SteelCentral Controller for SteelHead Mobile User s Guide. Version 4.7 March 2015

Transcription

1 SteelCentral ler for SteelHead Mobile User s Guide Version 4.7 March 2015

2 Riverbed Technology 680 Folsom Street San Francisco, CA Phone: Fax: Web: Part Number

3 2015 Riverbed Technology, Inc. All rights reserved. Riverbed, SteelApp, SteelCentral, SteelFusion, SteelHead, SteelScript, SteelStore, Steelhead, SteelHead (in the cloud), SteelHead (virtual edition), Granite, SteelHead Interceptor, Stingray, Whitewater, WWOS, RiOS, Think Fast, AirPcap, BlockStream, FlyScript, SkipWare, TrafficScript, TurboCap, WinPcap, Mazu, OPNET, and Cascade are all trademarks or registered trademarks of Riverbed Technology, Inc. (Riverbed) in the United States and other countries. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein cannot be used without the prior written consent of Riverbed or their respective owners. Akamai and the Akamai wave logo are registered trademarks of Akamai Technologies, Inc. SureRoute is a service mark of Akamai. Apple and Mac are registered trademarks of Apple, Incorporated in the United States and in other countries. Cisco is a registered trademark of Cisco Systems, Inc. and its affiliates in the United States and in other countries. EMC, Symmetrix, and SRDF are registered trademarks of EMC Corporation and its affiliates in the United States and in other countries. IBM, iseries, and AS/400 are registered trademarks of IBM Corporation and its affiliates in the United States and in other countries. Juniper Networks and Junos are registered trademarks of Juniper Networks, Incorporated in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States and in other countries. Microsoft, Windows, Vista, Outlook, and Internet Explorer are trademarks or registered trademarks of Microsoft Corporation in the United States and in other countries. Oracle and JInitiator are trademarks or registered trademarks of Oracle Corporation in the United States and in other countries. UNIX is a registered trademark in the United States and in other countries, exclusively licensed through X/Open Company, Ltd. VMware, ESX, ESXi are trademarks or registered trademarks of VMware, Inc. in the United States and in other countries. This product includes Windows Azure Linux Agent developed by the Microsoft Corporation ( Copyright 2012 Microsoft Corporation. This product includes software developed by the University of California, Berkeley (and its contributors), EMC, and Comtech AHA Corporation. This product is derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm. The SteelHead Mobile ler (virtual edition) includes VMware Tools. Portions Copyright VMware, Inc. All Rights Reserved. NetApp Manageability Software Development Kit (NM SDK), including any third-party software available for review with such SDK which can be found at and are included in a NOTICES file included within the downloaded files. For a list of open source software (including libraries) used in the development of this software along with associated copyright and license agreements, see the Riverbed Support site at https//support.riverbed.com. This documentation is furnished AS IS and is subject to change without notice and should not be construed as a commitment by Riverbed. This documentation may not be copied, modified or distributed without the express authorization of Riverbed and may be used only in connection with Riverbed products and services. Use, duplication, reproduction, release, modification, disclosure or transfer of this documentation is restricted in accordance with the Federal Acquisition Regulations as applied to civilian agencies and the Defense Federal Acquisition Regulation Supplement as applied to military agencies. This documentation qualifies as commercial computer software documentation and any use by the government shall be governed solely by these terms. All other use is prohibited. Riverbed assumes no responsibility or liability for any errors or inaccuracies that may appear in this documentation. SteelCentral ler for SteelHead Mobile User s Guide v

4 vi SteelCentral ler for SteelHead Mobile User s Guide

5 Contents Preface...1 About This Guide...1 Audience...2 Document Conventions...2 Documentation and Release Notes...2 Contacting Riverbed...3 Chapter 1 - Overview of SteelCentral ler for SteelHead Mobile...5 Hardware and Software Dependencies...5 Overview of the SteelCentral ler for SteelHead Mobile Solution...6 Definition of Terms...7 Mobile ler Administration Tasks...7 What Are Policies?...8 What Are Packages?...8 What Are Group Assignments?...8 What Are Clusters?...9 Using the Management Console...9 Connecting to the Management Console...9 The Home Page and Menu Bar...10 Navigating in the Management Console...11 Getting Help...14 Next Steps...15 Basic Steps for Deploying the SteelHead Mobile Package...15 Chapter 2 - Modifying Host and Network Interface Settings...17 Modifying General Host Settings...17 Modifying Network Interfaces...20 IPv6 Support...20 Configuring Port Labels...27 Modifying Ports in a Port Label...28 SteelCentral ler for SteelHead Mobile User s Guide iii

6 Contents Chapter 3 - Configuring System Administrator Settings...31 Setting Announcements...31 Configuring Alarm Settings...32 Configuring Date and Time...37 Configuring Monitored Ports...39 Configuring SNMP Settings...41 Configuring SNMP v SNMP Authentication and Access...46 Configuring Settings...50 Configuring Log Settings...53 Filtering Logs by Application or Process...55 Configuring Advanced Settings...57 Chapter 4 - Configuring Security Settings...61 Configuring General Security Settings...61 Viewing Permissions...62 Managing User Permissions...63 Capability-Based Accounts...63 Setting RADIUS Servers...66 Configuring TACACS+ Access...68 Unlocking the Secure Vault...70 Configuring Web Settings...71 Managing Web SSL Certificates...72 Chapter 5 - Managing Mobile lers...75 Configuring Scheduled Jobs...75 Managing Licenses...76 Installing a License...77 Upgrading Your Software...78 Rebooting and Shutting Down the Mobile ler...80 Configuring Mobile ler Clusters...81 Prerequisites...82 Configuration Settings in Your Clusters...83 Troubleshooting Cluster Connections...84 Troubleshooting Mobile ler Connectivity...84 License Pooling...85 Managing Configurations...85 Chapter 6 - Configuring SSL for Mobile lers...87 Configuring SSL for Mobile lers...87 iv SteelCentral ler for SteelHead Mobile User s Guide

