration items - An audit log entry is generated any time a
configuration item is created, modified or deleted within a Manager inside the Desktop Console. The
audit log entry includes the name of configuration item affected, the relevant Manager, the nature of
the configuration change and the user account that made the change. The audit log on the director
includes entries for all global configuration items. The audit log on an appliance only includes entries
for local configuration items.
 User Logins - An audit log entry is generated any time a user connects or disconnects to an
AppResponse Appliance.
You can export the contents of an audit log to a CSV file: while the Audit Log window is active, choose File >
Export (entire log) or File > Export Selection (selected rows only). You can also export audit log contents
using Web Services or the CLI, as described in “Exporting Audit Log Data Using Web URLs and CLI
Commands” on page 15.
A typical Audit Log is shown in the following figure.
Figure 1 Audit Log
By default, the Audit Log displays the last 500 entries. The number of entries displayed can be changed;
simply type in the number and press the Enter key.
Figure 2 Audit log - Show Selector

Alternatively, the Audit Log can be configured to display only entries that were generated during the
current time selection by choosing Project Time Interval. For more information, see “Time Selection” on
page 15.
The following fields can be displayed for event records in the Audit Log:
 Date—The date and time that the entry was generated.
 Manager/Interface—The name of the Manager that generated the audit event.
 Parameter—The name of the configuration item.
 Description—A description of the event. e.g., GROUP CREATED, ALERT DELETED, USER
CONNECT.
 Original Value—The original value of a configuration item that has been changed.
 New Value—The new value of a configuration item that has been changed.
 Result—Specifies whether the event causing the audit log entry was successful.
 Name—The user account that made the configuration change.
 Address—The IP address from which the user is connecting to the AppResponse Appliance.
By default, the Name and Address fields are not displayed. However, you can customize the fields to
display.
Procedure 1 Showing/Hiding Fields in the Audit Log
1. Click the Show/Hide columns icon in the Audit Log.
Figure 3 Audit Log - Show/Hide Columns Button
The Show/Hide Columns Window appears.
Figure 4 Audit log - Show/Hide Columns Window
2. Select the fields to display. Clear the fields that you do not want to display.

3. Click OK.
End of Procedure 1
Exporting Audit Log Data Using Web URLs and CLI Commands
AppResponse supports two methods for exporting Audit Log entries:
 “Export via Web URL”
 “Export via CLI” on page 16
Export via Web URL

To export data using web URLs, log in to the Web Console or System > Administration web UI. Then open
a new browser window and enter the following URL with the appropriate appliance name and parameters:
https://[appliance]:8443/webservice/DataServiceServlet?type=auditLog&csv=true&
start=[starttime]&end=[endtime]&filter=[manager/interface]
Parameters
 appliance—IP or DNS name of the appliance
 csv—If true, returns data in CSV format; if false, returns data in XML format.
 starttime—Start time of the interval. All relevant log entries from (and including) the start time will
be retrieved.
 endtime—End time of the interval. All relevant log entries up to (but excluding) the end time will be
retrieved.
 manager/interface—Category of log entries to retrieve.
This should be one of the labels shown in the Web Console > Other Views > Audit Log >
Manager/Interface pull-down menu.
Notes
 You must be logged in to the Web Console before you can export log data using web URLs.
 The starttime and endtime parameters must be specified as UNIX timestamps (for example,
23503368 for date/time 2014-09-08@14:47). Search for an online conversion tool to generate the
correct timestamp.
 The starttime, endtime, and manager/interface parameters are not strictly required.
However, it is good practice to filter your queries; otherwise the query might return an extremely high
number of entries.
Example
URL:
https://arx.mycompany.com:8443/webservice/DataServiceServlet?type=auditLog&csv=true&
start=1410177600&end=1410350400&filter=Web%20Interface
Output:

cmd> Date , Manager/Interface , Parameter , Description , Original Value , New Value , Result , Name
, Address
2014-09-09 16:56:47,Web Interface,login,ADMIN USER LOGIN,,,success,admin,10.33.20.68
2014-09-09 17:00:29,Web Interface,login,USER LOGOUT,,,success,admin,10.33.20.68
Export via CLI

To export Audit Log data using the CLI, log in to the CLI and enter the following command:
AuditLog -m '[manager/interface]' -s '[starttime]' -e '[endtime]'
Parameters
 manager/interface—Category of log entries to retrieve.
This should be one of the labels shown in the Web Console > Other Views > Audit Log >
Manager/Interface pull-down menu.
 starttime—Start time of the interval. All relevant log entries from (and including) the start time will
be retrieved.
 endtime—End time of the interval. All relevant log entries up to (but excluding) the end time will be
retrieved.
Notes
 All parameters should begin and end with single quotes.
 The date/time parameters must be in the format yyyy-mm-dd hh:mm using 24-hour time (for
example, 2014-07-31 23:59). If you specify dates only, the default start/end times are midnight
(00:00).
 The manager/interface, date_time_start, and date_time_end parameters are not strictly
required. However, it is good practice to filter your queries; otherwise the query might return an
extremely high number of entries.
Example
cmd> AuditLog -m 'Web Interface' -s '2014-09-10 10:00' -e '2014-09-10 12:00'
#Timestamp: , 2014-09-10 14:09:44
#Source: , zonda5.res.nbttech.com
#Data Type: , Audit Log Table
Date , Manager/Interface , Parameter , Description , Original Value , New Value , Result , Name ,
Address
2014-09-10 10:26:57 , Web Interface , login , USER LOGIN , , pts/0 , success , admin , 10.35.134.109
2014-09-10 10:27:42 , Web Interface , login , USER LOGOUT , , pts/0 , success , admin , 10.35.134.109
Related Topics
 “Administration and Maintenance”

Appliance Information Window

The Appliance Information window provides a status report of the appliance configuration for the
categories shown in the following figure. It is located under the View menu.
Figure 5 Appliance Information Window
The buttons on the Appliance Information window can be used in the following ways:
 Refresh—Displays up-to-the minute status information.
 Email—Sends a copy of the status (by email) to an intended recipient.
 Copy—Copies to a clipboard.
 Cancel—Closes the window.
 ?—Displays the AppResponse User Manual.
Related Topics

Using the Command Line Interface

The AppResponse Appliance command line interface (CLI) is used during the initial installation. (See
“Command Line Interface” on page 128.) After installation, the CLI can be used to change configuration
parameters and run various commands to maintain appliance operation. These functions include:
 “Managing User Accounts” on page 23
 “Configuring Network Parameters” on page 33
 “Configuring Outgoing Email Parameters” on page 34
 “Running Diagnostics and Viewing Error Logs” on page 37
 “Checking the Factory Settings” on page 38
 “Halting or Rebooting the Appliance from the CLI” on page 39
 “Software Updates Using the CLI” on page 183
 “Setting Up Private-Address to AS-Number Maps” on page 40
 “Configuring SYSLOG Alert Destinations” on page 41
Accessing the Command Line Interface

The CLI can be accessed over the appliance serial port or by using SSH to connect to the appliance over the
network.
 Serial Port access - Use a terminal emulator program (such as hyperterm on Windows or tip on Unix)
to connect to the AppResponse Appliance’s serial port with the provided serial cable. Use the
following terminal-emulation settings: 115200 baud, no parity, 8 data bits, no flow control, and 1 stop
bit.
 SSH access - Use SSH to access the appliance over the network. A number of free SSH clients, such as
Teraterm and putty, are available for MS Windows. SSH to the IP address or hostname of the
AppResponse Appliance.
The CLI prompts for a valid username and password before granting access. After logging in, type help and
press Enter to see a list of valid commands.
Figure 6 Command Line Interface - Help
The AppResponse Appliance is based on the FreeBSD operating system. The CLI exposes many of the
commands from the FreeBSD shell to the user. The following commands should be familiar to users with a
UNIX background:
 date

 df
 host
 hostname
 ifconfig
 iostat
 netstat
 nslookup
 ping
 stty
 traceroute
 uptime
The CLI provides help for each command through the Unix man (manual) command. To access help for a
command, type man followed by the command name and press Enter. e.g., man netstat. Refer to the man
pages for help using the Unix commands listed above. Other sections within this chapter document usage
of commands that are unique to the AppResponse Appliance CLI.
Related Topics

Administration > System Web Interface

You can use the Administration > System web interface to set up and configure the appliance. To access this
interface, choose Administration > System in the Web Console or View > Web Interface in the Desktop
Console. You can do the following in this interface:
 Change network parameters (see “Installing an AppResponse Appliance: Workflow Description” on
page 124)
 Set the internal address list (“Internal Addresses List” on page 93)
 Configure SNMP (see “Configuring SNMP” on page 45)
 Configure RADIUS accounts (see “RADIUS Accounts” on page 23)
 Configure email (see “Configuring Outgoing Email Parameters” on page 34)
 Configure automatic traceroute settings
 Configure automatic diagnostics settings (see “Diagnostics in the Web Interface” on page 47)
 View diagnostics reports (see “Status” on page 60)
 Back up and restore the appliance database (see “Backup and Recovery of Appliance Data” on
page 147)
 Halt or reboot the appliance (see “Halting or Rebooting the Appliance from the Web Interface” on
page 61)
 Configure traffic filters (see “Configuring Traffic Filters” on page 62)
 Configure network ports (see “Configuring Network Ports” on page 64)
 Access reports (see “Reports in the Web Console” on page 288—search the User Guide or the online
help)
 Launch the Desktop Console (see “Installing the Desktop Console” on page 11—search the User Guide
or the online help)

Accessing the Administration > System Web Interface

The Administration > System web interface runs on TCP ports 8080 and 8443 by default (see “Configuring
Network Ports” on page 64). To successfully connect to the web interface, you must be able to access the
appliance from your desktop using these ports.
Procedure 2 Accessing the Web Interface

Note: Web interface features are not supported on all browser platforms. For more information, see the
System Requirements for the AppResponse release you are using. To access the System Requirements,
log in to the Support Site at (https://login.riverbed.com/login_support.htm)and navigate to the
AppResponse Appliance page.
1. Access the web interface using one of the following methods:
• Open View > Web Interface…
The browser may display the certificate validation popup window. Accept the certificate to proceed
to the Login page.
• Start a web browser and go to the appliance web interface by opening one of the following URLs:
http://<appliance_hostname>:8080
-or-
http://<appliance_ip_address>:8080
This automatically redirects the browser to a secure (SSL) connection on TCP port 8443. The browser
may display the certificate validation popup window. Accept the certificate to proceed to the Login
page.
2. At the Login page, enter your AppResponse Appliance Username. During initial set-up, log into the
appliance using the admin account.
3. Type the AppResponse Appliance Password for the user account.
4. Click Login.
5. Choose Administration > System in the Web Console navigation treeview.
End of Procedure 2
User Accounts in the Web Interface

You must provide a valid username and password to access the AppResponse Appliance. The default
administrative account named admin is used during the installation process. Additional accounts can be
created using the CLI. See “Managing User Accounts” on page 23.

Only one administrative user can be logged into the web interface at a time. If an administrative user is
already logged in and a second administrative user attempts to access the web interface, the second user is
granted access in read-only mode. Only the special admin user is granted read-write access while another
administrative user is logged in.
Always use the logout link to exit the web interface. If you leave the appliance web interface without
clicking the logout link, it takes 10 hours for your session to expire. If you were granted administrative
access, other users are not granted read-write access (except admin) until the session expires.
Related Topics
 “Managing User Accounts”

Managing User Accounts

A valid user account is required to access the AppResponse Appliance through the CLI, the web interface,
or through the Desktop Console. This section discusses the following topics:
 “Local Accounts”—Each appliance maintains a database of local user accounts that can access that
appliance.
 “Global Accounts”—For appliances that belong to a domain, a user account can be granted global
access to the domain. Global access allows that account to log into any appliances within the domain.
 “Global Accounts”—An appliance can also authenticate users against an external RADIUS server. This
section also discusses “Setting Up the RADIUS Server”.
Local Accounts
Each AppResponse Appliance maintains a database of local accounts that can be used to access that
appliance. This includes the special admin account used to configure the appliance at install time. After
installation is complete, the local admin account should not be used for day-to-day operations. Instead,
individual accounts should be created for each user. Local accounts are configured using the “User Admin
Manager”.
Global Accounts
AppResponse Appliance user accounts can be distributed to all appliances within a domain. This means
that a single user account can be used to any appliances in a domain. Global accounts are configured using
the “User Admin Manager”.
RADIUS Accounts
Access to each AppResponse Appliance can now be authenticated through external RADIUS server. To
configure RADIUS servers, log into the web interface, click radius in the System tab.
Figure 7 System Tab - Configuring Radius Authentication
Click activate to enable RADIUS authentication. Each RADIUS server must be configured with a hostname
or IP address in the host field, the UDP port on which the RADIUS server is listening (the default RADIUS
port is 1812) and the RADIUS secret for that server.

Each AppResponse Appliance can be configured to authenticate against up to 3 RADIUS servers. When a
user logs into the AppResponse Appliance, if the first server is reachable, it is used exclusively for RADIUS
authentication. If the first server is not reachable or does not respond on the appropriate UDP port, then the
second server is tried. Similarly, the second falls back the third server (if one is specified). This can create
confusing effects if the account databases do not agree between the servers. The intent is that secondary
RADIUS servers would be clones of the primary.
RADIUS authentication is configured on each appliance separately. This means that the administrator can
choose different authentication schemes for each appliance.
Setting Up the RADIUS Server

You must do the following on the RADIUS server:
1) “Create “dictionary.network-physics” File” on page 24
2) “Modify the Main Dictionary File to Load “dictionary.network-physics”” on page 25
3) “Cisco Access Control Server (ACS): Additional Requirement” on page 32
4) “Restart the FreeRADIUS Client” on page 25
Create “dictionary.network-physics” File

Create a new dictionary file with the following contents. Copy the following text, paste it into an empty text
file, and save it to the following: /usr/share/freeradius/dictionary.network-physics
Note: The FreeRadius file system includes a dictionary.networkphysics (no dash) file. Make sure
that the new file you create is named dictionary.network-physics (with dash) so you don't overwrite
the dictionary.networkphysics file.
# -*- text -*-

#
# Network-Physics dictionary
# $Id$
#
VENDOR Network-Physics 7119

BEGIN-VENDOR Network-Physics
ATTRIBUTE Network-Physics-Attribute 33 string
ATTRIBUTE Network-Physics-Account 34 integer
ATTRIBUTE Network-Physics-Role 35 string
#VALUE Network-Physics-Attribute Basic 'npinsight'

#VALUE Network-Physics-Attribute Restricted 'npread'
#VALUE Network-Physics-Attribute Standard 'npuser'
#VALUE Network-Physics-Attribute Administrative 'npadmin'
VALUE Network-Physics-Account NP-Insight_Only 0

VALUE Network-Physics-Account NP-Read_Only 1
VALUE Network-Physics-Account NP-User 2
VALUE Network-Physics-Account NP-Admin 3
#VALUE Network-Physics-Account NP-Nobody 4
END-VENDOR Network-Physics

Modify the Main Dictionary File to Load “dictionary.network-physics”

You must modify the main dictionary file (at /usr/share/freeradius/dictionary ) so that it loads
the newly created vendor-specific dictionary file. Add the following line to the dictionary file and then save
it:
$INCLUDE dictionary.network-physics
Add User Definitions for Basic and Restricted Users

If you are using Radius for authentication, authorization, and accounting (AAA) management, the Radius
user definitions for Basic and Restricted users (in FreeRadius: /etc/freeradius/users) must
include the following two entries:
Network-Physics-Attribute=npinsight (for Basic) | npread (for Restricted)
Network-Physics-Role="comma-separated-role-list-with-no-spaces"
Note: The comma-separated list of roles must be contained in plain-text, ASCII double quotes and cannot
have any spaces.
Examples:
basic_user_Tom Cleartext-Password := "basic_password"
Reply-Message = "Hello, %{User-Name}",
Vendor-Specific = Network-Physics,
Network-Physics-Attribute = npinsight,
Network-Physics-Role = "Allow_All_Insights, Allow_All_Reports"
restricted_user_Mary Cleartext-Password := "restricted_password"

Reply-Message = "Hello, %{User-Name}",
Vendor-Specific = Network-Physics,
Network-Physics-Attribute = npread,
Network-Physics-Role = "restricted_insights_role,restricted_reports_role"
Restart the FreeRADIUS Client

After you make the specified changes described in the previous steps, restart the FreeRadius client. Run the
following command on the Radius server:
/etc/init.d/freeradius restart
Order of Authentication
When a user logs in, the AppResponse Appliance attempts to authenticate the account against RADIUS
first, followed by accounts listed in the User Admin Manager. Therefore, if there is an account in RADIUS
with the same name as an account in the Desktop Console User Admin Manager, the one in RADIUS takes
precedence. If authentication against RADIUS fails for any reason (e.g., incorrect password, incorrect
vendor-specific attribute in RADIUS), the AppResponse Appliance attempts to authenticate against the
local or global users listed in the User Admin Manager.

Restricting User Access

The hostaccess utility enables you to allow/deny appliance access to specific IPs. (By default, hostaccess is
disabled and all IPs can access the appliance.) Note the following before you enable hostaccess on an
appliance.
 The hostaccess utility maintains a whitelist of IPs that are allowed access to the appliance. Once
hostaccess is enabled, only IPs on the whitelist can access the appliance.
 The only IP included on the whitelist by default is 127.0.0.1 (localhost). In this context, “localhost” is
the appliance loopback interface address, not the IP of your host (if you are connecting to the appliance
remotely).
 Important! Always include at least one statically-assigned IP address to the whitelist before you enable
hostaccess. This ensures that you can access the appliance from at least one remote host.
 If the appliance is in a director domain, include the director IP in the whitelist.
 If you want to enable hostaccess on a director, the whitelist should include the IPs of all appliances in
the domain.
 If you accidentally lock yourself out of the appliance, connect to the appliance directly using an
attached keyboard and monitor.
 If you want to ensure connectivity from a multihomed host, include all IPs for the host in the whitelist.
 It is good practice to review the whitelist periodically if you decide to enable hostaccess.
Procedure 3 Configuring hostaccess
1. Connect to the appliance as admin using an SSH-enabled utility such as PuTTY.
2. Enter the command: hostaccess
The following prompt appears:

Host access restrictions are OFF: Any host may connect.
enable - Enable client security restrictions
exit - Exit
3. Enter the command: enable
The hostaccess menu appears:

Host access restrictions are ON: 2 whitelist rule(s) present.
** There are unsaved changes. Type 'commit' to save and activate changes **
disable - Disable client security restrictions

show - Show client whitelist
allow - Add client access
deny - Remove client access
commit - Commit changes
exit - Exit
4. For each IP you want to allow access to the appliance, enter the command enable and then specify
the IP or network to add to the whitelist.
Note: The whitelist should include the following:
• The static IP of the host normally used to configure and manage the appliance.

• The management-port IP of the director (if the appliance is part of a director domain)
• The management-port IP of each appliance in the domain (if you are configuring hostaccess on
a director)
Note: You can enter network addresses in CIDR format (such as 10.10.15.10/16). Wildcards and
IP ranges are not supported.
5. Enter the command show and review the whitelist carefully. Once you commit, only IPs in this
whitelist will be able to connect to the appliance.
Note: You can use the deny command to remove IPs from the whitelist.
6. Enter the command commit to save the whitelist to disk.
7. Enter the command exit.
End of Procedure 3
User Admin Manager

To access the User Admin Manager, start the Desktop Console, click the Tools menu and select User Admin
Manager.
Note: The password for the admin account cannot be changed using the User Admin Manager. The CLI
command passwd must be used instead.
Figure 8 User Admin Manager

The user admin manager is only available to user accounts with administrative privileges.
To create a new user account, click the New button and supply the name, description, password and
privilege level (see also “Account Privileges” on page 29).
Accounts created on a regular appliance are local to that appliance. Whereas, accounts created on the
Domain Director are global and can log into any appliance within the domain. However, if a local account
exists on an appliance with the same name as a new global account, the appliance rejects the new global
account when the account configuration information is distributed by the director. An error appears in the
Director Update Log.

Account Privileges
Each account is assigned a specific privilege which controls the operations that the account is allowed to
perform. The following table lists the account privileges.
.
Table 1 Account Privileges
Privilege VSA Description
String
Basic npinsight A Basic user can

• Log into the web interface, CLI, and Desktop Console.
• View Insights and access some table and charts by right-clicking on some
elements of an Insight.
A Basic user cannot
• View, edit, or export any configurations on the appliance.
• View or download any captured packets on the appliance.
• Export data from a table to a CSV file.
• View Individual Page Views and Web User Troubleshooting insights.
Restricted npread A Restricted user can

• Access all Desktop Console functionality (with the following exceptions).
A Restricted user cannot
• Edit or export any configurations on the appliance or export configuration
settings.
• View or download any captured packets on the appliance.
Standard npuser A Standard user can

• View Individual Page Views and Web User Troubleshooting insights.
• View and download captured packets on the appliance.
• Access all Desktop Console functionality (except the User Admin Manager).
A Standard user cannot view, edit, or export configuration settings in the
following locations:
• User Admin Manager
• System > Administration web UI
• Command Line Interface (CLI)
Administrat npadmin An Administrative user can

ive
• Access all Desktop Console functionality.
• View, edit, and export configurations on the appliance.
• View and download captured packets on the appliance.

The user account associated with the current project is displayed at the top right of the Desktop Console
screen. Hover the mouse pointer over the user name to see the privilege level of the user.
Figure 9 Current User Privilege Level
Related Topics
Role-Based Access Control

Appliance administrators can limit the access of end users to specific insights, reports, and SLA dashboards.
This is useful when you want to filter the content that your end users can view and publish. This
functionality also
 Simplifies the user interface, since an end user sees only authorized content.
 Improves access security for the appliance. Unauthorized users cannot access insights with
Administrative functionality, such as configuring the appliance or downloading captured packets.
The following steps describe the basic workflow:
1) An Administrator opens the Role Manager and defines a role and the insights, reports, and custom
views that users with the role can access.
2) The Administrator opens the User Admin Manager and assigns the role (or multiple roles) to a specific
user profile.
Important Notes
Note the following:
 Administrator access is required to view, create, edit, and assign roles.
 Roles can apply to Restricted and Basic users only. Roles do not affect Administrator or Standard users,
who can access all insights, reports, and Custom Views.
 If you are using Radius and want to define roles for Basic or Restricted users, see “Cisco Access Control
Server (ACS): Additional Requirement” on page 32.
 Basic users cannot view or download captured packets, even if a user is assigned a role that includes
packet access features.
 If a Restricted or Basic user has no roles assigned, that user cannot view any insights, reports, or
Custom Views.
 If a Restricted or Basic user has multiple roles assigned, that user can view all assigned items in all
assigned roles.
 Unlike user accounts, role definitions cannot be distributed from a director to a connected appliance.
If you distribute a user account that includes roles, the following occurs:

a) The director distributes the user account definition—including the set of assigned roles (names, not
definitions)—to the connected appliances.
b) Each appliance updates the user account with the set of distributed role names and matches the
names to the local role definitions.
c) If a distributed name does not match a local definition, the appliance creates a new empty role (no
insights, reports, or custom views assigned).
 You cannot delete or rename any role if it is assigned to a global user account on a domain director.
 Role names cannot include commas or spaces.
 The appliance automatically updates roles and user profiles in response to the following actions, so
that user access is based on the current role definitions:
– Item (insight, report, custom view) is assigned or unassigned in a role
– Assigned item in a role is deleted from the appliance
– Role is renamed or deleted
– User with an assigned role is renamed or deleted
 When you update an appliance from a pre-9.0 release, the appliance does the following:
– Creates two default roles, Allow_All_Insights and Allow_All_Reports, in which all standard
insights and reports (respectively) are assigned.
– Assigns the Allow_All_Insights role to all Basic users
– Assigns the Allow_All_Insights and Allow_All_Reports roles to all Restricted users
 If you are using Radius for authentication, authorization, and accounting (AAA) management, set up
Radius as described in “RADIUS Accounts” on page 23.
Create/Edit a Role
Procedure 4 Create/Edit a Role
1. In the Desktop Console, choose Tools > Role Manager.
2. Click New to create a new role, or select a role in the table to edit it.
3. Define the role:
• Identity—Role name and description
• For the following tabs, move the items that a user can view/publish into the Assigned column, or
check Access All (if this option is available).
• Insight Accessibility
• Report Accessibility
• Custom View (Web UI) Accessibility
• Special Features

4. Click Apply or OK to save your changes.
End of Procedure 4
Assign Roles to a User
Procedure 5 Assign one or more roles to a user
1. In the Desktop Console, choose Tools > User Admin Manager.
2. In the Account tab, select the user profile.
3. In the Roles tab, move the roles into the Assigned tab.
Note: A user can view all assigned items in all assigned roles for that user profile.
4. Click Apply or OK to save your changes.
End of Procedure 5
Cisco Access Control Server (ACS): Additional Requirement

If you are using Cisco ACS for authentication, authorization, and accounting (AAA) management, you
must do the following:
1) Create a new attribute with the Vendor Attribute ID 35.
2) Assign that attribute to the authorization profile that was previously created for the AppResponse
Radius user.
3) Assign values to that attribute within the Authorization Profile (in this case it is called “ARXInsights”)
4) In the AppResponse Role Manager, create a role whose name matches the Authorization Profile name
in ACS (as defined in the previous step)
5) Assign the required privileges to the AppResponse Role.

For specific information about how to configure Access Control Server, refer to the Cisco documentation.

Configuring Network Parameters

The following network parameters can configured using either the web interface System > setup menu or
the CLI setup command:
 hostname
 IP address
 netmask
 default gateway
 domain name
Changes to these parameters may affect the visibility of the appliance on the network. Verify the parameter
values before running this command.
For instructions on setting these parameters using the web interface, see “Administration > System Web
Interface” on page 130.
To modify the network parameters using the CLI, log into the CLI, type setup and press Enter. The CLI
displays the setup menu which provides the following options:
 config - Change the appliance network parameters. Changes are not saved until the commit command
is run.
 showall - Display the current values of the network parameters.
 commit - Save changes made using the config command.
 reboot - Reboot the appliance without saving changes.
 quit - Return to the main CLI menu without saving changes.
Related Topics

Configuring Outgoing Email Parameters

The AppResponse Appliance can be configured to generate email messages as notification for such things
as static alerts and diagnostics reports. Depending on the setup of the host network, the AppResponse
Appliance may require some configuration in order to deliver email messages successfully.
This section discusses the following:
 “Customizing Sender Names of Outgoing Emails”—Useful if mail relay policies in your network
prohibit or restrict emails with the sender name root.
 “Configuring an Appliance to Send Emails Using an SMTP Relay”—Useful if the appliance cannot
deliver messages directly.
Customizing Sender Names of Outgoing Emails

The CLI utility mailmgr includes a command to customize the email sender (From:) field when the
appliance sends emails for traffic alerts, sysalerts, diagnostic reports, and so on. By default, AppResponse
uses the sender name root (for example, root@acelive.appliance1.mycompany.com). You might
want to change this default if the mail relay policies in your network prohibit or restrict emails with the
sender name root.
Procedure 6 Customizing the Sender Names for Outgoing Emails
1. Log in to the appliance using a terminal emulator or SSH client program, as described in the following
section of the AppResponse Administrator Guide:
Administration and Maintenance > Using the Command Line Interface > Accessing the Command
Line Interface
Note: You must have administrator privileges on the appliance to configure email options.
2. Enter the following command: mailmgr
mailmgr shows the list of available commands.

show - Show current mail configuration
config - Configure MTA parameters
reset - Restore stock mailer configuration, discarding any localizations
setrcpt - Set recipients for test mail
sendtest - Send message to test outbound mail
inbox - Review local inbox (for potential email failure notices)
rootmasq - Set up outgoing root masquerade
expert - toggle expert mode
mailq - display/process mail queues
quit - Commit changes, restart mailer (if needed), and exit this program
Note: rootmasq is an advanced command. If you do not see it in the list, you can enter expert to
turn on expert mode; then enter help to see the full menu.
3. Enter the following command: rootmasq
A prompt appears to enter the new sender name for outgoing emails.
Root masquerade configuration. Enter '?' for help.

