-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
match regex through message-length Commands
match third-party-registration
memory delayed-free-poisoner enable
memory delayed-free-poisoner validate
match regex through message-length Commands
match regex
To identify a regular expression in a regular expression class map, use the match regex command in class-map type regex configuration mode. To remove the regular expression from the class map, use the no form of this command.
match regex name
no match regex name
Syntax Description
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map type regex configuration
•
•
•
—
•
Command History
Usage Guidelines
The regex command can be used for various features that require text matching. You can group regular expressions in a regular expression class map using the class-map type regex command and then multiple match regex commands.
For example, you can configure special actions for application inspection using an inspection policy map (see the policy map type inspect command). In the inspection policy map, you can identify the traffic you want to act upon by creating an inspection class map containing one or more match commands or you can use match commands directly in the inspection policy map. Some match commands let you identify text in a packet using a regular expression; for example, you can match URL strings inside HTTP packets.
Examples
The following is an example of an HTTP inspection policy map and the related class maps. This policy map is activated by the Layer 3/4 policy map, which is enabled by the service policy.
hostname(config)# regex url_example example\.comhostname(config)# regex url_example2 example2\.comhostname(config)# class-map type regex match-any URLshostname(config-cmap)# match regex url_examplehostname(config-cmap)# match regex url_example2hostname(config-cmap)# class-map type inspect http match-all http-traffichostname(config-cmap)# match req-resp content-type mismatchhostname(config-cmap)# match request body length gt 1000hostname(config-cmap)# match not request uri regex class URLshostname(config-cmap)# policy-map type inspect http http-map1hostname(config-pmap)# class http-traffichostname(config-pmap-c)# drop-connection loghostname(config-pmap-c)# match req-resp content-type mismatchhostname(config-pmap-c)# reset loghostname(config-pmap-c)# parametershostname(config-pmap-p)# protocol-violation action loghostname(config-pmap-p)# policy-map testhostname(config-pmap)# class test [a Layer 3/4 class map not shown]hostname(config-pmap-c)# inspect http http-map1hostname(config-pmap-c)# service-policy test interface outsideRelated Commands
class-map type regex
Creates a regular expression class map.
regex
Adds a regular expression.
test regex
Tests a regular expression.
match req-resp
To configure a match condition for both HTTP requests and responses, use the match req-resp command in policy-map configuration mode. To disable this feature, use the no form of this command.
match [not] req-resp content-type mismatch
no match [not] req-resp content-type mismatch
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command enables the following checks:
•
•
•
If the message fails any of the above checks, the ASA takes the configured action.
The following is the list of supported content types.
Some content-types in this list may not have a corresponding regular expression (magic number) so they cannot be verified in the body portion of the message. When this case occurs, the HTTP message will be allowed.
Examples
The following example shows how to restrict HTTP traffic based on the content type of the HTTP message in an HTTP policy map:
hostname(config)#policy-map type inspect http http_maphostname(config-pmap)#match req-resp content-type mismatchRelated Commands
match request-command
To restrict specific FTP commands, use the match request-command command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.
match [not] request-command ftp_command [ftp_command...]
no match [not] request-command ftp_command [ftp_command...]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in an FTP class map or policy map. Only one entry can be entered in a FTP class map.
Examples
The following example shows how to configure a match condition for a specific FTP command in an FTP inspection policy map:
hostname(config)# policy-map type inspect ftp ftp_map1hostname(config-pmap)# match request-command stouRelated Commands
match request-method
To configure a match condition for the SIP method type, use the match request-method command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.
match [not] request-method method_type
no match [not] request-method method_type
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in a SIP class map or policy map. Only one entry can be entered in a SIP class map.
Examples
The following example shows how to configure a match condition for the path taken by a SIP message in a SIP inspection class map:
hostname(config-cmap)# match request-method ackRelated Commands
match request method
To configure a match condition for HTTP requests, use the match request method command in policy-map configuration mode. To disable this feature, use the no form of this command.
match [not] request {built-in-regex | regex {regex_name | class class_map_name}}
no match [not] request {built-in-regex | regex {regex_name | class class_map_name}}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
Examples
The following example shows how to define an HTTP inspection policy map that will allow and log any HTTP connection that attempts to access "www\.example.com/.*\.asp" or "www\example[0-9][0-9]\.com" with methods "GET" or "PUT." All other URL/Method combinations will be silently allowed:
hostname(config)# regex url1 "www\.example.com/.*\.asphostname(config)# regex url2 "www\.example[0-9][0-9]\.com"hostname(config)# regex get "GET"hostname(config)# regex put "PUT"hostname(config)# class-map type regex match-any url_to_loghostname(config-cmap)# match regex url1hostname(config-cmap)# match regex url2hostname(config-cmap)# exithostname(config)# class-map type regex match-any methods_to_loghostname(config-cmap)# match regex gethostname(config-cmap)# match regex puthostname(config-cmap)# exithostname(config)# class-map type inspect http http_url_policyhostname(config-cmap)# match request uri regex class url_to_loghostname(config-cmap)# match request method regex class methods_to_loghostname(config-cmap)# exithostname(config)# policy-map type inspect http http_policyhostname(config-pmap)# class http_url_policyhostname(config-pmap-c)# logRelated Commands
match route-type
To redistribute routes of the specified type, use the match route-type command in route-map configuration mode. To remove the route type entry, use the no form of this command.
