-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
object network through override-svc-download Commands
ospf network point-to-point non-broadcast
object network through override-svc-download Commands
object network
To configure a named network object, use the object network command in global configuration mode. Use the no form of this command to remove the object from the configuration.
object network name [rename new_obj_name]
no object network name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
8.3(1)
This command was introduced.
8.4(2)
Support for FQDNs was introduced. See the fqdn command.
Usage Guidelines
The network object can contain a host, a network, a range IP addresses (IPv4 or IPv6), or an FQDN.
You can also enable NAT rules on this network object. You can only define a single NAT rule for a given object; if you want to configure multiple NAT rules, you need to create multiple objects that specify the same IP address, for example, object network obj-10.10.10.1-01, object network obj-10.10.10.1-02, and so on.
If you configure an existing network object with a different IP address, the new configuration will replace the existing configuration.
You cannot remove an object or make an object empty if it is used in a command.
Examples
The following example shows how to create a network object:
hostname (config)# object network OBJECT1hostname (config-network-object)# host 10.1.1.1Related Commands
object service
To configure a service object that is automatically reflected in all configurations in which the object is used, use the object service command in global configuration mode. Use the no form of this command to remove the object.
object service name [rename new_obj_name]
no object service object name [rename new_obj_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The service object can contain a protocol, ICMP, ICMPv6, TCP or UDP port or port ranges.
If you configure an existing service object with a different protocol and port (or ports), the new configuration replaces the existing protocol and port (or ports) with the new ones.
Examples
The following example shows how to create a service object:
hostname(config)# object service SERVOBJECT1hostname(config-service-object)# service tcp source eq www destination eq sshRelated Commands
clear configure object
Clears all objects created.
service
Configures the protocol and port for the service object.
object-group
To define object groups that you can use to optimize your configuration, use the object-group command in global configuration mode. Use the no form of this command to remove object groups from the configuration. This command supports IPv4 and IPv6 addresses.
object-group {protocol | network | icmp-type | security | service [tcp | udp | tcp-udp] | user} grp_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Objects such as hosts, protocols, or services can be grouped, and then you can use the object group in features such as ACLs (access-list) and NAT (nat). This example shows the use of a network object group in an ACL:
hostname(config)# access-list access_list_name permit tcp any object-group NWgroup1You can group commands hierarchically; an object group can be a member of another object group.
You cannot remove or empty an object group if it is currently being used in a command.
Examples
The following example shows how to use the object-group icmp-type mode to create a new icmp-type object group:
hostname(config)# object-group icmp-type icmp-allowedhostname(config-icmp-object-group)# icmp-object echohostname(config-icmp-object-group)# icmp-object time-exceededhostname(config-icmp-object-group)# exitThe following example shows how to use the object-group network command to create a new network object group:
hostname(config)# object-group network sjc_eng_ftp_servershostname(config-network-object-group)# network-object host sjc.eng.ftp.servcershostname(config-network-object-group)# network-object host 172.23.56.194hostname(config-network-object-group)# network-object 192.1.1.0 255.255.255.224hostname(config-network-object-group)# exitThe following example shows how to use the object-group network command to create a new network object group and map it to an existing object-group:
hostname(config)# object-group network sjc_ftp_servershostname(config-network-object-group)# network-object host sjc.ftp.servershostname(config-network-object-group)# network-object host 172.23.56.195hostname(config-network-object-group)# network-object 193.1.1.0 255.255.255.224hostname(config-network-object-group)# group-object sjc_eng_ftp_servershostname(config-network-object-group)# exitThe following example shows how to use the object-group protocol mode to create a new protocol object group:
hostname(config)# object-group protocol proto_grp_1hostname(config-protocol-object-group)# protocol-object udphostname(config-protocol-object-group)# protocol-object ipsechostname(config-protocol-object-group)# exithostname(config)# object-group protocol proto_grp_2hostname(config-protocol-object-group)# protocol-object tcphostname(config-protocol-object-group)# group-object proto_grp_1hostname(config-protocol-object-group)# exitThe following example shows how to use the object-group service mode to create a new port (service) object group:
