-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
debug icmp through debug ospfv3 Commands
debug icmp through debug ospfv3 Commands
debug icmp
To display detailed information about ICMP inspection, use the debug icmp command in privileged EXEC mode. To disable debugging, use the no form of this command.
debug icmp trace [ level ]
no debug icmp trace [ level ]
Syntax Description
Defaults
All options are enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The debug icmp command displays detailed information about ICMP inspection. The no debug all or undebug all command turns off all enabled debugs.
Examples
The following example enables the display of detailed information about ICMP inspection:
hostname# debug icmpRelated Commands
debug idprom
To enable the display of IDPROM-related debugging information, use the debug idprom command in privileged EXEC mode. To disable the display of IDPROM-related debugging information, use the no form of this command.
debug idprom
no debug idprom
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables the display of debugging information for IDPROM-related errors:
hostname# debug idpromRelated Commands
debug igmp
To display IGMP debugging message information, use the debug igmp command in privileged EXEC mode. To disable the display of debugging message information, use the no form of this command.
debug igmp [group group_id | interface if_name]
no debug igmp [group group_id | interface if_name]
Syntax Description
group group_id
Displays IGMP debugging message information for the specified group.
interface if_name
Display IGMP debugging message information for the specified interface.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug igmp command:
hostname# debug igmpIGMP debugging is onIGMP: Received v2 Query on outside from 192.168.3.2IGMP: Send v2 general Query on dmzIGMP: Received v2 Query on dmz from 192.168.4.1IGMP: Send v2 general Query on outsideIGMP: Received v2 Query on outside from 192.168.3.1IGMP: Send v2 general Query on insideIGMP: Received v2 Query on inside from 192.168.1.1IGMP: Received v2 Report on inside from 192.168.1.6 for 224.1.1.1IGMP: Updating EXCLUDE group timer for 224.1.1.1Related Commands
debug ils
To show debugging messages for ILS, use the debug ils command in privileged EXEC mode. To stop showing debugging messages for ILS, use the no form of this command.
debug ils [level]
no debug ils [level]
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
To see the current debug command settings, enter the show debug command. To stop the debugging output, enter the no debug command. To stop all debugging messages from being displayed, enter the no debug all command.
Note
Examples
The following example enables debugging messages at the default level (1) for ILS application inspection:
hostname# debug ilsRelated Commands
debug imagemgr
To display Image Manager debugging information, use the debug imagemgr command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug imagemgr [level]
no debug imagemgr [level]
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug imagemgr and the show debug commands:
hostname# debug imagemgrdebug imagemgr enabled at level 1hostname# show debugdebug imagemgr enabled at level 1hostname#Related Commands
debug inspect tls-proxy
To show debugging messages for TLS proxy inspection, use the debug inspect tls-proxy command in privileged EXEC mode. To stop showing debugging messages, use the no form of this command.
debug inspect tls-proxy [all | errors | events | packets]
no debug inspect tls-proxy [all | errors | events | packets]
Syntax Description
all
Specifies all TLS proxy debugging.
errors
Specifies TLS proxy error debugging.
events
Specifies TLS proxy event debugging.
packets
Specifies TLS proxy packet debugging.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Using debug commands might slow down traffic on busy networks.
Examples
The following example enables debugging messages for TLS proxy:
hostname# debug inspect tls-proxyRelated Commands
debug ip eigrp
To display debugging message information EIGRP protocol packets, use the debug ip eigrp command in privileged EXEC mode. To disable the debugging message information display, use the no form of this command.
debug ip eigrp [as-number] [ip-addr mask | neighbor nbr-addr | notifications | summary]
no debug ip eigrp [as-number] [ip-addr mask | neighbor nbr-addr | notifications | summary]
Syntax Description
Defaults
If no keywords or arguments are specified, only debugging messages from the IPv4 ASDM appear.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
This command helps you analyze the packets that are sent and received on an interface.
