-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
shun through snmp-server user Commands
smart-tunnel auto-signon enable
shun through snmp-server user Commands
shun
To block connections from an attacking host, use the shun command in privileged EXEC mode. To disable a shun, use the no form of this command.
shun source_ip [dest_ip source_port dest_port [protocol]] [vlan vlan_id]
no shun source_ip [vlan vlan_id]
Syntax Description
Defaults
The default protocol is 0 (any protocol).
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The shun command lets you block connections from an attacking host. All future connections from the source IP address are dropped and logged until the blocking function is removed manually or by the Cisco IPS sensor. The blocking function of the shun command is applied whether or not a connection with the specified host address is currently active.
If you specify the destination address, source and destination ports, and the protocol, then you drop the matching connection as well as placing a shun on all future connections from the source IP address; all future connections are shunned, not just those that match these specific connection parameters.
You can only have one shun command per source IP address.
Because the shun command is used to block attacks dynamically, it is not displayed in the ASA configuration.
Whenever an interface configuration is removed, all shuns that are attached to that interface are also removed. If you add a new interface or replace the same interface (using the same name), then you must add that interface to the IPS sensor if you want the IPS sensor to monitor that interface.
Examples
The following example shows that the offending host (10.1.1.27) makes a connection with the victim (10.2.2.89) with TCP. The connection in the ASA connection table reads as follows:
10.1.1.27, 555-> 10.2.2.89, 666 PROT TCPApply the shun command using the following options:
hostname# shun 10.1.1.27 10.2.2.89 555 666 tcpThe command deletes the specific current connection from the ASA connection table and also prevents all future packets from 10.1.1.27 from going through the ASA.
Related Commands
clear shun
Disables all the shuns that are currently enabled and clears the shun statistics.
show conn
Shows all active connections.
show shun
Displays the shun information.
shutdown
To disable an interface, use the shutdown command in interface configuration mode. To enable an interface, use the no form of this command.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Defaults
All physical interfaces are shut down by default. Allocated interfaces in security contexts are not shut down in the configuration.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
•
Command History
7.0(1)
This command was moved from a keyword of the interface command to an interface configuration mode command.
Usage Guidelines
The default state of an interface depends on the type and the context mode.
In multiple context mode, all allocated interfaces are enabled by default, no matter what the state of the interface is in the system execution space. However, for traffic to pass through the interface, the interface also has to be enabled in the system execution space. If you shut down an interface in the system execution space, then that interface is down in all contexts that share it.
In single mode or in the system execution space, interfaces have the following default states:
•
•
•
Note
Examples
The following example enables a main interface:
hostname(config)# interface gigabitethernet0/2hostname(config-if)# speed 1000hostname(config-if)# duplex fullhostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownThe following example enables a subinterface:
hostname(config)# interface gigabitethernet0/2.1hostname(config-subif)# vlan 101hostname(config-subif)# nameif dmz1hostname(config-subif)# security-level 50hostname(config-subif)# ip address 10.1.2.1 255.255.255.0hostname(config-subif)# no shutdownThe following example shuts down the subinterface:
hostname(config)# interface gigabitethernet0/2.1hostname(config-subif)# vlan 101hostname(config-subif)# nameif dmz1hostname(config-subif)# security-level 50hostname(config-subif)# ip address 10.1.2.1 255.255.255.0hostname(config-subif)# shutdownRelated Commands
clear xlate
Resets all translations for existing connections, causing the connections to be reset.
interface
Configures an interface and enters interface configuration mode.
shutdown (ca-server mode)
To disable the local Certificate Authority (CA) server and render the enrollment interface inaccessible to users, use the shutdown command in CA server configuration mode. To enable the CA server, lock down the configuration from changes, and to render the enrollment interface accessible, use the no form of this command.
[ no ] shutdown
Syntax Description
This command has no arguments or keywords.
Defaults
Initially, by default, the CA server is shut down.
Command Modes
The following table shows the modes in which you can enter the command:
Ca server configuration
•
—
•
—
—
Command History
Usage Guidelines
This command in CA server mode is similar to the shutdown command in interface mode. At setup time, the local CA server is shutdown by default and must be enabled using the no shutdown command. When you use the no shutdown command for the first time, you enable the CA server and generate the CA server certificate and keypair.
Note
To enable the CA server and lock down the current configuration with the no shutdown command, a 7-character password is required to encode and archive a PKCS12 file containing the CA certificate and keypair that is to be generated. The file is stored to the storage identified by a previously specified database path command.