hostname(config)# object-group service eng_service tcphostname(config-service-object-group)# group-object eng_www_servicehostname(config-service-object-group)# port-object eq ftphostname(config-service-object-group)# port-object range 2000 2005hostname(config-service-object-group)# exitThe following example shows how to add and remove a text description to an object group:
hostname(config)# object-group protocol protos1hostname(config-protocol-object-group)# description This group of protocols is for our internal networkhostname(config-protocol-object-group)# show running-config object-group id protos1object-group protocol protos1description: This group of protocols is for our internal networkhostname(config-protocol-object-group)# no descriptionhostname(config-protocol-object-group)# show running-config object-group id protos1object-group protocol protos1The following example shows how to use the group-object mode to create a new object group that consists of previously defined objects:
hostname(config)# object-group network host_grp_1hostname(config-network-object-group)# network-object host 192.168.1.1hostname(config-network-object-group)# network-object host 192.168.1.2hostname(config-network-object-group)# exithostname(config)# object-group network host_grp_2hostname(config-network-object-group)# network-object host 172.23.56.1hostname(config-network-object-group)# network-object host 172.23.56.2hostname(config-network-object-group)# exithostname(config)# object-group network all_hostshostname(config-network-object-group)# group-object host_grp_1hostname(config-network-object-group)# group-object host_grp_2hostname(config-network-object-group)# exithostname(config)# access-list grp_1 permit tcp object-group host_grp_1 any eq ftphostname(config)#access-list grp_2 permit tcp object-group host_grp_2 any eq smtphostname(config)#access-list all permit tcp object-group all_hosts any eq wwwWithout the group-object command, you need to define the all_hosts group to include all the IP addresses that have already been defined in host_grp_1 and host_grp_2. With the group-object command, the duplicated definitions of the hosts are eliminated.
The following examples show how to use object groups to simplify the access list configuration:
hostname(config)# object-group network remotehostname(config-network-object-group)# network-object host kqk.suu.dri.ixxhostname(config-network-object-group)# network-object host kqk.suu.pyl.gnlhostname(config)# object-group network localshostname(config-network-object-group)# network-object host 209.165.200.225hostname(config-network-object-group)# network-object host 209.165.200.230hostname(config-network-object-group)# network-object host 209.165.200.235hostname(config-network-object-group)# network-object host 209.165.200.240hostname(config)# object-group service eng_svc tcphostname(config-service-object-group)# port-object eq wwwhostname(config-service-object-group)# port-object eq smtphostname(config-service-object-group)# port-object range 25000 25100This grouping enables the access list to be configured in 1 line instead of 24 lines, which would be needed if no grouping is used. Instead, with the grouping, the access list configuration is as follows:
hostname(config)# access-list acl permit tcp object-group remote object-group locals object-group eng_svcThe following example shows how to use the service-object subcommand, which is useful for grouping TCP and UDP services:
hostname(config)# object-group network remotehostname(config-network-object-group)# network-object host kqk.suu.dri.ixxhostname(config-network-object-group)# network-object host kqk.suu.pyl.gnlhostname(config)# object-group network localshostname(config-network-object-group)# network-object host 209.165.200.225hostname(config-network-object-group)# network-object host 209.165.200.230hostname(config-network-object-group)# network-object host 209.165.200.235hostname(config-network-object-group)# network-object host 209.165.200.240hostname(config)# object-group service usr_svchostname(config-service-object-group)# service-object tcp destination eq wwwhostname(config-service-object-group)# service-object tcp destination eq httpshostname(config-service-object-group)# service-object tcp destination eq pop3hostname(config-service-object-group)# service-object udp destination eq ntphostname(config-service-object-group)# service-object udp destination eq domainhostname(config)# access-list acl permit object-group usr_svc object-group locals object-group remote
Note
Related Commands
object-group user
To create a user group object that support the Identity Firewall feature, use the object-group user command in global configuration mode. Use the no form of this command to disable the user group object.
object-group user user_group_name
[no] object-group user user_group_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the Active Directory domain controller. The ASA imports these groups for the Identity Firewall feature. However, the ASA might have localized network resources that are not defined globally that require local user groups with localized security policies. Local user groups can contain nested groups and user groups that are imported from Active Directory. The ASA consolidates local and Active Directory groups. A user can belong to local user groups and user groups imported from Active Directory.
