-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
tcp-map through title Commands
test dynamic-access-policy attributes
test dynamic-access-policy execute
threat-detection scanning-threat
timeout (dns-server-group configuration mode)
timers lsa-group-pacing (OSPFv2)
timers pacing lsa-group (OSPFv3)
tcp-map through title Commands
tcp-map
To define a set of TCP normalization actions, use the tcp-map command in global configuration mode. The TCP normalization feature lets you specify criteria that identify abnormal packets, which the ASA drops when they are detected. To remove the TCP map, use the no form of this command.
tcp-map map_name
no tcp-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
7.2(4)/8.0(4)
The invalid-ack, seq-past-window, and synack-data subcommands were added.
Usage Guidelines
This feature uses Modular Policy Framework. First define the TCP normalization actions you want to take using the tcp-map command. The tcp-map command enters tcp-map configuration mode, where you can enter one or more commands to define the TCP normalization actions. Then define the traffic to which you want to apply the TCP map using the class-map command. Enter the policy-map command to define the policy, and enter the class command to reference the class map. In class configuration mode, enter the set connection advanced-options command to reference the TCP map. Finally, apply the policy map to an interface using the service-policy command. For more information about how Modular Policy Framework works, see the CLI configuration guide.
The following commands are available in tcp-map configuration mode:
Examples
For example, to allow urgent flag and urgent offset packets for all traffic sent to the range of TCP ports between the well known FTP data port and the Telnet port, enter the following commands:
hostname(config)# tcp-map tmaphostname(config-tcp-map)# urgent-flag allowhostname(config-tcp-map)# class-map urg-classhostname(config-cmap)# match port tcp range ftp-data telnethostname(config-cmap)# policy-map pmaphostname(config-pmap)# class urg-classhostname(config-pmap-c)# set connection advanced-options tmaphostname(config-pmap-c)# service-policy pmap globalRelated Commands
tcp-options
To allow or clear the TCP options through the ASA, use the tcp-options command in tcp-map configuration mode. To remove this specification, use the no form of this command.
tcp-options {selective-ack | timestamp | window-scale} {allow | clear}
no tcp-options {selective-ack | timestamp | window-scale} {allow | clear}
tcp-options range lower upper {allow | clear | drop}
no tcp-options range lower upper {allow | clear | drop}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the tcp-options command in tcp-map configuration mode to clear selective-acknowledgement, window-scale, and timestamp TCP options. You can also clear or drop packets with options that are not very well defined.
Examples
The following example shows how to drop all packets with TCP options in the ranges of 6-7 and 9-255:
hostname(config)# access-list TCP extended permit tcp any anyhostname(config)# tcp-map tmaphostname(config-tcp-map)# tcp-options range 6 7 drophostname(config-tcp-map)# tcp-options range 9 255 drophostname(config)# class-map cmaphostname(config-cmap)# match access-list TCPhostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
telnet
To allow Telnet access to an interface, use the telnet command in global configuration mode. To remove Telnet access, use the no form of this command.
telnet {ipv4_address mask | ipv6_address/prefix} interface_name
no telnet {ipv4_address mask | ipv6_address/prefix} interface_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
9.0(2), 9.1(2)
The default password, "cisco," has been removed; you must actively set a login password using the password command.
Usage Guidelines
The telnet command lets you specify which hosts can access the ASA CLI with Telnet. You can enable Telnet to the ASA on all interfaces. However, You cannot use Telnet to the lowest security interface unless you use Telnet inside a VPN tunnel.
Use the password command to set a password for Telnet access to the console. Use the who command to view which IP addresses are currently accessing the ASA console. Use the kill command to terminate an active Telnet console session.
If you use the aaa authentication telnet console command, Telnet console access must be authenticated with an authentication server.
Examples
This example shows how to permit hosts 192.168.1.3 and 192.168.1.4 to access the ASA CLI through Telnet. In addition, all the hosts on the 192.168.2.0 network are given access.
hostname(config)# telnet 192.168.1.3 255.255.255.255 insidehostname(config)# telnet 192.168.1.4 255.255.255.255 insidehostname(config)# telnet 192.168.2.0 255.255.255.0 insidehostname(config)# show running-config telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideThis example shows a Telnet console login session (the password does not display when entered):
hostname# passwd: ciscoWelcome to the XXX...Type help or `?' for a list of available commands.hostname>You can remove individual entries with the no telnet command or all telnet command statements with the clear configure telnet command:
hostname(config)# no telnet 192.168.1.3 255.255.255.255 insidehostname(config)# show running-config telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insidehostname(config)# clear configure telnetRelated Commands
telnet timeout
To set the Telnet idle timeout, use the telnet timeout command in global configuration mode. To restore the default timeout, use the no form of this command.
telnet timeout minutes
no telnet timeout minutes
Syntax Description
minutes
Number of minutes that a Telnet session can be idle before being closed by the ASA. Valid values are from 1 to 1440 minutes. The default is 5 minutes.
Defaults
By default, Telnet sessions left idle for five minutes are closed by the ASA.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the telnet timeout command to set the maximum time that a console Telnet session can be idle before being logged off by the ASA.
Examples
This example shows how to change the maximum session idle duration:
hostname(config)# telnet timeout 10hostname(config)# show running-config telnet timeouttelnet timeout 10 minutesRelated Commands
terminal
To allow syslog messages to show in the current Telnet session, use the terminal monitor command in privileged EXEC mode. To disable syslog messages, use the no form of this command.
terminal {monitor | no monitor}
Syntax Description
monitor
Enables the display of syslog messages in the current Telnet session.
no monitor
Disables the display of syslog messages in the current Telnet session.