Examples
The following example disables the local CA server and renders the enrollment interface inaccessible:
hostname(config)# crypto ca serverhostname(config-ca-server)# shutdownhostname(config-ca-server)#The following example enables the local CA server and makes the enrollment interface accessible:
hostname(config)# crypto ca serverhostname(config-ca-server)# no shutdownhostname(config-ca-server)#hostname(config-ca-server)# no shutdown% Some server settings cannot be changed after CA certificate generation.% Please enter a passphrase to protect the private key% or type Return to exitPassword: caserverRe-enter password: caserverKeypair generation process begin. Please wait...hostname(config-ca-server)#Related Commands
sla monitor
To create an SLA operation, use the sla monitor command in global configuration mode. To remove the SLA operation, use the no form of this command.
sla monitor sla_id
no sla monitor sla_id
Syntax Description
sla_id
Specifies the ID of the SLA being configured. If the SLA does not already exist, it is created. Valid values are from 1 to 2147483647.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The sla monitor command creates SLA operations and enters SLA Monitor configuration mode. Once you enter this command, the command prompt changes to
hostname(config-ca-server)to indicate that you are in SLA Monitor configuration mode. If the SLA operation already exists, and a type has already been defined for it, then the prompt appears ashostname(config-ca-server)You can create a maximum of 2000 SLA operations. Only 32 SLA operations may be debugged at any time.The no sla monitor command removes the specified SLA operation and the commands used to configure that operation.
After you configure an SLA operation, you must schedule the operation with the sla monitor schedule command. You cannot modify the configuration of the SLA operation after scheduling it. To modify the the configuration of a scheduled SLA operation, you must use the no sla monitor command to remove the selected SLA operation completely. Removing an SLA operation also removes the associated sla monitor schedule command. Then you can reenter the SLA operation configuration.
To display the current configuration settings of the operation, use the show sla monitor configuration command. To display operational statistics of the SLA operation, use the show sla monitor operation-state command. To see the SLA commands in the configuration, use the show running-config sla monitor command.
Examples
The following example configures an SLA operation with an ID of 123 and creates a tracking entry with the ID of 1 to track the reachability of the SLA:
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# timeout 1000hostname(config-sla-monitor-echo)# frequency 3hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
sla monitor schedule
To schedule an SLA operation, use the sla monitor schedule command in global configuration mode. To remove SLA operation schedule, and place the operation in the pending state, use the no form of this command.
sla monitor schedule sla-id [life {forever | seconds}] [start-time {hh:mm[:ss] [month day | day month] | pending | now | after hh:mm:ss}] [ageout seconds] [recurring]
no sla monitor schedule sla-id
Syntax Description
Defaults
The defaults are as follows:
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
When an SLA operation is in an active state, it immediately begins collecting information. The following time line shows the age-out process of the operation:
W----------------------X----------------------Y----------------------Z•
•
•
•
The age out process, if used, starts counting down at W, is suspended between X and Y, and is reset to its configured size are starts counting down again at Y. When an SLA operation ages out, the SLA operation configuration is removed from the running configuration. It is possible for the operation to age out before it executes (that is, Z can occur before X). To ensure that this does not happen, the difference between the operation configuration time and start time (X and W) must be less than the age-out seconds.
The recurring keyword is only supported for scheduling single SLA operations. You cannot schedule multiple SLA operations using a single sla monitor schedule command. The life value for a recurring SLA operation should be less than one day. The ageout value for a recurring operation must be "never" (which is specified with the value 0), or the sum of the life and ageout values must be more than one day. If the recurring option is not specified, the operations are started in the existing normal scheduling mode.
You cannot modify the configuration of the SLA operation after scheduling it. To modify the configuration of a scheduled SLA operation, you must use the no sla monitor command to remove the selected SLA operation completely. Removing an SLA operation also removes the associated sla monitor schedule command. Then you can reenter the SLA operation configuration.
Examples
The following example shows SLA operation 25 scheduled to begin actively collecting data at 3:00 p.m. on April 5. This operation will age out after 12 hours of inactivity. When this SLA operation ages out, all configuration information for the SLA operation is removed from the running configuration.
hostname(config)# sla monitor schedule 25 life 43200 start-time 15:00 apr 5 ageout 43200The following example shows SLA operation 1 schedule to begin collecting data after a 5-minute delay. The default life of one hour applies.
hostname(config)# sla monitor schedule 1 start after 00:05:00The following example shows SLA operation 3 scheduled to begin collecting data immediately and is scheduled to run indefinitely:
hostname(config)# sla monitor schedule 3 life forever start-time nowThe following example shows SLA operation 15 scheduled to begin automatically collecting data every day at 1:30 a.m.:
hostname(config)# sla monitor schedule 15 start-time 01:30:00 recurringRelated Commands
show sla monitor configuration
Displays the SLA configuration settings.
sla monitor
Defines an SLA monitoring operation.
smart-tunnel auto-signon enable
To enable smart tunnel auto sign-on in clientless (browser-based) SSL VPN sessions, use the smart-tunnel auto-signon enable command in group-policy webvpn configuration mode or username webvpn configuration mode.