match route-type {local | internal | {external [type-1 | type-2]} | {nssa-external [type-1 | type-2]}}
no match route-type {local | internal | {external [type-1 | type-2]} | {nssa-external [type-1 | type-2]}}
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
•
—
Command History
Usage Guidelines
The route-map global configuration command and the match and set configuration commands allow you to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has match and set commands that are associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria that is enforced by the match commands are met. The no route-map command deletes the route map.
The match route-map configuration command has multiple formats. You can enter the match commands in any order. All match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.
A route map can have several parts. Any route that does not match at least one match clause relating to a route-map command is ignored. To modify only some data, you must configure a second route map section and specify an explicit match.
For OSPF, the external type-1 keywords match only type 1 external routes and the external type-2 keywords match only type 2 external routes.
Examples
The following example shows how to redistribute internal routes:
hostname(config)# route-map namehostname(config-route-map)# match route-type internalRelated Commands
match rtp
To specify a UDP port range of even-number ports in a class map, use the match rtp command in class-map configuration mode. To remove this specification, use the no form of this command.
match rtp starting_port range
no match rtp starting_port range
Syntax Description
starting_port
Specifies lower bound of even-number UDP destination port. Range is 2000-65535
range
Specifies range of RTP ports. Range is 0-16383.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The match commands are used to identify the traffic included in the traffic class for a class map. They include different criteria to define the traffic included in a class-map. Define a traffic class using the class-map global configuration command as part of configuring a security feature using Modular Policy Framework. From class-map configuration mode, you can define the traffic to include in the class using the match command.
After a traffic class is applied to an interface, packets received on that interface are compared to the criteria defined by the match statements in the class map. If the packet matches the specified criteria, it is included in the traffic class and is subjected to any actions associated with that traffic class. Packets that do not match any of the criteria in any traffic class are assigned to the default traffic class.
Use the match rtp command to match RTP ports (even UDP port numbers between the starting_port and the starting_port plus the range).
Examples
The following example shows how to define a traffic class using a class map and the match rtp command:
hostname(config)# class-map cmaphostname(config-cmap)# match rtp 20000 100hostname(config-cmap)#Related Commands
match sender-address
To configure a match condition on the ESMTP sender e-mail address, use the match sender-address command in policy-map configuration mode. To disable this feature, use the no form of this command.
match [not] sender-address [length gt bytes | regex regex]
no match [not] sender-address [length gt bytes | regex regex]
Syntax Description
length gt bytes
Specifies to match on the sender e-mail address length.
regex regex
Specifies to match on the regular expression.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Policy map configuration
•
•
•
•
—
Command History
Examples
The following example shows how to configure a match condition for the sender email address of length greater than 320 characters in an ESMTP inspection policy map:
hostname(config-pmap)# match sender-address length gt 320Related Commands
match server
To configure a match condition for an FTP server, use the match server command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.
match [not] server regex [regex_name | class regex_class_name]
no match [not] server regex [regex_name | class regex_class_name]
Syntax Description
regex_name
Specifies a regular expression.
class regex_class_name
Specifies a regular expression class map.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in an FTP class map or policy map. Only one entry can be entered in a FTP class map.
The ASA matches the server name based using the initial 220 server message that is displayed above the login prompt when connecting to an FTP server. The 220 server message might contain multiple lines. The server match is not based on the FQDN of the server name resolved through DNS.
Examples
The following example shows how to configure a match condition for an FTP server in an FTP inspection policy map:
hostname(config-pmap)# match server class regex ftp-serverRelated Commands
match service
To configure a match condition for a specific instant messaging service, use the match service command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.
match [not] service {chat | file-transfer | games | voice-chat | webcam | conference}
no match [not] service {chat | file-transfer | games | voice-chat | webcam | conference}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in an IM class map or policy map. Only one entry can be entered in a IM class map.
