-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
show uauth through show xlate Commands
show user-identity ad-group-members
show user-identity statistics top user
show user-identity user active
show user-identity user inactive
show user-identity user-not-found
show user-identity user-of-group
show vpn-sessiondb license-summary
show uauth through show xlate Commands
show uauth
To display one or all currently authenticated users, the host IP to which they are bound, and any cached IP and port authorization information, use the show uauth command in privileged EXEC mode.
show uauth [username]
Syntax Description
username
(Optional) Specifies, by username, the user authentication and authorization information to display.
Defaults
Omitting username displays the authorization information for all users.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
7.0(1)
This command was introduced.
7.2(1)
The idle time was added to the output.
7.2(2)
The idle time was removed from the output.
Usage Guidelines
The show uauth command displays the AAA authorization and authentication caches for one user or for all users.
This command is used with the timeout command.
Each user host IP address has an authorization cache attached to it. The cache allows up to 16 address and service pairs for each user host. If the user attempts to access a service that has been cached from the correct host, the ASA considers it preauthorized and immediately proxies the connection. Once you are authorized to access a website, for example, the authorization server is not contacted for each image as it is loaded (assuming the images come from the same IP address). This process significantly increases performance and reduces the load on the authorization server.
The output from the show uauth command displays the username that is provided to the authorization server for authentication and authorization purposes, the IP address to which the username is bound, and if the user is authenticated only or has cached services.
Note
Use the timeout uauth command to specify how long the cache should be kept after the user connections become idle. Use the clear uauth command to delete all the authorization caches for all the users, which will cause them to have to reauthenticate the next time that they create a connection.
Examples
This example shows sample output from the show uauth command when no users are authenticated and one user authentication is in progress:
hostname(config)# show uauthCurrent Most SeenAuthenticated Users 1 1Authen In Progress 0 1user 'v039294' at 136.131.178.4, authenticated (idle for 0:00:00)access-list #ACSACL#-IP-v039294-521b0b8b (*)absolute timeout: 0:00:00inactivity timeout: 0:05:00This example shows sample output from the show uauth command when three users are authenticated and authorized to use services through the ASA:
hostname(config)# show uauthuser `pat' from 209.165.201.2 authenticateduser `robin' from 209.165.201.4 authorized to:port 192.168.67.34/telnet 192.168.67.11/http 192.168.67.33/tcp/8001192.168.67.56/tcp/25 192.168.67.42/ftpuser `terry' from 209.165.201.7 authorized to:port 192.168.1.50/http 209.165.201.8/httpRelated Commands
clear uauth
Remove current user authentication and authorization information.
timeout
Set the maximum idle time duration.
show url-block
To display the number of packets held in the url-block buffer and the number (if any) dropped due to exceeding the buffer limit or retransmission, use the show url-block command in privileged EXEC mode.
show url-block [block statistics]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show url-block block statistics command displays the number of packets held in the url block buffer and the number (if any) dropped due to exceeding the buffer limit or retransmission.
Examples
The following is sample output from the show url-block command:
hostname# show url-block| url-block url-mempool 128 | url-block url-size 4 | url-block block 128This shows the configuration of the URL block buffer.
The following is sample output from the show url-block block statistics command:
hostname# show url-block block statisticsURL Pending Packet Buffer Stats with max block 128 |Cumulative number of packets held: | 896Maximum number of packets held (per URL): | 3Current number of packets held (global): | 38Packets dropped due to| exceeding url-block buffer limit: | 7546| HTTP server retransmission: | 10Number of packets released back to client: | 0Related Commands
show url-cache statistics
To display information about the url-cache, which is used for URL responses received from an N2H2 or Websense filtering server, use the show url-cache statistics command in privileged EXEC mode.
show url-cache statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show url-cache statistics command displays the following entries:
•
•
•
•
•
You can view additional information about N2H2 Sentian or Websense filtering activity with the show perfmon command.
Examples
The following is sample output from the show url-cache statistics command:
hostname# show url-cache statisticsURL Filter Cache Stats----------------------| Size : 1KBEntries : 36In Use : 30Lookups : 300| Hits : 290Related Commands
show url-server
To display information about the URL filtering server, use the show url-server command in privileged EXEC mode.
show url-server statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show url-server statistics command displays the URL server vendor; number of URLs total, allowed, and denied; number of HTTPS connections total, allowed, and denied; number of TCP connections total, allowed, and denied; and the URL server status.
The show url-server command displays the following information:
•
•
Examples
The following is sample output from the show url-server statistics command:
hostname## show url-server statisticsGlobal Statistics:------------------URLs total/allowed/denied 994387/155648/838739URLs allowed by cache/server 70483/85165URLs denied by cache/server 801920/36819HTTPSs total/allowed/denied 994387/155648/838739HTTPs allowed by cache/server 70483/85165HTTPs denied by cache/server 801920/36819FTPs total/allowed/denied 994387/155648/838739FTPs allowed by cache/server 70483/85165FTPs denied by cache/server 801920/36819Requests dropped 28715Server timeouts/retries 567/1350Processed rate average 60s/300s 1524/1344 requests/secondDenied rate average 60s/300s 35648/33022 requests/secondDropped rate average 60s/300s 156/189 requests/secondURL Server Statistics:----------------------192.168.0.1 UPVendor websensePort 17035Requests total/allowed/denied 366519/255495/110457Server timeouts/retries 567/1350Responses received 365952Response time average 60s/300s 2/1 seconds/request192.168.0.2 DOWNVendor websensePort 17035Requests total/allowed/denied 0/0/0Server timeouts/retries 0/0Responses received 0Response time average 60s/300s 0/0 seconds/request. . .URL Packets Sent and Received Stats:------------------------------------Message Sent ReceivedSTATUS_REQUEST 411 0LOOKUP_REQUEST 366519 365952LOG_REQUEST 0 NAErrors:-------RFC noncompliant GET method 0URL buffer update failure 0Semantics:This command allows the operator to display url-server statistics organized on a global and per-server basis. The output is reformatted to provide: more-detailed information and per-server organization.Supported Modes:privilegedrouter || transparentsingle || multi/contextPrivilege:ATTR_ES_CHECK_CONTEXTDebug support:N/AMigration Strategy (if any):N/ARelated Commands
show user-identity ad-agent
To display information about the AD Agent for the Identify Firewall, use the show user-identity ad-agent command in privileged EXEC mode.
show user-identity ad-agent [statistics]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You can monitor the AD Agent component of the Identity Firewall.
Use the show user-identity ad-agent command to obtain troubleshooting information for the AD Agent. This command displays the following information about the primary and secondary AD Agents:
•
•
•
Examples
This example shows how to display information for the AD Agent for the Identify Firewall:
hostname# show user-identity ad-agentPrimary AD Agent:Status up (registered)Mode: full-downloadIP address: 172.23.62.125Authentication port: udp/1645Accounting port: udp/1646ASA Listening port: udp/3799Interface: mgmtUp time: 15 mins 41 secsAverage RTT: 57 msecSecondary AD Agent:Status upMode: full-downloadIP address: 172.23.62.136Authentication port: udp/1645Accounting port: udp/1646ASA Listening port: udp/3799Interface: mgmtUp time: 7 mins 56 secsAvg RTT: 15 msecRelated Commands
show user-identity ad-group-members
To display the group members in the domain of the AD Agent for the Identify Firewall, use the show user-identity ad-group-members command in privileged EXEC mode.
show user-identity ad-group-members [domain_nickname\]user_group_name [timeout seconds seconds]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show user-identity ad-group-members command displays the immediate members (the users and groups) of the specified user group.
Note
The ASA sends an LDAP query for the Active Directory groups configured on the Active Directory server. Running this command is equivalent to running an LDAP browser command that allows you to check members of a specified user group. ASA issues one level of LDAP query to retrieve the immediate members of the specified group in the distinguishedName format. Running this command does not update the ASA internal cache of imported user groups.
When you do not specify domain_nickname, the ASA displays information for the group that has user_group_name in the default domain. The argument domain_nickname can be the real domain nickname or LOCAL.
The group name is the AD group's unique sAMAccountName not the CN name. To display information for a specific group sAMAccountName, use the show user-identity ad-groups filter filter_string command to retrieve group's sAMAccountName.
Examples
This example shows how to display members of the group sample1 for the Identity Firewall:
hostname# show user-identity ad-group-member group.sample1Domain:CSCO AAA Server Group: CISCO_AD_SERVERGroup Member List Retrieved SuccessfullyNumber of Members in AD Group group.schiang: 12dn: CN=user1,OU=Employees,OU=Cisco Users,DC=cisco,DC=comdn: CN=user2,OU=Employees,OU=Cisco Users,DC=cisco,DC=com...Related Commands
user-identity enable
Creates the Cisco Identify Firewall instance.
show user-identity ad-groups
Displays information about the AD Agent for the Identify Firewall.
show user-identity ad-groups
To display information for a specific group for the Identify Firewall, use the show user-identity ad-groups command in privileged EXEC mode.
show user-identity ad-groups domain_nickname {filter filter_string | import-user-group [count]}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
When you run the show user-identity ad-groups command, the ASA sends an LDAP query to the Microsoft Active Directory to retrieve all user groups that are part of the specified domain nickname. The argument domain_nickname can be the real domain nickname or LOCAL. The ASA only retrieves groups that have the group objectclass attribute. The ASA displays the retrieved groups in distinguishedName format.