To remove the smart-tunnel auto-signon enable command from the group policy or username and inherit it from the default group-policy, use the no form of this command.
no smart-tunnel auto-signon enable list [domain domain] [port port] [realm realm string]
Syntax Description
Defaults
No defaults exist for this command.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration
•
—
•
—
—
Username webvpn configuration
•
—
•
—
—
Command History
8.0(4)
This command was introduced.
8.4(1)
Optional realm and port arguments were introduced.
Usage Guidelines
The smart-tunnel auto sign-on feature supports only applications communicating HTTP and HTTPS using the Microsoft WININET library. For example, Microsoft Internet Explorer uses the WININET dynamic linked library to communicate with web servers.
You must use the smart-tunnel auto-signon list command to create a list of servers first. You can assign only one list to a group policy or username.
A realm string is associated with the protected area of the website and is passed back to the browser either in the authentication prompt or in the HTTP headers during authentication. If adminstrators do not know the corresponding realm, they should perform logon once and get the string from the prompt dialog.
Administrators can now optionally specify a port number for the corresponding hosts. For Firefox, if no port number is specified, auto sign-on is performed on HTTP and HTTPS, accessed by the default port numbers 80 and 443 respectively.
Examples
The following commands enable the smart tunnel auto sign-on list named HR:
hostname(config-group-policy)# webvpnhostname(config-group-webvpn)# smart-tunnel auto-signon enable HRhostname(config-group-webvpn)The following command enables the smart tunnel auto sign-on list named HR and adds the domain named CISCO to the username during authentication:
hostname(config-group-webvpn)# smart-tunnel auto-signon enable HR domain CISCOThe following command removes the smart tunnel auto sign-on list named HR from the group policy and inherits the smart tunnel auto sign-on list command from the default group policy:
hostname(config-group-webvpn)# no smart-tunnel auto-signon enable HRRelated Command
s
smart-tunnel auto-signon list
To create a list of servers for which to automate the submission of credentials in smart tunnel connections, use the smart-tunnel auto-signon list command in webvpn configuration mode.Use this command for each server you want to add to a list.
To remove an entry from a list, use the no form of this command, specifying both the list and the IP address or hostname, as it appears in the ASA configuration.
no smart-tunnel auto-signon list [use-domain] {ip ip-address [netmask] | host hostname-mask}
To display the smart tunnel auto sign-on list entries, enter the show running-config webvpn smart-tunnel command in privileged EXEC mode.
To remove an entire list of servers from the ASA configuration, use the no form of the command, specifying only the list.
no smart-tunnel auto-signon list
Syntax Description
Defaults
No defaults exist for this command.
Command Modes
The following table shows the modes in which you can enter the command:
webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
The smart-tunnel auto sign-on feature supports only applications communicating HTTP and HTTPS using the Microsoft WININET library. For example, Microsoft Internet Explorer uses the WININET dynamic linked library to communicate with web servers.
Following the population of a smart tunnel auto sign-on list, use the smart-tunnel auto-signon enable list command in group policy webvpn or username webvpn mode to assign the list.
Examples
The following command adds all hosts in the subnet and adds the Windows domain to the username if authentication requires it:
asa2(config-webvpn)# smart-tunnel auto-signon HR use-domain ip 192.32.22.56 255.255.255.0The following command removes that entry from the list:
asa2(config-webvpn)# no smart-tunnel auto-signon HR use-domain ip 192.32.22.56 255.255.255.0The command shown above also removes the list named HR if the entry removed is the only entry in the list. Otherwise, the following command removes the entire list from the ASA configuration:
asa2(config-webvpn)# no smart-tunnel auto-signon HRThe following command adds all hosts in the domain to the smart tunnel auto sign-on list named intranet:
asa2(config-webvpn)# smart-tunnel auto-signon intranet host *.exampledomain.comThe following command removes that entry from the list:
asa2(config-webvpn)# no smart-tunnel auto-signon intranet host *.exampledomain.comRelated Command
s
smart-tunnel auto-start
To start smart tunnel access automatically upon user login in a clientless (browser-based) SSL VPN session, use the smart-tunnel auto-start command in group-policy webvpn configuration mode or username webvpn configuration mode.
smart-tunnel auto-start list
To remove the smart-tunnel command from the group policy or username and inherit the [no] smart-tunnel command from the default group-policy, use the no form of the command.
no smart-tunnel
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration mode
•
—
•
—
—
Username webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
This command requires that you use the smart-tunnel list command to create the list of applications first.
This option to start smart tunnel access upon user login applies only to Windows.