Examples
The following example shows how to configure a match condition for the chat service in an instant messaging class map:
hostname(config)# class-map type inspect im im_classhostname(config-cmap)# match service chatRelated Commands
match third-party-registration
To configure a match condition for the requester of a third-party registration, use the match third-party-registration command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.
match [not] third-party-registration regex [regex_name | class regex_class_name]
no match [not] third-party-registration regex [regex_name | class regex_class_name]
Syntax Description
regex_name
Specifies a regular expression.
class regex_class_name
Specifies a regular expression class map.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in a SIP class map or policy map. Only one entry can be entered in a SIP class map.
The third-party registration match command is used to identify the user who can register others with a SIP registar or SIP proxy. It is identified by the From header field in the REGISTER message in the case of mismatching From and To values.
Examples
The following example shows how to configure a match condition for third-party registration in a SIP inspection class map:
hostname(config-cmap)# match third-party-registration regex class sip_registRelated Commands
match tunnel-group
To match traffic in a class map that belongs to a previously defined tunnel-group, use the match tunnel-group command in class-map configuration mode. To remove this specification, use the no form of this command.
match tunnel-group name
no match tunnel-group name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The match commands are used to identify the traffic included in the traffic class for a class map. They include different criteria to define the traffic included in a class-map. Define a traffic class using the class-map global configuration command as part of configuring a security feature using Modular Policy Framework. From class-map configuration mode, you can define the traffic to include in the class using the match command.
After a traffic class is applied to an interface, packets received on that interface are compared to the criteria defined by the match statements in the class map. If the packet matches the specified criteria, it is included in the traffic class and is subjected to any actions associated with that traffic class. Packets that do not match any of the criteria in any traffic class are assigned to the default traffic class.
To enable flow-based policy actions, use the match flow ip destination-address and match tunnel-group commands with the class-map, policy-map, and service-policy commands. The criteria to define flow is the destination IP address. All traffic going to a unique IP destination address is considered a flow. Policy action is applied to each flow instead of the entire class of traffic. QoS action police is applied using the police command. Use match tunnel-group along with match flow ip destination-address to police every tunnel within a tunnel group to a specified rate.
Examples
The following example shows how to enable flow-based policing within a tunnel group and limit each tunnel to a specified rate:
hostname(config)# class-map cmaphostname(config-cmap)# match tunnel-grouphostname(config-cmap)# match flow ip destination-addresshostname(config-cmap)# exithostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# police 56000hostname(config-pmap)# exithostname(config)# service-policy pmap globalRelated Commands
match uri
To configure a match condition for the URI in the SIP headers, use the match uri command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.
match [not] uri {sip | tel} length gt gt_bytes
no match [not] uri {sip | tel} length gt gt_bytes
Syntax Description
sip
Specifies a SIP URI.
tel
Specifies a TEL URI.
length gt gt_bytes
Specifies the maximum length of the URI. Value is between 0 and 65536.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in a SIP class map or policy map. Only one entry can be entered in a SIP class map.
Examples
The following example shows how to configure a match condition for the URI in the SIP message:
hostname(config-cmap)# match uri sip length gtRelated Commands
match url-filter
To configure a match condition for URL filtering in an RTSP message, use the match url-filter command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.
match [not] url-filter regex [regex_name | class regex_class_name]
no match [not] url-filter regex [regex_name | class regex_class_name]
Syntax Description
regex_name
Specifies a regular expression.
class regex_class_name
Specifies a regular expression class map.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in an RTSP class map or policy map.
Examples
The following example shows how to configure a match condition for URL filtering in an RTSP inspection policy map:
hostname(config)# regex badurl www.example.com/rtsp.avihostname(config)# policy-map type inspect rtsp rtsp-maphostname(config-pmap)# match url-filter regex badurlhostname(config-pmap-p)# drop-connectionRelated Commands
match user group
To specifie a user or group to whitelist for Cloud Web Security, use the match user group command in parameters configuration mode. You can access the parameters onfiguration mode by first entering the class-map type inspect scansafe command. To remove the match, use the no form of this command.
match [not] {[user username] [group groupname]}
no match [not] {[user username] [group groupname]}
Syntax Description
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you use AAA rules or IDFW, you can configure the ASA so that web traffic from specific users or groups that otherwise match the service policy rule is not redirected to the Cloud Web Security proxy server for scanning. When you bypass Cloud Web Security scanning, the ASA retrieves the content directly from the originally requested web server without contacting the proxy server. When it receives the response from the web server, it sends the data to the client. This process is called "whitelisting" traffic.
Although you can achieve the same results of exempting traffic based on user or group when you configure the class of traffic using ACLs to send to Cloud Web Security, you might find it more straightforward to use a whitelist instead. Note that the whitelist feature is only based on user and group, not on IP address.
After creating the whitelist as part of the inspection policy map (policy-map type inspect scansafe), you can use this map when you specify the Cloud Web Security action using the inspect scansafe command.