7 Contents Basic Steps for Configuring SSL...88 Configuring Mobile ler Peering...89 Modifying SSL Server Certificate Settings...90 Configuring SSL Certificate Authorities...98 Configuring SSL Bulk Import and Export...99 Chapter 7 - Managing SteelHead Mobiles Managing SteelHead Mobile Policies Creating New Policies Configuring In-Path Optimization Rules for Policies Configuring Protocol Settings Configuring SSL for Policies Configuring Location Awareness for Policies Configuring Endpoint Settings for Policies Managing SteelHead Mobile Packages Creating Packages Viewing Package Details Deploying SteelHead Mobile Packages Managing SteelHead Mobile Assignments Changing Default Policy Assignments Working with Group Assignments Changing an Endpoint Group for Clients Using a GPO Enabling or Disabling Optimization Using a GPO Template Chapter 8 - Viewing Reports and Logs Viewing Reports for Endpoints Viewing Endpoint Reports Viewing Endpoint User Information Viewing Desktop Bandwidth Reports Viewing Branch Warming Reports Viewing SSL Reports Viewing Endpoint History Reports Viewing Desktop Traffic Reports Viewing Diagnostics Reports Viewing Alarm Status Reports Viewing CPU Utilization Reports Viewing Memory Paging Reports Viewing Interface Counters Viewing and Downloading Logs Viewing Logs Downloading Log Files Viewing Diagnostic Reports for Endpoints Viewing the Memory Dumps List Viewing the System Dumps List SteelCentral ler for SteelHead Mobile User s Guide v

8 Contents Downloading Endpoint TCP Dumps Viewing ler Reports Viewing the System Dumps List Viewing Process Dump Files Capturing and Uploading TCP Dumps Stopping a TCP Dump After an Event Occurs Exporting Logs Chapter 9 - Troubleshooting the SteelHead Mobile Common SteelHead Mobile Problems Appendix A - Default Policy Settings Default Policy Settings Summary Appendix B - Windows and Mac SteelHead Mobiles Windows SteelHead Mobile Properties Status Tab Settings Tab Support Tab System Tray Options Mac SteelHead Mobile Properties Viewing Preferences and System Status Accessing the Support Menu Managing Optimization s Using the lers Tab Using the SSL Tab Appendix C - Windows Installer Properties Windows Installer Properties Overview Command-line Properties Precedence Rules Appendix D - Mobile ler MIB Accessing the Mobile ler Enterprise MIB SNMP Traps Index vi SteelCentral ler for SteelHead Mobile User s Guide

9 Preface Read this preface for an overview of the information provided in this guide. This preface includes the following sections: About This Guide on page 1 Documentation and Release Notes on page 2 Contacting Riverbed on page 3 About This Guide The SteelCentral ler for SteelHead Mobile User s Guide describes how to configure and manage the SteelCentral ler for SteelHead Mobile. It describes how to create policies, packages, and assignments for SteelHead Mobiles using the RiverbedManagement Console. The information in this guide applies to the Mobile ler as well as the Virtual SteelHead Mobile ler (Mobile ler-v) products, except where explicit references are made to hardware or virtual features. This guide is written for storage and network administrators who are familiar with administering and managing WANs using common network protocols such as TCP, CIFS, HTTP, FTP, and NFS. You must also be familiar with administering and managing a network of deployed SteelHeads. Riverbed product names have changed. At the time of publication, the user interfaces of the products described in this guide may have not changed, and the original names may be used in the text. For the product naming key, see the following link: This guide includes information pertinent to the following products: Riverbed SteelCentral ler for SteelHead Mobile software (SteelCentral ler for SteelHead Mobile) Riverbed SteelCentral ler for SteelHead Mobile (Mobile ler, SMC) Riverbed Mobile ler (virtual edition) (Mobile ler-v, VSMC) Riverbed Management Console (Management Console) Riverbed SteelHead (SteelHead) SteelCentral ler for SteelHead Mobile User s Guide 1

