-
Cisco Security Appliance Command Reference, Version 7.1
-
About this Guide
-
Using the Command Line Interface
-
aaa accounting through accounting-server-group
-
acl-netmask-convert through auto-update timeout Commands
-
backup-servers through browse networks Commands
-
cache through clear compression Commands
-
clear configure through clear configure vpn-load-balancing Commands
-
clear console-output through clear xlate Commands
-
client-access-rule through crl-configure Commands
-
crypto ca authenticate through customization Commands
-
debug aaa through debug xdmcp Commands
-
default through duplex Commands
-
email through functions Commands
-
gateway through hw-module module shutdown Commands
-
icmp through imap4s Commands
-
inspect ctiqbe through inspect xdmcp Commands
-
interface-dhcp through issuer-name Commands
-
join-failover-group through kill Commands
-
ldap-attribute-map through log-adj-changes Commands
-
logging asdm through logout message Commands
-
mac-address through multicast-routing Commands
-
name through override-account-disable Commands
-
page style through pwd Commands
-
queue-limit through routerospf Commands
-
same-security-traffic through show asdm sessions Commands
-
show asp drop through show curpriv Commands
-
show debug through show ipv6 traffic Commands
-
show isakmp sa through show route Commands
-
show running-config through show running-config isakmp Commands
-
show running-config ldap through show running-config webvpn auto-signon Commands
-
show service-policy through show webvpn svc Commands
-
shun through sysopt uauth allow-http-cache Commands
-
tcp-map through tx-ring-limit Commands
-
urgent-flag through write terminal Commands
-
Feedback
Table Of Contents
tcp-map through tx-ring-limit Commands
timeout (dns-server-group configuration mode)
tunnel-group general-attributes
tunnel-group webvpn-attributes
tunnel-group-map default-group
tcp-map through tx-ring-limit Commands
tcp-map
To define a set of TCP normalization actions, use the tcp-map command in global configuration mode. The TCP normalization feature lets you specify criteria that identify abnormal packets, which the security appliance drops when they are detected. To remove the TCP map, use the no form of this command.
tcp-map map_name
no tcp-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
This feature uses Modular Policy Framework. First define the TCP normalization actions you want to take using the tcp-map command. The tcp-map command enters tcp-map configuration mode, where you can enter one or more commands to define the TCP normalization actions. Then define the traffic to which you want to apply the TCP map using the class-map command. Enter the policy-map command to define the policy, and enter the class command to reference the class map. In class configuration mode, enter the set connection advanced-options command to reference the TCP map. Finally, apply the policy map to an interface using the service-policy command. For more information about how Modular Policy Framework works, see the Cisco Security Appliance Command Line Configuration Guide.
The following commands are available in tcp-map configuration mode:
Examples
For example, to allow urgent flag and urgent offset packets for all traffic sent to the range of TCP ports between the well known FTP data port and the Telnet port, enter the following commands:
hostname(config)# tcp-map tmaphostname(config-tcp-map)# urgent-flag allowhostname(config-tcp-map)# class-map urg-classhostname(config-cmap)# match port tcp range ftp-data telnethostname(config-cmap)# policy-map pmaphostname(config-pmap)# class urg-classhostname(config-pmap-c)# set connection advanced-options tmaphostname(config-pmap-c)# service-policy pmap globalRelated Commands
tcp-options
To allow or clear the TCP options through the security appliance, use the tcp-options command in tcp-map configuration mode. To remove this specification, use the no form of this command.
tcp-options {selective-ack | timestamp | window-scale} {allow | clear}
no tcp-options {selective-ack | timestamp | window-scale} {allow | clear}
tcp-options range lower upper {allow | clear | drop}
no tcp-options range lower upper {allow | clear | drop}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the tcp-options command in tcp-map configuration mode to clear selective-acknowledgement, window-scale, and timestamp TCP options. You can also clear or drop packets with options that are not very well defined.