Examples
The following example whitelists the same users and groups for the HTTP and HTTPS inspection policy maps:
hostname(config)# class-map type inspect scansafe match-any whitelist1hostname(config-cmap)# match user user1 group ciscohostname(config-cmap)# match user user2hostname(config-cmap)# match group group1hostname(config-cmap)# match user user3 group group3hostname(config)# policy-map type inspect scansafe cws_inspect_pmap1hostname(config-pmap)# parametershostname(config-pmap-p)# httphostname(config-pmap-p)# default group default_grouphostname(config-pmap-p)# class whitelist1hostname(config-pmap-c)# whitelisthostname(config)# policy-map type inspect scansafe cws_inspect_pmap2hostname(config-pmap)# parametershostname(config-pmap-p)# httpshostname(config-pmap-p)# default group2 default_group2hostname(config-pmap-p)# class whitelist1hostname(config-pmap-c)# whitelistRelated Commands
match username
To configure a match condition for an FTP username, use the match username command in class-map or policy-map configuration mode. To remove the match condtion, use the no form of this command.
match [not] username regex [regex_name | class regex_class_name]
no match [not] username regex [regex_name | class regex_class_name]
Syntax Description
regex_name
Specifies a regular expression.
class regex_class_name
Specifies a regular expression class map.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in an FTP class map or policy map. Only one entry can be entered in a FTP class map.
Examples
The following example shows how to configure a match condition for an FTP username in an FTP inspection class map:
hostname(config)# class-map type inspect ftp match-all ftp_class1hostname(config-cmap)# match username regex class ftp_regex_userRelated Commands
match version
To configure a match condition for a GTP message ID, use the match message length command in class-map or policy-map configuration mode. To remove the match condition, use the no form of this command.
match [not] version [version_id | range lower_range upper_range]
no match [not] version [version_id | range lower_range upper_range]
Syntax Description
vresion_id
Specifies a version between 0 and 255.
range lower_range upper_range
Specifies a lower and upper range of versions.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map or policy map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command can be configured in a GTP class map or policy map. Only one entry can be entered in a GTP class map.
Examples
The following example shows how to configure a match condition for a message version in a GTP inspection class map:
hostname(config-cmap)# match version 1Related Commands
max-failed-attempts
To specify the number of failed attempts allowed for any given server in the server group before that server is deactivated, use the max-failed-attempts command in aaa-server group configuration mode. To remove this specification and revert to the default value, use the no form of this command.
max-failed-attempts number
no max-failed-attempts
Syntax Description
number
An integer in the range of 1-5, specifying the number of failed connection attempts allowed for any given server in the server group specified in a previous aaa-server command.
Defaults
The default value of number is 3.
Command Modes
The following table shows the modes in which you can enter the command:
aaa-server group configuration
•
•
•
•
—
Command History
Usage Guidelines
You must have configured the AAA server or group before issuing this command.
Examples
hostname(config)#aaa-server svrgrp1 protocol tacacs+hostname(config-aaa-server-group)#max-failed-attempts 4hostname(config-aaa-server-group)#Related Commands
max-forwards-validation
To enable check on Max-forwards header field of 0, use the max-forwards-validation command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
max-forwards-validation action {drop | drop-connection | reset | log} [log}
no max-forwards-validation action {drop | drop-connection | reset | log} [log}
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Usage Guidelines
This command counts the number of hops to destination, which cannot be 0 before reaching the destination.
Examples
The following example shows how to enable max forwards validation in a SIP inspection policy map:
hostname(config)# policy-map type inspect sip sip_maphostname(config-pmap)# parametershostname(config-pmap-p)# max-forwards-validation action logRelated Commands
max-header-length
To restrict HTTP traffic based on the HTTP header length, use the max-header-length command in HTTP map configuration mode, which is accessible using the http-map command. To remove this command, use the no form of this command.
max-header-length {request bytes [response bytes] | response bytes} action {allow | reset | drop} [log]
no max-header-length {request bytes [response bytes] | response bytes} action {allow | reset | drop} [log]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
HTTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
After enabling the max-header-length command, the ASA only allows messages having an HTTP header within the configured limit and otherwise takes the specified action. Use the action keyword to cause the ASA to reset the TCP connection and optionally create a syslog entry.
Examples
The following example restricts HTTP requests to those with HTTP headers that do not exceed 100 bytes. If a header is too large, the ASA resets the TCP connection and creates a syslog entry.
hostname(config)# http-map inbound_httphostname(config-http-map)# max-header-length request bytes 100 action log resethostname(config-http-map)#Related Commands
max-object-size
To set a maximum size for objects that the ASA can cache for WebVPN sessions, use the max-object-size command in cache mode. To change the size, use the command again.
max-object-size integer range
Syntax Description
Defaults
1000 KB
Command Modes
The following table shows the modes in which you enter the command:
Cache mode
•
—
•
—
—
Command History
Usage Guidelines
The Maximum object size must be larger than the minimum object size. The ASA calculates the size after compressing the object, if cache compression is enabled.
