-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
default through dhcp-server Commands
default-information originate (OSPFv2 and OSPFv3)
default-information originate (RIP)
default through dhcp-server Commands
default (crl configure)
To return all CRL parameters to their system default values, use the default command in crl configure configuration mode.
default
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Crl configure configuration
•
—
•
—
—
Command History
Usage Guidelines
Invocations of this command do not become part of the active configuration. The crl configure configuration mode is accessible from the crypto ca trustpoint configuration mode. These parameters are used only when the LDAP server requires them.
Examples
The following example enters ca-crl configuration mode and returns CRL command values to their defaults:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# crl configurehostname(ca-crl)# defaulthostname(ca-crl)#Related Commands
crl configure
Enters crl configure configuration mode.
crypto ca trustpoint
Enters trustpoint configuration mode.
protocol ldap
Specifies LDAP as a retrieval method for CRLs.
default (interface)
To return an interface command to its system default value, use the default command in interface configuration mode.
default command
Syntax Description
command
Specifies the command that you want to set to the default. For example:
default activation key
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is a runtime command; when you enter it, it does not become part of the active configuration.
Examples
The following example enters interface configuration mode and returns the security level to its default:
hostname(config)# interface gigabitethernet 0/0hostname(config-if)# default security-levelRelated Commands
default (OSPFv3)
To return an OSPFv3 parameter to its default value, use the default command in router configuration mode.
default [area | auto-cost | default-information | default-metric | discard-route | distance | distribute-list | ignore | log-adjacency-changes | maximum-paths | passive-interface | redistribute | router-id | summary-prefix | timers]
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
Use this command to reset OSPFv3 parameter default values.
Examples
The following example resets OSPFv3 timer parameters to their default values:
hostname(config-router)# default timers spfRelated Commands
default (time-range)
To restore default settings for the absolute and periodic commands, use the default command in time-range configuration mode.
default {absolute | periodic days-of-the-week time to [days-of-the-week] time}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Time-range configuration
·
·
·
·
Command History
Usage Guidelines
If the end days-of-the-week value is the same as the start value, you can omit them.
If a time-range command has both absolute and periodic values specified, then the periodic commands are evaluated only after the absolute start time is reached, and are not further evaluated after the absolute end time is reached.
The time-range feature relies on the system clock of the ASA; however, the feature works best with NTP synchronization.
Examples
The following example shows how to restore the default behavior of the absolute keyword:
hostname(config-time-range)# default absoluteRelated Commands
default user group
For Cloud Web Security, to specify the default username and/or group if the ASA cannot determine the identity of the user coming into the ASA, use the default user group command in parameters configuration mode. To remove the default user or group, use the no form of this command. You can access the parameters configuration mode by first entering the policy-map type inspect scansafe command.
default {[user username] [group groupname]}
no default [user username] [group groupname]
Syntax Description
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Usage Guidelines
If the ASA cannot determine the identity of the user coming into the ASA, then the default user and/or group is included in the HTTP header.
Examples
The following example sets a default name as "Boulder" and a group name as "Cisco":
hostname(config)# policy-map type inspect scansafe cws_inspect_pmap1hostname(config-pmap)# parametershostname(config-pmap-p)# httphostname(config-pmap-p)# default name Boulder group CiscoRelated Commands
default-acl
To specify the ACL to be used as the default ACL for NAC Framework sessions that fail posture validation, use the default-acl command in nac-policy-nac-framework configuration mode. To remove the command from the NAC policy, use the no form of the command.
[no] default-acl acl-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Nac-policy-nac-framework configuration
•
—
•
—
—
Command History
Usage Guidelines
Each group policy points to a default ACL to be applied to hosts that match the policy and are eligible for NAC. The ASA applies the NAC default ACL before posture validation. After posture validation, the ASA replaces the default ACL with the one obtained from the Access Control Server for the remote host. It retains the default ACL if posture validation fails.
The ASA also applies the NAC default ACL if clientless authentication is enabled (which is the default setting).