Defaults
Syslog messages are disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
This example shows how to display and disable syslog messages in the current session:
hostname# terminal monitorhostname# terminal no monitorRelated Commands
terminal pager
To set the number of lines on a page before the "---More---"
192.168.1.3 255.255.255.255 insideprompt appears for Telnet sessions, use the terminal pager command in privileged EXEC mode.terminal pager [lines] lines
Syntax Description
Defaults
The default is 24 lines.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command changes the pager line setting only for the current Telnet session. To save a new default pager setting to the configuration, use the pager command.
If you use Telnet to access the admin context, then the pager line setting follows your session when you change to other contexts, even if the pager command in a given context has a different setting. To change the current pager setting, enter the terminal pager command with a new setting, or you can enter the pager command in the current context. In addition to saving a new pager setting to the context configuration, the pager command applies the new setting to the current Telnet session.
Examples
The following example changes the number of lines displayed to 20:
hostname# terminal pager 20Related Commands
terminal width
To set the width for displaying information during console sessions, use the terminal width command in global configuration mode. To disable, use the no form of this command.
terminal width columns
no terminal width columns
Syntax Description
Defaults
The default display width is 80 columns.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Examples
This example shows how to terminal display width to 100 columns:
hostname# terminal width 100Related Commands
test aaa-server
To check whether the ASA can authenticate or authorize users with a particular AAA server, use the test aaa-server command in privileged EXEC mode. Failure to reach the AAA server may be due to incorrect configuration on the ASA, or the AAA server may be unreachable for other reasons, such as restrictive network configurations or server downtime.
test aaa-server {authentication server_tag [host ip_address] [username username] [password password] | authorization server_tag [host ip_address] [username username][ad-agent]}
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The test aaa-server command lets you verify that the ASA can authenticate users with a particular AAA server, and for legacy VPN authorization, if you can authorize a user. This command lets you test the AAA server without having an actual user who attempts to authenticate or authorize. It also helps you isolate whether AAA failures are due to misconfiguration of AAA server parameters, a connection problem to the AAA server, or other configuration errors on the ASA.
Examples
The following example configures a RADIUS AAA server named srvgrp1 on host 192.168.3.4, sets a timeout of 9 seconds, sets a retry-interval of 7 seconds, and configures authentication port 1650. The test aaa-server command following the setup of the AAA server parameters indicates that the authentication test failed to reach the server.
hostname(config)#aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)#aaa-server svrgrp1 host 192.168.3.4hostname(config-aaa-server-host)#timeout 9hostname(config-aaa-server-host)#retry-interval 7hostname(config-aaa-server-host)#authentication-port 1650hostname(config-aaa-server-host)#exithostname(config)#test aaa-server authentication svrgrp1Server IP Address or name:192.168.3.4Username:bogusPassword:mypasswordINFO: Attempting Authentication test to IP address <192.168.3.4> (timeout: 10 seconds)ERROR: Authentication Rejected: UnspecifiedThe following is sample output from the test aaa-server command with a successful outcome:
hostname# test aaa-server authentication svrgrp1 host 192.168.3.4 username bogus password mypasswordINFO: Attempting Authentication test to IP address <10.77.152.85> (timeout: 12 seconds)INFO: Authentication SuccessfulRelated Commands
test aaa-server ad-agent
To test the Active Directory Agent configuration after you configure, use the test aaa-server ad-agent command in AAA Server Group configuration mode.
test aaa-server ad-agent
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
AAA Server Group configuration mode
•
—
•
—
—
Command History
Usage Guidelines
To configure the Active Directory Agent for the Identity Firewall, you must enter the ad-agent-mode command, which is a submode of the aaa-server command. Entering the ad-agent-mode command enters the AAA Server Group configuration mode.
After configuring the Active Directory Agent, enter the test aaa-server ad-agent command to verify that the ASA has a functional connection to the Active Directory Agent.
Periodically or on-demand, the AD Agent monitors the Active Directory server security event log file via WMI for user login and logoff events. The AD Agent maintains a cache of user ID and IP address mappings. and notifies the ASA of changes.
Configure the primary and secondary AD Agents for the AD Agent Server Group. When the ASA detects that the primary AD Agent is not responding and a secondary agent is specified, the ASA switches to secondary AD Agent. The Active Directory server for the AD agent uses RADIUS as the communication protocol; therefore, you should specify a key attribute for the shared secret between ASA and AD Agent.
Examples
The following example shows how to enable ad-agent-mode while configuring the Active Directory Agent for the Identity Firewall and then test the connection:
hostname(config)# aaa-server adagent protocol radiushostname(config)# ad-agent-modehostname(config-aaa-server-group)# aaa-server adagent (inside) host 192.168.1.101hostname(config-aaa-server-host)# key mysecrethostname(config-aaa-server-hostkey)# user-identity ad-agent aaa-server adagenthostname(config-aaa-server-host)# test aaa-server ad-agentRelated Commands
test dynamic-access-policy attributes
To enter the dap attributes mode, from Privileged EXEC mode, enter the test dynamic-access-policy attributes command. Doing so lets you specify user and endpoint attribute value pairs.
dynamic-access-policy attributes
Defaults
No default value or behaviors.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
—
Command History
Usage Guidelines
Normally the ASA retrieves user authorization attributes from the AAA server and retrieves endpoint attributes from Cisco Secure Desktop, Host Scan, CNA or NAC. For the test command, you specify the user authorization and endpoint attributes in this attributes mode. The ASA writes them to an attribute database that the DAP subsystem references when evaluating the AAA selection attributes and endpoint select attributes for a DAP record.
This feature lets you experiment with creating a DAP record.