Examples
The following example shows how to set a maximum object size of 4000 KB:
hostname(config)#webvpnhostname(config-webvpn)#cachehostname(config-webvpn-cache)# max-object-size 4000hostname(config-webvpn-cache)#Related Commands
max-retry-attempts
To configure the number of times the ASA retries a failed SSO authentication attempt before letting the request time out, use the max-retry-attempts command in the webvpn configuration mode for the specific SSO server type.
To return to the default value, use the no form of this command.
max-retry-attempts retries
no max-retry-attempts
Syntax Description
Syntax DescriptionSyntax Description
retries
The number of times the ASA retries a failed SSO authentication attempt. The range is 1 to 5 retries.
Defaults
The default value for this command is 3.
Command Modes
The following table shows the modes in which you can enter the command:
config-webvpn-sso-saml
•
—
•
—
—
config-webvpn-sso-siteminder
•
—
•
—
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The ASA currently supports the SiteMinder-type of SSO server and the SAML POST-type SSO server.
This command applies to both types of SSO Servers.
Once you have configured the ASA to support SSO authentication, optionally you can adjust two timeout parameters:
•
•
Examples
The following example, entered in webvpn-sso-siteminder configuration mode, configures four authentication retries for the SiteMinder SSO server named my-sso-server:
hostname(config-webvpn)# sso-server my-sso-server type siteminderhostname(config-webvpn-sso-siteminder)# max-retry-attempts 4hostname(config-webvpn-sso-siteminder)#Related Commands
max-uri-length
To restrict HTTP traffic based on the length of the URI in the HTTP request message, use the max-uri-length command in HTTP map configuration mode, which is accessible using the http-map command. To remove this command, use the no form of this command.
max-uri-length bytes action {allow | reset | drop} [log]
no max-uri-length bytes action {allow | reset | drop} [log]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
HTTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
After enabling the max-uri-length command, the ASA only allows messages having a URI within the configured limit and otherwise takes the specified action. Use the action keyword to cause the ASA to reset the TCP connection and create a syslog entry.
URIs with a length less than or equal to the configured value will be allowed. Otherwise, the specified action will be taken.
Examples
The following example restricts HTTP requests to those with URIs that do not exceed 100 bytes. If a URI is too large, the ASA resets the TCP connection and creates a syslog entry.
hostname(config)# http-map inbound_httphostname(config-http-map)# max-uri-length 100 action reset loghostname(config-http-map)#Related Commands
mcc
To identify the mobile country code and the mobile network code for IMSI prefix filtering, use the mcc command in GTP map configuration mode. To remove the configuration, use the no form of this command.
mcc country_code mnc network_code
no mcc country_code mnc network_code
Syntax Description
Defaults
By default, the ASA does not check for valid MCC/MNC combinations.
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is used for IMSI Prefix filtering. The MCC and MNC in the IMSI of the received packet is compared with the MCC/MNC configured with this command and is dropped if it does not match.
This command must be used to enable IMSI Prefix filtering. You can configure multiple instances to specify permitted MCC and MNC combinations. By default, the ASA does not check the validity of MNC and MCC combinations, so you must verify the validity of the combinations configured. To find more information about MCC and MNC codes, see the ITU E.212 recommendation, Identification Plan for Land Mobile Stations.
Examples
The following example identifies traffic for IMSI Prefix filtering with an MCC of 111 and an MNC of 222:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)# mcc 111 mnc 222hostname(config-gtpmap)#Related Commands
media-termination
To specify the media termination instance to use for media connections to the Phone Proxy feature, use the media-termination command in global configuration mode.
To remove the media-termination address from the Phone Proxy configuration, use the no form of this command.
media-termination instance_name
no media-termination instance_name
Syntax Description
instance_name
Specifies the name of the interface for which the media termination address is used. Only one media-termination address can be configured per interface.
Defaults
There are no default settings for this command.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The ASA must have IP addresses for media termination that meet the following criteria:
For the media termination instance, you can configure a global media-termination address for all interfaces or configure a media-termination address for different interfaces. However, you cannot use a global media-termination address and media-termination addresses configured for each interface at the same time.
If you configure a media termination address for multiple interfaces, you must configure an address on each interface that the ASA uses when communicating with IP phones.
The IP addresses are publicly routable addresses that are unused IP addresses within the address range on that interface.
See CLI configuration guide for the complete list of prerequisites that you must follow when creating the media termination instance and configuring the media termination addresses.