(root_masq) Enter Root masquerade address:
4. Enter the new sender name:

(root_masq) Enter Root masquerade address: user.x@mydomain.com

Note: You might see a message such as:
WARNING: Unresolvable hostname: user.x@mydomain.com
This message indicates that AppResponse ran a UNIX gethostbyname() lookup and could not
resolve the hostname. If the sendtest command runs successfully in the next step, you can usually
ignore this warning.
5. Enter the following command: sendtest
mailmgr sends a test email and displays a status message such as:
Test mail was sent (subject: TEST 2010/01/07 14:47:29
Note—The sendtest email comes from your login username, but diagnostics and alert emails will
have the root masquerade.
A prompt appears asking if you want to save your changes:
Apply configuration changes? (y/n)
6. Enter y to apply the changes.
A series of status messages appears.
7. Enter the following command to quit the utility: quit
AppResponse now uses the new sender name for all outgoing emails.
8. netmasq command does not affect the “common name” or “screen name” used by different
subsystems on the AppResponse appliance. Thus, the full sender lines will appear like this:
From: Traffic Monitor <user.x@mydomain.com>

From: ACE Live Reports <user.x@mydomain.com>
End of Procedure 6

Configuring an Appliance to Send Emails Using an SMTP Relay

By default, the AppResponse Appliance attempts to deliver messages directly. If the appliance is unable to
deliver messages directly, it must be configured to use an SMTP relay. The following SMTP relay parameters
can be configured through the CLI or through the System > mail menu of the web interface.
Table 2 Outgoing Email Parameters

Parameter Description
mta_mail_hub The MTA (message transfer agent) or system of agents used to route email to the
final email server.
[optional]
mta_relay The hostname (or IP address) of the SMTP relay. All outgoing email messages are
forwarded to the relay rather than being delivered directly by the appliance.
mta_relay_port The TCP port number used by the SMTP relay. This parameter does not need to be
configured. By default, the appliance attempts to communicate with the mta_relay
[optional]
host using TCP port 25.
mta_masq_domain The domain used for email originating from the appliance. By default, the
appliance uses the domain name specified in the system setup page.
[optional]
root_masq The name to use as the email sender (From: ) when the appliance sends emails for
alerts, diagnostic reports, and so on.
[optional]
Procedure 7 Configuring SMTP Relay Parameters via CLI
1. Login to the AppResponse Appliance CLI using the appliance serial port or SSH (see “Command Line
Interface” on page 128).
2. Type mailmgr at the CLI prompt and press Enter. A list of mailmgr options is displayed on the screen.
3. Type config at the prompt and press Enter.
4. Input the appropriate SMTP relay parameters for your network:
• mta_masq_domain
• mta_relay
• mta_relay_port
The appliance is automatically reconfigured using these values.
5. Type quit at the prompt and press Enter to exit the mail configuration submenu.
6. Type quit at the prompt and press Enter to terminate the CLI session.
End of Procedure 7
Related Topics

Running Diagnostics and Viewing Error Logs

The CLI provides two commands related to accessing diagnostics information. The CLI dmq command
displays a complete diagnostics report on the AppResponse Appliance. The report includes information
and statistics on the following:
 cpu and memory usage
 I/O statistics
 environmental status
 process, driver, database and disk status
The web interface provides the ability to view the diagnostics report, as described in “Diagnostics in the
Web Interface” on page 47. The web interface can also be used to email the diagnostics report directly to
Riverbed support in the event of a problem.
The CLI viewlog command displays the AppResponse system log. This log includes detailed information
on the status of each core process running on the AppResponse Appliance.
Related Topics

Checking the Factory Settings

The AppResponse Appliance includes a set of initial system parameters, known as factory settings, that are
set during system production. These parameters include the model name and number, the initial software
version and the appliance serial number. Run the fset command at the CLI to access the factory settings.
The appliance serial number is needed if you call Riverbed support. The fset command displays the serial
number on a line starting with FS::Serial_Number.
Related Topics

Halting or Rebooting the Appliance from the CLI

The AppResponse Appliance should always be shut down gracefully. Shutting down the appliance using
the power switch may result in data loss.
The following CLI commands can be used to shut down the system.
 halt - Shut down the appliance.
 reboot - Shut down and restart the appliance.
These functions can also be performed using the web interface.
For more information, see “Halting or Rebooting the Appliance from the Web Interface” on page 61.
Related Topics

Setting Up Private-Address to AS-Number Maps

The AppResponse Appliance maps IP addresses to AS groups before data is displayed to the user. Each IP
address is mapped to the ISP AS, Peer AS and Dest AS groups. Private IP addresses (RFC 1918) are mapped
to AS Unknown unless they are present in both the local BGP table and the appliance’s WHOIS database.
The following two steps must be taken to ensure that Private IP addresses are mapped to a specific AS
number (instead of AS Unknown):
 BGP table - Enter the private IP addresses into the local BGP table. Follow the instructions provided by
your router vendor to add private IP addresses to BGP.
Note—These CLI commands must query the BGP routing table and may take up to 2 minutes to
execute.
The AppResponse Appliance automatically uses this information to map private IP addresses to the
appropriate ISP AS and Peer AS if it has been configured as a BGP peer.
 Appliance WHOIS database - The AppResponse Appliance provides CLI commands that can be used
to add private IP address entries from BGP to the appliance WHOIS database. The commands used to
manage this process are:
– ipas-display-private-ips
List the private IP addresses that are already in the AppResponse Appliance WHOIS database.
– ipas-add-private-ips
Add the private IP addresses from the BGP table to the appliance WHOIS database. The Desktop
Console must be restarted before the changes resulting from ipas-add-private-ips take effect on a
desktop machine.
– ipas-undo-private-ips
Remove the private IP address entries from the appliance WHOIS database. The Desktop Console
must be uninstalled then reinstalled before the changes resulting from ipas-undo-private-ips take
effect on a desktop machine. Remove the Desktop Console using the Java Web Start Application
Manager and download it again from the appliance web interface.
Related Topics

Configuring SYSLOG Alert Destinations

All alerts generated by the AppResponse Appliance can be forwarded to a SYSLOG server. Note the
following:
 The AppResponse Appliance does not generate SYSLOG alerts unless SNMP is configured and
enabled. See “Configuring SNMP” on page 45.
 AppResponse supports syslog messages in UTF-8 format.This requires a syslog receiver that supports
UTF-8 encoding.
To configure a SYSLOG destination for alerts log into the CLI, type alertdir and press Enter. The CLI
displays the setup menu which provides the following options:
 list - List current SYSLOG destinations.
 add - Add a new SYSLOG destination. The following parameters must be supplied to configure a new
SYSLOG destination:
– host - The hostname or IP address of the SYSLOG server.
– facility - The SYSLOG facility assigned to all alerts forwarded by the AppResponse Appliance.
– priority filter - The lowest priority message that should be sent to this SYSLOG server. The
priorities supported by SYSLOG, from highest to lowest, are listed in the following table.
Table 3 SYSLOG Priorities

SYSLOG priority (text) SYSLOG priority (numeric)
emerg 0
alert 1
crit 2
err 3
warning 4
notice 5
info 6
debug 7
Static and adaptive alerts generated by the AppResponse Appliance are mapped to the following
SYSLOG priorities:
Table 4 Appliance Alerts and SYSLOG Priorities

AppResponse Appliance alert severity SYSLOG priority
critical 2
major 4
minor 5
normal 6
 delete - Delete an existing SYSLOG destination.

 modify - Modify an existing SYSLOG destination.

Related Topics

Traceroute Parameters
Traceroute is an important source of data for the AppResponse Appliance. All topology information
displayed in the IP topology tool is collected through traceroute. In addition, all traceroute metrics are based
on data collected through traceroute.
Note: By default, traceroute is turned off. To turn on traceroute, go to the Web Console > Administration >
System > Traceroute page and set the Automatic Traceroute option.
TCP traceroutes may be mistaken as port scanning activity by some intrusion detection systems. If this is a
concern, consider using ICMP traces.
When traceroute is enabled, the AppResponse Appliance actively runs a traceroute to network destinations
using ICMP. In environments where personal firewalls (PFW) are mandatory, this traceroute feature may
trigger alerts on personal firewall software with rules involving inbound ICMP. Most PFW software does
not block or alert on inbound ICMP as part of their default. If this occurs, consider changing the
AppResponse Appliance to TCP (see also “Traceroute Types” on page 43).
Automated and Manual Traceroutes

When traceroute is enabled, AppResponse Appliance automatically runs a traceroute to common
destinations at frequent intervals. By default, an automatic process runs a traceroute to the top 100 IP
addresses once every 5 minutes. These parameters are configurable through the web interface.
The top IP addresses are selected using the following algorithm:
 The Top N IP addresses (N defaults to 100) are selected from the following groups.
– 1/3 of the addresses are chosen from the top member IPs within Business Groups ranked by
Throughput (Inbound and Outbound).
– 1/3 of the addresses are chosen from the preferred IP list. (See “Preferred IPs” on page 155.)
– 1/3 of the addresses are chosen from the top 50 Dest AS ranked by Throughput (Inbound and
Outbound). The IP addresses are select to maximize coverage of the top Dest AS. If only 30 IP
addresses are chosen from Dest AS, one IP address is selected from each of the top 30 Dest AS. If
100 IP addresses are chosen from Dest AS, two addresses are selected from each of the top 50 Dest
AS.
In addition to the automated traceroutes, the user can trigger manual traceroutes using the IP Topology
view in the Desktop Console, as described in “Topology” on page 199. The IP Topology view can also be
used to visualize topology information collected by both manual and automated traceroutes.
Traceroute Types
The AppResponse Appliance supports both standard ICMP traceroute and TCP-based traceroute.
Conventionally, traceroutes are performed by sending out either UDP datagrams or ICMP echo request
messages and waiting for ICMP errors. The AppResponse Appliance can send out either TCP SYN request
or UDP datagrams and detects both ICMP errors and TCP RST segments. Due to different traffic filtering,
one form of traceroute may provide more accurate results than the other for any given destination.

Configuring Traceroute Parameters

To configure traceroute preferences, click traceroute from the System tab of the web interface.
Figure 10 System > Traceroute Menu
The following traceroute parameters can be configured through the web interface:
 Automatic Traceroute—Turn automated traceroutes on or off (default is off).
 Traceroute Period—The frequency at which batches of automated traceroutes are executed. Traceroute
period is specified in minutes.
 Traceroute Count—The number of IP address to traceroute in each batch. These IP addresses are
selected by decreasing Total Outbound Throughput.
 Traceroute Protocol—Toggle the type of traceroute between TCP and ICMP.
Related Topics

SNMP Traps
In addition to user-configurable static and adaptive alerts (described in “Alerting and the
Dashboard”—search the User Guide or the online help), the AppResponse Appliance can be configured to
generate alerts of two other types:
 Appliance alerts—Appliance alerts are SNMP traps that are automatically generated when the
AppResponse Appliance experiences abnormal environmental conditions or excessive resource
consumption.
 Heartbeat alerts—Heartbeat alerts are SNMP traps sent periodically by the AppResponse Appliance to
indicate that the AppResponse Appliance is functioning correctly. This includes an cold-start trap each
time the SNMP agent on the appliance is restarted. These cold-start traps occur whenever the
appliance is rebooted, or when changes are made to SNMP settings through the web interface.
You can download the AppResponse MIB from the Administration > System web UI: from the Web
Console, choose Administration > System; then choose System > SNMP. You can then use the MIB in a
network-management system or browse it with a standard MIB browser.
See also “SNMP Alert Descriptions” on page 52.
Configuring SNMP
SNMP must be configured through the web interface in order for the AppResponse Appliance to generate
SNMP traps. To configure SNMP, begin by logging into the web interface. On the System menu, click snmp.
The following SNMP parameters can be set:
 SNMP Agent—Enable or disable the SNMP agent on the AppResponse Appliance. If disabled, the
SNMP agent does not respond to SNMP queries.
 Community—Set the community string for the SNMP agent on the AppResponse Appliance.
 Traps—Enable or disable SNMP traps generated by the AppResponse Appliance. This includes static
alerts, appliance alerts and heartbeat alerts.
 Trap Destination—The AppResponse Appliance forwards traps to the destination specified as a trap
destination. The destination IP address, port number and community string must be defined. The
appliance can forward traps to up to two destinations simultaneously.
 Send Heartbeat Traps—Enable or disable heartbeat traps. The INTERVAL parameter controls the
frequency of heartbeat traps.
 Snmp Version—SNMP version 1, 2c, or 3.
You can specify the SNMP version for the primary and secondary trap destination. Version 3 has
encryption and privacy features that are unavailable in versions 1 and 2. The following options are
available only when SNMP v3 is selected:
– Sec Level—Select the security level:
NoAuthNoPriv (no authentication or privacy requested)
AuthNoPriv (authentication but no privacy requested)

AuthPriv (both authentication and privacy requested).

– AuthProto—If authentication is requested, select the authentication protocol (MD5 or SHA) and
password.
– PrivProto—If privacy is requested, select the privacy protocol (DES or AES) and password.
Figure 11 System Tab - SNMP Page
The AppResponse SNMP MIB can be browsed using any MIB browser. By default, the SNMP agent runs on
UDP port 161. This port can be changed through the web interface (see “Configuring Network Ports” on
page 64).
Related Topics

Diagnostics in the Web Interface

The Diagnostic tab on the web interface can be used to generate diagnostic bundles with out using the CLI,
modify automatic diagnostic report settings, activate or deactivate automatic diagnostic reporting and
alerts.
The following is available under the Diagnostics tab:
 “Bundles”
 “Subscription”
 “Settings”
 “Status”
 “Log Viewer”
Bundles
Bundles are reports that can be generated on demand. The diagnostic bundles contain information used for
technical support troubleshooting. In general, this information—which includes system configuration,
serial numbers, software versions, process status, and error logs—is for Riverbed technical support to assess
the health of your AppResponse Appliance and can be used to assist in troubleshooting. There are two types
of bundles that can be created:
 log bundles
 core bundles
Log bundles are diagnostic bundles of all the logs and are used to help troubleshoot possible issues with
the AppResponse Appliance. Log bundles created here are the same as using the CLI commands
diag-bundle-create and diag-bundle-delete. (See “Diagnostics Bundles” on page 69.)
Core files are created when the entire AppResponse OS kernel crashes (resulting in a system reboot). Core
bundles are one or more core files packaged together. They are useful when working with support to
troubleshoot problems. Core bundles can be packaged up for delivery to Riverbed technical support via
FTP, after they are created in the CLI or the System > Administration web UI. Follow instructions from
Riverbed Technical Support.
Figure 12 Diagnostics Tab—Bundle

Procedure 8 Creating Bundles
1. Using the Period fields, enter the time period for the bundle you wish to create. For a 24 hour period
use the same date in each box (as shown in Figure 12).
2. Check either the “logs” or “core files” radio button.
3. Click Create Bundle.
End of Procedure 8
Bundles are created as a gzip-ed .tar file (.gz). Assembling the bundles can take a few minutes. Once
complete you can download the file directly from the Diagnostic tab.
To delete a bundle, click the red delete X to the left of the completed bundle.

Subscription
The Diagnostic > Subscription page has four tabs:
 “Reports”
 “SNMP Alert Descriptions”
 “Software Alerts”
 Other alerts
Reports
The Reports sub-tab is used to send reports to selected recipients. Reports are created according to a
schedule that you set.
Figure 13 Diagnostics Tab—Subscription—Reports
Procedure 9 Configuring Automatic Reports
1. Enter the email of the intended recipients. Multiple addresses are comma-separated.
2. Select active to send reports automatically and continue with steps 3 and 4.
Select inactive to disable this feature.
Select send report at boot time to send the report every time the AppResponse Appliance reboots.
3. Select the radio button for hourly, daily, weekly delivery and use the corresponding fields to enter the
specific information.
4. Click Apply.
End of Procedure 9

By default, the periodic automatic email report is sent to Riverbed to provide you with the best support.
You can generate manual reports at any time, but these are usually generated at the request of a Riverbed
technical support representative.
You may view and manually email the report by clicking the “status” link on the Diagnostic tab.
Alerts
The hardware alerts, software alerts, and other alerts sub-tabs are used to configure to whom and when
alerts are sent. Alerts are sent in real-time. Alert types to be sent are selected in “Settings”.
Please note that at this time there are no other alerts available.
Figure 14 Diagnostics—Subscription—Alerts
The three alerts sub-tabs have the same user interface.
Procedure 10 Specifying Report Recipients:
1. Select one of the alert sub-tabs.
2. Enter the email of the intended recipients. Multiple email addresses are comma-separated. If no email
is entered, email is not sent,
and/or
Check SNMP,
and/or
Check SYSLOG.
Both SNMP and SYSLOG need to be configured else where. For more information, see “Configuring
SYSLOG Alert Destinations” on page 41 and “Configuring SNMP” on page 45.
3. Select the minimum severity of Alerts you wish to send.
4. Click Apply.
End of Procedure 10

Settings
The Settings link allows you to choose which alerts are to be sent and to set the deduplication period. (See
“Alerts” for information on to whom the alerts are sent.) Alerts are sent in real-time.
Deduplication is when additional alerts are suppressed for the deduplication interval after the end of the
previous alert. For example, if the appliance temperature is out of range, the CPUTEMP alert is sent. The
alert continues to be active until an acceptable temperature is restored. Alternatively, if the temperature
fluctuates above and below its temperature threshold, deduplication suppresses additional alerts within
the time period. By selected Deduplication Period, the alert is only sent once at the time interval entered.
Figure 15 Diagnostics Tab—Alert Settings
By default, all alerts are enabled except NICPKTRT (see table for explanation).
Procedure 11 Modifying Alerts
1. Select the + next the Hardware alerts. This expands the Hardware alert list.
2. Select Enable all to select all alerts, or select the check box next to specific alerts.
3. Enter the length of the deduplication period in minutes.
4. Repeat steps 1-3 for the Software alerts.

Click Apply.
End of Procedure 11
To restore the default settings, click Restore default.

SNMP Alert Descriptions

The following sections describe the SNMP alerts defined in the appliance MIB:
 “User-Defined Alerts” on page 52
 “SNMP Alert Descriptions” on page 52
 “Unused Alerts” on page 59
You can download the AppResponse MIB from the Administration > System web UI: from the Web
Console, choose Administration > System; then choose System > SNMP. You can then use the MIB in a
network-management system or browse it with a standard MIB browser.
See also “SNMP Traps” on page 45.
User-Defined Alerts
The npUserTrafficTrap alert definition is reserved for alerts defined in the Alert Manager
(Desktop Console > Tools > Alert Manager). You can define alerts to generate SNMP traps when an alert is
triggered. For more information, search for “Alert Manager” in the online help.

Hardware Alerts
The following table lists brief descriptions of each hardware alert.
Table 5 Hardware Alerts

Alert Description Severity
Level
CPUCNT The detected count of CPUs is not the expected count. Critical
Check detected CPU count. Typically this alert indicates a hardware failure.
Create a diagnostic bundle and contact Support as
described in KB article S22633.
CPUTEMP The CPU temperature exceeds the normal range. Critical

CPU temperature out of limits. Create a diagnostic bundle and contact Support as
CPUTEMPMARG The CPU temperature is approaching its maximum • Critical

CPU temperature approaching limit limit. Create a diagnostic bundle and contact Support
• Major
as described in KB article S22633.
• Minor
DISKIO A hard drive or disk I/O failure has occurred. For Minor
Disk IO error more information, see KB article S22069.
FANRPM The fan RPMs exceeds or is below the normal range. Major
Fan RPM is out of limits Create a diagnostic bundle and contact Support as
HSCBADPKT This alert indicates that a network interface card Minor

Check HSC corrupt packets flagged some Ethernet packets as malformed or
corrupted. If you see frequent HSCBADPKT alerts,
check the hardware connectivity between the
monitoring interfaces on the appliance and the
devices/ports to which they are connected.
NICCNT The appliance checks all available network interfaces Critical

Check detected NIC once at startup and generates an alert if there is an
inconsistency in the set of network interfaces. If you
see this alert, note the alert time, create a diagnostic
bundle, and contact Support as described in KB article
S22633.
NICDOWN This alert is generated when all Network Interface Major

Check NIC status Card (NIC) ports are disconnected as a warning that
no traffic at all will be monitored or captured. Confirm
that the NICS you want to enable are plugged in and
active.

Table 5 Hardware Alerts (Continued)

Level
NICPKTLSS The appliance sends this alert when any packets are Critical
Check NIC packet loss limit dropped. A small amount is not critical to the
appliance, but needs to be understood. View the
Appliance Health Check insight (KB S25935) at the
time of the alert to confirm oversubscription or other
error conditions and correct them.
PHYMEM There is an issue with physical memory on the Major

Physical memory appliance. Note the alert time, create a diagnostic
bundle, and contact Support as described in KB article
S22633.
SYSPWR The power supply voltage is out of tolerance. Note the Critical
Power supply voltage is out of limits alert time, create a diagnostic bundle, and contact
Support as described in KB article S22633.
SYSTEMP The appliance temperature exceeds the normal range. Major

Sensor temperature is out of limits Create a diagnostic bundle and contact Support as

Software Alerts
The following table lists brief descriptions of each software alert.
Table 6 Software Alerts

Level
COREFILE A process terminated abnormally. Create a diagnostic Major

Abnormal process termination bundle and contact Support as described in KB article
S22633.
DAQERR Data processing on the appliance is stalled for some Critical

Data acquisition check reason—if the appliance is not processing packets, or
takes a long time to process packets after it sees them on
the monitoring interfaces. This alert is not triggered if the
appliance sees no traffic on the interfaces. Typically, this
alert indicates a problem with the appliance. Note the
alert time, create a diagnostic bundle, and contact
DIAGINT If you see this alert, create a diagnostic bundle and Critical
Diagnostic internal contact Support as described in KB article S22633.
DMCNAPPL Connectivity from the director to an appliance was lost. Critical

Connection to a leaf node is broken. Check the Domain Manager on the director and confirm
connectivity between the director and appliance.
Reconnect if needed. If this does not resolve the issue, run
resetTunnel from the director CLI.
DMCNDIR Connectivity from the appliance to the director was lost. Critical
Connection to the alpha node is Check the Domain Manager on the director and confirm
broken. connectivity between the director and appliance.
Reconnect if needed. If this does not resolve the issue, run
resetTunnel from the director CLI.
DMCNSYNC The director detects that the time clocks on the appliances Major
Domain connectivity error. are out of sync. If you see this alert, verify that the time
clocks on the director and all appliances are in sync.
DPLIMEXC The appliance has exceeded one of the limits for unique Major
Data processing limit exceeded IPs, IP conversations, or connected IPs for a given minute.
If you see this alert daily, scale back the amount of traffic
sent to the appliance.
FLOWPKTLSS The ASA process is experiencing packet loss. Internal Major

Packet loss seen at flowstats data processing might not be working, or the appliance is
taking a long time to process packets after it sees them on
the monitoring interfaces. This alert is not triggered if the
appliance sees no traffic on the interfaces.
View the Appliance Health Check insight (KB S25935) at
the time of the alert to confirm oversubscription or other
error conditions and correct them. If this does not work,
create a diagnostic bundle and contact Support as
described in KB article S22633. Include a screenshot of the
Appliance Health Check insight that shows the relevant
information in your support case.
FSFREE Free space on the appliance disk has dropped below the Minor
Check disks free space safe limit. Note the time when the alert was generated;
then create a diagnostic bundle and contact Support as

Table 6 Software Alerts (Continued)

Level
HSCPKTLSS This alert indicates packet loss between the monitoring Major
Check HSC packet loss interfaces and other analysis modules (Application
Minor
Stream Analysis, Web Transaction Analysis, etc.):
Minor alert = 30% - 50% of all packets are duplicates
Major alert = 50% or more of all packets received are
duplicates.
The system load is probably too high for the appliance to
keep up with input..For more information, see KB entry
S25647.
Packet loss was detected in the packet-capture process
and input to analysis modules. A minor alert is triggered
if the percentage of duplicate packets received is greater
than 30% but lesser than 50% and a major alert is
triggered if the percentage of duplicate packets received
is greater than 50%. Likely the system load is too high for
the system to keep up with input. See KB article S25647
for more details.
MIPMAPCHK The “mipmaps” is an internal process that generates the Major

Check MipMap consistency coarser granularities of data (5-minute, 1-hour, 1-day).
This alert indicates that expected granularities are not
being generated. Check the database as described in KB
article S23862.
NETFLOWDRP NetFlow packets are getting dropped. This alert is Minor

Check NetFlow packet drops generated only if the appliance has a NetFlow Monitoring
Major
Module license and NetFlow data collection is enabled.
Critical
The severity of the alert is based on the percentage of
packets that are getting dropped:
• 1-5% ==> Minor alert
• 5-10% ==> Major alert
• >10% ==> Critical alert
This alert indicates the appliance might be
oversubscribed and/or receiving NetFlow data in a
format that is not supported by AppResponse. View the
Appliance Health Check insight (KB S25935) at the time
of the alert to confirm oversubsription or other error
conditions and correct them.
If the alert persists, create a diagnostic bundle and contact
NETGW To check network connectivity on its management Major

Default route gateway is not reachable. interface, the appliance periodically pings the default
network gateway and generates an alert if the check fails.
Check network connectivity to the default gateway.
NICPKLIM This alert is generated on older appliance models and Critical

Check NIC packet rate limit. indicates that the packets are getting dropped due to
oversubscription. Reduce the traffic load on the
appliance.


Level
NOTIFCHK The notification service is an internal process on the Minor

Check Notification service (channel) appliance. This process is checked periodically for proper
operation. If this error occurs more than once a day, create
a diagnostic bundle and contact Support as described in
KB article S22633.
NOTIFCON The notification service is an internal process on the minor
Check Notification service appliance. This process is checked periodically for proper
(connection) operation. If this error occurs more than once a day, note
the alert time, create a diagnostic bundle, and contact
NTPCON Connection to the Network Time Protocol server (NTP) Minor

NTP synchronization failed. was lost. Confirm that NTP is configured and that the
appliance is connected to the NTP server, as described in
KB article S22394.
RAIDSTATUS Check the RAID status as described in KB article S23365. Major

RAID device is not in an optimal state
SMARTSTATUS Check the RAID status as described in KB article S23365. Major

RAID device is not in an optimal state
SQLCHK The MySQL server failed to complete a request. Note the Major
SQL failed to complete request alert time, create a diagnostic bundle, and contact
SQLCON The MySQL server is down. Note the alert time, create a Major
SQL server down diagnostic bundle, and contact Support as described in
KB article S22633.
SQLRST A MySQL connection was reinitialized. Note the alert Major

SQL connection reinitialized. time, create a diagnostic bundle, and contact Support as
SYSCRASH The appliance generates this alert if it rebooted as a result Critical

System crash occurred, core dumped. of a crash or a power failure. Note the alert time, create a
diagnostic bundle, and contact Support as described in
KB article S22633.
SYSREBOOT An alert is generated if the appliance reboots as a result of Minor

System reboot requested by the user. a user request.


