-
Cisco Security Appliance Command Reference, Version 8.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show ddns -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config ldap -- show running-config webvpn auto-signon
-
show service-policy -- show xlate
-
shun -- sysopt radius ignore-secret
-
- T through Z Commands
-
Feedback
Table Of Contents
queue-limit through rtp-conformance Commands
remote-access threshold session-threshold-exceeded
revert webvpn plug-in protocol
revert webvpn translation-table
queue-limit through rtp-conformance Commands
queue-limit (priority-queue)
To specify the depth of the priority queues, use the queue-limit command in priority-queue mode. To remove this specification, use the no form of this command.
queue-limit number-of-packets
no queue-limit number-of-packets
Syntax Description
Defaults
The default queue limit is 1024 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Priority-queue
•
•
•
•
—
Command History
Usage Guidelines
The security appliance allows two classes of traffic: low-latency queuing (LLQ) for higher priority, latency sensitive traffic (such as voice and video) and best-effort, the default, for all other traffic. The security appliance recognizes priority traffic and enforces appropriate Quality of Service (QoS) policies. You can configure the size and depth of the priority queue to fine-tune the traffic flow.
You must use the priority-queue command to create the priority queue for an interface before priority queuing takes effect. You can apply one priority-queue command to any interface that can be defined by the nameif command.
The priority-queue command enters priority-queue mode, as shown by the prompt. In priority-queue mode, you can configure the maximum number of packets allowed in the transmit queue at any given time (tx-ring-limit command) and the number of packets of either type (priority or best -effort) allowed to be buffered before dropping packets (queue-limit command).
Note
The tx-ring-limit and the queue-limit that you specify affect both the higher priority low-latency queue and the best-effort queue. The tx-ring-limit is the number of either type of packets allowed into the driver before the driver pushes back to the queues sitting in front of the interface to let them buffer packets until the congestion clears. In general, you can adjust these two parameters to optimize the flow of low-latency traffic.
Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is tail drop. To avoid having the queue fill up, you can use the queue-limit command to increase the queue buffer size.
Note
On ASA Model 5505 (only), configuring priority-queue on one interface overwrites the same configuration on all other interfaces. That is, only the last applied configuration is present on all interfaces. Further, if the priority-queue configuration is removed from one interface, it is removed from all interfaces.
To work around this issue, configure the priority-queue command on only one interface. If different interfaces need different settings for the queue-limit and/or tx-ring-limit commands, use the largest of all queue-limits and smallest of all tx-ring-limits on any one interface (CSCsi13132).
Examples
The following example configures a priority queue for the interface named test, specifying a queue limit of 30,000 packets and a transmit queue limit of 256 packets.
hostname(config)# priority-queue testhostname(priority-queue)# queue-limit 30000hostname(priority-queue)# tx-ring-limit 256Related Commands
queue-limit (tcp-map)
To configure the maximum number of out-of-order packets that can be buffered and put in order for a TCP connection, use the queue-limit command in tcp-map configuration mode. To set the value back to the default, use the no form of this command. This command is part of the TCP normalization policy enabled using the set connection advanced-options command.
queue-limit pkt_num [timeout seconds]
no queue-limit
Syntax Description
Defaults
The default setting is 0, which means this command is disabled.
The default timeout is 4 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
7.2(4)/8.0(4)
The timeout keyword was added.
Usage Guidelines
To enable TCP normalization, use the Modular Policy Framework:
1.
a.
2.
3.
a.
b.
4.
If you do not enable TCP normalization, or if the queue-limit command is set to the default of 0, which means it is disabled, then the default system queue limit is used depending on the type of traffic:
•
•
If you set the queue-limit command to be 1 or above, then the number of out-of-order packets allowed for all TCP traffic matches this setting. For example, for application inspection, IPS, and TCP check-retransmission traffic, any advertised settings from TCP packets are ignored in favor of the queue-limit setting. For other TCP traffic, out-of-order packets are now buffered and put in order instead of passed through untouched.
Examples
The following example sets the queue limit to 8 packets and the buffer timeout to 6 seconds for all Telnet connections:
hostname(config)# tcp-map tmaphostname(config-tcp-map)# queue-limit 8 timeout 6hostname(config)# class-map cmaphostname(config-cmap)# match port tcp eq telnethostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalhostname(config)#Related Commands
quit
To exit the current configuration mode, or to logout from privileged or user EXEC modes, use the quit command.
quit
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
You can also use the key sequence Ctrl Z to exit global configuration (and higher) modes. This key sequence does not work with privileged or user EXEC modes.
When you enter the quit command in privileged or user EXEC modes, you log out from the security appliance. Use the disable command to return to user EXEC mode from privileged EXEC mode.
Examples
The following example shows how to use the quit command to exit global configuration mode, and then logout from the session:
hostname(config)# quithostname# quitLogoffThe following example shows how to use the quit command to exit global configuration mode, and then use the disable command to exit privileged EXEC mode:
hostname(config)# quithostname# disablehostname>Related Commands
radius-common-pw
To specify a common password to be used for all users who are accessing this RADIUS authorization server through this security appliance, use the radius-common-pw command in AAA-server host mode. To remove this specification, use the no form of this command:
radius-common-pw string
no radius-common-pw
Syntax Description
string
A case-sensitive, alphanumeric keyword of up to 127 characters to be used as a common password for all authorization transactions with this RADIUS server.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server host
•
•
•
•
—
Command History
Usage Guidelines
This command is valid only for RADIUS authorization servers.
The RADIUS authorization server requires a password and username for each connecting user. The security appliance provides the username automatically. You enter the password here. The RADIUS server administrator must configure the RADIUS server to associate this password with each user authorizing to the server via this security appliance. Be sure to provide this information to your RADIUS server administrator.
If you do not specify a common user password, each user's password is his or her own username. For example, a user with the username "jsmith" would enter "jsmith". If you are using usernames for the common user passwords, as a security precaution do not use this RADIUS server for authorization anywhere else on your network.
13-125
Note
Examples
The following example configures a RADIUS AAA server group named "svrgrp1" on host "1.2.3.4", sets the timeout interval to 9 seconds, sets the retry interval to 7 seconds, and configures the RADIUS commnon password as "allauthpw".
hostname(config)# aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)# aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)# timeout 9hostname(config-aaa-server-host)# retry 7hostname(config-aaa-server-host)# radius-common-pw allauthpwhostname(config-aaa-server-host)# exithostname(config)#Related Commands
radius-reject-message
To enable the display of a RADIUS reject message on the login screen when authentication is rejected, use the radius-eject-message command from tunnel-group webvpn attributes configuration mode. To remove the command from the configuration, use the no form of the command:
radius-reject-message
no radius-reject-message
Defaults
The default is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
Enable this command if you want to display to remote users a RADIUS message about an authentication failure.
Examples
The following example enables the display of a RADIUS rejection message for the connection profile named engineering:
hostname(config)# tunnel-group engineering webvpn-attributeshostname(config-tunnel-webvpn)# radius-reject-messageradius-with-expiry (removed)
To have the security appliance use MS-CHAPv2 to negotiate a password update with the user during authentication, use the radius-with-expiry command in tunnel-group ipsec-attributes configuration mode. The security appliance ignores this command if RADIUS authentication has not been configured. To return to the default value, use the no form of this command.
radius-with-expiry
no radius-with-expiry
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting for this command is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group ipsec-attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute only to IPSec remote-access tunnel-group type.