Examples
The following example shows how to drop all packets with TCP options in the ranges of 6-7 and 9-255:
hostname(config)# access-list TCP extended permit tcp any anyhostname(config)# tcp-map tmaphostname(config-tcp-map)# tcp-options range 6 7 drophostname(config-tcp-map)# tcp-options range 9 255 drophostname(config)# class-map cmaphostname(config-cmap)# match access-list TCPhostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalhostname(config)#Related Commands
telnet
To add Telnet access to the console and set the idle timeout, use the telnet command in global configuration mode. To remove Telnet access from a previously set IP address, use the no form of
this command.telnet {{hostname | IP_address mask interface_name} | {IPv6_address interface_name} | {timeout number}}
no telnet {{hostname | IP_address mask interface_name} | {IPv6_address interface_name} | {timeout number}}
Syntax Description
Defaults
By default, Telnet sessions left idle for five minutes are closed by the security appliance.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
The variable IPv6_address was added. The no telnet timeout command was added too.
Usage Guidelines
The telnet command lets you specify which hosts can access the security appliance console with Telnet. You can enable Telnet to the security appliance on all interfaces. However, the security appliance enforces that all Telnet traffic to the outside interface be protected by IPSec. To enable a Telnet session to the outside interface, configure IPSec on the outside interface to include IP traffic that is generated by the security appliance and enable Telnet on the outside interface.
Use the no telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout command to set the maximum time that a console Telnet session can be idle before being logged off by the security appliance. You cannot use the no telnet command with the telnet timeout command.
If you enter an IP address, you must also enter a netmask. There is no default netmask. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address. To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255.
If IPSec is operating, you can specify an unsecure interface name, which is typically, the outside interface. At a minimum, you might configure the crypto map command to specify an interface name with the telnet command.
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the security appliance console. Use the kill command to terminate an active Telnet console session.
If you use the aaa command with the console keyword, Telnet console access must be authenticated with an authentication server.
Note
Examples
This example shows how to permit hosts 192.168.1.3 and 192.168.1.4 to access the security appliance console through Telnet. In addition, all the hosts on the 192.168.2.0 network are given access.
hostname(config)# telnet 192.168.1.3 255.255.255.255 insidehostname(config)# telnet 192.168.1.4 255.255.255.255 insidehostname(config)# telnet 192.168.2.0 255.255.255.0 insidehostname(config)# show running-config telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideThis example shows how to change the maximum session idle duration:
hostname(config)# telnet timeout 10hostname(config)# show running-config telnet timeouttelnet timeout 10 minutesThis example shows a Telnet console login session (the password does not display when entered):
hostname# passwd: ciscoWelcome to the XXX...Type help or `?' for a list of available commands.hostname>You can remove individual entries with the no telnet command or all telnet command statements with the clear configure telnet command:hostname(config)# no telnet 192.168.1.3 255.255.255.255 insidehostname(config)# show running-config telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insidehostname(config)# clear configure telnetRelated Commandsshow telnet
terminal
To allow system log messages to show in the current Telnet session, use the terminal monitor command in privileged EXEC mode. To disable system log messages, use the terminal no monitor command.
terminal {monitor | no monitor}
Syntax Description
monitor
Enables the display of system log messages on the current Telnet session.
no monitor
Disables the display of system log messages on the current Telnet session.
Defaults
System log messages are disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
This example shows how to enable logging and then disable logging only in the current session:
hostname# terminal monitorhostname# terminal no monitorRelated Commands
terminal pager
To set the number of lines on a page before the "
192.168.2.0 255.255.255.0 inside"---more---prompt appears for Telnet sessions, use the terminal pager command in privileged EXEC mode.terminal pager [lines] lines
Syntax Description
Defaults
The default is 24 lines.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command changes the pager line setting only for the current Telnet session. To save a new default pager setting to the configuration, use the pager command.
If you Telnet to the admin context, then the pager line setting follows your session when you change to other contexts, even if the pager command in a given context has a different setting. To change the current pager setting, enter the terminal pager command with a new setting, or you can enter the pager command in the current context. In addition to saving a new pager setting to the context configuration, the pager command applies the new setting to the current Telnet session.
Examples
The following example changes the number of lines displayed to 20:
hostname# terminal pager 20Related Commands
terminal width
To set the width for displaying information during console sessions, use the terminal width command in global configuration mode. To disable, use the no form of this command.
terminal width columns
no terminal width columns
Syntax Description
Defaults
The default display width is 80 columns.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Examples
This example shows how to terminal display width to 100 columns:
hostname# terminal width 100Related Commands
test aaa-server
Use the test aaa-server command to check whether the security appliance can authenticate or authorize users with a particular AAA server. Failure to reach the AAA server may be due to incorrect configuration on the security appliance, or the AAA server may be unreachable for other reasons, such as restrictive network configurations or server downtime.
test aaa-server {authentication | authorization} server-tag [host server-ip] [username username] [password password]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The test aaa-server command enables you to verify that the security appliance can authenticate and authorize users with a particular AAA server. Using this command simplifies verification of the configuration on the security appliance by removing the necessity of testing with a real supplicant. It also helps you isolate whether authentication and authorization failures are due to misconfiguration of AAA server parameters, a connection problem to the AAA server, or other configuration errors on the security appliance.