Examples
The following commands start smart tunnel access for a list of applications named apps1:
hostname(config-group-policy)# webvpnhostname(config-group-webvpn)# smart-tunnel auto-start apps1hostname(config-group-webvpn)The following commands remove the list named apps1 from the group policy and inherit the smart tunnel commands from the default group policy:
hostname(config-group-policy)# webvpnhostname(config-group-webvpn)# no smart-tunnelhostname(config-group-webvpn)Related Command
s
smart-tunnel disable
To prevent smart tunnel access through clientless (browser-based) SSL VPN sessions, use the smart-tunnel disable command in group-policy webvpn configuration mode or username webvpn configuration mode.
smart-tunnel disable
To remove a smart-tunnel command from the group policy or username and inherit the [no] smart-tunnel command from the default group-policy, use the no form of the command.
no smart-tunnel
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration mode
•
—
•
—
—
Username webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
By default, smart tunnels are not enabled, so the smart-tunnel disable command is necessary only if the (default) group policy or username configuration contains a smart-tunnel auto-start or smart-tunnel enable command that you do not want applied for the group policy or username in question.
Examples
The following commands prevent smart tunnel access:
hostname(config-group-policy)# webvpnhostname(config-group-webvpn)# smart-tunnel disablehostname(config-group-webvpn)Related Command
s
smart-tunnel enable
To enable smart tunnel access through clientless (browser-based) SSL VPN sessions, use the smart-tunnel enable command in group-policy webvpn configuration mode or username webvpn configuration mode.
smart-tunnel enable list
To remove the smart-tunnel command from the group policy or username and inherit the [no] smart-tunnel command from the default group-policy, use the no form of the command.
no smart-tunnel
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration mode
•
—
•
—
—
Username webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
The smart-tunnel enable command assigns a list of applications eligible for smart tunnel access to a group policy or username. It requires the user to start smart tunnel access manually, using the Application Access > Start Smart Tunnels button on the clientless-SSL-VPN portal page. Alternatively, you can use the smart-tunnel auto-start command to start smart tunnel access automatically upon user login.
Both commands require that you use the smart-tunnel list command to create the list of applications first.
Examples
The following commands enable the smart tunnel list named apps1:
hostname(config-group-policy)# webvpnhostname(config-group-webvpn)# smart-tunnel enable apps1hostname(config-group-webvpn)The following commands remove the list named apps1 from the group policy and inherit the smart tunnel list from the default group policy:
hostname(config-group-policy)# webvpnhostname(config-group-webvpn)# no smart-tunnelhostname(config-group-webvpn)Related Command
s
smart-tunnel list
To populate a list of applications that can use a clientless (browser-based) SSL VPN session to connect to private sites, use the smart-tunnel list command in webvpn configuration mode. To remove an application from a list, use the no form of the command, specifying the entry. To remove an entire list of applications from the ASA configuration, use the no form of the command, specifying only the list.
[no] smart-tunnel list list application path [platform OS] [hash]
no smart-tunnel list list
Syntax Description
Defaults
Windows is the default platform.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
You can configure more than one smart tunnel list on an ASA, but you cannot assign more than one smart tunnel list to a given group policy or username. To populate a smart tunnel list, enter the smart-tunnel list command once for each application, entering the same list string, but specifying an application and path that is unique for the OS. Enter the command once for each OS you want the list to support.
The session ignores a list entry if the OS does not match the one indicated in the entry. It also ignores an entry if the path to the application is not present.
To view the smart tunnel list entries in the SSL VPN configuration, enter the show running-config webvpn smart-tunnel command in privileged EXEC mode.
The path must match the one on the computer, but it does not have to be complete. For example, the path can consist of nothing more than the executable file and its extension.
Smart tunnels have the following requirements:
•
•
•
•
On Microsoft Windows, only Winsock 2, TCP-based applications are eligible for smart tunnel access.
On Mac OS, applications using TCP that are dynamically linked to the SSL library can work over a smart tunnel. The following types of applications do not work over a smart tunnel:
•
•
•
•
•
On Mac OS, only applications started from the portal page can establish smart tunnel sessions. This requirement includes smart tunnel support for Firefox. Using Firefox to start another instance of Firefox during the first use of a smart tunnel requires the user profile named csco_st. If this user profile is not present, the session prompts the user to create one.
The following limitations apply to smart tunnels:
•
•
•
•
Note
Entering a hash provides a reasonable assurance that clientless SSL VPN does not qualify an illegitimate file that matches the string you specified in the path. Because the checksum varies with each version or patch of an application, the hash you enter can only match one version or patch on the remote host. To specify a hash for more than one version of an application, enter the smart-tunnel list command once for each version, entering the same list string, but specifying the unique application string and unique hash value in each command.
Note
Following the configuration of a smart tunnel list, use the smart-tunnel auto-start or smart-tunnel enable command to assign the list to group policies or usernames.