Examples
The following example entered in config-ipsec configuration mode, configures Radius with Expiry for the remote-access tunnel group named remotegrp:
hostname(config)# tunnel-group remotegrp type ipsec_rahostname(config)# tunnel-group remotegrp ipsec-attributeshostname(config-tunnel-ipsec)# radius-with-expiryRelated Commands
ras-rcf-pinholes
To enable call setup between H.323 endpoints when the Gatekeeper is inside the network, use the ras-rcf-pinholes command in parameters configuration mode. To disable this feature, use the no form of this command.
ras-rcf-pinholes enable
no ras-rcf-pinholes enable
Syntax Description
Defaults
By default, this option is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Usage Guidelines
The security appliance includes options to open pinholes for calls based on the RegistrationRequest/RegistrationConfirm (RRQ/RCF) messages. Because these RRQ/RCF messages are sent to and from the Gatekeeper, the calling endpoint's IP address is unknown and the security appliance opens a pinhole through source IP address/port 0/0.
Examples
The following example shows how to set up an action for protocol violation in a policy map:
hostname(config)# policy-map type inspect h323 h323_maphostname(config-pmap)# parametershostname(config-pmap-p)# ras-rcf-pinholes enableRelated Commands
rate-limit
When using the Modular Policy Framework, limit the rate of messages for packets that match a match command or class map by using the rate-limit command in match or class configuration mode. This rate limit action is available in an inspection policy map (the policy-map type inspect command) for application traffic; however, not all applications allow this action. To disable this action, use the no form of this command.
rate-limit messages_per_second
no rate-limit messages_per_second
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Match and class configuration
•
•
•
•
—
Command History
Usage Guidelines
An inspection policy map consists of one or more match and class commands. The exact commands available for an inspection policy map depends on the application. After you enter the match or class command to identify application traffic (the class command refers to an existing class-map type inspect command that in turn includes match commands), you can enter the rate-limit command to limit the rate of messages.
When you enable application inspection using the inspect command in a Layer 3/4 policy map (the policy-map command), you can enable the inspection policy map that contains this action, for example, enter the inspect dns dns_policy_map command where dns_policy_map is the name of the inspection policy map.
Examples
The following example limits the invite requests to 100 messages per second:
hostname(config-cmap)# policy-map type inspect sip sip-map1hostname(config-pmap-c)# match request-method invitehostname(config-pmap-c)# rate-limit 100Related Commands
reactivation-mode
To specify the method by which failed servers in a group are reactivated, use the reactivation-mode command in aaa-server protocol mode. To remove this specification, use the no form of this command:
reactivation-mode {depletion [deadtime minutes] | timed}
no reactivation-mode [depletion [deadtime minutes] | timed]
Syntax Description
Defaults
The default reactivation mode is depletion, and the default deadtime value is 10.
Command Modes
The following table shows the modes in which you can enter the command:
Aaa-server protcocol configuration
•
•
•
•
—
Command History
Usage Guidelines
Each server group has an attribute that specifies the reactivation policy for its servers.
In depletion mode, when a server is deactivated, it remains inactive until all other servers in the group are inactive. When and if this occurs, all servers in the group are reactivated. This approach minimizes the occurrence of connection delays due to failed servers. When depletion mode is in use, you can also specify the deadtime parameter. The deadtime parameter specifies the amount of time (in minutes) that will elapse between the disabling of the last server in the group and the subsequent re-enabling of all servers. This parameter is meaningful only when the server group is being used in conjunction with the local fallback feature.
In timed mode, failed servers are reactivated after 30 seconds of down time. This is useful when customers use the first server in a server list as the primary server and prefer that it is online whenever possible. This policy breaks down in the case of UDP servers. Since a connection to a UDP server will not fail, even if the server is not present, UDP servers are put back on line blindly. This could lead to slowed connection times or connection failures if a server list contains multiple servers that are not reachable.
Accounting server groups that have simultaneous accounting enabled are forced to use the timed mode. This implies that all servers in a given list are equivalent.
Examples
The following example configures aTACACS+ AAA server named "srvgrp1" to use the depletion reactivation mode, with a deadtime of 15 minutes:
hostname(config)# aaa-server svrgrp1 protocol tacacs+hostname(config-aaa-sersver-group)# reactivation-mode depletion deadtime 15hostname(config-aaa-server)# exithostname(config)#The following example configures aTACACS+ AAA server named "srvgrp1" to use timed reactivation mode:
hostname(config)# aaa-server svrgrp2 protocol tacacs+hostname(config-aaa-server)# reactivation-mode timedhostname(config-aaa-server)#Related Commands
record-entry
To specify the trustpoints to be used for the creation of the CTL file, use the record-entry command in ctl-file configuration mode. To remove a record entry from a CTL, use the no form of this command.
record-entry [ capf | cucm | cucm-tftp | tftp ] trustpoint trustpoint address ip_address [domain-name domain_name]
no record-entry [ capf | cucm | cucm-tftp | tftp ] trustpoint trust_point address ip_address [domain-name domain_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
CTL-file configuration
•
—
•
—
—
Command History
Usage Guidelines
Only one domain-name can be specified. If the CTL file does not exist, manually export this certificate from CUCM to the security appliance.
Use this command only when you have not configured a CTL file for the Phone Proxy. Do not use this command when you have already configured a CTL file.
The IP address you specify in the ip_address argument must be the global address or address as seen by the IP phones because it will be the IP address used for the CTL record for the trustpoint.
Add additional record-entry configurations for each entity that is required in the CTL file.
Examples
The following example shows the use of the record-entry command to specify the trustpoints to be used for the creation of the CTL file:
hostname(config-ctl-file)# record-entry cucm-tftp trustpoint cucm1 address 192.168.1.2Related Commands
redirect-fqdn
To enable or disable redirection using a fully-qualified domain name in vpn load-balancing mode, use the redirect-fqdn enable command in global configuration mode.
redirect-fqdn {enable | disable}
no redirect-fqdn {enable | disable}
Note
Syntax Description
disable
Disables redirection with fully-qualified domain names.
enable
Enables redirection with fully-qualified domain names.
Defaults
This behavior is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Vpn load-balancing mode
•
—
•
—
—
Command History
Usage Guidelines
By default, the ASA sends only IP addresses in load-balancing redirection to a client. If certificates are in use that are based on DNS names, the certificates will be invalid when redirected to a secondary device.
As a VPN cluster master, this security appliance can send a fully qualified domain name (FQDN), using reverse DNS lookup, of a cluster device (another security appliance in the cluster), instead of its outside IP address, when redirecting VPN client connections to that cluster device.
All of the outside and inside network interfaces on the load-balancing devices in a cluster must be on the same IP network.