When you enter the command, you can omit the host and password keyword and argument pairs. The security appliance will prompt you for their values. If you are performing an authentication test, you can also omit the password keyword and argument pair and provide the password when the security appliance prompts you.
Examples
The following example configures a RADIUS AAA server named srvgrp1 on host 192.168.3.4, sets a timeout of 9 seconds, sets a retry-interval of 7 seconds, and configures authentication port 1650. The test aaa-server command following the setup of the AAA server parameters indicates that the authentication test failed to reach the server.
hostname(config)#aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)#aaa-server svrgrp1 host 192.168.3.4hostname(config-aaa-server-host)#timeout 9hostname(config-aaa-server-host)#retry-interval 7hostname(config-aaa-server-host)#authentication-port 1650hostname(config-aaa-server-host)#exithostname(config)#test aaa-server authentication svrgrp1Server IP Address or name:192.168.3.4Username:bogusPassword:******INFO: Attempting Authentication test to IP address <192.168.3.4> (timeout: 10 seconds)ERROR: Authentication Server not responding: No errorRelated Commands
test sso-server
To test an SSO server with a trial authentication request, use the test sso-server command in privileged EXEC mode. This is an SSO with CA SiteMinder command.
test sso-server server-name username user-name
Syntax Description
Syntax DescriptionSyntax Description
server-name
Specifies the name of the SSO server being tested.
user-name
Specifies the name of a user on the SSO server being tested.
Defaults
No default values or behavior.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without reentering a username and password more than once. The test sso-server command tests whether an SSO server is recognized and responding to authentication requests.
If the SSO server specified by the server-name argument is not found, the following error appears:
---more---server-name does not existIf the SSO server is found but the user specified by the user-name argument is not found, the authentication is rejected.
Examples
The following example, entered in privileged EXEC mode, successfully tests an SSO server named my-sso-server using a username of Anyuser:
hostname# test sso-server my-sso-server username AnyuserINFO: Attempting authentication request to sso-server my-sso-server for user AnyuserINFO: STATUS: Successhostname#The following example shows a test of the same server, but the user Anyuser is not recognized and the authentication fails:
hostname# test sso-server my-sso-server username AnyuserINFO: Attempting authentication request to sso-server my-sso-server for user AnyuserINFO: STATUS: Failedhostname#Related Commands
text-color
To set a color for text in the WebVPN title bar on the login, home page, and file access page, use the text-color command in webvpn mode. To remove a text color from the configuration and reset the default, use the no form of this command.
text-color [black | white | auto]
no text-color
Syntax Description
Defaults
The default text color for the title bars is white.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
—
•
—
—
Command History
Examples
The following example shows how to set the text color for title bars to black:
hostname(config)#webvpnhostname(config-webvpn)# text-color blackRelated Commands
secondary-text-color
Sets the secondary text color for the WebVPN login, home page, and file access page.
tftp-server
To specify the default TFTP server and path and filename for use with configure net or write net commands, use the tftp-server command in global configuration mode. To remove the server configuration, use the no form of this command. This command supports IPv4 and IPv6 addresses.
tftp-server interface_name server filename
no tftp-server [interface_name server filename]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The tftp-server command simplifies entering the configure net and write net commands. When you enter the configure net or write net commands, you can either inherit the TFTP server specified by the tftp-server command, or provide your own value. You can also inherit the path in the tftp-server command as is, add a path and filename to the end of the tftp-server command value, or override the tftp-server command value.
The security appliance supports only one tftp-server command.
Examples
This example shows how to specify a TFTP server and then read the configuration from the /temp/config/test_config directory:
hostname(config)# tftp-server inside 10.1.1.42 /temp/config/test_confighostname(config)# configure netRelated Commands
Loads the configuration from the TFTP server and path you specify.