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug ip eigrp command:
hostname# debug ip eigrpIP-EIGRP Route Events debugging is onEIGRP-IPv4(Default-IP-Routing-Table:1): Processing incoming UPDATE packetEIGRP-IPv4(Default-IP-Routing-Table:1): Ext 192.168.3.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960EIGRP-IPv4(Default-IP-Routing-Table:1): Ext 192.168.0.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960EIGRP-IPv4(Default-IP-Routing-Table:1): Ext 192.168.3.0 255.255.255.0 M 386560 - 256000 130560 SM 360960 - 256000 104960EIGRP-IPv4(Default-IP-Routing-Table:1): 172.69.43.0 255.255.255.0, - do advertise out Ethernet0/1EIGRP-IPv4(Default-IP-Routing-Table:1): Ext 172.69.43.0 255.255.255.0 metric 371200 - 256000 115200EIGRP-IPv4(Default-IP-Routing-Table:1): 192.135.246.0 255.255.255.0, - do advertise out Ethernet0/1EIGRP-IPv4(Default-IP-Routing-Table:1): Ext 192.135.246.0 255.255.255.0 metric 46310656 - 45714176 596480EIGRP-IPv4(Default-IP-Routing-Table:1): 172.69.40.0 255.255.255.0, - do advertise out Ethernet0/1EIGRP-IPv4(Default-IP-Routing-Table:1): Ext 172.69.40.0 255.255.255.0 metric 2272256 - 1657856 614400EIGRP-IPv4(Default-IP-Routing-Table:1): 192.135.245.0 255.255.255.0, - do advertise out Ethernet0/1EIGRP-IPv4(Default-IP-Routing-Table:1): Ext 192.135.245.0 255.255.255.0 metric 40622080 - 40000000 622080EIGRP-IPv4(Default-IP-Routing-Table:1): 192.135.244.0 255.255.255.0, - do advertise out Ethernet0/1Table 15-1describes the significant fields shown in the display.
Related Commands
debug ipsec-over-tcp
To display IPsec-over-TCP debugging information, use the debug ipsec-over-tcp command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug ipsec-over-tcp [level]
no debug ipsec-over-tcp
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables IPsec-over-TCP debugging messages. The show debug command reveals that IPsec-over-TCP debugging messages are enabled.
hostname# debug ipsec-over-tcpdebug ipsec-over-tcp enabled at level 1hostname# show debugdebug ipsec-over-tcp enabled at level 1hostname#Related Commands
debug ipv6
To display IPv6 debugging messages, use the debug ipv6 command in privileged EXEC mode. To stop the display of debugging messages, use the no form of this command.
debug ipv6 {icmp | interface | mld | nd | packet | routing}
no debug ipv6 {icmp | interface | nd | packet | routing}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output for the debug ipv6 icmp command:
hostname# debug ipv6 icmp13:28:40:ICMPv6:Received ICMPv6 packet from 2000:0:0:3::2, type 13613:28:45:ICMPv6:Received ICMPv6 packet from FE80::203:A0FF:FED6:1400, type 13513:28:50:ICMPv6:Received ICMPv6 packet from FE80::203:A0FF:FED6:1400, type 13613:28:55:ICMPv6:Received ICMPv6 packet from FE80::203:A0FF:FED6:1400, type 135Related Commands
debug ipv6 dhcp
To enable and disable generic IPv6 DHCP debugging messages, use the debug ipv6 dhcp command in privileged EXEC mode. To stop the display of debugging messages, use the no form of this command.
debug ipv6 dhcp
no debug ipv6 dhcp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output for the debug ipv6 dhcp command:
hostname# debug ipv6 dhcpIPv6 DHCP: Received RELAY-REPLY from fe80::2a0:c9ff:fe5d:41ed on cnrIPv6 DHCP: detailed packet contentssrc fe80::2a0:c9ff:fe5d:41ed (cnr)dst fe80::2e0:b6ff:fe00:3306type RELAY-REPLY(13), hop 0link 2002::1peer fe80::204:23ff:febb:b094option INTERFACE-ID(18), len 40x00000003option RELAY-MSG(9), len 58type REPLY(7), xid 3718228option CLIENTID(1), len 14000100010f9a59d1000423bbb094option SERVERID(2), len 140001000147f28f15000cf1fcecacoption STATUS-CODE(13), len 14status code SUCCESS(0)status message: All on link!Related Commands
debug ipv6 dhcprelay
Enables and disables IPv6 DHCP relay agent debugging.
show ipv6 dhcprelay binding
Displays the relay binding entries created by the relay agent.
