-
Cisco Security Appliance Command Reference, Version 7.1
-
About this Guide
-
Using the Command Line Interface
-
aaa accounting through accounting-server-group
-
acl-netmask-convert through auto-update timeout Commands
-
backup-servers through browse networks Commands
-
cache through clear compression Commands
-
clear configure through clear configure vpn-load-balancing Commands
-
clear console-output through clear xlate Commands
-
client-access-rule through crl-configure Commands
-
crypto ca authenticate through customization Commands
-
debug aaa through debug xdmcp Commands
-
default through duplex Commands
-
email through functions Commands
-
gateway through hw-module module shutdown Commands
-
icmp through imap4s Commands
-
inspect ctiqbe through inspect xdmcp Commands
-
interface-dhcp through issuer-name Commands
-
join-failover-group through kill Commands
-
ldap-attribute-map through log-adj-changes Commands
-
logging asdm through logout message Commands
-
mac-address through multicast-routing Commands
-
name through override-account-disable Commands
-
page style through pwd Commands
-
queue-limit through routerospf Commands
-
same-security-traffic through show asdm sessions Commands
-
show asp drop through show curpriv Commands
-
show debug through show ipv6 traffic Commands
-
show isakmp sa through show route Commands
-
show running-config through show running-config isakmp Commands
-
show running-config ldap through show running-config webvpn auto-signon Commands
-
show service-policy through show webvpn svc Commands
-
shun through sysopt uauth allow-http-cache Commands
-
tcp-map through tx-ring-limit Commands
-
urgent-flag through write terminal Commands
-
Feedback
Table Of Contents
same-security-traffic through show asdm sessions Commands
set connection advanced-options
same-security-traffic through show asdm sessions Commands
same-security-traffic
To permit communication between interfaces with equal security levels, use the same-security-traffic command in global configuration mode. To disable the same-security interfaces, use the no forms of this command.
same-security-traffic permit {inter-iterface | intra-interface}
no same-security-traffic permit {inter-interface | intra-interface}
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Allowing communication between same security interfaces provides the following benefits:
•
•
You can also redirect incoming client VPN traffic back out through the same interface unencrypted as well as encrypted. If you send VPN traffic back out through the same interface unencrypted, you must enable NAT for the interface so that publicly routable addresses replace your private ip addresses (unless you already use public ip addresses in your local ip address pool). The following example commands apply an interface PAT rule to traffic sourced from the client ip pool:
hostname(config)#ip local pool clientpool 192.168.0.10-192.168.0.100
hostname(config)# global (outside) 1 interface
hostname(config)# nat (outside) 1 192.168.0.0 255.255.255.0
When the security appliance sends encrypted VPN traffic back out this same interface, however, NAT is optional. To apply NAT to all outgoing traffic, implement only the commands above. To exempt the VPN-to-VPN traffic from NAT, add commands (to the example above) that implement NAT exemption for VPN-to-VPN traffic, such as:hostname(config)#access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0 hostname(config)# nat (outside) 0 access-list nonatSee the nat command for more information.
Examples
The following example shows how to enable the same-security interface communication:
hostname(config)# same-security-traffic permit inter-interfaceRelated Commands
show running-config same-security-traffic
Displays the same-security-traffic configuration.
sasl-mechanism
To specify a SASL (Simple Authentication and Security Layer) mechanism for authenticating an LDAP client to an LDAP server, use the sasl-mechanism command in aaa-server host configuration mode. The SASL authentication mechanism options are digest-md5 and kerberos.
To disable an authentication mechanism, use the no form of this command.
sasl-mechanism {digest-md5 | kerberos server-group-name}
no sasl-mechanism {digest-md5 | kerberos server-group-name}
Note
Syntax Description
Syntax DescriptionSyntax Description
Defaults
No default behavior or values. The security appliance passes the authentication parameters to the LDAP server in plain text.
Note
Command Modes
The following table shows the modes in which you can enter the command:
aaa-server host configuration
•
•
•
•
—
Command History
Usage Guidelines
Use this command to specify security appliance authentication to an LDAP server using SASL mechanisms.
Both the security appliance and the LDAP server can support multiple SASL authentication mechanisms. When negotiating SASL authentication, the security appliance retrieves the list of SASL mechanisms configured on the server and sets the authentication mechanism to the strongest mechanism configured on both the security appliance and the server. The Kerberos mechanism is stronger than the Digest-MD5 mechanism. To illustrate, if both the LDAP server and the security appliance support both mechanisms, the security appliance selects Kerberos, the stronger of the mechanisms.
When disabling the SASL mechanisms, you must enter a separate no command for each mechanism you want to disable because they are configured independently. Mechanisms that you do not specifically disable remain in effect. For example, you must enter both of the following commands to disable both SASL mechanisms:
no sasl-mechanism digest-md5
no sasl-mechanism kerberos <server-group-name>
Examples
The following examples, entered in aaa-server host configuration mode, enable the SASL mechanisms for authentication to an LDAP server named ldapsvr1 with an IP address of 10.10.0.1. This example enables the SASL digest-md5 authentication mechanism:
hostname(config)# aaa-server ldapsvr1 protocol ldaphostname(config-aaa-server-group)# aaa-server ldapsvr1 host 10.10.0.1hostname(config-aaa-server-host)# sasl-mechanism digest-md5hostname(config-aaa-server-host)#The following example enables the SASL Kerberos authentication mechanism and specifies kerb-servr1 as the Kerberos AAA server:
hostname(config)# aaa-server ldapsvr1 protocol ldaphostname(config-aaa-server-group)# aaa-server ldapsvr1 host 10.10.0.1hostname(config-aaa-server-host)# sasl-mechanism kerberos kerbsvr1hostname(config-aaa-server-host)#Related Commands
secondary
To give the secondary unit higher priority in a failover group, use the secondary command in failover group configuration mode. To restore the default, use the no form of this command.
secondary
no secondary
Syntax Description
This command has no arguments or keywords.
Defaults
If primary or secondary is not specified for a failover group, the failover group defaults to primary.