Examples
The following example identifies acl-1 as the ACL to be applied before posture validation succeeds:
hostname(config-group-policy)# default-acl acl-1hostname(config-group-policy)The following example inherits the ACL from the default group policy:
hostname(config-group-policy)# no default-aclhostname(config-group-policy)Related Commands
default enrollment
To return all enrollment parameters to their system default values, use the default enrollment command in crypto ca trustpoint configuration mode.
default enrollment
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
·
·
·
·
·
Command History
Usage Guidelines
Invocations of this command do not become part of the active configuration.
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and returns all enrollment parameters to their default values within trustpoint central:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# default enrollmenthostname(ca-trustpoint)#Related Commands
clear configure crypto ca trustpoint
Removes all trustpoints.
crl configure
Enters crl configuration mode.
crypto ca trustpoint
Enters trustpoint configuration mode.
default-domain
To set a default domain name for users of the group policy, use the default-domain command in group-policy configuration mode. To delete a domain name, use the no form of this command.
default-domain {value domain-name | none}
no default-domain [domain-name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy configuration
•
—
•
—
—
Command History
Usage Guidelines
To prevent users from inheriting a domain name, use the default-domain none command.
The ASA passes the default domain name to the AnyConnect Secure Mobility Client or the legacy VPN client (IPsec/IKEv1) to append to DNS queries that omit the domain field. This domain name applies only to tunneled packets. When there are no default domain names, users inherit the default domain name in the default group policy.
You can use only alphanumeric characters, hyphens (-), and periods (.) in default domain names.
Examples
The following example shows how to set a default domain name of FirstDomain for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# default-domain value FirstDomainRelated Commands
default-group-policy
To specify the set of attributes that the user inherits by default, use the default-group-policy command in tunnel-group general-attributes configuration mode. To eliminate a default group policy name, use the no form of this command.
default-group-policy group-name
no default-group-policy group-name
Syntax Description
Defaults
The default group name is DfltGrpPolicy.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general-attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
In Version 7.1(1), if you enter this command in webvpn configuration mode, it is transformed to the same command in tunnel-group general-attributes mode.
The default group policy DfltGrpPolicy comes with the initial configuration of the ASA. You can apply this attribute to all tunnel group types.
Examples
The following example entered in config-general configuration mode, specifies a set of attributes for users to inherit by default for an IPsec LAN-to-LAN tunnel group named "standard-policy." This set of commands defines the accounting server, the authentication server, the authorization server, and the address pools.
hostname(config)# tunnel-group standard-policy type ipsec-rahostname(config)# tunnel-group standard-policy general-attributeshostname(config-tunnel-general)# default-group-policy first-policyhostname(config-tunnel-general)# accounting-server-group aaa-server123hostname(config-tunnel-general)# address-pool (inside) addrpool1 addrpool2 addrpool3hostname(config-tunnel-general)# authentication-server-group aaa-server456hostname(config-tunnel-general)# authorization-server-group aaa-server78hostname(config-tunnel-general)#Related Commands
default-group-policy (webvpn)
To specify the name of the group policy to use when the WebVPN or e-mail proxy configuration does not specify a group policy, use the default-group-policy command in various configuration modes. To remove the attribute from the configuration, use the no form of this command.
default-group-policy groupname
no default-group-policy
Syntax Description
groupname
Identifies the previously configured group policy to use as the default group policy. Use the group-policy command to configure a group policy.
Defaults
A default group policy, named DfltGrpPolicy, always exists on the ASA. This default-group-policy command lets you substitute a group policy that you create as the default group policy for WebVPN and e-mail proxy sessions. An alternative is to edit the DfltGrpPolicy.
Command Modes
The following table shows the modes in which you can enter the command:
Command History
7.0(1)
This command was introduced.
7.1(1)
This command was deprecated in webvpn configuration mode and moved to tunnel-group general-attributes configuration mode.
Usage Guidelines
WebVPN, IMAP4S, POP3S, and SMTPS sessions require either a specified or a default group policy. For WebVPN, use this command in webvpn configuration mode. For e-mail proxy, use this command in the applicable e-mail proxy mode.