Displays the default TFTP server address and the directory of the configuration file.
timeout
To set the maximum idle time duration, use the timeout command in global configuration mode.
timeout [xlate | conn | udp | icmp | rpc | h225 | h323 | mgcp | mgcp-pat | sip | sip_media | uauth hh:mm:ss]
Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration mode
•
•
•
•
—
Command History
Usage Guidelines
The timeout command lets you set the idle time for connection, translation UDP, and RPC slots. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence.
Note
The connection timer takes precedence over the translation timer; the translation timer works only after all connections have timed out.
When setting the conn hh:mm:ss, use 0:0:0 to never time out a connection.
When setting the half-closed hh:mm:ss, use 0:0:0 to never time out a half-closed connection.
When setting the h255 hh:mm:ss, h225 00:00:00 means to never tear down an H.225 signaling connection. A timeout value of h225 00:00:01 disables the timer and closes the TCP connection immediately after all calls are cleared.
The uauth hh:mm:ss duration must be shorter than the xlate keyword. Set to 0 to disable caching. Do not set to zero if passive FTP is used on the connections.
To disable the absolute keyword, set the uauth timer to 0 (zero).
Examples
The following example shows how to configure the maximum idle time durations:
hostname(config)# timeout uauth 0:5:00 absolute uauth 0:4:00 inactivityhostname(config)# show running-config timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolute uauth 0:04:00 inactivityRelated Commands
show running-config timeout
Displays the timeout value of the designated protocol.
timeout (aaa-server host)
To configure the host-specific maximum response time, in seconds, allowed before giving up on establishing a connection with the AAA server, use the timeout command in aaa-server host mode. To remove the timeout value and reset the timeout to the default value of 10 seconds, use the no form of this command.
timeout seconds
no timeout
Syntax Description
Defaults
The default timeout value is 10 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
aaa-server host configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is valid for all AAA server protocol types.
Use the timeout command to specify the length of time during which the security appliance attempts to make a connection to a AAA server. Use the retry-interval command to specify the amount of time the security appliance waits between connection attempts.
The timeout is the total amount of time that the security appliance spends trying to complete a transaction with a server. The retry interval determines how often the communication is retried during the timeout period. Thus, if the retry interval is greater than or equal to the timeout value, you will see no retries. If you want to see retries, the retry interval musts be less than thte timeout value.
Examples
The following example configures a RADIUS AAA server named "svrgrp1" on host 1.2.3.4 to use a timeout value of 30 seconds, with a retry interval of 10 seconds. Thus, the security appliance tries the communication attempt three times before giving up after 30 seconds.
hostname(config)#aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)#aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)#timeout 30hostname(config-aaa-server-host)#retry-interval 10hostname(config-aaa-server-host)#Related Commands
timeout (gtp-map)
To change the inactivity timers for a GTP session, use the timeout command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no form of this command to set these intervals to their default values.
timeout {gsn | pdp-context | request | signaling | tunnel } hh:mm:ss
no timeout {gsn | pdp-context | request | signaling | tunnel } hh:mm:ss
Syntax Description
Defaults
The default is 30 minutes for gsn, pdp-context, and signaling.
The default for request is 1 minute.
The default for tunnel is 1 minute (in the case where a Delete PDP Context Request is not received).
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
·
·
·
·
No
Command History
Usage Guidelines
The Packet Data Protocol (PDP) context is identified by the Tunnel Identifier (TID), which is a combination of IMSI and NSAPI. Each MS can have up to 15 NSAPIs, allowing it to create multiple PDP contexts each with a different NSAPI, based on application requirements for varied QoS levels.
A GTP tunnel is defined by two associated PDP Contexts in different GSN nodes and is identified with a Tunnel ID. A GTP tunnel is necessary to forward packets between an external packet data network and a mobile station user.
Examples
The following example sets a timeout value for the request queue of 2 minutes:
hostname(config)# gtp-map gtp-policyhostname(config-gtpmap)# timeout request 00:02:00Related Commands
timeout (dns-server-group configuration mode)
To specify the amount of time to wait before trying the next DNS server, use the timeout command in dns-server-group configuration mode. To restore the default timeout, use the no form of this command.
timeout seconds
no timeout [seconds]
Syntax Description
Defaults
The default timeout is 2 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example sets the timeout to 1 second for the DNS server group "dnsgroup1":
hostname(config)# dns server-group dnsgroup1hostname(config-dns-server-group)# dns timeout 1Related Commands
timers lsa-group-pacing
To specify the interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing command in router configuration mode. To restore the default value, use the no form of this command.
timers lsa-group-pacing seconds
no timers lsa-group-pacing [seconds]
Syntax Description
seconds
The interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged. Valid values are from 10 to 1800 seconds.