To do WebVPN load Balancing using FQDNs rather than IP addresses, you must do the following configuration steps:
Step 1
Step 2
Step 3
Step 4
Examples
The following is an example of the redirect-fqdn command that disables redirection:
hostname(config)# vpn load-balancinghostname(config-load-balancing)# redirect-fqdn disablehostname(config-load-balancing)#The following is an example of a VPN load-balancing command sequence that includes an interface command that enables redirection for a fully-qualified domain name, specifies the public interface of the cluster as "test" and the private interface of the cluster as "foo":
hostname(config)# interface GigabitEthernet 0/1hostname(config-if)# ip address 209.165.202.159 255.255.255.0hostname(config)# nameif testhostname(config)# interface GigabitEthernet 0/2hostname(config-if)# ip address 209.165.201.30 255.255.255.0hostname(config)# nameif foohostname(config)# vpn load-balancinghostname(config-load-balancing)# nat 192.168.10.10hostname(config-load-balancing)# priority 9hostname(config-load-balancing)# interface lbpublic testhostname(config-load-balancing)# interface lbprivate foohostname(config-load-balancing)# cluster ip address 209.165.202.224hostname(config-load-balancing)# cluster key 123456789hostname(config-load-balancing)# cluster encryptionhostname(config-load-balancing)# cluster port 9023hostname(config-load-balancing)# redirect-fqdn enablehostname(config-load-balancing)# participateRelated Commands
redistribute (EIGRP)
To redistribute routes from one routing domain into the EIGRP routing process, use the redistribute command in router configuration mode. To remove the redistribution, use the no form of this command.
redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected} [metric bandwidth delay reliability load mtu] [route-map map_name]
no redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected} [metric bandwidth delay reliability load mtu] [route-map map_name]
Syntax Description
Defaults
The following are the command defaults:
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
You must specify the metric with the redistribute command if you do not have a default-metric command in your EIGRP configuration.
Examples
This example redistributes static and connected routes into the EIGRP routing process:
hostname(config)# router eigrp 100hostname(config-router)# redistribute statichostname(config-router)# redistribute connectedRelated Commands
router eigrp
Creates an EIGRP routing process and enters configuration mode for that process.
show running-config router
Displays the commands in the global router configuration.
redistribute (OSPF)
To redistribute routes from one routing domain into an OSPF routing process, use the redistribute command in router configuration mode. To remove the redistribution, use the no form of this command.
redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected | eigrp as-number} [metric metric_value] [metric-type metric_type] [route-map map_name] [tag tag_value] [subnets]
no redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected} [metric metric_value] [metric-type metric_type] [route-map map_name] [tag tag_value] [subnets]
Syntax Description
Defaults
The following are the command defaults:
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Preexisting
This command was preexisting.
7.2(1)
This command was modified to include the rip keyword.
8.0(2)
This command was modified to include the eigrp keyword.
Examples
This example shows how to redistribute static routes into the current OSPF process:
hostname(config)# router ospf 1hostname(config-router)# redistribute staticRelated Commands
redistribute (RIP)
To redistribute routes from another routing domain into the RIP routing process, use the redistribute command in router configuration mode. To remove the redistribution, use the no form of this command.
redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | static | connected | eigrp as-number} [metric {metric_value | transparent}] [route-map map_name]
no redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | static | connected | eigrp as-number} [metric {metric_value | transparent}] [route-map map_name]
Syntax Description
Defaults
The following are the command defaults:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
7.2(1)
This command was introduced.
8.0(2)
This command was modified to include the eigrp keyword.
Examples
This example shows how to redistribute static routes into the current RIP process:
hostname(config)# router riphostname(config-router)# network 10.0.0.0hostname(config-router)# redistribute static metric 2Related Commands
redundant-interface
To set which member interface of a redundant interface is active, use the redundant-interface command in privileged EXEC mode.
redundant-interface redundantnumber active-member physical_interface
Syntax Description
Defaults
By default, the active interface is the first member interface listed in the configuration, if it is available.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
To view which interface is active, enter the following command:
hostname# show interface redundantnumber detail | grep MemberFor example:
hostname# show interface redundant1 detail | grep MemberMembers GigabitEthernet0/3(Active), GigabitEthernet0/2Examples
The following example creates a redundant interface. By default, gigabitethernet 0/0 is active because it is first in the configuration. The redundant-interface command sets gigabitethernet 0/1 as the active interface.
hostname(config-if)# interface redundant 1hostname(config-if)# member-interface gigabitethernet 0/0hostname(config-if)# member-interface gigabitethernet 0/1hostname(config-if)# redundant-interface redundant1 active-member gigabitethernet0/1Related Commands
regex
To create a regular expression to match text, use the regex command in global configuration mode. To delete a regular expression, use the no form of this command.
regex name regular_expression
no regex name [regular_expression]
Syntax Description
name
Specifies the regular expression name, up to 40 characters in length.
regular_expression
Specifies the regular expression up to 100 characters in length. See "Usage Guidelines" for a list of metacharacters you can use in the regular expression.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The regex command can be used for various features that require text matching. For example, you can configure special actions for application inspection using Modular Policy Framework using an inspection policy map (see the policy map type inspect command). In the inspection policy map, you can identify the traffic you want to act upon by creating an inspection class map containing one or more match commands or you can use match commands directly in the inspection policy map. Some match commands let you identify text in a packet using a regular expression; for example, you can match URL strings inside HTTP packets. You can group regular expressions in a regular expression class map (see the class-map type regex command).
A regular expression matches text strings either literally as an exact string, or by using metacharacters so you can match multiple variants of a text string. You can use a regular expression to match the content of certain application traffic; for example, you can match body text inside an HTTP packet.
Note
Table 23-1 lists the metacharacters that have special meanings.
To test a regular expression to make sure it matches what you think it will match, enter the test regex command.
The regular expression performance impact is determined by two main factors:
•
The regular expression engine has only a small impact to the security appliance performance when the search length is small.
•
How the Search Length Impacts Performance
When you configure a regular expression search, every byte of the searched text is usually examined against a regular expression database to find a match. The longer the searched text is, the longer the search time will be. Below is a performance test case which illustrates this phenomenon.
•
•
•
When a policy is configured to search the URI and the body in the HTTP GET request only, the throughput is:
•
•
But when a policy is configured to also search the whole HTTP response body, the throughput drops down to 145 mbps because of the long response body (3250 bytes) search.
Following is a list of factors that will increase the length of text for a regular expression search:
•
•
How the Number of Chained Regular Expression Tables Impact Performance
Currently, all regular expressions that are configured for the same protocol field, such as all regular expressions for URI, are built into a database consisting of one or more regular expression chained tables. The number of tables is determined by the total memory required and the availability of memory at the time the tables are built. A regular expression database will be split into multiple tables under any of the following conditions:
•
•
With multiple chained tables, each table must be searched for regular expression matches and hence the search time increases in proportion to the number of tables that are searched.
Certain types of regular expressions tend to increase the table size significantly. It is prudent to design regular expressions in a way to avoid wildcard and repeating factors if possible. See Table 23-1 for a description of the following metacharacters:
•
–
•
–
–
–
•
–
–
–
•
–
–
–
–
–
The following examples illustrate how memory consumptions are different for regular expressions with and without wildcards and repetition.
•
regex r1 "q3rfict9(af.*12)*ercvdf"regex r2 "qtaefce.*qeraf.*adasdfev"regex r3 "asdfdfdfds.*wererewr0e.*aaaxxxx.*xxx"regex r4 "asdfdfdfds.*wererewr0e.*afdsvcvr.*aefdd"•
regex s1 "abcde"regex s2 "12345"regex s3 "123xyz"regex s4 "xyz123"A large number of regular expressions will increase the total memory that is needed for the regular expression database and hence increases the probabilities of more tables if memory is fragmented. Following are examples of memory consumptions for different numbers of regular expressions:
•
•
•
Note
The debug menu regex 40 10 command can be used to display how many chained tables there are in each regex database.Examples
The following example creates two regular expressions for use in an inspection policy map:
hostname(config)# regex url_example example\.comhostname(config)# regex url_example2 example2\.comRelated Commands
reload
To reboot and reload the configuration, use the reload command in privileged EXEC mode.
reload [at hh:mm [month day | day month]] [cancel] [in [hh:]mm] [max-hold-time [hh:]mm] [noconfirm] [quick] [reason text] [save-config]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
7.0(1)
This command was modified to add the following new arguments and keywords: day, hh, mm, month, quick, save-config, and text.