In Version 7.1(1), if you enter this command in webvpn configuration mode, it is transformed to the same command in tunnel-group general-attributes configuration mode.
You can edit, but not delete the system DefaultGroupPolicy. It has the following AVPs:
Examples
The following example shows how to specify a default group policy called WebVPN7 for WebVPN:
hostname(config)#webvpnhostname(config-webvpn)# default-group-policy WebVPN7default-idle-timeout
To set a default idle timeout value for WebVPN users, use the default-idle-timeout command in webvpn configuration mode. To remove the default idle timeout value from the configuration and reset the default, use the no form of this command.
default-idle-timeout seconds
no default-idle-timeout
Syntax Description
seconds
Specifies the number of seconds for the idle time out. The minimum is 60 seconds, maximum is 1 day (86400 seconds).
Defaults
1800 seconds (30 minutes).
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
The ASA uses the value you set here if there is no idle timeout defined for a user, if the value is 0, or if the value does not fall into the valid range. The default idle timeout prevents stale sessions.
We recommend that you set this command to a short time period, because a browser set to disable cookies (or one that prompts for cookies and then denies them) can result in a user not connecting but nevertheless appearing in the sessions database. If the maximum number of connections permitted is set to one (via the vpn-simultaneous-logins command), the user cannot log back in because the database indicates that the maximum number of connections already exists. Setting a low idle timeout removes such phantom sessions quickly, and lets a user log in again.
Examples
The following example shows how to set the default idle timeout to 1200 seconds (20 minutes):
hostname(config)#webvpnhostname(config-webvpn)# default-idle-timeout 1200Related Commands
vpn-simultaneous-logins
Sets the maximum number of simultaneous VPN sessions permitted.
default-information (EIGRP)
To control the candidate default route information for the EIGRP routing process, use the default-information command in router configuration mode. To suppress EIGRP candidate default route information in incoming or outbound updates, use the no form of this command.
default-information {in | out} [acl-name]
no default-information {in | out}
Syntax Description
acl-name
(Optional) Specifies the named standard access list.
in
Configures EIGRP to accept exterior default routing information.
out
Configures EIGRP to advertise external routing information.
Defaults
Exterior routes are accepted and sent.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
•
—
Command History
Usage Guidelines
Only the no form of the command or default-information commands with an access list specified will appear in the running configuration because, by default, the candidate default routing information is accepted and sent. The no form of the command does not take an acl-name argument.
Examples
The following example disables the receipt of exterior or candidate default route information:
hostname(config)# router eigrp 100hostname(config-router)# no default-information inRelated Commands
router eigrp
Creates an EIGRP routing process and enters configuration mode for that process.
default-information originate (OSPFv2 and OSPFv3)
To generate a default external route into an OSPFv2 or OSPFv3 routing domain, use the default-information originate command in router configuration mode or IPv6 router configuration mode. To disable this feature, use the no form of this command.
default-information originate [always] [metric value] [metric-type {1 | 2}] [route-map map-name]
no default-information originate [[always] [metric value] [metric-type {1 | 2}] [route-map map-name]]
Syntax Description
Defaults
The default values are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
IPv6 router configuration
•
—
•
—
—
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
Using the no form of this command with optional keywords and arguments only removes the optional information from the command. For example, entering the no default-information originate metric 3 command removes the metric 3 option from the command in the running configuration. To remove the complete command from the running configuration, use the no form of the command without any options: no default-information originate.
Examples
The following example shows how to use the default-information originate command with an optional metric and metric type:
hostname(config-rtr)# default-information originate always metric 3 metric-type 2hostname(config-rtr)#Related Commands
default-information originate (RIP)
To generate a default route into RIP, use the default-information originate command in router configuration mode. To disable this feature, use the no form of this command.
default-information originate [route-map name]
no default-information originate [route-map name]]
Syntax Description
route-map name
(Optional) Name of the route map to apply. The routing process generates the default route if the route map is satisfied.
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
The route map referenced in the default-information originate command cannot use an extended access list; it can use only a standard access list.
