-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
tls-proxy through type echo Commands
tunnel-group general-attributes
tunnel-group webvpn-attributes
tunnel-group-map default-group
tls-proxy through type echo Commands
tls-proxy
To configure a TLS proxy instance in TLS configuration mode or to set the maximum sessions, use the tls-proxy command in global configuration mode. To remove the configuration, use the no form of this command.
tls-proxy [maximum-sessions max_sessions | proxy_name] [noconfirm]
no tls-proxy [maximum-sessions max_sessions | proxy_name] [noconfirm]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the tls-proxy command to enter TLS proxy configuration mode to create a TLS proxy instance, or to set the maximum sessions supported on the platform.
Examples
The following example shows how to create a TLS proxy instance:
hostname(config)# tls-proxy my_proxyhostname(config-tlsp)# server trust-point ccm_proxyhostname(config-tlsp)# client ldc issuer ldc_serverhostname(config-tlsp)# client ldc keypair phone_commonRelated Commands
tos
To define a type of service byte in the IP header of an SLA operation request packet, use the tos command in SLA monitor protocol configuration mode. To restore the default value, use the no form of this command.
tos number
no tos
Syntax Description
Defaults
The default type of service value is 0.
Command Modes
The following table shows the modes in which you can enter the command:
SLA monitor protocol configuration
•
—
•
—
—
Command History
Usage Guidelines
This field contains information such as delay, precedence, reliability, and so on. This is can be used by other routers on the network for policy routing and features such as Committed Access Rate.
Examples
The following example configures an SLA operation with an ID of 123 that uses an ICMP echo request/response time probe operation. It sets the payload size of the echo request packets to 48 bytes, the number of echo requests sent during an SLA operation to 5, and the type of service byte to 80.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# num-packets 5hostname(config-sla-monitor-echo)# request-data-size 48hostname(config-sla-monitor-echo)# tos 80hostname(config-sla-monitor-echo)# timeout 4000hostname(config-sla-monitor-echo)# threshold 2500hostname(config-sla-monitor-echo)# frequency 10hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
traceroute
To determine the route packets will take to their destination, use the traceroute command.
traceroute destination_ip | hostname [source source_ip | source-interface] [numeric] [timeout timeout_value] [probe probe_num] [ttl min_ttl max_ttl] [port port_value] [use-icmp]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Priveleged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The traceroute command prints the result of each probe sent. Every line of output corresponds to a TTL value in increasing order. The following are the output symbols printed by the traceroute command:
Examples
The following example shows traceroute output that results when a destination IP address has been specified:
hostname# traceroute 209.165.200.225Tracing the route to 209.165.200.2251 10.83.194.1 0 msec 10 msec 0 msec2 10.83.193.65 0 msec 0 msec 0 msec3 10.88.193.101 0 msec 10 msec 0 msec4 10.88.193.97 0 msec 0 msec 10 msec5 10.88.239.9 0 msec 10 msec 0 msec6 10.88.238.65 10 msec 10 msec 0 msec7 172.16.7.221 70 msec 70 msec 80 msec8 209.165.200.225 70 msec 70 msec 70 msecRelated Commands
track rtr
To track the reachability of an SLA operation, use the track rtr command in global configuration mode. To remove the SLA tracking, use the no form of this command.
track track-id rtr sla-id reachabilitity
no track track-id rtr sla-id reachabilitity
Syntax Description
Defaults
SLA tracking is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The track rtr command creates a tracking entry object ID and specifies the SLA used by that tracking entry.
Every SLA operation maintains an operation return-code value, which is interpreted by the tracking process. The return code may be OK, Over Threshold, or several other return codes. Table 65-1 displays the reachability state of an object with respect to these return codes.
Table 65-1 SLA Tracking Return Codes
Reachability
OK or Over Threshold
Up
Any other code
Down
Examples
The following example configures an SLA operation with an ID of 123 and creates a tracking entry with the ID of 1 to track the reachability of the SLA:
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# timeout 1000hostname(config-sla-monitor-echo)# frequency 3hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
route
Configures a static route.
sla monitor
Defines an SLA monitoring operation.
traffic-forward cxsc
To enable a traffic-forwarding interface for the ASA CX module for demonstration purposes, use the traffic-forward cxsc command in interface configuration mode. To disable traffic-forwarding, use the no form of this command.
traffic-forward cxsc monitor-only
no traffic-forward cxsc monitor-only
Syntax Description
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
—
•
•
—
—
Command History
Usage Guidelines
For testing and demonstration purposes, you can configure an ASA interface to be a traffic-forwarding interface, where all traffic received is forwarded directly to the ASA CX module without any ASA processing. This feature is only supported in monitor-only mode. In this mode, the ASA CX module inspects the traffic as usual, makes policy decisions, and generates events. However, because the packets are read-only copies, the module actions do not affect the actual traffic. Instead, the module drops the copies after inspection.
See the following guidelines:
•
•
–
–
–
•
•
•
•
•
•
Examples
The following example makes GigabitEthernet 0/5 a traffic-forwarding interface:
interface gigabitethernet 0/5no nameiftraffic-forward cxsc monitor-onlyno shutdownRelated Commands
traffic-non-sip
To allow non-SIP traffic using the well-known SIP signaling port, use the traffic-non-sip command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
traffic-non-sip
no traffic-non-sip
Syntax Description
This command has no arguments or keywords.