Command Modes
The following table shows the modes in which you can enter the command:
Failover group configuration
•
•
—
—
•
Command History
Usage Guidelines
Assigning a primary or secondary priority to a failover group specifies which unit the failover group becomes active on when both units boot simulataneously (within a unit polltime). If one unit boots before the other, then both failover groups become active on that unit. When the other unit comes online, any failover groups that have the second unit as a priority do not become active on the second unit unless the failover group is configured with the preempt command or is manually forced to the other unit with the no failover active command.
Examples
The following example configures failover group 1 with the primary unit as the higher priority and failover group 2 with the secondary unit as the higher priority. Both failover groups are configured with the preempt command, so the groups will automatically become active on their preferred unit as the units become available.
hostname(config)# failover group 1hostname(config-fover-group)# primaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# exithostname(config)# failover group 2hostname(config-fover-group)# secondaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# mac-address e1 0000.a000.a011 0000.a000.a012hostname(config-fover-group)# exithostname(config)#Related Commands
secondary-color
To set a secondary color for the WebVPN login, home page, and file access page, use the secondary-color command in webvpn mode. To remove a color from the configuration and reset the default, use the no form of this command.
secondary-color [color]
no secondary-color
Syntax Description
Defaults
The default secondary color is HTML #CCCCFF, a lavender shade.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
•
—
—
•
Command History
Usage Guidelines
The number of RGB values recommended for use is 216, many fewer than the mathematical possibilities. Many displays can handle only 256 colors, and 40 of those look differently on MACs and PCs. For best results, check published RGB tables. To find RGB tables online, enter RGB in a search engine.
Examples
The following example shows how to set an HTML color value of #5F9EAO, which is a teal shade:
hostname(config)#webvpnhostname(config-webvpn)# secondary-color #5F9EAORelated Commands
title-color
Sets a color for the WebVPN title bar on the login, home page, and file access page
secondary-text-color
To set the secondary text color for the WebVPN login, home page and file access page, use the secondary-text-color command in webvpn mode. To remove the color from the configuration and reset the default, use the no form of this command.
secondary-text-color [black | white]
no secondary-text-color
Syntax Description
Defaults
The default secondary text color is black.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
—
•
—
—
Command History
Examples
The following example shows how to set the secondary text color to white:
hostname(config)#webvpnhostname(config-webvpn)# secondary-text-color whiteRelated Commands
text-color
Sets a color for text in the WebVPN title bar on the login, home page and file access page
secure-unit-authentication
To enable secure unit authentication, use the secure-unit-authentication enable command in group-policy configuration mode. To disable secure unit authentication, use the secure-unit-authentication disable command. To remove the secure unit authentication attribute from the running configuration, use the no form of this command. This option allows inheritance of a value for secure unit authentication from another group policy.
Secure unit authentication provides additional security by requiring VPN hardware clients to authenticate with a username and password each time the client initiates a tunnel. With this feature enabled, the hardware client does not have a saved username and password.
Note
secure-unit-authentication {enable | disable}
no secure-unit-authentication
Syntax Description
Defaults
Secure unit authentication is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group policy
•
—
•
—
—
Command History
Usage Guidelines
Secure unit authentication requires that you have an authentication server group configured for the tunnel group the hardware client(s) use.
If you require secure unit authentication on the primary security appliance, be sure to configure it on any backup servers as well.
Examples
The following example shows how to enable secure unit authentication for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# secure-unit-authentication enableRelated Commands
security-level
To set the security level of an interface, use the security-level command in interface configuration mode. To set the security level to the default, use the no form of this command. The security level protects higher security networks from lower security networks by imposing additional protection between the two.
security-level number
no security-level
Syntax Description
Defaults
By default, the security level is 0.
If you name an interface "inside" and you do not set the security level explicitly, then the security appliance sets the security level to 100 (see the nameif command). You can change this level if desired.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
—
Command History
7.0(1)
This command was moved from a keyword of the nameif command to an interface configuration mode command.
Usage Guidelines
The level controls the following behavior:
•
For same security interfaces, there is an implicit permit for interfaces to access other interfaces on the same security level or lower.
•
–
–
•
For same security interfaces, you can filter traffic in either direction.
•
Without NAT control, or for same security interfaces, you can choose to use NAT between any interface, or you can choose not to use NAT. Keep in mind that configuring NAT for an outside interface might require a special keyword.
•
For same security interfaces, you can configure established commands for both directions.
Normally, interfaces on the same security level cannot communicate. If you want interfaces on the same security level to communicate, see the same-security-traffic command. You might want to assign two interfaces to the same level and allow them to communicate if you want to create more than 101 communicating interfaces, or you want protection features to be applied equally for traffic between two interfaces; for example, you have two departments that are equally secure.
If you change the security level of an interface, and you do not want to wait for existing connections to time out before the new security information is used, you can clear the connections using the clear local-host command.
Examples
The following example configures the security levels for two interfaces to be 100 and 0:
hostname(config)# interface gigabitethernet0/0hostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownhostname(config-if)# interface gigabitethernet0/1hostname(config-if)# nameif outsidehostname(config-if)# security-level 0hostname(config-if)# ip address 10.1.2.1 255.255.255.0hostname(config-if)# no shutdownRelated Commands
serial-number
To include the security appliance serial number in the certificate during enrollment, use the serial-number command in crypto ca trustpoint configuration mode. To restore the default setting, use the no form of the command.
serial-number
no serial-number
Syntax Description
Defaults
The default setting is to not include the serial number.
Command Modes
The following table shows the modes in which you can enter the command
Crypto ca trustpoint configuration
•
•
•
•
•
:
Command History
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and includes the security appliance serial number in the enrollment request for trustpoint central:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# serial-numberhostname(ca-trustpoint)#Related Commands
server
To specify a default e-mail proxy server, use the server command in the applicable e-mail proxy mode. To remove the attribute from the configuration, use the no version of this command. The security appliance sends requests to the default e-mail server when the user connects to the e-mail proxy without specifying a server. If you do not configure a default server, and a user does not specify a server, the security appliance returns an error.
server {ipaddr or hostname}
no server
Syntax Description
hostname
The DNS name of the default e-mail proxy server.
ipaddr
The IP address of the default e-mail proxy server.
Defaults
There is no default e-mail proxy server by default.
