-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
queue-limit through reset Commands
remote-access threshold session-threshold-exceeded
queue-limit through reset Commands
queue-limit (priority-queue)
To specify the depth of the priority queues, use the queue-limit command in priority-queue configuration mode. To remove this specification, use the no form of this command.
Note
This command is not supported on ASA 5580 Ten Gigabit Ethernet interfaces. (Ten Gigabit Ethernet interfaces are supported for priority queues on the ASA 5585-X.) This command is also not supported for the ASA 5512-X through ASA 5555-X Management interface.
This command is not supported on the ASA Services Module.
queue-limit number-of-packets
no queue-limit number-of-packets
Syntax Description
Defaults
The default queue limit is 1024 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Priority-queue configuration
•
•
•
•
—
Command History
Usage Guidelines
The ASA allows two classes of traffic: low-latency queuing (LLQ) for higher priority, latency sensitive traffic (such as voice and video) and best-effort, the default, for all other traffic. The ASA recognizes priority traffic and enforces appropriate quality of service (QoS) policies. You can configure the size and depth of the priority queue to fine-tune the traffic flow.
Note
You can apply one priority-queue command to any interface that can be defined by the nameif command.
The priority-queue command enters priority-queue configuration mode, as shown by the prompt. In priority-queue configuration mode, you can configure the maximum number of packets allowed in the transmit queue at any given time (tx-ring-limit command) and the number of packets of either type (priority or best -effort) allowed to be buffered before dropping packets (queue-limit command).
The tx-ring-limit and the queue-limit that you specify affect both the higher priority low-latency queue and the best-effort queue. The tx-ring-limit is the number of either type of packets allowed into the driver before the driver pushes back to the queues sitting in front of the interface to let them buffer packets until the congestion clears. In general, you can adjust these two parameters to optimize the flow of low-latency traffic.
Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is tail drop. To avoid having the queue fill up, you can use the queue-limit command to increase the queue buffer size.
Examples
The following example configures a priority queue for the interface named test, specifying a queue limit of 234 packets and a transmit queue limit of 3 packets.
hostname(config)# priority-queue testhostname(priority-queue)# queue-limit 234hostname(priority-queue)# tx-ring-limit 3Related Commands
queue-limit (tcp-map)
To configure the maximum number of out-of-order packets that can be buffered and put in order for a TCP connection, use the queue-limit command in tcp-map configuration mode. To set the value back to the default, use the no form of this command. This command is part of the TCP normalization policy enabled using the set connection advanced-options command.
queue-limit pkt_num [timeout seconds]
no queue-limit
Syntax Description
Defaults
The default setting is 0, which means this command is disabled.
The default timeout is 4 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
7.2(4)/8.0(4)
The timeout keyword was added.
Usage Guidelines
To enable TCP normalization, use the Modular Policy Framework:
1.
a.
2.
3.
a.
b.
4.
If you do not enable TCP normalization, or if the queue-limit command is set to the default of 0, which means it is disabled, then the default system queue limit is used depending on the type of traffic:
•
•
If you set the queue-limit command to be 1 or above, then the number of out-of-order packets allowed for all TCP traffic matches this setting. For example, for application inspection, IPS, and TCP check-retransmission traffic, any advertised settings from TCP packets are ignored in favor of the queue-limit setting. For other TCP traffic, out-of-order packets are now buffered and put in order instead of passed through untouched.
Examples
The following example sets the queue limit to 8 packets and the buffer timeout to 6 seconds for all Telnet connections:
hostname(config)# tcp-map tmaphostname(config-tcp-map)# queue-limit 8 timeout 6hostname(config)# class-map cmaphostname(config-cmap)# match port tcp eq telnethostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalhostname(config)#Related Commands
quit
To exit the current configuration mode, or to logout from privileged or user EXEC modes, use the quit command.
quit
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
You can also use the key sequence Ctrl Z to exit global configuration (and higher) modes. This key sequence does not work with privileged or user EXEC modes.
When you enter the quit command in privileged or user EXEC modes, you log out from the ASA. Use the disable command to return to user EXEC mode from privileged EXEC mode.
Examples
The following example shows how to use the quit command to exit global configuration mode, and then logout from the session:
hostname(config)# quithostname# quitLogoffThe following example shows how to use the quit command to exit global configuration mode, and then use the disable command to exit privileged EXEC mode:
hostname(config)# quithostname# disablehostname>Related Commands
quota management-session
To set the maximum number of simultaneous ASDM, SSH, and Telnet sessions that are allowed on the ASA, use the quota management-session command in global configuration mode. To set the quota to the default value, use the no form of this command.
quota management-session number
no quota management-session number
Syntax Description
number
Specifies the maximum number of simultaneous ASDM, SSH, and Telnet sessions that are allowed. Valid values are from 0 to 10,000.