10 Preface Documentation and Release Notes Audience This guide is written for storage and network administrators who are familiar with administering and managing WANs using common network protocols such as TCP, CIFS, HTTP, FTP, and NFS. You must also be familiar with administering and managing a network of deployed SteelHeads. Document Conventions This guide uses the following standard set of typographical conventions. Convention Meaning italics boldface Courier Within text, new terms and emphasized words appear in italic typeface. Within text, CLI commands, CLI parameters, and REST API properties appear in bold typeface. Code examples appear in Courier font: amnesiac > enable amnesiac # configure terminal < > Values that you specify appear in angle brackets: interface <ip-address> [ ] Optional keywords or variables appear in brackets: ntp peer <ip-address> [version <number>] { } Elements that are part of a required choice appear in braces: {<interface-name> ascii <string> hex <string>} The pipe symbol represents a choice to select one keyword or variable to the left or right of the symbol. The keyword or variable can be either optional or required: {delete <filename> upload <filename>} Documentation and Release Notes To obtain the most current version of all Riverbed documentation, go to the Riverbed Support site at If you need more information, see the Riverbed Knowledge Base for any known issues, how-to documents, system requirements, and common error messages. You can browse titles or search for keywords and strings. To access the Riverbed Knowledge Base, log in to the Riverbed Support site at Each software release includes release notes. The release notes identify new features in the software as well as known and fixed problems. To obtain the most current version of the release notes, go to the Software and Documentation section of the Riverbed Support site at Examine the release notes before you begin the installation and configuration process. 2 SteelCentral ler for SteelHead Mobile User s Guide

11 Contacting Riverbed Preface Contacting Riverbed This section describes how to contact departments within Riverbed. Technical support - If you have problems installing, using, or replacing Riverbed products, contact Riverbed Support or your channel partner who provides support. To contact Riverbed Support, open a trouble ticket by calling RVBD-TAC ( ) in the United States and Canada or outside the United States. You can also go to Professional services - Riverbed has a staff of professionals who can help you with installation, provisioning, network redesign, project management, custom designs, consolidation project design, and custom coded solutions. To contact Riverbed Professional Services, proserve@riverbed.com or go to Documentation - The Riverbed Technical Publications team continually strives to improve the quality and usability of Riverbed documentation. Riverbed appreciates any suggestions you might have about its online documentation or printed materials. Send documentation comments to techpubs@riverbed.com. SteelCentral ler for SteelHead Mobile User s Guide 3

12 Preface Contacting Riverbed 4 SteelCentral ler for SteelHead Mobile User s Guide

13 CHAPTER 1 Overview of SteelCentral ler for SteelHead Mobile This chapter introduces the Mobile ler, the Management Console, and the basic steps for deploying SteelHead Mobile packages. This overview contains the following sections: Hardware and Software Dependencies on page 5 Overview of the SteelCentral ler for SteelHead Mobile Solution on page 6 Using the Management Console on page 9 Next Steps on page 15 Before reading this chapter and this guide, you should know how to install and connect the Mobile ler to your network. For details, see the SteelCentral ler for SteelHead Mobile Installation Guide. To use this chapter, you must know how to install, configure, and manage WAN optimization using the SteelHead. For details about the SteelHead, see the SteelHead Installation and Configuration Guide, the SteelHead Management Console User s Guide, and the SteelHead Deployment Guide. Hardware and Software Dependencies The following table summarizes the hardware and software requirements for the Mobile ler. SteelCentral ler for SteelHead Mobile Component Mobile ler Management Console Hardware and Software Requirements 19-inch (483-mm) two-post or four-post rack Any computer that supports a Web browser with a color image display The Management Console has been tested with Mozilla Firefox Extended Support Release version 10.0 and Microsoft Internet Explorer version 7.0 and 8.0. Note: JavaScript and cookies must be enabled in your Web browser. SteelHead Mobile RiOS v4.0.x or later on the SteelHead SteelCentral ler for SteelHead Mobile User s Guide 5

14 Overview of SteelCentral ler for SteelHead Mobile Overview of the SteelCentral ler for SteelHead Mobile Solution Overview of the SteelCentral ler for SteelHead Mobile Solution The SteelCentral ler for SteelHead Mobile solution lets you optimize TCP traffic to remote users who are accessing your computer network using any type of remote access. Remote users employ client software to exchange optimized data with a SteelHead. In most cases, the Mobile ler requires only a hostname and IP address to be operational, and client software can be deployed using default settings. Depending on your organization, your SteelCentral ler for SteelHead Mobile solution can include: SteelHead Mobile ler - A dedicated, rackable unit designed to manage SteelCentral ler for SteelHead Mobile licenses and to control the deployment, management, and reporting of SteelCentral ler for SteelHead Mobile client software for large deployments and rapidly growing organizations. Virtual SteelHead Mobile ler - Provides virtualized enterprise-grade acceleration for smallsized and medium-sized businesses or smaller strategic mobile deployments. SteelHead Mobile Client - The client software that enables LAN-like performance for Windows PCs or Mac computers, no matter where users are located. SteelHead Mobiles are managed by the Mobile ler and connect to a SteelHead. The SteelCentral ler for SteelHead Mobile solution enables you to perform optimization for the following types of users: Mobile Users - Employees who connect to the WAN from various locations and also connect to the LAN locally. Home Users - Employees who use computers that connect to the corporate network. Small Branch Office Users - Users located at offices with fewer than ten employees who connect to the WAN but do not have a standard SteelHead on site. The SteelHead Mobile software is deployed to PC or Mac laptops or desktops. A Mobile ler, typically located in the data center, is required for SteelCentral ler for SteelHead Mobile deployment, management, and licensing control. After the Mobile ler is deployed, packages that contain client software can be distributed. SteelHead Mobile policies are assigned to a group or a particular user on the Mobile ler. Policies define optimization rules and connection information for the SteelHead Mobiles. The Mobile ler can update SteelHead Mobile policies, if desired. Figure 1-1 outlines the optimization process flow. Figure 1-1. Optimization Process Flow SteelCentral ler for SteelHead Mobile is designed to be deployed to your SteelHead Mobiles without additional configuration. It ships with default policies that provide default values for the client software that is deployed to your endpoints. You can create your own packages and your own polices as needed. You can find information about custom deployments in this guide and in the SteelHead Deployment Guide. 6 SteelCentral ler for SteelHead Mobile User s Guide

