-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
isakmp am-disable through issuer-name Commands
isakmp am-disable through issuer-name Commands
isakmp am-disable
To disable inbound aggressive mode connections, use the isakmp am-disable command in global configuration mode. To enable inbound aggressive mode connections, use the no form of this command.
isakmp am-disable
no isakmp am-disable
Syntax Description
This command has no arguments or keywords.
Defaults
The default value is enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp am-disable command replaced it.
Examples
The following example, entered in global configuration mode, disables inbound aggressive mode connections:
hostname(config)# isakmp am-disableRelated Commands
isakmp disconnect-notify
To enable disconnect notification to peers, use the isakmp disconnect-notify command in global configuration mode. To disable disconnect notification, use the no form of this command.
isakmp disconnect-notify
no isakmp disconnect-notify
Syntax Description
This command has no arguments or keywords.
Defaults
The default value is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp disconnect-notify command replaced it.
Examples
The following example, entered in global configuration mode, enables disconnect notification to peers:
hostname(config)# isakmp disconnect-notifyRelated Commands
isakmp enable
To enable ISAKMP negotiation on the interface on which the IPsec peer communicates with the ASA, use the isakmp enable command in global configuration mode. To disable ISAKMP on the interface, use the no form of this command.
isakmp enable interface-name
no isakmp enable interface-name
Syntax Description
interface-name
Specifies the name of the interface on which to enable or disable ISAKMP negotiation.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp enable command replaced it.
Examples
The following example, entered in global configuration mode, shows how to disable ISAKMP on the inside interface:
hostname(config)# no isakmp enable insideRelated Commands
isakmp identity
To set the Phase 2 ID to be sent to the peer, use the isakmp identity command in global configuration mode. To return to the default setting, use the no form of this command.
isakmp identity {address | hostname | key-id key-id-string | auto}
no isakmp identity {address | hostname | key-id key-id-string | auto}
Syntax Description
Defaults
The default ISAKMP identity is the isakmp identity hostname command.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp identity command replaced it.
Examples
The following example, entered in global configuration mode, enables ISAKMP negotiation on the interface for communicating with the IPsec peer, depending on connection type:
hostname(config)# isakmp identity autoRelated Commands
isakmp ipsec-over-tcp
To enable IPsec over TCP, use the isakmp ipsec-over-tcp command in global configuration mode. To disable IPsec over TCP, use the no form of this command.
isakmp ipsec-over-tcp [port port1...port10]
no isakmp ipsec-over-tcp [port port1...port10]
Syntax Description
Defaults
The default value is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp ipsec-over-tcp command replaces it.
Examples
This example, entered in global configuration mode, enables IPsec over TCP on port 45:
hostname(config)# isakmp ipsec-over-tcp port 45Related Commands
isakmp keepalive
To configure IKE keepalives, use the isakmp keepalive command in tunnel-group ipsec-attributes configuration mode. To return the keepalive parameters to enabled with default threshold and retry values, use the no form of this command.
isakmp keepalive [threshold seconds | infinite] [retry seconds] [disable]
no isakmp keepalive disable [threshold seconds | infinite] [retry seconds] [disable]
Syntax Description
Defaults
The default for a remote access group is a threshold of 300 seconds and a retry of 2 seconds.
For a LAN-to-LAN group, the default is a threshold of 10 seconds and a retry of 2 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group ipsec-attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
In every tunnel group, IKE keepalives are enabled by default with default threshold and retry values. You can apply this attribute only to IPsec remote access and IPsec LAN-to-LAN tunnel group types.
Examples
The following example entered in tunnel-group ipsec-attributes configuration mode, configures IKE DPD, establishes a threshold of 15, and specifies a retry interval of 10 for the IPsec LAN-to-LAN tunnel group with the IP address 209.165.200.225:
hostname(config)# tunnel-group 209.165.200.225 type IPSec_L2Lhostname(config)# tunnel-group 209.165.200.225 ipsec-attributeshostname(config-tunnel-ipsec)# isakmp keepalive threshold 15 retry 10hostname(config-tunnel-ipsec)#Related Commands
isakmp nat-traversal
To enable NAT traversal globally, check that ISAKMP is enabled (you can enable it with the isakmp enable command) in global configuration mode and then use the isakmp nat-traversal command. If you have enabled NAT traversal, you can disable it with the no form of this command.
isakmp nat-traversal natkeepalive
no isakmp nat-traversal natkeepalive
Syntax Description
Defaults
By default, NAT traversal (isakmp nat-traversal command) is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp nat-traversal command replaced it.