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
•
—
—
•
Imap4s
•
•
—
—
•
Smtps
•
•
—
—
•
Command History
Examples
The following example shows how to set a default POP3S e-mail server with an IP address. of 10.1.1.7:
hostname(config)#pop3shostname(config-pop3s)# server 10.1.1.7server-port
To configure a AAA server port for a host, use the server-port command in AAA-server host mode. To remove the designated server port, use the no form of this command:
server-port port-number
no server-port
Syntax Description
Defaults
The default server ports are as follows:
•
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server group
•
•
•
•
—
Command History
Examples
The following example configures an SDI AAA server named "srvgrp1" to use server port number 8888:
hostname(config)#aaa-server srvgrp1 protocol sdihostname(config-aaa-server-group)#aaa-server srvgrp1 host 192.168.10.10hostname(config-aaa-server-host)#server-port 8888hostname(config-aaa-server-host)#Related Commands
server-separator
To specify a character as a delimiter between the e-mail and VPN server names, use server-separator command in the applicable e-mail proxy mode. To revert to the default, ":", use the no form of this command.
server-separator {symbol}
no server-separator
Syntax Description
symbol
The character that separates the e-mail and VPN server names. Choices are "@," (at) "|" (pipe), ":"(colon), "#" (hash), "," (comma), and ";" (semi-colon).
Defaults
The default is "@" (at).
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
—
•
—
—
Imap4s
•
—
•
—
—
Smtps
•
—
•
—
—
Command History
Usage Guidelines
The server separator must be different from the name separator.
Examples
The following example shows how to set a pipe (|) as the server separator for IMAP4S:
hostname(config)#imap4shostname(config-imap4s)# server-separator |Related Commands
server-type
To manually configure the LDAP server model, use the server-type command in aaa-server host configuration mode. The security appliance supports the following server models:
•
•
To disable this command, use the no form of this command.
server-type {auto-detect| microsoft | sun}
no server-type {auto-detect| microsoft | sun}
Syntax Description
Syntax DescriptionSyntax Description
Defaults
By default, auto-detection attempts to determine the server type.
Command Modes
The following table shows the modes in which you can enter the command:
aaa-server host configuration
•
•
•
•
—
Command History
Usage Guidelines
The security appliance supports LDAP version 3 and is compatible with any LDAP v3 or v2 directory server. However, it supports password management features only on the Sun Microsystems JAVA System Directory Server and the Microsoft Active Directory. For example, the security appliance supports automated reset of an expired password without manual intervention by a system administrator with either a Sun or Microsoft LDAP server. With any other type of LDAP server, such as a Novell or OpenLDAP server, it supports all LDAP functions except for password management. Thus, if someone tries to log in to a security appliance using one of these other servers for authentication and their password has expired, the security appliance drops the connection and a manual password reset is required.
Note
•
By default, the security appliance auto-detects whether it is connected to a Microsoft or a Sun LDAP directory server. However, if auto-detection fails to determine the LDAP server type and if you know the server is either a Microsoft or Sun server, you can use the server-type command to manually configure the server as either a Microsoft or a Sun Microsystems LDAP server.
Examples
The following example, entered in aaa-server host configuration mode, configures the server type for the LDAP server ldapsvr1 at IP address 10.10.0.1. The first example configures a Sun Microsystems LDAP server.
hostname(config)# aaa-server ldapsvr1 protocol ldaphostname(config-aaa-server-group)# aaa-server ldapsvr1 host 10.10.0.1hostname(config-aaa-server-host)# server-type sunhostname(config-aaa-server-host)#The following example specifies that the security appliance use auto-detection to determine the server type:
hostname(config)# aaa-server ldapsvr1 protocol LDAPhostname(config-aaa-server-group)# aaa-server ldapsvr1 host 10.10.0.1hostname(config-aaa-server-host)# server-type auto-detecthostname(config-aaa-server-host)#Related Commands
service
To enable resets for denied TCP connections, use the service command in global configuration mode. To disable resets, use the no form of this command.
service {resetinbound [interface interface_name] | resetoutbound [interface interface_name] | resetoutside}
no service {resetinbound [interface interface_name] | resetoutbound [interface interface_name] | resetoutside}
Syntax Description
Defaults
By default, service resetoutbound is enabled for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
You might want to explicitly send resets for inbound traffic if you need to reset identity request (IDENT) connections. When you send a TCP RST (reset flag in the TCP header) to the denied host, the RST stops the incoming IDENT process so that you do not have to wait for IDENT to time out. Waiting for IDENT to time out can cause traffic to slow because outside hosts keep retransmitting the SYN until the IDENT times out, so the service resetinbound command might improve performance.
Examples
The following example disables outbound resets for all interfaces except for the inside interface:
hostname(config)# no service resetoutboundhostname(config)# service resetoutbound interface insideThe following example enables inbound resets for all interfaces except for the DMZ interface:
hostname(config)# service resetinboundhostname(config)# no service resetinbound interface dmzThe following example enables resets for connections that terminate on the outside interface:
hostname(config)# service resetoutsideRelated Commands
service password-recovery
To enable password recovery, use the service password-recovery command in global configuration mode. To disable password recovery, use the no form of this command. Password recovery is enabled by default, but you might want to disable it to ensure that unauthorized users cannot use the password recovery mechanism to compromise the security appliance.
service password-recovery
no service password-recovery
Syntax Description
This command has no arguments or keywords.
Defaults
Password recovery is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
•
Command History
Usage Guidelines
On the ASA 5500 series adaptive security appliance, if you forget the passwords, you can boot the security appliance into ROMMON by pressing the Escape key on the terminal keyboard when prompted during startup. Then set the security appliance to ignore the startup configuration by changing the configuration register (see the config-register command). For example if your configuration register is the default 0x1, then change the value to 0x41 by entering the confreg 0x41 command. After reloading the security appliance, it loads a default configuration, and you can enter privileged EXEC mode using the default passwords. Then load the startup configuration by copying it to the running configuration and reset the passwords. Finally, set the security appliance to boot as before by setting the configuration register to the original setting. For example, enter the config-register 0x1 command in global configuration mode.
On the PIX 500 series security appliance, boot the security appliance into monitor mode by pressing the Escape key on the terminal keyboard when prompted during startup. Then download the PIX password tool to the security appliance, which erases all passwords and aaa authentication commands.