Examples
The following example shows how to use the attributes command.
hostname #test dynamic-access-policy attributeshostname(config-dap-test-attr)#Related Commands
dynamic-access-policy-record
Creates a DAP record.
attributes
Enters attributes mode, in which you can specify user attribute value pairs.
display
Displays current attribute list.
test dynamic-access-policy execute
To test already configured DAP records, use the test dynamic-access-policy execute command in privileged EXEC mode:
test dynamic-access-policy execute
Syntax Description
Syntax DescriptionSyntax Description
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
—
Command History
Usage Guidelines
This command lets you test the retrieval of the set of DAP records configured on the device by specifying authorization attribute value pairs.
test regex
To test a regular expression, use the test regex command in privileged EXEC mode.
test regex input_text regular_expression
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The test regex command tests a regular expression to make sure it matches what you think it will match.
If the regular expression matches the input text, you see the following message:
INFO: Regular expression match succeeded.If the regular expression does not match the input text, you see the following message:
INFO: Regular expression match failed.Examples
The following example tests input text against a regular expression:
hostname# test regex farscape scapeINFO: Regular expression match succeeded.hostname# test regex farscape scaperINFO: Regular expression match failed.Related Commands
test sso-server
To test an SSO server with a trial authentication request, use the test sso-server command in privileged EXEC mode.
test sso-server server-name username user-name
Syntax Description
Syntax DescriptionSyntax Description
server-name
Specifies the name of the SSO server being tested.
user-name
Specifies the name of a user on the SSO server being tested.
Defaults
No default values or behavior.
Command Modes
The following table shows the modes in which you can enter the command:
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The test sso-server command tests whether an SSO server is recognized and responding to authentication requests.
If the SSO server specified by the server-name argument is not found, the following error appears:
192.168.2.0 255.255.255.0 insideserver-name does not existIf the SSO server is found but the user specified by the user-name argument is not found, the authentication is rejected.
In the authentication, the ASA acts as a proxy for the WebVPN user to the SSO server. The ASA currently supports the SiteMinder SSO server (formerly Netegrity SiteMinder) and the SAML POST-type SSO server. This command applies to both types of SSO Servers.
Examples
The following example, entered in privileged EXEC mode, successfully tests an SSO server named my-sso-server using a username of Anyuser:
hostname# test sso-server my-sso-server username AnyuserINFO: Attempting authentication request to sso-server my-sso-server for user AnyuserINFO: STATUS: Successhostname#The following example shows a test of the same server, but the user, Anotheruser, is not recognized and the authentication fails:
hostname# test sso-server my-sso-server username AnotheruserINFO: Attempting authentication request to sso-server my-sso-server for user AnotheruserINFO: STATUS: Failedhostname#Related Commands
text-color
To set a color for text in the WebVPN title bar on the login, home page, and file access page, use the text-color command in webvpn mode. To remove a text color from the configuration and reset the default, use the no form of this command.
text-color [black | white | auto]
no text-color
Syntax Description
Defaults
The default text color for the title bars is white.
Command Modes
The following table shows the modes in which you can enter the command:
config-webvpn
•
—
•
—
—
Command History
Examples
The following example shows how to set the text color for title bars to black:
hostname(config)#webvpnhostname(config-webvpn)# text-color blackRelated Commands
secondary-text-color
Sets the secondary text color for the WebVPN login, home page, and file access page.
tftp-server
To specify the default TFTP server and path and filename for use with configure net or write net commands, use the tftp-server command in global configuration mode. To remove the server configuration, use the no form of this command. This command supports IPv4 and IPv6 addresses.
tftp-server interface_name server filename
no tftp-server [interface_name server filename]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The tftp-server command simplifies entering the configure net and write net commands. When you enter the configure net or write net commands, you can either inherit the TFTP server specified by the tftp-server command, or provide your own value. You can also inherit the path in the tftp-server command as-is, add a path and filename to the end of the tftp-server command value, or override the tftp-server command value.
The ASA supports only one tftp-server command.
Examples
The following example shows how to specify a TFTP server and then read the configuration from the /temp/config/test_config directory:
hostname(config)# tftp-server inside 10.1.1.42 /temp/config/test_confighostname(config)# configure netRelated Commands
tftp-server address
To specify the TFTP servers in the cluster, use the tftp-server address command in phone-proxy configuration mode. To remove the TFTP server from the Phone Proxy configuration, use the no form of this command.
tftp-server address ip_address [port] interface interface
no tftp-server address ip_address [port] interface interface
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Phone-proxy configuration
•
—
•
—
—
Command History
Usage Guidelines
The Phone Proxy must have at least one CUCM TFTP server configured. Up to five TFTP servers can be configured for the Phone Proxy.
The TFTP server is assumed to be behind the firewall on the trusted network; therefore, the Phone Proxy intercepts the requests between the IP phones and TFTP server. The TFTP server must reside on the same interface as the CUCM.
Create the TFTP server using the internal IP address and specify the interface on which the TFTP server resides.
On the IP phones, the IP address of the TFTP server must be configured as follows:
•
•
If the service-policy is applied globally, a classification rule will be created to direct any TFTP traffic reaching the TFTP server on all ingress interfaces, except for the interface on which the TFTP server resides. When the service-policy is applied on a specific interface, a classification rule will be created to direct any TFTP traffic reaching the TFTP server on that specified interface to the phone-proxy module.
If a NAT rule is configured for the TFTP server, it must be configured prior to applying the service-policy so that the global address of the TFTP server is used when installing the classification rule.
Examples
The following example shows the use of the tftp-server address command to configure two TFTP servers for the Phone Proxy:
hostname(config)#phone-proxy asa_phone_proxyhostname(config-phone-proxy)#tftp-server address 192.168.1.2 in interface outsidehostname(config-phone-proxy)#tftp-server address 192.168.1.3 in interface outsidehostname(config-phone-proxy)#media-termination address 192.168.1.4 interface insidehostname(config-phone-proxy)#media-termination address 192.168.1.25 interface outsidehostname(config-phone-proxy)#tls-proxy asa_tlsphostname(config-phone-proxy)#ctl-file asactlhostname(config-phone-proxy)#cluster-mode nonsecureRelated Commands
threat-detection basic-threat
To enable basic threat detection, use the threat-detection basic-threat command in global configuration mode. To disable basic threat detection, use the no form of this command.
threat-detection basic-threat
no threat-detection basic-threat
Syntax Description
This command has no arguments or keywords.