15 Overview of the SteelCentral ler for SteelHead Mobile Solution Overview of SteelCentral ler for SteelHead Mobile Definition of Terms The following terms are used to describe SteelCentral ler for SteelHead Mobile features, attributes, and processes in SteelCentral ler for SteelHead Mobile. Term endpoint/ SteelHead Mobile SteelHead Mobile package policies group assignments clusters Demilitarized Zone (DMZ) Definition An endpoint client or SteelHead Mobile is a client computer: for example, a Windows or Mac laptop, or tablet. A SteelHead Mobile install package is used to install SteelHead Mobile software onto each of your endpoint clients. A package created on a Mobile ler contains the fully qualified domain name (FQDN) of the Mobile ler and a certificate that secures communication between the client and the controller. The default SteelHead Mobile package that ships with the Mobile ler contains default package settings. Typically, you can install and deploy SteelCentral ler for SteelHead Mobile without modifying the default policy or package that ship with the product. For details, see Creating Packages on page 139. A policy contains optimization rules for accelerating the WAN traffic between SteelHead Mobiles and SteelHeads in your network. A policy is required for optimization to occur. A policy also contains information about the size of the SteelHead Mobile RiOS data store. For details, see Managing SteelHead Mobile Policies on page 103. Prior to Mobile ler v4.0, policies were separated into endpoint and acceleration policies. A group assignment is an association between a number of SteelHead Mobiles or users and a package and policy. A group assignment governs which policies and packages the Mobile ler provides to SteelHead Mobiles. When you create a package, you can assign a group assignment to it. The group assignment is associated with the SteelHead Mobiles upon installation of the SteelHead Mobile software. The Mobile ler subsequently uses the group assignment to identify the SteelHead Mobile and provides the assigned policies and software updates. For details, see Managing SteelHead Mobile Assignments on page 146. Group assignment was called Deployment ID in Mobile ler v2.x and earlier releases. Clusters are groups of two or more Mobile lers used to pool available SteelHead Mobile licenses and configuration settings. This means that the entire pool of available licenses remains available to SteelHead Mobiles even if one Mobile ler has used all of its licenses or one Mobile ler fails. SteelHead Mobiles can connect to Mobile lers in a cluster and receive a consistent configuration from any Mobile ler in the cluster. Configuration changes made to any Mobile ler propagate to all Mobile lers in the cluster. A demilitarized zone (DMZ) is a computer or small subnetwork that sits between a trusted internal network, such as a corporate private LAN, and an untrusted external network, such as the public Internet. Typically, the DMZ contains devices accessible to Internet traffic, such as Web (HTTP) servers, FTP servers, SMTP ( ) servers, and DNS servers. Mobile ler Administration Tasks The Mobile ler facilitates the following administration tasks for your SteelHead Mobiles: Configuration - The Mobile ler enables you to install, configure, and update SteelHead Mobiles in groups. The Mobile ler uses policies, packages, and deployment groups to facilitate centralized configuration and reporting. Monitoring - The Mobile ler provides both high-level status and detailed statistics about SteelHead Mobile performance, and enables you to configure alerts for managed SteelHead Mobiles. SteelCentral ler for SteelHead Mobile User s Guide 7

16 Overview of SteelCentral ler for SteelHead Mobile Overview of the SteelCentral ler for SteelHead Mobile Solution Management - The Mobile ler enables you to schedule software upgrades and configuration changes to groups of SteelHead Mobiles or to collect logs from SteelHead Mobiles. License Pooling - You can join two or more Mobile lers into a cluster, allowing pooling of available licenses. With license pooling, the entire pool of licenses remains available to the SteelHead Mobile Client, even if one Mobile ler has used all of its installed licenses or a Mobile ler in the cluster fails. SteelHead Mobiles can connect to any Mobile ler in a cluster and receive shared configuration settings from any Mobile ler in the cluster. For details, see Configuring Mobile ler Clusters on page 81. What Are Policies? Policies are sets of optimization, security, endpoint storage, and other configuration settings for groups of SteelHead Mobiles that have the same performance requirements. Policies can also be shared by Mobile lers that are members of a cluster. A policy can be for a specific SteelHead Mobile, or it can represent settings for groups of SteelHead Mobiles and SteelHeads in your enterprise environment. The Mobile ler ships with a default policy, Initial, which the Mobile ler automatically provides to endpoint clients. For basic settings, you can install and deploy SteelCentral ler for SteelHead Mobile without modifying the default policy. For details, see Managing SteelHead Mobile Packages on page 139. What Are Packages? You use packages to install and update the SteelHead Mobile Client software on each of your endpoint clients. A package is an installation bundle for the client s operating system that contains the SteelHead Mobile Client software and the information necessary for SteelHead Mobiles to communicate with the Mobile ler. In most cases, you can deploy the default package included with Mobile ler. For details, see Creating Packages on page 139. Note: If the package is to be downloaded by more than 50 clients, Riverbed recommends that you put the package on a file server so that the Mobile ler is not overloaded with requests. What Are Group Assignments? Group assignments govern which policies and packages your SteelHead Mobiles receive. Group assignments enable you to deploy different policies to groups of SteelHead Mobiles, based on their individual performance needs. When you deploy a package to a group, the Mobile ler uses the group assignment to identify the proper subset of SteelHead Mobiles and automatically provides policy and software updates to them. For details, see Managing SteelHead Mobile Assignments on page SteelCentral ler for SteelHead Mobile User s Guide