On the ASA 5500 series adaptive security appliance, the no service password-recovery command prevents a user from entering ROMMON with the configuration intact. When a user enters ROMMON, the security appliance prompts the user to erase all Flash file systems. The user cannot enter ROMMON without first performing this erasure. If a user chooses not to erase the Flash file system, the security appliance reloads. Because password recovery depends on using ROMMON and maintaining the existing configuration, this erasure prevents you from recovering a password. However, disabling password recovery prevents unauthorized users from viewing the configuration or inserting different passwords. In this case, to recover the system to an operating state, load a new image and a backup configuration file, if available. The service password-recovery command appears in the configuration file for informational purposes only; when you enter the command at the CLI prompt, the setting is saved in NVRAM. The only way to change the setting is to enter the command at the CLI prompt. Loading a new configuration with a different version of the command does not change the setting. If you disable password recovery when the security appliance is configured to ignore the startup configuration at startup (in preparation for password recovery), then the security appliance changes the setting to boot the startup configuration as usual. If you use failover, and the standby unit is configured to ignore the startup configuration, then the same change is made to the configuration register when the no service password recovery command replicates to the standby unit.
On the PIX 500 series security appliance, the no service password-recovery command forces the PIX password tool to prompt the user to erase all Flash file systems. The user cannot use the PIX password tool without first performing this erasure. If a user chooses not to erase the Flash file system, the security appliance reloads. Because password recovery depends on maintaining the existing configuration, this erasure prevents you from recovering a password. However, disabling password recovery prevents unauthorized users from viewing the configuration or inserting different passwords. In this case, to recover the system to an operating state, load a new image and a backup configuration file, if available.
Examples
The following example disables password recovery for the ASA 5500 series adaptive security appliance:
hostname(config)# no service password-recoveryWARNING: Executing "no service password-recovery" has disabled the password recovery mechanism and disabled access to ROMMON. The only means of recovering from lost or forgotten passwords will be for ROMMON to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the ROMMON command line.The following example disables password recovery for the PIX 500 series security appliance:
hostname(config)# no service password-recoveryWARNING: Saving "no service password-recovery" in the startup-config will disable password recovery via the npdisk application. The only means of recovering from lost or forgotten passwords will be for npdisk to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the Monitor Mode command line.The following example for the ASA 5500 series adaptive security appliance shows when to enter ROMMON at startup and how to complete a password recovery operation.
Use BREAK or ESC to interrupt boot.Use SPACE to begin boot immediately.Boot interrupted.Use ? for help.rommon #0> confregCurrent Configuration Register: 0x00000001Configuration Summary:boot default image from FlashDo you wish to change this configuration? y/n [n]: nrommon #1> confreg 0x41Update Config Register (0x41) in NVRAM...rommon #2> bootLaunching BootLoader...Boot configuration file contains 1 entry.Loading disk0:/ASA_7.0.bin... Booting...###################...Ignoring startup configuration as instructed by configuration register.Type help or '?' for a list of available commands.hostname> enablePassword:hostname# configure terminalhostname(config)# copy startup-config running-configDestination filename [running-config]?Cryptochecksum(unchanged): 7708b94c e0e3f0d5 c94dde05 594fbee9892 bytes copied in 6.300 secs (148 bytes/sec)hostname(config)# enable password NewPasswordhostname(config)# config-register 0x1Related Commands
config-register
Sets the security appliance to ignore the startup configuration when it reloads.
enable password
Sets the enable password.
password
Sets the login password.
service-policy
To activate a policy map globally on all interfaces or on a targeted interface, use the service-policy command in privileged EXEC mode. To disable, use the no form of this command. Use the service-policy command to enable a set of policies on an interface. In general, a service-policy command can be applied to any interface that can be defined by the nameif command.
service-policy policymap_name [ global | interface intf ]
no service-policy policymap_name [ global | interface intf ]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
If an interface name is specified, the policy-map only applies to the interface. The interface name is defined in the nameif command, and an interface policy-map overrides a global policy-map. Only one policy-map is allowed per interface.
Only one global policy is allowed.
Examples
The following example shows the syntax of the service-policy command:
hostname(config)# service-policy outside_security_map outsidehostname(config)#Related Commands
session
To establish a Telnet session to an intelligent SSM, such as an AIP SSM or a CSC SSM, use the session command in privileged EXEC mode.
session slot [do | ip]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
7.0(1)
This command was introduced.
7.1(1)
The do and ip keywords were added. These keywords are for use only when advised to do so by Cisco TAC.
Usage Guidelines
This command is only available when the SSM is in the Up state. See the show module command for state information.
To end a session, enter exit or Ctrl-Shift-6 then the X key.
Examples
The following example sessions to an SSM in slot 1:
hostname# session 1Opening command session with slot 1.Connected to slot 1. Escape character sequence is 'CTRL-^X'.Related Commands
set connection
To specify connection values within a policy-map for a traffic class, use the set connection command in class mode. Use this command to specify the maximum number of simultaneous connections and to specify whether TCP sequence number randomization is enabled. To remove these specifications, thereby allowing unlimited connections, use the no form of this command.
set connection {conn-max n | embryonic-conn-max n | per-client-embryonic-max n | per-client-max n | random-sequence-number {enable | disable}}. . .
no set connection {conn-max n | embryonic-conn-max n | per-client-embryonic-max n | per-client-max n | random-sequence-number {enable | disable}}. . .
Syntax Description
Defaults
For the conn-max, embryonic-conn-max, per-client-embryonic-max, and per-client-max parameters, the default value of n is 0, which allows unlimited connections.
Sequence number randomization is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
7.0(1)
This command was introduced.
7.1(1)
The per-client-embryonic-max and per-client-max keywords were added.
Usage Guidelines
While the conn-max, embryonic-conn-max, per-client-embryonic-max, per-client-max, random-sequence-number keywords are all optional, you must specify at least one of them.