When you specify the filter filter_string keyword and argument, the ASA displays groups that contain the specified filter string in the CN attribute of the domain controller. Because the access-list and object-group commands only take sAMAccountName, you can run the show user-identity ad-users filter filter_string command to retrieve the sAMAccountName for a group. When you do not specify filter filter_string, the ASA displays all Active Directory groups.
When you specify the import-user-group count keywords, the ASA displays all Active Directory groups that are activated (because they are part an access-group, import-user-group, or service-policy configuration) and stored in the local database. The ASA only displays the sAMAccountName for the groups.
Examples
These examples show how to display user groups that are part of the specified domain nickname for the Identity Firewall:
hostname# show user-identity ad-groups CSCO filter sampleuser1Domain: CSCO AAA Server Group: CISCO_AD_SERVERGroup list retrieved successfullyNumber of Active Directory Groups 6dn: CN=group.reg.sampleuser1,OU=Organizational,OU=Cisco Groups,DC=cisco,DC=comsAMAccountName: group.reg.sampleuser1dn: CN=group.temp.sampleuser1,OU=Organizational,OU=Cisco Groups,DC=cisco,DC=comsAMAccountName: group.temp.sampleuser1...hostname# show user-identity ad-groups CSCO import-user-group countTotal AD groups in domain CSCO stored in local: 2hostname# show user-identity ad-groups CSCO import-user-groupDomain: CSCOGroups:group.SampleGroup1group.SampleGroup2...This example shows how to run the command to apply a filter string to the results from an access-list and object-group command. Running the show user-identity ad-users CSCO filter SampleGroup1 command obtains the sAMAccountName of specified string:
hostname# show user-identity ad-users CSCO filter SampleGroup1Domain:CSCO AAA Server Group: CISCO_AD_SERVERUser list retrieved successfullyNumber of Active Directory Users: 2dn: CN=SampleUser1,OU=Employees,OU=Cisco Users,DC=cisco,DC=comsAMAccountName: SampleUser2dn: CN=SAMPLEUSER2-WXP05,OU=Workstations,OU=Cisco Computers,DC=cisco,DC=comsAMAccountName: SAMPLEUSER2-WXP05$Related Commands
show user-identity ad-users
To display Microsoft Active Directory users for the Identify Firewall, use the show user-identity ad-users command in privileged EXEC mode.
show user-identity ad-users domain_nickname [filter filter_string]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
When you run the show user-identity ad-users command, the ASA sends an LDAP query to the Microsoft Active Directory to retrieve all users that are part of the specified domain nickname. The argument domain_nickname can be the real domain nickname or LOCAL.
When you specify the filter filter_string keyword and argument, the ASA displays users that contain the specified filter string in the CN attribute of the domain controller. The ASA sends an LDAP query for the Active Directory groups configured on the Active Directory server.
The ASA only retrieves users that have the user objectclass attribute and the samAccountType attribute 805306368. Other objects, such as machine objects, can be included in the user objectclass; however, the samAccountType 805306368 filters out the non-user objects. When you do not specify a filter string, the ASA displays all Active Directory users.
The ASA displays the retrieved users in distinguishedName format.
Examples
This example shows how to display information about Active Directory users for the Identity Firewall:
hostname# show user-identity ad-users CSCO filter userDomain: CSCO AAA Server Group: CISCO_AD_SERVERUser list retrieved successfullyNumber of Active Directory Users: 10dn: CN=sampleuser1,OU=Employees,OU=Cisco Users,DC=cisco,DC=comsAMAccountName: sampleuser1dn: CN=sampleuser2,OU=Employees,OU=Cisco Users,DC=cisco,DC=comsAMAccountName: sampleuser2dn: CN=user3,OU=Employees,OU=Cisco Users,DC=cisco,DC=comsAMAccountName: user3...Related Commands
show user-identity group
To display the user groups configured for the Identify Firewall, use the show user-identity group command in privileged EXEC mode.
show user-identity group
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show user-identity group command to obtain troubleshooting information for the user groups configured for the Identity Firewall. The ASA sends an LDAP query for the Active Directory groups configured on the Active Directory server. This command displays the list of activated user groups in the following format:
domain\group_name
The ASA only displays top groups that are applied to a security policy. The maximum number of activated top groups is 256. Groups are activated when they are part an access-group, import-user-group, or service-policy configuration.
Examples
This example shows how to display the activated groups for the Identity Firewall:
hostname# show user-identity groupGroup ID Activated Group Name (Domain\\Group)-------- ------------------------------------1 LOCAL\\og12 LOCAL\\marketing3 CISCO\\group.sampleuser14 IDFW\\grp1...Related Commands
show user-identity ip-of-user
To display the IP address for a specified user for the Identify Firewall, use the show user-identity ip-of-user command in privileged EXEC mode.
show user-identity ip-of-user [domain_nickname\]user-name [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
This command displays user information and the IP addresses for the specified user. Users can have more than one IP address associated with them.
When you do not specify the domain_nickname argument, the ASA displays information for the user with user_name in default domain. The argument domain_nickname can be the real domain nickname or LOCAL.
When you specify the detail keyword, the ASA displays the total number of active connections, the user-statistics period and the drops, and the input packets and output packets during the period over all IP addresses for the specified user. When you do not specify the detail option, the ASA displays only the domain nickname and status of each IP address.
Note
Examples
These examples show how to display IP addresses of specified users for the Identity Firewall:
hostname# show user-identity ip-of-user sampleuser1CSCO\172.1.1.1 (Login)CSCO\172.100.3.23 (Login)CSCO\10.23.51.3 (Inactive)hostname# show user-identity ip-of-user sampleuser1 detailCSCO\172.1.1.1 (Login) Login time: 1440 mins; Idle time: 10 mins; 2 active connsCSCO\172.100.3.23 (Login) Login time: 20 mins; Idle time: 10 mins; 10 active connsCSCO\10.23.51.3 (Inactive) Login time: 3000 mins; Idle time: 2040 mins; 8 active connsTotal number of active connections: 201-hour recv packets: 125601-hour sent packets: 3256020-min drops: 560hostname# show user-identity ip-of-user sampleuser2ERROR: no such userhostname# show user-identity ip-of-user sampleuser3ERROR: no IP address, user not login nowIPv6 support
hostname# show user-identity ip-of-user sampleuser4CSCO\172.1.1.1 (Login)CSCO\8080:1:3::56 (Login)CSCO\8080:2:3::34 (Inactive)hostname# show user-identity ip-of-user sampleuser4 detailCSCO\172.1.1.1 (Login) Login time: 1440 mins; Idle time: 10 mins; 8 active connsCSCO\8080:1:3::56 (Login) Login time: 20 mins; Idle time: 10 mins; 12 active connsCSCO\8080:2:3::34 (Inactive) Total number of active connections: 201-hour recv packets: 125601-hour sent packets: 3256020-min drops: 560Related Commands
user-identity enable
Creates the Cisco Identify Firewall instance.
show user-identity user-of-ip
Displays the user information associated with the specified IP address
show user-identity memory
To display the memory of various modules of the Identify Firewall, use the show user-identity memory command in privileged EXEC mode.
show user-identity memory
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You can monitor the memory usage that the Identity Firewall consumes on the ASA. Running the show user-identity memory command displays the memory for user records, group records, host records, and their associated hash table. The ASA also displays the memory used by the identity-based tmatch table.
The command displays the memory usage in bytes of various modules in the Identity Firewall:
•
•
•
•
The ASA sends an LDAP query for the Active Directory groups configured on the Active Directory server. The Active Directory server authenticates users and generates user logon security logs.
•
•
•
How you configure the Identity Firewall to retrieve user information from the AD Agent impacts the amount of memory used by the feature. You specify whether the ASA uses on demand retrieval or full download retrieval. Selecting On Demand has the benefit of using less memory as only users of received packets are queried and stored. See "Configuring Identity Options" in the CLI configuration guide for a description of these options.
Examples
This example shows how to display the memory status of the modules of the Identity Firewall:
hostname# show user-identity memoryUsers: 22416048 bytesGroups: 320 bytesUser stats: 0 bytesLDAP: 300 bytesAD agent: 500 bytesMisc: 32428 bytesTotal: 22449596 bytesUsers: 22416048 bytesRelated Commands
show user-identity statistics
To display statistics for a user or user group for the Identify Firewall, use the show user-identity statistics command in privileged EXEC mode.
show user-identity statistics [user [domain_nickname\]user_name | user-group [domain_nickname\]user_group_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Run the show user-identity statistics command to display the statistics for a user or user group.