Examples
The following command adds the Microsoft Windows application Connect to a smart tunnel list named apps1:
hostname(config-webvpn)# smart-tunnel list apps1 LotusSametime connect.exeThe following command adds the Windows application msimn.exe and requires that the hash of the application on the remote host match the last string entered to qualify for smart tunnel access:
hostname(config-webvpn)# smart-tunnel list apps1 OutlookExpress msimn.exe 4739647b255d3ea865554e27c3f96b9476e75061The following command provides smart tunnel support for the Mac OS browser Safari:
hostname(config-webvpn)# smart-tunnel list apps1 Safari /Applications/Safari platform macRelated Commands
smart-tunnel network
To create a list of hosts to use for configuring smart tunnel tunnel policies, use the smart-tunnel network command in webvpn configuration mode. To disallow a list of hosts for smart tunnel tunnel policies, use the [no] form of this command.
smart-tunnel network
no smart-tunnel network
Syntax Description
host host mask
The hostname mask, such as *.cisco.com.
ip ip address
The IP address of a network.
netmask
The Netmask of a network.
network name
The name of the network to apply to tunnel policy.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
•
•
Command History
Usage Guidelines
When the smart tunnel is turned on, you can allow traffic outside of the tunnel with the smart-tunnel network command, which configures the network (a set of hosts), and the smart-tunnel tunnel-policy command, which uses the specified smart-tunnel network to enforce a policy on a user.
Examples
The following is a sample of how the smart-tunnel network command is used:
hostname(config-webvpn)# smart-tunnel network testnet ip 192.168.0.0 255.255.255Related Commands
smart-tunnel tunnel-policy
Uses the specified smart-tunnel network to enforce a policy on a user.
smart-tunnel tunnel-policy
To apply smart tunnel tunnel policies to a particular group or user policy, use the smart-tunnel tunnel-policy command in configuration webvpn mode. To unapply smart tunnel tunnel policies to a particular group, use the [no] form of this command.
smart-tunnel tunnel-policy
no smart-tunnel tunnel-policy
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
•
•
Command History
Usage Guidelines
When the smart tunnel is turned on, you can allow traffic outside of the tunnel with the smart-tunnel network command, which configures the network (a set of hosts), and the smart-tunnel tunnel-policy command, which uses the specified smart-tunnel network to enforce a policy on a user.
Examples
The following is a sample of how the smart-tunnel tunnel-policycommand is used:
hostname(config-username-webvpn)# smart-tunnel tunnel-policy tunnelspecified testnetRelated Commands
smart-tunnel network
Creates a list of hosts for configuring smart tunnel policies.
smtp from-address
To specify the e-mail address to use in the E-mail From: field for all e-mails generated by the local CA server (such as distribution of one-time passwords) use the smtp from-address command in CA server configuration mode. To reset the e-mail address to the default, use the no form of this command.
smtp from-address e-mail_address
no smtp from-address
Syntax Description
e-mail_address
Specifies the e-mail address appearing in the From: field of all e-mails generated by the CA server.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Ca server configuration
•
—
•
—
—
Command History
Examples
The following example specifies that the From: field of all e-mails from the local CA server include ca-admin@asa1-ca.example.com:
hostname(config)# crypto ca serverhostname(config-ca-server)# smtp from-address ca-admin@asa1-ca.example.comhostname(config-ca-server)#The following example resets the From: field of all e-mails from the local CA server to the default address admin@asa1-ca.example.com:
hostname(config)# crypto ca serverhostname(config-ca-server)# smtp from-address admin@asa1-ca.example.comhostname(config-ca-server)#Related Commands
smtp subject
To customize the text that appears in the subject field of all e-mails generated by the local Certificate Authority (CA) server (such as distribution of one-time passwords), use the smtp subject command in CA server configuration mode. To reset the text to the default, use the no form of this command.
smtp subject subject-line
no smtp subject
Syntax Description
subject-line
Specifies the text appearing in the Subj: field of all e-mails sent from the CA server. The maximum number of characters is 127.
Defaults
By default, the text in the Subj: field is "Certificate Enrollment Invitation".
Command Modes
The following table shows the modes in which you can enter the command:
Ca server configuration
•
—
•
—
—
Command History
Examples
The following example specifies that the text Action: Enroll for a certificate appear in the Subj: field of all e-mails from the CA server:
hostname(config)# crypto ca serverhostname(config-ca-server)# smtp subject Action: Enroll for a certificatehostname(config-ca-server)#The following example resets the Subj: field text for all e-mails from the CA server to the default text "Certificate Enrollment Invitation":
hostname(config)# crypto ca serverhostname(config-ca-server)# no smtp subjecthostname(config-ca-server)#Related Commands
smtps
To enter SMTPS configuration mode, use the smtps command in global configuration mode. To remove any commands entered in SMTPS command mode, use the no version of this command. SMTPS is a TCP/IP protocol that lets you to send e-mail over an SSL connection.
smtps
no smtps
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Examples
The following example shows how to enter SMTPS configuration mode:
hostname(config)#smtpshostname(config-smtps)#Related Commands
clear configure smtps
Removes the SMTPS configuration.
show running-config smtps
Displays the running configuration for SMTPS.
smtp-server
To configure an SMTP server, use the smtp-server command in global configuration mode. To remove the attribute from the configuration, use the no form of this command.
smtp-server {primary_server} [backup_server]
no smtp-server
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
The ASA includes an internal SMTP client that the Events system can use to notify external entities that a certain event has occurred. You can configure SMTP servers to receive these event notices, and then forward them to specified e-mail addresses. The SMTP facility is active only when you enable E-mail events to the ASA.