Level
VOIPLICENSE The appliance is monitoring more calls than the Major

VoIP license has been exceeded. maximum limit specified in the installed VoIP Monitoring
Module license. Reduce the number of VoIP calls
monitored by the appliance or increase the license level.
VOIPSLICING The appliance is receiving sliced packets and cannot Major

VoIP Monitoring Module is receiving derive VoIP data for these packets. The most likely causes
sliced packets are:
• The appliance has packet slicing enabled. Check the
Administration > System > Capture > Packet Size
Limit setting.
• Traffic loads on the monitoring interfaces are too high.
View the Appliance Health Check insight (KB
S25935) at the time of the alert to confirm
oversubsription.
WEBCON The appliance checks the internal web server process Major
Check TomCat operability (connect) periodically and generates an alert if it detects any
problems or potential problems. Create a diagnostic
bundle and contact Support as described in KB article
S22633.
WEBGET The appliance checks the internal web server process Major
Check TomCat operability (request) periodically and generates an alert if it detects any
improper operations. Note the time when this alert
occurred, create a diagnostic bundle, and contact Support
as described in KB article S22633.

Unused Alerts
The following alerts are defined in the appliance MIB but are not currently used:
 BypassActive
 ClientIpDrop
 Cpu0RpmTrap
 Cpu0TemperatureTrap
 Cpu0VoltageTrap
 Cpu1RpmTrap
 Cpu1TemperatureTrap
 Cpu1VoltageTrap
 DataAcquisitionStatus
 DomainConfiguration
 DUMMY
 GenericSystemStatus
 HeartBeat
 MCE
 MEMFREE
 PacketDropRate
 PacketErrorRate
 PacketRate
 SampleAlert
 Selftest
 SnmpUpDown
 SystemConnection
 SystemCpuTrap
 SystemDiskTrap
 SystemMemoryTrap
 SystemTrafficTrap
 UnschSystemReboot

Status
The status link shows you the last report that was generated (for information about how and to whom
reports are sent, see “Reports” on page 49).
Figure 16 Diagnostics Tab—Status
The report shown in the status Diagnostic Status window is the last report generated. To manually send this
report:
1) Enter the recipient email in the Send report to dialog box. Multiple addresses are comma-separated.
2) Click Apply.
Log Viewer
The log utility is useful when working with Riverbed technical support to troubleshoot problems.
Related Topics

Halting or Rebooting the Appliance from the Web Interface

The AppResponse Appliance should always be shut down gracefully. Shutting down the appliance using
the power switch may result in data loss. From the web interface Action menu, select Reboot to restart the
appliance, select Shutdown to halt the appliance, or select Configure to force a configuration push to the
appliance after a hard drive replacement or if the appliance configuration is out of sync with the web
interface. These functions can also be performed using the CLI. (See “Halting or Rebooting the Appliance
from the CLI” on page 39.)
Related Topics

Configuring Traffic Filters

It may not be possible to support the estimated traffic rate on all networks. Each network has unique
characteristics, including number of unique IP addresses and number of simultaneous TCP sessions, that
influence the maximum support traffic rate. Using traffic filters, it is possible to disable some features of the
appliance to allow it to support higher traffic rates.
You configure traffic filters on the System > advanced page of the web interface ().
Figure 17 System > Advanced Page
The following traffic filters can be configured through the web interface:
 Network utilization metrics for IP addresses
 TCP metrics for server IP addresses
 TCP metrics for client IP addresses
 All metrics for Business Groups
 Connected IP Address drilldown for Business Groups
 Connected Groups drilldowns for Business Groups
 IP Protocols drill-down for Business Group Links

 Link Members drilldown for Business Group Links

 Application drilldowns
 IP Address to IP Address drilldowns
 Peer AS drilldown for ISPs
 CIDR drilldown for ISPs
 Destination AS groups
 All metrics for ISPs
 Total Traffic group and drilldowns
To increase the maximum traffic rate of the AppResponse Appliance, disable a traffic filter if the data it
collects is not required.
Related Topics

Configuring Network Ports

The network ports used by the AppResponse Appliance can be reassigned using the web interface. Click
the System tab, then click “ports” to access the port configuration page. This page lists the network ports
that are used by internal and external services on the AppResponse Appliance.
Figure 18 System Tab - Ports
Internal services are ports used by the AppResponse Appliance to communicate with itself. The
AppResponse Appliance rejects all external connections to these ports. These ports can not be reassigned
and are listed for informational purposes only.
External services are ports used by external devices to communicate with the AppResponse Appliance. It is
important to ensure that external devices are able to connect to the AppResponse Appliance on these ports.
If your network employs firewalls or access control lists that block access to these ports, either reconfigure
the firewall to allow access or reassign the service to a port that allows access under your security
infrastructure.
Related Topics

Managing Software Licenses

The License Manager is used to enter a license key in order to activate the appliance the first time you load
the Desktop Console, or to upgrade the appliance or add additional features. Features that have not been
activated are not visible to the user.
Figure 19 License Manager
When you purchase a new appliance, an upgrade, or a new feature, you receive an Activation Key from
Riverbed. This Key is needed to create the License Key that loads the level of features appropriate for your
appliance. For more information, see:
 “Licensing a New Appliance” on page 65
 “Adding a License” on page 66
 “Activating an Extended Feature” on page 66
 “Moving Licenses from One Appliance/Director to Another” on page 67
Licensing a New Appliance

The first time you load the Desktop Console, the License Manager dialog opens.
If the AppResponse Appliance has connectivity to the Internet, it automatically connects you to the
AppResponse Product Registration web page, which is already populated with the serial number of the
appliance. Fill out the remainder of the form with the requested information and click Submit to generate
your License Key, which is emailed to the email address you entered in the form.
If the appliance does not have connectivity to the Internet, go to the URL listed in the License Manager to
access the AppResponse Product Registration web page. Enter the serial number of the appliance (listed in
the License Manager), and fill out the remainder of the form with the requested information. Click Submit
to generate your license key, which is emailed to the email address you entered in the form.

Adding a License
To activate a license on an appliance, you must enter the license key in the License Manager (Desktop
Console > Tools > License Manager).
Procedure 12 Adding a License
1. Open an instance of the Desktop Console and connect to the appliance.
The following steps describe how to do this:
1.1. Open the web UI: open a web browser and navigate to the following URL:
http://[appliance-ip-address]:8080
1.2. Click the Console link on the login page.
1.3. Connect to the appliance as a user with Administrator privileges.
2. Choose Tools > License Manager.
If the appliance does not have a product license installed, this window appears automatically when
you connect.
Figure 20 License Manager
3. Enter the license key and click Submit.
A notification window indicates a successful installation.
End of Procedure 12
Activating an Extended Feature
Procedure 13 Activating an Extended Feature
1. On the Tools menu of the Desktop Console, click License Manager. The License Manager displays the
appliance name, serial number, and all configured licenses.

2. If the appliance has connectivity to the Internet, it automatically connects you to the AppResponse
Product Registration web page, which is already populated with the serial number of the appliance.
Fill out the remainder of the form with the requested information and click Submit to generate your
license key, which is emailed to the email address you entered in the form.
3. If the appliance does not have connectivity to the Internet, go to the URL listed in the License Manager
to access the AppResponse Product Registration web page. Enter the serial number of the appliance
(listed in the License Manager), and fill out the remainder of the form with the requested information.
Click Submit to generate your license key, which is emailed to the email address you entered in the
form.
4. Enter the license key in the text area labelled “Enter License Key”.
5. Click the Submit button.
End of Procedure 13
Moving Licenses from One Appliance/Director to Another

In some cases, you might need to move a set of licenses from a source device (appliance/director) to a target
device—for example, if you are upgrading from an old device to a new device, and you have only one set
of licenses.
Procedure 14 Moving Licenses from One Appliance to Another
1. Deregister the licenses on the source device:
1.1. Open the License Manager (Desktop Console > Tools > License Manager).
1.2. Write down or copy the serial number of the device.
1.3. Go to support.riverbed.com and open a support case. Include the serial number and ask Support
to deregister the license for that device.
1.4. Sign the Notice of Permit Deactivation as requested by Support. This form authorizes Riverbed
to de-register the license for the purpose of the move.
1.5. Wait until Support informs you that the licenses for the device have been deregistered. Do not
proceed until you receive notification from Support.
2. Add the licenses on the target device.
2.1. To do this, you need to generate a license key. You can do this yourself: Go to
support.riverbed.com> My Licenses and then follow the link for AppResponse licenses that are
pending activation.
2.2. After you generate a license key, you can add it to the device from the Desktop Console > Tools >
License Manager.
End of Procedure 14

Related Topics

Diagnostics Bundles
Diagnostics bundles contain information required to diagnose AppResponse Appliance internals. If you
contact Riverbed Support to submit an issue, you may be asked to generate and send a diagnostics bundle.
Bundles are created through the CLI and downloaded through the web interface.
Note: Diagnostics bundles can only be created if AppResponse Appliance disk utilization is below 90%.
Creating a Diagnostics Bundle

The CLI command diag-bundle-create is used to create a new diagnostics bundle. The command
requires that you specify a begin and end date. All relevant information logged between the begin and end
date is included in the bundle.
diag-bundle-create <begin_date> <end_date>
e.g., diag-bundle-create 11-Jan-2004 13-Jan-2004
For information about creating a diagnostic bundle from the web interface, see “Bundles” on page 47.
Deleting a Diagnostics Bundle

The CLI command diag-bundle-delete is used to delete an existing diagnostics bundle. The command
requires that you specify the begin and end date of the diagnostics bundle that you wish to delete.
diag-bundle-delete <begin_date> <end_date>
e.g., diag-bundle-delete 11-Jan-2004 13-Jan-2004
Use zero as a begin and end date to delete all existing diagnostics bundles (e.g., diag-bundle-delete 0
0).
A list of existing diagnostics bundle can be seen through the web interface.
Downloading a Diagnostics Bundle

Diagnostics bundles can be downloaded through the AppResponse Appliance web interface at the
following URL:
https://<ace_live_appliance>:8443/admin/bundle.asp
Related Topics

Removing Residual Data from Appliance Disk Drives

To alleviate security concerns, all customer-specific data can be removed from AppResponse appliance disk
drives. This is especially useful when replacing and/or returning hardware.The disk drives in an
AppResponse appliance can be cleared of customer-specific data using the rollback, diskwipe, and
resetData CLI utilities
 “Rollback Utility”—Restores an appliance to its default factory settings.
 “Diskwipe Utility”—Overwrites all unused disk space on one or all disk drives after rollback is
completed.
 “Important Notes”
 “Running DiskWipe in Stand-Alone Mode”
 “ResetData Utility”—Deletes all metric data and captured packets, but retains configuration settings.
Rollback Utility
The Rollback utility restores an AppResponse appliance to its default factory settings. This means that all
customer-specific data is removed from the appliance, including:
 configuration settings
 data from database tables
 logs
 reports and report definitions
Diskwipe Utility
The DiskWipe utility overwrites all unused disk space on the specified disk drives. More specifically, in one
pass, the DiskWipe utility writes zeros to all blocks on the disk drive(s) that have no data. (The DiskWipe
Utility is similar to the dd unix command.)
Note: Because it writes to blocks that have no data, the DiskWipe utility should be run only after the
“Rollback Utility”.
Important Notes
Note the following:
 A rollback operation can take 10 to 20 minutes to complete, depending on the hardware model.
 The Rollback utility does not remove AppResponse software patches. Therefore, you do not need to
re-install software patches after Rollback.

Rollback and Diskwipe Procedure
Procedure 15 Performing a Rollback and Diskwipe
1. Access the appliance CLI (Command Line Interface).
Use one of the following access methods:
• A direct serial connection to the appliance using a terminal emulator, such as hyperterm or with a
keyboard and monitor.
• Through the network, using an SSH client on port 22.
2. Log in to the appliance as an administrator.
The rollback command has the following options:
--noshut
Do not shut down the appliance when rollback is completed. This optional argument is
especially useful when accessing the appliance remotely. When Rollback is complete, you can
re-add the management IP address without losing connectivity to the appliance.
--keeplicense
Do not delete the licenses during rollback. This optional argument is helpful if you want to use
the same licenses after the rollback.
3. Enter the rollback command with the options you want—for example:
rollback --noshut --keeplicense
Note—You must enter two hyphens before each argument.
When the rollback is complete, a CLI prompt asks if you want to run the diskwipe utility. This
utility overwrites all unused disk space on the specified disk drives; specifically, the utility writes
zeros to all blocks on the disk drive(s) that have no data. (This utility is similar to the dd command
in UNIX.)
4. If you choose to run diskwipe,now, enter one of the following commands:
status—displays a list of all appliance disk drives and the DiskWipe status for each disk drive
auto—wipes all available appliance disk drives
wipe—wipes a specified appliance disk drive
stop—stops the wipe operation
cleanup—removes the utilities’ working files from disk drives (typically run after the stop
option)
quit—exists the DiskWipe utility

5. Enter a command from the menu, press return, and follow the prompts.
End of Procedure 15
Running DiskWipe in Stand-Alone Mode

The following procedure describes how to run the “Diskwipe Utility” after you run the “Rollback Utility”.
Because diskwipe writes to blocks that have no data, you should run diskwipe only after you run
rollback.
Procedure 16 Running DiskWipe in Stand-Alone Mode
1. If the rollback command was just run without the --noshut argument and the AppResponse
appliance is currently turned off, then turn on the appliance.
3. Login to the appliance as an administrator.
4. Enter the DiskWipe command:
diskwipe
The DiskWipe utility menu appears.
5. Enter an option from the utility menu, press return, and follow the prompts.
option)
End of Procedure 16

ResetData Utility
The resetData CLI command deletes all traffic data stored on the appliance, while retaining all
user-specified configurations. Situations in which this command can be useful include:
 The appliance was configured incorrectly, resulting in inaccurate data, so you correct the configuration
and delete the data collected using the previous configuration.
 You want to move the appliance to a new location that requires only minor changes to the appliance
configuration, so you reconfigure the appliance and delete all traffic data collected at the old location.
When you run the resetData command from the CLI, the following data is deleted:
 Metric data derived from monitored traffic, such as Application Stream Analysis, Web Transaction
Analysis, NetFlow Monitoring, and VoIP/Video Monitoring
 All packet capture data
 All generated reports
The following data is retained:
 All custom settings in the web UI
 All custom settings in the Desktop Console: Business Group Manager, Defined Application Manager,
Preferred IP Manager, and so on
 All certificate and private key information stored on the appliance (for example, in Administration >
System > System > Administration > Pages)
Note the following:
 The resetData command is case-sensitive: all lowercase except for the uppercase 'D'.
 You must be logged in to the CLI as a user with Administrator privileges to run this command.

Application Stream Analysis (ASA) Configuration
Application Stream Analysis refers to the engine that calculates metric data from traffic observed on the
appliance monitoring interfaces. This section describes the following options for configuring the ASA
engine:
 “ASA Boost”
 “Calculation of Round Trip Times”
 “VXLAN Decoding”
 “Ignore Wire Length When Calculating Sizes for Pre-Sliced Packets”
ASA Boost
Application Stream Analysis Boost (ASA Boost) mode is useful for monitoring traffic in high-throughput
environments such as server farms or data centers.
Note the following:
 This mode is available on certain high-end appliance models only; maximum processing speeds can
vary based on the appliance model and conditions in the production environment.
 You can run ASA Boost at the same time as any of the following features:
– RPM Integration
– Web Transaction Analysis
– NetFlow Data Collection
– Database Performance
– Module for VoIP Performance
– CX-Tracer
 Running ASA Boost together with one or more of these features will add more load to the appliance
and might reduce performance. For example: If you enable ASA Boost at the same time as either Web
Transaction Analysis or Database Performance Monitoring, the peak packet processing rate on the
appliance will be reduced by up to 20%.
 If you want to enable ASA Boost with any of these features, it is good practice to check consumption on
the appliance using the Performance Health Check Insight. You should do this before you enable ASA
Boost and periodically while ASA Boost is enabled.
WARNING—It is important to check consumption in the Performance Health Check insight because,
if the appliance gets overloaded, you could lose data.
To install or update the Performance Health Check insight on your appliance, go to the Update Center
(Desktop Console > Insights > Update Center) and then navigate to the following section:
support.opnet.com/ace_live/insights/support > Tools
 The packet size limit is the maximum number of bytes per captured packet that an appliance saves to
disk. To optimize packet processing at the highest traffic rates, you might need to set the packet size
limit to 128 manually. To change this setting, go to the Web Console > Administration > System >
Capture page.

Procedure 17 To enable ASA Boost:
1. Install the Appliance Health Check insight on your appliance, or (if it is already installed) verify that
you have the latest version installed.
To install or update the Appliance Health Check insight on your appliance, go to the Update Center
(Desktop Console > Insights > Update Center) and then navigate to the following section:
support.opnet.com/ace_live/insights/support > Tools
2. Check the following feature settings and verify that only the features that you want to run at the same
time as ASA Boost are enabled:
• System > Administration web UI > System > Advanced > Collect Netflow Data
• System > Administration web UI > System > Advanced > Collect VoIP Data for Business Groups
• System > Administration web UI > System > Advanced > Collect VoIP Data for Business Groups >
Connected Groups
• Database Performance Module Management Console

(http://<appresponse-xpert-appliance-ip>:2780) > “Manage software instances” page: For the asx
instance, set Run Status to Stop and “Autostart at reboot” to No.
• You can enable and disable Microflow Indexing for RPM Integration in the CLI. (This process is
enabled by default.) Log in to the appliance as Administrator using an SSH-enabled program such
as putty. Then enter the command shark. Then enter one of the following:
• capture_job index enable
• capture_job index disable
3. Run the Appliance Health Check insight and verify that there are no performance issues on the
appliance.
4. Open a CLI window, connect to the appliance, and enter the following command:
ASAmode boost
To disable ASA Boost mode, enter the following CLI command:
ASAmode default
5. After you have enabled ASA Boost, monitor the health of the appliance by running the Appliance
Health Check insight periodically to make sure that no issues have resulted from enabling ASA Boost.
You should check the network’s health at the following times after you enable ASA Boost:
• A peak hour in a business day
• The busiest day in a week
• A typical business week
If these checks detect no performance issues, the appliance can safely run ASA Boost with the current
appliance configuration. If performance issues are detected, you should do one or more of the
following:
• Disable ASA Boost

• Disable one or more of the following processes if they are running at the same time as ASA Boost
(as described in step 2. on page 75):
• Web Transaction Analysis
• NetFlow Monitoring Module
• Database Performance Monitoring
• VoIP Monitoring Module
• RPM Integration (Microflow Indexing)
• Reduce traffic loads so that performance is no longer impacted.
End of Procedure 17
Calculation of Round Trip Times

Release 8.5 introduced a change in the default method for calculating the “Round Trip Time [msec]” metric.
The default method considers only immediate ACKs and ignores delayed ACKs and piggybacked ACKs,
resulting in round trip times that more closely reflect network propagation delay. The difference in round
trip times (compared to previous releases) can be especially apparent for highly chatty applications. The
trade-off of the new method is that you might see no Round Trip Time metrics at all for some highly chatty
applications.
If you want to revert to the old method of calculating round trip times, do the following:
1) Using a SSH-enabled command line program such as putty, log in to the appliance as a user with admin
privileges.
2) Enter the following command in the CLI:

setNgfestats COUNT_ONLY_IMMEDIATE_RTT=0
To switch back to the new method later, enter the following command in the CLI:
setNgfestats COUNT_ONLY_IMMEDIATE_RTT=1
VXLAN Decoding
This release supports decoding of encapsulated Virtual eXtensible LAN (VXLAN) traffic. To enable VXLAN
decoding, log in to the CLI as Administrator and enter the following command:
setNgfestats DECODE_VXLAN_ENCAPSULATION=1
To disable VXLAN decoding, enter:
setNgfestats Ngfestats -d DECODE_VXLAN_ENCAPSULATION
Note: This option is disabled by default. You should enable it only if your network includes VXLAN traffic
that you want to monitor and analyze.

By default, the appliance assumes that the network uses UDP port 8472 to exchange VXLAN-encapsulated
traffic. Enter the following command to specify a different port:
setNgfestats VXLAN_UDP_PORT=[udp_port_#]
Ignore Wire Length When Calculating Sizes for Pre-Sliced Packets

By default, the appliance calculates packet lengths based on the frame sizes it observes “on the wire”—that
is, on the monitoring interfaces of the appliance. If packets are sliced before they arrive at the appliance,
utilization and other metric results might be inaccurate (due to the discrepancy between the original packet
sizes and the truncated frame sizes observed on the wire).
You might want to override this default behavior if packets are sliced before they arrive at the
appliance—for example, by a traffic aggregator or some other external device. You can configure the
appliance to use the IP Length and other header data to estimate the original sizes of observed packets
(regardless of whether the packets were pre-sliced or not).
To enable this “ignore-wire-length” mode, log in to the appliance CLI as Administrator and enter the
following command:
setNgfestats IGNORE_WIRE_LENGTH=1

Password Complexity Support
When password complexity is enabled on the appliance, users will be prompted to choose a new complex
password. The password must have at least one uppercase character, at least one lowercase character, at
least one special character, and should not be easy to guess (dictionary words, palindromes, and so on).
Also, you will be able to specify additional requirements for the passwords, such as:
 A minimum password length
 What types of characters must be used in a password (for example, you can require numbers,
uppercase letters, or special punctuation)
 The number of failed attempts before the account is disabled and the user is locked out.
 How often passwords can be changed (for example, not more often than every 24 hours)
 How often passwords must be changed (for example, a new password is required every 60 days)
 How often a password can be reused
Note that after you have enabled password complexity, all user passwords will have to be changed. Users
will be prompted to change their password the next time the log in to the appliance.
Enable / Configure Password Complexity

To enable and configure password complexity, use the command line interface to log in to the appliance as
an administrator and start the feature editor, as described below.
Procedure 18 Starting the Password Complexity Configuration Editor
1. Open the command line interface for the appliance.
3. Enter pwverify.
Available commands are displayed in the editor. See “pwverify Commands” on page 79.
4. Review or change the password configuration as desired using the enable, disable, review, and
edit commands.
5. When you are satisfied with the configuration changes you have made, enter commit to save your
changes.
6. Enter exit to close the editor.
End of Procedure 18

The following table lists the commands available in pwverify.
Table 7 pwverify Commands

Command Description
enable Enables the password complexity requirements. By default, this feature is turned
off.
disable Disables the password complexity requirements. This is the default behavior.
edit Presents each of the configurable parameters, which you can edit. For a description
of each parameter, see Table 7
review Displays the current configuration so that you can view the value of each
parameter.
commit Saves the changes that you have made to the configuration.
exit Closes the editor. Note that changes are not automatically saved on exit, to save
changes, use the commit command.
The following table lists the parameters that you can configure to specify the requirements for new
passwords.
Table 8 pwverify Parameters

Parameter Default Value Description
ENABLED no Turns the password complexity feature on or off. This

feature is turned off by default.
OBSCURE_CHECKS_ENAB yes Verifies that the password is not a palindrome or too

similar to previous passwords. Although configurable,
this value should always be “yes.”
PASS_CHANGE_TRIES 3 When choosing a new password, the user only has this
number of attempts to choose a valid password. If the
user does not specify an valid password within the
specified number of attempts, the session terminates and
the user will have to start the password change operation
again.
PASS_MIN_DAYS -1 The minimum period of time (in days) between

password changes. After changing their password, the
user will have to wait this period of time before changing
their password again. A value of -1 turns this feature off
and means that a user can change their password as often
as they wish.
PASS_MAX_DAYS -1 The maximum period of time (in days) between

password changes. After this period of time, the user
must choose a new password or they will bot be allowed
to log in. A value of -1 disables this feature and means
that passwords do not expire.
PASS_MAX_LEN 16 The maximum length of a password.
PASS_MIN_LEN 6 The minimum length of a password.

Table 8 pwverify Parameters
Parameter Default Value Description
PASS_WARN_DAYS -1 Specifies how much advanced warning is provided to

users when their password is about to expire. Setting this
value to 5 would warn users each time they tried to log in
within 5 days of the expiry of their password. A value of
-1 disables this feature and means that no advanced
warning will be displayed to notify users that their
passwords are about to expire.
PASS_HISTORY -1 This specifies how often users can reuse a password. A

value of 5 means that the previous 5 passwords are saved
and the user will not be allowed to use any of these
passwords when specifying a new password. A value of
-1 disables this feature.
PASS_LOCK_LIMIT -1 This is the number of times that a user can enter an

incorrect password before their account is locked. When
locked out, a user will not be able to log back in until the
account is unlocked by an administrator. This feature
does not apply to administrator accounts. A value of -1
disables this feature. See Procedure 21 for instructions on
how to unlock an account.
PASS_ALWAYS_WARN yes When this feature is turned on, the user is always notified
about the upcoming password expiration date.
Change a Password
An administrator can change a user password using the alpasswd command.
Procedure 19 To Change a Password
1. Open the command line interface.
2. At the prompt, enter:

alpasswd username current-password new-password
Note: The current-password field is optional for Administrators and required for non-Administrators.
End of Procedure 19

Lock a User Account
An administrator can lock the account of any non-administrative and non-root user using the
alpasswd_lock command.
Procedure 20 To Lock a User Account

alpasswd_lock user lock
where user is the username on the account.
End of Procedure 20
Procedure 21 To Unlock a User Account

alpasswd_lock user unlock
where user is the username on the account.
End of Procedure 21

IPv6 Support
AppResponse now supports monitoring and analysis in IPv6 environments. This section describes how to
configure an AppResponse appliance to monitor IPv6 networks and how to verify that the IPv6 feature is
functioning correctly.
Topics Covered:
 “How to Set Up IPv6 on an Appliance” on page 83
– “Verify Appliance Performance” on page 83
– “Enable IPv6 on the Appliance” on page 83
– “Verify Appliance Health with IPv6 Enabled” on page 85
 “What You Need to Know About IPv6 Support in AppResponse” on page 86

How to Set Up IPv6 on an Appliance
Do the following:
1) “Verify Appliance Performance” on page 83
2) “Enable IPv6 on the Appliance” on page 83
3) “Verify Appliance Health with IPv6 Enabled” on page 85
Verify Appliance Performance

Before you enable IPv6 monitoring on an appliance that is already monitoring an IPv4 network, you should
make sure that the appliance can handle the extra performance requirements needed to support IPv6
monitoring and analysis. You can correct any issues that might be present before you enable IPv6 on the
appliance. You can check the health of an appliance by running the Appliance Health Check insight. If you
have the Netflow Health Check insight, you can run that instead.
If the insights report that the appliance is running smoothly, enable IPv6 on the appliance.
If the insight reports that there is one or more performance problems (indicated in red), resolve the issues
before you enable IPv6.
Enable IPv6 on the Appliance

Before you can use the IPv6 features of AppResponse, you must first enable IPv6 support on the appliances
that will be monitoring the IPv6 network.
Procedure 22 Enabling IPv6 Support on the Appliance
1. Open the Web Console.

Note: These steps can be done in the Web Console only.
2. Expand Administration and click System.
3. Expand System and click Advanced.
4. Under Advanced Data Collection Options, click the Enable IPv6 checkbox to select it.
5. Click Apply to save the configuration then OK in the confirmation dialog box.
After the server restarts, the appliance will be able to collect and view IPv6 information.