Defaults
The default is 0, which means there is no session limit.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
Usage Guidelines
When the quota is reached, subsequent management session requests are denied and a syslog message is generated. The console session is never blocked by the management session quota mechanism to prevent device lockout.
Examples
The following example configures the management session quota to 100:
hostname(config)#quota management-session 100Related Commands
show run quota management-session
Displays the current value of the management-session quota.
show quota management-session
Displays statistics for management sessions.
radius-common-pw
To specify a common password to be used for all users who are accessing a RADIUS authorization server through the ASA, use the radius-common-pw command in aaa-server host configuration mode. To remove this specification, use the no form of this command.
radius-common-pw string
no radius-common-pw
Syntax Description
string
A case-sensitive, alphanumeric keyword of up to 127 characters to be used as a common password for all authorization transactions with the RADIUS server.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
aaa-server host
•
•
•
•
—
Command History
Usage Guidelines
This command is valid only for RADIUS authorization servers.
The RADIUS authorization server requires a password and username for each connecting user. The ASA provides the username automatically. You enter the password here. The RADIUS server administrator must configure the RADIUS server to associate this password with each user authorizing to the server via this ASA. Be sure to provide this information to your RADIUS server administrator.
If you do not specify a common user password, each user password is the username. If you are using usernames for common user passwords, as a security precaution, do not use the RADIUS server for authorization anywhere else on your network.
13-125
Note
Examples
The following example configures a RADIUS AAA server group named "svrgrp1" on host "1.2.3.4," sets the timeout interval to 9 seconds, sets the retry interval to 7 seconds, and configures the RADIUS commnon password as "allauthpw."
hostname(config)#aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)#aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)#timeout 9hostname(config-aaa-server-host)#retry 7hostname(config-aaa-server-host)#radius-common-pw allauthpwhostname(config-aaa-server-host)#exithostname(config)#Related Commands
radius-reject-message
To enable the display of a RADIUS reject message on the login screen when authentication is rejected, use the radius-eject-message command from tunnel-group webvpn attributes configuration mode. To remove the command from the configuration, use the no form of the command:
radius-reject-message
no radius-reject-message
Defaults
The default is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
Enable this command if you want to display to remote users a RADIUS message about an authentication failure.
Examples
The following example enables the display of a RADIUS rejection message for the connection profile named engineering:
hostname(config)# tunnel-group engineering webvpn-attributeshostname(config-tunnel-webvpn)# radius-reject-messageradius-with-expiry (removed)
To have the ASA use MS-CHAPv2 to negotiate a password update with the user during authentication, use the radius-with-expiry command in tunnel-group ipsec-attributes configuration mode. To return to the default value, use the no form of this command.
radius-with-expiry
no radius-with-expiry
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting for this command is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group ipsec-attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute only to the IPSec remote-access tunnel-group type. The ASA ignores this command if RADIUS authentication has not been configured.
Examples
The following example entered in config-ipsec configuration mode, configures Radius with Expiry for the remote-access tunnel group named remotegrp:
hostname(config)# tunnel-group remotegrp type ipsec_rahostname(config)# tunnel-group remotegrp ipsec-attributeshostname(config-tunnel-ipsec)# radius-with-expiryRelated Commands
range
To configure a range of addresses for a network object, use the range command in object configuration mode. Use the no form of this command to remove the object from the configuration.
range ip_addr_1 ip_addr2
no range ip_addr_1 ip_addr2
Syntax Description
ip_addr_1
Identifies the first IP address in the range, either IPv4 or IPv6.
ip_addr_2
Identifies the last IP address in the range.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Object network configuration
•
•
•
•
—
Command History
8.3(1)
This command was introduced.
9.0(1)
We added support for IPv6 addresses.
Usage Guidelines
If you configure an existing network object with a different IP address, the new configuration will replace the existing configuration.
Examples
The following example shows how to create a range network object:
hostname (config)# object network OBJECT_RANGEhostname (config-network-object)# range 10.1.1.1 10.1.1.8Related Commands
ras-rcf-pinholes
To enable call setup between H.323 endpoints when the Gatekeeper is inside the network, use the ras-rcf-pinholes command in parameters configuration mode. To disable this feature, use the no form of this command.
ras-rcf-pinholes enable
no ras-rcf-pinholes enable
Syntax Description
Defaults
By default, this option is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Usage Guidelines
The ASA includes options to open pinholes for calls based on the RegistrationRequest/RegistrationConfirm (RRQ/RCF) messages. Because these RRQ/RCF messages are sent to and from the Gatekeeper, the calling endpoint's IP address is unknown and the ASA opens a pinhole through source IP address/port 0/0.