You can enter this command with multiple parameters or you can enter each parameter as a separate command. The security appliance combines the commands into one line in the running configuration. For example, if you entered the following two commands in Class configuration mode:
hostname(config-pmap-c)# set connection conn-max 600hostname(config-pmap-c)# set connection embryonic-conn-max 50the output of the show running-config policy-map command would display the result of the two commands in a single, combined command:
set connection conn-max 600 embryonic-conn-max 50The set connection command parameters (conn-max, embryonic-conn-max, per-client-embryonic-max, per-client-max, random-sequence-number) can co-exist with any nat or static command; that is, you can configure connection parameters either through the nat/static commands using max-conn, emb_limit, or noramdomseq parameters, or through the MPC set connection command using conn-max, embryonic-conn-max, per-client-embryonic-max, per-client-max or random-sequence-number parameters. A mixed configuration is not recommended, but if one exists, it behaves in the following ways:
•
•
The per-client-embryonic-max and per-client-max parameters limit the maximum number of connections that a client can open. If particular clients use more network resources simultaneously than is desired, you can use these parameters to limit the number of connections that the security appliance will allow specific clients. DoS attacks seek to disrupt networks by overwhelming the capacity of key hosts with connections or requests for connections. You can use the per-client-embryonic-max and per-client-max parameters to thwart DoS attacks. After you configure a per-client maximum that can be supported by hosts likely to be attacked, malicious clients will be unable to overwhelm hosts on protected networks.
Examples
The following is an example of the use of the set connection command configure the maximum number of simultaneous connections as 256 and to disable TCP sequence number randomization:
hostname(config)# policy-map localpolicy1hostname(config-pmap)# class local_serverhostname(config-pmap-c)# set connection conn-max 256 random-sequence-number disablehostname(config-pmap-c)#The following is an example of the use of the set connection command in a service policy that diverts traffic to a Cisco Content Security and Control (CSC) SSM. The set connection command restricts each client whose traffic the CSC SSM scans to a maximum of five connections.
hostname(config)# policy-map csc_policyhostname(config-pmap)# class local_serverhostname(config-pmap-c)# set connection per-client-max 5hostname(config-pmap-c)# csc fail-closehostname(config-pmap-c)#Related Commands
set connection advanced-options
To specify advanced TCP connection options within a policy-map for a traffic class, use the set connection advanced-options command in class mode. To remove advanced TCP connection options for a traffic class within a policy map, use the no form of this command.
set connection advanced-options tcp-mapname
no set connection advanced-options tcp-mapname
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command, as well as the TCP map name, before issuing this command. See the description of the tcp-map command for detailed information.
Examples
The following example shows the use of the set connection advanced-options command to specify the use of a TCP map named localmap:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1hostname(config)# class-map http-serverhostname(config-cmap)# match access-list http-serverhostname(config-cmap)# exithostname(config)# tcp-map localmaphostname(config)# policy-map global_policy globalhostname(config-pmap)# description This policy map defines a policy concerning connection to http server.hostname(config-pmap)# class http-serverhostname(config-pmap-c)# set connection advanced-options localmaphostname(config-pmap-c)#Related Commands
set connection timeout
To configure the timeout period, after which an idle TCP connection is disconnected, use the set connection timeout command in class mode. To remove the timeout, use the no form of this command.
set connection timeout tcp hh[:mm[:ss]] [reset]
no set connection timeout tcp
set connection timeout embryonic hh[:mm[:ss]]
no set connection timeout embryonic
set connection timeout half-closed hh[:mm[:ss]]
no set connection timeout half-closed
Syntax Description
Defaults
The default embryonic connection timeout value is 30 seconds.
The default half-closed connection timeout value is 10 minutes.
The default tcp connection timeout value is 1 hour.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command before issuing this command.
A TCP connection for which a three-way handshake is not complete is an embryonic connection. For the embryonic connection timeout value, use 0:0:0 to specify that the connection never times out. Otherwise, the timeout duration must be at least 5 seconds.
When the TCP connection is in the closing state, use the half-closed parameter to configure the length of time until the connection is freed. Use 0:0:0 to specify that the connection never times out. The minimum timeout duration is 5 minutes.
The tcp inactive connection timeout configures the period after which an idle TCP connection in the established state is disconnected. Use 0:0:0 to specify that the connection never times out. The minimum timeout duration is 5 minutes.
The reset keyword is used to send a TCP RST packet to both end systems once an idle TCP connection has timed out. Some applications require a TCP RST after a timeout to perform properly.
Examples
The following is an example of a set connection timeout command that specifies an embryonic connection timeout of two minutes:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1hostname(config)# class-map http-serverhostname(config-cmap)# match access-list http-serverhostname(config-cmap)# exithostname(config)# policy-map global_policy globalhostname(config-pmap)# description This policy map defines a policy concerning connection to http server.hostname(config-pmap)# class http-serverhostname(config-pmap-c)# set connection timeout embryonic 00:2:00hostname(config-pmap-c)#Related Commands
set metric
To set the metric value for a routing protocol, use the set metric command in route-map configuration mode. To return to the default metric value, use the no form of this command.
set metric value
no set metric value
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
—
—
Command History
Usage Guidelines
The no set metric value command allows you to return to the default metric value. In this context, the value is an integer from 0 to 4294967295.
Examples
The following example shows how to configure a route map for OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# show route-maproute-map maptag1 permit 8set metric 5match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
set metric-type
To specify the type of OSPF metric routes, use the set metric-type command in route-map configuration mode. To return to the default setting, use the no form of this command.
set metric-type {type-1 | type-2}
no set metric-type
Syntax Description
type-1
Specifies the type of OSPF metric routes that are external to a specified autonomous system.
type-2
Specifies the type of OSPF metric routes that are external to a specified autonomous system.
Defaults
The default is type-2.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
—
—
Command History
Examples
The following example shows how to configure a route map for OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# set metric-type type-2hostname(config-route-map)# show route-maproute-map maptag1 permit 8set metric 5set metric-type type-2match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
setup
To configure a minimal configuration for the security appliance using interactive prompts, enter the setup command in global configuration mode. This configuration provides connectivity to use ASDM. See also the configure factory-default command to restore the default configuration.
setup
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The setup dialog automatically appears at boot time if there is no startup configuration in Flash memory.
Before you can use the setup command, you must have an inside interface already configured. The PIX 500 series default configuration includes an inside interface (Ethernet 1), but the ASA 550 series default configuration does not. Before using the setup command, enter the interface command for the interface you want to make inside, and then the nameif inside command.
In multiple context mode, you can use the setup command in the system execution space and for each context.
When you enter the setup command, you are asked for the information in Table 24-1. The system setup command includes a subset of these prompts. If there is already a configuration for the prompted parameter, it appears in barckets so you can either accept it as the default or override it by entering something new.