When you do not specify the domain_nickname argument with the user keyword, the ASA displays information for the user with user_name in default domain.
When you do not specify domain_nickname with the user-group keyword, the ASA displays information for the group that has user_group_name in the default domain. The argument domain_nickname can be the real domain nickname or LOCAL.
Examples
These examples show how to display statistics about users for the Identity Firewall:
hostname# show user-identity statistics userCurrent monitored users:11 Total not monitored users:0Average(eps) Current(eps) Trigger Total eventsUser: CSCO\user1 tot-ses:4911 act-ses:1213 fw-drop:0 insp-drop:0 null-ses:4861 bad-acc:020-min Recv attack: 4 10 14 48611-hour Recv pkts: 1 10 0 4901User: CSCO\user2 tot-ses:2456 act-ses:607 fw-drop:0 insp-drop:0 null-ses:2431 bad-acc:020-min Sent attack: 4 10 4 48621-hour Sent pkts: 0 5 0 2451...hostname# show user-identity statistics user user1Current Average(eps) Current(eps) Trigger Total eventsUser: -(user1-) tot-ses:4911 act-ses:1213 fw-drop:0 insp-drop:0 null-ses:4861 bad-acc:020-min Recv attack: 4 10 14 48611-hour Recv pkts: 1 10 0 4901Related Commands
show user-identity statistics top user
To display statistics for the top 10 users for the Identify Firewall, use the show user-identity statistics top user command in privileged EXEC mode.
show user-identity statistics top user
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show user-identity statistics top user command displays statistics for received EPS packets, sent EPS packets, and sent attacks for the top 10 users. For each user (displayed as domain\user_name), the ASA displays the average EPS packet, the current EPS packet, the trigger, and total events for that user.
Examples
This example shows how to display information about the top 10 users for the Identity Firewall:
hostname# show user-identity statistics top userTop Name Id Average(eps) Current(eps) Trigger Total events1-hour Recv pkts:01 APAC\sampleuser10 0 0 3911-hour Sent pkts:01 APAC\sampleuser20 0 0 19602 CSCO\sampleuser30 0 0 19510-min Sent attack:01 CSCO\sampleuser40 0 0 35202 CSCO\sampleuser30 0 0 350Related Commands
show user-identity user active
To display the active users for the Identify Firewall, use the show user-identity user active command in privileged EXEC mode.
show user-identity user active [domain domain_nickname | user-group [domain_nickname\]user_group_name | user [domain_nickname\]user_name] [list [detail]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You can display information about all users contained in the IP-user mapping database used by the Identity Firewall.
The show user-identity user active command displays the following information for users:
•
•
•
The default domain name can be the real domain name, a special reserved word, or LOCAL. The Identity Firewall uses the LOCAL domain name for all locally defined user groups or locally defined users (users who log in and authenticate by using a VPN or web portal). When default domain is not specified, the default domain is LOCAL.
A user's name is appended with the number of minutes idle. The login time and idle time are stored on a per user basis instead of per the IP address of a user.
When the user-group keyword is specified, only the activated user-groups are displayed. Groups are activated when they are part an access-group, import-user-group, or service-policy configuration.
When you do not specify domain_nickname with the user-group keyword, the ASA displays information for the group that has user_group_name in the default domain.
Note
Note
Examples
The following examples show how to display information about active users for the Identity Firewall:
hostname# show user-identity user activeTotal active users: 30 Total IP addresses: 35LOCAL: 0 users, 0 IP addressescisco.com: 0 users, 0 IP addressesd1: 0 users, 0 IP addressesIDFW: 0 users, 0 IP addressesidfw.com: 0 users, 0 IP addressesIDFWTEST: 30 users, 35 IP addresseshostname# show user-identity user active domain CSCOTotal active users: 48020 Total IP addresses:10000CSCO: 48020 users, 10000 IP addresseshostname# show user-identity user active domain CSCO listTotal active users: 48020 Total IP addresses: 10000CSCO: 48020 users, 10000 IP addressesCSCO\sampleuser1: 20 active conns; idle 0 minsCSCO\member-1: 20 active conns; idle 5 minsCSCO\member-2: 20 active conns; idle 20 minsCSCO\member-3: 3 active conns; idle 101 mins...hostname# show user-identity user active listTotal active users: 48032 Total IP addresses: 10000CSCO\sampleuser1: 20 active conns; idle 0 minsCSCO\member-1: 20 active conns; idle 6 minsAPAC\sampleuser2: 20 active conns; idle 0 minsCSCO\member-2: 20 active conns; idle 1 minsCSCO\member-3: 20 active conns; idle 0 minsAPAC\member-2: 20 active conns; idle 22 minsCSCO\member-4: 3 active conns; idle 101 mins...hostname# show user-identity user active list detailTotal active users: 48032 Total IP addresses: 10010CSCO: 48020 users, 10000 IP addressesAPAC: 12 users, 10 IP addressesCSCO\sampleuser1: 20 active conns; idle 0 mins172.1.1.1: login 360 mins, idle 0 mins, 15 active conns172.100.3.23: login 200 min, idle 15 mins , 5 active conns10.23.51.3: inactive1-hour recv packets: 125601-hour sent packets: 3256020-min drops: 560CSCO\member-1: 4 active connections; idle 350 mins...APAC\sampleuser12: 3 active conns; idle 101 mins172.1.1.1: login 360 mins, idle 101 mins, 1 active conns172.100.3.23: login 200 min, idle 150 mins, 2 active conns10.23.51.3: inactive1-hour recv packets: 125601-hour sent packets: 3256020-min drops: 560hostname# show user-identity user active list detailTotal users: 25 Total IP addresses: 5LOCAL\idfw: 0 active conns6.1.1.1: inactivecisco.com\sampleuser1: 0 active connscisco.com\sampleuser2: 0 active connscisco.com\sampleuser3: 0 active conns20.0.0.3: login 0 mins, idle 0 mins, 0 active conns (disabled)cisco.com\sampleuser4: 0 active conns; idle 0 mins20.0.0.2: login 0 mins, idle 0 mins, 0 active conns (disabled)cisco.com\sampleuser5: 0 active conns...hostname# show user-identity user active user sampleuser1 list detailCSCO\sampleuser1: 20 active conns; idle 3 mins172.1.1.1: login 360 mins, idle 20 mins, 15 active conns172.100.3.23: login 200 mins, idle 3 mins, 5 active conns10.23.51.3: inactive1-hour recv packets: 125601-hour sent packets: 3256020-min drops: 560hostname# show user-identity user active user APAC\sampleuser2APAC\sampleuser2: 20 active conns; idle 2 minshostname# show user-identity user active user-group APAC\\marketing listAPAC\sampleuser1: 20 active conns; idle 2 minsAPAC\member-1: 20 active conns; idle 0 minsAPAC\member-2: 20 active conns; idle 0 minsAPAC\member-3: 20 active conns; idle 6 mins...hostname# show user-identity user active user-group APAC\\inactive listERROR: group is not activatedRelated Commands
show user-identity user all
To display statistics about users for the Identify Firewall, use the show user-identity user all command in privileged EXEC mode.
show user-identity user all [list] [detail]
Syntax Description
detail
(Optional) Displays the detailed output about all users for the Identity Firewall.
list
(Optional) Displays a list summarizing the statistics for all users for the Identity Firewall.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show user-identity all command to display information for all users contained in the IP-user mapping database used by the Identity Firewall.
When you include the detail keyword with this command and the command output shows an IP address is inactive, the IP address is not associated with the user. Searching for the user associated with that IP address will return an error.
Note
Note
Examples
The following examples show how to display statistics about all users for the Identity Firewall:
hostname# show user-identity user all listTotal inactive users: 1201 Total IP addresses: 100hostname# show user-identity user all listTotal users: 7LOCAL\idfw: 0 active connscisco.com\sampleuser1: 0 active connscisco.com\sampleuser2: 0 active connscisco.com\sampleuser3: 0 active connscisco.com\sampleuser4: 0 active conns; idle 300 minscisco.com\sampleuser5: 0 active connscisco.com\sampleuser6: 0 active connscisco.com\sampleuser7: 0 active connshostname# show user-identity user all list detailTotal users: 7 Total IP addresses: 3LOCAL\idfw: 0 active conns10.1.1.1: inactivecisco.com\sampleuser1: 0 active connscisco.com\sampleuser2: 0 active connscisco.com\sampleuser3: 0 active conns; idle 300 mins171.69.42.8: inactive10.0.0.2: login 300 mins, idle 300 mins, 5 active connscisco.com\sampleuser4: 0 active connscisco.com\sampleuser5: 0 active connscisco.com\sampleuser6: 0 active conns1-hour recv packets: 125601-hour sent packets: 3256020-min drops: 560Related Commands
show user-identity user inactive
To display information about the inactive users for the Identify Firewall, use the show user-identity user inactive command in privileged EXEC mode.
show user-identity user inactive [domain domain_nickname | user-group [domain_nickname\]user_group_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show user-identity user inactive command to display information about users who have no active traffic for longer than the value configured with the user-identity inactive-user-timer command.