Examples
The following example shows the use of the media-termination address command to specify the IP address to use for media connections:
hostname(config-phone-proxy)# media-termination mta_instance1Related Commands
media-type
To set the media type to copper or fiber Gigabit Ethernet, use the media-type command in interface configuration mode. The fiber SFP connector is available on the 4GE SSM for the ASA 5500 series adaptive security appliance. To restore the media type setting to the default, use the no form of this command.
media-type {rj45 | sfp}
no media-type [rj45 | sfp]
Syntax Description
rj45
(Default) Sets the media type to the copper RJ-45 connector.
sfp
Sets the media type to the fiber SFP connector.
Defaults
The default is rj45.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
—
•
Command History
Usage Guidelines
The sfp setting uses a fixed speed (1000 Mbps), so the speed command allows you to set whether the interface negotiates link parameters or not. The duplex command is not supported for sfp.
Examples
The following example sets the media type to SFP:
hostname(config)# interface gigabitethernet1/1hostname(config-if)# media-type sfphostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownRelated Commands
member
To assign a context to a resource class, use the member command in context configuration mode. To remove the context from the class, use the no form of this command.
member class_name
no member class_name
Syntax Description
Defaults
By default, the context is assigned to the default class.
Command Modes
The following table shows the modes in which you can enter the command:
Context configuration
•
•
—
—
•
Command History
Usage Guidelines
By default, all security contexts have unlimited access to the resources of the ASA, except where maximum limits per context are enforced. However, if you find that one or more contexts use too many resources, and they cause other contexts to be denied connections, for example, then you can configure resource management to limit the use of resources per context. The ASA manages resources by assigning contexts to resource classes. Each context uses the resource limits set by the class.
Examples
The following example assigns the context test to the gold class:
hostname(config-ctx)# context testhostname(config-ctx)# allocate-interface gigabitethernet0/0.100 int1hostname(config-ctx)# allocate-interface gigabitethernet0/0.102 int2hostname(config-ctx)# allocate-interface gigabitethernet0/0.110-gigabitethernet0/0.115 int3-int8hostname(config-ctx)# config-url ftp://user1:passw0rd@10.1.1.1/configlets/test.cfghostname(config-ctx)# member goldRelated Commands
member-interface
To assign a physical interface to a redundant interface, use the member-interface command in interface configuration mode. This command is available only for the redundant interface type. You can assign two member interfaces to a redundant interface. To remove a member interface, use the no form of this command. You cannot remove both member interfaces from the redundant interface; the redundant interface requires at least one member interface.
member-interface physical_interface
no member-interface physical_interface
Syntax Description
physical_interface
Identifies the interface ID, such as gigabitethernet 0/1. See the interface command for accepted values. Both member interfaces must be the same physical type.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
—
•
Command History
Usage Guidelines
Both member interfaces must be of the same physical type. For example, both must be Ethernet.
You cannot add a physical interface to the redundant interface if you configured a name for it. You must first remove the name using the no nameif command.
Caution
The only configuration available to physical interfaces that are part of a redundant interface pair are physical parameters such as speed and duplex commands, the description command, and the shutdown command. You can also enter run-time commands like default and help.
If you shut down the active interface, then the standby interface becomes active.
To change the active interface, enter the redundant-interface command.
The redundant interface uses the MAC address of the first physical interface that you add. If you change the order of the member interfaces in the configuration, then the MAC address changes to match the MAC address of the interface that is now listed first. Alternatively, you can assign a MAC address to the redundant interface, which is used regardless of the member interface MAC addresses (see the mac-address command or the mac-address auto command). When the active interface fails over to the standby, the same MAC address is maintained so traffic is not disrupted.
Examples
The following example creates two redundant interfaces:
hostname(config)# interface redundant 1hostname(config-if)# member-interface gigabitethernet 0/0hostname(config-if)# member-interface gigabitethernet 0/1hostname(config-if)# interface redundant 2hostname(config-if)# member-interface gigabitethernet 0/2hostname(config-if)# member-interface gigabitethernet 0/3Related Commands
memberof
To specify a list of group-names that this user is a member of, use the memberof command in username attributes configuration mode. To remove this attribute from the configuration, use the no form of this command.
memberof group_1[,group_2,...group_n]
no memberof group_1[,group_2,...group_n]
Syntax Description
Defaults
No default behavior or value.
Command Modes
The following table shows the modes in which you can enter the command:
Username attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
Enter a comma-separated list of group names to which this user belongs.