Figure 21 Enable IPv6 Checkbox
You can follow these links to specify additional IPv6

configuration information for the appliance.
System Configuration lets you configure DHCP for IPv6 and
specify a DNS server that supports IPv6.
6. Enable DNS support for IPv6. This step is optional, but highly recommended. If DNS is not enabled or
does not support IPv6, you will see only IPv6 addresses in the output tables and charts. If you enable
DNS, the information column in the output tables and charts will instead show the hostnames, which
are much more readable and easier to work with.
6.1. Return to the System > Advanced > Advanced Data Collection Options.
6.2. Click on the System Configuration link.
6.3. Under DNS Configuration, specify the name of a DNS server that supports IPv6.
6.4. Click Apply to save changes.
Figure 22 Enabling DNS Support for IPv6
Specify a DNS server that supports

IPv6 here.
End of Procedure 22

Verify Appliance Health with IPv6 Enabled
After you have enabled IPv6 on the appliance, monitor the health of the appliance by running the Appliance
Health Check insight periodically to make sure that no issues have resulted from enabling IPv6. You should
check the network’s health at the following times after you enable IPv6 support:
 a peak hour in a business day
 the busiest day in a week
 a typical business week
If these checks detect no performance issues, the appliance can safely monitor IPv6 environments. If
performance issues are detected, the appliance is unable to support IPv6 monitoring with the current traffic
load. You can either disable IPv6 or reduce traffic loads so that performance is no longer impacted.
Related Topics
 “What You Need to Know About IPv6 Support in AppResponse”
 “Viewing IPv6 Information” (search the User Guide or the online help)

What You Need to Know About IPv6 Support in AppResponse
You should consider the following implementation details when using AppResponse in IPv6 environments:
 Dual-stack environment for the management port
You can add an IPv6 address to the management port so that the management port is configured with
the IPv6 address and an IPv4 address. In other words, a dual-stack environment is required in order to
add an IPv6 address to the management port. You can configure this IPv6 management port on the
System / Setup page.
 DHCP support
Support for DHCP (IPv4 and/or IPv6) is included in this release. You can configure this setting on the
System / Setup page. Note that if you enable DHCP, you must also enable dynamic DNS.
 DNS server support
Support for DNS servers with IPv6 addresses. You can configure this setting on the System / Setup
page.
 Management through Director over IPv4 only
Appliances that have IPv6 enabled cannot be added to a Director’s domain through the IPv6
management interface. All appliances must be added to the Director’s domain by specifying their IPv4
management interface.
IPv6 is not supported for the following features:
 Defined web apps and Web Transaction Analysis
 Web Dashboards
 VoIP
 SteelCentral™ AppSensor, SteelCentral™ AppSQL, SteelCentral™ AppMapper, and the
SteelCentral™ NetShark module
 BGP
 Destination AS numbers
 Auto-traceroute and topology to IPv6
 Sendmail configuration
 Prefix/24 or Dest AS table
 NetFlow on the IPv6 management interface. Support for NetFlow monitoring of IPv6 traffic is limited
to IPv6 flows embedded in NetFlow records received over the IPv4 management interface.
 RPM Dashboards over IPv6
– If the appliance is running in dual-stack mode, you must use the IPv4 address when adding the
appliance as a data source to RPM Dashboards.
– Release 2.3 PL1 or later of RPM Web Dashboards includes support for the IPv6 features in
AppResponse. Earlier versions will not display IPv6 information.
 Import to AppMapper. When you import traffic data from AppResponse into AppMapper, only IPv4
traffic data is included—the IPv6 traffic is filtered out.
 SNMP polling
 Backup and recovery. Backup and recovery requires an IPv4 server.

 Fast recovery must be done using the IPv4 address of the appliance.
Related Topics
 “How to Set Up IPv6 on an Appliance”
 “Viewing IPv6 Information” (search the User Guide or the online help)

CHAPTER 2 Installing the Appliance
The Installation Guide provides all the information required to install an appliance within your network.
This chapter includes the following topics:
 “Pre-installation Information”
 “Installing the Appliance”
 “Configuring the Appliance”
 “Updating the Software”
 “Safety Warnings”
Instructions for setting up the Desktop Console are in “Installing the Desktop Console” on page 11 (search
the User Guide or the online help).
Installing the Appliance
Pre-installation Information
The following sections provide information that should be reviewed prior to installing the AppResponse
appliance.
AppResponse Appliance Overview

The AppResponse appliance is a rackmount system that installs in your data center (Figure 23). The
AppResponse appliance does not require changes to your content or application servers, IT infrastructure,
overlay network or cooperation from downstream elements, client side applications, or special protocols.
The AppResponse appliance is a passive data collection device that is attached to the target network using
a span port or a copper/fiber tap.
Figure 23 A Typical AppResponse Appliance Installation

AppResponse Appliance Models

Available AppResponse appliance models include the following:
 AppResponse-6000—5U rackmount system that supports up to two fiber (10GbE enhanced Small
Form-factor Pluggable (SFP+)) Ethernet monitoring interfaces.
 AppResponse-5100—4U rackmount system that supports up to two fiber (10GbE enhanced Small
Form-factor Pluggable (SFP+)) Ethernet monitoring interfaces.
 AppResponse-5000—4U rackmount system that supports up to two fiber (10GbE XFP SR/LR) Ethernet
monitoring interfaces.
 AppResponse-4300—4U rackmount system that supports up to four Small Form-factor Pluggable
(SFP) copper or fiber (1GbE) Ethernet monitoring interfaces.
 AppResponse-2200—1U rackmount system that supports up to three Small Form-factor Pluggable
(SFP) copper and one copper (10/100/1000 Mbps) Ethernet monitoring interfaces.
 AppResponse-2100—1U rackmount system that supports up to two copper (10/100/1000 Mbps) or
fiber (1 Gbps) Ethernet monitoring interfaces.
 AppResponse-1200—1U rackmount system that supports up to three Small Form-factor Pluggable
(SFP) copper and one copper (10/100/1000 Mbps) Ethernet monitoring interfaces.
Note: SFPs and XFPs are hot-swappable, so you do not need to power down the appliance before you add
or switch an SFP or XFP.
Instead of referring to specific models numbers, the rest of this manual only uses the term AppResponse
appliance to refer to all models except where explicitly noted.
Physical Configurations
The AppResponse appliance can be connected to the network using either a span port or a copper/fiber tap.
The manner in which the appliance is connected to the network is referred to as the physical configuration.
In many network configurations, the AppResponse appliance is attached to a span port on a layer 3 switch.
The AppResponse appliance has two monitoring interfaces and can be attached to one or two span ports.
During the installation process, the user must configure the number of span ports connected to the
AppResponse appliance (see “Step 4: Completing Setup using the Administration > System Web Interface”
on page 131). The span port is normally configured to send both inbound and outbound packets to the
AppResponse appliance so that both directions of network communication are monitored.

A copper/fiber tap can be used to connect the AppResponse appliance if a span port is not available at the
desired location in the network. Copper/fiber taps are installed inline directly within the target network.
As a result, the physical connectivity of the target link must be temporarily interrupted while the tap is
installed. The AppResponse appliance attaches directly to the tap. Unlike a span port, the tap does not
require reconfiguration of a switch.

Internal Addresses List

For most groups, an appliance can rely on packet data to determine the direction of traffic flows (“Inbound
/ Outbound”) and the roles played by specific IPs and groups (“Client”, “Server”, “TCP Client”, “TCP
Server”). For some group types, however, you must specify the range of Internal IPs for the appliance to
determine flow directions and IP roles.
By default, the Internal Addresses List includes all private IPs that are visible to the appliance (10.0.0.0/8,
172.16.0.0/12, 192.168.0.0/16). To view or edit this list, go to Administration > System > Setup >
Internal Addresses.
Best Practice: Include All Server IPs in the Internal Addresses List
It is best practice to verify that all server IPs for all Defined Applications are included in the Internal Addresses
list. This is necessary to ensure that the directions and roles of all metrics are interpreted correctly. If a server
IP is not included in this list, the directions and roles for some metrics might be the opposite of what you
expect.
 “Groups Affected by the Internal Addresses List”
 “How to Set the Internal Addresses List”
 “Example: What Can Happen when a Server IP is not in the Internal Addresses List”
Groups Affected by the Internal Addresses List

An appliance uses the Internal Addresses list when it calculates metrics for the following groups:
 Application
 Total Traffic
 VLAN
 Mon Interface Group
(if Administration > System > Interface Groups > [group] > “Traffic relative to” option is set to Internal
Addresseses)
How to Set the Internal Addresses List

To set the Internal Addresses list, do the following:
1) Open the Defined Application Manager (Desktop Console > Tools > Applications >
Defined Application Manager).
2) Click the Server tab.
3) Starting at the top of the Applications table, copy/paste all of the Server IPs into a text file. Press the
Down key to iterate through all entries. (Defined applications of type Standard do not have a Server IPs
field.)
4) In the Web Console, go to Administration > System > Setup > Internal Addresses.
5) Iterate through your list of Server IPs and verify that each server IP is included in the Internal Addresses
list. If a server IP is not included in an address range or subnet, redefine or add a range to include this
server IP.

WARNING—Keep the number of comma-separated items in the Internal Addresses List as small as
possible
When the appliance calculates metrics in real time, it checks monitored packets against each
comma-separated item (IP or IP range) in the Internal Addresses list. A long or complex list can increase
computation loads and affect monitoring performance on the appliance.
To keep the Internal Addresses List as simple as possible, it is good practice to
 Include no more than 15 comma-separated entries in the list. (The list cannot include more than 50
comma-separated entries.)
 Specify IP address ranges, rather than individual IPs, whenever possible.
Example: What Can Happen when a Server IP is not in the Internal Addresses List
An appliance monitors the application MyExtApp. The clients for MyExtApp are included in the Internal
Addresses list, but not the servers (Figure 24). If you open an Applications table, you will see that the
metrics for MyExtApp appear in the reverse role from what is expected.
 The Internal and External IPs are reversed: the MyExtApp servers are External IPs, the clients are
Internal IPs, and the metrics are shown in relation to the clients.
An in-depth application analysis usually starts from the perspective of the servers and then moves
outward to the clients.
 The role of clients and servers are reversed: MyExtApp metrics appear as "[metric] (Clients)"
rather than "[metric] (Servers)".
 The throughput directions are reversed: for example, "Throughput (Inbound)" measures traffic to
the MyExtApp clients, not the servers.

Figure 24 Server IPs Not Included in Internal Addresses List

By editing the Internal Addresses list to include the servers for MyExtApp, you ensure that the MyExtMap
metrics identify the roles (Clients, Servers) and directions (Inbound, Outbound) correctly.
Figure 25 Server IPs Included in Internal Addresses List
Single Span Port

If the AppResponse appliance is attached to only one span port, the user must select the single span port
physical configuration during system configuration as described in “Step 4: Completing Setup using the
Administration > System Web Interface” on page 131.
Dual Span Port
Note: In dual span port mode, the monitoring interfaces used must be of the same type (copper or fiber).
If the AppResponse appliance is attached to two span ports, the user must select the dual span port physical
configuration during system configuration as described in “Step 4: Completing Setup using the
Administration > System Web Interface” on page 131.

Copper/Fiber Tap
With a copper or fiber tap, the user must select the copper or fiber tap Monitoring Interface(s) Speed/Duplex
Setting during system configuration as described in “Step 4: Completing Setup using the Administration >
System Web Interface” on page 131. In this configuration, traffic direction is not ambiguous since the
AppResponse appliance receives outbound and inbound packets through different monitoring interfaces.
As a result, the internal Addresses list does not need to be specified.
The following taps, supplied by Netoptics, have been qualified for use with AppResponse equipment.
Other equivalent devices should work as well:
 NETOPTICS P/N: 96042-G-30: SX Gigabit Splitter Module, Multimode 62.5/125um, 70:30 split (for
optical Ethernet)
 NETOPTICS P/N NET-96135-RM: 100BaseT TX Tap (for copper Ethernet)
Network Placement Considerations

Many factors must be considered when choosing where to install the AppResponse appliance within your
network. In fact, identifying a target location may be the most difficult part of setting up the appliance. Take
the following items in consideration when choosing the target location.
Network Coverage
The location of the AppResponse appliance dictates the traffic the appliance is able to monitor. In general,
the appliance is placed at a location of network aggregation to maximize the monitored traffic. This often
means that the appliance is installed near a border/edge router. Select a network location that allows the
AppResponse appliance to monitor complete network sessions, or install the appliance in a dual span port
mode and monitor both network paths.
Span Port Physical Configuration

If using the span port physical configuration, the appliance must be attached directly to a device, typically
a switch, supporting this feature. Each network equipment vendor implements the span port feature
differently, resulting in different capabilities and limitations. However, all major vendors support basic
span port functionality.
Traffic Volume
Select a network location that does not exceed the maximum traffic rate supported by the AppResponse
appliance. If this level is exceeded, a fraction of the packets are dropped by the appliance. This reduces the
accuracy of collected metrics, but does not affect the network.
Traffic Symmetry
Asymmetric traffic occurs when traffic can take a different route between endpoints in the incoming and
outgoing directions. This condition often exists within networks with redundant paths. However, the
AppResponse appliance cannot monitor traffic accurately if it is unable to monitor complete network
sessions. Under asymmetric conditions a number of traffic metrics collected by the appliance are not
measured accurately. Select a network location that allows the AppResponse appliance to monitor complete
network sessions.

Modified Frame Formats

The AppResponse appliance supports frames from VLANs in 802.1Q format.
The AppResponse appliance does not support frames in ISL format.
Ethernet jumbo frames are supported on the following appliance models only:
 AppResponse-3200
For more information, contact Riverbed Technical Support.
Select a network location that does not include unsupported frame formats.
Encryption, Tunneling and Encapsulation

The AppResponse appliance collects metrics by extracting information from standard TCP/IP headers.
Many network technologies modify the header format through encryption or introduction of additional
encapsulation headers. Non-standard header formats affect the metrics collected by the AppResponse
appliance. The following sections discuss technologies that obscure standard headers at various layers of
the OSI protocol stack.
Layer 3 Header Obscurity (MPLS, PPPoE, etc.)

These protocols insert an additional header before OSI layer 3 (Network Layer - IP protocol). As a result,
the headers of the IP protocol (layer 3) and all layers above are not recognized by the AppResponse
appliance. Traffic of this type is not recorded. Select a network location that reduces or eliminates traffic of
this type.
Layer 4 Header Obscurity (IPSEC, GRE, PPTP, GTP, etc.)

These protocols insert an additional header before OSI layer 4 (Transport Layer - TCP/UDP protocol). As a
result, the layer 4 protocol is not recognized. The AppResponse appliance is only able to identify the source,
destination and utilization (bytes sent and received) for these protocol.
Obscurity Above Layer 4 (SSL, TLS, SHTTP, etc.)

These protocols encrypt data above the transport layer and do not impact data collected by the
AppResponse appliance.

Network Address Translation

The AppResponse appliance identifies the source and destination for each packet based on the addresses in
the IP header. Network address translation, a procedure common in firewalls, load balancers and proxies,
replaces the original address with the IP address of an intermediary device. As a result, all network sessions
appear to originate from the network address translation device rather than the actual originating device.
If this is a concern, select a network location before network address translation occurs.
Security
The AppResponse appliance monitoring interfaces operate in promiscuous mode. These interfaces are only
used to record traffic. The interfaces cannot send traffic, nor are they assigned an IP address. It is safe to
connect these interfaces to a network segment outside a firewall.
The management interface of the AppResponse appliance is used for general purpose communications and
should be connected to a network segment protected against direct access from the outside world.
Additional Information
The following sections provides addition background information on AppResponse appliance
configuration and behavior.
BGP and the AppResponse Appliance

Configuring the AppResponse appliance to be a BGP peer is optional. If this configuration is not completed,
the ISP AS, Peer AS and Dest CIDR groups are not available within the AppResponse Console. Similarly,
the Trans-ISP Round Trip Time and ISP Peering Point Round Trip Time metrics are meaningless.
The AppResponse appliance can use BGP information to enhance the data it collects. BGP information is
used to determine which service providers are used to reach a particular destination IP address. This
information is accessible in the AppResponse Console through the ISP AS, Peer AS, and CIDR groups,.
In order to collect BGP information, the AppResponse appliance must become a passive peer in the existing
BGP mesh. Typically the appliance is set up as a passive BGP peer to one of the border routers. You can find
these parameters on the Administration > System > Setup page. Contact Riverbed for examples of
configuring the AppResponse appliance within a typical network.
Firewall Configuration
The AppResponse appliance uses a variety of ports for network communications. The following sections
describe the forms of network communication between the AppResponse appliance and other devices.
Ensure that there are no firewalls or access control lists blocking access to the network ports used by the
appliance.
Internal and External Services

External services are ports used by external devices to communicate with the AppResponse appliance.
Ensure that external devices are able to connect to the AppResponse appliance on these ports. The port
numbers for these external services can be reassigned in the security section of the web interface

The following table lists the external services and the authorization controls used to restrict access to these
ports.
Table 9 External Services and Authorization Controls

External Transport Authorization Description
Service and Port
SNMP UDP 161 Open. The default The SNMP service provides read-only access to the
SNMP community AppResponse SNMP MIB. The appliance supports
string can be only SNMP GET access, it cannot be configured
changed through through SNMP. Riverbed recommends using an
the external security mechanism (e.g. firewall, ACLs) to
Administration > protect this port from undesired access.
System web Alternatively, the SNMP service can be disabled
interface. through the Administration > System web interface.
HTTP TCP 8080 Open. The Administration > System web interface is
accessed using the HTTP and HTTPS services.
Access is not restricted by IP address. A valid user
with a password can log into the web interface from
any IP address. Use an external security mechanism
to restrict access if desired.
When the web interface connection is received using
the HTTP protocol, it transparently redirects the
session to use HTTPS. Depending on desktop
security settings, The browser immediately presents
the user with a Certificate Verification dialog. This
occurs because the AppResponse appliance sends a
self-signed certificate that the browsers cannot verify
against an external certificate authority.
HTTPS TCP 8443 Password See HTTP service.

required.
BGP TCP 179 Password required The BGP service establishes a peer session with an
and access external BGP speaker.
(not applicable to
restricted to the IP
the Domain
address of the BGP
Director)
peer configured in
the web interface.
This port shows up
on scans, but
connections from
IP addresses other
than the BGP peer
are rejected by the
BGP application.z

Table 9 External Services and Authorization Controls (Continued)

External Transport Authorization Description
Service and Port
BGP-VTY (not TCP 3605 Password required The BGP-VTY service is used by the appliance to
applicable to the and access manage the BGP service.
Domain Director) restricted to the IP
address of the BGP
peer configured in
the
Administration >
web interface. This
port shows up on
scans, but
connections from
IP addresses other
than the BGP peer
are rejected by the
BGP-VTY
application.
SSH 1 TCP 22 Password The SSH service is used for a variety of

required. communications:
Provide remote access to the appliance command
line interface
All communication between the AppResponse
Console and the appliance
1
NTP UDP 123 Open. The NTP service is used to synchronize the
AppResponse appliance clock with an external time
source.
Netflow UDP 9996 Open. The port on which the AppResponse appliance
(inbound) receives Netflow packets from enabled routers and
switches.
AppTransaction TCP 27401 Open The port that the op_capture_server service uses to
Capture Manager communicate with the AppTransaction Capture
Manager running on a remote device.
1.The port number for this service cannot be changed.
Internal services are ports used by the AppResponse appliance for interprocess communication. The
following table lists the internal services and the authorization controls used to restrict access to these ports.
Table 10 Internal Services and Authorization Controls

Internal Transport Authorization Description
Service and Port
NPlog TCP 4999 Access is restricted to the The NPlog service is used to aggregate log messages
IP address of the (e.g. status information, errors) from all the appliance
AppResponse appliance. processes.
MySQL TCP 3306 Password required. Access The MySQL service provides access to the internal
is restricted to the IP MySQL database.
address of the
AppResponse appliance.

Traceroute (not applicable to the Domain Director)

The AppResponse appliance can be configured to run traceroutes to selected IP addresses manually or
automatically. These traceroutes can either use TCP or ICMP packets. To permit this operation, which is
necessary for the topology tool and other functions, firewalls must be configured to allow the following:
 Inbound (AppResponse appliance is the destination)
– ICMP mode
ICMP time-exceeded, unreachable, and echo-reply must pass
– TCP mode
ICMP time-exceeded and unreachable must pass
TCP RST must pass, with destination port 80 and source ports between 3200 and 63999
If TCP state information is being stored in the firewall, then the RST must be allowed to pass even
though no connection initiation has occurred (“three-way handshake”)
 Outbound (AppResponse appliance is the source)
– ICMP mode
ICMP echo-request must pass
– TCP mode
TCP SYN must pass, with source port 80 and destination ports between 3200 and 63999
If TCP state information is being stored in the firewall, then connection initiation must be allowed
from the AppResponse appliance side.

Installation Preparation Sheet

Use the following preparation sheet to collect required configuration information before starting the
installation. Riverbed recommends that you print a copy of this page, write down all required information,
and retain the hardcopy for future reference.
Table 11 Installation Preparation Sheet

Hostname
Note—The hostname assigned to the
AppResponse appliance should be
added to the DNS servers.
Domain Name
IP Address
Netmask
Default Router Address (aka

gateway)
DNS Server Address(es)
NTP Server Address(es)

Note—This configuration parameter is
optional, but strongly recommended.
See “Quitting the Web Interface” on
page 134 for more information on using
public NTP servers.
Peer Router Name 1
Peer Router IP Address 1
Appliance AS Number 1
Peer Router AS Number 1
Last Internal AS Number 1
1.The AppResponse appliance establishes a BGP peering session with a border router in order to learn the BGP route
table. This information is used to construct the ISP AS, Peer AS and Dest AS groups. These parameters are optional.


After you’ve determined the appropriate location in your network for the AppResponse appliance
installation, follow the steps to perform physical installation, wiring and configuration of the appliance
(these steps are outlined in “Installing an AppResponse Appliance: Workflow Description” on page 124). It
is recommended that you read through the installation instructions prior to beginning installation and
again while performing installation.
AppResponse Appliance Material Inventory

Before physically installing and wiring the AppResponse appliance, examine the appliance back panel and
the items shipped with the appliance to familiarize yourself with the system. The following sections walk
you through wiring of the appliance’s power, serial port, management network interface and monitoring
network interfaces. The management interface is used for general purpose communication and must be
connected to a network segment that allows it to communicate with end-user desktop machines. The
monitoring interfaces are used to collect data passively and must be connected to a span port or
copper/fiber tap.
Note: Do not discard the original shipping carton or packing materials. They are required for all returns and
exchanges or the warranty is void.
For the directory material inventory, see “Director Material Inventory” on page 698.

AppResponse-1200 Appliance
The following figure shows the back panel of an AppResponse-1200 appliance. For more information, see
“Back Panel Ports” on page 120.
Figure 26 Back Panel of AppResponse-1200

Monitoring interface ports:
4 N/A 3 2 1
serial port serial port

video port



Monitoring interface ports:
4 N/ 3 2 1
serial port management port

video port

The following figure shows the back panel of an AppResponse-3200 and AppResponse-3700 appliance. For
more information, see “Back Panel Ports” on page 120.

port #4
port #3
port #2
port #1
serial port monitoring

management port power
VGA port
USB ports


monitoring ports: port #4
port #3
port #2
port #1
management VGA port serial port

power supply units port

The following figure shows the back panel of an AppResponse-3200 and AppResponse-3700 appliance. For
more information, see “Back Panel Ports” on page 120.

port #4
port #3
port #2
port #1
serial port management port monitoring power

VGA port
USB ports


monitoring ports: port #4
port #3
port #2
port #1
management serial port

VGA port
power supply units port

port #1
power serial port VGA monitoring
USB port #2 ports
port
ports port #3
management port
port #4

expansion port #1
power serial port monitoring
chassis port port #2 ports
VGA port port #3
management port port #4

serial VGA port #1

power
port port port #2
management port USB ports Monitoring interfaces:

two (2) 10-Gigabit Ethernet ports

serial port port #1

power
port #2
VGA port
expansion Monitoring interfaces:
management port
chassis port two (2) 10-Gigabit Ethernet ports


monitoring interfaces:
Management Connect ground Ports for expansion chassis: two (2) 10-Gigabit SFP+ ports
port (left) wire here Controller 2 (left) Controller 1 (right)
port #1 port #2
Serial port
VGA port
USB port
Note: You must provide a permanent ground before connecting to the mains, with a ground conductor
(usually green colored wire), minimum 18AWG size conductor, copper conductor only.

AppResponse-4100-S16 Expansion Chassis

The following figure shows the back panel of an AppResponse-4100-S16 Expansion Chassis. For more
information, see Procedure 37 “Connecting the Appliance to One or More Expansion Chassis” on page 193.
Figure 38 AppResponse-4100-S16 Expansion Chassis Back Panel
SAS Port A- top

SAS Port B - bottom

AppResponse Expansion Chassis 200

The following figure shows the back panel of an AppResponse Expansion Chassis 200. For more
Figure 39 AppResponse Expansion Chassis 200 Back Panel
SAS Expansion ports
SAS Port A- left SAS Port B - right

(In from appliance or previous Expansion (Out to next Expansion Chassis)

AppResponse Expansion Chassis 300

The following figure shows the back panel of an AppResponse Expansion Chassis 300. For more
Figure 40 AppResponse Expansion Chassis 300 Back Panel
Connect top port to Connect bottom port to

Controller 2 (Left) on 6000 appliance • Controller 1 (Right) on 6000 appliance
• Expansion Chassis port on 5100 appliance
• Expansion Chassis port on 4300 appliance

Back Panel Ports

The AppResponse appliance back panel includes the following ports:
 AC power—For more information, see the specifications sheet for your specific appliance.
 Serial port—RJ45 or DB-9
 Management Interface—RJ45 1Gb Ethernet
 1 Monitoring interface—RJ45 (copper) 10/100/1000 Mbps Ethernet (included for 2200)
 2 Monitoring interfaces—RJ45 (copper) Gigabit Ethernet (included for 2100)
 2 Monitoring interfaces—LC (fiber) Gigabit Ethernet (included for 2100)
 3 Monitoring interfaces—SFP modules allowing copper or fiber 1Gigabit Ethernet (included for 2200)
 4 Monitoring interfaces—SFP modules allowing copper or fiber 1Gigabit Ethernet (included for 3200,
3300, 3700, 3800, 4200, and 4300)
 2 Monitoring interfaces—XFP modules allowing SR or LR 10Gigabit Ethernet (included for 5000)
 2 Monitoring interfaces—SFP+ modules allowing SR or LR 10Gigabit Ethernet (included for 5100 and
6000)
 SVGA video port (to optionally connect a monitor)
 Keyboard port to optionally connect a keyboard. Included on older appliance models only. (For newer
appliances, connect to the appliance using the CLI, as described in “Using the Command Line

Front Panel Ports

The following diagrams show the buttons and LEDs on the AppResponse appliance front panel:
Figure 41 AppResponse Appliance Front Panel
The AppResponse appliance front panel includes the following ports:

 A: RJ45 NIC activity LED (see B on back panel)
 B: RJ45 NIC activity LED (see H on back panel)
 C: Power/sleep button
 D: Power/sleep LED
 E: Hard drive status LED
 F: System status LED
 G: ID LED
 H: ID button
 I: Reset button
 J: USB connector
 K: Nonmaskable Interrupt (NMI) button
 L: SVGA video port (to optionally connect a monitor)

Figure 42 Front Panel - 4200 / 4300 / 5000 / 5100
Power Switch
HDD Tray Activity LED LAN1 & LAN2 LED
USB 2.0 Port
Failure LED
System Reset Power LED
Button System HDD Activity LED
Alarm Mute
Figure 43 Front Panel - 6000
HDD Tray Activity LED Power switch
Power LED
USB 2.0 Port

System HDD
LAN 2 (top)
LAN 1 (bottom)
Fan light shows PSU status (if light is red,
Alarm Mute one of the PSUs are not plugged in
System Reset Button

Additional Items
The following items are included in the shipping carton for an AppResponse appliance:
 Appliance and front bezel
 AC power cords. The number of cords differs depending on the appliance model:
– 1 cord (1200 and 2200 appliances)
– 2 cords (3200, 3300, 3700, 3800, 4300, and 5100 appliances; 200 and 300 directors)
– 3 cords (4200 and 5000 appliances)
– 4 cords (6000 appliances)
 4 1GbE SFP modules (3200, 3300, 3700, 3800, 4200, and 4300 appliances)
 2 10GbE XFP modules (5000 appliances)
 2 10GbE SFP+ modules (5100 and 6000 appliances)
 Serial cable: DB-9 (female)<–>RJ45 or DB-9<–>DB-9
 Rack mount assembly kit and instructions
 Warranty paperwork and license

Installing an AppResponse Appliance: Workflow Description

The following workflow provides a general outline of the tasks required to wire, install and configure the
AppResponse appliance. Each step refers to a procedure detailed in the following pages.
1) Rackmount and Wire

Rackmount the appliance and wire the electrical, serial port and management network interface as
described in “Step 1: Rackmount and Wire the AppResponse Appliance” on page 125.
2) Physical Configuration
Wire the appliance’s monitoring interfaces using one of the following procedures depending on the
appropriate physical configuration for the network.
a) Single Span Port or Dual Span Port:
Complete the steps described in “Span Port Physical Configuration” on page 97
b) Copper or Fiber Tap:
Complete the steps described in “Step 2b: Wiring for Copper/Fiber Tap Physical Configuration” on
page 127.
3) Initial setup
Use the command line interface to perform initial configuration of the AppResponse appliance, as
described in “Step 3: Initial Setup using the CLI” on page 129.
4) Complete setup
Use the Administration > System web interface to complete the AppResponse appliance configuration
“Step 4: Completing Setup using the Administration > System Web Interface” on page 131
After this procedure is complete, AppResponse appliance configuration is finished. Install the
AppResponse Console on a desktop machine to access data collected by the appliance.