When the user-group keyword is specified, only the activated user-groups are displayed. Groups are activated when they are part an access-group, import-user-group, or service-policy configuration.
When you do not specify domain_nickname with the user-group keyword, the ASA displays information for the group that has user_group_name in the default domain. The argument domain_nickname can be the real domain nickname or LOCAL.
Examples
These examples show how to display the status of inactive users for the Identity Firewall:
hostname# show user-identity user inactiveTotal inactive users: 1201APAC\sampleuser1CSCO\sampleuser2172.1.1.1: inactive ......hostname# show user-identity user inactive domain CSCOTotal inactive users: 1101CSCO: 1101CSCO\sampleuser1CSCO\sampleuser2CSCO\sampleuser3...hostname# show user-identity user inactive user-group CSCO\\marketingTotal inactive users: 21CSCO\sampleuser1CSCO\sampleuser2...Related Commands
show user-identity user-not-found
To display the IP addresses of the Active Directory users not found for the Identify Firewall, use the show user-identity user-not-found command in privileged EXEC mode.
show user-identity user-not-found
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show user-identity user-not-found command to display the IP addresses of the users who are not found in Microsoft Active Directory.
The ASA maintains a local user-not-found database of these IP addresses. The ASA keeps only the last 1024 packets (contiguous packets from the same source IP address are treated as one packet) of the user-not-found list and not the entire list in the database.
Examples
This example shows how to display information about not-found users for the Identity Firewall:
hostname# show user-identity user-not-found172.13.1.2171.1.45.5169.1.1.2172.13.12...Related Commands
show user-identity user-of-group
To display the users of a specified user group for the Identify Firewall, use the show user-identity user-of-group command in privileged EXEC mode.
show user-identity user-of-group [domain_nickname\]user_group_name
Syntax Description
domain_nickname
Specifies the domain name for the Identity Firewall.
user_group_name
Specifies the user group for which to display statistics.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show user-identity user-of-group command to display users whose group ID matches the specified user group. (The ASA scans the IP-user hash list for this information and rather than sending an LDAP query to Active Directory. The AD Agent maintains a cache of user ID and IP address mappings and notifies the ASA of changes.)
The user group name you specify must be activated, meaning the group is an import user group (defined as a user group in an access list or service policy configuration) or a local user group (defined in an object-group user).
The group can have more than one user member. The members of the user group are all immediate members (including users and groups) of the specified group.
When you do not specify domain_nickname with the user_group_name argument, the ASA displays information for the group that has user_group_name in the default domain. The argument domain_nickname can be the real domain nickname or LOCAL.
When the command out put indicates a user's status is inactive, the user can be logged out or has never logged in.
Examples
These examples show how to display users of a specified user group for the Identity Firewall:
hostname# show user-identity user-of-group group.samplegroup1Group: CSCO\\group.user1 Total users: 13CSCO\user2 10.0.0.10(Login) 20.0.0.10(Inactive) ...CSCO\user3 10.0.0.11(Inactive)CSCO\user4 10.0.0.12 (Login)CSCO\user5 10.0.0.13 (Login)CSCO\user6 10.0.0.14 (Inactive)....hostname# show user-identity user-of-group group.local1Group: LOCAL\\group.local1 Total users: 2CSCO\user1 10.0.4.12 (Login)LOCAL\user2 10.0.3.13 (Login)Related Commands
show user-identity user-of-ip
To display information about a user with a specific IP address for the Identify Firewall, use the show user-identity user-of-ip command in privileged EXEC mode.
show user-identity user-of-ip ip_address [detail]
Syntax Description
detail
(Optional) Displays the detailed output about user with the specified IP address.
ip_address
Indicates the IP address of the user for which to display information.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show user-identity user-of-ip command to display the user information associated with the specified IP address.
When you specify the detail keyword, the ASA displays user login time, idle time, the number of active connections, the user-statistics period and the drops, and the input packets and output packets during the period. When you do not specify the detail keyword, the ASA only displays the domain nickname, user name, and status.
When user status is inactive, the user can be logged out or has never logged in.
When you include the detail keyword with this command and the command output for an IP address displays an error, the IP address is inactive, meaning that the IP address is not associated with a user.
Note
Examples
These examples show how to display the status of the active users for the Identity Firewall:
hostname# show user-identity user-of-ip 172.1.1.1CSCO\sampleuser1 (Login)hostname# show user-identity user-of-ip 172.1.1.1 detailCSCO\sampleuser1 (Login) Login time: 240 mins; Idle time: 10 minsNumber of active connections: 201-hour sent packets: 36781-hour rcvd packets: 125620-min sent drops: 60hostname# show user-identity user-of-ip 172.1.2.2 detailCSCO\sampleuser2 (Login) Login time: 1440 mins; Idle time: 100 minsNumber of active connections: 01-hour sent packets: 36781-hour rcvd packets: 125620-min sent drops: 60hostname# show user-identity user-of-ip 172.1.7.7ERROR: no user with this IP addressIPv6 Support
hostname# show user-identity user-of-ip 8080:1:1::4CSCO\sampleuser1 (Login)hostname# show user-identity user-of-ip 8080:1:1::4 detailCSCO\sampleuser1 (Login) Login time: 240 mins; Idle time: 10 minsNumber of active connections: 201-hour sent packets: 36781-hour rcvd packets: 125620-min sent drops: 60hostname# show user-identity user-of-ip 8080:1:1::6 detailCSCO\sampleuser2 (Login) Login time: 1440 mins; Idle time: 100 minsNumber of active connections: 01-hour sent packets: 36781-hour rcvd packets: 125620-min sent drops: 60hostname# show user-identity user-of-ip 8080:1:1::100ERROR: no user with this IP addressRelated Commands
show version
To display the software version, hardware configuration, license key, and related uptime data, use the show version command in user EXEC mode.
show version
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show version command allows you to display the software version, operating time since the last reboot, processor type, Flash partition type, interface boards, serial number (BIOS ID), activation key value, license type, and time stamp for when the configuration was last modified.
The serial number listed with the show version command is for the flash partition BIOS. This number is different from the serial number on the chassis. When you get a software upgrade, you will need the serial number that appears in the show version command, not the chassis number.
The failover cluster uptime value indicates how long a failover set has been running. If one unit stops running, the uptime value continues to increase as long as the active unit continues to operate. Therefore, it is possible for the failover cluster uptime to be greater than the individual unit uptime. If you temporarily disable failover, and then reenable it, the failover cluster uptime reports the time the unit was up before failover was disabled plus the time the unit was up while failover was disabled.
If you have a No Payload Encryption model, then when you view the license, VPN and Unified Communications licenses will not be listed.
For the Total VPN Peers on the ASA 5505, the total combined number of VPN sessions of all types depends on your licenses. If you enable AnyConnect Essentials, then the total is the model maximum of 25. If you enable AnyConnect Premium, then the total is the AnyConnect Premium value plus the Other VPN value, not to exceed 25 sessions. Unlike other models, where the Other VPN value equals the model limit for all VPN sessions, the ASA 5505 has a lower Other VPN value than the model limit, so the total value can vary depending on the AnyConnect Premium license.
Examples
The following is sample output from the show version command, and shows the software version, hardware configuration, license key, and related uptime information. Note that in an environment where stateful failover is configured an additional line showing the failover cluster uptime is displayed. If failover is not configured, the line is not displayed. This display shows a warning message about minimum memory requirements.