Defaults
The default interval is 240 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
To change the interval at which the OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing seconds command. To return to the default timer values, use the no timers lsa-group-pacing command.
Examples
The following example sets the group processing interval of LSAs to 500 seconds:
hostname(config-router)# timers lsa-group-pacing 500hostname(config-router)#Related Commands
timers spf
To specify the shortest path first (SPF) calculation delay and hold time, use the timers spf command in router configuration mode. To restore the default values, use the no form of this command.
timers spf delay holdtime
no timers spf [delay holdtime]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
To configure the delay time between when the OSPF protocol receives a topology change and when it starts a calculation, and the hold time between two consecutive SPF calculations, use the timers spf command. To return to the default timer values, use the no timers spf command.
Examples
The following example sets the SPF calculation delay to 10 seconds and the SPF calculation hold time to 20 seconds:
hostname(config-router)# timers spf 10 20hostname(config-router)#Related Commands
title
To customize the title of the WebVPN page displayed to WebVPN users when they connect to the security appliance, use the title command from webvpn customization mode:
title {text | style} value
[no] title {text | style} value
To remove the command from the configuration and cause the value to be inherited, use the no form of the command.
Syntax Description
Defaults
The default title text is "WebVPN Service".
The default title style is:
background-color:white;color:maroon;border-bottom:5px groove #669999;font-size:larger;
vertical-align:middle;text-align:left;font-weight:boldCommand Modes
The following table shows the modes in which you can enter the command:
Webvpn customization
•
—
•
—
—
Command History
Usage Guidelines
To have no title, use the title text command without a value argument.
The style option is expressed as any valid Cascading Style Sheet (CSS) parameters. Describing these parameters is beyond the scope of this document. For more information about CSS parameters, consult CSS specifications at the World Wide Web Consortium (W3C) website at www.w3.org. Appendix F of the CSS 2.1 Specification contains a convenient list of CSS parameters, and is available at www.w3.org/TR/CSS21/propidx.html.
Here are some tips for making the most common changes to the WebVPN pages—the page colors:
•
•
•
Note
Examples
In the following example, the title is customized with the text "Cisco WebVPN Service":
F1-asa1(config)# webvpnF1-asa1(config-webvpn)# customization ciscoF1-asa1(config-webvpn-custom)# title text Cisco WebVPN ServiceRelated Commands
logo
Customizes the logo on the WebVPN page.
page style
Customizes the WebVPN page using Cascading Style Sheet (CSS) parameters.
transfer-encoding
To restrict HTTP traffic by specifying a transfer encoding type, use the transfer-encoding command in HTTP map configuration mode, which is accessible using the http-map command. To disable this feature, use the no form of this command.
transfer-encoding type {chunked | compress | deflate | gzip | identity | default} action {allow | reset | drop} [log]
no transfer-encoding type {chunked | compress | deflate | gzip | identity | default} action {allow | reset | drop} [log]
Syntax Description
Defaults
This command is disabled by default. When the command is enabled and a supported transfer encoding type is not specified, the default action is to allow the connection without logging. To change the default action, use the default keyword and specify a different default action.
Command Modes
The following table shows the modes in which you can enter the command:
HTTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
When you enable the transfer-encoding command, the security appliance applies the specified action to HTTP connections for each supported and configured transfer encoding type.
The security appliance applies the default action to all traffic that does not match the transfer encoding types on the configured list. The preconfigured default action is to allow connections without logging.
For example, given the preconfigured default action, if you specify one or more encoding types with the action of drop and log, the security appliance drops connections containing the configured encoding types, logs each connection, and allows all connections for the other supported encoding types.
If you want to configure a more restrictive policy, change the default action to drop (or reset) and log (if you want to log the event). Then configure each permitted encoding type with the allow action.
Enter the transfer-encoding command once for each setting you wish to apply. You use one instance of the transfer-encoding command to change the default action and one instance to add each encoding type to the list of configured transfer encoding types.
When you use the no form of this command to remove an application category from the list of configured application types, any characters in the command line after the application category keyword are ignored.