17 Using the Management Console Overview of SteelCentral ler for SteelHead Mobile What Are Clusters? Clusters are groups of two or more Mobile lers used to pool available endpoint licenses and share configurations when multiple Mobile lers are needed to support large deployments. SteelHead Mobiles associated with clusters have access to the licenses on all of the Mobile lers in the cluster, even if one or more of the Mobile lers is unavailable. Any member of a cluster can modify settings used by the cluster, and the settings are then automatically updated to the entire cluster. For detailed information about clusters, see Configuring Mobile ler Clusters on page 81. Using the Management Console The following section describes how to connect to and navigate in the Management Console. It includes the following sections: Connecting to the Management Console on page 9 The Home Page and Menu Bar on page 10 Navigating in the Management Console on page 11 Getting Help on page 14 You manage the Mobile ler using either the Web-based Management Console or the Riverbed command-line interface. Riverbed recommends that you use the Management Console to configure and manage your system. The Mobile ler command-line features are described in the Riverbed Command- Line Interface Reference Manual. Connecting to the Management Console To connect to the Management Console, you must know the URL or IP address and administrator password that you assigned when you set up your Mobile ler using the configuration wizard of the Mobile ler. For details, see the SteelCentral ler for SteelHead Mobile Installation Guide. Note: JavaScript and cookies must be enabled in your Web browser. To connect to the Management Console 1. Enter the URL for the Mobile ler in the location box of your Web browser: protocol://host.domain protocol is HTTP or HTTPS. HTTPS uses the SSL protocol to ensure a secure channel. If you use HTTPS to connect, you might be prompted to inspect and verify the SSL certificate. By default, the Mobile ler uses a self-signed certificate, which provides encrypted Web connections to the Management Console. It is re-created when the appliance hostname changes and when the certificate has expired. host is the hostname you assigned to the Mobile ler primary interface in the configuration wizard. If your DNS server maps that IP address to a name, you can specify the DNS name. domain is the full domain name for the Mobile ler appliance. SteelCentral ler for SteelHead Mobile User s Guide 9

18 Overview of SteelCentral ler for SteelHead Mobile Using the Management Console The Management Console appears, displaying the Login page. Figure 1-2. Login Page 2. In the Username text box, specify the user login: admin, monitor, a login from a RADIUS or TACACS+ database, or any local accounts created using the role-based accounts feature. The default login is admin. For details on role-based accounts, see Managing User Permissions on page 63. Users with administrator (admin) privileges can configure and administer the Mobile ler. Users with monitor (monitor) privileges can view the Mobile ler reports, user logs, and change their own password. A monitor user cannot make configuration changes. 3. In the Password text box, specify the password you assigned in the configuration wizard of the Mobile ler. (The Mobile ler is shipped with the default password: password.) 4. Click Log In to display the Home page. The Home Page and Menu Bar The top of every page displays the menu bar. The current state of the system appears to the right of the menus Healthy, Admission, Degraded, or Critical and is always visible. A status of Healthy (Needs Attention) indicates that the management tasks that do not affect optimization are needed. For details, select the current system status to display the Alarm Status page. Figure 1-3. Mobile ler Menu Bar The system saves settings on a per-user basis. A message appears at the top of each page when more than one user is logged in, explaining that user preferences might be overwritten. The Home page displays the controller up time, temperature (if the Mobile ler is not virtual), CMC hostname (if you have one in your network), connected clients, licenses in use, and the status of the clients (healthy, degraded, critical, and disabled). In Mobile ler v4.7 and later, the Home page also displays cluster information, if a cluster is configured. The Cluster Wide Connection Information lists the number of controllers in the cluster, installed and free licenses, connections and licensed connections, and the status of the clients in the cluster (healthy, degraded, critical, and disabled). The Home page also displays the following reports: Bandwidth Optimization - Summarizes the throughput or total data transmitted by all clients over the WAN and the LAN in the last week. In Mobile ler v4.7 and later, this graph also shows the number of desktop licenses installed and in use. 10 SteelCentral ler for SteelHead Mobile User s Guide

19 Using the Management Console Overview of SteelCentral ler for SteelHead Mobile Endpoint History - Displays the endpoints that are connected to the controller and the licensed endpoints. By default, endpoint data for the past week is shown. In Mobile ler v4.7 and later, this graph also shows the history of desktop endpoints. Figure 1-4. The Home Page (Bandwidth Optimization Report) In Mobile ler v4.7 and later, there are panes for the Bandwidth Optimization and Endpoint History reports at the bottom of the Home page. Click a pane to display the report you want to see. Navigating in the Management Console You can navigate to the tools and reports available to you in the Management Console using hyperlinked tabs and menus. To display cascading menus 1. Select the Configure, Manage, and Reports menus to display the submenus. For example, select Reports to display the submenus Endpoints, Diagnostics, and Export. The menu item that is currently active is highlighted. 2. To go to a page, slide your cursor down to the submenu item you want to display and select the menu name. For example, under Reports > Optimization, select Bandwidth Optimization to display the page. SteelCentral ler for SteelHead Mobile User s Guide 11