Examples
The following example shows how to set up an action in a policy map to open pinholes for these calls:
hostname(config)# policy-map type inspect h323 h323_maphostname(config-pmap)# parametershostname(config-pmap-p)# ras-rcf-pinholes enableRelated Commands
rate-limit
When using the Modular Policy Framework, limit the rate of messages for packets that match a match command or class map by using the rate-limit command in match or class configuration mode. This rate limit action is available in an inspection policy map (the policy-map type inspect command) for application traffic; however, not all applications allow this action. To disable this action, use the no form of this command.
rate-limit messages_per_second
no rate-limit messages_per_second
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Match and class configuration
•
•
•
•
—
Command History
Usage Guidelines
An inspection policy map consists of one or more match and class commands. The exact commands available for an inspection policy map depends on the application. After you enter the match or class command to identify application traffic (the class command refers to an existing class-map type inspect command that in turn includes match commands), you can enter the rate-limit command to limit the rate of messages.
When you enable application inspection using the inspect command in a Layer 3/4 policy map (the policy-map command), you can enable the inspection policy map that contains this action, for example, enter the inspect dns dns_policy_map command where dns_policy_map is the name of the inspection policy map.
Examples
The following example limits the invite requests to 100 messages per second:
hostname(config-cmap)# policy-map type inspect sip sip-map1hostname(config-pmap-c)# match request-method invitehostname(config-pmap-c)# rate-limit 100Related Commands
reactivation-mode
To specify the method by which failed servers in a group are reactivated, use the reactivation-mode command in aaa-server protocol mode. To remove this specification, use the no form of this command.
reactivation-mode {depletion [deadtime minutes] | timed}
no reactivation-mode [depletion [deadtime minutes] | timed]
Syntax Description
Defaults
The default reactivation mode is depletion, and the default deadtime value is 10.
Command Modes
The following table shows the modes in which you can enter the command:
Aaa-server protcocol configuration
•
•
•
•
—
Command History
Usage Guidelines
Each server group has an attribute that specifies the reactivation policy for its servers.
In depletion mode, when a server is deactivated, it remains inactive until all other servers in the group are inactive. When and if this occurs, all servers in the group are reactivated. This approach minimizes the occurrence of connection delays due to failed servers. When depletion mode is in use, you can also specify the deadtime parameter. The deadtime parameter specifies the amount of time (in minutes) that will elapse between the disabling of the last server in the group and the subsequent re-enabling of all servers. This parameter is meaningful only when the server group is being used in conjunction with the local fallback feature.
In timed mode, failed servers are reactivated after 30 seconds of down time. This is useful when customers use the first server in a server list as the primary server and prefer that it is online whenever possible. This policy breaks down in the case of UDP servers. Since a connection to a UDP server will not fail, even if the server is not present, UDP servers are put back on line blindly. This could lead to slowed connection times or connection failures if a server list contains multiple servers that are not reachable.
Accounting server groups that have simultaneous accounting enabled are forced to use the timed mode. This implies that all servers in a given list are equivalent.
Examples
The following example configures a TACACS+ AAA server named "srvgrp1" to use the depletion reactivation mode, with a deadtime of 15 minutes:
hostname(config)#aaa-server svrgrp1 protocol tacacs+hostname(config-aaa-sersver-group)#reactivation-mode depletion deadtime 15hostname(config-aaa-server)#exithostname(config)#The following example configures a TACACS+ AAA server named "srvgrp1" to use timed reactivation mode:
hostname(config)#aaa-server svrgrp2 protocol tacacs+hostname(config-aaa-server)#reactivation-mode timedhostname(config-aaa-server)#Related Commands
record-entry
To specify the trustpoints to be used for the creation of the CTL file, use the record-entry command in ctl-file configuration mode. To remove a record entry from a CTL, use the no form of this command.
record-entry [ capf | cucm | cucm-tftp | tftp ] trustpoint trustpoint address ip_address [domain-name domain_name]
no record-entry [ capf | cucm | cucm-tftp | tftp ] trustpoint trust_point address ip_address [domain-name domain_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
CTL-file configuration
•
—
•
—
—
Command History
Usage Guidelines
Only one domain-name can be specified. If the CTL file does not exist, manually export this certificate from CUCM to the ASA.
Use this command only when you have not configured a CTL file for the Phone Proxy. Do not use this command when you have already configured a CTL file.
The IP address you specify in the ip_address argument must be the global address or address as seen by the IP phones because it will be the IP address used for the CTL record for the trustpoint.
Add additional record-entry configurations for each entity that is required in the CTL file.