Examples
The following example entered in global configuration mode, creates a username called newuser, then specifies that newuser is a member of the DevTest and management groups:
hostname(config)# username newuser nopasswordhostname(config)# username newuser attributeshostname(config-username)# memberof DevTest,managementhostname(config-username)#Related Commands
memory delayed-free-poisoner enable
To enable the delayed free-memory poisoner tool, use the memory delayed-free-poisoner enable command in privileged EXEC mode. To disable the delayed free-memory poisoner tool, use the no form of this command. The delayed free-memory poisoner tool lets you monitor freed memory for changes after it has been released by an application.
memory delayed-free-poisoner enable
no memory delayed-free-poisoner enable
Syntax Description
This command has no arguments or keywords.
Defaults
The memory delayed-free-poisoner enable command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Enabling the delayed free-memory poisoner tool has a significant impact on memory usage and system performance. The command should only be used under the supervision of the Cisco TAC. It should not be run in a production environment during heavy system usage.
When you enable this tool, requests to free memory by the applications running on the ASA are written to a FIFO queue. As each request is written to the queue, each associated byte of memory that is not required by lower-level memory management is "poisoned" by being written with the value 0xcc.
The freed memory requests remain in the queue until more memory is required by an application than is in the free memory pool. When memory is needed, the first freed memory request is pulled from the queue and the poisoned memory is validated.
If the memory is unmodified, it is returned to the lower-level memory pool and the tool reissues the memory request from the application that made the initial request. The process continues until enough memory for the requesting application is freed.
If the poisoned memory has been modified, then the system forces a crash and produces diagnostic output to determine the cause of the crash.
The delayed free-memory poisoner tool periodically performs validation on all of the elements of the queue automatically. Validation can also be started manually using the memory delayed-free-poisoner validate command.
The no form of the command causes all of the memory referenced by the requests in the queue to be returned to the free memory pool without validation and any statistical counters to be cleared.
Examples
The following example enables the delayed free-memory poisoner tool:
hostname# memory delayed-free-poisoner enableThe following is sample output when the delayed free-memory poisoner tool detects illegal memory reuse:
delayed-free-poisoner validate failed because adata signature is invalid at delayfree.c:328.heap region: 0x025b1cac-0x025b1d63 (184 bytes)memory address: 0x025b1cb4byte offset: 8allocated by: 0x0060b812freed by: 0x0060ae15Dumping 80 bytes of memory from 0x025b1c88 to 0x025b1cd7025b1c80: ef cd 1c a1 e1 00 00 00 | ........025b1c90: 23 01 1c a1 b8 00 00 00 15 ae 60 00 68 ba 5e 02 | #.........`.h.^.025b1ca0: 88 1f 5b 02 12 b8 60 00 00 00 00 00 6c 26 5b 02 | ..[...`.....l&[.025b1cb0: 8e a5 ea 10 ff ff ff ff cc cc cc cc cc cc cc cc | ................025b1cc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc | ................025b1cd0: cc cc cc cc cc cc cc cc | ........An internal error occurred. Specifically, a programming assertion wasviolated. Copy the error message exactly as it appears, and get theoutput of the show version command and the contents of the configurationfile. Then call your technical support representative.assertion "0" failed: file "delayfree.c", line 191Table 34-2 describes the significant portion of the output.
Related Commands
memory delayed-free-poisoner validate
To force validation of all elements in the memory delayed-free-poisoner queue, use the memory delayed-free-poisoner validate command in privileged EXEC mode.
memory delayed-free-poisoner validate
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
You must enable the delayed free-memory poisoner tool using the memory delayed-free-poisoner enable command before issuing the memory delayed-free-poisoner validate command.
The memory delayed-free-poisoner validate command causes each element of the memory delayed-free-poisoner queue to be validated. If an element contains unexpected values, then the system forces a crash and produces diagnostic output to determine the cause of the crash. If no unexpected values are encountered, the elements remain in the queue and are processed normally by the tool; the memory delayed-free-poisoner validate command does not cause the memory in the queue to be returned to the system memory pool.
Note
Examples
The following example causes all elements in the memory delayed-free-poisoner queue to be validated:
hostname# memory delayed-free-poisoner validateRelated Commands
memory caller-address
To configure a specific range of program memory for the call tracing, or caller PC, to help isolate memory problems, use the memory caller-address command in privileged EXEC mode. The caller PC is the address of the program that called a memory allocation primitive. To remove an address range, use the no form of this command.
memory caller-address startPC endPC
no memory caller-address
Syntax Description
endPC
Specifies the end address range of the memory block.
startPC
Specifies the start address range of the memory block.
Defaults
The actual caller PC is recorded for memory tracing.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the memory caller-address command to isolate memory problems to a specific block of memory.
In certain cases the actual caller PC of the memory allocation primitive is a known library function that is used at many places in the program. To isolate individual places in the program, configure the start and end program address of the library function, thereby recording the program address of the caller of the library function.