Examples
This example shows how to complete the setup command prompts:
hostname(config)# setupPre-configure Firewall now through interactive prompts [yes]? yesFirewall Mode [Routed]: routedEnable password [<use current password>]: writerAllow password recovery [yes]? yesClock (UTC):Year: 2005Month: NovDay: 15Time: 10:0:0Inside IP address: 192.168.1.1Inside network mask: 255.255.255.0Host name: tech_pubsDomain name: your_company.comIP address of host running Device Manager: 10.1.1.1The following configuration will be used:Enable password: writerAllow password recovery: yesClock (UTC): 20:54:44 Sep 17 2005Firewall Mode: RoutedInside IP address: 192.168.1.1Inside network mask: 255.255.255.0Host name: tech_pubsDomain name: your_company.comIP address of host running Device Manager: 10.1.1.1Use this configuration and write to flash? yesRelated Commands
show aaa local user
To show the list of usernames that are currently locked, or to show details about the username, use the show aaa local user command in global configuration mode.
show aaa local user [locked]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you omit the optional keyword locked, the security appliance displays the failed-attempts and lockout status details for all AAA local users.
You can specify a single user by using the username option or all users with the all option.
This command affects only the status of users that are locked out.
The administrator cannot be locked out of the device.
Examples
The following example shows use of the show aaa local user command to display the lockout status of all usernames:
This example shows the use of the show aaa local user command to display the number of failed authentication attempts and lockout status details for all AAA local users, after the limit has been set to 5:
hostname(config)# aaa local authentication attempts max-fail 5hostname(config)# show aaa local userLock-time Failed-attempts Locked User- 6 Y test- 2 N mona- 1 N cisco- 4 N newuserhostname(config)#This example shows the use of the show aaa local user command with the lockout keyword to display the number of failed authentication attempts and lockout status details only for any locked-out AAA local users, after the limit has been set to 5:
hostname(config)# aaa local authentication attempts max-fail 5hostname(config)# show aaa local userLock-time Failed-attempts Locked User- 6 Y testhostname(config)#Related Commands
show aaa-server
To display AAA server statistics for AAA servers, use the show aaa-server command in privileged EXEC mode:
show aaa-server [LOCAL | groupname [host hostname] | protocol protocol]
Syntax Description
Defaults
By default, all AAA server statistics display.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Preexisting
This command was preexisting.
7.1(1)
The http form protocol was added.
Examples
This example shows the use of the show aaa-server command to display statistics for a particular host in server group group1:
hostname(config)# show aaa-server group1 host 192.68.125.60Server Group: group1Server Protocol: RADIUSServer Address: 192.68.125.60Server port: 1645Server status: ACTIVE/FAILED. Last transaction (success) at 11:10:08 UTC Fri Aug 22Number of pending requests 20Average round trip time 4msNumber of authentication requests 20Number of authorization requests 0Number of accounting requests 0Number of retransmissions 1Number of accepts 16Number of rejects 4Number of challenges 5Number of malformed responses 0Number of bad authenticators 0Number of pending requests 0Number of timeouts 0Number of unrecognized responses 0hostname(config)#This example shows the use of the show aaa-server command to show the statistics for all servers in a small, inactive system:
hostname(config)# show aaa-serverServer Group: LOCALServer Protocol: Local databaseServer Address: NoneServer port: NoneServer status: ACTIVE, Last transaction at unknownNumber of pending requests 0Average round trip time 0msNumber of authentication requests 0Number of authorization requests 0Number of accounting requests 0Number of retransmissions 0Number of accepts 0Number of rejects 0Number of challenges 0Number of malformed responses 0Number of bad authenticators 0Number of timeouts 0Number of unrecognized responses 0hostname(config)#Related Commands
show running-config aaa-server
Display statistics for all servers in the indicated server group or for a particular server.
clear aaa-server statistics
Clear the AAA server statistics.
show access-list
To display the counters for an access list, use the show access-list command in privileged EXEC mode.
show access-list id
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show access-list command:
hostname# show access-listaccess-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)alert-interval 300access-list 101; 10 elementsaccess-list 101 line 1 extended permit tcp any eq www any (hitcnt=0) 0xa14fc533 access-list 101 line 2 extended permit tcp any eq www any eq www (hitcnt=0) 0xaa73834e access-list 101 line 3 extended permit tcp any eq www any range telnet www (hitcnt=0) 0x49ac02e6access-list 101 line 4 extended permit tcp any range telnet www any range telnet www (hitcnt=0) 0xa0021a9faccess-list 101 line 5 extended permit udp any range biff www any (hitcnt=0) 0xf89a7328access-list 101 line 6 extended permit udp any lt ntp any (hitcnt=0) 0x8983c43 access-list 101 line 7 extended permit udp any any lt ntp (hitcnt=0) 0xf361ffb6access-list 101 line 8 extended permit udp any any range ntp biff (hitcnt=0) 0x219581access-list 101 line 9 extended permit icmp any any (hitcnt=0) 0xe8fa08e1access-list 101 line 10 extended permit icmp any any echo (hitcnt=0) 0x2eb8deeaaccess-list 102; 1 elements access-list 102 line 1 extended permit icmp any any echo (hitcnt=0) 0x59e2fea8The output contains a unique hexamdecimal identifier for each access control entry at the end of each line.Related Commands
show activation-key
To display the commands in the configuration for features that are enabled by your activation key, including the number of contexts allowed, use the show activation-key command in privileged EXEC mode.
show activation-key
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
PIX Version 7.0
Support for this command was introduced on the security appliance.