20 Overview of SteelCentral ler for SteelHead Mobile Using the Management Console The following table summarizes the cascading menus. Tab Home Configure Purpose Displays the current status of your system and verifies bandwidth optimization. Networking - Configure host settings, network interfaces, and port labels. SSL - Configure peering, signing CA, and certificate authorities. System Settings - Configure announcements, alarms, monitored ports, SNMP basic, SNMP v.3, SNMP ACIs, , and logging. Security - Configure general security settings, user permissions, RADIUS, TACACS+, secure vault, and Web settings. Maintenance - Configure scheduled jobs, licenses, software upgrade, reboot/ shutdown. Cluster - Configure cluster settings. My Account - Change your password and configure user roles. Configurations - Apply a saved configuration. Manage Reports Support Save Healthy/Degraded/ Critical/Unlicensed Configure policies, packages, and assignments. Create and display endpoint reports and diagnostic reports and export reports to files and . Displays contact information for Riverbed Support, software and hardware information, MIB files, and the online help. Save current settings on all pages. Click the status display to navigate to the Reports > Diagnostics > Alarm Status page. Displaying Report Details You can zoom in to display report details. 12 SteelCentral ler for SteelHead Mobile User s Guide

21 Using the Management Console Overview of SteelCentral ler for SteelHead Mobile To display chart details 1. Click and drag your cursor across an area of interest to you. Figure 1-5. Highlight Area of Interest 2. Release the cursor to magnify the highlighted area. Figure 1-6. Magnified Area 3. To return to the original report view, click Reset Zoom or refresh your browser. SteelCentral ler for SteelHead Mobile User s Guide 13

22 Overview of SteelCentral ler for SteelHead Mobile Using the Management Console Saving Your Configuration Most Management Console configuration pages include an Apply button for you to commit your changes. When you click Apply, the Management Console updates the running configuration, but your changes are written to disk only when you save your configuration. The Save icon on the menu bar alerts you if the changes you have made require saving to disk. To permanently save the changes, click Save. Logging Out Click Logout in the upper-right corner of the screen to log out of the current session. Printing Pages and Reports You can print Management Console pages and reports using the print option on your Web browser. To print pages and reports Choose File > Print in your Web browser to open the Print dialog box. Getting Help The Support page provides the following options: Online Help - View browser-based online help. Support - View links and contact information for Riverbed Support. Appliance Details - View appliance information such as model number, hardware revision type, serial number, and software version number currently installed on the appliance. MIB Files - View Riverbed and appliance MIB files in text format. Displaying Online Help The Management Console provides page-level help for the appliance. To display online help in the Management Console Click the question mark icon next to the page title. The help for the page appears in a new browser window. Downloading Documentation The Riverbed Support Site contains PDF versions of the documentation for all Riverbed products: 14 SteelCentral ler for SteelHead Mobile User s Guide

23 Next Steps Overview of SteelCentral ler for SteelHead Mobile Next Steps This section contains the steps required to deploy SteelHead Mobile Clients software to SteelHead Mobiles. If you use the default package, all you have to do is distribute the package and make sure the endpoints connect successfully. If you create a custom package, additional steps are required to configure your custom policies. Basic Steps for Deploying the SteelHead Mobile Package The following section describes the basic steps for deploying the default SteelHead Mobile package to the endpoint clients in your network. You have a number of options with regard to the default package and policy that is shipped with SteelCentral ler for SteelHead Mobile. You can create custom packages to be used in the future with customized policies, or you can customize the default policy, Initial. In addition, you can use the default package and customize the policy that is assigned to the Default group on the assignments page. To deploy a custom SteelHead Mobile package 1. Log in to the Management Console. For details, see Connecting to the Management Console on page Apply your policies. For details, see Managing SteelHead Mobile Packages on page Create your packages to deploy the SteelHead Mobile software to your endpoint clients. For details, see Managing SteelHead Mobile Packages on page 139. Note: If the package will be downloaded by more than 50 clients simultaneously, Riverbed recommends that you put the package on a file server so that the Mobile ler is not overloaded with requests. 4. Define your group. For details about groups, see Managing SteelHead Mobile Assignments on page Assign your policies and packages to groups. For details, see Managing SteelHead Mobile Packages on page 139 and Managing SteelHead Mobile Policies on page Using the deployment tool of your choice (for example, or an internal Web site), deploy the packages to your endpoint clients. For details, see Deploying SteelHead Mobile Packages on page Verify your connection and optimization in the Endpoint Report page. For details, see Viewing Endpoint Reports on page 152. SteelCentral ler for SteelHead Mobile User s Guide 15