*************************************************************************** **** *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING *** **** **** ----> Minimum Memory Requirements NOT Met! <---- **** **** Installed RAM: 512 MB **** Required RAM: 2048 MB **** Upgrade part#: ASA5520-MEM-2GB= **** **** This ASA does not meet the minimum memory requirements needed to **** run this image. Please install additional memory (part number **** listed above) or downgrade to ASA version 8.2 or earlier. **** Continuing to run without a memory upgrade is unsupported, and **** critical system features will not function properly. **** ***************************************************************************Cisco Adaptive Security Appliance Software Version 8.4(1)Device Manager Version 6.4(1)Compiled on Thu 20-Jan-12 04:05 by buildersSystem image file is "disk0:/cdisk.bin"Config file at boot was "disk0:/tomm_backup.cfg"asa3 up 3 days 3 hoursHardware: ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHzInternal ATA Compact Flash, 64MBSlot 1: ATA Compact Flash, 128MBBIOS Flash AT49LW080 @ 0xfff00000, 1024KBEncryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)Boot microcode : CN1000-MC-BOOT-2.00SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03IPsec microcode : CNlite-MC-IPSECm-MAIN-2.060: Ext: GigabitEthernet0/0 : address is 0013.c480.82ce, irq 91: Ext: GigabitEthernet0/1 : address is 0013.c480.82cf, irq 92: Ext: GigabitEthernet0/2 : address is 0013.c480.82d0, irq 93: Ext: GigabitEthernet0/3 : address is 0013.c480.82d1, irq 94: Ext: Management0/0 : address is 0013.c480.82cd, irq 115: Int: Not used : irq 116: Int: Not used : irq 5Licensed features for this platform:Maximum Physical Interfaces : Unlimited perpetualMaximum VLANs : 150 perpetualInside Hosts : Unlimited perpetualFailover : Active/Active perpetualVPN-DES : Enabled perpetualVPN-3DES-AES : Enabled perpetualSecurity Contexts : 10 perpetualGTP/GPRS : Enabled perpetualAnyConnect Premium Peers : 2 perpetualAnyConnect Essentials : Disabled perpetualOther VPN Peers : 750 perpetualTotal VPN Peers : 750 perpetualShared License : Enabled perpetualShared AnyConnect Premium Peers : 12000 perpetualAnyConnect for Mobile : Disabled perpetualAnyConnect for Cisco VPN Phone : Disabled perpetualAdvanced Endpoint Assessment : Disabled perpetualUC Phone Proxy Sessions : 12 62 daysTotal UC Proxy Sessions : 12 62 daysBotnet Traffic Filter : Enabled 646 daysIntercompany Media Engine : Disabled perpetualThis platform has a Base license.The flash permanent activation key is the SAME as the running permanent key.Active Timebased Activation Key:0xa821d549 0x35725fe4 0xc918b97b 0xce0b987b 0x47c7c285Botnet Traffic Filter : Enabled 646 days0xyadayad2 0xyadayad2 0xyadayad2 0xyadayad2 0xyadayad2Total UC Proxy Sessions : 10 62 daysSerial Number: JMX0938K0C0Running Permanent Activation Key: 0xce06dc6b 0x8a7b5ab7 0xa1e21dd4 0xd2c4b8b8 0xc4594f9cRunning Timebased Activation Key: 0xa821d549 0x35725fe4 0xc918b97b 0xce0b987b 0x47c7c285Configuration register is 0x1Configuration last modified by docs at 15:23:22.339 EDT Fri Oct 30 2012The following message appears if you enter the show version command after the eject command has been executed, but the device has not been physically removed:
Slot 1: Compact Flash has been ejected!It may be removed and a new device installed.Related Commands
show vlan
To display all VLANs configured on the ASA, use the show vlan command in privileged EXEC mode.
show vlan
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following example displays the configured VLANs:
hostname# show vlan10-11,30,40,300Related Commands
show vpn load-balancing
To display the runtime statistics for the VPN load-balancing virtual cluster configuration, use the show vpn-load-balancing command in global configuration, privileged EXEC, or VPN load-balancing mode.
show vpn load-balancing
Syntax Description
This command has no variables or arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
Privileged EXEC
•
—
•
—
Vpn load-balancing
•
—
•
—
Command History
Usage Guidelines
The show vpn load-balancing command displays statistical information for the virtual VPN load-balancing cluster. If the local device is not participating in the VPN load-balancing cluster, this command indicates that VPN load balancing has not been configured for this device.
The asterisk (*) in the output indicates the IP address of the ASA to which you are connected.
Examples
This example displays show vpn load-balancing command and its output for a situation in which the local device is participating in the VPN load-balancing cluster:
hostname# sh vpn load-balancing--------------------------------------------------------------------------Status Role Failover Encryption Cluster IP Peers--------------------------------------------------------------------------Enabled Master n/a Disabled 192.0.2.255 0Peers:--------------------------------------------------------------------------Public IP Role Pri Model Load-Balancing Version--------------------------------------------------------------------------192.0.2.255 Master 5 ASA-5520 3Total License Load:--------------------------------------------------------------------------Public IP AnyConnect Premium/Essentials Other VPN------------------------------- ---------------------Limit Used Load Limit Used Load--------------------------------------------------------------------------192.0.2.255 750 0 0% 750 1 0%Licenses Used By Inactive Sessions :--------------------------------------------------------------------------Public IP AnyConnect Premium/Essentials Inactive Load--------------------------------------------------------------------------192.0.2.255 0 0%On the primary device, the Total License Load output includes information about the primary and backup device; however, the backup device only shows information about itself and not the primary device. Thus, the primary device knows about all licensed members, but the licensed members themselves only know about their own licenses.
The output also contains a License Used by Inactive Session section. When an AnyConnect session goes inactive, the ASA keeps that session as long as the session has not terminated by normal means. That way, AnyConnect sessions can reconnect using the same webvpn cookie and not have to re-authenticate. The inactive sessions will remain in that state until either the AnyConnect client resumes the session or an idle timeout occurs. The licenses for those sessions are maintained for these inactive sessions and are represented in this License Used by Inactive Session section.
If the local device is not participating in the VPN load-balancing cluster, the show vpn load-balancing command shows a different result:
hostname(config)# show vpn load-balancingVPN Load Balancing has not been configured.Related Commands
show vpn-sessiondb
To display information about VPN sessions, use the show vpn-sessiondb command in privileged EXEC mode.The command includes options for displaying information in full or in detail, lets you specify type of sessions to display, and provides options to filter and sort the information. The syntax table and usage notes organize the choices accordingly
show vpn-sessiondb [detail] [ospfv3] [failover] [full] [summary] [ratio {encryption | protocol}] [license-summary] {anyconnect | email-proxy | index indexnumber | l2l | ra-ikev1-ipsec | vpn-lb | webvpn} [filter {name username | ipaddress IPaddr | a-ipaddress IPaddr | p-ipaddress IPaddr | tunnel-group groupname | protocol protocol-name | encryption encryption-algo | inactive}] [sort {name | ipaddress | a-ipaddress | p-ip address | tunnel-group | protocol | encryption | inactivity}]
Syntax Description
Defaults
There is no default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
Command History
Usage Guidelines
You can use the following options to filter and to sort the session display:
Examples
The following is sample output from the show vpn-sessiondb command:
hostname#show vpn-sessiondb---------------------------------------------------------------------------VPN Session Summary---------------------------------------------------------------------------Active : Cumulative : Peak Concur : Inactive----------------------------------------------AnyConnect Client : 1 : 78 : 2 : 0SSL/TLS/DTLS : 1 : 72 : 2 : 0IKEv2 IPsec : 0 : 6 : 1 : 0Clientless VPN : 0 : 8 : 2Browser : 0 : 8 : 2---------------------------------------------------------------------------Total Active and Inactive : 1 Total Cumulative : 86Device Total VPN Capacity : 750Device Load : 0%------------------------------------------------------------------------------------------------------------------------------------------------------Tunnels Summary---------------------------------------------------------------------------Active : Cumulative : Peak Concurrent----------------------------------------------IKEv2 : 0 : 6 : 1IPsecOverNatT : 0 : 6 : 1Clientless : 0 : 17 : 2AnyConnect-Parent : 1 : 69 : 2SSL-Tunnel : 1 : 75 : 2DTLS-Tunnel : 1 : 56 : 2---------------------------------------------------------------------------Totals : 3 : 229------------------------------------------------------------------------------------------------------------------------------------------------------IPv6 Usage Summary---------------------------------------------------------------------------Active : Cumulative : Peak Concurrent----------------------------------------------AnyConnect SSL/TLS/DTLS : : :IPv6 Peer : 1 : 41 : 2Tunneled IPv6 : 1 : 70 : 2AnyConnect IKEv2 : : :IPv6 Peer : 0 : 4 : 1Clientless : : :IPv6 Peer : 0 : 1 : 1---------------------------------------------------------------------------