Examples
The following example shows the use of the record-entry command to specify the trustpoints to be used for the creation of the CTL file:
hostname(config-ctl-file)# record-entry cucm-tftp trustpoint cucm1 address 192.168.1.2Related Commands
redirect-fqdn
To enable or disable redirection using a fully qualified domain name in vpn load-balancing mode, use the redirect-fqdn enable command in global configuration mode.
redirect-fqdn {enable | disable}
no redirect-fqdn {enable | disable}
Note
Syntax Description
disable
Disables redirection with fully qualified domain names.
enable
Enables redirection with fully qualified domain names.
Defaults
This behavior is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Vpn load-balancing mode
•
—
•
—
—
Command History
Usage Guidelines
By default, the ASA sends only IP addresses in load-balancing redirection to a client. If certificates are in use that are based on DNS names, the certificates will be invalid when redirected to a secondary device.
As a VPN cluster master, this ASA can send a fully qualified domain name (FQDN), using reverse DNS lookup, of a cluster device (another ASA in the cluster), instead of its outside IP address, when redirecting VPN client connections to that cluster device.
All of the outside and inside network interfaces on the load-balancing devices in a cluster must be on the same IP network.
To do WebVPN load Balancing using FQDNs rather than IP addresses, you must do the following configuration steps:
Step 1
Step 2
Step 3
Step 4
hostname(config)#(IP address of your DNS server)Examples
The following is an example of the redirect-fqdn command that disables redirection:
hostname(config)# vpn load-balancinghostname(config-load-balancing)# redirect-fqdn disablehostname(config-load-balancing)#The following is an example of a VPN load-balancing command sequence that includes an interface command that enables redirection for a fully qualified domain name, specifies the public interface of the cluster as "test" and the private interface of the cluster as "foo":
hostname(config)# interface GigabitEthernet 0/1hostname(config-if)# ip address 209.165.202.159 255.255.255.0hostname(config)# nameif testhostname(config)# interface GigabitEthernet 0/2hostname(config-if)# ip address 209.165.201.30 255.255.255.0hostname(config)# nameif foohostname(config)# vpn load-balancinghostname(config-load-balancing)# nat 192.168.10.10hostname(config-load-balancing)# priority 9hostname(config-load-balancing)# interface lbpublic testhostname(config-load-balancing)# interface lbprivate foohostname(config-load-balancing)# cluster ip address 209.165.202.224hostname(config-load-balancing)# cluster key 123456789hostname(config-load-balancing)# cluster encryptionhostname(config-load-balancing)# cluster port 9023hostname(config-load-balancing)# redirect-fqdn enablehostname(config-load-balancing)# participateRelated Commands
redistribute (EIGRP)
To redistribute routes from one routing domain into the EIGRP routing process, use the redistribute command in router configuration mode. To remove the redistribution, use the no form of this command.
redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected} [metric bandwidth delay reliability load mtu] [route-map map_name]
no redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected} [metric bandwidth delay reliability load mtu] [route-map map_name]
Syntax Description
Defaults
The following are the command defaults:
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
•
—
Command History
Usage Guidelines
You must specify the metric with the redistribute command if you do not have a default-metric command in your EIGRP configuration.
Examples
The following example redistributes static and connected routes into the EIGRP routing process:
hostname(config)# router eigrp 100hostname(config-router)# redistribute statichostname(config-router)# redistribute connectedRelated Commands
router eigrp
Creates an EIGRP routing process and enters configuration mode for that process.
show running-config router
Displays the commands in the global router configuration.
redistribute (OSPF)
To redistribute routes from one routing domain into an OSPF routing process, use the redistribute command in router configuration mode. To remove the redistribution when no options are included, use the no form of this command. The no form of the command with an option removes only the configuration for that option.
redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected | eigrp as-number} [metric metric_value] [metric-type metric_type] [route-map map_name] [tag tag_value] [subnets]
no redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | rip | static | connected} [metric metric_value] [metric-type metric_type] [route-map map_name] [tag tag_value] [subnets]
Syntax Description
Defaults
The following are the command defaults:
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
•
—
Command History
Examples
The following example shows how to redistribute static routes into the current OSPF process:
hostname(config)# router ospf 1hostname(config-rtr)# redistribute staticRelated Commands
redistribute (OSPFv3)
To redistribute IPv6 routes from one OSPFv3 routing domain into OSPFv3 routing domain, use the redistribute command in IPv6 router configuration mode. To disable the redistribution, use the no form of this command.
redistribute source-protocol [process-id] [include-connected {level-1 | level-1-2 | level-2}] [as-number] [metric {metric-value | transparent}] [metric-type type-value] [match {external [1 | 2] | internal | nssa-external [1 | 2]}] [tag tag-value] [route-map map-tag]
no redistribute source-protocol [process-id] [include-connected {level-1 | level-1-2 | level-2}] [as-number] [metric {metric-value | transparent}] [metric-type type-value] [match {external [1 | 2] | internal | nssa-external [1 | 2]}] [tag tag-value] [route-map map-tag]
Syntax Description
Defaults
The following are the command defaults:
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
IPv6 router configuration
•
—
•
—
—
Command History
Examples
The following example shows how to redistribute static routes into the current OSPFv3 process:
hostname(config-if)# ipv6 router ospf 1hostname(config-rtr)# redistribute staticRelated Commands
ipv6 router ospf
Enters router configuration mode for OSPFv3.