Step 1: Rackmount and Wire the AppResponse Appliance
Procedure 23 Rackmounting and Wiring the AppResponse Appliance
1. Rackmount the AppResponse appliance at a location near the switch on which the span port (or span
ports) is configured. Follow the rack mount instructions listed in the rack kit installation guide. This
document can be found in the small materials box that ships in the main AppResponse appliance
shipping carton.
2. Connect the female plug of the supplied AC power cord to the AC input port on the back of the
AppResponse appliance next to the power-supply fan, and then connect the male plug of the power
cord to a conditioned power outlet. If there are redundant power supplies, plug every cord into an
appropriate power outlet.
3. Connect to the AppResponse appliance in one of the following ways:
• Use a terminal emulator program (such as hyperterm on Windows or tip on UNIX).
Connect to the AppResponse appliance's serial port with the provided serial cable. Use the
following terminal-emulation settings: 115200 baud, 8 data bits, no parity, 1 stop bit, and no flow
control.
• Use a cat5 ethernet cable that connects to a local network node using a static IP address:
• Connect the AppResponse appliance management ethernet port to a local PC or laptop with a
cat5 cable. The AppResponse appliance comes pre-configured with a default static IP address
of 192.168.119.119.
• Set the network node to an address in the 192.168.119.x address space (such as
192.168.119.1) with a subnet mask of 255.255.255.0.
• Wait for a few minutes before you log in to the appliance. It is useful to ping the AppResponse
appliance to indicate when it is ready to accept a login.
• Use an SSH client (such as putty) to log into the AppResponse appliance at
192.168.119.119.
• Use a standard PC keyboard and video display monitor.
Note–This option is not available on 3200, 3700, 4200, or 5000 appliances because these models do
not have a keyboard port.
Note—USB keyboards are supported on 1200, 2200, 3300, 3800, 4300, 5100, and 6000 appliance
models. USB keyboards are supported on 3200, 3700, 4200, or 5000 appliances running 8.6.2 or
higher (or 8.5.5 with s210 JAR class). On all other models, the USB ports are disabled while the
software is running.
Connect the keyboard cable to the purple keyboard port on back of the Appliance. Connect
standard 15 pin video monitor cable to 15 pin video connector on the back of the Appliance. Connect
this video cable to video monitor and power on the video monitor.
Nothing appears on the monitor or serial port console until the appliance is powered on and is booted
up, which occurs in the next procedure “Step 3: Initial Setup using the CLI” on page 129.
4. If you are not using the static IP for setup, connect an RJ45 CAT 5 Ethernet patch cable between the
AppResponse appliance Management interface and a switch or router.

5. With the rackmount and wiring complete, proceed to one of the following procedures, depending on
your physical configuration.
• Procedure 24 “Wiring for Span Port Physical Configuration” on page 126
• Procedure 25 “Wiring for Copper/Fiber Tap Physical Configuration” on page 127
End of Procedure 23
Step 2a: Wiring for Span Port Physical Configuration
Procedure 24 Wiring for Span Port Physical Configuration
1. Configure a span port (or two span ports if both monitoring interfaces are used) on the appropriate
switch.
Consider spanning traffic in both directions so that the AppResponse appliance can monitor all
network traffic.
2. Connect the span port(s) to the AppResponse appliance:

Note: The span port configuration and wiring of the monitoring interfaces can be deferred until the
remaining system configuration is complete. Keep in mind that the appliance does not collect traffic
until the span port is configured.
2.1. Connect the first span port to the AppResponse appliance’s first monitoring interface:
• For copper networks, use a standard RJ45 CAT 5E ethernet patch cable to connect the span port
to the RJ45 monitoring interface labeled 1.
• For fiber networks, connect the span port to the monitoring interface labeled 1 using a fiber
patch cable with an LC connector on the AppResponse appliance side. In the event that an LC
fiber patch cable is not available, the AppResponse appliance includes an LC/SC fiber patch
cable and SC/SC female adapter.
2.2. (Optional) Connect the second span port to the AppResponse appliance’s second monitoring
interface. NOTE—the second monitoring interface must be of the same type (e.g., copper) as the
first monitoring interface.
• For copper networks, use a standard RJ45 CAT 5E ethernet patch cable to connect the span port
to the RJ45 monitoring interface labeled 2.
• For fiber networks, connect the second span port to the monitoring interface labeled 2 using a
fiber patch cable with an LC connector on the AppResponse appliance side. In the event that
an LC fiber patch cable is not available, the AppResponse appliance includes an LC/SC fiber
patch cable and SC/SC female adapter.
3. With the span port configured and the wiring of the monitoring interfaces complete, proceed to Step 3
of the installation procedure (“Step 3: Initial Setup using the CLI” on page 129).
End of Procedure 24

Step 2b: Wiring for Copper/Fiber Tap Physical Configuration
Procedure 25 Wiring for Copper/Fiber Tap Physical Configuration
1. Install the copper or fiber tap into the network segment carrying the traffic to be monitored.
Refer to the installation instructions provided with the tap.
2. Connect the tap port facing the internal network to the first monitoring interface.
Note: Consider installing the copper or fiber tap before installing the AppResponse appliance when it
has the least detrimental effect on traffic.
• For copper networks, connect the monitoring interface labeled 1 on the AppResponse appliance to
the tap port facing the internal network.
• For fiber networks, connect the monitoring interface labeled 1 on the AppResponse appliance to the
tap port facing the internal network.
3. Connect the tap port facing the internal network to the second monitoring interface.
• For copper networks, connect the monitoring interface labeled 2 on the AppResponse appliance to
the tap port facing the external network.
• For fiber networks, connect the monitoring interface labeled 2 on the AppResponse appliance to the
tap port facing the external network.
4. With the wiring of the copper/fiber tap and the monitoring interfaces complete, proceed “Initial Setup
Using the CLI” on page 129.
End of Procedure 25

Configuring the Appliance

With the physical connections for the AppResponse appliance complete, the initial appliance configuration
must be performed using one of the methods described in step 3. of Procedure 23 on page 125. Once this is
complete, the final appliance configuration is done using the web interface.
Command Line Interface

The AppResponse appliance requires minimal initial configuration; you must access the command-line
interface (CLI) using the appliance’s serial port, static IP address, or keyboard/monitor (as described in
“Step 3: Initial Setup using the CLI”). There you can set the appliance host name, domain name, IP address,
netmask, and the default gateway for the management interface.
The command line interface also provides functionality to set the date, ping and traceroute arbitrary
destinations, check the status and statistics of all network interfaces, run diagnostics reports and view the
error log. These functions are not required during the initial configuration procedures.
Note: A number of free SSH clients, such as Teraterm and putty, are available for Windows.
After you’ve set the basic network parameters using the CLI, you can then access the CLI over the network
by using SSH to login to the appliance. You can also access the Administration > System web interface to
complete the system configuration (as described in “Step 4: Completing Setup using the Administration >
System Web Interface” on page 131).
In general, the CLI should only be used to configure network parameters at install time. All subsequent
changes to network parameters should be performed using the web interface.

Step 3: Initial Setup using the CLI
Procedure 26 Initial Setup Using the CLI
1. Press the power switch on the front of the AppResponse appliance to turn the appliance on. Watch the
serial port console for any error messages during the boot process.
2. The login prompt appears approximately 2 minutes after the appliance is turned on. Type admin and
press Enter.
The initial CLI login is admin with a null password.The admin login has administrative privileges and
can be used to create additional CLI logins as well as web interface logins.
While using the CLI, you can view the list of available commands by typing: commands
3. Specify a password for the admin user:
3.1. At the prompt, type passwd, then press Enter.
3.2. At the Old Password prompt, press Enter (null password):
3.3. At the New Password prompt, enter a password and press Enter (you need to do this twice for
confirmation).
4. To display the system configuration menu, at the prompt type setup, and then press Enter.
5. To begin the interactive system configuration, at the setup prompt type config, and then press Enter.
6. For each of the following parameters, type the appropriate value.
Caution—IP Address, Netmask, and Gateway changes may affect the visibility of this system on the
network.
Table 12 Required Parameters for the Setup Appliance

Parameter Value Description
Hostname Type the host name for the system. Enter the hostname only, do not include the domain
name. The hostname must be under 63 characters long, contain only letters, digits, or
dashes, and start with a letter and end with either a letter or digit.
IP Address Type the IP address for the management interface.
Netmask Type the netmask for the management interface.
Default Gateway Type the primary gateway IP address used by the management interface to reach other
networks.
Domain Type the default, fully qualified domain name for the system used during DNS
resolution. Do not include the hostname. Each portion of the domain name must be
under 63 characters long, contain only letters, digits, or dashes, and start with a letter
and end with either a letter or digit.
End of Table 2-26
CAUTION—The CLI should only be used to set the network parameters at install time. All
subsequent changes should be performed using the Administration > System web interface.

7. Verify your new settings: At the setup prompt, type showall and then press Enter.
8. To save the changes if the settings are correct, at the setup prompt type commit and then press Enter.
9. Because these changes require a restart to take effect, when you are asked if you want to restart the
system, at the setup prompt type yes and then press Enter.
If the login prompt appears approximately two to three minutes after you reboot the system, the
reboot process is complete.
To quit the CLI without rebooting, type no at the reboot prompt, and then type quit and press Enter.
10. With the initial setup of the appliance finished, proceed to Step 4a of the installation procedure (“Step
4: Completing Setup using the Administration > System Web Interface” on page 131).
Note: If this is a first time installation, be sure to read the next section for information on how to access
the web interface (“Accessing the Administration > System Web Interface”).
End of Procedure 26
Administration > System Web Interface

After you install the AppResponse appliance hardware and set it up using the command line interface, start
the web interface to finish setup
The web interface is used to complete the configuration of the appliance. The web interface allows you to
change the same parameters as in the initial CLI configuration —host name, domain, IP address, netmask,
and default gateway—plus it allows you to configure additional parameters including physical
configuration, DNS, NTP, and BGP.
Changes to network parameters may affect the visibility and accessibility of the system on the network. If
you are no longer able to access the system on the network, use the CLI from the serial port to enter
appropriate network settings.
Some changes made using the web interface require a restart to take effect.
Accessing the Administration > System Web Interface

If you have never accessed the web interface before, follow these steps.
Key Concept—To successfully connect to the web interface you must be able to access the AppResponse
appliance from your desktop machine via TCP ports 8080 and 8443.
Procedure 27 Accessing the Web Interface
1. Start a web browser and go to the appliance web interface by opening one of the following URLs:
http://<appliance_hostname>:8080
http://<appliance_ip_address>:8080
This automatically redirects the browser to a secure (SSL) connection on TCP port 8443.

The browser may display the certificate validation popup window. Accept the certificate to proceed to
the Login page.
Note: It takes approximately 5 to 10 minutes after the appliance is rebooted for the web interface to be
available.
2. At the Login page, enter your AppResponse appliance Username. During initial set-up, log into the
appliance using the admin account.
3. Type the AppResponse appliance Password for the user account.
4. Click Login.
If the username and password supplied were valid, the main page of the Web Console appears.
5. Choose Administration > System in the Web Console sidebar.
The Administration > System web page provides a brief overview of the functionality available within
this interface. It also displays the name and access rights of the user account used to access the web
interface.
End of Procedure 27
Step 4: Completing Setup using the Administration > System Web Interface
Procedure 28 Completing Setup Using the Web Interface
1. After installing the AppResponse appliance hardware, log in to the Web Console.
2. Choose Administration > System; then choose System > Setup.

Figure 44 System > Setup Page in “Administration > System” Web Interface
3. Under Network Configuration Settings, verify the network parameters that were set during the initial
CLI configuration (as described in “Step 3: Initial Setup using the CLI” on page 129):
• Host Name
• Netmask
• Domain
• Gateway
• IP Address
CAUTION—IP Address, Netmask, and Gateway changes may affect the visibility of this system on
the network.
4. From the Management Interface Speed/Duplex Settings drop-down list, select the management
network interface card’s mode of operation (or media type) used for communication. Note the
following:
• If the switch port to which the management port is connected is forced to a specific speed or duplex
setting, the management interface media type must be configured to the same settings; otherwise,
select autoselect.

• The Administration > System > Setup web page displays the speed/duplex settings and current
status of the management and monitoring interfaces. The management interface speed/duplex is
set to autoselect by default. However, the speed/duplex settings should be configured to the same
value set on the router/switch port.
• Changes to the Management Interface settings may greatly affect the responsiveness of the system.
5. (Optional) Configure the duplicate packet filter.
Under Physical Configuration, by default, the duplicate packet filter is enabled. The appliance may
receive multiple copies of the same packet.
In certain network configurations, the AppResponse appliance may receive duplicate frames. For
instance, if a span port is configured to mirror both inbound and outbound traffic flow, packets
between machines being spanned is sent to the appliance twice. The appliance can be configured to
detect and ignore these packets using the duplicate packet filter.
Riverbed strongly recommends that the AppResponse appliance is deployed in a manner such that
duplicate packets are minimized or avoided altogether. Even though the AppResponse appliance is
capable of filtering duplicate packets, the increased number of packets received and processed by the
AppResponse appliance can be very detrimental to overall system performance.
Note: The appliance must be rebooted before changes to the duplicate packet filter take effect.
6. Under Domain Name Servers, type the DNS Server IP addresses used by the AppResponse appliance
to perform network IP address resolution (one server address per line). Configure this option to see a
fully qualified domain name in the Console (instead of IP addresses).
7. (Optional) Under Border Gateway Protocol Settings, enter the following settings to give the
AppResponse appliance access to BGP information required to map IP addresses to AS numbers:
Note: You can set the BGP Mode to Inactive if you do not have access to a BGP router or you do not
want to enter this information at this time.
• Set the BGP Mode to Active to enable the AppResponse appliance to exchange routing information
with a border router -or- Inactive to terminate the AppResponse appliance’s exchange of routing
information with a border router.
• Enter the hostname of the router under Peer Router Name.
• Enter the IP address of the router under Peer Router IP Address.
• Under Appliance AS, type the autonomous system number (from 1 to 65535) of the network in
which the AppResponse appliance is located.
• Under Peer Router AS, type the autonomous system number (from 1 to 65535) of the network in
which the border router is located.
• Under Last Internal AS, type the autonomous system number of the router at the border of your
network. All AS numbers before this are not displayed in the traffic report. As a result, the ISP AS
number is identified as the 1st Hop after the Last Internal AS.
The border router must also be configured to allow BGP peering with the AppResponse appliance.

8. Under Internal Addresses, enter the internal Addresses list. This is a list of IP addresses within the local
network. The AppResponse appliance uses this list to determine the direction of traffic flow (inbound
or outbound) for the Total Traffic group. Inbound and Outbound for all other groups are relative to the
group (as described in “Physical Configurations” on page 91).
Note: To ensure accurate results, you must include all server IPs for all “Server Application”s and
“Web Application”s in the Internal Addresses list (Administration > System > Setup page). This
ensures that the Applications Table shows the IPs for that application correctly (Internal IPs ==>
[clients] and External IPs ==> [servers]).
The default setting for the Internal Addresses List is all private address ranges: 10.0.0.0/8,
172.16.0.0/12, and 192.168.0.0/16.
9. Under Time Settings, enter the following:
9.1. Local Time Zone
The time zone in which the AppResponse appliance is used.
9.2. Network Time Protocol (NTP) Servers
To prevent clock drift and to ensure that AppResponse appliance time matches the time on other
systems, it is strongly recommended that the AppResponse appliance clock be synchronized with
a known time source using the NTP protocol. Public NTP servers are available if your
organization does not have internal servers. The IP address of the NTP server should always be
used rather than its hostname. Refer to the Public NTP Server List on http://www.ntp.org/ for a
complete list of public NTP servers and access policies.
10. Scroll down the page (if necessary), and then click Apply to save the configuration settings.
TIP—Whenever you change settings, consider backing up the system configuration.
11. Under Administration > System > History, the System Log displays details about all configuration
changes, restarts, and shutdowns that have occurred on the system. Review the system log for any
errors that may have occurred during the initial configuration.
12. Set up hardware and software alerts on the appliance. For more information, see “Alerts” on page 50
(search the AppResponse User Guide or the online help).
Note: To improve uptime, Riverbed strongly recommends that you set up hardware and software
alerts on all your AppResponse appliances.
End of Procedure 28
Quitting the Web Interface

With the web interface running, click logout at the top of the page (see “Accessing the Administration >
System Web Interface” on page 130).

Installation and Configuration Complete

Now that the AppResponse appliance has been rackmounted and configured, the AppResponse Console
can be installed on a desktop machine. Please refer to “Installing the Desktop Console” on page 11 (search
the User Guide or the online help).
Note: You can log in again at any time (as described in “Accessing the Administration > System Web
If you close the browser window without clicking logout, the web interface does not allow that user account
to make administrative changes for 30 minutes. The admin user is exempt from this rule.

Updating the Software

Your AppResponse appliance might not have the latest version of AppResponse software installed. It is
good practice to check the Riverbed Support Center periodically and make sure that you have the most
recent AppResponse software release. To do this, go to www.riverbed.com/support and navigate to the
Software & Documentation page for AppResponse.
Safety Warnings
Heed Safety Instructions
Before working with your AppResponse appliance, whether you are using this guide or any other resource
as a reference, pay close attention to the safety instructions. You must adhere to the assembly instructions
in this guide to ensure and maintain compliance with existing product certifications and approvals.
System Power On/Off

Warning–Disconnect all power before servicing.
Attention–Débrancher toute alimentation électrique avant manipulation.
The power button DOES NOT turn off the system AC power.
To remove power from system, you must remove all AC power cords from the wall outlet.
Battery
The lithium battery on the server board powers the real time clock (RTC) for up to 10 years in the absence
of power. When the battery starts to weaken, it loses voltage, and the server settings stored in CMOS RAM
in the RTC (for example, the date and time) may be wrong. If you believe this situation is occurring, contact
your customer service representative. The battery is not user serviceable. The RAID Controller Cards might
contain a battery that is not serviceable.
WARNING: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE.
WARNING: DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.
Important Notes about Installing, Connecting, and Rebooting

AppResponse Appliances
Administrators and users should understand and follow these guidelines to ensure optimal performance
of AppResponse appliances.
This section discusses the following topics:
 “Placing and Installing the Appliance” on page 137
 “Connecting Fiber Ports for Monitoring Interface on the Appliance” on page 138

 “Guidelines for Powering Down or Rebooting an AppResponse Appliance” on page 140
Placing and Installing the Appliance
WARNING: To ensure against hardware damage, you must install the high-storage appliance in a physical
location that
• Has a temperature that is normally less than 30°C/86°F

and never exceeds 35°C/95°F
(ideally, the temperature should not exceed 25°C/77°F)
• Provides significant airflow across the front of the appliance

Connecting Fiber Ports for Monitoring Interface on the Appliance

The following figures are included to illustrate the correct fiber port connectivity for monitoring interfaces
on high-end-storage appliances.
Figure 45 shows fiber port allocations on the ARX-5000.
Figure 45 Fiber Port Allocations on 5000 Appliances
Transmit Receptacle
Receive Receptacle #1
Transmit Receptacle
Figure 46 shows fiber port allocations on the 4200 and 4300 appliance models.
Figure 46 Fiber Port Allocations on 4200 and 4300 Appliances
Transmit Receptacle
Transmit Receptacle
Port #3 (copper SFP - example)
Port #4 (copper SFP - example)


port #4
port #3
port #2
port #1
Transmit Receptacle #1
Transmit Receptacle #2

Guidelines for Powering Down or Rebooting an AppResponse

Appliance
Follow these guidelines when rebooting the appliance:
 Recommended reboot methods:
– Reboot from the CLI. For more information, see the following:
AppResponse Administrator’s Guide >
Administration and Maintenance >
Using the Command Line Interface >
Accessing the Command Line Interface
Halting or Rebooting the Appliance from the CLI
– Reboot from the web interface. For more information, see the following:
Halting or Rebooting the Appliance from the Web Interface
 Acceptable power-down method:
– Press the power button on the front panel, then release quickly (in less than two seconds).
 WARNING—Do not power down the appliance using either of the following methods unless it is
absolutely necessary:
– Press the power button on the front panel for an extended period
– Unplug the appliance
Note: We recommend that you print out a copy of this page and then post the hardcopy in a prominent
location near the appliance.

CHAPTER 3 Verifying Appliance Operations
The following system tests ensure that your AppResponse Appliance configuration, services, and
operations are functioning properly:
 “AppResponse Appliance” on page 142
 “Verifying Diagnostic Reporting, SNMP, and Backup Server Configuration” on page 144
 “Desktop Console” on page 145
Consider running these tests during or after the initial installation and before operational deployment. Of
course, you can also run these tests at any time to troubleshoot issues or after future reconfigurations of
your appliance.

Verifying Appliance Operations
AppResponse Appliance
Log in to CLI mode using either the serial interface or an ssh secured connection. To display the following
list of CLI commands, at the prompt type commands, and then press Enter.
NPinstallcf host ping
alertdir hostname quit
core-bundle-create ifconfig reboot
core-bundle-delete iostat release-current
date ipas-add-private-ips release-list
df ipas-display-private-ips release-update
diag-bundle-create ipas-undo-private-ips setup
diag-bundle-delete mailmgr stty
dmq man sync
exit netstat traceroute
fset nslookup uptime
halt ntpq viewlog
help passwd
To view documentation about a command, type man <command name>, and then press Enter.
Checking Time and Date

If the time is incorrect, check your NTP server address and time zone settings using the “Administration >
System Web Interface”. If you have a large time difference (such as more than 2 minutes), consider rebooting
your AppResponse Appliance to correctly set the time. Smaller time differences are automatically resolved
by NTP slews over several days.
WARNING: Be sure to use the -q option for query only.
To display the local time setting, at the prompt type date, and the press Enter.
To see the time difference between the AppResponse Appliance and a Unix system with an NTP time
source, at the prompt type ntpdate -q <server name>, and then press Enter. The offset should be less than
2 seconds. If more than 2 seconds, reboot the appliance to synchronize time with your NTP server.
Verifying Ethernet Configuration

To verify Ethernet configuration, at the prompt type ifconfig, and then press Enter. Verify that the IP address
and speed/duplex setting are correct for fxp0—the management interface.
The ifconfig output refers to the monitoring interfaces using the following names:
 The copper monitoring interface labeled 1 is referred to as interface em2.

 The copper monitoring interface labeled 1 is referred to as interface em3.

 The fiber monitoring interface labeled A is referred to as interface em0.
 The fiber monitoring interface labeled B is referred to as interface em1.
Check the status of the network interfaces in the “Administration > System Web Interface”. The status of
active indicates that the speed/duplex setting is correct. The status of no carrier indicates a bad hardware
connection.
To display a 1-second traffic report for any interface, at the CLI prompt type netstat -I <interface-name>
1 (e.g., netstat -I em2 1), and then press Enter. To terminate reporting, press Ctrl+C. You should see
the number of packets seen by that interface every second. If traffic is not flowing, check the status of the
Ethernet traffic ports as described above.

Verifying Diagnostic Reporting, SNMP, and Backup Server

Configuration
To complete each of the following items, first start the web interface “Administration > System Web
Interface”:
 “Verifying that Manual Diagnostic Reporting is Operational”
 “Verifying that SNMP is Operational”
 “Verifying Backup Server Configuration”
Verifying that Manual Diagnostic Reporting is Operational

If you are able to successfully generate a manual diagnostics report, then the AppResponse Appliance
diagnostics process is functioning properly. A problem generating the diagnostics report would indicate
that the appliance may be having trouble monitoring its own heath. Run a manual diagnostics report by
clicking the web interface Diagnostic menu, and then click bundles (see “Bundles” on page 47). Your
Riverbed support engineer can interpret the diagnostics report with you.
If you cannot generate a report, reboot the AppResponse Appliance, and then try to generate another
report. Under manual, type your email address in the Manual Reports Targets box, click mail, and then click
Apply.
Verifying that SNMP is Operational

For traps, on the web interface System tab, click snmp. Next to Traps, select On to enable sending of SNMP
traps to the primary and secondary Network Operations Center (NOC). Under Primary NOC, type your
destination SNMP manager Host Name IP address, Port number, and Community string. Under Heartbeat
Traps next to “Send heartbeat traps,” click On. In the Interval box, type 60. Within 60 seconds, you should
receive an SNMP trap from the AppResponse Appliance with Heartbeat and Normal SNMP trap variable
binding strings with OID string values. If this does not work, verify that the Host Name, Port, and
Community values match your SNMP manager settings. (Remember to turn off heartbeat traps if you do
not want to display them.)
For SNMP MIB browsing, point any MIB browser to the AppResponse Appliance. (The default is port 161
with a public community.) Execute a SNMP get request to any MIB-2 system OID. A data response
indicates that the SNMP agent is operating. If you cannot gain access, check the port settings to verify that
they match your MIB browser by clicking the web interface security menu, and then clicking ports.
Verifying Backup Server Configuration

In the web interface Backup tab select servers, then click the edit icon at the right of the backup server whose
configuration you want to verify. Click Test connection to test the connection and perform a test write. For
more information, see “Defining a Backup Server” on page 152.