24 Overview of SteelCentral ler for SteelHead Mobile Next Steps 16 SteelCentral ler for SteelHead Mobile User s Guide

25 CHAPTER 2 Modifying Host and Network Interface Settings This chapter describes how to configure host and network interface settings. You initially set these properties when you ran the installation wizard. This section describes how you can view and modify these settings, if needed. It includes the following sections: Modifying General Host Settings on page 17 Modifying Network Interfaces on page 20 Configuring Port Labels on page 27 Modifying General Host Settings You can view and modify general host settings in the Configure > Networking > Host Settings page. When you initially ran the installation wizard, you set required network host settings for the Mobile ler. Use the following controls only if modification or additional configuration is required: Name - Modify the hostname only if your deployment requires it. DNS Settings - Riverbed recommends that you use DNS resolution. Hosts - If you do not use DNS resolution, or if the host does not have a DNS entry, you can create a host-ip address resolution map. Web/FTP Proxy - Configure proxy addresses for Web or FTP proxy access to the Mobile ler. SteelCentral ler for SteelHead Mobile User s Guide 17

26 Modifying Host and Network Interface Settings Modifying General Host Settings To modify general host settings Choose Configure > Networking > Host Settings to display the Host Settings page. Figure 2-1. Host Settings Page To change the hostname 1. Choose Configure > Networking > Host Settings to display the Host Settings page. 2. Under Name, modify the value in the Hostname field. 3. Click Apply to apply your changes to the running configuration. 4. Click Save to save your settings permanently. To specify DNS settings 1. Choose Configure > Networking > Host Settings to display the Host Settings page. Under DNS Settings, complete the configuration as described in this table. Primary DNS Server Secondary DNS Server Specify the IP address for the primary name server. Optionally, specify the IP address for the secondary name server. 18 SteelCentral ler for SteelHead Mobile User s Guide

27 Modifying General Host Settings Modifying Host and Network Interface Settings Tertiary DNS Server DNS Domain List Optionally, specify the IP address for the tertiary name server. Specify an ordered list of domain names. If you specify domains, the system automatically finds the appropriate domain for each of the hosts that you specify in the system. 2. Click Apply to apply your changes to the running configuration. 3. Click Save to save your settings permanently. To add a new host 1. Choose Configure > Networking > Host Settings to display the Host Settings page. Under Hosts, complete the configuration as described in this table. IP Address Hostname Add Remove Selected Specify the IP address for the host. Specify a hostname. Adds the host. Select the check box next to the name and click Remove Selected. 2. Click Apply to apply your changes to the running configuration. 3. Click Save to save your settings permanently. To set a Web/FTP proxy 1. Choose Configure > Networking > Host Settings to display the Host Settings page. 2. Under Web/FTP Proxy, complete the configuration as described in this table. Enable Web Proxy Web/FTP Proxy Provides Web proxy access to the Mobile ler. Enables the Mobile ler to use a Web proxy to contact the Riverbed licensing portal and fetch licenses in a secure environment. You can optionally require user credentials to communicate with the proxy, and you can specify the method used to authenticate and negotiate user credentials. Web proxy access is disabled by default. RiOS supports the following proxies: Squid, Blue Coat Proxy SG, Microsoft WebSense, and McAfee Web Gateway. Specify the IP address for the Web or FTP proxy. SteelCentral ler for SteelHead Mobile User s Guide 19

28 Modifying Host and Network Interface Settings Modifying Network Interfaces Port Optionally, specify the port for the Web or FTP proxy. The default port is Enable Authentication Optionally, select to require user credentials for use with Web or FTP proxy traffic. Specify the following to authenticate the users: Username - Specify a username. Password - Specify a password. Authentication Type - Select an authentication method from the drop-down list: Basic - Authenticates user credentials by requesting a valid username and password. This is the default setting. NTLM - Authenticates user credentials based on an authentication challenge and response. Digest - Provides the same functionality as Basic authentication; however, Digest authentication improves security because the system sends the user credentials across the network as a Message Digest 5 (MD5) hash. 3. Click Apply to apply your changes to the running configuration. 4. Click Save to save your settings permanently. Modifying Network Interfaces You can view and modify settings for the appliance primary and auxiliary interfaces in the Configure > Networking > Network Interfaces page. When you initially ran the Configuration wizard, you set required values for the base interfaces for the Mobile ler. Use the following controls if modification or additional configuration is required: Primary Interface - On the appliance, the primary interface is the port you connect to the LAN switch. The primary interface is the appliance management interface. The primary interface is also used by SteelHead Mobiles to connect to the Mobile ler. Auxiliary Interface - On the appliance, the auxiliary interface provides a second subnet, if needed, to separate administration from client access. The IP address for the auxiliary interface must be on a subnet different from the primary interface subnet. Main Routing Table - Displays a summary of the main routing table for the appliance. If necessary, you can add static routes that might be required for out-of-path deployments or particular device management subnets. IPv6 Support RiOS v7.0 extended support for IPv6 traffic with packet-mode optimization, and RiOS v8.5 and later further enhances its IPv6 capabilities by supporting auto-discovery and fixed-target rules. By using auto-discovery or fixed-target in-path rules, RiOS can apply transport and application streamlining techniques (similarly as it does for TCP connections over IPv4) to improve the user experience as the transition to IPv6 continues. 20 SteelCentral ler for SteelHead Mobile User s Guide