Examples
The following example shows how to set an SMTP server with an IP address of 10.1.1.24, and a backup SMTP server with an IP address of 10.1.1.34:
hostname(config)#smtp-server 10.1.1.24 10.1.1.34snmp cpu threshold rising
To configure the threshold value for a high CPU threshold and the threshold monitoring period, use the snmp cpu threshold rising command in global configuration mode. To not configure the threshold value and threshold monitoring period, use the no form of this command.
snmp cpu threshold rising threshold_value monitoring_period
no snmp cpu threshold rising threshold_value monitoring_period
Syntax Description
monitoring_period
Defines the monitoring period in minutes.
threshold_value
Defines the threshold level as a percentage of CPU usage.
Defaults
If the snmp cpu threshold rising command is not configured, the default for the high threshold level is set at over 70 percent of CPU usage, and the default for the critical threshold level isset at over 95 percent of CPU usage. The default monitoring period is set to one minute.
Command Modes
The following table shows the modes in which you can enter the command.
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
You cannot configure the critical CPU threshold level, which is maintained at a constant 95 percent. Valid threshold values range from 10 to 94 percent of CPU usage. Valid values for the monitoring period range from 1 to 60 minutes.
Examples
The following example shows how to configure the SNMP CPU threshold level to 75 percent of CPU usage and a monitoring period of 30 minutes:
hostname(config)# snmp cpu threshold 75% 30Related Commands
snmp link threshold
To configure the threshold value for an SNMP physical interface and the threshold value for system memory usage, use the snmp link threshold command in global configuration mode. To clear the threshold value for an SNMP physical interface and the threshold value for system memory usage, use the no form of this command.
snmp link threshold threshold_value
no snmp link threshold threshold_value
Syntax Description
Defaults
If you do not configure the snmp link threshold command, the default threshold value is 70 percent of CPU usage and system memory usage.
Command Modes
The following table shows the modes in which you can enter the command.
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Valid threshold values range from 30 to 99 percent of physical interfaces. The snmp link threshold command is available only in the admin context.
Examples
The following example shows how to configure the SNMP interface threshold value to 75 percent for all physical interfaces:
hostname(config)# snmp link threshold 75%Related Commands
snmp-map
To identify a specific map for defining the parameters for SNMP inspection, use the snmp-map command in global configuration mode. To remove the map, use the no form of this command.
snmp-map map_name
no snmp-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the snmp-map command to identify a specific map to use for defining the parameters for SNMP inspection. When you enter this command, the system enters the SNMP map configuration mode, which lets you enter the different commands used for defining the specific map. After defining the SNMP map, you use the inspect snmp command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.
Examples
The following example shows how to identify SNMP traffic, define a SNMP map, define a policy, and apply the policy to the outside interface.
hostname(config)# access-list snmp-acl permit tcp any any eq 161hostname(config)# access-list snmp-acl permit tcp any any eq 162hostname(config)# class-map snmp-porthostname(config-cmap)# match access-list snmp-aclhostname(config-cmap)# exithostname(config)# snmp-map inbound_snmphostname(config-snmp-map)# deny version 1hostname(config-snmp-map)# exithostname(config)# policy-map inbound_policyhostname(config-pmap)# class snmp-porthostname(config-pmap-c)# inspect snmp inbound_snmphostname(config-pmap-c)#Related Commands
snmp-server community
To set the SNMP community string, use the snmp-server community command in global configuration mode. To remove the SNMP community string, use the no form of this command.
snmp-server community [0 | 8] community-string
no snmp-server community [0 | 8] community-string
Syntax Description
Defaults
The default community string is "public."
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
8.2(1)
The text argument was changed to the community-string argument.
8.3(1)
Support for encrypted passwords was added.
Usage Guidelines
The SNMP community string is a shared secret among the SNMP management station and the network nodes being managed. It is used only for Version 1 and 2c communication between the management station and the device. The ASA uses a key to determine whether or not the incoming SNMP request is valid.
For example, you could designate a site with a community string and then configure the routers, the ASA, and the management station with this same string. The ASA uses this string and does not respond to requests with an invalid community string.
After you have used an encrypted community string, only the encrypted form is visible to all systems (for example, CLI, ASDM, CSM, and so on). The clear text password is not visible.
The encrypted community string is always generated by the ASA; you normally enter the clear text form.