debug ipv6 dhcprelay
To enable and disable IPv6 DHCP relay agent debugging messages, use the debug ipv6 dhcprelay command in privileged EXEC mode. To stop the display of debugging messages, use the no form of this command.
debug ipv6 dhcprelay
no debug ipv6 dhcprelay
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output for the debug ipv6 dhcprelay command:
hostname# debug ipv6 dhcprelayIPv6 DHCP_RELAY: Relaying CONFIRM from fe80::204:23ff:febb:b094 on clientIPv6 DHCP_RELAY: Creating relay binding for fe80::204:23ff:febb:b094 at interface clientIPv6 DHCP_RELAY: to fe80::2a0:c9ff:fe5d:41ed using cnrIPv6 DHCP_RELAY: to 2005::11 via 2005::11 using routerIPv6 DHCP_RELAY: to fe80::204:23ff:febb:b094 using serverIPv6 DHCP_RELAY: Relaying RELAY-REPLY from fe80::2a0:c9ff:fe5d:41ed on cnrIPv6 DHCP_RELAY: relayed msg: REPLYIPv6 DHCP_RELAY: to fe80::204:23ff:febb:b094IPv6 DHCP_RELAY: Deleting binding for fe80::204:23ff:febb:b094 at interface clientRelated Commands
debug ipv6 dhcp
Enables and disables generic IPv6 DHCP debugging messages.
show ipv6 dhcprelay binding
Displays the relay binding entries created by the relay agent.
debug iua-proxy
To display IUA proxy debugging information, use the debug iua-proxy command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug iua-proxy [level]
no debug iua-proxy
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables IUA-proxy debugging messages. The show debug command indicates that IUA-proxy debugging messages are enabled.
hostname# debug iua-proxydebug iua-proxy enabled at level 1hostname# show debugdebug iua-proxy enabled at level 1hostname#Related Commands
debug kerberos
To display Kerberos authentication debugging information, use the debug kerberos command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug kerberos [level]
no debug kerberos
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging lvel is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables Kerberos debugging messages. The show debug command reveals that Kerberos debugging messages are enabled.
hostname# debug kerberosdebug kerberos enabled at level 1hostname# show debugdebug kerberos enabled at level 1hostname#Related Commands
debug l2tp
To display L2TP debugging information, use the debug l2tp command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug l2tp {data | error | event | packet} level
no debug l2tp {data | error | event | packet} level
Syntax Description
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables L2TP debugging messages for connection events. The show debug command indicates that L2TP debugging messages are enabled.
hostname# debug l2tp event 1hostname# show debugdebug l2tp event enabled at level 1hostname#Related Commands
debug lacp
To display EtherChannel LACP debugging information, use the debug lacp command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug lacp [all | event | fsm | misc | packet | periodic]
no debug lacp [all | event | fsm | misc | packet | periodic]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables LACP debugging messages for events. The show debug command indicates that LACP debugging messages are enabled.
hostname# debug lacp eventhostname# show debugdebug lacp event enabledhostname#Related Commands
debug lacp cluster
To display cluster Link Aggregation Control Protocol (cLACP) debug information, use the debug lacp cluster command in privileged EXEC mode. To disable the display of debug information, use the no form of this command.
debug lacp cluster [all | ccp | misc | protocol] [level]
no debug lacp cluster [all | ccp | misc | protocol]
Syntax Description
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables debug messages for all types:
hostname# debug lacp cluster allRelated Commands
debug ldap
To display LDAP debugging information, use the debug ldap command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug ldap [level]
no debug ldap
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables LDAP debugging messages. The show debug command indicates that LDAP debugging messages are enabled.
hostname# debug ldapdebug ldap enabled at level 1hostname# show debugdebug ldap enabled at level 1hostname#Related Commands
debug license
To show debugging messages for licenses, use the debug license command in privileged EXEC mode. To stop showing debugging messages for licenses, use the no form of this command.
debug license [level]
[no] debug license [level]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Using debug commands might slow down traffic on busy networks.
Examples
The following example enables debugging for licenses:
hostname# debug lioense 255debug license enabled at level 255Related Commands
license server-enable
Identifies a unit as a shared licensing server.
show activation-key
Shows the current licenses installed.
show debug
Shows all enabled debuggers.
debug mac-address-table
To show debugging messages for the MAC address table, use the debug mac-address-table command in privileged EXEC mode. To stop showing debugging messages for the MAC address table, use the no form of this command.
debug mac-address-table [level]
no debug mac-address-table [level]
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Usage Guidelines
Using debug commands might slow down traffic on busy networks.