Defaults
Basic threat detection is enabled by default. The following default rate limits are used:
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
8.0(2)
This command was introduced.
8.2(1)
The burst rate interval changed from 1/60th to 1/30th of the average rate.
Usage Guidelines
When you enable basic threat detection, the ASA monitors the rate of dropped packets and security events due to the following reasons:
•
•
•
•
•
•
•
•
•
•
When the ASA detects a threat, it immediately sends a system log message (733100) and alerts ASDM.
Basic threat detection affects performance only when there are drops or potential threats; even in this scenario, the performance impact is insignificant.
Table 64-1 in the "Defaults" section lists the default settings. You can view all these default settings using the show running-config all threat-detection command. You can override the default settings for each type of event by using the threat-detection rate command.
If an event rate is exceeded, then the ASA sends a system message. The ASA tracks two types of rates: the average event rate over an interval, and the burst event rate over a shorter burst interval. The burst event rate is 1/30th of the average rate interval or 10 seconds, whichever is higher. For each event received, the ASA checks the average and burst rate limits; if both rates are exceeded, then the ASA sends two separate system messages, with a maximum of one message for each rate type per burst period.
Examples
The following example enables basic threat detection, and changes the triggers for DoS attacks:
hostname(config)# threat-detection basic-threathostname(config)# threat-detection rate dos-drop rate-interval 600 average-rate 60 burst-rate 100Related Commands
threat-detection rate
When you enable basic threat detection using the threat-detection basic-threat command, you can change the default rate limits for each event type using the threat-detection rate command in global configuration mode. If you enable scanning threat detection using the threat-detection scanning-threat command, then this command with the scanning-threat keyword also sets the when a host is considered to be an attacker or a target; otherwise the default scanning-threat value is used for both basic and scanning threat detection. To return to the default setting, use the no form of this command.
threat-detection rate {acl-drop | bad-packet-drop | conn-limit-drop | dos-drop | fw-drop | icmp-drop | inspect-drop | interface-drop | scanning-threat | syn-attack} rate-interval rate_interval average-rate av_rate burst-rate burst_rate
no threat-detection rate {acl-drop | bad-packet-drop | conn-limit-drop | dos-drop | fw-drop | icmp-drop | inspect-drop | interface-drop | scanning-threat | syn-attack} rate-interval rate_interval average-rate av_rate burst-rate burst_rate
Syntax Description
Defaults
When you enable basic threat detection using the threat-detection basic-threat command, the following default rate limits are used:
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
8.0(2)
This command was introduced.
8.2(1)
The burst rate interval changed from 1/60th to 1/30th of the average rate.
Usage Guidelines
You can configure up to three different rate intervals for each event type.
When you enable basic threat detection, the ASA monitors the rate of dropped packets and security events due to the event types described in the "Syntax Description" table.
When the ASA detects a threat, it immediately sends a system log message (733100) and alerts ASDM.
Basic threat detection affects performance only when there are drops or potential threats; even in this scenario, the performance impact is insignificant.
Table 64-1 in the "Defaults" section lists the default settings. You can view all these default settings using the show running-config all threat-detection command.
If an event rate is exceeded, then the ASA sends a system message. The ASA tracks two types of rates: the average event rate over an interval, and the burst event rate over a shorter burst interval. For each event received, the ASA checks the average and burst rate limits; if both rates are exceeded, then the ASA sends two separate system messages, with a maximum of one message for each rate type per burst period.
Examples
The following example enables basic threat detection, and changes the triggers for DoS attacks:
hostname(config)# threat-detection basic-threathostname(config)# threat-detection rate dos-drop rate-interval 600 average-rate 60 burst-rate 100Related Commands
threat-detection scanning-threat
To enable scanning threat detection, use the threat-detection scanning-threat command in global configuration mode. To disable scanning threat detection, use the no form of this command.
threat-detection scanning-threat [shun
[except {ip-address ip_address mask | object-group network_object_group_id} | duration seconds]]no threat-detection scanning-threat [shun
[except {ip-address ip_address mask | object-group network_object_group_id} | duration seconds]]Syntax Description
Defaults
The default shun duration is 3600 seconds (1 hour).
The following default rate limits are used for scanning attack events:
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
Usage Guidelines
A typical scanning attack consists of a host that tests the accessibility of every IP address in a subnet (by scanning through many hosts in the subnet or sweeping through many ports in a host or subnet). The scanning threat detection feature determines when a host is performing a scan. Unlike IPS scan detection that is based on traffic signatures, the ASA scanning threat detection feature maintains an extensive database that contains host statistics that can be analyzed for scanning activity.
The host database tracks suspicious activity such as connections with no return activity, access of closed service ports, vulnerable TCP behaviors such as non-random IPID, and many more behaviors.
Caution
You can configure the ASA to send system log messages about an attacker or you can automatically shun the host. By default, the system log message 730101 is generated when a host is identified as an attacker.
The ASA identifies attackers and targets when the scanning threat event rate is exceeded. The ASA tracks two types of rates: the average event rate over an interval, and the burst event rate over a shorter burst interval. For each event detected that is considered to be part of a scanning attack, the ASA checks the average and burst rate limits. If either rate is exceeded for traffic sent from a host, then that host is considered to be an attacker. If either rate is exceeded for traffic received by a host, then that host is considered to be a target. You can change the rate limits for scanning threat events using the threat-detection rate scanning-threat command.