Note
Examples
The following example sets the community string to "onceuponatime":
hostname(config)# snmp-server community onceuponatimeThe following example sets an encrypted community string:
hostname(config)# snmp-server community 8 LvAu+JdFG+GjPmZYlKvAhXpb28E=The following example sets an unencrypted community string:
hostname(config)# snmp-server community 0 ciscoRelated Commands
snmp-server contact
To set the SNMP server contact name, use the snmp-server contact command in global configuration mode. To remove the SNMP contact name, use the no form of this command.
snmp-server contact text
no snmp-server contact [text]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example sets the SNMP server contact to EmployeeA:
hostname(config)# snmp-server contact EmployeeARelated Commands
snmp-server enable
To enable the SNMP server on the ASA, use the snmp-server enable command in global configuration mode. To disable the SNMP server, use the no form of this command.
snmp-server enable
no snmp-server enable
Syntax Description
This command has no arguments or keywords.
Defaults
The SNMP server is enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
You can enable and disable SNMP easily, without configuring and reconfiguring SNMP traps or other configuration.
Examples
The following example enables SNMP, configures the SNMP host and traps, and then sends traps as syslog messages.
hostname(config)# snmp-server enablehostname(config)# snmp-server community onceuponatimehostname(config)# snmp-server location Building 42, Sector 54hostname(config)# snmp-server contact EmployeeBhostname(config)# snmp-server host perimeter 10.1.2.42hostname(config)# snmp-server enable traps allhostname(config)# logging history 7hostname(config)# logging enableRelated Commands
snmp-server enable traps
To enable the ASA to send traps to the NMS, use the snmp-server enable traps command in global configuration mode. To disable traps, use the no form of this command.
snmp-server enable traps [all | syslog | snmp [trap] [...] | entity [trap] [...] | ipsec [trap] [...] | ikev2 [trap] [...] | remote-access [trap] | connection-limit-reached | cpu threshold rising | link-threshold | memory-threshold | nat [trap]
no snmp-server enable traps [all | syslog | snmp [trap] [...] | entity [trap] [...] | ipsec [trap] [...] | remote-access [trap] | connection-limit-reached | cpu threshold rising | link-threshold | memory-threshold | nat [trap]
Syntax Description
Defaults
The default configuration has all snmp traps enabled (snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart). If you enter this command and do not specify a trap type, then the default is syslog. (The default snmp traps continue to be enabled along with the syslog trap.) All other traps are disabled by default.
You can disable these traps using the no form of this command with the snmp keyword. The clear configure snmp-server command restores the default enabling of SNMP traps.
Command Modes
The following table shows the modes in which you can enter the command.
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
To enable individual traps or sets of traps, enter this command for each feature type. To enable all traps, enter the all keyword.
To send traps to the NMS, enter the logging history command, then enable logging using the logging enable command.
Traps generated in the admin context only include the following:
•
•
•
Traps generated through the admin context only for physically connected interfaces in the system context include the following:
•
All other traps are available in the admin and user contexts.
Note
If the CPU usage is greater than the configured threshold value for the configured monitoring period, a cpu threshold rising trap is generated.
When the used system memory reaches 80 percent, the memory-threshold trap is generated.
Note
Examples
The following example enables SNMP, configures the SNMP host and traps, then sends traps as syslog messages:
hostname(config)# snmp-server enablehostname(config)# snmp-server community onceuponatimehostname(config)# snmp-server location Building 42, Sector 54hostname(config)# snmp-server contact EmployeeBhostname(config)# snmp-server host perimeter 10.1.2.42hostname(config)# snmp-server enable traps allhostname(config)# logging history 7hostname(config)# logging enableRelated Commands
snmp-server group
To configure a new SNMP group, use the snmp-server group command in global configuration mode. To remove a specified SNMP group, use the no form of this command.
snmp-server group group-name {v3 {auth | noauth | priv}}
no snmp-server group group-name {v3 {auth | noauth | priv}}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
8.2(1)
This command was introduced.
8.3(1)
Support for password encryption was added.
Usage Guidelines
To use the Version 3 security model, you must first configure an SNMP group, then configure an SNMP user, and then configure an SNMP host. You must also specify Version 3 and a security level. When a community string is configured internally, two groups with the name "public" are automatically created—one for the Version 1 security model and one for the Version 2c security model. When you delete a community string, both configured groups are automatically deleted.
Note
During bootup or upgrade of the ASA, single-digit passwords and passwords starting with a digit followed by a whitespace are no longer supported. For example, 0 pass and 1 are invalid passwords.
Note
Examples
The following example show how the ASA can receive SNMP requests using the SNMP Version 3 security model, which includes creating a group, creating a user, and creating a host:
hostname(config)# snmp-server group v3 vpn-group privhostname(config)# snmp-server user admin vpn group v3 auth sha letmein priv 3des cisco123hostname(config)# snmp-server host mgmt 10.0.0.1 version 3 priv adminRelated Commands
clear configure snmp-server
Clears the SNMP configuration counters.
snmp-server host
Sets the SNMP host address.
snmp-server user
Creates a new SNMP user.
snmp-server host
To specify the NMS that can use SNMP on the ASA, use the snmp-server host command in global configuration mode. To disable the NMS, use the no form of this command.
snmp-server host {interface {hostname | ip_address}} [trap | poll] [community 0 | 8 community-string] [version {1 | 2c | 3 username}] [udp-port port]
no snmp-server host {interface {hostname | ip_address}} [trap | poll] [community 0 | 8 community-string] [version {1 | 2c | 3 username}] [udp-port port]
Syntax Description
Defaults
The default UDP port is 162.