Examples
The following example shows how to generate a default route into RIP:
hostname(config)# router riphostname(config-router)# network 10.0.0.0hostname(config-router)# default-information originateRelated Commands
router rip
Enters router configuration mode for the RIP routing process.
show running-config router
Displays the commands in the global router configuration.
default-language
To set the default language displayed on the Clientless SSL VPN pages, use the default-language command in webvpn configuration mode.
default-language language
Syntax Description
Defaults
The default language is en-us (English spoken in the United States).
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
The ASA provides language translation for the portal and screens displayed to users that initiate browser-based, clientless SSL VPN connections, as well as the user interface displayed to AnyConnect VPN Client users.
The default language is displayed to Clientless SSL VPN users when they initially connect to the ASA, before logging in. Thereafter, the language displayed is affected by the tunnel group or group policy settings and any customization that they reference.
Examples
The following example changes the default language to Chinese with the name Sales:
hostname(config-webvpn)# default-language zhRelated Commands
default-metric
To specify the EIGRP metrics for redistributed routes, use the default-metric command in router configuration mode. To restore the default values, use the no form of this command.
default-metric bandwidth delay reliability loading mtu
no default-metric bandwidth delay reliability loading mtu
Syntax Description
Defaults
Only connected routes can be redistributed without a default metric. The metric of redistributed connected routes is set to 0.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
•
—
Command History
Usage Guidelines
You must use a default metric to redistribute a protocol into EIGRP unless you use the metric keyword and attributes in the redistribute command. Metric defaults have been carefully set to work for a wide variety of networks. Take great care when changing these values. Keeping the same metrics is supported only when you are redistributing from static routes.
The minimum MTU allowed on an IPv6 enabled interface is 1280 bytes; however, if IPsec is enabled on the interface, the MTU value should not be set below 1380 because of the overhead of IPsec encryption. Setting the interface below 1380 bytes may result in dropped packets.
Examples
The following example shows how the redistributed RIP route metrics are translated into EIGRP metrics with values as follows: bandwidth = 1000, delay = 100, reliability = 250, loading = 100, and MTU = 1500.
hostname(config)# router eigrp 100hostname(config-router)# network 172.16.0.0hostname(config-router)# redistribute riphostname(config-router)# default-metric 1000 100 250 100 1500Related Commands
router eigrp
Creates an EIGRP routing process and enters router configuration mode for that process.
redistribute (EIGRP)
Redistributes routes into the EIGRP routing process.
delay
To set a delay value for an interface, use the delay command in interface configuration mode. To restore the default delay value, use the no form of this command.
delay delay-time
no delay
Syntax Description
Defaults
The default delay depends upon the interface type. Use the show interface command to see the delay value for an interface.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
The value entered is in tens of microseconds. The delay value displayed in the show interface output is in microseconds.
Examples
The following example changes the delay on an interface from the default 1000 to 2000. Truncated show interface command output is included before and after the delay command to show how the command affects the delay values. The delay value is noted in the second line of the show interface output, after the DLY label.
Notice that the command entered to change the delay value to 2000 is delay 200, not delay 2000. This is because the value entered with the delay command is in tens of microseconds, and the show interface output displays microseconds.
hostname(config)# interface Ethernet0/0hostname(config-if)# show interface Ethernet0/0Interface Ethernet0/0 "outside", is up, line protocol is upHardware is i82546GB rev03, BW 100 Mbps, DLY 1000 usecAuto-Duplex(Half-duplex), Auto-Speed(100 Mbps)MAC address 0013.c480.7e16, MTU 1500IP address 10.86.194.224, subnet mask 255.255.254.0! Remainder of the output removedhostname(config-if)# delay 200hostname(config-if)# show interface Ethernet0/0Interface Ethernet0/0 "outside", is up, line protocol is upHardware is i82546GB rev03, BW 100 Mbps, DLY 2000 usecAuto-Duplex(Half-duplex), Auto-Speed(100 Mbps)MAC address 0013.c480.7e16, MTU 1500IP address 10.86.194.224, subnet mask 255.255.254.0! Remainder of the output removedRelated Commands
delete
To delete a file from flash memory, use the delete command in privileged EXEC mode.
delete [/noconfirm] [/recursive] [disk0: | disk1: | flash:] [path/] filename
Syntax Description
Defaults
If you do not specify a directory, the directory is the current working directory by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The file is deleted from the current working directory if a path is not specified. Wildcards are supported when deleting files. When deleting files, you are prompted with the filename and must confirm the deletion.