show running-config ipv6 router
Displays the commands in the router configuration for OSPFv3.
redistribute (RIP)
To redistribute routes from another routing domain into the RIP routing process, use the redistribute command in router configuration mode. To remove the redistribution, use the no form of this command.
redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | static | connected | eigrp as-number} [metric {metric_value | transparent}] [route-map map_name]
no redistribute {{ospf pid [match {internal | external [1 | 2] | nssa-external [1 | 2]}]} | static | connected | eigrp as-number} [metric {metric_value | transparent}] [route-map map_name]
Syntax Description
Defaults
The following are the command defaults:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
•
—
Command History
7.2(1)
This command was introduced.
8.0(2)
This command was modified to include the eigrp keyword.
9.0(1)
Multiple context mode is supported.
Examples
The following example shows how to redistribute static routes into the current RIP process:
hostname(config)# router riphostname(config-rtr)# network 10.0.0.0hostname(config-rtr)# redistribute static metric 2Related Commands
redundant-interface
To set which member interface of a redundant interface is active, use the redundant-interface command in privileged EXEC mode.
redundant-interface redundantnumber active-member physical_interface
Syntax Description
Defaults
By default, the active interface is the first member interface listed in the configuration, if it is available.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
To view which interface is active, enter the following command:
hostname# show interface redundantnumber detail | grep MemberFor example:
hostname# show interface redundant1 detail | grep MemberMembers GigabitEthernet0/3(Active), GigabitEthernet0/2Examples
The following example creates a redundant interface. By default, gigabitethernet 0/0 is active because it is first in the configuration. The redundant-interface command sets gigabitethernet 0/1 as the active interface.
hostname(config-if)# interface redundant 1hostname(config-if)# member-interface gigabitethernet 0/0hostname(config-if)# member-interface gigabitethernet 0/1hostname(config-if)# redundant-interface redundant1 active-member gigabitethernet0/1Related Commands
regex
To create a regular expression to match text, use the regex command in global configuration mode. To delete a regular expression, use the no form of this command.
regex name regular_expression
no regex name [regular_expression]
Syntax Description
name
Specifies the regular expression name, up to 40 characters in length.
regular_expression
Specifies the regular expression up to 100 characters in length. See "Usage Guidelines" for a list of metacharacters you can use in the regular expression.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The regex command can be used for various features that require text matching. For example, you can configure special actions for application inspection using Modular Policy Framework using an inspection policy map (see the policy map type inspect command). In the inspection policy map, you can identify the traffic you want to act upon by creating an inspection class map containing one or more match commands or you can use match commands directly in the inspection policy map. Some match commands let you identify text in a packet using a regular expression; for example, you can match URL strings inside HTTP packets. You can group regular expressions in a regular expression class map (see the class-map type regex command).
A regular expression matches text strings either literally as an exact string, or by using metacharacters so you can match multiple variants of a text string. You can use a regular expression to match the content of certain application traffic; for example, you can match body text inside an HTTP packet.
Note
Table 41-1 lists the metacharacters that have special meanings.
To test a regular expression to make sure it matches what you think it will match, enter the test regex command.
The regular expression performance impact is determined by two main factors:
•
The regular expression engine has only a small impact to the ASA performance when the search length is small.
•
How the Search Length Impacts Performance
When you configure a regular expression search, every byte of the searched text is usually examined against a regular expression database to find a match. The longer the searched text is, the longer the search time will be. Below is a performance test case which illustrates this phenomenon.
•
•
•
When a policy is configured to search the URI and the body in the HTTP GET request only, the throughput is:
•
•
But when a policy is configured to also search the whole HTTP response body, the throughput drops down to 145 mbps because of the long response body (3250 bytes) search.
Following is a list of factors that will increase the length of text for a regular expression search:
•
•
How the Number of Chained Regular Expression Tables Impact Performance
Currently, all regular expressions that are configured for the same protocol field, such as all regular expressions for URI, are built into a database consisting of one or more regular expression chained tables. The number of tables is determined by the total memory required and the availability of memory at the time the tables are built. A regular expression database will be split into multiple tables under any of the following conditions:
•
•
With multiple chained tables, each table must be searched for regular expression matches and hence the search time increases in proportion to the number of tables that are searched.