To view hosts categorized as attackers or as targets, use the show threat-detection scanning-threat command.
To view shunned hosts, use the show threat-detection shun command. To release a host from being shunned, use the clear threat-detection shun command.
Examples
The following example enables scanning threat detection and automatically shuns hosts categorized as attackers, except for hosts on the 10.1.1.0 network. The default rate limits for scanning threat detection are also changed.
hostname(config)# threat-detection scanning-threat shun except ip-address 10.1.1.0 255.255.255.0hostname(config)# threat-detection rate scanning-threat rate-interval 1200 average-rate 10 burst-rate 20hostname(config)# threat-detection rate scanning-threat rate-interval 2400 average-rate 10 burst-rate 20Related Commands
threat-detection statistics
To enable advanced threat detection statistics, use the threat-detection statistics command in global configuration mode. To disable advanced threat detection statistics, use the no form of this command.
Caution
threat-detection statistics [access-list | [host | port | protocol [number-of-rate {1 | 2 | 3}] | tcp-intercept [rate-interval minutes] [burst-rate attacks_per_sec] [average-rate attacks_per_sec]]
no threat-detection statistics [access-list | host | port | protocol | tcp-intercept [rate-interval minutes] [burst-rate attacks_per_sec] [average-rate attacks_per_sec]]
Syntax Description
Defaults
Access list statistics are enabled by default. If you do not specify any options in this command, then you enable all options.
The default tcp-intercept rate-interval is 30 minutes. The default burst-rate is 400 per second. The default average-rate is 200 per second.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
1 Only TCP Intercept statistics are supported in multiple context mode.
Command History
Usage Guidelines
If you do not specify any options in this command, then you enable all statistics. To enable only certain statistics, enter this command for each statistic type, and do not also enter the command without any options. You can enter threat-detection statistics (without any options) and then customize certain statistics by entering the command with statistics-specific options (for example, threat-detection statistics host number-of-rate 2). If you enter threat-detection statistics (without any options) and then enter a command for specific statistics, but without any statistic-specific options, then that command has no effect because it is already enabled.
If you enter the no form of this command, it removes all threat-detection statistics commands, including the threat-detection statistics access-list command, which is enabled by default.
View statistics using the show threat-detection statistics commands.
You do not need to enable scanning threat detection using the threat-detection scanning-threat command; you can configure detection and statistics separately.
Examples
The following example enables scanning threat detection and scanning threat statistics for all types except host:
hostname(config)# threat-detection scanning-threat shun except ip-address 10.1.1.0 255.255.255.0hostname(config)# threat-detection statistics access-listhostname(config)# threat-detection statistics porthostname(config)# threat-detection statistics protocolhostname(config)# threat-detection statistics tcp-interceptRelated Commands
threshold
To set the threshold value for over threshold events in SLA monitoring operations, use the threshold command in SLA monitor configuration mode. To restore the default value, use the no form of this command.
threshold milliseconds
no threshold
Syntax Description
milliseconds
Specifies the number of milliseconds for a rising threshold to be declared. Valid values are from 0 to 2147483647. This value should not be larger than the value set for the timeout.
Defaults
The default threshold is 5000 milliseconds.
Command Modes
The following table shows the modes in which you can enter the command:
SLA monitor configuration
•
—
•
—
—
Command History
Usage Guidelines
The threshold value is only used to indicate over threshold events, which do not affect reachability but may be used to evaluate the proper settings for the timeout command.
Examples
The following example configures an SLA operation with an ID of 123 and creates a tracking entry with the ID of 1 to track the reachability of the SLA. The frequency of the SLA operation is set to 10 seconds, the threshold to 2500 milliseconds, and the timeout value us set to 4000 milliseconds.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# threshold 2500hostname(config-sla-monitor-echo)# timeout 4000hostname(config-sla-monitor-echo)# frequency 10hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
sla monitor
Defines an SLA monitoring operation.
timeout
Defines the amount of time the SLA operation waits for a response.
ticket
To configure the ticket epoch and password for the Cisco Intercompany Media Engine proxy, use the ticket command in UC-IME configuration mode. To remove the configuration from the proxy, use the no form of this command.
ticket epoch n password password
no ticket epoch n password password
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
UC-IME configuration
•
—
•
—
—
Command History
Usage Guidelines
Configures the ticket epoch and password for Cisco Intercompany Media Engine.
The epoch contains an integer that updates each time that the password is changed. When the proxy is configured the first time and a password entered for the first time, enter 1 for the epoch integer. Each time you change the password, increment the epoch to indicate the new password. You must increment the epoch value each time your change the password.
Typically, you increment the epoch sequentially; however, the ASA allows you to choose any value when you update the epoch.
If you change the epoch value, the current password is invalidated and you must enter a new password.
We recommend a password of at least 20 characters. Only one password can be configured at a time.
The ticket password is stored onto flash. The output of the show running-config uc-ime command displays ***** instead of the password string.
Note
Examples
The following example shows specify the ticket and epoch in the Cisco Intercompany Media Engine Proxy:
hostname(config)#uc-ime local_uc-ime_proxyhostname(config-uc-ime)# media-termination ime-media-termhostname(config-uc-ime)# ucm address 192.168.10.30 trunk-security-mode non-securehostname(config-uc-ime)# ticket epoch 1 password password1234hostname(config-uc-ime)# fallback monitoring timer 120hostname(config-uc-ime)# fallback hold-down timer 30Related Commands
timeout
To set the global maximum idle time duration for various features, use the timeout command in global configuration mode. To set all timeouts to the default, use the no form of this command. To reset a single feature to its default, reenter the timeout command with the default value.
timeout {conn | floating-conn | h225 | h323 | half-closed | icmp | mgcp | mgcp-pat | pat-xlate | sip | sip-disconnect | sip-invite | sip_media | sip-provisional-media | sunrpc | tcp-proxy-reassembly | udp | xlate} hh:mm:ss
timeout uauth hh:mm:ss [absolute | inactivity]
no timeout
Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration mode
•
•
•
•
—
Command History
Usage Guidelines
The timeout command lets you set global timeouts. For some features, the set connection timeout command takes precedence for traffic identified in the command.