Examples
The following example shows how to delete a file named test.cfg in the current working directory:
hostname# delete test.cfgRelated Commands
cd
Changes the current working directory to the one specified.
rmdir
Removes a file or directory.
show file
Displays the specified file.
deny-message
To change the message delivered to a remote user who logs into WebVPN successfully, but has no VPN privileges, use the deny-message value command in group-webvpn configuration mode. To remove the string so that the remote user does not receive a message, use the no form of this command.
deny-message value string
no deny-message value
Syntax Description
string
Allows up to 491 alphanumeric characters, including special characters, spaces, and punctuation.
Defaults
The default deny message is: "Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information."
Command Modes
The following table shows the modes in which you can enter the command:
Group-webvpn configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.1(1)
This command moved from tunnel-group webvpn configuration mode to group-webvpn configuration mode.
Usage Guidelines
Before entering this command, you must enter the group-policy name attributes command in global configuration mode, then the webvpn command. (This step assumes you already have created the policy name.)
The no deny-message none command removes the attribute from the group-webvpn configuration. The policy inherits the attribute value.
When typing the string in the deny-message value command, continue typing even if the command wraps.
The text appears on the remote user's browser upon login, independent of the tunnel policy used for the VPN session.
Examples
The following example shows the first command that creates an internal group policy named group2. The subsequent commands modify the deny message associated with that policy:
hostname(config)# group-policy group2 internalhostname(config)# group-policy group2 attributeshostname(config-group-policy)# webvpnhostname(config-group-webvpn)# deny-message value "Your login credentials are OK. However, you have not been granted rights to use the VPN features. Contact your administrator for more information."hostname(config-group-webvpn)Related Commands
deny version
To deny a specific version of SNMP traffic, use the deny version command in snmp-map configuration mode. To disable this command, use the no form of this command.
deny version version
no deny version version
Syntax Description
version
Specifies the version of SNMP traffic that the ASA drops. The permitted values are 1, 2, 2c, and 3.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Snmp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the deny version command to restrict SNMP traffic to specific versions of SNMP. Earlier versions of SNMP were less secure, so restricting SNMP traffic to Version 2 may be specified by your security policy. You use the deny version command within an SNMP map, which you configure using the snmp-map command, which is accessible by entering the snmp-map command in global configuration mode. After creating the SNMP map, you enable the map using the inspect snmp command, and then apply it to one or more interfaces using the service-policy command.
Examples
The following example shows how to identify SNMP traffic, define a SNMP map, define a policy, and apply the policy to the outside interface:
hostname(config)# access-list snmp-acl permit tcp any any eq 161hostname(config)# access-list snmp-acl permit tcp any any eq 162hostname(config)# class-map snmp-porthostname(config-cmap)# match access-list snmp-aclhostname(config-cmap)# exithostname(config)# snmp-map inbound_snmphostname(config-snmp-map)# deny version 1hostname(config-snmp-map)# exithostname(config)# policy-map inbound_policyhostname(config-pmap)# class snmp-porthostname(config-pmap-c)# inspect snmp inbound_snmphostname(config-pmap-c)# exithostname(config-pmap)# exithostname(config)# service-policy inbound_policy interface outsideRelated Commands
description
To add a description for a named configuration unit (for example, for a context or for an object group, or for a DAP record), use the description command in various configuration modes. To remove the description, use the no form of this command.
description text
no description
Syntax Description
Defaults
No default behavior or values.
Command Modes
This command is available in various configuration modes.
Command History
7.0(1)
This command was introduced.
8.0(2)
Support was added for the dynamic-access-policy-record configuration mode.