29 Modifying Network Interfaces Modifying Host and Network Interface Settings IPv6 is enabled by default in RiOS v8.5 and later. The SteelHead support for IPv6 is twofold: Managing SteelHeads - Support for management access using IPv6 IP addresses on primary and auxiliary interfaces. Optimizing IPv6 traffic using SteelHead appliances - SteelHeads can optimize IPv6 traffic. For details on IPv6 deployments, see the SteelHead Deployment Guide. This table lists IPv6 support by feature and notes any limits and special considerations. RiOS IPv6 Support Includes Conformance with Request for Comments (RFCs) 1981, 2460, 2464, 2710, 3590, 4007, 4291, 4443, 4861, 4862, 4943, 5095, and TCP IPv6 traffic interception between source and destination, bandwidth optimization. Auto-discovery of SteelHeads. Ability to automatically discover fixed-target and pass-through in-path rules, along with ability to deny and reject IPv6 TCP traffic as configured in the in-path rules. SteelCentral ler for SteelHead Mobile User s Guide HTTP and HTTPS latency optimization for IPv6 TCP traffic. Ability to configure serial clusters. Interception of IPv6 traffic for in-path, virtual in-path, and server-side out-of-path configurations. Intercepting and passing through IPv4 and/or IPv6 traffic, depending on the in-path rules. Ability to detect asymmetric routes for IPv6 TCP traffic; enables connection forwarding of IPv6 TCP traffic in asymmetric conditions. Ability to configure IPv4 and IPv6 addresses on every in-path interface and intercepting and optimizing IPv4 and IPv6 traffic. Ability to configure one IPv6 address configuration for every in-path interface. RiOS intercepts and optimizes traffic matching the scope of the IPv6 address configured on the in-path interface. Not applicable for a link-local address configured on the in-path interface. RiOS Version v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later v8.5 and later Notes TCP inner connections between the peer SteelHeads is strictly IPv4. RiOS does not support the Outlook Anywhere and Citrix latency optimization policies for autodiscovery and fixed-target rules. RiOS does not support the neural framing modes Always, TCP Hints, and Dynamic. RiOS does not support the Oracle forms and Oracle forms over SSL preoptimization policies. WCCPv6 support is not available. Virtual in-path support is PBR only. Interceptor is not supported. The connection-forwarding control channel between the neighbors is strictly IPv4. You must configure IPv4 addresses on the SteelHeads when using a connection-forwarding control channel. RiOS passes through IPv6 TCP traffic not matching the scope of the IPv6 address configured on the in-path interface. SteelCentral ler for SteelHead Mobile User s Guide 21

30 Modifying Host and Network Interface Settings Modifying Network Interfaces RiOS IPv6 Support Includes RiOS Version Notes Ability to configure IPv6 addresses on any in-path interface. IPv6 TCP inner connections only in fixed-target cases. Enhanced autodiscovery of SteelHeads for IPv6 TCP traffic. Simplified routing for IPv6 TCP traffic. Connection forwarding for IPv6 traffic in multi-interface mode. v8.5 and later v8.5 and later v8.5 and later v8.5 and later This IPv6-only mode requires configuring only fixed-target in-path rules. TCP inner connections between the peer SteelHeads is IPv4 only. The control connection between neighbors is still IPv4 only. When multiple interface support in the Networking > Network Integration: Connection Forwarding page is not enabled, IPv6 traffic is passed through. Ability to configure peering rules for IPv6 traffic. v8.5 The peer client-side SteelHead IP address is IPv4 only. Ability to configure IPv6 addresses in Single Ended Interception (SEI) rules under Optimization > Network Services: Transport Settings. Global and automatic kickoff for pass-through TCP IPv6 traffic. Ability to configure asymmetric VLANs for IPv6 TCP traffic. Latency optimization of signed-smb, CIFS/SMB1, SMB2, and SMB3 using IPv6 endpoint addressing. Encrypted Outlook Anywhere latency optimization. MAPI, emapi latency optimization Authentication over IPv6. v8.5 and later v8.5 and later v8.5 and later v8.5.2 and later v8.6 and later v8.6 and later v8.6 and later The authentication stack continues to require IPv4 endpoint addressing. Authentication is over IPv4. Features Not Supported with IPv6 The following features are not IPv6 compatible: Management In-Path (MIP) Interface Transparency NetFlow RSP Path selection QoS Host labels IPSec 22 SteelCentral ler for SteelHead Mobile User s Guide

31 Modifying Network Interfaces Modifying Host and Network Interface Settings Automatic address assignment through DHCPv6 Multicast listener discovery IPv6 stateless address autoconfiguration WCCP using anything other than IPv4 outer connections To display and modify the configuration for network interfaces 1. Choose Configure > Networking > Network Interfaces to display the Network Interfaces page. The Network Interfaces page is divided into four areas: Primary Interface, Auxiliary Interface, Main IPv4 Routing Table, and Main IPv6 Routing Table. Figure 2-2. Network Interfaces Page 2. Under Primary Interface, complete the configuration as described in this table. Enable Primary Interface Obtain IPv4 Address Automatically Enables the appliance management interface, which can be used for both managing the SteelHead and serving data for a server-side out-of-path (OOP) configuration. Select this option to automatically obtain the IP address from a DHCP server. A DHCP server must be available so that the system can request the IP address from it. Note: The primary and in-path interfaces can share the same network subnet. The primary and auxiliary interfaces cannot share the same network subnet. Enable IPv4 Dynamic DNS Select this option to send the hostname with the DHCP request for registration with Dynamic DNS. The hostname is specified in the Configure > Networking > Host Settings page. SteelCentral ler for SteelHead Mobile User s Guide 23