Usage Guidelines
The command lets you reboot the security appliance and reload the configuration from Flash.
By default, the reload command is interactive. The security appliance first checks whether the configuration has been modified but not saved. If so, the security appliance prompts you to save the configuration. In multiple context mode, the security appliance prompts for each context with an unsaved configuration. If you specify the save-config parameter, the configuration is saved without prompting you. The security appliance then prompts you to confirm that you really want to reload the system. Only a response of y or pressing the Enter key causes a reload. Upon confirmation, the security appliance starts or schedules the reload process, depending upon whether you have specified a delay parameter (in or at).
By default, the reload process operates in "graceful" (also known as "nice") mode. All registered subsystems are notified when a reboot is about to occur, allowing these subsystems to shut down properly before the reboot. To avoid waiting until for such a shutdown to occur, specify the max-hold-time parameter to specify a maximum time to wait. Alternatively, you can use the quick parameter to force the reload process to begin abruptly, without notifying the affected subsystems or waiting for a graceful shutdown.
You can force the reload command to operate noninteractively by specifying the noconfirm parameter. In this case, the security appliance does not check for an unsaved configuration unless you have specified the save-config parameter. The security appliance does not prompt the user for confirmation before rebooting the system. It starts or schedules the reload process immediately, unless you have specified a delay parameter, although you can specify the max-hold-time or quick parameters to control the behavior or the reload process.
Use reload cancel to cancel a scheduled reload. You cannot cancel a reload that is already in progress.
Note
Examples
This example shows how to reboot and reload the configuration:
hostname# reloadProceed with ? [confirm] yRebooting...XXX Bios VX.X...Related Commands
remote-access threshold session-threshold-exceeded
To set threshold values, use the remote-access threshold command in global configuration mode. To remove threshold values, use the no version of this command. This command specifies the number of active remote access sessions, at which point the security appliance sends traps.
remote-access threshold session-threshold-exceeded {threshold-value}
no remote-access threshold session-threshold-exceeded
Syntax Description
threshold-value
Specifies an integer less than or equal to the session limit the security appliance supports.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Examples
The following example shows how to set a threshold value of 1500:
hostname# remote-access threshold session-threshold-exceeded 1500Related Commands
rename
To rename a file or a directory from the source filename to the destination filename, use the rename command in privileged EXEC mode.
rename [/noconfirm] [disk0: | disk1: | flash:] source-path [disk0: | disk1: | flash:] destination-path
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
The rename flash: flash: command prompts you to enter a source and destination filename.
You cannot rename a file or directory across file systems.
For example:
hostname# rename flash: disk1:Source filename []? new-configDestination filename []? old-config%Cannot rename between filesystemsExamples
The following example shows how to rename a file named "test" to "test1":
hostname# rename flash: flash:Source filename [running-config]? testDestination filename [n]? test1Related Commands
mkdir
Creates a new directory.
rmdir
Removes a directory.
show file
Displays information about the file system.
rename (class-map)
To rename a class map, enter the rename command in class-map configuration mode.
rename new_name
Syntax Description
new_name
Specifies the new name of the class map, up to 40 characters in length. The name "class-default" is reserved.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map configuration
•
•
•
•
—
Command History
Examples
The following example shows how to rename a class map from test to test2:
hostname(config)# class-map testhostname(config-cmap)# rename test2Related Commands
renewal-reminder
To specify the number of days prior to local Certificate Authority (CA) certificate expiration that an initial reminder to re-enroll is sent to certificate owners, use the renewal-reminder command in CA server configuration mode. To reset the time to the default of 14 days, use the no form of this command.
renewal-reminder time
no renewal-reminder
Syntax Description
time
Specifies the time in days prior to the expiration of an issued certificate that the certificate owner is first reminded to re-enroll. Valid values range from 1 to 90 days.
Defaults
By default, the CA server sends an expiration notice and reminder to re-enroll 14 days prior to certificate expiration.
Command Modes
The following table shows the modes in which you can enter the command:
CA server configuration
•
—
•
—
—
Command History
Usage Guidelines
There are three reminders in all: one at the renewal-reminder time prior to certificate expiration, a second at (expiration time + otp expiration) - renewal-reminder time/2, and a third at (expiration time + otp expiration) - renewal-reminder/4.
An e-mail is sent automatically to the certificate owner for each of the three reminders, if an e-mail address is specified in the user database. If no e-mail address exists, a syslog message is generated to alert the administrator of the renewal.
Examples
The following example specifies that the security appliance send an expiration notice to users 7 days prior to certificate expiration:
hostname(config)# crypto ca serverhostname(config-ca-server)# renewal-reminder 7hostname(config-ca-server)#The following example resets the expiration notice time to the default of 14 days prior to certificate expiration:
hostname(config)# crypto ca serverhostname(config-ca-server)# no renewal-reminderhostname(config-ca-server)#Related Commands
replication http
To enable HTTP connection replication for the failover group, use the replication http command in failover group configuration mode. To disable HTTP connection replication, use the no form of this command.
replication http
no replication http
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Failover group configuration
•
•
—
—
•
Command History
Usage Guidelines
By default, the security appliance does not replicate HTTP session information when Stateful Failover is enabled. Because HTTP sessions are typically short-lived, and because HTTP clients typically retry failed connection attempts, not replicating HTTP sessions increases system performance without causing serious data or connection loss. The replication http command enables the stateful replication of HTTP sessions in a Stateful Failover environment, but could have a negative effect on system performance.
This command is available for Active/Active failover only. It provides the same functionality as the failover replication http command for Active/Standby failover, except for failover groups in Active/Active failover configurations.
Examples
The following example shows a possible configuration for a failover group:
hostname(config)# failover group 1hostname(config-fover-group)# primaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# replication httphostname(config-fover-group)# exitRelated Commands
failover group
Defines a failover group for Active/Active failover.
failover replication http
Configures stateful failover to replicate HTTP connections.
request-command deny
To disallow specific commands within FTP requests, use the request-command deny command in FTP map configuration mode, which is accessible by using the ftp-map command. To remove the configuration, use the no form of this command.
request-command deny { appe | cdup | dele | get | help | mkd | put | rmd | rnfr | rnto | site | stou }
no request-command deny { appe | cdup | help | retr | rnfr | rnto | site | stor | stou }
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
FTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is used for controlling the commands allowed within FTP requests traversing the security appliance when using strict FTP inspection.
Examples
The following example causes the security appliance to drop FTP requests containing stor, stou, or appe commands:
hostname(config)# ftp-map inbound_ftphostname(config-ftp-map)# request-command deny put stou appeRelated Commands
request-data-size
To set the size of the payload in the SLA operation request packets, use the request-data-size command in SLA monitor protocol configuration mode. To restore the default value, use the no form of this command.
request-data-size bytes
no request-data-size
Syntax Description
Defaults
The default bytes is 28.
Command Modes
The following table shows the modes in which you can enter the command:
SLA monitor protocol configuration
•
—
•
—
—
Command History
Usage Guidelines
For reachability, it may be necessary to increase the default data size to detect PMTU changes between the source and the target. Low PMTU will likely affect session performance and, if detected, may indicate that the secondary path be used.