The default version is 1.
SNMP traps are enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you configure the snmp-server host command on a port that is currently in use, the following message appears:
WarningThe existing SNMP thread continues to poll every 60 seconds until the port is available, and issues syslog message %ASA-1-212001 if the port is still in use.
To use the Version 3 security model, you must configure an SNMP group first, then an SNMP user, and then an SNMP host. The username must already be configured on the device. When a device is configured as the standby unit of a failover pair, the SNMP engine ID and user configuration are replicated from the active unit. This action allows a transparent switchover from an SNMP Version 3 query perspective. No configuration changes are necessary in the NMS to accommodate a switchover event.
After you have used an encrypted community string, only the encrypted form is visible to all systems (for example, CLI, ASDM, CSM, and so on). The clear text password is not visible.
The encrypted community string is always generated by the ASA; you normally enter the clear text form.
During bootup or upgrade of the ASA, single-digit passwords and passwords starting with a digit followed by a whitespace are no longer supported. For example, 0 pass and 1 are invalid passwords.
Note
Examples
The following example sets the host to 192.0.2.5, which is attached to the inside interface:
hostname(config)# snmp-server host inside 192.0.2.5hostname(config)# snmp-server host inside 192.0.2.5 version 3 md5aes128 udp-port 190The following example show how the ASA can receive SNMP requests using the SNMP Version 3 security model, which includes creating a group, creating a user, and creating a host:
hostname(config)# snmp-server group v3 vpn-group privhostname(config)# snmp-server user admin vpn group v3 auth sha letmein priv 3des cisco123hostname(config)# snmp-server host mgmt 10.0.0.1 version 3 priv adminThe following example sets the host to use an encrypted community string:
hostname(config)# snmp-server host mgmt 1.2.3.4 community 8 LvAu+JdFG+GjPmZYlKvAhXpb28E=The following example sets the host to use an unencrypted community string:
hostname(config)# snmp-server host mgmt 1.2.3.4 community 0 ciscoRelated Commands
snmp-server listen-port
To set the listening port for SNMP requests, use the snmp-server listen-port command in global configuration mode. To restore the default port, use the no form of the command.
snmp-server listen-port lport
no snmp-server listen-port lport
Syntax Description
lport
The port on which incoming requests will be accepted1 .
1 The snmp-server listen-port command is only available in admin context, and is not available in the system context.
Defaults
The default port is 161.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you configure the snmp-server listen-port command on a port that is currently in use, the following message appears:
WarningThe existing SNMP thread continues to poll every 60 seconds until the port is available, and issues syslog message %ASA-1-212001 if the port is still in use.
Examples
The following example sets the listening port to 192:
hostname(config)# snmp-server listen-port 192Related Commands
snmp-server location
To set the ASA location for SNMP, use the snmp-server location command in global configuration mode. To remove the location, use the no form of this command.
snmp-server location text
no snmp-server location [text]
Syntax Description
location text
Specifies the security appliance location. The location text is case sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example sets the ASA location for SNMP as Building 42, Sector 54:
hostname(config)# snmp-server location Building 42, Sector 54Related Commands
snmp-server user
To configure a new SNMP user, use the snmp-server user command in global configuration mode. To remove a specified SNMP user, use the no form of this command.
snmp-server user username group-name {v3 [encrypted] [auth {md5 | sha} auth-password]} [priv {des | 3des | aes {128 | 192 | 256}} priv-password]
no snmp-server user username group-name {v3 [encrypted] [auth {md5 | sha} auth-password]} [priv {des | 3des | aes {128 | 192 | 256}} priv-password]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
An SNMP user must be part of an SNMP group. To use the Version 3 security model, you must first configure an SNMP group, then configure an SNMP user, and then configure an SNMP host.
Note
When the snmp-server user configuration is displayed on the console or written to a file (for example, the startup-configuration file), the localized authentication and privacy digests always appear instead of a plain-text password. This usage is required by RFC 3414, Section 11.2.
Note
During bootup or upgrade of the ASA, single-digit passwords and passwords starting with a digit followed by a whitespace are no longer supported. For example, 0 pass and 1 are invalid passwords.
Examples
The following example shows how the ASA can receive SNMP requests using the SNMP Version 3 security model:
hostname(config)# snmp-server group engineering v3 authhostname(config)# snmp-server user engineering v3 auth sha mypasswordRelated Commands