You can enter multiple keywords and values after the timeout command.
The connection timer (conn) takes precedence over the translation timer (xlate); the translation timer works only after all connections have timed out.
Examples
The following example shows how to configure the maximum idle time durations:
hostname(config)# timeout uauth 0:5:0 absolute uauth 0:4:0 inactivityhostname(config)# show running-config timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolute uauth 0:04:00 inactivityRelated Commands
timeout (aaa-server host)
To configure the host-specific maximum response time, in seconds, allowed before giving up on establishing a connection with the AAA server, use the timeout command in aaa-server host mode. To remove the timeout value and reset the timeout to the default value of 10 seconds, use the no form of this command.
timeout seconds
no timeout
Syntax Description
Defaults
The default timeout value is 10 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
aaa-server host configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is valid for all AAA server protocol types.
Use the timeout command to specify the length of time during which the ASA attempts to make a connection to a AAA server. Use the retry-interval command to specify the amount of time the ASA waits between connection attempts.
The timeout is the total amount of time that the ASA spends trying to complete a transaction with a server. The retry interval determines how often the communication is retried during the timeout period. Thus, if the retry interval is greater than or equal to the timeout value, you will see no retries. If you want to see retries, the retry interval musts be less than thte timeout value.
Examples
The following example configures a RADIUS AAA server named "svrgrp1" on host 1.2.3.4 to use a timeout value of 30 seconds, with a retry interval of 10 seconds. Thus, the ASA tries the communication attempt three times before giving up after 30 seconds.
hostname(config)#aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)#aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)#timeout 30hostname(config-aaa-server-host)#retry-interval 10hostname(config-aaa-server-host)#Related Commands
timeout (dns-server-group configuration mode)
To specify the amount of time to wait before trying the next DNS server, use the timeout command in dns-server-group configuration mode. To restore the default timeout, use the no form of this command.
timeout seconds
no timeout [seconds]
Syntax Description
Defaults
The default timeout is 2 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example sets the timeout to 1 second for the DNS server group "dnsgroup1":
hostname(config)# dns server-group dnsgroup1hostname(config-dns-server-group)# dns timeout 1Related Commands
timeout (gtp-map)
To change the inactivity timers for a GTP session, use the timeout command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no form of this command to set these intervals to their default values.
timeout {gsn | pdp-context | request | signaling | t3-response | tunnel } hh:mm:ss
no timeout {gsn | pdp-context | request | signaling | t3-response | tunnel } hh:mm:ss
Syntax Description
Defaults
The default is 30 minutes for gsn, pdp-context, and signaling.
The default for request is 1 minute.
The default for tunnel is 1 hour (in the case where a Delete PDP Context Request is not received).
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
·
·
·
·
—
Command History
Usage Guidelines
The Packet Data Protocol (PDP) context is identified by the Tunnel Identifier (TID), which is a combination of IMSI and NSAPI. Each MS can have up to 15 NSAPIs, allowing it to create multiple PDP contexts each with a different NSAPI, based on application requirements for varied QoS levels.
A GTP tunnel is defined by two associated PDP Contexts in different GSN nodes and is identified with a Tunnel ID. A GTP tunnel is necessary to forward packets between an external packet data network and a mobile station user.
Examples
The following example sets a timeout value for the request queue of 2 minutes:
hostname(config)# gtp-map gtp-policyhostname(config-gtpmap)# timeout request 00:02:00Related Commands
timeout (radius-accounting)
To change the inactivity timers for RADIUS accounting users, use the timeout command in radius-accounting parameter configuration mode, which is accessed by using the inspect radius-accounting command. Use the no form of this command to set these intervals to their default values.
timeout users hh:mm:ss
no timeout users hh:mm:ss
Syntax Description
Defaults
The default timeout for users is one hour.
Command Modes
The following table shows the modes in which you can enter the command:
radius-accounting parameter configuration
·
·
·
·
—
Command History
Examples
The following example sets a timeout value for the user of ten minutes:
hostname(config)# policy-map type inspect radius-accounting rahostname(config-pmap)# parametershostname(config-pmap-p)# timeout user 00:10:00Related Commands
inspect radius-accounting
Sets inspection for RADIUS accounting.
parameters
Sets parameters for an inspection policy map.
timeout (sla monitor)
To set the amount of time the SLA operation waits for a response to the request packets, use the timeout command in SLA monitor protocol configuration mode. To restore the default value, use the no form of this command.
timeout milliseconds
no timeout
Syntax Description
Defaults
The default timeout value is 5000 milliseconds.
Command Modes
The following table shows the modes in which you can enter the command:
SLA monitor protocol configuration
•
—
•
—
—
Command History
Usage Guidelines
Use the frequency command to set how often the SLA operation sends out the request packets and the timeout command to set how long the SLA operation waits to receive a response to those requests. The values specified for the timeout command cannot be greater than the value specified for the frequency command.