The ASA supports up to 256 user groups (including imported user groups and local user groups).
You active user group objects by including them within an access group, capture, or service policy.
Within a user group object, you can define the following object types:
•
The user can be either a LOCAL user or imported user. The user_name argument that you specify with the user keyword contains an ASCII user name and does not specify an IP address.
The name of an imported user must be the sAMAccountName, which is unique, rather than the common name (cn), which might not be unique. However, some Active Directory server administrators might require that the sAMAccountName and the cn be identical. In this case, the cn that the ASA displays in the output of the show user-identity ad-group-member command can be used for imported users defined by the user object.
•
The group name of the user-group must be the sAMAccountName, which is unique, rather than the cn, which might not be unique. However, some Active Directory server administrators might require that the sAMAccountName and the cn be identical. In this case, the cn that the ASA displays in the output of the show user-identity ad-group-member command can be used in the user_group_name argument specified with the user-group keyword.
Note
•
Note
•
Examples
The following example shows how to use the object-group user command to create user group objects for use with the Identity Firewall feature:
hostname(config)# object-group user sampleuser1-grouphostname(config-object-group user)# description group members of sampleuser1-grouphostname(config-object-group user)# user-group CSCO\\group.sampleusers-allhostname(config-object-group user)# user CSCO\user2hostname(config-object-group user)# exithostname(config)# object-group user sampleuser2-grouphostname(config-object-group user)# description group members of sampleuser2-grouphostname(config-object-group user)# group-object sampleuser1-grouphostname(config-object-group user)# user-group CSCO\\group.sampleusers-marketinghostname(config-object-group user)# user CSCO\user3Related Commands
object-group-search
To enable ACL optimization, use the object-group-search command in global configuration mode. Use the no form of this command to disable ACL optimization.
object-group-search access-control
no object-group-search access-control
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The object-group-search command optimizes all ACLs in the inbound direction.
When the object-group-search command is enabled, all of the old NP rules are removed from the soft-NP and reinserted with object-group IDs. When the command is disabled, all of the old rules are removed from the soft-NP and reinserted by expanding the object groups.
When the object-group-search access-control command is enabled on an ASA, with a significant number of features enabled, a large number of active connections and loaded with a large ACL, there will be a connection drop during the operation and a performance drop while establishing new connections.
