Cisco / IronPort Web Proxy – Useful Commands

Some commands if find use full while working with Cisco Ironport Proxies.

1. Kick the Proxy Process
2. Packet Capture
3. List and Download the Captures

Kick the Proxy Process

This forces the proxy to reconnect to upstream proxies, etc.

proxy> diagnostic
Choose the operation you want to perform:
- NET - Network Diagnostic Utility.
- PROXY - Proxy Debugging Utility.
- REPORTING - Reporting Utilities.
[]> PROXY
- SNAP - Take a snapshot of the proxy
- OFFLINE - Take the proxy offline (via WCCP)
- RESUME - Resume proxy traffic via (via WCCP)
- CACHE - Clear proxy cache
[]> kick
Kick the proxy?
Are you sure you want to proceed? [N]> y

- SNAP - Take a snapshot of the proxy
- OFFLINE - Take the proxy offline (via WCCP)
- RESUME - Resume proxy traffic via (via WCCP)
- CACHE - Clear proxy cache

Packet Capture

Enter this command into the CLI:

PROXY> packetcapture
Status: No capture running
Current Settings:
 Max file size:      200 MB
 Capture Limit:      None (Run Indefinitely)
 Capture Interfaces: Management
 Capture Filter:     (tcp port 80 or tcp port 3128)

Choose the operation that you want to perform:
- START - Start packet capture.
- SETUP - Change packet capture settings.
[]> setup

Enter the maximum allowable size for the capture file (in MB):
[200]> 200

Do you want to stop the capture when the file size is reached? (If not, a new
 file will be started and the older capture data will be discarded.)

[N]> n

The following interfaces are configured:
1. Management
2. T1
3. T2

Enter the name or number of one or more interfaces from which to capture packets, separated by commas:

[1]> 1

Enter the filter that you want to use for the capture. Enter the word CLEAR in order to clear the filter and capture all of the packets on the selected interfaces.

[(tcp port 80 or tcp port 3128)]> host 10.10.10.10 && port 80

Status: No capture running

Current Settings:
 Max file size:      200 MB
 Capture Limit:      None (Run Indefinitely)
 Capture Interfaces: Management
 Capture Filter:     host 10.10.10.10 && port 80

Choose the start operation in order to begin the capture:
- START - Start packet capture.
- SETUP - Change packet capture settings.

[]> start

Status: Capture in progress (Duration: 0s)

File Name: S350-00937262569A-8C2FDB1-20080919-174302.cap (Size: 0K)
Current Settings:
 Max file size:      200 MB
 Capture Limit:      None (Run Indefinitely)
 Capture Interfaces: Management
 Capture Filter:     host 10.10.10.10 && port 80

Choose the stop operation in order to end the capture:

- STOP - Stop packet capture.
- STATUS - Display current capture status.
- SETUP - Change packet capture settings.

[]> stop

Status: No capture running (Capture stopped by user)

Current Settings:
 Max file size:      200 MB
 Capture Limit:      None (Run Indefinitely)
 Capture Interfaces: Management
 Capture Filter:     host 10.10.10.10 && port 80

List and Download the Captures

List

ssh -l <username> <proxy> ls captures/

Download

scp <username>@<proxy>:captures/<filename>

Photo by Taylor Vick on Unsplash