Usage Guidelines
Network Address Translation (NAT), including Port Address Translation (PAT), is used in many networks where IPsec is also used, but there are a number of incompatibilities that prevent IPsec packets from successfully traversing NAT devices. NAT traversal enables ESP packets to pass through one or more NAT devices.
The ASA supports NAT traversal as described by Version 2 and Version 3 of the IETF "UDP Encapsulation of IPsec Packets" draft, available at http://www.ietf.org/html.charters/ipsec-charter.html, and NAT traversal is supported for both dynamic and static crypto maps.
This command enables NAT-T globally on the ASA. To disable in a crypto-map entry, use the crypto map set nat-t-disable command.
Examples
The following example, entered in global configuration mode, enables ISAKMP and then enables NAT traversal with an interval of 30 seconds:
hostname(config)# isakmp enablehostname(config)# isakmp nat-traversal 30Related Commands
isakmp policy authentication
To specify an authentication method within an IKE policy, use the isakmp policy authentication command in global configuration mode. To remove the ISAKMP authentication method, use the clear configure command.
isakmp policy priority authentication {crack | pre-share | rsa-sig}
Syntax Description
Defaults
The default ISAKMP policy authentication is the pre-share option.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
IKE policies define a set of parameters for IKE negotiation. If you specify RSA signatures, you must configure the ASA and its peer to obtain certificates from a certification authority (CA). If you specify preshared keys, you must separately configure these preshared keys within the ASA and its peer.
Examples
The following example, entered in global configuration mode, sets the authentication method of RSA signatures to be used within the IKE policy with the priority number of 40:
hostname(config)# isakmp policy 40 authentication rsa-sigRelated Commands
isakmp policy encryption
To specify the encryption algorithm to use within an IKE policy, use the isakmp policy encryption command in global configuration mode. To reset the encryption algorithm to the default value, use the no form of this command.
isakmp policy priority encryption {aes | aes-192| aes-256 | des | 3des}
no isakmp policy priority encryption {aes | aes-192| aes-256 | des | 3des}
Syntax Description
Defaults
The default ISAKMP policy encryption is 3des.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp policy encryption command replaced it.
Examples
The following example, entered in global configuration mode, sets 128-bit key AES encryption as the algorithm to be used within the IKE policy with the priority number of 25:
hostname(config)# isakmp policy 25 encryption aesThe following example, entered in global configuration mode, sets the 3DES algorithm to be used within the IKE policy with the priority number of 40:
hostname(config)# isakmp policy 40 encryption 3deshostname(config)#Related Commands
isakmp policy group
To specify the Diffie-Hellman group for an IKE policy, use the isakmp policy group command in global configuration mode.To reset the Diffie-Hellman group identifier to the default value, use the no form of this command.
isakmp policy priority group {1 | 2 | 5}
no isakmp policy priority group
Syntax Description
Defaults
The default is group 2.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
IKE policies define a set of parameters to use during IKE negotiation.
There are three group options: 768-bit (DH Group 1), 1024-bit (DH Group 2), and 1536-bit (DH Group 5). The 1024-bit and 1536-bit Diffie-Hellman Groups provide stronger security, but require more CPU time to execute.
Note
AES support is available on ASAs licensed for VPN-3DES only. Due to the large key sizes provided by AES, ISAKMP negotiation should use Diffie-Hellman (DH) group 5 instead of group 1 or group 2. This is done with the isakmp policy priority group 5 command.
Examples
The following example, entered in global configuration mode, sets group 2, the 1024-bit Diffie Hellman, to use for the IKE policy with the priority number of 40:
hostname(config)# isakmp policy 40 group 2Related Commands
isakmp policy hash
To specify the hash algorithm for an IKE policy, use the isakmp policy hash command in global configuration mode.To reset the hash algorithm to the default value of SHA-1, use the no form of this command.
isakmp policy priority hash {md5 | sha}
no isakmp policy priority hash
Syntax Description
Defaults
The default hash algorithm is SHA-1.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp policy hash command replaces it.