Examples
The following example adds a description to the "Administration" context configuration:
hostname(config)# context administratorhostname(config-context)# description This is the admin context.hostname(config-context)# allocate-interface gigabitethernet0/0.1hostname(config-context)#allocate-interface gigabitethernet0/1.1hostname(config-context)#config-url flash://admin.cfgRelated Commands
dhcp client route distance
To configure an administrative distance for routes learned through DHCP, use the dhcp client route distance command in interface configuration mode. To restore the default setting, use the no form of this command.
dhcp client route distance distance
no dhcp client route distance distance
Syntax Description
distance
The administrative distance to apply to routes learned through DHCP. Valid values are from 1 to 255.
Defaults
Routes learned through DHCP are given an administrative distance of 1 by default.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
The dhcp client route distance command is checked only when a route is learned from DHCP. If the dhcp client route distance command is entered after a route is learned from DHCP, the administrative distance specified does not affect the existing learned route. Only routes learned after the command was entered have the specified administrative distance.
You must specify the setroute option in the ip address dhcp command to obtain routes through DHCP.
If DHCP is configured on multiple interfaces, you must use the dhcp client route distance command on each of the interfaces to indicate the priority of the installed routes.
Examples
The following example obtains the default route through DHCP on GigabitEhternet0/2. The route is tracked by tracking entry object 1. The SLA operation monitors the availability of the 10.1.1.1 gateway off of the outside interface. If the SLA operation fails, then the backup route obtained through DHCP on GigabitEthernet0/3 is used. The backup route is assigned an administrative distance of 254.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# timeout 1000hostname(config-sla-monitor-echo)# frequency 3hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityhostname(config)# interface GigabitEthernet0/2hostname(config-if)# dhcp client route track 1hostname(config-if)# ip address dhcp setroutehostname(config)# interface GigabitEthernet0/3hostname(config-if)# dhcp client route track 1hostname(config-if)# dhcp client route distance 254hostname(config-if)# ip address dhcp setrouteRelated Commands
dhcp client route track
To configure the DHCP client to associate added routes with a specified tracked object number, use the dhcp client route track command in interface configuration mode. To disable DHCP client route tracking, use the no form of this command.
dhcp client route track number
no dhcp client route track
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
The dhcp client route track command is checked only when a route is learned from DHCP. If the dhcp client route track command is entered after a route is learned from DHCP, the existing learned routes are not associated with a tracking object. You must put the following two commands in the correct order. Make sure that you always enter the dhcp client route track command first, followed by the ip address dhcp setroute command, If you have already entered the ip address dhcp setroute command, then remove it and reenter it in the order previously described. Only routes learned after the command was entered are associated with the specified tracking object.
You must specify the setroute option in the ip address dhcp command to obtain routes through DHCP.
If DHCP is configured on multiple interfaces, you must use the dhcp client route distance command on each of the interfaces to indicate the priority of the installed routes.
Examples
The following example obtains the default route through DHCP on GigabitEhternet0/2. The route is tracked by tracking entry object 1. The SLA operation monitors the availability of the 10.1.1.1 gateway off of the outside interface. If the SLA operation fails, then the backup route obtained through DHCP on GigabitEthernet0/3 is used. The backup route is assigned an administrative distance of 254.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# timeout 1000hostname(config-sla-monitor-echo)# frequency 3hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityhostname(config)# interface GigabitEthernet0/2hostname(config-if)# dhcp client route track 1hostname(config-if)# ip address dhcp setroutehostname(config)# interface GigabitEthernet0/3hostname(config-if)# dhcp client route distance 254hostname(config-if)# ip address dhcp setrouteRelated Commands
dhcp-client broadcast-flag
To allow the ASA to set the broadcast flag in the DHCP client packet, use the dhcp-client broadcast-flag command in global configuration mode. To disallow the broadcast flag, use the no form of this command.
dhcp-client broadcast-flag
no dhcp-client broadcast-flag
Syntax Description
This command has no arguments or keywords.