Examples
The following example shows how to use the object-group-search command to enable ACL optimization:
hostname(config)# object-group-search access-controlThe following is sample output from the show access-list command when object-group-search is not enabled:
hostname# show access-list KH-BLK-Tunnelaccess-list KH-BLK-Tunnel; 9 elementsaccess-list KH-BLK-Tunnel line 1 extended permit ip object-group KH-LAN object-group BLK-LAN 0x724c956baccess-list KH-BLK-Tunnel line 1 extended permit ip 192.168.97.0 255.255.255.0 192.168.4.0 255.255.255.0 (hitcnt=10) 0x30fe29a6access-list KH-BLK-Tunnel line 1 extended permit ip 13.13.13.0 255.255.255.0 192.168.4.0 255.255.255.0 (hitcnt=4) 0xc6ef2338access-list KH-BLK-Tunnel line 1 extended permit ip 192.168.97.0 255.255.255.0 14.14.14.0 255.255.255.0 (hitcnt=2) 0xce8596ecaccess-list KH-BLK-Tunnel line 1 extended permit ip 13.13.13.0 255.255.255.0 14.14.14.0 255.255.255.0 (hitcnt=0) 0x9a2f1c4daccess-list KH-BLK-Tunnel line 2 extended permit ospf interface pppoe1 host 87.139.87.200 (hitcnt=0) 0xb62d5832access-list KH-BLK-Tunnel line 3 extended permit ip interface pppoe1 any (hitcnt=0) 0xa2c9ed34access-list KH-BLK-Tunnel line 4 extended permit ip host 1.1.1.1 any (hitcnt=0) 0xd06f7e6baccess-list KH-BLK-Tunnel line 5 extended deny ip 1.1.0.0 255.255.0.0 any (hitcnt=0) 0x9d979934access-list KH-BLK-Tunnel line 6 extended permit ip 1.1.1.0 255.255.255.0 any (hitcnt=0) 0xa52a0761The following is sample output from the show access-list command when object-group-search is enabled:
hostname# show access-list KH-BLK-Tunnelaccess-list KH-BLK-Tunnel; 6 elementsaccess-list KH-BLK-Tunnel line 1 extended permit ip object-group KH-LAN(1) object-group BLK-LAN(2)(hitcount=16) 0x724c956baccess-list KH-BLK-Tunnel line 2 extended permit ospf interface pppoe1 host 87.139.87.200 (hitcnt=0) 0xb62d5832access-list KH-BLK-Tunnel line 3 extended permit ip interface pppoe1 any (hitcnt=0) 0xa2c9ed34access-list KH-BLK-Tunnel line 4 extended permit ip host 1.1.1.1 any (hitcnt=0) 0xd06f7e6baccess-list KH-BLK-Tunnel line 5 extended deny ip 1.1.0.0 255.255.0.0 any (hitcnt=0) 0x9d979934access-list KH-BLK-Tunnel line 6 extended permit ip 1.1.1.0 255.255.255.0 any (hitcnt=0) 0xa52a0761
Related Commands
ocsp disable-nonce
To disable the nonce extension, use the ocsp disable-nonce command in crypto ca trustpoint configuration mode. To re-enable the nonce extension, use the no form of this command.
ocsp disable-nonce
no ocsp disable-nonce
Syntax Description
This command has no arguments or keywords.
Defaults
By default, OCSP requests include a nonce extension.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
•
•
•
•
•
Command History
Usage Guidelines
When you use this command, the OCSP request does not include the OCSP nonce extension, and the ASA does not check it. By default, OCSP requests include a nonce extension, which cryptographically binds requests with responses to avoid replay attacks. However, some OCSP servers use pre-generated responses that do not contain this matching nonce extension. To use OCSP with these servers, you must disable the nonce extension.
Examples
The following example shows how to disable the nonce extension for a trustpoint called newtrust.
hostname(config)# crypto ca trustpoint newtrusthostname(config-ca-trustpoint)# ocsp disable-noncehostname(config-ca-trustpoint)#Related Commands
ocsp url
To configure an OCSP server for the ASA to use to check all certificates associated with a trustpoint rather than the server specified in the AIA extension of the client certificate, use the ocsp url command in crypto ca trustpoint configuration mode. To remove the server from the configuration, use the no form of this command.
ocsp url URL
no ocsp url
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
•
•
•
•
•
Command History
Usage Guidelines
The ASA supports only HTTP URLs, and you can specify only one URL per trustpoint.
The ASA provides three ways to define an OCSP server URL, and it attempts to use OCSP servers according to how you define them, in the following order:
•
•
•
If you do not configure an OCSP URL via the match certificate command or the ocsp url command, the ASA uses the OCSP server in the AIA extension of the client certificate. If the certificate does not have an AIA extension, revocation status checking fails.