Usage Guidelines
IKE policies define a set of parameters to be used during IKE negotiation.
There are two hash algorithm options: SHA-1 and MD5. MD5 has a smaller digest and is considered to be slightly faster than SHA-1.
Examples
The following example, entered in global configuration mode, specifies that the MD5 hash algorithm be used within the IKE policy, with the priority number of 40:
hostname(config)# isakmp policy 40 hash md5Related Commands
isakmp policy lifetime
To specify the lifetime of an IKE security association before it expires, use the isakmp policy lifetime command in global configuration mode. To reset the security association lifetime to the default value of 86,400 seconds (one day), use the no form of this command .
isakmp policy priority lifetime seconds
no isakmp policy priority lifetime
Syntax Description
Defaults
The default value is 86,400 seconds (one day).
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp policy lifetime command replaced it.
Usage Guidelines
When IKE begins negotiations, it seeks to agree upon the security parameters for its own session. Then the security association at each peer refers to the agreed-upon parameters. The peers retain the security association until the lifetime expires. Before a security association expires, subsequent IKE negotiations can use it, which can save time when setting up new IPsec security associations. The peers negotiate new security associations before current security associations expire.
With longer lifetimes, the ASA sets up future IPsec security associations more quickly. Encryption strength is great enough to ensure security without using very fast rekey times, on the order of every few minutes. We recommend that you accept the default, but you can specify an infinite lifetime if the peer does not propose a lifetime.
Note
Examples
The following example, entered in global configuration mode, sets the lifetime of the IKE security association to 50,4000 seconds (14 hours) within the IKE policy with the priority number of 40:
hostname(config)# isakmp policy 40 lifetime 50400The following example, entered in global configuration mode, sets the IKE security association to an infinite lifetime.
hostname(config)# isakmp policy 40 lifetime 0Related Commands
isakmp reload-wait
To enable waiting for all active sessions to voluntarily terminate before rebooting the ASA, use the isakmp reload-wait command in global configuration mode. To disable waiting for active sessions to terminate and to proceed with a reboot of the ASA, use the no form of this command.
isakmp reload-wait
no isakmp reload-wait
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
This command was deprecated. The crypto isakmp reload-wait command replaced it.
Examples
The following example, entered in global configuration mode, tells the ASA to wait until all active sessions have terminated before rebooting:
hostname(config)# isakmp reload-waitRelated Commands
issuer
To specify the security device that is sending assertions to a SAML-type SSO server, use the issuer command in webvpn-sso-saml configuration mode for that specific SAML type. To remove the issuer name, use the no form of this command.
issuer identifier
no issuer [identifier]
Syntax Description
identifier
Specifies a security device name, usually the hostname of the device. An identifier must be less than 65 alphanumeric characters.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn-sso-saml configuration
•
—
•
—
—
Command History
Usage Guidelines
SSO support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The ASA currently supports the SAML POST-type SSO server and the SiteMinder-type of SSO server.
This command applies only to SAML-type SSO Servers.
Examples
The following example specifies the issuer name for a security device named asa1.example.com:
hostname(config-webvpn)# sso server myhostname type saml-v1.1-posthostname(config-webvpn-sso-saml# issuer asa1.example.comhostname(config-webvpn-sso-saml#Related Commands
issuer-name
To specify the issuer name DN of all issued certificates, use the issuer-name command in local certificate authority (CA) server configuration mode. To remove the subject DN from the certificate authority certificate, use the no form of this command.
issuer-name DN-string
no issuer-name DN-string
Syntax Description
Defaults
The default issuer name is cn=hostame.domain-name, for example cn=asa.example.com.
Command Modes
The following table shows the modes in which you can enter the command:
Ca server configuration
•
—
•
—
—
Command History
7.3(1)
This command was introduced.
8.0(2)
Support for quotation marks was added to retain commas in DN-string values.
Usage Guidelines
This command specifies the issuer name that appears on any certificate created by the local CA server. Use this optional command if you want the issuer name to be different from the default CA name.
Note
Examples
The following example configures certificate authentication:
hostname(config)# crypto ca serverhostname(config-ca-server)# issuer-name cn=asa-ca.example.com,ou=Eng,o=Example,c="cisco systems, inc."hostname(config-ca-server)#Related Commands