Examples
The following example configures an SLA operation with an ID of 123 and creates a tracking entry with the ID of 1 to track the reachability of the SLA. The frequency of the SLA operation is set to 10 seconds, the threshold to 2500 milliseconds, and the timeout value us set to 4000 milliseconds.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# threshold 2500hostname(config-sla-monitor-echo)# timeout 4000hostname(config-sla-monitor-echo)# frequency 10hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
frequency
Specifies the rate at which the SLA operation repeats.
sla monitor
Defines an SLA monitoring operation.
timeout pinhole
To configure the timeout for DCERPC pinholes and override the global system pinhole timeout of two minutes, use the timeout pinhole command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
timeout pinhole hh:mm:ss
no timeout pinhole
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to configure the pinhole timeout for pin hole connections in a DCERPC inspection policy map:
hostname(config)# policy-map type inspect dcerpc dcerpc_maphostname(config-pmap)# parametershostname(config-pmap-p)# timeout pinhole 0:10:00Related Commands
time-range
To enter time-range configuration mode and define a time range that you can attach to traffic rules, or an action, use the time-range command in global configuration mode. To disable, use the no form of this command.
time-range name
no time-range name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Creating a time range does not restrict access to the device. The time-range command defines the time range only. After a time range is defined, you can attach it to traffic rules or an action.
To implement a time-based ACL, use the time-range command to define specific times of the day and week. Then use the with the access-list extended time-range command to bind the time range to an ACL.
The time range relies on the system clock of the ASA; however, the feature works best with NTP synchronization.
Examples
The following example creates a time range named "New_York_Minute" and enters time range configuration mode:
hostname(config)# time-range New_York_Minutehostname(config-time-range)#After you have created a time range and entered time-range configuration mode, you can define time range parameters with the absolute and periodic commands. To restore default settings for the time-range command absolute and periodic keywords, use the default command in time-range configuration mode.
To implement a time-based ACL, use the time-range command to define specific times of the day and week. Then use the with the access-list extended command to bind the time range to an ACL. The following example binds an ACL named "Sales" to a time range named "New_York_Minute":
hostname(config)# access-list Sales line 1 extended deny tcp host 209.165.200.225 host 209.165.201.1 time-range New_York_Minutehostname(config)#See the access-list extended command for more information about ACLs.
Related Commands
timeout secure-phones
To configure the idle timeout after which the secure-phone entry is removed from the Phone Proxy database, use the timeout secure-phones command in phone-proxy configuration mode. To set the timeout value back to the default of 5 minutes, use the no form of this command.
timeout secure-phones hh:mm:ss
no timeout secure-phones hh:mm:ss
Syntax Description
Defaults
The default value for secure phone timeout is 5 minutes.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
Since secure phones always request a CTL file upon bootup, the Phone Proxy creates a database that marks the phone as secure. The entries in the secure phone database are removed after a specified configured timeout (via the timeout secure-phones command). The entry's timestamp is updated for each registration refresh the Phone Proxy receives for SIP phones and KeepAlives for SCCP phones.
The default value for the timeout secure-phones command is 5 minutes. Specify a value that is greater than the maximum timeout value for SCCP KeepAlives and SIP Register refresh. For example, if the SCCP Keepalives are configured for 1 minute intervals and the SIP Register Refresh is configured for 3 minutes, configure this timeout value greater than 3 minutes.
Examples
The following example shows the use of the timeout secure-phones command to configure the Phone Proxy to timeout entries in the secure phone database after 3 minutes:
hostname(config)#phone-proxy asa_phone_proxyhostname(config-phone-proxy)#tftp-server address 192.168.1.2 in interface outsidehostname(config-phone-proxy)#tftp-server address 192.168.1.3 in interface outsidehostname(config-phone-proxy)#media-termination address 192.168.1.4hostname(config-phone-proxy)#tls-proxy asa_tlsphostname(config-phone-proxy)#ctl-file asactlhostname(config-phone-proxy)# timeout secure-phones 00:03:00Related Commands
timers lsa arrival
To set the minimum interval at which the ASA accepts the same LSA from OSPFv3 neighbors, use the timers lsa arrival command in IPv6 router configuration mode. To restore the default value, use the no form of this command.
timers lsa arrival milliseconds
no timers lsa arrival milliseconds
Syntax Description
milliseconds
Specifies the minimum delay in milliseconds that must pass between acceptance of the same LSA that is arriving between neighbors. Valid values are from 0 to 600,000 milliseconds.
Defaults
The default is 1000 millliseconds.
Command Modes
The following table shows the modes in which you can enter the command:
IPv6 router configuration
•
—
•
—
—
Command History
Usage Guidelines
Use this command to indicate the minimum interval that must pass between acceptance of the same LSA that is arriving from neighbors.
Examples
The following example sets the minimum interval for accepting the same LSA at 2000 milliseconds:
hostname(config-if)# ipv6 router ospf 1hostname(config-rtr)# log-adjacency-changeshostname(config-rtr)# timers lsa arrival 2000Related Commands
timers lsa-group-pacing (OSPFv2)
To specify the interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing command in router configuration mode. To restore the default value, use the no form of this command.
timers lsa-group-pacing seconds
no timers lsa-group-pacing [seconds]
Syntax Description
seconds
The interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged. Valid values are from 10 to 1800 seconds.
Defaults
The default interval is 240 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
To change the interval at which the OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing seconds command. To return to the default timer values, use the no timers lsa-group-pacing command.
Examples
The following example sets the group processing interval of LSAs to 500 seconds:
hostname(config-rtr)# timers lsa-group-pacing 500hostname(config-rtr)#Related Commands
timers pacing flood (OSPFv3)
To configure LSA flood packet pacing, use the timers pacing flood command in IPv6 router configuration mode. To restore the default flood packet pacing value, use the no form of this command.
timers pacing flood milliseconds
no timers pacing flood milliseconds
Syntax Description
milliseconds
Specifies the time in milliseconds at which LSAs in the flooding queue are paced in-between updates. The configurable range is from 5 to 100 milliseconds.
Defaults
The default is 33 millliseconds.
Command Modes
The following table shows the modes in which you can enter the command:
IPv6 router configuration
•
—
•
—
—
Command History
Usage Guidelines
Use this command to configure LSA flood packet pacing.