Examples
The following example shows how to configure an OCSP server with the URL http://10.1.124.22.
hostname(config)# crypto ca trustpoint newtrusthostname(config-ca-trustpoint)# ocsp url http://10.1.124.22hostname(config-ca-trustpoint)#Related Commands
onscreen-keyboard
To insert an onscreen keyboard into the logon pane or all panes with a login/password requirement, use the onscreen-keyboard command in webvpn mode. To remove a previously configured onscreen keyboard, use the no version of the command.
onscreen-keyboard {logon | all}
no onscreen-keyboard [logon | all]
Syntax Description
logon
Inserts the onscreen keyboard for the logon pane.
all
Inserts the onscreen keyboard for the logon pane, and for all other panes with a login/password requirement.
Defaults
No onscreen keyboard.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
The onscreen keyboard lets you enter user credentials without keystrokes.
Examples
The following example shows how to enable the onscreen keyboard for the logon page:
hostname(config)#webvpnhostname(config-webvpn)#onscreen-keyboard logonhostname(config-webvpn)#Related Commands
webvpn
Enters webvpn mode, which lets you configure attributes for clientless SSLVPN connections.
ospf authentication
To enable the use of OSPF authentication, use the ospf authentication command in interface configuration mode. To restore the default authentication stance, use the no form of this command.
ospf authentication [message-digest | null]
no ospf authentication
Syntax Description
message-digest
(Optional) Specifies to use OSPF message digest authentication.
null
(Optional) Specifies to not use OSPF authentication.
Defaults
By default, OSPF authentication is not enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
Before using the ospf authentication command, configure a password for the interface using the ospf authentication-key command. If you use the message-digest keyword, configure the message-digest key for the interface with the ospf message-digest-key command.
For backward compatibility, authentication type for an area is still supported. If the authentication type is not specified for an interface, the authentication type for the area will be used (the area default is null authentication).
When this command is used without any options, simple password authentication is enabled.
Examples
The following example shows how to enable simple password authentication for OSPF on the selected interface:
hostname(config-if)# ospf authenticationhostname(config-if)#Related Commands
ospf authentication-key
Specifies the password used by neighboring routing devices.
ospf message-digest-key
Enables MD5 authentication and specifies the MD5 key.
ospf authentication-key
To specify the password used by neighboring routing devices, use the ospf authentication-key command in interface configuration mode. To remove the password, use the no form of this command.
ospf authentication-key [0 | 8] password
no ospf authentication-key
Syntax Description<
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
The password created by this command is used as a key that is inserted directly into the OSPF header when routing protocol packets are originated. A separate password can be assigned to each network on a per-interface basis. All neighboring routers on the same network must have the same password to be able to exchange OSPF information.
ExamplesNote
The following example shows how to specify a password for OSPF authentication:
hostname(config-if)# ospf authentication-key 8 yWIvi0qJAnGK5MRWQzrhIohkGP1wKbRelated Commands
area authentication
Enables OSPF authentication for the specified area.
ospf authentication
Enables the use of OSPF authentication.
ospf cost
To specify the cost of sending a packet through the interface, use the ospf cost command in interface configuration mode. To reset the interface cost to the default value, use the no form of this command.
ospf cost interface_cost
no ospf cost
Syntax Description
Defaults
The default interface_cost is 10.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
The ospf cost command lets you explicitly specify the cost of sending a packet on an interface. The interface_cost parameter is an unsigned integer value from 0 to 65535.
The no ospf cost command allows you to reset the path cost to the default value.
Examples
The following example show how to specify the cost of sending a packet on the selected interface:
hostname(config-if)# ospf cost 4Related Commands
show running-config interface
Displays the configuration of the specified interface.
ospf database-filter
To filter out all outgoing LSAs to an OSPF interface during synchronization and flooding, use the ospf database-filter command in interface configuration mode. To restore the LSAs, use the no form of this command.
ospf database-filter all out
no ospf database-filter all out
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
The ospf database-filter command filters outgoing LSAs to an OSPF interface. The no ospf database-filter all out command restores the forwarding of LSAs to the interface.