Certain types of regular expressions tend to increase the table size significantly. It is prudent to design regular expressions in a way to avoid wildcard and repeating factors if possible. See Table 41-1 for a description of the following metacharacters:
•
–
•
–
–
–
•
–
–
–
•
–
–
–
–
–
The following examples illustrate how memory consumptions are different for regular expressions with and without wildcards and repetition.
•
regex r1 "q3rfict9(af.*12)*ercvdf"regex r2 "qtaefce.*qeraf.*adasdfev"regex r3 "asdfdfdfds.*wererewr0e.*aaaxxxx.*xxx"regex r4 "asdfdfdfds.*wererewr0e.*afdsvcvr.*aefdd"•
regex s1 "abcde"regex s2 "12345"regex s3 "123xyz"regex s4 "xyz123"A large number of regular expressions will increase the total memory that is needed for the regular expression database and hence increases the probabilities of more tables if memory is fragmented. Following are examples of memory consumptions for different numbers of regular expressions:
•
•
•
Note
The debug menu regex 40 10 command can be used to display how many chained tables there are in each regex database.
Examples
The following example creates two regular expressions for use in an inspection policy map:
hostname(config)# regex url_example example\.comhostname(config)# regex url_example2 example2\.comRelated Commands
reload
To reboot and reload the configuration, use the reload command in privileged EXEC mode.
reload [at hh:mm [month day | day month]] [cancel] [in [hh:]mm] [max-hold-time [hh:]mm] [noconfirm] [quick] [reason text] [save-config]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command.
Privileged EXEC
•
•
•
—
•
Command History
7.0(1)
This command was modified to add the following new arguments and keywords: day, hh, mm, month, quick, save-config, and text.
9.1(3)
The save-show-tech keyword was added.
Usage Guidelines
The command lets you reboot the ASA and reload the configuration from flash memory.
By default, the reload command is interactive. The ASA first checks whether the configuration has been modified but not saved. If so, the ASA prompts you to save the configuration. In multiple context mode, the ASA prompts for each context with an unsaved configuration. If you specify the save-config keyword, the configuration is saved without prompting you. The ASA then prompts you to confirm that you really want to reload the system. Only a response of y or pressing the Enter key causes a reload. After confirmation, the ASA starts or schedules the reload process, depending on whether you have specified a delay keyword (in or at).
By default, the reload process operates in "graceful" mode. All registered subsystems are notified when a reboot is about to occur, allowing these subsystems to shut down properly before the reboot. To avoid waiting until for such a shutdown to occur, specify the max-hold-time keyword to specify a maximum time to wait. Alternatively, you can use the quick keyword to force the reload process to begin abruptly, without notifying the affected subsystems or waiting for a graceful shutdown.
You can force the reload command to operate noninteractively by specifying the noconfirm keyword. In this case, the ASA does not check for an unsaved configuration unless you have specified the save-config keyword. The ASA does not prompt you for confirmation before rebooting the system. It starts or schedules the reload process immediately, unless you have specified a delay keyword, although you can specify the max-hold-time or quick keyword to control the behavior or the reload process.
Use the reload cancel command to cancel a scheduled reload. You cannot cancel a reload that is already in progress.
Note
Examples
The following example shows how to reboot and reload a configuration:
hostname# reloadProceed with ? [confirm]yRebooting...XXXBios VX.X...Related Commands
remote-access threshold session-threshold-exceeded
To set threshold values, use the remote-access threshold command in global configuration mode. To remove threshold values, use the no version of this command. This command specifies the number of active remote access sessions, at which point the ASA sends traps.
remote-access threshold session-threshold-exceeded {threshold-value}
no remote-access threshold session-threshold-exceeded
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Examples
The following example shows how to set a threshold value of 1500:
hostname# remote-access threshold session-threshold-exceeded 1500Related Commands
rename
To rename a file or a directory from the source filename to the destination filename, use the rename command in privileged EXEC mode.
rename [/noconfirm] [disk0: | disk1: | flash:] source-path [disk0: | disk1: | flash:] destination-path
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
The rename flash: flash: command prompts you to enter a source and destination filename.
You cannot rename a file or directory across file systems.
For example:
hostname# rename flash: disk1:Source filename []? new-configDestination filename []? old-config%Cannot rename between filesystemsExamples
The following example shows how to rename a file named "test" to "test1":
hostname# rename flash: flash:Source filename [running-config]? testDestination filename [n]? test1Related Commands
mkdir
Creates a new directory.
rmdir
Removes a directory.
show file
Displays information about the file system.
rename (class-map)
To rename a class map, enter the rename command in class-map configuration mode.
rename new_name
Syntax Description
new_name
Specifies the new name of the class map, up to 40 characters in length. The name "class-default" is reserved.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class-map configuration
•
•
•
•
—
Command History
Examples
The following example shows how to rename a class map from test to test2:
hostname(config)# class-map testhostname(config-cmap)# rename test2Related Commands
renewal-reminder
To specify the number of days before user certificate expiration that an initial reminder to re-enroll is sent to certificate owners, use the renewal-reminder command in ca server configuration mode. To reset the time to the default of 14 days, use the no form of this command.
renewal-reminder days
no renewal-reminder
Syntax Description
days
Specifies the time in days before the expiration of an issued certificate that the certificate owner is first reminded to re-enroll. Valid values range from 1 to 90 days.