The following is sample output from the show vpn-sessiondb detail l2l command, showing detailed information about LAN-to-LAN sessions:
hostname#show vpn-sessiondb detail l2lSession Type: LAN-to-LAN DetailedConnection : 172.16.0.0Index : 1IP Addr : 172.16.0.0Protocol : IKEv2 IPsecEncryption : IKEv2: (1)AES256 IPsec: (1)AES256Hashing : IKEv2: (1)SHA1 IPsec: (1)SHA1Bytes Tx : 240 Bytes Rx : 160Login Time : 14:50:35 UTC Tue May 1 2012Duration : 0h:00m:11sIKEv2 Tunnels: 1IPsec Tunnels: 1IKEv2:Tunnel ID : 1.1UDP Src Port : 500 UDP Dst Port : 500Rem Auth Mode: preSharedKeysLoc Auth Mode: preSharedKeysEncryption : AES256 Hashing : SHA1Rekey Int (T): 86400 Seconds Rekey Left(T): 86389 SecondsPRF : SHA1 D/H Group : 5Filter Name :IPv6 Filter :IPsec:Tunnel ID : 1.2Local Addr : 10.0.0.0/255.255.255.0Remote Addr : 209.165.201.30/255.255.255.0Encryption : AES256 Hashing : SHA1Encapsulation: Tunnel PFS Group : 5Rekey Int (T): 120 Seconds Rekey Left(T): 107 SecondsRekey Int (D): 4608000 K-Bytes Rekey Left(D): 4608000 K-BytesIdle Time Out: 30 Minutes Idle TO Left : 29 MinutesBytes Tx : 240 Bytes Rx : 160Pkts Tx : 3 Pkts Rx : 2NAC:Reval Int (T): 0 Seconds Reval Left(T): 0 SecondsSQ Int (T) : 0 Seconds EoU Age(T) : 13 SecondsHold Left (T): 0 Seconds Posture Token:Redirect URL :The following is sample output from the show vpn-sessiondb detail index 1 command:AsaNacDev# show vpn-sessiondb detail index 1Session Type: Remote DetailedUsername : user1Index : 1Assigned IP : 192.168.2.70 Public IP : 10.86.5.114Protocol : IPsec Encryption : AES128Hashing : SHA1Bytes Tx : 0 Bytes Rx : 604533Client Type : WinNT Client Ver : 4.6.00.0049Tunnel Group : bxbvpnlabLogin Time : 15:22:46 EDT Tue May 10 2005Duration : 7h:02m:03sFilter Name :NAC Result : AcceptedPosture Token: HealthyVM Result : StaticVLAN : 10IKE Sessions: 1 IPsec Sessions: 1 NAC Sessions: 1IKE:Session ID : 1UDP Src Port : 500 UDP Dst Port : 500IKE Neg Mode : Aggressive Auth Mode : preSharedKeysXauthEncryption : 3DES Hashing : MD5Rekey Int (T): 86400 Seconds Rekey Left(T): 61078 SecondsD/H Group : 2IPsec:Session ID : 2Local Addr : 0.0.0.0Remote Addr : 192.168.2.70Encryption : AES128 Hashing : SHA1Encapsulation: TunnelRekey Int (T): 28800 Seconds Rekey Left(T): 26531 SecondsBytes Tx : 0 Bytes Rx : 604533Pkts Tx : 0 Pkts Rx : 8126NAC:Reval Int (T): 3000 Seconds Reval Left(T): 286 SecondsSQ Int (T) : 600 Seconds EoU Age (T) : 2714 SecondsHold Left (T): 0 Seconds Posture Token: HealthyRedirect URL : www.cisco.comThe following is sample output from the show vpn-sessiondb ospfv3 command:
asa# show vpn-sessiondb ospfv3Session Type: OSPFv3 IPsecConnection :Index : 1 IP Addr : 0.0.0.0Protocol : IPsecEncryption : IPsec: (1)none Hashing : IPsec: (1)SHA1Bytes Tx : 0 Bytes Rx : 0Login Time : 15:06:41 EST Wed Feb 1 2012Duration : 1d 5h:13m:11sThe following is sample output from the show vpn-sessiondb detail ospfv3 command:
asa# show vpn-sessiondb detail ospfv3Session Type: OSPFv3 IPsec DetailedConnection :Index : 1 IP Addr : 0.0.0.0Protocol : IPsecEncryption : IPsec: (1)none Hashing : IPsec: (1)SHA1Bytes Tx : 0 Bytes Rx : 0Login Time : 15:06:41 EST Wed Feb 1 2012Duration : 1d 5h:14m:28sIPsec Tunnels: 1IPsec:Tunnel ID : 1.1Local Addr : ::/0/89/0Remote Addr : ::/0/89/0Encryption : none Hashing : SHA1Encapsulation: TransportIdle Time Out: 0 Minutes Idle TO Left : 0 MinutesBytes Tx : 0 Bytes Rx : 0Pkts Tx : 0 Pkts Rx : 0NAC:Reval Int (T): 0 Seconds Reval Left(T): 0 SecondsSQ Int (T) : 0 Seconds EoU Age(T) : 105268 SecondsHold Left (T): 0 Seconds Posture Token:Redirect URL :The following is sample output from the show vpn-sessiondb summary command:
asa# show vpn-sessiondb summary---------------------------------------------------------------------------VPN Session Summary---------------------------------------------------------------------------Active : Cumulative : Peak Concur : Inactive----------------------------------------------OSPFv3 IPsec : 1 : 1 : 1---------------------------------------------------------------------------Total Active and Inactive : 1 Total Cumulative : 1Device Total VPN Capacity : 10000Device Load : 0%-----------------------------------------------------------------------The following is sample output from the show vpn-sessiondb det anyconnect command:
asa1# sho vpn-sessiondb det anyconnectSession Type: AnyConnect DetailedUsername : rashmi Index : 2Assigned IP : 65.2.1.100 Public IP : 75.2.1.60Assigned IPv6: 2001:1000::10Protocol : IKEv2 IPsecOverNatT AnyConnect-ParentLicense : AnyConnect PremiumEncryption : IKEv2: (1)3DES IPsecOverNatT: (1)3DES AnyConnect-Parent: (1)noneHashing : IKEv2: (1)SHA1 IPsecOverNatT: (1)SHA1 AnyConnect-Parent: (1)noneBytes Tx : 0 Bytes Rx : 21248Pkts Tx : 0 Pkts Rx : 238Pkts Tx Drop : 0 Pkts Rx Drop : 0Group Policy : DfltGrpPolicy Tunnel Group : test1Login Time : 22:44:59 EST Tue Aug 13 2013Duration : 0h:02m:42sInactivity : 0h:00m:00sNAC Result : UnknownVLAN Mapping : N/A VLAN : noneIKEv2 Tunnels: 1IPsecOverNatT Tunnels: 1AnyConnect-Parent Tunnels: 1AnyConnect-Parent:Tunnel ID : 2.1Public IP : 75.2.1.60Encryption : none Hashing : noneAuth Mode : userPasswordIdle Time Out: 400 Minutes Idle TO Left : 397 MinutesConn Time Out: 500 Minutes Conn TO Left : 497 MinutesClient OS : WindowsClient Type : AnyConnectClient Ver : 3.1.05050IKEv2:Tunnel ID : 2.2UDP Src Port : 64251 UDP Dst Port : 4500Rem Auth Mode: userPasswordLoc Auth Mode: rsaCertificateEncryption : 3DES Hashing : SHA1Rekey Int (T): 86400 Seconds Rekey Left(T): 86241 SecondsPRF : SHA1 D/H Group : 2Filter Name : mixed1Client OS : WindowsIPsecOverNatT:Tunnel ID : 2.3Local Addr : 75.2.1.23/255.255.255.255/47/0Remote Addr : 75.2.1.60/255.255.255.255/47/0Encryption : 3DES Hashing : SHA1Encapsulation: Transport, GRERekey Int (T): 28400 Seconds Rekey Left(T): 28241 SecondsIdle Time Out: 400 Minutes Idle TO Left : 400 MinutesConn Time Out: 500 Minutes Conn TO Left : 497 MinutesBytes Tx : 0 Bytes Rx : 21326Pkts Tx : 0 Pkts Rx : 239NAC:Reval Int (T): 0 Seconds Reval Left(T): 0 SecondsSQ Int (T) : 0 Seconds EoU Age(T) : 165 SecondsHold Left (T): 0 Seconds Posture Token:Redirect URL :As shown in the examples, the fields displayed in response to the show vpn-sessiondb command vary, depending on the keywords you enter. Table 60-2 explains these fields.
Related Commands
show vpn-sessiondb license-summary
To display a summary of VPN license information for the ASA, use the show vpn-sessiondb license-summary command in privileged EXEC mode.
show vpn-sessiondb license-summary
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
8.4(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Examples
The following is sample output for the show vpn-sessiondb ratio command, with encryption as the argument:
hostname(config)# show vpn-sessiondb license-summary---------------------------------------------------------------------------VPN Licenses and Configured Limits Summary---------------------------------------------------------------------------Status : Installed : Burst: Limit-----------------------------------------AnyConnect Premium : ENABLED : 750 : 20 : NONEAnyConnect Essentials : DISABLED : 750 : 10 : NONEOther VPN (Available by Default) : ENABLED : 750 : 750 : NONEShared License Server : DISABLEDShared License Participant : DISABLEDAnyConnect for Mobile : DISABLED(Requires Premium or Essentials)Advanced Endpoint Assessment : DISABLED(Requires Premium)VPN-3DES-AES : ENABLEDVPN-DES : ENABLEDAnyConnect for Cisco VPN Phone : DISABLED------------------------------------------------------------------------------------------------------------------------------------------------------VPN Licenses Usage Summary---------------------------------------------------------------------------Local : Shared : All : Peak : Eff. :In Use : In Use : In Use : In Use : Limit : Usage----------------------------------------------------AnyConnect Premium : 0 : 0 : 0 : 0 : 2 : 0%AnyConnect Client : : 0 : 0 : 0%AnyConnect Mobile : : 0 : 0 : 0%Clientless VPN : : 0 : 0 : 0%Other VPN : : 0 : 0 : 750 : 0%Cisco VPN Client/ : : 0 : 0 : 0%L2TP ClientsSite-to-Site VPN : : 0 : 0 : 0%------------------------------------------------------------------------------------------------------------------------------------------------------Shared License Network Summary---------------------------------------------------------------------------AnyConnect PremiumTotal shared licenses in network : 12000Shared licenses held by this participant : 0Shared licenses held by all participants in the network : 0---------------------------------------------------------------------------hostname(config)#Related Commandsshow vpn-sessiondb ratio
show vpn-sessiondb ratio
To display the ratio of current sessions as a percentage by protocol or encryption algorithm, use the show vpn-sessiondb ratio command in privileged EXEC mode.
show vpn-sessiondb ratio {protocol | encryption} [filter groupname]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
7.0(1)
This command was introduced.