Examples
The following example shows how to use the ospf database-filter command to filter outgoing LSAs:
hostname(config-if)# ospf database-filter all outRelated Commands
ospf dead-interval
To specify the interval before neighbors declare a router down, use the ospf dead-interval command in interface configuration mode. To restore the default value, use the no form of this command.
ospf dead-interval seconds
no ospf dead-interval seconds
Syntax Description
seconds
The length of time during which no hello packets are seen. The default for seconds is four times the interval set by the ospf hello-interval command (which ranges from 1 to 65535).
Defaults
The default value for seconds is four times the interval set by the ospf hello-interval command.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
The ospf dead-interval command lets you set the dead interval before neighbors to declare the router down (the length of time during which no hello packets are seen). The seconds argument specifies the dead interval and must be the same for all nodes on the network. The default for seconds is four times the interval set by the ospf hello-interval command from 1 to 65535.
The no ospf dead-interval command restores the default interval value.
Examples
The following example sets the OSPF dead interval to 1 minute:
hostname(config-if)# ospf dead-interval 60Related Commands
ospf hello-interval
Specifies the interval between hello packets sent on an interface.
show ospf interface
Displays OSPF-related interface information.
ospf hello-interval
To specify the interval between hello packets sent on an interface, use the ospf hello-interval command in interface configuration mode. To return the hello interval to the default value, use the no form of this command.
ospf hello-interval seconds
no ospf hello-interval
Syntax Description
seconds
Specifies the interval between hello packets that are sent on the interface; valid values are from 1 to 65535 seconds.
Defaults
The default value for hello-interval seconds is 10 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
This value is advertised in the hello packets. The smaller the hello interval, the faster topological changes will be detected, but more routing traffic will ensue. This value must be the same for all routers and access servers on a specific network.
Examples
The following example sets the OSPF hello interval to 5 seconds:
hostname(config-if)# ospf hello-interval 5Related Commands
ospf dead-interval
Specifies the interval before neighbors declare a router down.
show ospf interface
Displays OSPF-related interface information.
ospf message-digest-key
To enable OSPF MD5 authentication, use the ospf message-digest-key command in interface configuration mode. To remove an MD5 key, use the no form of this command.
ospf message-digest-key key-id md5 [0 | 8] key
no ospf message-digest-key
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
The ospf message-digest-key command lets you enable MD5 authentication. The no form of the command let you remove an old MD5 key. key_id is a numerical identifier from 1 to 255 for the authentication key. key is an alphanumeric password of up to 16 bytes. MD5 verifies the integrity of the communication, authenticates the origin, and checks for timeliness.
Examples
The following example shows how to specify an MD5 key for OSPF authentication:
hostname(config-if)# ospf message-digest-key 3 md5 8 yWIvi0qJAnGK5MRWQzrhIohkGP1wKbRelated Commands
area authentication
Enables OSPF area authentication.
ospf authentication
Enables the use of OSPF authentication.
ospf mtu-ignore
To disable OSPF maximum transmission unit (MTU) mismatch detection on receiving database packets, use the ospf mtu-ignore command in interface configuration mode. To restore MTU mismatch detection, use the no form of this command.
ospf mtu-ignore
no ospf mtu-ignore
Syntax Description
This command has no arguments or keywords.
Defaults
By default, ospf mtu-ignore is enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
OSPF checks whether neighbors are using the same MTU on a common interface. This check is performed when neighbors exchange Database Descriptor (DBD) packets. If the receiving MTU in the DBD packet is higher than the IP MTU configured on the incoming interface, OSPF adjacency will not be established.The ospf mtu-ignore command disables OSPF MTU mismatch detection on receiving DBD packets. It is enabled by default.
Examples
The following example shows how to disable the ospf mtu-ignore command:
hostname(config-if)# ospf mtu-ignoreRelated Commands
ospf network point-to-point non-broadcast
To configure the OSPF interface as a point-to-point, non-broadcast network, use the ospf network point-to-point non-broadcast command in interface configuration mode. To remove this command from the configuration, use the no form of this command.
ospf network point-to-point non-broadcast
no ospf network point-to-point non-broadcast
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
The ospf network point-to-point non-broadcast command lets you to transmit OSPF routes over VPN tunnels.