Examples
The following example enables debugging messages for the MAC address table:
hostname# debug mac-address-tableRelated Commands
debug menu
To display detailed debugging information for specific features, use the debug menu command in privileged EXEC mode.
debug menu [aaa | ak47 | coredump | crashinfo | ctm | cts | dap | email | fw | ike-common | ikev1 | ikev2 | ipaddrutl | ipsec-over-tcp | ipv6 | license | memory | nac | npshim | pki | ppp | qos | quota | regex | sessmgr | splitdns | ssl | syslog | vpnfo | vpnlib | webvpn]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Caution
Related Commands
debug mfib
To display MFIB debugging information, use the debug mfib command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug mfib {db | init | mrib | pak | ps | signal} [group] [cluster]
no debug mfib {db | init | mrib | pak | ps | signal} [group] [cluster]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug mfib db command:
hostname# debug mfib dbMFIB IPv4 db debugging enabledThe following is sample output from the debug mfib cluster command:
hostname# debug mfib clusterMFIB CLUSTER: MFIB CLUSTER: mfib_cluster_send_update_msg sync DB entry add: s=172.23.57.98, g=229.111.112.12, mask_len=32, epoch=1, attr=0x20MFIB CLUSTER: MFIB CLUSTER: mfib_cluster_send_update_msg sync DB entry add: s=172.23.57.98, g=229.111.112.12, mask_len=32, epoch=1, attr=0x20MFIB CLUSTER: MFIB CLUSTER: mfib_cluster_send_update_msg sync DB entry add: s=172.23.57.98, g=229.111.112.12, mask_len=32, epoch=1, attr=0x20MFIB CLUSTER: MFIB CLUSTER: mfib_cluster_send_update_msg sync DB entry add: s=172.23.57.98, g=229.111.112.12, mask_len=32, epoch=1, attr=0x20Related Commands
debug mgcp
To display detailed information about MGCP application inspection, use the debug mgcp command in privileged EXEC mode. To disable debugging, use the no form of this command.
debug mgcp {messages | parser | sessions}
no debug mgcp {messages | parser | sessions}
Syntax Description
messages
Displays debugging information about MGCP messages.
parser
Displays debugging information for parsing MGCP messages.
sessions
Displays debugging information about MGCP sessions.
Defaults
All options are enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The debug mgcp command displays detailed information about MGCP inspection. The no debug all or undebug all command turns off all enabled debugging.
Examples
The following example enables the display of detailed information about MGCP application inspection:
hostname# debug mgcpRelated Commands
debug mmp
To display inspect MMP events, use the debug mmp command in privileged EXEC mode. To stop the display of inspect MMP events, use the no form of this command.
debug mmp
no debug mmp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example shows how to display inspect MMP events:
hostname#debug mmpciscoasa5520-tfw-cuma/admin(config-pmap)# MMP:: received 28 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: version OLWP-2.0MMP status: 0MMP:: forward 28/28 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: received 85 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: version OLWP-2.0MMP:: session-id: 41A3D410-8B10-4DEB-B15C-B2B4B0D22055MMP status: 201MMP:: forward 85/85 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: received 265 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: content-length: 196MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 200/196MMP:: forward 265/265 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: received 267 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: content-length: 198MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 202/198MMP:: forward 267/267 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: received 135 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: content-length: 67MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 71/67MMP:: forward 135/135 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: received 100 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2442MMP:: content-length: 32MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 36/32MMP:: forward 100/100 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2442MMP:: received 130 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: content-length: 62MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 66/62MMP:: forward 130/130 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: received 220 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: content-length: 151MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 155/151MMP:: forward 220/220 bytes from outside:172.23.62.204/2494 to inside:10.0.0.42/5443MMP:: received 130 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494MMP:: content-length: 62MMP:: content-type: text/oml21+wbxmlMMP:: processing entity body 66/62MMP:: forward 130/130 bytes from inside:10.0.0.42/5443 to outside:172.23.62.204/2494Related Commands
debug module-boot
To show debugging messages about the SSM booting process, use the debug module-boot command in privileged EXEC mode. To disable the display of debugging messages for the SSM booting process, use the no form of this command.
debug module-boot [level]
no debug module-boot [level]
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Using debug commands might slow down traffic on busy networks.