8.4(1)
The output was enhanced to include IKEv2.
9.0(1)
Support for multiple context mode was added.
Examples
The following is sample output for the show vpn-sessiondb ratio command, with encryption as the argument:
hostname# show vpn-sessiondb ratio encryptionFilter Group : AllTotal Active Sessions: 5Cumulative Sessions : 9Encryption Sessions Percentnone 0 0%DES 1 20%3DES 0 0%AES128 4 80%AES192 0 0%AES256 0 0%The following is sample output for the show vpn-sessiondb ratio command with protocol as the argument:
hostname# show vpn-sessiondb ratio protocolFilter Group : AllTotal Active Sessions: 6Cumulative Sessions : 10Protocol Sessions PercentIKE 0 0%IPsec 1 20%IPsecLAN2LAN 0 0%IPsecLAN2LANOverNatT 0 0%IPsecOverNatT 0 0%IPsecOverTCP 1 20%IPsecOverUDP 0 0%L2TP 0 0%L2TPOverIPsec 0 0%L2TPOverIPsecOverNatT 0 0%PPPoE 0 0%vpnLoadBalanceMgmt 0 0%userHTTPS 0 0%IMAP4S 3 30%POP3S 0 0%SMTPS 3 30%Related Commandsshow vpn-sessiondb ratio
show vpn-sessiondb summary
To display the number of IPsec, Cisco AnyConnect, and NAC sessions, use the show vpn-sessiondb summary command in privileged EXEC mode.
show vpn-sessiondb summary
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Examples
The following is sample output for the show vpn-sessiondb summary command with one IPsec IKEv1 and one clientless session:
Note
hostname# show vpn-sessiondb summaryVPN Session SummarySessions:Active : Cumulative : Peak Concurrent : Inactive :Clientless VPN : 1: 2: 1 Browser : 1: 2: 1 IKEv1 IPsec/L2TP IPsec 0 : 1: 1: 1Total Active and Inactive: 2 Total Cumulative: 3Device Total VPN Capacity: 10000Device Load : 0%License Information:Shared VPN License Information:SSL VPN : 12000Allocated to this device : 0Allocated to network : 0Device limit : 750IPsec : 750 Configured : 750 Active : 0 Load : 0%SSL VPN : 750 Configured : 750 Active : 0 Load : 0%Active : Cumulative : Peak ConcurrentSSL VPN : 0 : 1 : 1Totals : 0 : 1 :Active NAC Sessions:Accepted : 0Rejected : 0Exempted : 0Non-responsive : 0Hold-off : 0N/A : 0Active VLAN Mapping Sessions:Static : 0Auth : 0Access : 0Guest : 0Quarantine : 0N/A : 0F1-asa1#You can use the SSL output to determine the physical device resources in respect to the number of licenses. A single user session may occupy a license but could use multiple tunnels. For example, an AnyConnect user with DTLS often has the parent session, SSL tunnel, and DTLS tunnels associated with it.
Note
With this example, you would see three tunnels allocated on the device, even if only one user is logged in. An IPsec LAN-to-LAN tunnel counts as one session, and it allows many host-to-host connections through the tunnel. An IPsec remote access session is one remote access tunnel that supports one user connection.
From the output you can see which sessions are active. If a session has no underlying tunnels associated to it, the status is waiting to resume mode (displayed as Clientless in the session output). This mode means that dead peer detection from the head-end device has started, and the head-end device can no longer communicate with the client. When you encounter this condition, you can hold the session to allow the user to roam networks, go to sleep, recover the session, and so on. These sessions count towards the actively connected sessions (from a license standpoint) and are cleared with a user idle timeout, a user logging out, or a resumption of the original session.
The Active SSL VPN With Client column shows the number of active connections passing data. The Cumulative SSL VPN With Client column shows the number of active sessions that have been established. It includes those that are inactive and increments only when a new session is added. The Peak Concurrent SSL VPN With Client column shows the peak number of concurrently active sessions that are passing data. The Inactive SSL VPN With Client column shows how long the AnyConnect client was disconnected. You can use this Inactivity timeout value to determine when licenses are expired. The ASA can then determine whether reconnection is possible. These are AnyConnect sessions without an active SSL tunnel associated with them.
Table 60-3 explains the fields in the Active Sessions and Session Information tables.
The Active NAC Sessions table shows general statistics about remote peers that are subject to posture validation.
The Cumulative NAC Sessions table shows general statistics about remote peers that are or have been subject to posture validation.
Table 60-2 explains the fields in the Active NAC Sessions and Total Cumulative NAC Sessions tables.
The Active VLAN Mapping Sessions table shows general statistics about remote peers that are subject to posture validation.
The Cumulative VLAN Mapping Sessions table shows general statistics about remote peers that are or have been subject to posture validation.
Table 60-5 explains the fields in the Active VLAN Mapping Sessions and Cumulative VLAN Mapping Sessions tables.
Related Commands Total Active Sessions : 7
show wccp
To display global statistics related to Web Cache Communication Protocol (WCCP), use the show wccp command in privileged EXEC mode.
show wccp {web-cache | service-number}[detail | view]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example shows how to display WCCP information:
hostname(config)# show wccpGlobal WCCP information:Router information:Router Identifier: -not yet determined-Protocol Version: 2.0Service Identifier: web-cacheNumber of Cache Engines: 0Number of routers: 0Total Packets Redirected: 0Redirect access-list: fooTotal Connections Denied Redirect: 0Total Packets Unassigned: 0Group access-list: foobarTotal Messages Denied to Group: 0Total Authentication failures: 0Total Bypassed Packets Received: 0hostname(config)#Related Commands
wccp
Enables support of WCCP with service groups.
wccp redirect
Enables support of WCCP redirection.
show webvpn csd
To determine whether CSD is enabled, display the CSD version in the running configuration, determine what image is providing the Host Scan package, and to test a file to see if it is a valid CSD distribution package, use the show webvpn csd command in privileged EXEC mode.
show webvpn csd [image filename]
Syntax Description
filename
Specifies the name of a file to test for validity as a CSD distribution package. It must take the form csd_n.n.n-k9.pkg.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
•
—
•
—
Command History
Examples
Use the show webvpn csd command to check the operational status of CSD. The CLI responds with a message indicating if CSD is installed and if it is enabled, if Host Scan is installed and if it is enabled, and which image is supplying the Host Scan package if there is both a CSD package and a Host Scan package installed.
hostname# show webvpn csdThese are the messages you could receive:
•
user `pat' from 209.165.201.2 authenticated
user `robin' from 209.165.201.4 authorized to:•
port 192.168.67.34/telnet 192.168.67.11/http 192.168.67.33/tcp/8001n.n.n.n is currently installed but not enabled
192.168.67.56/tcp/25 192.168.67.42/ftp•
user `terry' from 209.165.201.7 authorized to:n.n.n.n is currently installed and enabledStandalone Hostscan package is not installed (Hostscan is currently installed and enabled via the CSD package)The message, "
port 192.168.1.50/http 209.165.201.8/httpn.n.n.n is currently installed ..." means that the image is loaded on the ASA and in the running configuration. The image can be either enabled or not enabled. You can go to webvpn configuration mode and enter the csd enable command to enable CSD.The messaage, "
URL Filter Cache Stats" means that the Host Scan package delivered with the CSD package is the Host Scan package in use.•
----------------------n.n.n.n is currently installed and enabled
Entries : 36n.n.n.n is currently installed and enabledThe message, "
In Use : 30n.n.n.n is currently installed and enabled Hostscan version n.n.n.n is currently installed and enabled" means that both CSD and a Host Scan package, delivered either as a standalone package or as part of an AnyConnect image, are installed. If Host Scan is enabled and both CSD and an AnyConnect image with Host Scan, or a standalone Host Scan package, are installed and enabled, the Host Scan package delivered as a standalone package or as part of an AnyConnect image takes precedence over the one provided with a CSD package.•
Lookups : 300n.n.n.n is currently installed but not enabled
hostname#n.n.n.n is currently installed but not enabledUse the show webvpn csd image filename command to test a file to determine if a CSD distribution package is valid.
hostname# show webvpn csd image csd_n.n.n-k9.pkg
The CLI responds with one of the following messages when you enter this command:
•
hostname#Make sure the filename is in the form the form csd_n.n.n_k9.pkg. If the csd package does not have this naming convention, replace the file with one obtained from the following website:
http://www.cisco.com/pcgi-bin/tablebuild.pl/securedesktop
Then reenter the show webvpn csd image command. If the image is valid, use the csd image and csd enable commands in webvpn configuration mode to install and enable CSD.