Examples
The following example provides a permissive policy, using the preconfigured default, which allows all supported application types that are not specifically prohibited.
hostname(config)# http-map inbound_httphostname(config-http-map)# transfer-encoding gzip drop loghostname(config-http-map)#In this case, only connections using GNU zip are dropped and the event is logged.
The following example provides a restrictive policy, with the default action changed to reset the connection and to log the event for any encoding type that is not specifically allowed.
hostname(config)# http-map inbound_httphostname(config-http-map)# port-misuse default action reset loghostname(config-http-map)# port-misuse identity allowhostname(config-http-map)#In this case, only connections using no transfer encoding are allowed. When HTTP traffic for the other supported encoding types is received, the security appliance resets the connection and creates a syslog entry.
Related Commands
trust-point
To specify the name of a trustpoint that identifies the certificate to be sent to the IKE peer, use the trust-point command in tunnel-group ipsec-attributes mode. To eliminate a trustpoint specification, use the no form of this command.
trust-point trust-point-name
no trust-point trust-point-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group ipsec attributes
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute to all IPSec tunnel-group types.
Examples
The following example entered in config-ipsec configuration mode, configures a trustpoint for identifying the certificate to be sent to the IKE peer for the IPSec LAN-to-LAN tunnel group named 209.165.200.225:
hostname(config)# tunnel-group 209.165.200.225 type IPSec_L2Lhostname(config)# tunnel-group 209.165.200.225 ipsec-attributeshostname(config-tunnel-ipsec)# trust-point mytrustpointhostname(config-tunnel-ipsec)#Related Commands
ttl-evasion-protection
To disable the Time-To-Live evasion protection, use the ttl-evasion-protection command in tcp-map configuration mode. To remove this specification, use the no form of this command.
ttl-evasion-protection
no ttl-evasion-protection
Syntax Description
This command has no arguments or keywords.
Defaults
TTL evasion protection offered by the security appliance is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the ttl-evasion-protection command in tcp-map configuration mode to prevent attacks that attempt to evade security policy.
For instance, an attacker can send a packet that passes policy with a very short TTL. When the TTL goes to zero, a router between the security appliance and the endpoint drops the packet. It is at this point that the attacker can send a malicious packet with a long TTL that appears to the security appliance to be a retransmission and is passed. To the endpoint host, however, it is the first packet that has been received by the attacker. In this case, an attacker is able to succeed without security preventing the attack. Enabling this feature prevents such attacks.
Examples
The following example shows how to disable TTL evasion protection on flows from network 10.0.0.0 to 20.0.0.0:
hostname(config)# access-list TCP1 extended permit tcp 10.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0hostname(config)# tcp-map tmaphostname(config-tcp-map)# ttl-evasion-protection disablehostname(config)# class-map cmaphostname(config-cmap)# match access-list TCP1hostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
tunnel-group
To create and manage the database of connection-specific records for IPSec and WebVPN tunnels, use the tunnel-group command in global configuration mode. To remove a tunnel group, use the no form of this command.
tunnel-group name type type
no tunnel-group name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
See Note.
•
—
—
Note
Command History
Usage Guidelines
The security appliance has the following default tunnel groups:
•
•
•
You can change these groups, but not delete them. The security appliance uses these groups to configure default tunnel parameters for remote access and LAN-to-LAN tunnel groups when there is no specific tunnel group identified during tunnel negotiation.
After entering the tunnel-group command, you enter the appropriate following commands to configure specific attributes for a particular tunnel group. Each of these commands enters a configuration mode for configuring tunnel-group attributes.
•
•
•
Examples
The following examples are entered in global configuration mode. The first configures an IPSec remote access tunnel group. The group name is "group1".
hostname(config)# tunnel-group group1 type ipsec-rahostname(config)#The following example configures an IPSec LAN-to-LAN tunnel group. The name is the IP address of the LAN-to-LAN peer:
hostname(config)# tunnel-group 209.165.200.225 type ipsec-l2lhostname(config)#The following example shows the tunnel-group command configuring the webvpn tunnel group named "group1". You enter this command in global configuration mode:
hostname(config)# tunnel-group group1 type webvpnhostname(config)#Related Commands
tunnel-group general-attributes
To enter the general-attribute configuration mode, use the tunnel-group general-attributes command in global configuration mode. This mode is used to configure settings that are common to all supported tunneling protocols.