Desktop Console
Download and set up the Desktop Console, and then either create or open a project (see “Installing the
Desktop Console” on page 11 (search the User Guide or the online help).
Viewing Traffic Flow

From within the Desktop Console, click Select Time and choose the Recent Hour time selection. Then open
a group table and view the Total Traffic group.The metrics displayed should be greater than zero if the
AppResponse Appliance is successfully monitoring traffic.
Verifying Desktop Time and Date

From within the Desktop Console, invoke the Time Selection dialog. Verify that the AppResponse
Appliance and desktop times and date toward the top of the window are correct. (They may differ if your
client desktop is in a different time zone than the AppResponse Appliance.) Your client time is your desktop
computer time and date. If the “Client is 10 Minutes Behind the AppResponse Appliance” message
displays, consider correcting your local computer time setting.
Verifying that DNS is Operating on the Desktop

From within the Desktop Console, open a Top Traffic table and select the IP Address group. Make sure that
the Information column is included in the table display. DNS is operational if any of the IP addresses listed
are resolved to hostnames in the Information column. If all columns are blank, either DNS name lookups
are not operational or none of the IP addresses listed in the table have valid DNS hostnames. Check these
results against the operating system's DNS resolution tools (e.g., nslookup).
Verifying that BGP Peering is Operating

From within the Desktop Console, invoke a Groups table and view the ISP AS groups. Then click Select
Time to select a recent time period (such as the last hour). The Group column should display an ISP AS other
than Unknown. If the rows are labelled ISP AS Unknown then BGP peering is probably not operating.
Verify that your BGP router is configured to peer with the AppResponse Appliance. Also, check the BGP
settings in the web interface, as described in “Administration > System Web Interface” on page 130.
Disk Alert Pop-Up Window in Desktop Console

The Desktop Console features a new pop-up window that appears when a disk alert is generated. This
window serves as a visible reminder to fix or replace the disk.
Figure 49 Disk Alert Pop-Up Window in Desktop Console

Note: The popup for a specific alert will continue to appear until an Administrator manually deletes it from
the appliance. After you resolve a disk issue, it is good practice to delete the pop-up for that issue. The alert
information is still available under Administration > System > Diagnostic > Log Viewer.
Administrators can add custom information that might be useful to others that log in to the appliance—for
example, "WARNING: This Appliance is scheduled to be down for maintenance from 1-2
pm, 04/29/14." The following steps outline this workflow:
1) Click Edit.
2) Resize the window to see the full alert.
3) Edit the HTML text between the <body> and </body> tags with the content you want displayed for
that pop-up. Click Done/Edit to toggle between edit and view mode.
4) Click Save to save the edited text on the appliance.

CHAPTER 4 Backup and Recovery of Appliance
Data
This chapter describes the backup and recovery methods for AppResponse appliances.
The methods are:
 “Backup and Recovery”—
Use this method to schedule regular backups that provide snapshots of appliance data. The data can
then be restored after an unexpected loss of data, including accidental file deletion, database
corruption, or hardware failure.
Backup Recovery
Appliance A Appliance B
(source) Backup Server (target)
 “Fast Recovery”—
Use this method to quickly add or replace an appliance by transferring data directly from one
appliance to another.
Fast-Recovery
Appliance A
(source) X Appliance B
(target)
Backup Server
(not needed)

Backup and Recovery of Appliance Data
Backup and Recovery

AppResponse appliances monitor, collect, and analyze network data 24/7. The data and analysis are critical
to the smooth operation of your enterprise. Therefore, it is important to protect the data and analysis by
implementing a backup and recovery plan.
AppResponse’s backup and recovery functionality serve as your backup and recovery plan. Regularly
scheduled backups provide snapshots of data that can be restored after an unexpected loss of data,
including accidental file deletion, database corruption, or hardware failure. The backup and recovery
feature is also useful to transfer data from one appliance to another.
Important—Backup and recovery is a disaster recovery tool—not an archiving tool. When a backup is
restored on an appliance, the backup data replaces the existing data.
About the Data Included in a Backup

The following AppResponse appliance data can be included in a backup:
 Configuration Data
Includes all parameters necessary to configure the appliance. Also includes all database tables relevant
for configuring (or reconfiguring) an appliance.
 Traffic Data
Includes 5-minute tables and/or 1-minute tables.
 Reports
Includes all published reports.
 Packet Captures
Includes packet capture files.
Note—This option is only available on appliances without High Speed Capture.
Note: SSL certificates and SSL private keys are excluded from backup/recovery for security reasons. This
means that you must re-enter the keys after a restore operation.
For detailed information about the data included in a backup, see the “Include” option listed in
Table 14 “Options for Scheduling a Backup”.
About Backups
Backups can be performed either on-demand or scheduled at regular intervals (daily, weekly, monthly) at
a specific time (preferably during off-peak hours).
Before a backup can be performed, the backup process must be configured, which includes defining the
following information:
1) Backup server(s)—specifies where the backup files are stored and the protocol used by the backup
process (FTP or SSH).

2) Data to include—specifies the data to include in the backup (e.g., configuration data, traffic data,
reports).
Note: For the most reliable disaster recovery plan, it is best to schedule regular backups. On-demand
backups are best when performed just before and/or just after a major change to an appliance, such as a
software upgrade.
Global vs. Local Backups

Depending on your environment (e.g., whether you have an appliance or a director) backups can be
configured locally (by appliance) and globally (by domain). The advantage of globally configuring a
director domain is that the identical backup configuration is sent to all appliances, saving you from defining
the same information on each appliance.
Note: After defining global backups on a director, you must activate the backups on each appliance.
Additionally, it is best to stagger the time of the backups on each appliance so that multiple appliances are
not simultaneously copying data to the backup server.
Note the Key Concept—Global vs. Local statement before procedures for a description of the difference
between the two types of backups.
Accessing the Backup and Recovery Operations

The Administration > System > Backup navigation menu has five choices:
 servers—Configures backup servers.
(See “Defining Backup Servers”.)
 backup now—Performs an on-demand backup.
(See “Performing an On-Demand Backup”.)
 schedule—Schedules backups.
(See “Scheduling a Backup”.)
 recovery—Restores configuration and/or other data from a backup.
(See “Performing a Recovery”.)
 history—Lists available backups and the status of in-progress backups.
(See “Viewing a List of Backups”.)
General Workflow for Backup and Recovery

The general workflow for configuring backups is as follows:
1) “Pre-Configuration Tasks and Verifications”
2) “Defining Backup Servers”
3) “Scheduling a Backup” -or-

“Performing an On-Demand Backup”
To view a list of available and in-progress backups, see “Viewing a List of Backups”.

To perform a recovery, see “Performing a Recovery”.

For additional information, see:
 “Best Practices and Guidelines for Backup and Recovery”
 “Troubleshooting Common Issues with Backup and Recovery”

Pre-Configuration Tasks and Verifications

Before configuring backups, perform the following tasks and verifications:
 Identify the backup server(s) where backup files will be copied and stored.
 For each backup server, note the following information:
– IP address
– Username/password to access the server
– Path to the directory on the server where backups will be copied
Note—You can specify multiple backup servers with different paths, protocols, and security settings
on the same physical server.
 On each backup server, verify the following:
– SSH and/or FTP is installed and configured
– The user account for the backup server has access to the backup directory with read, write, delete,
and execute privileges
– The backup server has sufficient disk space for the backup files
 On each AppResponse Appliance, verify that the AppResponse user account has write privileges on
the appliance. (Write privilege is required to perform a recovery.)
For more information, see “Best Practices and Guidelines for Backup and Recovery”.

Defining Backup Servers

At least one backup server must be configured to perform or schedule a backup.
Note: You can specify multiple backup servers with different paths, protocols, and security settings on the
same physical server.
Global vs. Local Backups

Key Concept—Global vs. Local Backups
Backup servers can be defined for an appliance or for an entire domain. Local backup servers are
defined from an AppResponse appliance, while domain backup servers are defined from an
AppResponse Director.
When a backup server is defined on an AppResponse Director, the backup server definition is pushed
to all AppResponse appliances in the domain. If a global and local server have the same name, the
conflict is resolved as follows:
– If a local backup server with the same name and the same settings already exists—the backup
server becomes “global”.
– If a local backup server with the same name, but different settings already exists—the name of the
existing backup server is marked as “local”.
Whether a backup server is defined globally or locally is designated in the third column of the “List of
Backup Servers” page. Global is defined with a blue globe; local is defined with a greyed-out globe and
name. (The globe and name are greyed-out as a reminder that the backup server cannot be edited or
deleted from the AppResponse appliance).
Before defining backup servers, be sure to review “Best Practices and Guidelines for Backup and Recovery”.
Procedure 29 Defining a Backup Server
1. Login to AppResponse.
• Login to the AppResponse Director to define a global backup server definition (for use by all
appliances in the domain).
• Login to an AppResponse appliance to define a local backup server definition (for use by the specific
appliance).
2. Navigate to the Administration > System > Backup > Servers page.
3. Do one of the following:
• To define a new backup server, click “Add new”.

(The “Add new” option is located on the last line of the table, on the right.)
• To edit an existing backup server, click Edit corresponding to the backup server that you want to
edit.
(The Edit option is the first column of the table.)
Remember that global backup servers can only be edited on the AppResponse Director.

4. Specify the information listed in the following table.
Table 13 Options for Defining a Backup Server

Option Description
Name Specifies the name of the backup server.

The name is used to identify the backup server in the user interface.
Host Specifies the IP address of the backup server.
Protocol Specifies the protocol used to communicate with the backup server. You can choose
FTP (the default) or SSH.
For more information, see “Best Practices and Guidelines for Backup and
Recovery”.
Path Specifies the path where backup files are stored on the backup server. Each backup
goes into its own directory under this path. (If using SSH protocol, this is the same
path used in a secure copy (scp) command.)
User Specifies the user name for logging into the backup server. If no user name is
specified, then the same user name that is used to login to the AppResponse
appliance is used.
Password/RSA Key For FTP protocol, specify the password for logging into the backup server.
For SSH protocol, specify the RSA key used in authentication procedure. Either
click Generate to generate a key or paste an existing key.
Note the following:
• The RSA Key must be generated and stored on the backup server before the
backup procedure can execute. This is accomplished by adding the key to the
$HOME/.ssh/authorized_keys file for the appropriate user account on the
backup server. For more information, contact your system administrator or
consult the ssh manual pages.
• When you select and copy the key from the RSA key field to paste it in the
authorized_keys file, be sure to select all characters in the string. It is good
practice to compare the string in the RSA field and the authorized_keys file
carefully to verify that the entire string is copied.
5. Click Apply to save the backup server definition.
6. Optionally, edit the backup server and click “Test connection” to initiate a connection with the
specified backup server and to execute a test write.
End of Procedure 29
To delete a backup server from an appliance, click the Delete option corresponding to the backup server.
(The Delete option is in the second column in the “List of Backup Servers” page.) Remember that global
backup servers can only be deleted from the AppResponse Director. Also note that a backup server cannot
be deleted if it is currently specified as the backup server for a scheduled backup.

Scheduling a Backup
For the most reliable disaster recovery plan, it is best to schedule regular backups.
Key Concept—Global vs. Local Backup Schedules
Backup schedules can be defined on local appliances or for an entire domain. Global schedules must
use global backup servers, but local schedules can use local or global backup servers.
Backup schedules defined on a Director are automatically pushed to all appliances in the domain.
Whether a scheduled backup is defined globally or locally is designated in the fourth column of the
“List of Backup Schedules” page. Global is defined with a blue globe; local is defined with a
greyed-out globe.
When a global backup schedule is pushed to the appliances in the domain, the schedules are inactive
by default. To activate the schedule, you must edit the schedule on each appliance and change the
status from inactive to active. Additionally, it is best to change the start date and/or time to avoid
having all the appliances in a domain attempting backups to the same server at the same time.
Note—When editing a global schedule on an AppResponse appliance (not a Director), you can only
change Status (active/inactive), Start date, and Start time.
Before scheduling backups, see “Best Practices and Guidelines for Backup and Recovery”.
Procedure 30 Scheduling a Backup
1. Log in to the web console (https://[appliance]:8080) of the appliance or director. To schedule a global
backup, log in to the AppResponse Director.
Note—Backup schedules created on a director are automatically pushed to all appliances in the
domain.
• To schedule a local backup, login to an AppResponse appliance.
2. Navigate to the Administration > System > Backup > Schedule page.
3. Do one of the following:
• To define a new scheduled backup, click “Add new”.

(The “Add new” option is located on the last line of the table, on the right.)
• To edit an existing scheduled backup, click Edit corresponding to the backup schedule that you
want to edit.
(The Edit option is the first column of the table.)
• To copy an existing scheduled backup, click Copy corresponding to the backup schedule that you
want to copy. The Copy option is useful when you want to schedule a backup that is similar to an
exiting backup. After copying a scheduled backup, you can then edit the copy.
(The Copy option is the third column of the table.)
Note—Scheduled backups can be deleted or inactivated. An inactive backup is not performed. Use the
inactive feature to temporarily stop a scheduled backup.
• To delete a scheduled backup, click Delete corresponding to the backup that you want to delete.
(The Delete option is the second column of the table.)

• To activate/inactivate a scheduled backup, click the “Active” checkbox corresponding to the

backup schedule that you want to activate/inactivate. (The backup is active when a check
appears in the checkbox.)
The following figure shows the “New Schedule” page that appears when defining a new scheduled
backup.
4. Specify the information listed in the following table.
Table 14 Options for Scheduling a Backup

Option Description
Schedule name Specifies the name of the scheduled backup.

The name is used to identify the scheduled backup in the user interface.
Status Indicates whether the schedule backup is active. (The backup is active when a
check appears in the checkbox.)
Note—For a global schedule (e.g., a schedule that was defined on a Director), this
option can be changed on an appliance.
Start date Specifies the date on which the first backup is performed.
Enter a date in YYYY-MM-DD format or click the calendar icon next to the field to
select a date from the calendar.
Start time Specifies the time at which the backup is performed.


Table 14 Options for Scheduling a Backup (Continued)

Option Description
Server name Specifies the backup server to which the backup is copied and stored.
Select a backup server from the pull-down list. Click the “Add new backup server”
option to add a backup server in a new browser window. (See “Defining Backup
Servers”.)
Prefix Adds a prefix to the directory name in which the backup is copied. (The directory
name consists of the appliance name, version number, and timestamp.) This field is
optional.
Use the prefix option for identification purposes. For example, supposed you
schedule multiple backups, and each backup includes different data. You could
specify the data included in the backup using the prefix option.
Compressed Indicates whether the backup files are compressed, using the gzip algorithm. (Files
are compressed when a check appears in the checkbox.)
Include Specifies the data to be included in the backup.

Select one or more of the following:
• config—includes all parameters necessary to configure the AppResponse
appliance (including alerts, insights, applications, business groups, SLA
dashboards, and appliance setup). All database tables relevant for configuring
(or reconfiguring) an appliance are saved in a separate tar file on the backup
server with the name CNF.tgr or CNF.tar.
(Note—The config option is always included in a backup.)
• traffic data—Select 5-minute tables (less granular but create a smaller backup
file) and/or 1-minute tables (more granular but create a larger backup file).
Traffic data is stored in two separate tar files on the backup server: open
database tables (can be updated) in a file called DOP.tgz or DOP.tar, and closed
database tables (historical, no longer updated) in a file called DCL.tgz or
DCL.tar.
• reports—Includes all published reports in a file named REP.tgz or REP.tar. (Note
that this is not the same as report definitions, which are stored with
configuration data.) For more information, see AppResponse User Guide >
Console Reports.)
Frequency Specifies the frequency of the backup.

Select one of the following:
• daily (every x days)
• weekly (every x weeks and the day(s) of the week)
• monthly (every x months and the day(s) of the month)
Keep last x full backups Specifies the number of backups to keep on the backup server. The default is 2. If
unchecked, each backup overwrites the previous backup.
Note—The more backup you keep, the more disk space you need to store the
backup files.
Retry attempts If a backup fails, specifies the number of times the appliance tries to connect to the
backup server. The default is 3.
Minutes between retry Specifies the minutes between retry attempts. The default is 30 minutes.
attempts
5. Click Apply to save the scheduled backup definition.
6. If scheduling global backups, edit the schedules on the individual appliances:

• Change Inactive to Active.
• Change the start date and/or time to avoid having all the appliances in a domain attempting
backups to the same server at the same time.
End of Procedure 30

Performing an On-Demand Backup

On-demand backups are best when preformed just before and/or just after a major change to an appliance,
such as a software upgrade.
Key Concept—Global vs. Local On-Demand Backups
On-demand backups copy data from the specific appliance from which the backup is performed. In
other words, when performing an on-demand backup from a Director of a domain, only the data on
the Director is included in the backup.
Before performing an on-demand backup, see “Best Practices and Guidelines for Backup and Recovery”.
Procedure 31 Performing an On-Demand Backup
1. Log in to the appliance (https://[appliance]:8080) and navigate to the Administration > System >
Backup > Backup Now page.
2. Specify the following information:
• Server name—Select the backup server from the pull-down menu.
• Prefix—Add a prefix to the backup directory name. (optional)
• Compressed—Compress the backup files using gzip compression.
• Include—Specify the data to backup.
For more information about these options, see Table 14 “Options for Scheduling a Backup” in
Procedure 30 “Scheduling a Backup”.
3. Optionally, click “Estimate size” to estimate the size of the backup files.
The “Backup estimation” page appears.

The “Backup estimation” page refreshes every 10 seconds while the estimation is in progress. When
complete, the page lists the size of the backup files. Click Back to return to the “Backup Server
Information” page.
4. Click Backup.
The Backup progress page appears.
During backup, a progress screen appears. A checkmark indicates completed tasks, an hourglass for
tasks in-progress or yet to execute, and a red X for tasks that failed.
If you close the browser window while the backup is in progress, you can monitor, abort, and/or verify
the backup on the “Backup History” page. For more information, see “Viewing a List of Backups”.
When the backup completes, the completion screen appears and displays the success of the backup.
End of Procedure 31

Viewing a List of Backups

You can display and search completed backups and monitor in-progress backups. Also, you can delete
backup files from the backup servers.
Procedure 32 Viewing a List of Backups
1. Log in to the appliance (https://[appliance]:8080) and navigate to the Administration > System >
Backup > Backup History page.
Note the following:
• The second column shows a solid blue rectangle for a full backup.
• The third column shows a checkmark for a successful backup.
2. Do any of the following:
• To search for an available backup, specify a date range using the Start date and End date fields. Or
click any of the pre-defined searches (current week, last week, current month, last month).
• To delete a backup, select the checkbox in the first column of the table and click Delete.
End of Procedure 32

Performing a Recovery
Perform a recovery to restore the system configuration, traffic data, and reports, to an appliance or Director
from a selected backup.
Before performing a recovery, see “Best Practices and Guidelines for Backup and Recovery”.
For information about restoring a backup to a different backup server, see “Restoring a Backup to a
Different Appliance”.
Note—Before performing a recovery on an AppResponse appliance that is connected to an expansion
chassis, do the following:
 Verify that the expansion chassis is connected and operational.
 Backup the expansion chassis before performing the appliance recovery.
Additionally, when rebooting the AppResponse appliance, wait 30 seconds to 1 minute for the expansion
chassis to reconnect with appliance.
Procedure 33 Recovering Data on an Appliance
1. Login to AppResponse.
2. If restoring an appliance in a domain, disconnect the appliance from the domain using the Domain
Manager on the Director. For more information, see “Disconnecting an Appliance from a
Domain”.
3. Click the Backup tab.
4. Click recovery.
5. The Recovery page appears.
6. Select the backup server:
Select the backup server from the Server pull-down option. You can add a new backup server in a
separate browser window by clicking the “Add new backup server” option to the right of the
pull-down field. (See “Defining Backup Servers”.)
7. Select a backup:
Select the “most recent” checkbox to restore with the most recent backup. Or, uncheck the checkbox
and click “Find backup archives” to display a list of available backups. You can then select a backup
from the list.
8. Select the data to restore:

Click the Clock icon located to the left of the backup that you want to restore and select the types of
data to restore. Uncheck the ones you do not want to restore at this time: opened (current tables), closed
(archive tables), reports, and packet capture (on appliances without High Speed Capture).
Configuration data is always restored.
Note: All selected data is restored. You cannot choose specific files from a backup to restore. However,
you can restore data from a backup one set at a time, called a partial recovery. For example: restore
configuration files and later restore traffic data, reports, and/or capture data.
9. Click Recover to start the process.
A recovery progress screen displays.
10. When the recovery process completes, click Reboot to reboot the appliance and to activate the restored
configuration files.
11. If the recovery is partial (you want to restore additional data (i.e., traffic data, reports) from the selected
backup):
11.1. Select the checkboxes for the data to restore.
11.2. Click “Continue Recover”.
12. When the recovery process completes, click Reboot.

(Perform the partial recovery and reboot as many times as necessary.)
13. If you are restoring an appliance in a domain, re-activate the appliance from the Domain Manager
(search for “Connecting an Appliance to a Domain” in the Director User Guide or the online help).
End of Procedure 33

Restoring a Backup to a Different Appliance

You can restore a backup to a different appliance from which the backup data originated, by renaming the
backup directory with the AppResponse appliance to which the backup will be restored.
For example, suppose you have a backup on the backup server under the following directory name:
ARX2_8.5.5_119908473000
where:
 ARX2 = the hostname of the AppResponse appliance
 8.5.5 = the AppResponse version
 119908473000 = the UNIX or POSIX time (number of seconds since January 1,1970)
Now suppose that you want to restore this backup to a different AppResponse appliance: ARX5.
To restore the ARX5 appliance with the ARX2 backup, do the following:
1) Rename the backup directory by changing the appliance name from ARX2 to ARX5.
2) On ARX5 appliance:
a) Add the backup server.
(See Procedure 29 “Defining Backup Servers”.)
b) Perform a recovery.
(See Procedure 33 “Recovering Data on an Appliance”.)
Be sure to unselect the “most recent” checkbox and click “Find backup archives” to find and select
the backup that you want to restore.
Important Notes
When restoring a backup to a different device, note the following:
 Recovering “downward” to an older or lower-end device is not recommended. Not all
appliance/director models can used as the target device for a specific source device. If the target device
does not support the source data, the Fast Recovery will exit with a warning message.
 The target device must have the same or higher software release installed as the source device. You can
restore to a newer release, but not to an older release.
You can verify the installed release in the Administration > System > Setup page (top-left corner).
 The target device must have at least as much available disk space as the source device.
You can verify the amount of disk space in the Desktop Console > View > Appliance Info window.
Scroll to the bottom and note the second-to-last line: Disk Usage.
 If you are recovering data that requires a specific license, you will need to have that license installed on
the target device to view that data.
the destination appliance to view that data.
If you have only one set of licenses, and need to transfer these licenses from the source to the target, do
the following:
a) Back up the data on the source device.
b) Recover the data to the target device.

c) Deregister the licenses on the source device:

i) Open the License Manager (Desktop Console > Tools > License Manager).
ii) Copy or write down the serial number of the appliance.
iii) Go to www.riverbed.com/support and open a support case. Include
the serial number of the appliance in the initial request.
d) When Support notifies you that the licenses are available, add them on the destination device.
After you generate a license key, you can add it to the device from the Desktop Console > Tools >
License Manager.
To verify and compare licenses, access the License Manager on each appliance. Open the Desktop
Console (Administration > Desktop Console) and choose Tools > License Manager… Note the list of
licenses in the License Manager.

Best Practices and Guidelines for Backup and Recovery

For best practices and guidelines, see:
 “Recommendation: Use SSH If Possible”
 “Estimating Backup/Recovery Times”
 “Recovery Guidelines”
Recommendation: Use SSH If Possible

If you have an SSH server, Riverbed recommends that you back up and restore over SSH. SSH is more
reliable than FTP, especially for large backup/restore operations.
Estimating Backup/Recovery Times

The average speed of a backup/restore operation ranges from 35Mbps to 50Mbps (megabits per second),
with a maximum possible speed of 55Mbps. You can estimate the amount of time a backup/restore
operation will take based on the amount of data that needs to compressed and archived (or uncompressed
and extracted). For example, suppose you want to back up 100GB (gigabytes) of data. You can estimate the
backup time as follows:
100GB * 8 = 800Gb of data
convert gigabytes to gigabits
800Gb / 50Mbps = ~16k seconds backup time
total backup data (bits) / estimated backup speed (bits per second)
16k / 60 = ~267 minutes backup time
267 / 60 = ~4.44 hours backup time
You can estimate the size of a proposed backup using the “Estimate size” option (Backup > backup now
page). (See step 3. in Procedure 31 “Performing an On-Demand Backup”.) The Backup > recovery page
shows the size of each available archive.
Note the following:
 Backup operations can take longer if the appliance is busy.
 Restore operations take slightly longer than backup operations.
 Restore operations can take longer if you are restoring data from one release to another (for example,
restoring 8.0.x data onto an 8.5.x appliance).
Recovery Guidelines
Before you perform a Recovery operation, note the following:
1) To restore an appliance in a domain, you must first disconnect the appliance from the domain using the
Domain Manager on the director, as described in “Disconnecting an Appliance from a Domain” (search
the Director User Guide or the online help). After the restore, you must re-connect the appliance to the
domain.

2) Most of the Administration > System web UI functionality becomes unavailable during recovery.
Therefore it is best to perform a restore during off-peak hours. Also note that a recovery replaces the
data on the AppResponse appliance. Therefore, any changes to the appliance or packet capture data
collected during a recovery (on appliances without High Speed Capture) will be lost. Therefore, it is best
to restore when you don’t need the appliance to collect data.
3) When you perform a recovery operation that includes tables, reports, or packet capture data (on
appliances without High Speed Capture)—that is, when you want to recover anything in addition to
configuration data—it is best to split the operation into separate phases:
a) On the restore system, open the License Manager (Tools > License Manager in the Desktop
Console) and verify that the appliance has a valid, unexpired license installed.
b) Perform the “Recovering Data on an Appliance” procedure with all Content checkboxes (Traffic
Data, Reports, and Packet Capture) unselected. This will recover the configuration data only.
c) When the Recover operation finishes, click Reboot.
d) When the appliance finishes rebooting, re-connect using the Administration > System web UI and
return to the Backup > Recovery.
e) Select the additional data you want to recover (under Continue Recovery Process) and click
“Continue Recovery”.

Troubleshooting Common Issues with Backup and Recovery

Typically, backup and recovery problems are related to permissions issues, an improperly defined backup
server, connection timeouts, etc. The following table lists troubleshooting tasks.
Table 15 Backup/Recovery Troubleshooting Tasks

Task Description
FTP or SSH Check whether the backup is using FTP or SSH.

If using FTP, note that in some cases, performing large file backups over FTP may
result in a failure. To test, try performing a small file backup over FTP. If a small
backup (i.e., configs only) works, but a full backup fails, try performing an SSH
backup.
Confirm Verify the following and contact your network administrator if either of the following
Connectivity items fail:
• From the backup server, try to ping the AppResponse appliance.
• If there is a firewall between the backup server and the appliance, make sure that
the appropriate ports (FTP or SSH) are open for backup/restore.
Confirm the • Verify that the path to the backup directory is correctly defined in AppResponse.
Backup
• Try the following:
Directory Path
Log in to the backup server from your Windows command prompt (Start > Run >
cmd) using the same username and password defined in the Administration >
System web UI.
After logging in, type pwd or dir to determine where it's logging in. For instance,
when you enter pwd it shows that you are logged in under “C:\desktop\ftp” and
your backup ftp directory path is “C:\desktop\ftp\riverbed\backup”. Then you
know that in the System > Administration web UI, you need to define the path as
“\riverbed\backup” and not the complete path.
Check Verify that the user performing the backup has read, write, delete, and execute
Permissions permissions to the backup directory on the backup server.
Check Logs Obtain the exact error message in the br.log file. This file can be accessed through the
System > Administration web UI: Diagnostic > log viewer.
Related Topics
 “Fast Recovery”

Fast Recovery
Fast Recovery allows you to recover data directly from one AppResponse device to another directly,
without the step of transferring data via an intermediate backup server. Fast Recovery offers the following
advantages over a standard Backup and Recovery:
 Fast Recovery is significantly faster
 Fast Recovery always recovers the most recent data from the appliance or director (instead of archived
data from a backup server).
Figure 50 Fast Recovery: No Backup Server Needed
Appliance A
(source device) X Appliance B
(target device)
Backup Server
(not needed)
Note—Fast Recovery does not replace a standard Backup and Recovery and is not always recommended.
Fast Recovery is typically used to add or replace an appliance when both source and target are running,
available, and visible to each other. You cannot use Fast Recovery to recover data on the same appliance, or
to recover data from a source device that has already been decommissioned.
Note—Fast Recovery is usually faster than an equivalent Backup and Recover in part because Fast
Recovery transfers uncompressed data while Backup and Recovery compresses, transfers, and
uncompresses the data. This eliminates the compression/uncompression processing time, but also results
in more data being transferred across your network. The actual Fast Recovery time depends on latency,
bandwidth, utilization, and other conditions in your network. You might want to start the Fast Recovery
when network usage is minimal–late at night, for example, or during the weekend--especially if the amount
of data being transferred is very large.
 “About the Data Restored in a Fast Recovery”
 “Important Notes” on page 169
 “Performing a Fast Recovery” on page 171
 “Troubleshooting Fast Recoveries” on page 173
About the Data Restored in a Fast Recovery

The following AppResponse appliance data can be restored during a Fast Recovery:
 Configuration Data
Includes all parameters necessary to configure the appliance. Also includes all database tables relevant
for configuring (or reconfiguring) an appliance. The configuration data is always restored during a
Fast Recovery.
 Traffic Data
Includes 1-minute, 5-minute, 60-minute, and 1-day tables. You can specify the traffic data to restore
during a Fast Recovery.