•
Secure Desktop is not installed
Hostscan is not installed
Secure Desktop version
Standalone Hostscan package is not installed (Hostscan is currently installed via the CSD package but not enabled)Note that the CLI provides both the version and date stamp if the file is valid.
Related Commands
show webvpn group-alias
To display the aliases for a specific tunnel-group or for all tunnel groups, use the group-alias command in privileged EXEC mode.
show webvpn group-alias [tunnel-group]
Syntax Description
Defaults
If you do not enter a tunnel-group name, this command displays all the aliases for all the tunnel groups.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
Command History
Usage Guidelines
WebVPN must be running when you enter the show webvpn group-alias command.
Each tunnel group can have multiple aliases or no alias.
Examples
The following example shows the show webvpn group-alias command that displays the aliases for the tunnel group "devtest" and the output of that command:
hostname# show webvpn group-alias devtestQAFra-QARelated Commands
group-alias
Specifies one or more URLs for the group.
tunnel-group webvpn-attributes
Enters the config-webvpn mode for configuring WebVPN tunnel-group attributes.
show webvpn group-url
To display the URLs for a specific tunnel-group or for all tunnel groups, use the group-url command in privileged EXEC mode.
show webvpn group-url [tunnel-group]
Syntax Description
Defaults
If you do not enter a tunnel-group name, this command displays all the URLs for all the tunnel groups.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
Command History
Usage Guidelines
WebVPN must be running when you enter the show webvpn group-url command. Each group can have multiple URLs or no URL.
Examples
The following example shows the show webvpn group-url command that displays the URLs for the tunnel group "frn-eng1" and the output of that command:
hostname# show webvpn group-urlhttp://www.cisco.comhttps://fra1.example.comhttps://fra2.example.comRelated Commands
group-url
Specifies one or more URLs for the group.
tunnel-group webvpn-attributes
Enters the config-webvpn mode for configuring WebVPN tunnel-group attributes.
show webvpn kcd
Use the show webvpn kcd command in webvpn configuration mode to display the Domain Controller information and Domain join status on the ASA.
show webvpn kcd
Syntax Description
None.
Defaults
There are no defaults for this command.
Command Modes
The following table shows the modes in which you can enter the command:
webvpn configuration
•
—
•
—
Command History
Usage Guidelines
The show webvpn kcd command in webvpn configuration mode displays the Domain Controller information and Domain join status on the ASA.
Examples
The following example shows important details to note from the show webvpn kcd command and the interpretation of the status message.
This example shows that the registration is under way and not finished:
Secure Desktop versionshow webvpn kcd
Kerberos Realm: CORP.TEST.INTERNAL
Domain Join: In-ProgressThis example shows that a registration was successful and that the ASA has joined the domain:
hostname# show webvpn kcd Kerberos Realm: CORP.TEST.INTERNAL Domain Join: CompleteRelated Commands
show webvpn sso-server
To display the operating statistics for Webvpn single sign-on servers, use the show webvpn sso-server command in privileged EXEC mode.
show webvpn sso-server [name]
Syntax Description
Syntax DescriptionSyntax Description
name
Optionally specifies the name of the SSO server. The server name must be between four and 31 characters in length.
Defaults
No default values or behavior.
Command Modes
The following table shows the modes in which you can enter the command:
Config-webvpn-sso-saml
•
—
•
—
Config-webvpn-sso-siteminder
•
—
•
—
Privileged EXEC
•
—
•
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The show webvpn sso-server command displays operating statistics for any and all SSO servers configured on the security device.
If no SSO server name argument is entered, statistics for all SSO servers display.
Examples
The following example, entered in privileged EXEC mode, displays statistics for a SiteMinder-type SSO server named example:
hostname# show webvpn sso-server exampleName: exampleType: SiteMinderAuthentication Scheme Version: 1.0Web Agent URL: http://www.example.com/webvpnNumber of pending requests: 0Number of auth requests: 0Number of retransmissions: 0Number of accepts: 0Number of rejects: 0Number of timeouts: 0Number of unrecognized responses: 0hostname#The following example of the command issued without a specific SSO server name, displays statistics for all configured SSO servers on the ASA:hostname#(config-webvpn)# show webvpn sso-serverName: high-security-serverType: SAML-v1.1-POSTAssertion Consumer URL:Issuer:Number of pending requests: 0Number of auth requests: 0Number of retransmissions: 0Number of accepts: 0Number of rejects: 0Number of timeouts: 0Number of unrecognized responses: 0Name: my-serverType: SAML-v1.1-POSTAssertion Consumer URL:Issuer:Number of pending requests: 0Number of auth requests: 0Number of retransmissions: 0Number of accepts: 0Number of rejects: 0Number of timeouts: 0Number of unrecognized responses: 0Name: serverType: SiteMinderAuthentication Scheme Version: 1.0Web Agent URL:Number of pending requests: 0Number of auth requests: 0Number of retransmissions: 0Number of accepts: 0Number of rejects: 0Number of timeouts: 0Number of unrecognized responses: 0asa1(config-webvpn)#Related Commands
show webvpn anyconnect
To view information about SSL VPN client images installed on the ASA and loaded in cache memory, or to test a file to see if it is a valid client image, use the show webvpn anyconnect command from privileged EXEC mode.
show webvpn anyconnect [image filename]
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
Command History
7.1(1)
This command was introduced.
8.4(1)
The show webvpn anyconnect form of the command replaced show webvpn svc.
Usage Guidelines
Use the show webvpn anyconnect command to view information about SSL VPN client images that are loaded in cache memory and available for download to remote PCs. Use the image filename keyword and argument to test a file to see if it is a valid image. If the file is not a valid image, the following message appears:
ERROR: This is not a valid SSL VPN Client image file.Examples
The following example shows the output of the show webvpn anyconnect command for currently installed images:
hostname# show webvpn anyconnect1. windows.pkg 1SSL VPN ClientCISCO STC win2k+ 1.1.01,1,0,107Thu 04/14/2005 09:27:54.432. window2.pkg 2CISCO STC win2k+ 1.1.01,1,0,107Thu 04/14/2005 09:27:54.43The following example shows the output of the show webvpn anyconnect image filename command for a valid image:
hostname(config-webvpn)# show webvpn anyconnect image sslclient-win-1.0.2.127.pkgThis is a valid SSL VPN Client image:CISCO STC win2k+ 1.0.01,0,2,127Fri 07/22/2005 12:14:45.43Related Commands
show xlate
To display information about NAT sessions (xlates), use the show xlate command in privileged EXEC mode.
show xlate [global ip1[-ip2] [netmask mask]] [local ip1[-ip2] [netmask mask]]
[gport port1[-port2]] [lport port1[-port2]] [interface if_name] [type type]show xlate count
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show xlate command displays the contents of the translation slots.
When the vpnclient configuration is enabled and the inside host is sending out DNS requests, the show xlate command may list multiple xlates for a static translation.
In an ASA clustering environment, up to three xlates may be duplicated to different nodes in the cluster to handle a PAT session. One xlate is created on the unit that owns the connection. One xlate is created on a different unit to backup the PAT address. Finally, one xlate exists on the director that replicates the flow. In the case where the backup and director is the same unit, two instead of three xlates may be created.
Examples
The following is sample output from the show xlate command.
hostname# show xlate5 in use, 5 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twicee - extendedNAT from any:10.90.67.2 to any:10.9.1.0/24flags idle 277:05:26 timeout 0:00:00NAT from any:10.1.1.0/24 to any:172.16.1.0/24flags idle 277:05:26 timeout 0:00:00NAT from any:10.90.67.2 to any:10.86.94.0flags idle 277:05:26 timeout 0:00:00NAT from any:10.9.0.9, 10.9.0.10/31, 10.9.0.12/30,10.9.0.16/28, 10.9.0.32/29, 10.9.0.40/30,10.9.0.44/31 to any:0.0.0.0flags idle 277:05:26 timeout 0:00:00NAT from any:10.1.1.0/24 to any:172.16.1.0/24flags idle 277:05:14 timeout 0:00:00The following is sample output from the show xlate command showing use of the e - extended flag and the destination address to which the xlate is extended.
hostname# show xlate1 in use, 1 most usedFlags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twicee - extendedICMP PAT from inside:10.2.1.100/6000 to outside:172.16.2.200/6000(172.16.2.99)flags idle 0:00:06 timeout 0:00:30TCP PAT from inside:10.2.1.99/5 to outside:172.16.2.200/5(172.16.2.90)flags idle 0:00:03 timeout 0:00:30UDP PAT from inside:10.2.1.101/1025 to outside:172.16.2.200/1025(172.16.2.100)flags idle 0:00:10 timeout 0:00:30The following is sample output from the show xlate command showing a translation from IPv4 to IPv6.
hostname# show xlate1 in use, 2 most usedNAT from outside:0.0.0.0/0 to in:2001::/96flags sT idle 0:16:16 timeout 0:00:00Related Commands