Examples
The following example configures an SLA operation with an ID of 123 that uses an ICMP echo request/response time probe operation. It sets the payload size of the echo request packets to 48 bytes and the number of echo requests sent during an SLA operation to 5.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# num-packets 5hostname(config-sla-monitor-echo)# request-data-size 48hostname(config-sla-monitor-echo)# timeout 4000hostname(config-sla-monitor-echo)# threshold 2500hostname(config-sla-monitor-echo)# frequency 10hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
request-queue
To specify the maximum number of GTP requests that will be queued waiting for a response, use the request-queue command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no form of this command to return this number to the default of 200.
request-queue max_requests
no request-queue max_requests
Syntax Description
max_requests
The maximum number of GTP requests that will be queued waiting for a response. The range values is 1 to 4294967295.
Defaults
The max_requests default is 200.
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
The gtp request-queue command specifies the maximum number of GTP requests that are queued waiting for a response. When the limit has been reached and a new request arrives, the request that has been in the queue for the longest time is removed. The Error Indication, the Version Not Supported and the SGSN Context Acknowledge messages are not considered as requests and do not enter the request queue to wait for a response.
Examples
The following example specifies a maximum request queue size of 300 bytes:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)# request-queue-size 300Related Commands
request-timeout
To configure the number of seconds before a failed SSO authentication attempt times out, use the request-timeout command in webvpn configuration mode.
To return to the default value, use the no form of this command.
request-timeout seconds
no request-timeout
Syntax Description
Syntax DescriptionSyntax Description
seconds
The number of seconds before a failed SSO authentication attempt times out. The range is 1 to 30 seconds. Fractions are not supported.
Defaults
The default value for this command is 5 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The security appliance currently supports SiteMinder and SAML POST type SSO servers.
This command applies to both types of SSO Servers.
Once you have configured the security appliance to support SSO authentication, you have the option to adjust two timeout parameters:
•
•
Examples
The following example, entered in webvpn-config-sso-siteminder mode, configures an authentication timeout at ten seconds for the SiteMinder type SSO server, "example":
hostname(config-webvpn)# sso-server example type siteminderhostname(config-webvpn-sso-siteminder)# request-timeout 10Related Commands
reserve-port-protect
To restrict usage on the reserve port during media negotiation, use the reserve-port-protect command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
reserve-port-protect
no reserve-port-protect
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to protect the reserve port in an RTSP inspection policy map:
hostname(config)# policy-map type inspect rtsp rtsp_maphostname(config-pmap)# parametershostname(config-pmap-p)# reserve-port-protectRelated Commands
reserved-bits
To clear reserved bits in the TCP header, or drop packets with reserved bits set, use the reserved-bits command in tcp-map configuration mode. To remove this specification, use the no form of this command.
reserved-bits {allow | clear | drop}
no reserved-bits {allow | clear | drop}
Syntax Description
allow
Allows packet with the reserved bits in the TCP header.
clear
Clears the reserved bits in the TCP header and allows the packet.
drop
Drops the packet with the reserved bits in the TCP header.
Defaults
The reserved bits are allowed by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the reserved-bits command in tcp-map configuration mode to remove ambiguity as to how packets with reserved bits are handled by the end host, which may lead to desynchronizing the security appliance. You can choose to clear the reserved bits in the TCP header or even drop packets with the reserved bits set.
Examples
The following example shows how to clear packets on all TCP flows with the reserved bit set:
hostname(config)# access-list TCP extended permit tcp any anyhostname(config)# tcp-map tmaphostname(config-tcp-map)# reserved-bits clearhostname(config)# class-map cmaphostname(config-cmap)# match access-list TCPhostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
reset
When using the Modular Policy Framework, drop packets, close the connection, and send a TCP reset for traffic that matches a match command or class map by using the reset command in match or class configuration mode. This reset action is available in an inspection policy map (the policy-map type inspect command) for application traffic; however, not all applications allow this action. To disable this action, use the no form of this command.
reset [log]
no reset [log]
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Match and class configuration
•
•
•
•
—
Command History
Usage Guidelines
An inspection policy map consists of one or more match and class commands. The exact commands available for an inspection policy map depends on the application. After you enter the match or class command to identify application traffic (the class command refers to an existing class-map type inspect command that in turn includes match commands), you can enter the reset command to drop packets and close the connection for traffic that matches the match command or class command.
If you reset a connection, then no further actions are performed in the inspection policy map. For example, if the first action is to reset the connection, then it will never match any further match or class commands. If the first action is to log the packet, then a second action, such as resetting the connection, can occur. You can configure both the reset and the log action for the same match or class command, in which case the packet is logged before it is reset for a given match.
When you enable application inspection using the inspect command in a Layer 3/4 policy map (the policy-map command), you can enable the inspection policy map that contains this action, for example, enter the inspect http http_policy_map command where http_policy_map is the name of the inspection policy map.
Examples
The following example resets the connection and sends a log when they match the http-traffic class map. If the same packet also matches the second match command, it will not be processed because it was already dropped.
hostname(config-cmap)# policy-map type inspect http http-map1hostname(config-pmap)# class http-traffichostname(config-pmap-c)# reset loghostname(config-pmap-c)# match req-resp content-type mismatchhostname(config-pmap-c)# reset logRelated Commands
retries
To specify the number of times to retry the list of DNS servers when the security appliance does not receive a response, use the dns retries command in global configuration mode. To restore the default setting, use the no form of this command.
retries number
no retries [number]
Syntax Description
Defaults
The default number of retries is 2.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Add DNS servers using the name-server command.
This command replaces the dns name-server command.
Examples
The following example sets the number of retries to 0. The security appliance tries each server only once.
hostname(config)# dns server-group dnsgroup1hostname(config-dns-server-group)# dns retries 0Related Commands
retry-interval
To configure the amount of time between retry attempts for a particular AAA server designated in a prior aaa-server host command, use the retry-interval command in AAA-server host mode. To reset the retry interval to the default value, use the no form of this command.
retry-interval seconds
no retry-interval
Syntax Description
seconds
Specify the retry interval (1-10 seconds) for the request. This is the time the security appliance waits before retrying a connection request.
Defaults
The default retry interval is 10 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server host
•
•
•
•
—
Command History
Usage Guidelines
Use the retry-interval command to specify or reset the number of seconds the security appliance waits between connection attempts. Use the timeout command to specify the length of time during which the security appliance attempts to make a connection to a AAA server.
Examples
The following examples show the retry-interval command in context.
hostname(config)# aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)# aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)# timeout 7hostname(config-aaa-server-host)# retry-interval 9hostname(config-aaa-server-host)#Related Commands
reval-period
To specify the interval between each successful posture validation in a NAC Framework session, use the reval-period command in nac-policy-nac-framework configuration mode. To remove the command from the NAC Framework policy, use the no form of this command.
reval-period seconds
no reval-period [seconds]
Syntax Description
Defaults
The default value is 36000.
Command Modes
The following table shows the modes in which you can enter the command:
nac-policy-nac-framework configuration
•
—
•
—
—
Command History
7.3(0)
"nac-" removed from command name. Command moved from group-policy configuration mode to nac-policy-nac-framework configuration mode.
7.2(1)
This command was introduced.
Usage Guidelines
The security appliance starts the revalidation timer after each successful posture validation. The expiration of this timer triggers the next unconditional posture validation. The security appliance maintains posture validation during revalidation. The default group policy becomes effective if the Access Control Server is unavailable during posture validation or revalidation.