Usage Guidelines
The show activation-key command output indicates the status of the activation key as follows:
•
The flash activation key is the SAME as the running key.•
The flash activation key is DIFFERENT from the running key.The flash activation key takes effect after the next reload.•
•
•
Examples
This example shows how to display the commands in the configuration for features that are enabled by your activation key:
hostname(config)# show activation-keySerial Number: P3000000134 Running Activation Key: 0xyadayada 0xyadayada 0xyadayada 0xyadayada 0xyadayadaLicense Features for this Platform:Maximum Physical Interfaces : UnlimitedMaximum VLANs : 50Inside Hosts : UnlimitedFailover : EnabledVPN-DES : EnabledVPN-3DES-AES : DisabledCut-through Proxy : EnabledGuards : EnabledURL-filtering : EnabledSecurity Contexts : 20GTP/GPRS : DisabledVPN Peers : 5000The flash activation key is the SAME as the running key.hostname(config)#Related Commands
show admin-context
To display the context name currently assigned as the admin context, use the show admin-context command in privileged EXEC mode.
show admin-context
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following is sample output from the show admin-context command. The following example shows the admin context called "admin" and stored in the root directory of flash:
hostname# show admin-contextAdmin: admin flash:/admin.cfgRelated Commands
show arp
To view the ARP table, use the show arp command in privileged EXEC mode. This command shows dynamic and manual ARP entries, but does not identify the origin of each entry.
show arp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show arp command:
hostname# show arpinside 10.86.195.205 0008.023b.9892inside 10.86.194.170 0001.023a.952dinside 10.86.194.172 0001.03cf.9e79inside 10.86.194.1 00b0.64ea.91a2inside 10.86.194.146 000b.fcf8.c4adinside 10.86.194.168 000c.ce6f.9b7eRelated Commands
show arp-inspection
To view the ARP inspection setting for each interface, use the show arp-inspection command in privileged EXEC mode.
show arp-inspection
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show arp-inspection command:
hostname# show arp-inspectioninterface arp-inspection miss----------------------------------------------------inside1 enabled floodoutside disabled -The miss column shows the default action to take for non-matching packets when ARP inspection is enabled, either "flood" or "no-flood."
Related Commands
show arp statistics
To view ARP statistics, use the show arp statistics command in privileged EXEC mode.
show arp statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show arp statistics command:
hostname# show arp statisticsNumber of ARP entries:ASA : 6Dropped blocks in ARP: 6Maximum Queued blocks: 3Queued blocks: 1Interface collision ARPs Received: 5ARP-defense Gratuitous ARPS sent: 4Total ARP retries: 15Unresolved hosts: 1Maximum Unresolved hosts: 2Table 2 shows each field description.
Related Commands
show asdm history
To display the contents of the ASDM history buffer, use the show asdm history command in privileged EXEC mode.
show asdm history [view timeframe] [snapshot] [feature feature] [asdmclient]
Syntax Description
Defaults
If no arguments or keywords are specified, all history information for all features is displayed.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0(1)
This command was changed from the show pdm history command to the show asdm history command.
Usage Guidelines
The show asdm history command displays the contents of the ASDM history buffer. Before you can view ASDM history information, you must enable ASDM history tracking using the asdm history enable command.
Examples
The following is sample output from the show asdm history command. It limits the output to data for the outside interface collected during the last 10 minutes.
hostname# show asdm history view 10m feature interface outsideInput KByte Count:[ 10s:12:46:41 Mar 1 2005 ] 62640 62636 62633 62628 62622 62616 62609Output KByte Count:[ 10s:12:46:41 Mar 1 2005 ] 25178 25169 25165 25161 25157 25151 25147Input KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 752 752 751 751 751 751 751Output KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 55 55 55 55 55 55 55Input Bit Rate:[ 10s:12:46:41 Mar 1 2005 ] 3397 2843 3764 4515 4932 5728 4186Output Bit Rate:[ 10s:12:46:41 Mar 1 2005 ] 7316 3292 3349 3298 5212 3349 3301Input Packet Rate:[ 10s:12:46:41 Mar 1 2005 ] 5 4 6 7 6 8 6Output Packet Rate:[ 10s:12:46:41 Mar 1 2005 ] 1 0 0 0 0 0 0Input Error Packet Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0No Buffer:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Received Broadcasts:[ 10s:12:46:41 Mar 1 2005 ] 375974 375954 375935 375902 375863 375833 375794Runts:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Giants:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0CRC:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Frames:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Overruns:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Underruns:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Output Error Packet Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Collisions:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0LCOLL:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Reset:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Deferred:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Lost Carrier:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Hardware Input Queue:[ 10s:12:46:41 Mar 1 2005 ] 128 128 128 128 128 128 128Software Input Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Hardware Output Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Software Output Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Drop KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0hostname#The following is sample output from the show asdm history command. Like the previous example, it limits the output to data for the outside interface collected during the last 10 minutes. However, in this example the output is formatted for the ASDM client.
hostname# show asdm history view 10m feature interface outside asdmclientMH|IBC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|62439|62445|62453|62457|62464|6 2469|62474|62486|62489|62496|62501|62506|62511|62518|62522|62530|62534|62539|62542|62547|6 2553|62556|62562|62568|62574|62581|62585|62593|62598|62604|62609|62616|62622|62628|62633|6 2636|62640|62653|62657|62665|62672|62678|62681|62686|62691|62695|62700|62704|62711|62718|6 2723|62728|62733|62738|62742|62747|62751|62761|62770|62775|MH|OBC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|25023|25023|25025|25025|25025|2 5026|25026|25032|25038|25044|25052|25056|25060|25064|25070|25076|25083|25087|25091|25096|2 5102|25106|25110|25114|25118|25122|25128|25133|25137|25143|25147|25151|25157|25161|25165|2 5169|25178|25321|25327|25332|25336|25341|25345|25349|25355|25359|25363|25367|25371|25375|2 5381|25386|25390|25395|25399|25403|25410|25414|25418|25422|MH|IPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|749|749|749|749|749|750|750|750 |750|750|750|750|750|750|750|750|750|750|750|750|751|751|751|751|751|751|751|751|751|751|7 51|751|751|751|751|752|752|752|752|752|752|752|752|752|752|752|752|752|752|753|753|753|753 |753|753|753|753|753|753|753|MH|OPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|55|55|55|55|55|55|55|55|55|55|5 