Examples
The following example configures LSA flood packet pacing updates to occur in 20-millisecond intervals for OSPFv3:
hostname(config-if)# ipv6 router ospf 1hostname(config-rtr)# timers pacing flood 20Related Commands
timers pacing lsa-group (OSPFv3)
To specify the interval at which OSPFv3 LSAs are collected into a group and refreshed, check summed, or aged, use the timers pacing lsa-group command in IPv6 router configuration mode. To restore the default value, use the no form of this command.
timers pacing lsa-group seconds
no timers pacing lsa-group [seconds]
Syntax Description
seconds
Specifies the number of seconds in the interval at which LSAs are collected into a group and refreshed, check summed, or aged. Valid values are from 10 to 1800 seconds.
Defaults
The default interval is 240 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
IPv6 router configuration
•
—
•
—
—
Command History
Usage Guidelines
Use this command to indicate the interval at which the OSPFv3 LSAs are collected into a group and refreshed, check summed, or aged.
Examples
The following example configures OSPFv3 group packet pacing updates between LSA groups to occur in 300-seconds intervals for OSPFv3 routing process 1:
hostname(config-if)# ipv6 router ospf 1hostname(config-rtr)# timers pacing lsa-group 300Related Commands
timers spf
To specify the shortest path first (SPF) calculation delay and hold time, use the timers spf command in router configuration mode. To restore the default values, use the no form of this command.
timers spf delay holdtime
no timers spf [delay holdtime]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
•
—
Command History
Usage Guidelines
To configure the delay time between when the OSPF protocol receives a topology change and when it starts a calculation, and the hold time between two consecutive SPF calculations, use the timers spf command. To return to the default timer values, use the no timers spf command.
Examples
The following example sets the SPF calculation delay to 10 seconds and the SPF calculation hold time to 20 seconds:
hostname(config-router)# timers spf 10 20hostname(config-router)#Related Commands
timers throttle
To configure LSA or SPF OSPFv3 throttling, use the timers throttle command in IPv6 router configuration mode. To remove the throttling configuration, use the no form of this command.
timers throttle [lsa | spf] milliseconds1 milliseconds2 milliseconds3
no timers throttle [lsa | spf]
Syntax Description
Defaults
LSA throttling:
•
•
•
SPF throttling:
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
IPv6 router configuration
•
—
•
•
—
Command History
Usage Guidelines
LSA and SPF throttling provide a dynamic mechanism to slow down LSA updates in OSPFv3 during times of network instability and allow faster OSPFv3 convergence by providing LSA rate limiting in milliseconds.
For LSA throttling, if the minimum or maximum time is less than the first occurrence value, then OSPFv3 automatically corrects to the first occurrence value. Similarly, if the maximum delay specified is less than the minimum delay, then OSPFv3 automatically corrects to the minimum delay value.
For SPF throttling, if milliseconds2 or milliseconds3 is less than milliseconds1, then OSPFv3 automatically corrects to the milliseconds1 value. Similarly, if milliseconds3 is less than milliseconds2, then OSPFv3 automatically corrects to the milliseconds2 value.
Examples
The following example configures OSPFv3 LSA throttling in milleseconds:
hostname(config)# ipv6 router ospf 10hostname(config-rtr)# timers throttle lsa 100 4000 5000For LSA throttling, the following example shows the automatic correction that occurs if the maximum delay value specified is less than the minimum delay value:
hostname(config)# ipv6 router ospf 10hostname(config-rtr)# timers throttle lsa 100 50 50% OSPFv3: Throttle timers corrected to: 100 100 100hostname(config-rtr)# show running-config ipv6ipv6 router ospf 10timers throttle lsa 100 100 100The following example configures OSPFv3 SPF throttling in milleseconds:
hostname(config)# ipv6 router ospf 10hostname(config-rtr)# timers throttle spf 6000 12000 14000For SPF throttling, the following example shows the automatic correction that occurs if the maximum delay value specified is less than the minimum delay value:
hostname(config)# ipv6 router ospf 10hostname(config-rtr)# timers throttle spf 100 50 50% OSPFv3: Throttle timers corrected to: 100 100 100hostname(config-rtr)# show running-config ipv6ipv6 router ospf 10timers throttle spf 100 100 100Related Commands
title
To customize the title of the WebVPN page displayed to WebVPN users when they connect to the security appliance, use the title command from webvpn customization mode:
title {text | style} value
[no] title {text | style} value
To remove the command from the configuration and cause the value to be inherited, use the no form of the command.
Syntax Description
Defaults
The default title text is "WebVPN Service".
The default title style is:
background-color:white;color:maroon;border-bottom:5px groove #669999;font-size:larger;
vertical-align:middle;text-align:left;font-weight:boldCommand Modes
The following table shows the modes in which you can enter the command:
Webvpn customization
•
—
•
—
—
Command History
Usage Guidelines
To have no title, use the title text command without a value argument.
The style option is expressed as any valid Cascading Style Sheet (CSS) parameters. Describing these parameters is beyond the scope of this document. For more information about CSS parameters, consult CSS specifications at the World Wide Web Consortium (W3C) website at www.w3.org. Appendix F of the CSS 2.1 Specification contains a convenient list of CSS parameters, and is available at www.w3.org/TR/CSS21/propidx.html.
Here are some tips for making the most common changes to the WebVPN pages—the page colors:
•
•
•
Note
Examples
In the following example, the title is customized with the text "Cisco WebVPN Service":
hostname(config)# webvpnhostname(config-webvpn)# customization ciscohostname(config-webvpn-custom)# title text Cisco WebVPN ServiceRelated Commands
logo
Customizes the logo on the WebVPN page.
page style
Customizes the WebVPN page using Cascading Style Sheet (CSS) parameters.