Examples
The following example changes the revalidation timer to 86400 seconds:
hostname(config-nac-policy-nac-framework)# reval-period 86400hostname(config-nac-policy-nac-framework)The following example removes the revalidation timer from the NAC policy:
hostname(config-nac-policy-nac-framework)# no reval-periodhostname(config-nac-policy-nac-framework)Related Commands
revert webvpn all
To remove all web-related data (customization, plug-in, translation table, URL list, and web content) from the security appliance flash memory, enter the revert webvpn all command in privileged EXEC mode.
revert webvpn all
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
—
Command History
Usage Guidelines
Use the revert webvpn all command to disable and remove all web-related information (customization, plug-in, translation table, URL list, and web content) from the flash memory of the security appliance. Removal of all web-related data returns default settings when applicable.
Examples
The following command removes all of the web-related configuration data from the security appliance:
hostname# revert webvpn allhostnameRelated Commands
show import webvpn (option)
Displays various imported WebVPN data and plug-ins. currently present in flash memory on the security appliance.
revert webvpn customization
To remove a customization object from the security appliance cache memory, enter the revert webvpn customization command in privileged EXEC mode.
revert webvpn customization name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
—
Command History
Usage Guidelines
Use the revert webvpn customization command to remove Clientless SSL VPN support for the specified customization and to remove it from the cache memory on the security appliance. Removal of a customization object returns default settings when applicable. A customization object contains the configuration parameters for a specific, named portal page.
Version 8.0 software extends the functionality for configuring customization, and the new process is incompatible with previous versions. During the upgrade to 8.0 software, the security appliance preserves a current configuration by using old settings to generate new customization objects. This process occurs only once, and is more than a simple transformation from the old format to the new one because the old values are only a partial subset of the new ones.
Note
Examples
The following command removes the customization object named GroupB:
hostname# revert webvpn customization groupbhostnameRelated Commands
revert webvpn plug-in protocol
To remove a plug-in from the flash device of the security appliance, enter the revert webvpn plug-in protocol command in privileged EXEC mode.
revert plug-in protocol protocol
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
—
Command History
Usage Guidelines
Use the revert webvpn plug-in protocol command to disable and remove Clientless SSL VPN support for the specified Java-based client application, as well as to remove it from the flash drive of the security appliance.
Examples
The following command removes support for RDP:
hostname# revert webvpn plug-in protocol rdphostnameRelated Commands
revert webvpn translation-table
To remove a translation table from the security appliance flash memory, enter the revert webvpn translation-table command in privileged EXEC mode.
revert webvpn translation-table translationdomain language
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
—
Command History
Usage Guidelines
Use the revert webvpn translation-table command to disable and remove an imported translation table and to remove it from the flash memory on the security appliance. Removal of a translation table returns default settings when applicable.
Examples
The following command removes the AnyConnect translation table, Dutch:
hostname# revert webvpn translation-table anyconnect dutchhostnameRelated Commands
revert webvpn url-list
To remove a URL list from the security appliance, enter the revert webvpn url-list command in privileged EXEC mode.
revert webvpn url-list template name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
—
Command History
Usage Guidelines
Use the revert webvpn url-list command to disable and remove a current URL list from the flash drive of the security appliance. Removal of a url-list returns default settings when applicable.
The template argument used with the revert webvpn url-list command specifies the name of a previously configured list of URLs. To configure such a list, use the url-list command in global configuration mode.
Examples
The following command removes the URL list, servers2:
hostname# revert webvpn url-list servers2hostnameRelated Commands
revert webvpn webcontent
To remove a specified web object from a location in the security appliance flash memory, enter the revert webvpn webcontent command in privileged EXEC mode.
revert webvpn webcontent filename
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
—
Command History
Usage Guidelines
Use the revert webvpn content command to disable and remove a file containing the web content and to remove it from the flash memory of the security appliance. Removal of web content returns default settings when applicable.
Examples
The following command removes the web content file, ABCLogo, from the security appliance flash memory:
hostname# revert webvpn webcontent abclogohostnameRelated Commands
revocation-check
To set one or more methods for revocation checking, use the revocation-check command in crypto ca trustpoint mode. The security appliance tries the methods in the order that you configure them, trying the second and third methods only if the previous method returns an error (for example, server down), as opposed to finding the status as revoked.
You can set a revocation checking method in the client certificate validating trustpoint and also configure no revocation checking (revocation-check none) in the responder certificate validating trustpoint. The match certificate command documentation includes step-by-step configuration example.
To restore the default revocation checking method, which is none, use the no version of this command.
revocation-check {[crl] [none] [ocsp]}
no revocation-check
Syntax Description
Defaults
The default value is none.
Command Modes
The following table shows the modes in which you can enter the command:
crypto ca trustpoint mode
•
•
•
•
•
Command History
Usage Guidelines
The signer of the OCSP response is usually the OCSP server (responder) certificate. After receiving the response, devices try to verify the responder certificate.
Normally a CA sets the lifetime of its OCSP responder certificate to a relatively short period to minimize the chance of compromising its security. The CA includes an ocsp-no-check extension in the responder certificate that indicates it does not need revocation status checking. But if this extension is not present, the device tries to check the certificate's revocation status using the revocation methods you configure for the trustpoint with this revocation-check command.The OCSP responder certificate must be verifiable if it does not have an ocsp-no-check extension since the OCSP revocation check fails unless you also set the none option to ignore the status check.
Examples
The following example shows how to set revocation methods of OCSP and CRL, in that order, for the trustpoint called newtrust.
hostname(config)# crypto ca trustpoint newtrusthostname(config-ca-trustpoint)# revocation-check ocsp crlhostname(config-ca-trustpoint)#Related Commands
rewrite
To disable content rewriting a particular application or type of traffic over a WebVPN connection, use the rewrite command in webvpn mode. To eliminate a rewrite rule, use the no form of this command with the rule number, which uniquely identifies the rule. To eliminate all rewriting rules, use the no form of the command without the rule number.
By default, the security appliance rewrites, or transforms, all WebVPN traffic.
rewrite order integer {enable | disable} resource-mask string [name resource name]
no rewrite order integer {enable | disable} resource-mask string [name resource name]
Syntax Description
Defaults
The default is to rewrite everything.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn mode
•
—
•
—
—
Command History
Usage Guidelines
The security appliance performs content rewriting for applications to insure that they render correctly over WebVPN connections. Some applications do not require this processing, such as external public websites. For these applications, you might choose to turn off content rewriting.
You can turn off content rewriting selectively by using the rewrite command with the disable option to let users browse specific sites directly without going through the security appliance. This is similar to split-tunneling in IPSec VPN connections.
You can use this command multiple times. The order in which you configure entries is important because the security appliance searches rewrite rules by order number and applies the first rule that matches.
Examples
The following example shows how to configure a rewrite rule, order number of 1, that turns off content rewriting for URLS from cisco.com domains:
hostname(config-webpn)# rewrite order 2 disable resource-mask *cisco.com/*Related Commands
apcf
Specifies nonstandard rules to use for a particular application.
proxy-bypass
Configures minimal content rewriting for a particular application.
re-xauth
To require that IPSec users reauthenticate on IKE rekey, issue the re-xauth enable command in group-policy configuration mode. To disable user reauthentication on IKE rekey, use the re-xauth disable command.