Examples
The following example enables debugging messages for the SSM booting process:
hostname# debug module-bootRelated Commands
debug mrib
To display MRIB debugging information, use the debug mrib command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug mrib {client | io | route [group] | table}
no debug mrib {client | io | route [group] | table}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug mrib io command:
hostname# debug mrib ioIPv4 MRIB io debugging is onRelated Commands
show mrib client
Displays information about the MRIB client connections.
show mrib route
Displays MRIB table entries.
debug nac
To enable logging of NAC Framework events, use the debug nac command in privileged EXEC mode. To disable the logging of NAC debugging messages, use the no form of this command.
debug nac {all | auth | errors | events}
no debug nac {all | auth | errors | events}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
When you use this command, the ASA logs the following types of NAC events: initializations, exception list matches, ACS transactions, clientless authentications, default ACL applications, and revalidations.
The high priority assigned to debugging output can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables the logging of all NAC session events:
hostname# debug nac eventshostname#The following example enables the logging of all NAC debugging messages:
hostname# debug nac allhostname#The following example disables the logging of all NAC debugging messages:
hostname# no debug nachostname#Related Commands
debug ntdomain
To display NT domain authentication debugging information, use the debug ntdomain command in privileged EXEC mode. To disable the display of NT domain debugging information, use the no form of this command.
debug ntdomain [level]
no debug ntdomain
Syntax Description
level
(Optional) Sets the debugging message level to display, between 1 and 255. The default is 1. To display additional messages at higher levels, set the level to a higher number.
Defaults
The default value for the debugging level is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following example enables NT domain debugging messages. The show debug command indicates that NT domain debugging messages are enabled.
hostname# debug ntdomaindebug ntdomain enabled at level 1hostname# show debugdebug ntdomain enabled at level 1hostname#Related Commands
debug ntp
To show debugging messages for NTP, use the debug ntp command in privileged EXEC mode. To stop showing debugging messages for NTP, use the no form of this command.
debug ntp {adjust | authentication | events | loopfilter | packets | params | select | sync | validity}
no debug ntp {adjust | authentication | events | loopfilter | packets | params | select | sync | validity}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Using debug commands might slow down traffic on busy networks.
Examples
The following example enables debugging messages for NTP:
hostname# debug ntp eventsRelated Commands
debug ospf
To display debugging information about the OSPF routing processes, use the debug ospf command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug ospf [adj | database-timer | events | flood | hello | ipsec | lsa | lsa-generation | lsa-maxage | lsdb | packet | rate-limit | retransmission | spf | tree] [external]
no debug ospf [adj | database-timer | events | flood | hello | ipsec | lsa | lsa-generation | lsa-maxage | lsdb | packet | rate-limit | retransmission | spf | tree] [external]
Syntax Description
Defaults
Displays all OSPF debugging information if no keyword is provided.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
9.0(1)
The following keywords have been added: hello, ipsec, lsa, lsa-maxage, lsdb, and rate-limit.
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug ospf events command:
hostname# debug ospf eventsospf event debugging is onOSPF:hello with invalid timers on interface Ethernet0hello interval received 10 configured 10net mask received 255.255.255.0 configured 255.255.255.0dead interval received 40 configured 30Related Commands
debug ospfv3
To display debugging information about the OSPFv3 routing processes, use the debug ospfv3 command in privileged EXEC mode. To disable the display of debugging information, use the no form of this command.
debug ospfv3 [adj | database-timer | events | flood | hello | lsa-generation | packet | retransmission | spf ]
no debug ospfv3 [adj | database-timer | events | flood | hello | lsa-generation | packet | retransmission | spf ]
Syntax Description
Defaults
Displays all OSPFv3 debugging information if no keyword is provided.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The following is sample output from the debug ospf events command:
hostname# debug ospfv3 eventsospfv3 event debugging is onOSPFv3:hello with invalid timers on interface Ethernet0hello interval received 10 configured 10net mask received 255.255.255.0 configured 255.255.255.0dead interval received 40 configured 30Related Commands