When the interface is specified as point-to-point, the OSPF neighbors have to be manually configured; dynamic discovery is not possible. To manually configure OSPF neighbors, use the neighbor command in router configuration mode.
When an interface is configured as point-to-point, the following restrictions apply:
•
•
•
•
•
Examples
The following example shows how to configure the selected interface as a point-to-point, non-broadcast interface:
hostname(config-if)# ospf network point-to-point non-broadcasthostname(config-if)#Related Commands
neighbor
Specifies manually configured OSPF neighbors.
show interface
Displays interface status information.
ospf priority
To change the OSPF router priority, use the ospf priority command in interface configuration mode. To restore the default priority, use the no form of this command.
ospf priority number
no ospf priority [number]
Syntax Description
Defaults
The default value for number is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
When two routers attached to a network both attempt to become the designated router, the one with the higher router priority takes precedence. If there is a tie, the router with the higher router ID takes precedence. A router with a router priority set to zero is ineligible to become the designated router or backup designated router. Router priority is configured only for interfaces to multiaccess networks (in other words, not to point-to-point networks).
Examples
The following example shows how to change the OSPF priority on the selected interface:
hostname(config-if)# ospf priority 4hostname(config-if)#Related Commands
ospf retransmit-interval
To specify the time between LSA retransmissions for adjacencies belonging to the interface, use the ospf retransmit-interval command in interface configuration mode. To restore the default value, use the no form of this command.
ospf retransmit-interval [seconds]
no ospf retransmit-interval [seconds]
Syntax Description
seconds
Specifies the time between LSA retransmissions for adjacent routers belonging to the interface; valid values are from 1 to 65535 seconds.
Defaults
The default value of retransmit-interval seconds is 5 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
When a router sends an LSA to its neighbor, it keeps the LSA until it receives the acknowledgment message. If the router receives no acknowledgment, it will re-send the LSA.
The setting of this parameter should be conservative, or needless retransmission will result. The value should be larger for serial lines and virtual links.
Examples
The following example shows how to change the retransmit interval for LSAs:
hostname(config-if)# ospf retransmit-interval 15hostname(config-if)#Related Commands
ospf transmit-delay
To set the estimated time required to send a link-state update packet on the interface, use the ospf transmit-delay command in interface configuration mode. To restore the default value, use the no form of this command.
ospf transmit-delay [seconds]
no ospf transmit-delay [seconds]
Syntax Description
seconds
Sets the estimated time required to send a link-state update packet on the interface. The default value is 1 second with a range from 1 to 65535 seconds.
Defaults
The default value of seconds is 1 second.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
•
—
Command History
Usage Guidelines
LSAs in the update packet must have their ages incremented by the amount specified in the seconds argument before transmission. The value assigned should take into account the transmission and propagation delays for the interface.
If the delay is not added before transmission over a link, the time in which the LSA propagates over the link is not considered. This setting has more significance on very low-speed links.
Examples
The following example sets the transmit delay to 3 seconds for the selected interface:
hostname(config-if)# ospf restransmit-delay 3hostname(config-if)#Related Commands
otp expiration
To specify the duration in hours that an issued One-Time Password (OTP) for the local Certificate Authority (CA) enrollment page is valid, use the otp expiration command in ca server configuration mode. To reset the duration to the default number of hours, use the no form of this command.
otp expiration timeout
no otp expiration
Syntax Description
timeout
Specifies the time in hours users have to enroll for a certificate from the local CA before the OTP for the enrollment page expires. Valid values range from 1 to 720 hours (30 days).
Defaults
By default, a OTP expiration for certificate enrollment is 72 hours (3 days).
Command Modes
The following table shows the modes in which you can enter the command:
Ca server configuration
•
—
•
—
—
Command History
Usage Guidelines
The OTP expiration period specifies the number of hours that a user has to log in to the enrollment page of the CA server. After the user logs in and enrolls for a certificate, the time period specified by the enrollment retrieval command starts.