5|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|5 5|55|55|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|MH|IBR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|7127|5155|6202|3545|5408|3979|4 381|9492|3033|4962|4571|4226|3760|5923|3265|6494|3441|3542|3162|4076|4744|2726|4847|4292|5 401|5166|3735|6659|3837|5260|4186|5728|4932|4515|3764|2843|3397|10768|3080|6309|5969|4472| 2780|4492|3540|3664|3800|3002|6258|5567|4044|4059|4548|3713|3265|4159|3630|8235|6934|4298|MH|OBR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|82791|57|1410|588|57|639|0|4698 |5068|4992|6495|3292|3292|3352|5061|4808|5205|3931|3298|3349|5064|3439|3356|3292|3343|3349 |5067|3883|3356|4500|3301|3349|5212|3298|3349|3292|7316|116896|5072|3881|3356|3931|3298|33 49|5064|3292|3349|3292|3292|3349|5061|3883|3356|3931|3452|3356|5064|3292|3349|3292|MH|IPR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|12|8|6|5|7|5|6|14|5|7|7|5|6|9|5 |8|6|5|5|7|6|5|6|5|6|7|6|8|6|6|6|8|6|7|6|4|5|19|5|8|7|6|4|7|5|6|6|5|7|8|6|6|7|5|5|7|6|9|7| 6|MH|OPR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|12|0|1|0|0|0|0|4|0|2|2|0|0|0|0| 1|1|0|0|0|0|0|0|0|0|0|0|0|0|1|0|0|0|0|0|0|1|28|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |MH|IERR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|NB|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|RB|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|374874|374911|374943|374967|3750 10|375038|375073|375113|375140|375160|375181|375211|375243|375289|375316|375350|375373|375 395|375422|375446|375481|375498|375535|375561|375591|375622|375654|375701|375738|375761|37 5794|375833|375863|375902|375935|375954|375974|375999|376027|376075|376115|376147|376168|3 76200|376224|376253|376289|376315|376365|376400|376436|376463|376508|376530|376553|376583| 376614|376668|376714|376749|MH|RNT|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|GNT|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|CRC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|FRM|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|OR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|UR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|OERR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|COLL|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|LCOLL|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |MH|RST|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|DEF|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|LCR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|HIQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|128|128|128|128|128|128|128|128 |128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|1 28|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128 |128|128|128|128|128|128|128|MH|SIQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|HOQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|SOQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|DPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|hostname#The following is sample output from the show asdm history command using the snapshot keyword:
hostname# show asdm history view 10m snapshotAvailable 4 byte Blocks: [ 10s] : 100Used 4 byte Blocks: [ 10s] : 0Available 80 byte Blocks: [ 10s] : 100Used 80 byte Blocks: [ 10s] : 0Available 256 byte Blocks: [ 10s] : 2100Used 256 byte Blocks: [ 10s] : 0Available 1550 byte Blocks: [ 10s] : 7425Used 1550 byte Blocks: [ 10s] : 1279Available 2560 byte Blocks: [ 10s] : 40Used 2560 byte Blocks: [ 10s] : 0Available 4096 byte Blocks: [ 10s] : 30Used 4096 byte Blocks: [ 10s] : 0Available 8192 byte Blocks: [ 10s] : 60Used 8192 byte Blocks: [ 10s] : 0Available 16384 byte Blocks: [ 10s] : 100Used 16384 byte Blocks: [ 10s] : 0Available 65536 byte Blocks: [ 10s] : 10Used 65536 byte Blocks: [ 10s] : 0CPU Utilization: [ 10s] : 31Input KByte Count: [ 10s] : 62930Output KByte Count: [ 10s] : 26620Input KPacket Count: [ 10s] : 755Output KPacket Count: [ 10s] : 58Input Bit Rate: [ 10s] : 24561Output Bit Rate: [ 10s] : 518897Input Packet Rate: [ 10s] : 48Output Packet Rate: [ 10s] : 114Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 377331Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 3672Output KByte Count: [ 10s] : 4051Input KPacket Count: [ 10s] : 19Output KPacket Count: [ 10s] : 20Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 1458Runts: [ 10s] : 1Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 63LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 15Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 0Output KByte Count: [ 10s] : 0Input KPacket Count: [ 10s] : 0Output KPacket Count: [ 10s] : 0Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 0Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 0Output KByte Count: [ 10s] : 0Input KPacket Count: [ 10s] : 0Output KPacket Count: [ 10s] : 0Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 0Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Available Memory: [ 10s] : 205149944Used Memory: [ 10s] : 63285512Xlate Count: [ 10s] : 0Connection Count: [ 10s] : 0TCP Connection Count: [ 10s] : 0UDP Connection Count: [ 10s] : 0URL Filtering Count: [ 10s] : 0URL Server Filtering Count: [ 10s] : 0TCP Fixup Count: [ 10s] : 0TCP Intercept Count: [ 10s] : 0HTTP Fixup Count: [ 10s] : 0FTP Fixup Count: [ 10s] : 0AAA Authentication Count: [ 10s] : 0AAA Authorzation Count: [ 10s] : 0AAA Accounting Count: [ 10s] : 0Current Xlates: [ 10s] : 0Max Xlates: [ 10s] : 0ISAKMP SAs: [ 10s] : 0IPSec SAs: [ 10s] : 0L2TP Sessions: [ 10s] : 0L2TP Tunnels: [ 10s] : 0hostname#Related Commands
show asdm image
To the current ASDM software image file, use the show asdm image command in privileged EXEC mode.
show asdm image
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
7.0(1)
This command was changed from the show pdm image command to the show asdm image command.
Examples
The following is sample output from the show asdm image command:
hostname# show asdm imageDevice Manager image file, flash:/ASDMRelated Commands
show asdm log_sessions
To display a list of active ASDM logging sessions and their associated session IDs, use the show asdm log_sessions command in privileged EXEC mode.
show asdm log_sessions
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Each active ASDM session has one or more associated ASDM logging sessions. ASDM uses the logging session to retrieve syslog messages from the security appliance. Each ASDM logging session is assigned a unique session ID. You can use this session ID with the asdm disconnect log_session command to terminate the specified session.
Note
Examples
The following is sample output from the show asdm log_sessions command:
hostname# show asdm log_sessions0 192.168.1.11 192.168.1.2Related Commands
show asdm sessions
To display a list of active ASDM sessions and their associated session IDs, use the show asdm sessions command in privileged EXEC mode.
show asdm sessions
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
7.0(1)
This command was changed from the show pdm sessions command to the show asdm sessions command.
Usage Guidelines
Each active ASDM session is assigned a unique session ID. You can use this session ID with the asdm disconnect command to terminate the specified session.
Examples
The following is sample output from the show asdm sessions command:
hostname# show asdm sessions0 192.168.1.11 192.168.1.2Related Commands