To remove the re-xauth attribute from the running configuration, use the no form of this command. This enables inheritance of a value for reauthentication on IKE rekey from another group policy.
re-xauth {enable [extended] | disable}
no re-xauth
Syntax Description
Defaults
Reauthentication on IKE rekey is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group policy
•
—
•
—
—
Command History
Usage Guidelines
Reauthentication on IKE rekey applies only to IPSec connections.
If you enable reauthentication on IKE rekey, the security appliance prompts the user to enter a username and password during initial Phase 1 IKE negotiation and also prompts for user authentication whenever an IKE rekey occurs. Reauthentication provides additional security.
The user has 30 seconds to enter credentials, and up to three attempts before the SA expires at approximately two minutes and the tunnel terminates. Use the extended keyword to allow users to reenter authentication credentials until the maximum lifetime of the configured SA.
To check the configured rekey interval, in monitoring mode, issue the show crypto ipsec sa command to view the security association lifetime in seconds and lifetime in kilobytes of data.
Note
Examples
The following example shows how to enable reauthentication on rekey for the group policy named FirstGroup:
hostname(config) #group-policy FirstGroup attributeshostname(config-group-policy)# re-xauth enablerip send version
To specify the RIP version used to send RIP updates on an interface, use the rip send version command in interface configuration mode. To restore the defaults, use the no form of this command.
rip send version {[1] [2]}
no rip send version
Syntax Description
Defaults
The security appliance sends RIP Version 1 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
You can override the global RIP send version setting on a per-interface basis by entering the rip send version command on an interface.
If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.
Examples
The following example configures the security appliance to send and receive RIP Version 1 and 2 packets on the specified interface:
hostname(config)# interface GigabitEthernet0/3hostname(config-if)# rip send version 1 2hostname(config-if)# rip receive version 1 2Related Commands
rip receive version
To specify the version of RIP accepted on an interface, use the rip receive version command in interface configuration mode. To restore the defaults, use the no form of this command.
version {[1] [2]}
no version
Syntax Description
Defaults
The security appliance accepts Version 1 and Version 2 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
You can override the global setting on a per-interface basis by entering the rip receive version command on an interface.
If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.
Examples
The following example configures the security appliance to receive RIP Version 1 and 2 packets the specified interface:
hostname(config)# interface GigabitEthernet0/3hostname(config-if)# rip send version 1 2hostname(config-if)# rip receive version 1 2Related Commands
rip authentication mode
To specify the type of authentication used in RIP Version 2 packets, use the rip authentication mode command in interface configuration mode. To restore the default authentication method, use the no form of this command.
rip authentication mode {text | md5}
no rip authentication mode
Syntax Description
md5
Uses MD5 for RIP message authentication.
text
Uses clear text for RIP message authentication (not recommended).
Defaults
Clear text authentication is used by default.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.
Use the show interface command to view the rip authentication commands on an interface.
Examples
The following examples shows RIP authentication configured on interface GigabitEthernet0/3:
hostname(config)# interface Gigabit0/3hostname(config-if)# rip authentication mode md5hostname(config-if)# rip authentication key thisismykey key_id 5Related Commands
rip authentication key
To enable authentication of RIP Version 2 packets and specify the authentication key, use the rip authentication key command in interface configuration mode. To disable RIP Version 2 authentication, use the no form of this command.
rip authentication key key key_id key_id
no rip authentication key
Syntax Description
key
Key to authenticate RIP updates. The key can contain up to 16 characters.
key_id
Key identification value; valid values range from 1 to 255.
Defaults
RIP authentication is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates. When you enable neighbor authentication, you must ensure that the key and key_id arguments are the same as those used by neighbor devices that provide RIP version 2 updates. The key is a text string of up to 16 characters.
Use the show interface command to view the rip authentication commands on an interface.
Examples
The following examples shows RIP authentication configured on interface GigabitEthernet0/3:
hostname(config)# interface Gigabit0/3hostname(config-if)# rip authentication mode md5hostname(config-if)# rip authentication key thisismykey key_id 5Related Commands
rip receive version
To specify the version of RIP accepted on an interface, use the rip receive version command in interface configuration mode. To restore the defaults, use the no form of this command.
version {[1] [2]}
no version
Syntax Description
Defaults
The security appliance accepts Version 1 and Version 2 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
You can override the global setting on a per-interface basis by entering the rip receive version command on an interface.
If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.
Examples
The following example configures the security appliance to receive RIP Version 1 and 2 packets the specified interface:
hostname(config)# interface GigabitEthernet0/3hostname(config-if)# rip send version 1 2hostname(config-if)# rip receive version 1 2Related Commands
rip send version
To specify the RIP version used to send RIP updates on an interface, use the rip send version command in interface configuration mode. To restore the defaults, use the no form of this command.
rip send version {[1] [2]}
no rip send version
Syntax Description
Defaults
The security appliance sends RIP Version 1 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
You can override the global RIP send version setting on a per-interface basis by entering the rip send version command on an interface.
If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.
Examples
The following example configures the security appliance to send and receive RIP Version 1 and 2 packets on the specified interface:
hostname(config)# interface GigabitEthernet0/3hostname(config-if)# rip send version 1 2hostname(config-if)# rip receive version 1 2Related Commands
rmdir
To remove the existing directory, use the rmdir command in privileged EXEC mode.
rmdir [/noconfirm] [disk0: | disk1: | flash:]path
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
If the directory is not empty, the rmdir command fails.
Examples
This example shows how to remove an existing directory named "test":
hostname# rmdir testRelated Commands
dir
Displays the directory contents.
mkdir
Creates a new directory.
pwd
Displays the current working directory.
show file
Displays information about the file system.
route
To enter a static or default route for the specified interface, use the route command in global configuration mode. Use the no form of this command to remove routes from the specified interface.
route interface_name ip_address netmask gateway_ip [[metric] [track number] | tunneled]
no route interface_name ip_address netmask gateway_ip [[metric] [track number] | tunneled]
Syntax Description
Defaults
The metric default is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Preexisting
This command was preexisting.
7.2(1)
The track number value was added.
Usage Guidelines
Use the route command to enter a default or static route for an interface. To enter a default route, set ip_address and netmask to 0.0.0.0, or use the shortened form of 0. All routes that are entered using the route command are stored in the configuration when it is saved.
You can define a separate default route for tunneled traffic along with the standard default route. When you create a default route with the tunneled option, all traffic from a tunnel terminating on the security appliance that cannot be routed using learned or static routes, is sent to this route. For traffic emerging from a tunnel, this route overrides over any other configured or learned default routes.
The following restrictions apply to default routes with the tunneled option:
•
•
•
You cannot define more than one default route with the tunneled option; ECMP for tunneled traffic is not supported.
Create static routes to access networks that are connected outside a router on any interface. For example, the security appliance sends all packets that are destined to the 192.168.42.0 network through the 192.168.1.5 router with this static route command.
hostname(config)# route dmz 192.168.42.0 255.255.255.0 192.168.1.5 1Once you enter the IP address for each interface, the security appliance creates a CONNECT route in the route table. This entry is not deleted when you use the clear route or clear configure route commands.
If the route command uses the IP address from one of the interfaces on the security appliance as the gateway IP address, the security appliance will ARP for the destination IP address in the packet instead of ARPing for the gateway IP address.