 Reports
Includes all published reports. Reports are always restored during a Fast Recovery.
Note: SSL certificates and SSL private keys are excluded from Fast Recovery for security reasons. This
means that you must re-enter the keys after a Fast Recovery operation.
General Workflow
The Fast-Recovery process is performed using CLI commands and includes the following steps:
1) Establish a public/private key authentication between the source and target appliances.
2) Initiate and run the Fast-Recovery process.
Important Notes
Before you do a Fast Recovery, note the following:
 Recovering “downward” to an older or lower-end device is not recommended. Not all
appliance/director models can used as the target device for a specific source device. If the target device
does not support the source data, the Fast Recovery will exit with a warning message.
 If the original appliance is part of a director domain, you must
– Remove the original appliance from the domain,
– Do the Fast Recovery, and
– Add the new appliance to the domain.
 If you are doing Fast Recovery between two directors, and the original director has appliances in its
domain, you must
– Remove all appliances from the original director’s domain,
– Do the Fast Recovery, and
– Add all appliances to the new director’s domain.
 The target device must have the same or higher software release installed as the source device. You can
restore to a newer release, but not to an older release.
You can verify the installed release in the System > Administration web UI > System > Setup page
(top-left corner).
 If the source device is running a pre-8.5.5 software release, you must install the following patch before
you do a Fast Recovery:
Desktop Console >
Insights >
Update Center >
support.opnet.com/insights/support >
patches >
patchAV-all-xx00-R807_853-Backup-101
 The target device must have at least as much available disk space as the source device.

You can verify the amount of disk space in the Desktop Console > View > Appliance Info window.
Scroll to the bottom and note the second-to-last line: Disk Usage.
Note—During the Fast-Recovery process, a warning message displays if there is not enough space on
the target device.
 Depending on the hardware model and the data specified for recovery, the recovery process can take
several hours. For more information, see “Estimating Backup/Recovery Times” on page 165.
 While a Fast Recovery is in progress, all traffic monitoring is suspended on the source device. For this
reason, you should perform a Fast Recovery only when you do not need to use the device for critical
work.
the target device to view that data.
If you have only one set of licenses, and need to transfer these licenses from the source to the target, do
the following:
a) Fast-Recover the source device to the target device (as described in Procedure 34 on page 171).
b) Deregister the licenses on the source device:
i) Open the License Manager (Desktop Console> Tools > License Manager).
ii) Copy or write down the serial number of the appliance.
iii) Go to www.riverbed.com/support and open a support case. Include
the serial number of the appliance in the initial request.
When Support notifies you that the licenses are available, add them on the destination device.
After you obtain a license key, you can add it to the device from the Desktop Console > Tools >
License Manager.

Performing a Fast Recovery
Procedure 34 Performing a Fast Recovery
1. Target device: Log in as admin.

Note: You must be logged in as user admin, not simply as a user with Administrative privileges.
2. Target device: Run the following command to generate an RSA public key:
ssh-keygen -t rsa
If a key has been already generated, you will be prompted to either keep or overwrite it to create a new
one.
3. Target device: Run the following command to display the RSA public key on the screen:
ssh-keygen -D rsa
4. Target device: Select and copy the key displayed on the screen.
Be sure to select and copy the entire key.
In the next step, you will paste the key as part of the command.
5. Source device: Log in as admin.

Note: You must be logged in as user admin, not simply as a user with Administrative privileges.
6. Source device: Run the following command to copy the public key to the source appliance (paste the key
string into the command line:
add-sshkey “<key>”
The key string must begin and end with a double-quote (“) character:
Enter the following: add-sshkey “
Paste the key string, add a second double-quote, and press Enter.
The key is copied to the source appliance in the /<uid>/.ssh/authorized_keys file (where <uid> is the
admin user).
7. Target device: Run the fast-recover command:
fast-recover -s <hostname> <options>
where:
• -s <hostname> = Source. Specifies the host name or IP address of the source appliance.
<options>:
• -x '1,5,60,1440' = Exclude tables. Specifies the traffic data tables (both historical and current)
to exclude from the Fast Recovery. If excluding more than one table type, separate the tables with
commas:

• 1 = 1-minute tables
• 5 = 5-minute tables
• 60 = 60-minutes tables
• 1440 = 1-day tables
• <no option> = No data is excluded from the Fast Recovery.
Note—The configuration data and published reports are always restored during the Fast Recovery.
other option:
• -h = Help. Lists the available options.
The following examples show how the command options can be used for different use cases:
>fast-recover -s ARX5
Copy all recovery data from the ARX5 appliance.
>fast-recover -s ARX5 -x '1,5,60'
Copy all recovery data from the ARX5 appliance except for 1-minute tables, 5-minute tables, and
60-minute tables.
>fast-recover -s ARX5 -x '1,5,60,1440' -p
Copy only the configuration data and the published reports from the ARX5 appliance.
8. Before the Fast Recovery begins, the appliance shows the amount of data to be transferred. If you want
to estimate the approximate recovery time, see “Estimating Backup/Recovery Times” on page 165.
Otherwise, enter ‘y’ to proceed.
The Fast Recovery outputs characters to the CLI to indicate that the recovery is in progress. Thus, you
might see a string of characters like the following, which continually updates as the recovery proceeds:
=>=>=>=>=>=>=>=>=>=>=>=>
When the recovery is complete, the following message appears:
Fast-Recovery Successful
9. Run the following command to configure the target appliance.
setup
Follow the prompts to configure/verify the appliance settings (e.g., IP address and other network
parameters). When complete, the appliance automatically reboots.
End of Procedure 34
Related Topics
 .“Backup and Recovery”

Troubleshooting Fast Recoveries

This section describes the following issue:
 “Not Enough Disk Space on Target Appliance” on page 173
Not Enough Disk Space on Target Appliance

Before it starts a Fast Recovery, AppResponse checks the target appliance to ensure that it has enough disk
space for all source data. A target appliance can allocate up to 75% of its disk space to receive data from a
source appliance during a Fast Recovery. If the amount of source data exceeds this threshold, Fast Recovery
does not transfer any data; it simply generates an error message and exits.
In this case, you can run the following command on the source appliance to trim the database size:
dbcleanup -f [trim-original-size-to-this-percentage]
This command trims the 1-minute tables first; if the target percentage is not reached, it trims some of the
5-minute tables.
Riverbed has the following guidelines for trimming databases for a Fast Recovery:
 When transferring data from lower- to a higher-model appliance, or between two same-model
appliances, you can trim the source database to 75% (dbcleanup -f %75) in most cases.
 When transferring data from a higher- to a lower-model appliance, you need to trim the database by
50% (dbcleanup -f %50) in most cases.
 When transferring data from a 4200, 5000, or 5100 to a 6000 appliance, you should trim the database by
50%. Although the 6000 has more total disk space than these source models, it has less space allocated
for metric data (the extra space is dedicated to storing captured packets).
 If you're not interested in retaining the most recent data, you can discard 1-minute tables using the -x
command-line argument. This effectively reduces the database size by 50% while retaining all of the
5-minute, 1-hour, and 1-day data:
fast-recover -s [hostname] -x 1
If you want to calculate a more precise percentage, you can also run the following command to see disk
usage and availability on the source and target:
df -H
The following example shows how to calculate determine the trimming percentage for an example source
and destination. First, run df -H on the source and target appliance:
my-source-appliance.mycompany.com> df -H
Filesystem Size Used Avail Capacity Mounted on
/dev/da0s4d 1.9T 1.5T 240G 86% /u1
My-target-appliance.mycompany.com> df -H
Filesystem Size Used Avail Capacity Mounted on
/dev/da0s4d 1.2T 0.3T 900G 25% /u1
The key values here are Used on the source and Size on the target:
Size-on-target = 1.2T
Disk space on target available for Fast Recovery = 1.2T * 0.75 = 0.9T
Used-on-source = 1.5T

In this case, the source has much more data (1.5T) than it can transfer to the target. You would need to trim
the database by 50% (dbcleanup -f %50) to bring the source database down to 0.75T. This is within the
maximum threshold on the target (0.9T) and would allow the Fast Recovery to proceed.

APPENDIX A Software Updates from the
Administration > System Web UI
You can download and install software Updates for Appliances and Directors using the Administration >
System > Update web page.
Figure 51 System Tab - Appliance Update
There are three ways to download and install software Updates:

 Download (“Updating an Appliance that has Internet Access”)
 URL (“Updating from a Custom URL” on page 176)
 Upload (“Updating from a Local Host” on page 176)
Updating an Appliance that has Internet Access

This procedure describes how to Update an appliance that has internet access. If your appliance is on an
isolated network, follow the directions in “Updating from a Local Host” on page 176.
To Update an appliance from a Director or support.riverbed.com, do the following:
1) Log in to the Web Console and navigate to the Administration > System > Update page.
If the appliance connects to the internet through a proxy server, you can use the “options” link (right of
page) to specify a proxy URL.
2) In the New Version pull-down menu, select the Update you want.
3) Select the Copy and Install checkboxes.
4) Click Install.

Software Updates from the Administration > System Web UI
Updating from a Custom URL

You can Update an appliance from a custom URL—either from a local URL to which you have downloaded
and copied the software, or from a URL given to you by Riverbed support.
1) If you are copying the file from a local URL, download the file and copy it to the local web server
2) Select Specify URL in the New Version pull-down menu, enter the URL, and click OK.
3) Check the Copy and Install check boxes and click Install.
Figure 52 System Tab—URL Dialog
Note: You can copy the Update to a desktop or notebook computer and follow the directions shown in
“Updating from a Local Host” on page 176.
Updating from a Local Host

Because of security concerns, some network configurations won’t allow a direct download to the appliance.
This method can be used to download the software Update to the appliance from another location (such as
your desktop computer).
The following steps describe this workflow:
1) From the Riverbed support site, using a valid support account, download the software to your desktop
computer.
2) In the New Version pull-down menu, select Specify Local File.
3) Browse for the Update file that you downloaded to your desktop computer and then click OK.
4) Check the Copy and Install check boxes and then click Update.
Figure 53 System Tab - Specify Local File Dialog
Once the operation begins, you can use the Status box to see the status. During the download and verify
stages, you may stop the process by clicking the Stop icon. However, if you do this, you lose what you have
already downloaded/verified and must start at the beginning.
WARNING: You must not stop the process during the staging and installing stages.

Software Update Options

In some cases, the AppResponse Appliance may have access to the Internet via a proxy. Click Options to
specify the proxy URL, and any user credentials, if needed. Proxy settings apply to downloads only. If you
upload an Update, your browser must be able to make a direct connection with the appliance.
Figure 54 System tab - Software Update Options Dialog
Updating Software on a Director

See Appendix 91 “Updating the Director and Connected Appliances in the Web UI” on page 735 of Director
User Guide.
Deleting Old Releases

Since a domain can include appliances running versions of the AppResponse Operating System older than
the Director, it is customary for Directors to maintain a set of Upgrades that allow any members of the
domain to Upgrade to the same release as the Director. Bear in mind that intermediate releases may be
needed to Upgrade to the current release on the Director.
When you install a new release, the old release stays on the system but is not installed. Once the you have
verified that the new release is running smoothly, select the delete release link to remove the old release.
Figure 55 System Tab - Update - Delete


APPENDIX B Removing Residual Data from
Appliance Disk Drives
To alleviate security concerns, all customer-specific data can be removed from AppResponse appliance disk
drives. This is especially useful when replacing and/or returning hardware.
The disk drives in an AppResponse appliance can be cleared of all customer-specific data using the
following utilities that are run from the CLI (Command Line Interface):
 “Rollback Utility”
Restores an AppResponse appliance to its default factory settings.
 “Diskwipe Utility”
Overwrites all unused disk space on one or all disk drives after rollback is completed.
 “ResetData Utility”
Deletes all metric data and captured packets, but retains configuration settings.
Rollback Utility
The Rollback utility restores an AppResponse appliance to its default factory settings. This means that all
customer-specific data is removed from the appliance, including:
 configuration settings
 data from database tables
 logs
 reports and report definitions
Diskwipe Utility
The DiskWipe utility overwrites all unused disk space on the specified disk drives. More specifically, in one
pass, the DiskWipe utility writes zeros to all blocks on the disk drive(s) that have no data. (The DiskWipe
Utility is similar to the dd unix command.)
Note: Because it writes to blocks that have no data, the DiskWipe utility should be run only after the
“Rollback Utility”.

Important Notes
Note the following:
 A rollback operation can take 10 to 20 minutes to complete, depending on the hardware model.
 The Rollback utility does not remove AppResponse software patches. Therefore, you do not need to
re-install software patches after Rollback.
Rollback and Diskwipe Procedure
Procedure 35 Performing a Rollback and Diskwipe
The rollback command has the following options:
--noshut
Do not shut down the appliance when rollback is completed. This optional argument is
especially useful when accessing the appliance remotely. When Rollback is complete, you can
re-add the management IP address without losing connectivity to the appliance.
--keeplicense
Do not delete the licenses during rollback. This optional argument is helpful if you want to use
the same licenses after the rollback.
3. Enter the rollback command with the options you want—for example:
rollback --noshut --keeplicense
Note—You must enter two hyphens before each argument.
When the rollback is complete, a CLI prompt asks if you want to run the diskwipe utility. This
utility overwrites all unused disk space on the specified disk drives; specifically, the utility writes
zeros to all blocks on the disk drive(s) that have no data. (This utility is similar to the dd command
in UNIX.)
4. If you choose to run diskwipe,now, enter one of the following commands:

option)
5. Enter a command from the menu, press return, and follow the prompts.
End of Procedure 35
Running DiskWipe in Stand-Alone Mode

The following procedure describes how to run the “Diskwipe Utility” after you run the “Rollback Utility”.
Because diskwipe writes to blocks that have no data, you should run diskwipe only after you run
rollback.
Procedure 36 Running DiskWipe in Stand-Alone Mode
1. If the rollback command was just run without the --noshut argument and the AppResponse
appliance is currently turned off, then turn on the appliance.
3. Login to the appliance as an administrator.
4. Enter the DiskWipe command:
diskwipe
The DiskWipe utility menu appears.
5. Enter an option from the utility menu, press return, and follow the prompts.
option)

End of Procedure 36
ResetData Utility
The resetData CLI command deletes all traffic data stored on the appliance, while retaining all
user-specified configurations. Situations in which this command can be useful include:
 The appliance was configured incorrectly, resulting in inaccurate data, so you correct the configuration
and delete the data collected using the previous configuration.
 You want to move the appliance to a new location that requires only minor changes to the appliance
configuration, so you reconfigure the appliance and delete all traffic data collected at the old location.
When you run the resetData command from the CLI, the following data is deleted:
 Metric data derived from monitored traffic, such as Application Stream Analysis, Web Transaction
Analysis, NetFlow Monitoring, and VoIP/Video Monitoring
 All packet capture data
 All generated reports
The following data is retained:
 All custom settings in the web UI
 All custom settings in the Desktop Console: Business Group Manager, Defined Application Manager,
Preferred IP Manager, and so on
 All certificate and private key information stored on the appliance (for example, in the Web UI >
System > Administration > Pages)
Note the following:
 The resetData command is case-sensitive: all lowercase except for the uppercase 'D'.
 You must be logged in to the CLI as a user with Administrator privileges to run this command.

APPENDIX C Software Updates Using the CLI
Alternatively from the System > Administration web UI, you can download and install software updates
using the CLI, which includes a release-update command. Before updating, be sure to back up the
system configuration to simplify error recovery in case an update fails.
Important Notes
Note the following:
 You cannot downgrade any appliance or director to a previous release.
 The CLI method is primarily intended for updating appliances that currently have 8.5.5 or earlier
installed. Riverbed recommends that you use the System > Administration web UI to update or
upgrade from 8.6.2 or higher, as described in
– “Software Updates from the Administration > System Web UI” on page 175
– “Updating the Director and Connected Appliances in the Web UI” (search the Director User
Guideor the online help).
 The CLI method requires a local FTP or HTTP server that is visible to the appliance you want to
update.
 If you do not have a local FTP or HTTP server, you can use the System > Administration web UI to
update the appliance.
release-update Commands
To download and install a new software release access the CLI, type release-update and press Enter.
The CLI displays the update menu which provides the following commands:
 download
Download a software release from a local web server. If the check command was run previously,
download provides a list of available software releases. If the check command has not been run, you
must provide the complete URL to a software JAR. The download command supports URLs with an
embedded username and password. This can be useful for transferring files from FTP servers
requiring authentication.
ftp://username:password@host/path
http://username:password@host/path
This command transfers the software release to the appliance but does not install it.

Software Updates Using the CLI
 install
Install a software release that has been downloaded to the appliance. This command provides a list of
software JARs that are currently stored on the appliance.
 delete
Delete a software release that has been downloaded to the appliance. The delete command provides
a list of releases that are currently on the appliance.
Note—Before you start using the CLI to update an appliance, it is good practice to delete any old JARs
that are still stored on the appliance. This frees up disk space that might be needed to store new JARs.
In this context, an “old JAR” corresponds to
– Any release that is not the currently installed release (for appliances)
– Any release that is neither the current release nor a release that needs to be installed on any
connected appliance. (for directors)
Suppose you want to install 9.0.3 on an 8.6.8 director. The director and all connected appliances have
been updated to 8.6.8, but the director still has several older release JARs in its storage area. Therefore,
you should delete all JARS for all releases up to but not including 8.6.8.
To remove old JARs from an appliance or director, do the following steps:
a) Log in to the director as a user with Administrator privileges, using an SSH-enabled program such
as putty.
b) Enter the following command: release-update
The CLI displays the AppResponse Software Update menu.
c) Enter the following command: releases
The CLI displays all releases that are currently stored on the director.
d) For all old JARs (neither the current release nor a release needed to update the director or a
connected appliance), run the following commands:
delete <release_number>
unpublish <release_number>
All JAR files for <release_number> are removed from the director.
e) For the release currently installed on the Director, run the following command:
unpublish <release_number>
You must perform this step for the currently installed release if it was installed on the director
using the CLI rather than the System > Administration web UI.
 log
Examine a software installation log. A new log file is created each time a software release is installed.
The log command provides a list of available software logs.
 proxy
Configure an HTTP proxy server used by the check and download commands
 check
Note—This command is useful only on an appliance that is connected to a director. To confirm all
connections in the domain, log in to the director for the Desktop Console and confirm all connections
under Tools > Domain Manager.

You can use this option to check for software releases on a connected director that are available for
downloading and installing. By default, an appliance connected to a director should show the
following path. (If this path is not displayed, log in to the director Desktop Console and check the
connection under Tools > Domain Manager.)
http://director-ip-or-name:8080/updates/releases.txt
 quit
Return to the main CLI menu.
release-current Command
The release-current CLI command displays the current software release running on the appliance.
This command does not take arguments.


APPENDIX D Berkeley Packet Filter Syntax
You can specify packet filters using the tcpdump expression format; you can then apply these filters to
packet captures and traffic monitoring, as described in the following sections of the AppResponse User
Guide:
 “Packet Captures”
 “Traffic Monitoring: Enabling, Disabling, and Applying Packet (BPF) Filters”
 “Starting, Stopping, and Configuring High-Speed Captures”
This section is extracted from the tcpdump documentation available at http://www.tcpdump.org/.
References to non-ethernet protocols should be ignored since the AppResponse Appliance only supports
Ethernet network interfaces.
Tcpdump Expressions
The expression consists of one or more primitives.
Tcpdump Primitives and Qualifiers

Primitives usually consist of an id (name or number) preceded by one or more qualifiers. There are three
different kinds of qualifier:
 type qualifiers say what kind of thing the id name or number refers to.
Possible types are host, net and port. E.g., “host foo”, “net 128.3”, “port 20”. If there is no type
qualifier, host is assumed.
 dir qualifiers specify a particular transfer direction to and/or from id.
Possible directions are src, dst, src or dst, and src and dst. E.g., “src foo”, “dst net 128.3”, “src
or dst port ftp-data”.
If there is no dir qualifier, src or dst is assumed. For `null' link layers (i.e., point-to-point protocols
such as slip) the inbound and outbound qualifiers can be used to specify a desired direction.
 proto qualifiers restrict the match to a particular protocol.
Possible protos are: ether, fddi, ip, ip6, arp, rarp, decnet, lat, sca, moprc, mopdl, iso, esis,
isis, icmp, icmp6, tcp, and udp. E.g., èther src foo', àrp net 128.3', `tcp port 21'.

Berkeley Packet Filter Syntax
If there is no proto qualifier, all protocols consistent with the type are assumed. E.g., “src foo” means
”(ip or arp or rarp) src foo” (except the latter is not legal syntax), ”net bar” means ”(ip or arp or rarp)
net bar” and ”port 53” means ”(tcp or udp) port 53.”
Additionally, there are special primitive keywords that don't follow the pattern: gateway, broadcast, less,
greater and arithmetic expressions. For a list of the allowable tcpdump primitives, see Table 16 on page 188.
More complex filter expressions are built up by using the words ‘and’, ‘or’ and ‘not’ to combine primitives.
E.g., `host foo and not port ftp and not port ftp-data'. To save typing, identical qualifier lists can be omitted.
E.g., `tcp dst port ftp or ftp-data or domain' is exactly the same as `tcp dst port ftp or tcp dst port ftp-data
or tcp dst port domain'.
Allowable Primitives
The following table lists the allowable tcpdump primitives.
Table 16 tcpdump Primitives

Primitive Description
dst host host True if the IPv4/v6 destination field of the packet is host, which may be either an
address or a name.
src host host True if the IPv4/v6 source field of the packet is host.
host host True if either the IPv4/v6 source or destination of the packet is host. Any of the
above host expressions can be prepended with the keywords, ip, arp, rarp, or ip6 as
in: ip host host which is equivalent to: ether proto \ip and host host If host is a name
with multiple IP addresses, each address is checked for a match.
ether dst ehost True if the ethernet destination address is ehost. Ehost may be either a name from
/etc/ethers or a number (see ethers(3N) for numeric format).
ether src ehost True if the ethernet source address is ehost.
ether host ehost True if either the ethernet source or destination address is ehost.
gateway host True if the packet used host as a gateway, i.e., the ethernet source or destination
address was host but neither the IP source nor the IP destination was host. Host
must be a name and must be found in both /etc/hosts and /etc/ethers. (An
equivalent expression is ether host ehost and not host host which can be used with
either names or numbers for host / ehost.) This syntax does not work in
IPv6-enabled configuration at this moment.
dst net net True if the IPv4/v6 destination address of the packet has a network number of net.
Net may be either a name from /etc/networks or a network number (see
networks(4) for details).
src net net True if the IPv4/v6 source address of the packet has a network number of net. net
net True if either the IPv4/v6 source or destination address of the packet has a
network number of net.
net net mask mask True if the IP address matches net with the specific netmask. May be qualified with
src or dst. Note that this syntax is not valid for IPv6 net.
net net/len True if the IPv4/v6 address matches net a netmask len bits wide. May be qualified
with src or dst.

Table 16 tcpdump Primitives (Continued)

dst port port True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a destination port
value of port. The port can be a number or a name used in /etc/services (see tcp(4P)
and udp(4P)). If a name is used, both the port number and protocol are checked. If a
number or ambiguous name is used, only the port number is checked (e.g., dst port
513 prints both tcp/login traffic and udp/who traffic, and port domain prints both
tcp/domain and udp/domain traffic).
src port port True if the packet has a source port value of port.
port port True if either the source or destination port of the packet is port. Any of the above
port expressions can be prepended with the keywords, tcp or udp, as in: tcp src port
port which matches only tcp packets whose source port is port.
less length True if the packet has a length less than or equal to length. This is equivalent to: len
<= length.
greater length True if the packet has a length greater than or equal to length. This is equivalent to:
len >= length.
ip proto protocol True if the packet is an ip packet (see ip(4P)) of protocol type protocol. Protocol can
be a number or one of the names icmp, igrp, udp, nd, or tcp. Note that the identifiers
tcp, udp, and icmp are also keywords and must be escaped via backslash (\), which
is \\ in the C-shell. Note that this primitive does not chase protocol header chain.
ip6 proto protocol True if the packet is an IPv6 packet of protocol type protocol. Note that this primitive
does not chase protocol header chain.
ip6 protochain True if the packet is IPv6 packet, and contains protocol header with type protocol in
protocol its protocol header chain. For example, ip6 protochain 6 matches any IPv6 packet
with TCP protocol header in the protocol header chain. The packet may contain, for
example, authentication header, routing header, or hop-by-hop option header,
between IPv6 header and TCP header. The BPF code emitted by this primitive is
complex and cannot be optimized by BPF optimizer code in tcpdump, so this can be
somewhat slow.
ip protochain protocol Equivalent to ip6 protochain protocol, but this is for IPv4.
ether broadcast True if the packet is an ethernet broadcast packet. The ether keyword is optional.
ip broadcast True if the packet is an IP broadcast packet. It checks for both the all-zeroes and
all-ones broadcast conventions, and looks up the local subnet mask.
ether multicast True if the packet is an ethernet multicast packet. The ether keyword is optional. This
is shorthand for èther[0] & 1!= 0'.
ip multicast True if the packet is an IP multicast packet.
ip6 multicast True if the packet is an IPv6 multicast packet.
ether proto protocol True if the packet is of ether type protocol. Protocol can be a number or a name like
ip, ip6, arp, or rarp. Note these identifiers are also keywords and must be escaped
via backslash (\). [In the case of FDDI (e.g., `fddi protocol arp'), the protocol
identification comes from the 802.2 Logical Link Control (LLC) header, which is
usually layered on top of the FDDI header. Tcpdump assumes, when filtering on the
protocol identifier, that all FDDI packets include an LLC header, and that the LLC
header is in so-called SNAP format.]
ip, ip6, arp, rarp Abbreviations for: ether proto p where p is one of the above protocols.
lat, moprc, mopdl Abbreviations for: ether proto p where p is one of the above protocols. Note that
tcpdump does not currently know how to parse these protocols.