Note
Examples
The following example specifies that the OTP for the enrollment page applies for 24 hours:
hostname(config)# crypto ca serverhostname(config-ca-server)# otp expiration 24hostname(config-ca-server)#The following example resets the OTP duration to the default of 72 hours:
hostname(config)# crypto ca serverhostname(config-ca-server))# no otp expirationhostname(config-ca-server)#Related Commands
outstanding
To limit the number of unauthenticated e-mail proxy sessions, use the outstanding command in the applicable e-mail proxy configuration mode. To remove the attribute from the configuration, use the no form of this command.
outstanding {number}
no outstanding
Syntax Description
Defaults
The default is 20.
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
—
•
—
—
Imap4s
•
—
•
—
—
Smtps
•
—
•
—
—
Command History
Usage Guidelines
Use the no version of this command to remove the attribute from the configuration, which permits an unlimited number of unauthenticated sessions. This also limit s DOS attacks on the e-mail ports.
E-mail proxy connections have three states:
1.
2.
3.
If the number of connections in the unauthenticated state exceeds the configured limit, the ASA terminates the oldest unauthenticated connection, preventing overload. It does not terminate authenticated connections.
Examples
The following example shows how to set a limit of 12 unauthenticated sessions for POP3S e-mail proxy.
hostname(config)#pop3shostname(config-pop3s)#outstanding 12override-account-disable
To override an account-disabled indication from a AAA server, use the override-account-disable command in tunnel-group general-attributes configuration mode. To disable an override, use the no form of this command.
override-account-disable
no override-account-disable
Syntax Description
This command has no arguments or keywords.
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general-attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
This command is valid for servers, such as RADIUS with NT LDAP, and Kerberos, that return an "account-disabled" indication.
You can configure this attribute for IPsec RA and WebVPN tunnel-groups.
Examples
The following example allows overriding the "account-disabled" indicator from the AAA server for the WebVPN tunnel group "testgroup":
hostname(config)# tunnel-group testgroup type webvpnhostname(config)# tunnel-group testgroup general-attributeshostname(config-tunnel-general)# override-account-disablehostname(config-tunnel-general)#The following example allows overriding the "account-disabled" indicator from the AAA server for the IPsec remote access tunnel group "QAgroup":
hostname(config)# tunnel-group QAgroup type ipsec-rahostname(config)# tunnel-group QAgroup general-attributeshostname(config-tunnel-general)# override-account-disablehostname(config-tunnel-general)#Related Commands
override-svc-download
To configure the connection profile to override the group policy or username attributes configuration for downloading an AnyConnect or SSL VPN client, use the override-svc-download command from tunnel-group webvpn attributes configuration mode. To remove the command from the configuration, use the no form of the command:
override-svc-download enable
no override-svc-download enable
Defaults
The default is disabled. The ASA does not override the group policy or username attributes configuration for downloading the client.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
The security appliance allows clientless, AnyConnect, or SSL VPN client connections for remote users based on whether clientless and/or SSL VPN is enabled in the group policy or username attributes with the vpn-tunnel-protocol command. The svc ask command further modifies the client user experience by prompting the user to download the client or return to the WebVPN home page.
However, you may want clientless users logging in under specific tunnel groups to not experience delays waiting for the download prompt to expire before being presented with the clientless SSL VPN home page. You can prevent delays for these users at the connection profile level with the override-svc-download command. This command causes users logging through a connection profile to be immediately presented with the clientless SSL VPN home page regardless of the vpn-tunnel-protocol or svc ask command settings.
Examples
In the following example, the user enters tunnel-group webvpn attributes configuration mode for the connection profile engineering and enables the connection profile to override the group policy and username attribute settings for client download prompts:
hostname(config)# tunnel-group engineering webvpn-attributeshostname(config-tunnel-webvpn)# override-svc-downloadRelated Commands