Defaults
The default value is 14 days.
Command Modes
The following table shows the modes in which you can enter the command:
ca server configuration
•
—
•
—
—
Command History
Usage Guidelines
There are three reminders in all. An e-mail is sent automatically to the certificate owner for each of the three reminders if an e-mail address is specified in the user database. If no e-mail address exists, a syslog message is generated to alert the administrator of the renewal.
By default, the CA server sends the following three e-mail messages in the specified order before certificate expiration:
1.
2.
3.
The first e-mail is the invitation, the second e-mail is a reminder, and the third e-mail is a final reminder. The default setting for this notification is 14 days, which means that the initial invitation goes out 14 days before certificate expiration, the reminder e-mail goes out 7 days before certificate expiration, and the final reminder e-mail goes out 3 days before certificate expiration.
You can customize the renewal-reminder interval using the renewal-reminder days command.
Examples
The following example specifies that the ASA send an expiration notice to users 7 days before certificate expiration:
hostname(config)# crypto ca serverhostname(config-ca-server)# renewal-reminder 7hostname(config-ca-server)#The following example resets the expiration notice time to the default of 14 days before certificate expiration:
hostname(config)# crypto ca serverhostname(config-ca-server)# no renewal-reminderhostname(config-ca-server)#Related Commands
replication http
To enable HTTP connection replication for the failover group, use the replication http command in failover group configuration mode. To disable HTTP connection replication, use the no form of this command.
replication http
no replication http
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Failover group configuration
•
•
—
—
•
Command History
Usage Guidelines
By default, the ASA does not replicate HTTP session information when Stateful Failover is enabled. Because HTTP sessions are typically short-lived, and because HTTP clients typically retry failed connection attempts, not replicating HTTP sessions increases system performance without causing serious data or connection loss. The replication http command enables the stateful replication of HTTP sessions in a Stateful Failover environment, but could have a negative effect on system performance.
This command is available for Active/Active failover only. It provides the same functionality as the failover replication http command for Active/Standby failover, except for failover groups in Active/Active failover configurations.
Examples
The following example shows a possible configuration for a failover group:
hostname(config)# failover group 1hostname(config-fover-group)# primaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# replication httphostname(config-fover-group)# exitRelated Commands
failover group
Defines a failover group for Active/Active failover.
failover replication http
Configures stateful failover to replicate HTTP connections.
request-command deny
To disallow specific commands within FTP requests, use the request-command deny command in FTP map configuration mode, which is accessible by using the ftp-map command. To remove the configuration, use the no form of this command.
request-command deny { appe | cdup | dele | get | help | mkd | put | rmd | rnfr | rnto | site | stou }
no request-command deny { appe | cdup | help | retr | rnfr | rnto | site | stor | stou }
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
FTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is used for controlling the commands allowed within FTP requests traversing the ASA when using strict FTP inspection.
Examples
The following example causes the ASA to drop FTP requests containing stor, stou, or appe commands:
hostname(config)# ftp-map inbound_ftphostname(config-ftp-map)# request-command deny put stou appeRelated Commands
request-data-size
To set the size of the payload in the SLA operation request packets, use the request-data-size command in sla monitor protocol configuration mode. To restore the default value, use the no form of this command.
request-data-size bytes
no request-data-size
Syntax Description
Defaults
The default bytes is 28.
Command Modes
The following table shows the modes in which you can enter the command:
sla monitor protocol configuration
•
—
•
—
—
Command History
Usage Guidelines
For reachability, it may be necessary to increase the default data size to detect PMTU changes between the source and the target. Low PMTU will likely affect session performance and, if detected, may indicate that the secondary path be used.
Examples
The following example configures an SLA operation with an ID of 123 that uses an ICMP echo request/response time probe operation. It sets the payload size of the echo request packets to 48 bytes and the number of echo requests sent during an SLA operation to 5.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# num-packets 5hostname(config-sla-monitor-echo)# request-data-size 48hostname(config-sla-monitor-echo)# timeout 4000hostname(config-sla-monitor-echo)# threshold 2500hostname(config-sla-monitor-echo)# frequency 10hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
request-queue
To specify the maximum number of GTP requests that will be queued waiting for a response, use the request-queue command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no form of this command to return this number to the default of 200.
request-queue max_requests
no request-queue max_requests
Syntax Description
max_requests
The maximum number of GTP requests that will be queued waiting for a response. The range values is 1 to 4294967295.