Table 16 tcpdump Primitives (Continued)

vlan [vlan_id] True if the packet is an IEEE 802.1Q VLAN packet. If [vlan_id] is specified, only
encountered in expression changes the decoding offsets for the remainder of
expression on the assumption that the packet is a VLAN packet.
tcp, udp, icmp Abbreviations for: ip proto p or ip6 proto p where p is one of the above protocols.
expr relop expr True if the relation holds, where relop is one of >, <, >=, <=, =, !=, and expr is an
arithmetic expression composed of integer constants (expressed in standard C
syntax), the normal binary operators [+, -, *, /, &, |], a length operator, and special
packet data accessors. To access data inside the packet, use the following syntax:
proto [expr: size] Proto is one of ether, fddi, ip, arp, rarp, tcp, udp, icmp or ip6, and
indicates the protocol layer for the index operation. Note that tcp, udp and other
upper-layer protocol types only apply to IPv4, not IPv6 (this will be fixed in the
future). The byte offset, relative to the indicated protocol layer, is given by expr. Size
is optional and indicates the number of bytes in the field of interest; it can be either
one, two, or four, and defaults to one. The length operator, indicated by the keyword
len, gives the length of the packet.
End of Table D-36
For example, èther[0] & 1 != 0' catches all multicast traffic. The expression ìp[0] & 0xf != 5' catches all IP
packets with options. The expression ìp[6:2] & 0x1fff = 0' catches only unfragmented datagrams and frag
zero of fragmented datagrams. This check is implicitly applied to the tcp and udp index operations. For
instance, tcp[0] always means the first byte of the TCP header, and never means the first byte of an
intervening fragment.
Combining Primitives
Primitives may be combined using:
 A parenthesized group of primitives and operators (parentheses are special to the Shell and must be
escaped).
 Negation (`!' or `not')
 Concatenation (`&&' or ànd')
 Alternation (`||' or òr')
Negation has highest precedence. Alternation and concatenation have equal precedence and associate left
to right. Note that explicit and tokens, not juxtaposition, are now required for concatenation.
If an identifier is given without a keyword, the most recent keyword is assumed. For example, not host vs
and ace is short for not host vs and host ace which should not be confused with not (host vs or ace).
Expression arguments can be passed to tcpdump as either a single argument or as multiple arguments,
whichever is more convenient. Generally, if the expression contains Shell metacharacters, it is easier to pass
it as a single, quoted argument. Multiple arguments are concatenated with spaces before being parsed.

APPENDIX E Expansion Chassis Setup and
Administration
The Expansion Chassis enables you to extend the storage capacity for high-speed captures on an
AppResponse appliance that supports High Speed Captures such as the AL-4100, ARX-4200, ARX-4300,
ARX-5000, ARX-5100, or ARX-6000. The Expansion Chassis uses a pre-configured RAID (R6) array of hard
drives. You can monitor these hard drives and the overall Expansion Chassis system using the
command-line interface (CLI) on an AL-4100, ARX-4200, ARX-4300, ARX-5000, ARX-5100, or ARX-6000
appliance.
Important Notes and Warnings

Note the following:
 The Expansion Chassis package includes a 1-meter SAS cable. Riverbed recommends that you mount
the Expansion Chassis within 1 meter of the appliance. A 2-meter cable is available by special order.
 Each Expansion Chassis is configured at the factory to operate with a specific appliance. The shipping
information specifies the appliance to which the Expansion Chassis should be attached.
WARNING: When turning on the appliances, first apply power to the Expansion Chassis and wait for a few
seconds until the blue indicator lights for all hard drives come on. Only then is it safe to apply power to the
appliance.
WARNING: When turning off the appliance, first shut down the appliance using the halt command in the
CLI or the Shutdown command available under Administration > System > Action (you must be logged in
as admin to shut down the appliance). Wait for the appliance to power down completely after you shut it down.
Do not turn off the Expansion Chassis until the power light on the appliance goes off.
WARNING: The RAID card in the appliance does not support hot swapping. Before you connect or
disconnect an Expansion Chassis SAS interface cable (SFF-8080), make sure that the power light on the
appliance is off.
The following table shows the expansion chassis models that are compatible with each appliance model.

Expansion Chassis Setup and Administration
Expansion Chassis Compatibility by Appliance Model

The following table shows the expansion chassis models that are compatible with each appliance model.
Table 17 Expansion Chassis Compatibility by Appliance Model

S16 EXP-200 EXP-300
AL-4100 X X
(expansion card required)
ARX-4200 X X
ARX-4300 X
ARX-5000 X X
ARX-5100 X
ARX-6000 X
(includes two controllers)
Installing and Configuring an Expansion Chassis

Follow these procedures to attach one or more Expansion Chassis to an appliance and configure them to
operate together:
 “Step 1: Connect the Appliance and Expansion Chassis” on page 193
 “Step 2: Set Up the Expansion Chassis Disks” on page 199

Step 1: Connect the Appliance and Expansion Chassis

Use the following procedure to connect the Expansion Chassis to the appliance.
Procedure 37 Connecting the Appliance to One or More Expansion Chassis

Warning—Before proceeding, verify that the appliance and all Expansion Chassis (if any) are powered off.
1. Install the new Expansion Chassis in the equipment rack close to the appliance (the supplied SAS cable
is 1 meter in length).
2. Using the supplied AC power cords, connect the power supplies in each Expansion Chassis to a
conditioned power source.
3. Connect the appliance to the expansion chassis using SFF-8080 cables, based on your appliance and
Expansion Chassis model:
• “4100, 4200, and 5000 Appliance Connectivity with S-16 Expansion Chassis” on page 193
• “4100, 4200, and 5000 Appliance Connectivity with EXP-200 Expansion Chassis” on page 194
• “4300 and 5100 Appliance Connectivity with EXP-300 Expansion Chassis” on page 195
• “6000 Appliance Connectivity with EXP-300 Expansion Chassis” on page 197
4. Proceed to “Step 2: Set Up the Expansion Chassis Disks” on page 199.
End of Procedure 37
4100, 4200, and 5000 Appliance Connectivity with S-16 Expansion Chassis
To attach a 4100, 4200, or 5000 appliance to one, two, or three S16 expansion chassis devices, connect the
ports as indicated in Table 18 and Figure 56. Always use SFF-8080 cables.
After you finish connecting the appliance and chassis, proceed to “Step 2: Set Up the Expansion Chassis
Disks” on page 199.
Table 18 4100 / 4200 / 5000 Appliance Connectivity

with S16 Expansion Chassis
Device (Port) Device (Port)
appliance (expansion card, port B, bottom) chassis 1 (expansion card, port A, top)
chassis 1 (expansion card, port B, bottom) chassis 2 (expansion card, port A, top)
chassis 2 (expansion card, port B, bottom) chassis 3 (expansion card, port A, top)

Figure 56 4200 / 5000 Appliance Connectivity with S16 Expansion Chassis
Appliance
(expansion card, slot 5)
Expansion Chassis #1
4100, 4200, and 5000 Appliance Connectivity with EXP-200 Expansion Chassis
To attach a 4100, 4200, or 5000 appliance to one, two, or three EXP-200 expansion chassis devices, connect
the ports as indicated in Table 19 and Figure 57. Always use SFF-8080 cables.
Table 19 4100 / 4200 / 5000 Appliance Connectivity

with S16 / EXP-200 Expansion Chassis
appliance (expansion card, port B, bottom) chassis 1 (expansion card IN port, left)
chassis 1 (expansion card OUT port, right) chassis 2 (expansion card IN port, left)
chassis 2 (expansion card OUT port, right) chassis 3 (expansion card IN port, left

Figure 57 4100 / 4200 / 5000 Appliance Connectivity with EXP-200 Expansion Chassis
4300 and 5100 Appliance Connectivity with EXP-300 Expansion Chassis

To attach an ARX-4300 or ARX-5100 appliance to one or two EXP-300 expansion chassis, connect the ports
as indicated in Table 20 (below) and Figure 58 (next page). Always use SFF-8080 cables that are no longer than
1 meter.
Table 20 5100 or 4300 Appliance Connectivity

with EXP-300 Expansion Chassis
appliance (SAS-OUT) chassis 1 (A1-IN bottom left)
chassis 1 (A2-IN top left) chassis 1 (A1-OUT bottom right)
chassis 1 (A2-OUT top right) chassis 2 (A1-IN bottom left)
chassis 2 (A2-IN top left) chassis 2 (A1-OUT bottom right)

Figure 58 Port Connectivity between 4300 / 5100 Appliance and 300 Expansion Chassis
SAS-OUT port on 4300 /

5100 appliance
4300 / 5100 appliance
SAS-OUT
expansion chassis #1
A2-IN A2-OUT
A1-IN A1-OUT
A2-IN A2-OUT
A1-IN A1-OUT
IN / OUT ports on expansion chassis
A2-IN A2-OUT
A1-IN A1-OUT

6000 Appliance Connectivity with EXP-300 Expansion Chassis

To attach an ARX-6000 appliance to one, two, or three EXP-300 expansion chassis, connect the ports as
indicated in Table 21 (below) and Figure 59 (next page). Always use SFF-8080 cables.
Disks” on page 199
Table 21 ARX-6000 Port Connectivity with EXP-300 Expansion Chassis

appliance (A2-OUT left) chassis 1 (A2-IN top left)
appliance (A1-OUT right) chassis 1 (A1-IN bottom left)
chassis 1 (A2-OUT top right) chassis 2 (A2-IN top left)
chassis 1 (A1-OUT bottom right) chassis 2 (A1-IN bottom left)
chassis 2 (A2-OUT top right) chassis 3 (A2-IN top left)
chassis 2 (A1-OUT bottom right) chassis 3 (A1-IN bottom left)

Figure 59 ARX-6000 Port Connectivity with EXP-300 Expansion Chassis
ARX-6000 appliance
A2-OUT A1-OUT
A2-IN A2-OUT
A1-IN A1-OUT
A2-IN A2-OUT
A1-IN A1-OUT
A2-IN A2-OUT
IN / OUT ports on expansion chassis

A1-IN A1-OUT
A2-IN A2-OUT
A1-IN A1-OUT

Step 2: Set Up the Expansion Chassis Disks

This step mounts the new hard drives and configures AppResponse to use them.
Procedure 38 Setting Up the Expansion Chassis Disks

Note: This procedure requires AppResponse version 8.0.8 or higher (for 4100, 4200, and 5000
appliances) and 8.6.8 or higher (for 4300, 5100, and 6000 appliances). If the appliance does not have an
appropriate version installed, contact Technical Support for upgrade assistance.
1. Apply power to each Expansion Chassis and wait for a few seconds until the blue indicator lights for
all hard drives come on. Then apply power to the appliance.
2. Open a CLI window and log in to the appliance as admin.
3. If you are setting up a new (never used) EXP-300 expansion chassis connected to a 4300 or 5100 appliance,
do step 3.1..
For all other setup scenarios, skip this step and proceed to step 4..
3.1. Run one of the following commands, depending on the appliance model:
exenroll 4300
exenroll 5100
4. Run the command:
exls
For each expansion chassis, the CLI shows the serial number (Label), the disk ID (Disk), and the
mount point (Mounted On). If an Expansion Chassis has not been set up, it appears as
UNENROLLED in the Mounted On column. Here are some examples:
200 Expansion Chassis connected to 4200 or 5000 appliance:

# exls
Label Disk Mounted On
00063005A01 da3p1 UNENROLLED
00063001A01 da2p1 UNENROLLED
300 Expansion Chassis connected to 4300 or 5100 appliance:

# exls
NADE3300002BA01 mfid2p1 UNENROLLED
NADE3300002TA01 mfid3p1 UNENROLLED
300 Expansion Chassis connected to 6000 appliance:

# exls
Label Disk Mounted on
NADE3300001A01 stripe/NADE3300001GSp1 UNENROLLED
5. For each Expansion Chassis that is listed as UNENROLLED in the Mounted On column, run the
command:

exenroll <serial-number>
Each specified Expansion Chassis is configured for operation.
6. Verify that each Expansion Chassis was added by running the exls command again. For example, the
following sample shows that all Expansion Chassis are mounted and ready for use:
# exls
Label Disk Mounted on
NADE3300002BA01 mfid2p1 /ex/1/0
NADE3300002TA01 mfid3p1 /ex/2/0
End of Procedure 38
Viewing RAID Status on the Appliance

The following utilities provide information about the operation of attached disk arrays:
 “raid Utility”
 “tw_cli Utility (4200 and 5000 Appliances Only)”
raid Utility
raid is a command-line program that is useful for viewing high-level array and device information for
both internal and external RAID controllers. To view high-level information about all RAID controllers,
arrays, and devices, do the following:
1) Open a CLI window and log in to the appliance as admin.
2) Run the command:

raid
3) From the RAID menu, run the command:

status
Figure 60 shows an example of RAID status command output from an appliance with one EXP-300
expansion chassis.
Figure 60 raid status Output (Example)

RAID menu: status
ARX6000-000000 (rev. 2013-08)
mfi0/0 status as of 2013/08/13-01:10:42 GMT: ONLINE
Model Serial SMART Port

Disk VD Name Number Number Status Status
1 0 0:252:00 ST480FN0021 P3Y010AE OK Online, Spun Up
2 0 0:252:01 ST480FN0021 P3Y010FB OK Online, Spun Up
3 0 0:252:02 ST480FN0021 P3Y0114E OK Online, Spun Up
4 0 0:252:03 ST480FN0021 P3Y01140 OK Online, Spun Up

Volumes: Volume Volume RAID Volume Volume

ID Name Level Size Status
VD0/0 ARX6000OS 5 1TB Optimal
Volumes:
Volume Volume RAID Volume Volume
VD0/0 ARX6000OS 5 1TB Optimal
Model Serial SMART Port

1 0 1:245:00 ST3000NM0033-9ZM178 Z1Y02D05 OK Online, Spun Up
Volumes:
VD1/0 ARX6000GSB 6 18TB Optimal
VD1/1 E3B 6 18TB Optimal



Volumes:
VD2/0 ARX6000GST 6 18TB Optimal
VD2/1 E3T 6 18TB Optimal
tw_cli Utility (4200 and 5000 Appliances Only)

tw_cli is a command-line utility for RAID controllers. This utility is not supported on 4300, 5100, or 6000
appliance models.
You can run this utility from the CLI using the raid command as described in “raid Utility”. To view the
status for a specific controller, run the command:
tw_cli /cn show
where n is the controller number. For example, for the status of Controller 0, enter:
tw_cli /c0 show
Troubleshooting Expansion Chassis Operations
Issue: (File System) Does Not Exist or Is Not Mounted
After you install and configure the appliance, you can run the exls command to see the file system on the
expansion chassis:
cmd# exls
NADE3300001A01 /ex/1/0
NADE3300002A01 /ex/2/0
If the file system does not appear, repeat the steps in “Installing and Configuring an Expansion Chassis” on
page 192 to ensure that the file system is configured and mounted correctly.
If this does not resolve the issue, contact Riverbed Technical Support.
Configuring Storage on Expansion Chassis

You can specify the percentage of disk space to reserve on each Expansion Chassis for
 captured packets (Rolling Buffer)
 alert snapshots (Snapshot Buffer)
 individual page views (Web Transaction Analysis)

Figure 61 Expansion Chassis Configuration Options (Administration > System > Capture Page)
The Administration > System > Capture web page includes storage configuration options for every
Expansion Chassis that is connected to the appliance. The following steps outline the general workflow:
1) Specify the percentage of total disk space reserved for Rolling Packet Storage.
The Remaining Storage label updates automatically based on the new percentage.
2) Specify the percentage of remaining disk space reserved for alert snapshots and individual page views.
The Snapshot Storage and Individual Pages Storage fields update automatically based on the new
percentage.
3) Repeat this process for each Expansion Chassis that is connected to the appliance.
4) Scroll to the bottom of the page and click Apply.
Note: The configuration options for each expansion chassis are stored on the chassis itself, not on the
appliance to which it is attached. This ensures that the chassis configuration is persistent even if you move
the chassis to a different appliance.
Removing an Expansion Chassis

Warning—Failure to perform this procedure exactly as described might result in loss of data or other issues.
Procedure 39 Removing an Expansion Chassis from an Appliance
1. Log in to the appliance as admin.
2. Power down the appliance and Expansion Chassis exactly as described in the following steps.
2.1. Power down the appliance using the halt command in the CLI or the Shutdown command (in
the Administration > System > Action treeview).
2.2. Wait for the power light on the appliance to turn off so that you are sure that the appliance is
powered down completely.

2.3. Press the Power button the Expansion Chassis and wait for it to power down completely.
3. Remove the power cord and SAS cable from the Expansion Chassis.
End of Procedure 39

Index
A ARX-5100
activate an extended feature, adm-1-36, overview, adm-2-91
adm-1-66 ARX-6000
alerts back panel, adm-2-116
appliance, adm-1-45 overview, adm-2-91
descriptions, adm-1-53, adm-1-55
hardware, adm-1-50 B
heartbeat, adm-1-45 backup and recovery
other, adm-1-50 backup
settings, adm-1-51 global vs. local, adm-4-149
software, adm-1-50 on-demand, adm-4-158
syslog, adm-1-41 pre-configurations and verifications, adm-4-151
appliance schedule, adm-4-154
available models, adm-2-91
servers, adm-4-152
BGP, adm-2-99
installation, adm-2-89 view list of, adm-4-160
physical configuration, adm-2-91 best practices and guidelines,
appliance information window, adm-1-17 adm-4-165
appliance overview, adm-2-90 error logs, adm-4-167
ARX-1200 estimate backup/recovery time,
back panel, adm-2-105, adm-2-107 adm-4-165
ARX-2100 general workflow, adm-4-149
back panel, adm-2-106 introduction, adm-4-148
overview, adm-2-91 recovery
ARX-3100 different appliance, adm-4-163
overview, adm-2-91 guidelines, adm-4-165
ARX-3170 partial, adm-4-162
back panel, adm-2-109, adm-2-111
same appliance, adm-4-161
ARX-3200
back panel, adm-2-108 SSH vs. FTP protocol, adm-4-165
overview, adm-2-91 troubleshoot, adm-4-167
ARX-3300 BGP and the appliance, adm-2-99
overview, adm-2-91 BGP settings, adm-2-133
ARX-3700 bundles
back panel, adm-2-110 core, adm-1-47
overview, adm-2-91 log, adm-1-47
ARX-4100 web interface, adm-1-47
front panel, adm-2-122 C
ARX-4100-S16 CLI
back panel, adm-2-117 software updates, adm-C-183
ARX-4200 cli
back panel, adm-2-112 installation, adm-2-128
overview, adm-2-91 configure number of span ports during
ARX-4300 installation, adm-2-133
overview, adm-2-91 configuring
ARX-5000 using the cli, adm-2-129
back panel, adm-2-113 to adm-2-115
overview, adm-2-91

D
copper tap, adm-2-97 host name, adm-2-132

core bundles, adm-1-47 HSCBADPKT (hardware alert), adm-1-53
COREFILE (software alert), adm-1-55 HSCPKTLSS (software alert), adm-1-56
CPUCNT (hardware alert), adm-1-53
CPUTEMP (hardware alert), adm-1-53 I
installation
CPUTEMPMARG (hardware alert),
ACE Live appliance, adm-2-89
adm-1-53
additional information, adm-2-99
D appliance installation procedure,
DAQERR (software alert), adm-1-55 adm-2-124
deduplication, adm-1-51 cli, adm-2-128
DIAGINT (software alert), adm-1-55 inventory, adm-2-104
diagnostic reports network coverage, adm-2-97
automatic, adm-1-47 network placement considerations,
email, adm-1-49 adm-2-97
manual, adm-1-47 preparation sheet, adm-2-103
status, adm-1-60 rackmount, adm-2-125
web interface, adm-1-49, adm-1-60 span port, adm-2-133
diagnostics, adm-1-47 web interface, adm-2-130
alert descriptions, adm-1-53, adm-1-55 wiring the appliance using a span port,
alert setttings, adm-1-51 adm-2-126
alerts, adm-1-50 wiring the appliance using a tap,
bundle, adm-1-47 adm-2-127
log viewer, adm-1-60 internal address list, adm-2-93,
reports, adm-1-49 adm-2-97, adm-2-134
status, adm-1-60 internal services, adm-2-101
director ip address, adm-2-132
software update, adm-A-177
DISKIO (hardware alert), adm-1-53 L
last internal as, adm-2-133
DMCNAPPL (software alert), adm-1-55
license
DMCNDIR (software alert), adm-1-55
appliance, adm-1-65
DMCNSYNC (software alert), adm-1-55
software, adm-1-65
dmq, adm-1-37
license key, adm-1-65
dns, adm-2-133
license manager, adm-1-65
domain, adm-2-129, adm-2-132
licensing
DPLIMEXC (software alert), adm-1-55
extended feature, adm-1-66
dual span port, adm-2-96
log bundles, adm-1-47
E log viewer
email web interface, adm-1-60
diagnostic reports, adm-1-49 login, adm-1-21
encapsulation, adm-2-98
encryption, adm-2-98 M
mailmgr, adm-1-36
external services, adm-2-99
management console
F troubleshooting, adm-3-145
FANRPM (hardware alert), adm-1-53 management interface, adm-2-132
features not visible, adm-1-65 management nic, adm-2-132
fiber tap, adm-2-97 manager
firewall configuration, adm-2-99 user admiin, adm-1-27
FLOWPKTLSS (software alert), adm-1-55 MIPMAPCHK (software alert), adm-1-56
flowstats, adm-1-44 modified frame formats, adm-2-98
fset, adm-1-38 mta_mail_hub, adm-1-36
FSFREE (software alert), adm-1-55 mta_masq_domain, adm-1-36
mta_relay, adm-1-36
G mta_relay_port, adm-1-36
gateway, adm-2-129, adm-2-132
N
H NETFLOWDRP (software alert),
halt, adm-1-39
adm-1-56
hardware alerts
NETGW (software alert), adm-1-56
web interface, adm-1-50
netmask, adm-2-132
network address translation, adm-2-99
network configuration settings,

O
adm-2-132 setup, adm-1-33

network placement, adm-2-97 single span port, adm-2-96
802.1q, adm-2-98 SMARTSTATUS (software alert),
asymmetric traffic, adm-2-97 adm-1-57
encapsulation, adm-2-98 snmp
encryption, adm-2-98 agent port, adm-1-46
header obscurity, adm-2-98 community string, adm-1-45
isl, adm-2-98 enable/disable snmp agent, adm-1-45
jumbo frames, adm-2-98 trap destination, adm-1-45
maximum traffic rate, adm-2-97 software alerts
modified frame formats, adm-2-98 web interface, adm-1-50
network address translation, adm-2-99 software update
network coverage, adm-2-97 appliance, adm-A-175
security considerations, adm-2-99 deleting old releases, adm-A-177
span port, adm-2-97 director, adm-A-177
tunneling, adm-2-98 web ui, adm-A-175
NICCNT (hardware alert), adm-1-53 software updates in CLI, adm-C-183
NICDOWN (hardware alert), adm-1-53 span port
NICPKLIM (software alert), adm-1-56 installation, adm-2-133
NICPKTLSS (hardware alert), adm-1-54 physical configuration, adm-2-97
NOTIFCHK (software alert), adm-1-57 SQLCHK (software alert), adm-1-57
NOTIFCON (software alert), adm-1-57 SQLCON (software alert), adm-1-57
np appliance SQLRST (software alert), adm-1-57
troubleshooting, adm-3-141 to adm-3-142 SYSCRASH (software alert), adm-1-57
verifying operations, adm-3-141 syslog alerts, adm-1-41
NTP public server, adm-2-134 SYSPWR (hardware alert), adm-1-54
NTPCON (software alert), adm-1-57 SYSREBOOT (software alert), adm-1-57
ntps, adm-2-134 system requirements
O SYSTEMP (hardware alert), adm-1-54
other alerts
web interface, adm-1-50 T
tcp dump
P expression format, adm-D-187
PHYEM (hardware alert), adm-1-54
time zone, adm-2-134
physical configuration, adm-2-91
traceroute
copper/fiber tap, adm-2-97
firewall configuration, adm-2-102
dual span port, adm-2-96
traceroutes
single span port, adm-2-96
automated, adm-1-43
physical configurations, adm-2-91
selection algorithm, adm-1-43
port
types, adm-1-43
dual span, adm-2-96
traffic filters, adm-1-62
single span, adm-2-96
traffic symmetry, adm-2-97
ports
traffic volume, adm-2-97
used for network communications,
troubleshooting, adm-3-141
adm-2-99
management console, adm-3-145
preparation sheet, adm-2-103
np appliance, adm-3-142
privileges, adm-1-29
R
rackmount and wire the appliance, U
Updating
adm-2-125
software in CLI, adm-C-183
radius, adm-1-23
user admin manager, adm-1-27
RAIDSTATUS (software alert), adm-1-57
reboot, adm-1-39 V
recovery. See backup and recovery verifying operations, adm-3-141
release-current, adm-C-185 viewlog, adm-1-37
release-list, adm-C-185 VOIPLICENSE (software alert), adm-1-58
release-update command, adm-C-183
restore. See backup and recovery W
S alerts, adm-1-50
services diagnostic reports, adm-1-49,
internal and external, adm-2-99 adm-1-60
diagnostics page, adm-1-47
log viewer, adm-1-60

W
logging in, adm-1-21

ports page, adm-1-64
snmp page, adm-1-46
software update, adm-A-175
system requirements, adm-2-130
traceroute, adm-1-44
troubleshooting, adm-3-144
web interface system setup page,
adm-2-132
WEBCON (software alert), adm-1-58
WEBGET (software alert), adm-1-58
wire the Appliance using a span port,
adm-2-126

712 00244 06 Appresponse Admin Guide.9.6 PDF

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

712 00244 06 Appresponse Admin Guide.9.6 PDF

Hochgeladen von

Copyright:

Verfügbare Formate

SteelCentral™ AppResponse

This Documentation and Riverbed

Terms and Conditions of Use

Intellectual Property and Proprietary Notices

Restricted Rights Legend

No Warranty and Limitation of Liability

Destination Control Statement

Chapter 1 - Administration and Maintenance ....................................................................................... 11

SteelCentral AppResponse/Release 9.6 5

Setting Up Private-Address to AS-Number Maps................................................................................. 40

6 SteelCentral AppResponse/Release 9.6

Password Complexity Support................................................................................................................. 78

Chapter 2 - Installing the Appliance ...................................................................................................... 89

SteelCentral AppResponse/Release 9.6 7

AppResponse Expansion Chassis 300 ..................................................................................... 119

Chapter 3 - Verifying Appliance Operations ....................................................................................... 141

Chapter 4 - Backup and Recovery of Appliance Data ........................................................................ 147

8 SteelCentral AppResponse/Release 9.6

Best Practices and Guidelines for Backup and Recovery.................................................................... 165

Appendix B - Removing Residual Data from Appliance Disk Drives.................................................179

Appendix C - Software Updates Using the CLI....................................................................................183

Appendix D - Berkeley Packet Filter Syntax ........................................................................................187

Appendix E - Expansion Chassis Setup and Administration.............................................................191

SteelCentral AppResponse/Release 9.6 9

Installing and Configuring an Expansion Chassis............................................................................... 192

Index ....................................................................................................................................................... 205

10 SteelCentral AppResponse/Release 9.6

For more information, see:

 “Configuring Traffic Filters” on page 62

12 SteelCentral AppResponse/Release 9.6

Figure 1 Audit Log

Figure 2 Audit log - Show Selector

SteelCentral AppResponse/Release 9.6 13

Procedure 1 Showing/Hiding Fields in the Audit Log

1. Click the Show/Hide columns icon in the Audit Log.

Figure 3 Audit Log - Show/Hide Columns Button

The Show/Hide Columns Window appears.

Figure 4 Audit log - Show/Hide Columns Window

14 SteelCentral AppResponse/Release 9.6

Export via Web URL

SteelCentral AppResponse/Release 9.6 15

Export via CLI

16 SteelCentral AppResponse/Release 9.6

Appliance Information Window

Figure 5 Appliance Information Window

SteelCentral AppResponse/Release 9.6 17

Using the Command Line Interface

Accessing the Command Line Interface

Figure 6 Command Line Interface - Help

18 SteelCentral AppResponse/Release 9.6

SteelCentral AppResponse/Release 9.6 19

Administration > System Web Interface

20 SteelCentral AppResponse/Release 9.6

Accessing the Administration > System Web Interface

Procedure 2 Accessing the Web Interface

1. Access the web interface using one of the following methods:

• Open View > Web Interface…

3. Type the AppResponse Appliance Password for the user account.

5. Choose Administration > System in the Web Console navigation treeview.

User Accounts in the Web Interface

SteelCentral AppResponse/Release 9.6 21

22 SteelCentral AppResponse/Release 9.6

Managing User Accounts

# -- text --