To remove all general attributes, use the no form of this command.
tunnel-group name general-attributes
no tunnel-group name general-attributes
Syntax Description
general-attributes
Specifies attributes for this tunnel-group.
name
Specifies the name of the tunnel-group.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
Usage Guidelines
The following table lists the commands belonging in this group and the tunnel-group type where you can configure them:
Examples
The following example entered in global configuration mode, creates a tunnel group for an IPSec LAN-to-LAN connection using the IP address of the LAN-to-LAN peer, then enters general configuration mode for configuring general attributes. The name of the tunnel group is 209.165.200.225.
hostname(config)# tunnel-group 209.165.200.225 type IPSec_L2Lhostname(config)# tunnel-group 209.165.200.225 generalhostname(config-tunnel-general)#The following example entered in global configuration mode, creates a tunnel group named" remotegrp" for an IPSec remote access connection, and then enters general configuration mode for configuring general attributes for the tunnel group named "remotegrp":
hostname(config)# tunnel-group remotegrp type ipsec_rahostname(config)# tunnel-group remotegrp generalhostname(config-tunnel-general)Related Commands
tunnel-group ipsec-attributes
To enter the ipsec-attribute configuration mode, use the tunnel-group ipsec-attributes command in global configuration mode. This mode is used to configure settings that are specific to the IPSec tunneling protocol.
To remove all IPSec attributes, use the no form of this command.
tunnel-group name ipsec-attributes
no tunnel-group name ipsec-attributes
Syntax Description
ipsec-attributes
Specifies attributes for this tunnel-group.
name
Specifies the name of the tunnel-group.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
Usage Guidelines
The following commands belong in this group:
Examples
The following example entered in global configuration, creates a tunnel group for the IPSec remote-access tunnel group named remotegrp, and then specifies IPSec group attributes:
hostname(config)# tunnel-group remotegrp type ipsec_rahostname(config)# tunnel-group remotegrp ipsec-attributeshostname(config-tunnel-ipsec)Related Commands
tunnel-group webvpn-attributes
To enter the webvpn-attribute configuration mode, use the tunnel-group webvpn-attributes command in global configuration mode. This mode configures settings that are common to WebVPN tunneling.
To remove all WebVPN attributes, use the no form of this command.
tunnel-group name webvpn-attributes
no tunnel-group name webvpn-attributes
Syntax Description
webvpn-attributes
Specifies WebVPN attributes for this tunnel-group.
name
Specifies the name of the tunnel-group.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
In addition to the general attributes, you can also configure the following attributes specific to WebVPN connections in webvpn-attribute mode:
•
•
•
•
•
•
•
See the individual command descriptions for complete information about configuring these attributes.
Examples
The following example entered in global configuration mode, creates a tunnel group for a WebVPN connection using the IP address of the LAN-to-LAN peer, then enters webvpn-configuration mode for configuring WebVPN attributes. The name of the tunnel group is 209.165.200.225.
hostname(config)# tunnel-group 209.165.200.225 type webvpnhostname(config)# tunnel-group 209.165.200.225 webvpn-attributeshostname(config-tunnel-webvpn)#The following example entered in global configuration mode, creates a tunnel group named" remotegrp" for a WebVPN connection, and then enters webvpn configuration mode for configuring WebVPN attributes for the tunnel group named "remotegrp":
hostname(config)# tunnel-group remotegrp type webvpnhostname(config)# tunnel-group remotegrp webvpn-attributeshostname(config-tunnel-webvpn)#Related Commands
tunnel-group-map default-group
The tunnel-group-map default-group command specifies the default tunnel-group to use if the name could not be determined using other configured methods.
Use the no form of this command to eliminate a tunnel-group-map.
tunnel-group-map [rule-index] default-group tunnel-group-name
no tunnel-group-map
Syntax Description
Syntax DescriptionSyntax Description
Defaults
The default value for the tunnel-group-map default-group is DefaultRAGroup.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
Usage Guidelines
The tunnel-group-map commands configure the policy and rules by which certificate-based IKE sessions are mapped to tunnel groups. To associate the certificate map entries, created using the crypto ca certificate map command, with tunnel groups, use the tunnel-group-map command in global configuration mode. You can invoke this command multiple times as long as each invocation is unique and you do not reference a map index more than once.