Defaults
The max_requests default is 200.
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
The gtp request-queue command specifies the maximum number of GTP requests that are queued waiting for a response. When the limit has been reached and a new request arrives, the request that has been in the queue for the longest time is removed. The Error Indication, the Version Not Supported and the SGSN Context Acknowledge messages are not considered as requests and do not enter the request queue to wait for a response.
Examples
The following example specifies a maximum request queue size of 300 bytes:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)# request-queue-size 300Related Commands
request-timeout
To configure the number of seconds before a failed SSO authentication attempt times out, use the request-timeout command in webvpn configuration mode.
To return to the default value, use the no form of this command.
request-timeout seconds
no request-timeout
Syntax Description
Syntax DescriptionSyntax Description
seconds
The number of seconds before a failed SSO authentication attempt times out. The range is 1 to 30 seconds. Fractions are not supported.
Defaults
The default value for this command is 5 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
—
•
—
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The ASA currently supports SiteMinder and SAML POST type SSO servers.
This command applies to both types of SSO Servers.
Once you have configured the ASA to support SSO authentication, you have the option to adjust two timeout parameters:
•
•
Examples
The following example, entered in webvpn-config-sso-siteminder mode, configures an authentication timeout at ten seconds for the SiteMinder type SSO server, "example":
hostname(config-webvpn)# sso-server example type siteminderhostname(config-webvpn-sso-siteminder)# request-timeout 10Related Commands
reserve-port-protect
To restrict usage on the reserve port during media negotiation, use the reserve-port-protect command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
reserve-port-protect
no reserve-port-protect
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to protect the reserve port in an RTSP inspection policy map:
hostname(config)# policy-map type inspect rtsp rtsp_maphostname(config-pmap)# parametershostname(config-pmap-p)# reserve-port-protectRelated Commands
reserved-bits
To clear reserved bits in the TCP header, or drop packets with reserved bits set, use the reserved-bits command in tcp-map configuration mode. To remove this specification, use the no form of this command.
reserved-bits {allow | clear | drop}
no reserved-bits {allow | clear | drop}
Syntax Description
allow
Allows packet with the reserved bits in the TCP header.
clear
Clears the reserved bits in the TCP header and allows the packet.
drop
Drops the packet with the reserved bits in the TCP header.
Defaults
The reserved bits are allowed by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the reserved-bits command in tcp-map configuration mode to remove ambiguity as to how packets with reserved bits are handled by the end host, which may lead to desynchronizing the ASA. You can choose to clear the reserved bits in the TCP header or even drop packets with the reserved bits set.
Examples
The following example shows how to clear packets on all TCP flows with the reserved bit set:
hostname(config)# access-list TCP extended permit tcp any anyhostname(config)# tcp-map tmaphostname(config-tcp-map)# reserved-bits clearhostname(config)# class-map cmaphostname(config-cmap)# match access-list TCPhostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
reset
When using the Modular Policy Framework, drop packets, close the connection, and send a TCP reset for traffic that matches a match command or class map by using the reset command in match or class configuration mode. This reset action is available in an inspection policy map (the policy-map type inspect command) for application traffic; however, not all applications allow this action. To disable this action, use the no form of this command.
reset [log]
no reset [log]
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Match and class configuration
•
•
•
•
—
Command History
Usage Guidelines
An inspection policy map consists of one or more match and class commands. The exact commands available for an inspection policy map depends on the application. After you enter the match or class command to identify application traffic (the class command refers to an existing class-map type inspect command that in turn includes match commands), you can enter the reset command to drop packets and close the connection for traffic that matches the match command or class command.
If you reset a connection, then no further actions are performed in the inspection policy map. For example, if the first action is to reset the connection, then it will never match any further match or class commands. If the first action is to log the packet, then a second action, such as resetting the connection, can occur. You can configure both the reset and the log action for the same match or class command, in which case the packet is logged before it is reset for a given match.
When you enable application inspection using the inspect command in a Layer 3/4 policy map (the policy-map command), you can enable the inspection policy map that contains this action, for example, enter the inspect http http_policy_map command where http_policy_map is the name of the inspection policy map.
Examples
The following example resets the connection and sends a log when they match the http-traffic class map. If the same packet also matches the second match command, it will not be processed because it was already dropped.
hostname(config-cmap)# policy-map type inspect http http-map1hostname(config-pmap)# class http-traffichostname(config-pmap-c)# reset loghostname(config-pmap-c)# match req-resp content-type mismatchhostname(config-pmap-c)# reset logRelated Commands