Note
Examples
The following examples show the address ranges configured with the memory caller-address commands, and the resulting display of the show memory-caller address command:hostname# memory caller-address 0x00109d5c 0x00109e08hostname# memory caller-address 0x009b0ef0 0x009b0f14hostname# memory caller-address 0x00cf211c 0x00cf4464hostname# show memory-caller addressMove down stack frame for the addresses:pc = 0x00109d5c-0x00109e08pc = 0x009b0ef0-0x009b0f14pc = 0x00cf211c-0x00cf4464Related Commands
memory profile enable
To enable the monitoring of memory usage (memory profiling), use the memory profile enable command in privileged EXEC mode. To disable memory profiling, use the no form of this command.
memory profile enable peak peak_value
no memory profile enable peak peak_value
Syntax Description
Defaults
Memory profiling is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Before enabling memory profiling, you must first configure a memory text range to profile with the memory profile text command.
Some memory is held by the profiling system until you enter the clear memory profile command. See the output of the show memory status command.
Note
The following example enables memory profiling:
hostname# memory profile enableRelated Commands
memory profile text
Configures a text range of memory to profile.
show memory profile
Displays information about the memory usage (profiling) of the ASA.
memory profile text
To configure a program text range of memory to profile, use the memory profile text command in privileged EXEC mode. To disable, use the no form of this command.
memory profile text {startPC endPC | all resolution}
no memory profile text {startPC endPC | all resolution}
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
For a small text range, a resolution of "4" normally traces the call to an instruction. For a larger text range, a coarse resolution is probably enough for the first pass and the range could be narrowed down to a set of smaller regions in the next pass.
After entering the text range with the memory profile text command, you must then enter the memory profile enable command to begin memory profiling. Memory profiling is disabled by default.
Note
Examples
The following example shows how to configure a text range of memory to profile, with a resolution of 4:
hostname# memory profile text 0x004018b4 0x004169d0 4The following example displays the configuration of the text range and the status of memory profiling (OFF):
hostname# show memory profile InUse profiling: OFF Peak profiling: OFF Profile: 0x004018b4-0x004169d0(00000004)
Note
Related Commands
memory-size
To configure the amount of memory on the ASA which the various components of WebVPN can access, use the memory-size command in webvpn mode. You can configure the amount of memory either as a as a set amount of memory in KB or as a percentage of total memory. To remove a configured memory size, use the no form of this command.
Note
memory-size {percent | kb} size
no memory-size [{percent | kb} size]
Syntax Description
Defaults
No default behavior or value.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn mode
•
—
•
—
—
Command History
Usage Guidelines
The configured amount of memory will be allocated immediately. Before configuring this command, check the amount of available memory by using show memory. If a percentage of total memory is used for configuration, ensure that the configured value is below the available percentage. If a Kilobyte value is used for configuration, ensure that the configured value is below the available amount of memory in Kilobytes.
Examples
The following example shows how to configure a WebVPN memory size of 30 per cent:
hostname(config)# webvpnhostname(config-webvpn)# memory-size percent 30hostname(config-webvpn)#hostname(config-webvpn)# reloadRelated Commands
memory tracking enable
To enable the tracking of heap memory request, use the memory tracking enable command in privileged EXEC mode. To disable memory tracking, use the no form of this command.
memory tracking enable
no memory tracking enable
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the memory tracking enable command to track heap memory requests. To disable memory tracking, use the no form of this command.
Examples
The following example enables tracking heap memory requests:
hostname# memory tracking enableRelated Commands
merge-dacl
To merge a downloadable ACL with the ACL received in the Cisco AV pair from a RADIUS packet, use the merge-dacl command in aaa-server group configuration mode. To disable the merging of a downloadable ACL with the ACL received in the Cisco AV pair from a RADIUS packet, use the no form of this command.
merge dacl {before_avpair | after_avpair}
no merge dacl
Syntax Description
Defaults
The default setting is no merge dacl, which specifies that downloadable ACLs will not be merged with Cisco AV pair ACLs.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server group configuration
•
•
•
•
•
Command History
Usage Guidelines
If both an AV pair and a downloadable ACL are received, the AV pair has priority and is used.
Examples
The following example specifies that the downloadable ACL entries should be placed before the Cisco AV pair entries:
hostname(config)# aaa-server servergroup1 protocol radius
hostname(config-aaa-server-group)# merge-dacl before-avpair
Related Commands
message-length
To filter GTP packets that do not meet the configured maximum and minimum length, use the message-length command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no form to remove the command.
message-length min min_bytes max max_bytes
no message-length min min_bytes max max_bytes
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
The length specified by this command is the sum of the GTP header and the rest of the message, which is the payload of the UDP packet.
Examples
The following example allows messages between 20 bytes and 300 bytes in length:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)# permit message-length min 20 max 300hostname(config-gtpmap)#Related Commands