The crypto ca certificate map command maintains a prioritized list of certificate mapping rules. There can be only one map. But this map can have up to 65535 rules. Refer to the documentation on the crypto ca certificate map command for more information.
The processing that derives the tunnel-group name from the certificate ignores entries in the certificate map that are not associated with a tunnel group (any map rule not identified by this command).
Examples
The following example entered in global configuration mode, specifies a default tunnel group to use when the name cannot be derived by other configured methods. The name of the tunnel group to use is group1:
hostname(config)# tunnel-group-map default-group group1hostname(config)#Related Commands
tunnel-group-map enable
The tunnel-group-map enable command configures the policy and rules by which certificate-based IKE sessions are mapped to tunnel groups. Use the no form of this command to restore the default values.
tunnel-group-map [rule-index] enable policy
no tunnel-group-map enable [rule-index]
Syntax Description
Syntax DescriptionSyntax Description
Defaults
The default values for the tunnel-group-map command are enable ou and default-group set to DefaultRAGroup.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
Usage Guidelines
The crypto ca certificate map command maintains a prioritized list of certificate mapping rules. There can be only one map. But this map can have up to 65535 rules. Refer to the documentation on the crypto ca certificate map command for more information.
Examples
The following example enables mapping of certificate-based IKE sessions to a tunnel group based on the content of the phase1 IKE ID:
hostname(config)# tunnel-group-map enable ike-idhostname(config)#The following example enables mapping of certificate-based IKE sessions to a tunnel group based on the established IP address of the peer:
hostname(config)# tunnel-group-map enable peer-iphostname(config)#The following example enables mapping of certificate-based IKE sessions based on the organizational unit (OU) in the subject distinguished name (DN):
hostname(config)# tunnel-group-map enable ouhostname(config)#The following example enables mapping of certificate-based IKE sessions based on established rules:
hostname(config)# tunnel-group-map enable ruleshostname(config)#Related Commands
tunnel-limit
To specify the maximum number of GTP tunnels allowed to be active on the security appliance, use the tunnel limit command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no to set the tunnel limit back to its default.
tunnel-limit max_tunnels
no tunnel-limit max_tunnels
Syntax Description
max_tunnels
This is the maximum number of tunnels allowed. The ranges is from 1 to 4294967295 for the global overall tunnel limit.
Defaults
The default for the tunnel limit is 500.
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
New requests will be dropped once the number of tunnels specified by this command is reached.
Examples
The following example specifies a maximum of 10,000 tunnels for GTP traffic:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)# tunnel-limit 10000Related Commands
tx-ring-limit
To specify the depth of the priority queues, use the tx-ring-limit command in priority-queue mode. To remove this specification, use the no form of this command.
tx-ring-limit number-of-packets
no tx-ring-limit number-of-packets
Syntax Description
Defaults
The default tx-ring-limit is 128 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Priority-queue
•
•
•
•
—
Command History
Usage Guidelines
The security appliance allows two classes of traffic: low-latency queuing (LLQ) for higher priority, latency sensitive traffic (such as voice and video) and best-effort, the default, for all other traffic. The security appliance recognizes priority traffic and enforces appropriate Quality of Service (QoS) policies. You can configure the size and depth of the priority queue to fine-tune the traffic flow.
You must use the priority-queue command to create the priority queue for an interface before priority queuing takes effect. You can apply one priority-queue command to any interface that can be defined by the nameif command.
The priority-queue command enters priority-queue mode, as shown by the prompt. In priority-queue mode, you can configure the maximum number of packets allowed in the transmit queue at any given time (tx-ring-limit command) and the number of packets of either type (priority or best -effort) allowed to be buffered before dropping packets (queue-limit command).
Note
The tx-ring-limit and the queue-limit that you specify affect both the higher priority low-latency queue and the best-effort queue. The tx-ring-limit is the number of either type of packets allowed into the driver before the driver pushes back to the queues sitting in front of the interface to let them buffer packets until the congestion clears. In general, you can adjust these two parameters to optimize the flow of low-latency traffic.
Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is tail drop. To avoid having the queue fill up, you can use the queue-limit command to increase the queue buffer size.
Note
Examples
The following example configures a priority queue for the interface named test, specifying a queue limit of 2048 packets and a transmit queue limit of 256 packets.
hostname(config)# priority-queue testhostname(priority-queue)# queue-limit 2048hostname(priority-queue)# tx-ring-limit 256Related Commands