Examples
The following example shows how to specify one default route command for an outside interface:
hostname(config)# route outside 0 0 209.165.201.1 1The following example shows how to add these static route commands to provide access to the networks:
hostname(config)# route dmz1 10.1.2.0 255.0.0.0 10.1.1.4 1hostname(config)# route dmz1 10.1.3.0 255.0.0.0 10.1.1.4 1The following example uses an SLA operation to install a default route to the 10.1.1.1 gateway on the outside interface. The SLA operation monitors the availability of that gateway.If the SLA operation fails, then the backup route on the dmz interface is used.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# timeout 1000hostname(config-sla-monitor-echo)# frequency 3hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityhostname(config)# route outside 0.0.0.0 0.0.0.0 10.1.1.1 track 1hostname(config)# route dmz 0.0.0.0 0.0.0.0 10.2.1.1 254Related Commands
route-map
To define the conditions for redistributing routes from one routing protocol into another, use the route-map command in global configuration mode. To delete a map, use the no form of this command.
route-map map_tag [permit | deny] [seq_num]
no route-map map_tag [permit | deny] [seq_num]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The route-map command lets you redistribute routes.
The route-map global configuration command `and the match and set configuration commands define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria that are the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions, which are the redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.
The match route-map configuration command has multiple formats. You can enter the match commands in any order, and all match commands must pass to cause the route to be redistributed according to the set actions given with the set commands. The no form of the match commands removes the specified match criteria.
Use route maps when you want detailed control over how routes are redistributed between routing processes. You specify the destination routing protocol with the router ospf global configuration command. You specify the source routing protocol with the redistribute router configuration command.
When you pass routes through a route map, a route map can have several parts. Any route that does not match at least one match clause relating to a route-map command is ignored; the route is not advertised for outbound route maps and is not accepted for inbound route maps. To modify only some data, you must configure a second route map section with an explicit match specified.
The seq_number argument is as follows:
1.
2.
3.
If the no route-map map-tag command is specified (with no seq-num argument), the whole route map is deleted (all route-map entries with the same map-tag text).
If the match criteria are not met, and you specify the permit keyword, the next route map with the same map_tag is tested. If a route passes none of the match criteria for the set of route maps sharing the same name, it is not redistributed by that set.
Examples
The following example shows how to configure a route map in OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# show running-config route-maproute-map maptag1 permit 8set metric 5match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
router-id
To use a fixed router ID, use the router-id command in router configuration mode. To reset OSPF to use the previous router ID behavior, use the no form of this command.
router-id addr
no router-id [addr]
Syntax Description
Defaults
If not specified, the highest-level IP address on the security appliance is used as the router ID.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
By default, the security appliance uses the highest-level IP address on an interface that is covered by a network command in the OSPF configuration. If the highest-level IP address is a private address, then that address is sent in hello packets and database definitions. To use a specific router ID, use the router-id command to specify a global address for the router ID.
Router IDs must be unique within an OSPF routing domain. If two routers in the same OSPF domain are using the same router ID, routing may not work correctly.
You should enter the router-id command before entering network commands in an OSPF configuration. This prevents possible conflicts with the default router ID generated by the security appliance. If you do have a conflict, you will receive the message:
ERROR: router-id addr in use by ospf process pidTo enter the conflicting ID, remove the network command that contains the IP address causing the conflict, enter the router-id command, and then re-enter the network command.
Examples
The following example sets the router ID to 192.168.1.1:
hostname(config-router)# router-id 192.168.1.1hostname(config-router)#Related Commands
router ospf
Enters router configuration mode.
show ospf
Displays general information about the OSPF routing processes.
router eigrp
To start an EIGRP routing process and configure parameters for that process, use the router eigrp command in global configuration mode. To disable EIGRP routing, use the no form of this command.
router eigrp as-number
no router eigrp as-number
Syntax Description
as-number
Autonomous system number that identifies the routes to the other EIGRP routers. It is also used to tag the routing information. Valid values are from 1 to 65535.
Defaults
EIGRP routing is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The router eigrp command creates an EIGRP routing process or enters router configuration mode for an existing EIGRP routing process. You can only create a single EIGRP routing process on the security appliance.
Use the following router configuration mode commands to configure the EIGRP routing processes:
•
•
•
•
•
•
•
•
•
•
•
•
•
Use the following interface configuration mode commands to configure interface-specific EIGRP parameters:
•
•
•
•
•
•
•
Examples
The following example shows how to enter the configuration mode for the EIGRP routing process with the autonomous system number 100:
hostname(config)# router eigrp 100hostname(config-router)#Related Commands
router ospf
To start an OSPF routing process and configure parameters for that process, use the router ospf command in global configuration mode. To disable OSPF routing, use the no form of this command.
router ospf pid
no router ospf pid
Syntax Description
pid
Internally used identification parameter for an OSPF routing process; valid values are from 1 to 65535. The pid does not need to match the ID of OSPF processes on other routers.
Defaults
OSPF routing is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The router ospf command is the global configuration command for OSPF routing processes running on the security appliance. Once you enter the router ospf command, the command prompt appears as (config-router)#, indicating that you are in router configuration mode.
When using the no router ospf command, you do not need to specify optional arguments unless they provide necessary information. The no router ospf command terminates the OSPF routing process specified by its pid. You assign the pid locally on the security appliance. You must assign a unique value for each OSPF routing process.
The router ospf command is used with the following OSPF-specific commands to configure OSPF routing processes:
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example shows how to enter the configuration mode for the OSPF routing process numbered 5:
hostname(config)# router ospf 5hostname(config-router)#Related Commands
router rip
To start a RIP routing process and configure parameters for that process, use the router rip command in global configuration mode. To disable the RIP routing process, use the no form of this command.
router rip
no router rip
Syntax Description
This command has no arguments or keywords.
Defaults
RIP routing is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The router rip command is the global configuration command for configuring the RIP routing processes on the security appliance. You can only configure one RIP process on the security appliance. The no router rip command terminates the RIP routing process and removes all router configuration for that process.
When you enter the router rip command the command prompt changes to hostname(config-router)#, indicating that you are in router configuration mode.
The router rip command is used with the following router configuration commands to configure RIP routing processes:
•
•
•
•
•
•
•
•
Additionally, you can use the following commands in interface configuration mode to configure RIP properties on a per-interface basis:
•
•
•
•
RIP is not supported under transparent mode. By default, the security appliance denies all RIP broadcast and multicast packets. To permit these RIP messages to pass through a security appliance operating in transparent mode you must define access list entries to permit this traffic. For example, to permit RIP version 2 traffic through the security appliance, create an access list entry such as access-list myriplist extended permit ip any host 224.0.0.9. To permit RIP version 1 broadcasts, create an access list entry such as access-list myriplist extended permit udp any any eq rip. Apply these access list entries to the appropriate interface using the access-group command.
You can enable both RIP and OSPF routing on the security appliance at the same time.
Examples
The following example shows how to enter the configuration mode for the OSPF routing process numbered 5:
hostname(config)# router riphostname(config-router)# network 10.0.0.0hostname(config-router)# version 2Related Commands
rtp-conformance
To check RTP packets flowing on the pinholes for protocol conformance in H.323 and SIP, use the rtp-conformance command in parameters configuration mode. To disable this feature, use the no form of this command.
rtp-conformance [enforce-payloadtype]
no rtp-conformance [enforce-payloadtype]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to check RTP packets flowing on the pinholes for protocol conformance on an H.323 call:
hostname(config)# policy-map type inspect h323 h323_maphostname(config-pmap)# parametershostname(config-pmap-p)# rtp-conformanceRelated Commands