Defaults
By default, the broadcast flag is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you enable the DHCP client for an interface using the ip address dhcp command, then you can use this command to set the broadcast flag to 1 in the DHCP packet header when the DHCP client sends a discover requesting an IP address. The DHCP server listens to this broadcast flag and broadcasts the reply packet if the flag is set to 1.
If you enter the no dhcp-client broadcast-flag command, the broadcast flag is set to 0, and the DHCP server unicasts the reply packets to the client with the offered IP address.
The DHCP client can receive both broadcast and unicast offers from the DHCP server.
Examples
The following example enables the broadcast flag:
hostname(config)# dhcp-client broadcast-flagRelated Commands
dhcp-client client-id
To force a MAC address to be stored inside a DHCP request packet for option 61 instead of the default internally generated string, use the dhcp-client client-id command in global configuration mode. To disallow the MAC address, use the no form of this command.
dhcp-client client-id interface interface_name
no dhcp-client client-id interface interface_name
Syntax Description
interface interface_name
Specifies the interface on which you want to enable the MAC address for option 61.
Defaults
By default, an internally-generated ASCII string is used for option 61.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you enable the DHCP client for an interface using the ip address dhcp command, some ISPs expect option 61 to be the interface MAC address. If the MAC address is not included in the DHCP request packet, then an IP address will not be assigned. Use the dhcp-client client-id command to include the interface MAC address for option 61.
Examples
The following example enables the MAC address for option 61 for the outside interface:
hostname(config)# dhcp-client client-id interface outsideRelated Commands
dhcp-client update dns
To configure the update parameters that the DHCP client passes to the DHCP server, use the dhcp-client update dns command in global configuration mode. To remove the parameters that the DHCP client passes to the DHCP server, use the no form of this command.
dhcp-client update dns [server {both | none}]
no dhcp-client update dns [server {both | none}]
Syntax Description
Defaults
By default, the ASA requests that the DHCP server perform PTR RR updates only. The client does not send the FQDN option to the server.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Command History
Usage Guidelines
This command can also be entered in interface configuration mode, but it is not hyphenated. See the dhcp client update dns command. When entered in interface mode, the dhcp client update dns command overrides settings configured by this command in global configuration mode.
Examples
The following example configures the client to request that the DHCP server update neither the A and the PTR RRs:
hostname(config)# dhcp-client update dns server noneThe following example configures the client to request that the server update both the A and PTR RRs:
hostname(config)# dhcp-client update dns server both
Related Commands
dhcp-network-scope
To specify the range of IP addresses the ASA DHCP server should use to assign addresses to users of this group policy, use the dhcp-network-scope command in group-policy configuration mode. To remove the attribute from the running configuration, use the no form of this command.
dhcp-network-scope {ip_address} | none
no dhcp-network-scope
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
This command allows inheritance of a value from another group policy. To prevent inheriting a value, use the dhcp-network-scope none command.
Examples
The following example shows how to set an IP subnetwork of 10.10.85.1 for the group policy named First Group:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# dhcp-network-scope 10.10.85.1dhcp-server
To configure support for DHCP servers that assign IP addresses to clients as a VPN tunnel is established, use the dhcp-server command in tunnel-group general-attributes configuration mode. To return this command to the default, use the no form of this command.
dhcp-server [link-selection | subnet-selection] ip1 [ip2-ip10]
[no] dhcp-server [link-selection | subnet-selection] ip1 [ip2-ip10]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general attributes configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
8.0(5)
Added the link-selection and subnet-selection keywords.
Usage Guidelines
You can apply this attribute to remote access tunnel group types only.
Examples
The following command, entered in config-general configuration mode, adds three DHCP servers (dhcp1, dhcp2, and dhcp3) to the IPsec remote access tunnel group "remotegrp":
hostname(config)# tunnel-group remotegrp type remote-accesshostname(config)# tunnel-group remotegrp generalhostname(config-tunnel-general)# default-group-policy remotegrphostname(config-tunnel-general)# dhcp-server dhcp1 dhcp2 dhcp3hostname(config-tunnel-general)Related Commands