Defaults
This command is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to allow non-SIP traffic using the well-known SIP signaling port in a SIP inspection policy map:
hostname(config)# policy-map type inspect sip sip_maphostname(config-pmap)# parametershostname(config-pmap-p)# traffic-non-sipRelated Commands
transfer-encoding
To restrict HTTP traffic by specifying a transfer encoding type, use the transfer-encoding command in HTTP map configuration mode, which is accessible using the http-map command. To disable this feature, use the no form of this command.
transfer-encoding type {chunked | compress | deflate | gzip | identity | default} action {allow | reset | drop} [log]
no transfer-encoding type {chunked | compress | deflate | gzip | identity | default} action {allow | reset | drop} [log]
Syntax Description
Defaults
This command is disabled by default. When the command is enabled and a supported transfer encoding type is not specified, the default action is to allow the connection without logging. To change the default action, use the default keyword and specify a different default action.
Command Modes
The following table shows the modes in which you can enter the command:
HTTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
When you enable the transfer-encoding command, the ASA applies the specified action to HTTP connections for each supported and configured transfer encoding type.
The ASA applies the default action to all traffic that does not match the transfer encoding types on the configured list. The preconfigured default action is to allow connections without logging.
For example, given the preconfigured default action, if you specify one or more encoding types with the action of drop and log, the ASA drops connections containing the configured encoding types, logs each connection, and allows all connections for the other supported encoding types.
If you want to configure a more restrictive policy, change the default action to drop (or reset) and log (if you want to log the event). Then configure each permitted encoding type with the allow action.
Enter the transfer-encoding command once for each setting you wish to apply. You use one instance of the transfer-encoding command to change the default action and one instance to add each encoding type to the list of configured transfer encoding types.
When you use the no form of this command to remove an application category from the list of configured application types, any characters in the command line after the application category keyword are ignored.
Examples
The following example provides a permissive policy, using the preconfigured default, which allows all supported application types that are not specifically prohibited.
hostname(config)# http-map inbound_httphostname(config-http-map)# transfer-encoding gzip drop loghostname(config-http-map)#In this case, only connections using GNU zip are dropped and the event is logged.
The following example provides a restrictive policy, with the default action changed to reset the connection and to log the event for any encoding type that is not specifically allowed.
hostname(config)# http-map inbound_httphostname(config-http-map)# port-misuse default action reset loghostname(config-http-map)# port-misuse identity allowhostname(config-http-map)#In this case, only connections using no transfer encoding are allowed. When HTTP traffic for the other supported encoding types is received, the ASA resets the connection and creates a syslog entry.
Related Commands
trustpoint (SSO Server)
To specify the name of a trustpoint that identifies the certificate to be sent to the SAML POST-type SSO server, use the trustpoint command in config-webvpn-sso-saml mode. To eliminate a trustpoint specification, use the no form of this command.
trustpoint trustpoint-name
no trustpoint trustpoint-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Config webvpn sso saml
•
—
•
—
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without entering a username and password more than once. The ASA currently supports the SAML POST-type SSO server and the SiteMinder-type of SSO server.
This command applies only to SAML-type SSO Servers.
A trustpoint represents a Certificate Authority identity, based on a CA-issued certificate that can be relied upon as being valid without the need for validation testing, especially a public-key certificate used to provide the first public key in a certification path.
Examples
The following example enters config-webvpn-sso-saml mode and names a trustpoint for identifying the certificate to be sent to the SAML POST type SSO Server:
hostname(config-webvpn)# sso serverhostname(config-webvpn-sso-saml)# trustpoint mytrustpointRelated Commands
tsig enforced
To require a TSIG resource record to be present, use the tsig enforced command in parameters configuration mode. To disable this feature, use the no form of this command.
tsig enforced action {drop [log] | log}
no tsig enforced [action {drop [log] | log}]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Usage Guidelines
This command enables monitoring and enforcement of TSIG presence in DNS transactions.
Examples
The following example shows how to enable TSIG enforcement in a DNS inspection policy map:
hostname(config)# policy-map type inspect dns preset_dns_maphostname(config-pmap)# parametershostname(config-pmap-p)# tsig enforced action logRelated Commands
ttl-evasion-protection
To enable the Time-To-Live evasion protection, use the ttl-evasion-protection command in tcp-map configuration mode. To remove this specification, use the no form of this command.
ttl-evasion-protection
no ttl-evasion-protection
Syntax Description
This command has no arguments or keywords.
Defaults
TTL evasion protection offered by the ASA is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the ttl-evasion-protection command in tcp-map configuration mode to prevent attacks that attempt to evade security policy.
For instance, an attacker can send a packet that passes policy with a very short TTL. When the TTL goes to zero, a router between the ASA and the endpoint drops the packet. It is at this point that the attacker can send a malicious packet with a long TTL that appears to the ASA to be a retransmission and is passed. To the endpoint host, however, it is the first packet that has been received by the attacker. In this case, an attacker is able to succeed without security preventing the attack. Enabling this feature prevents such attacks.
Examples
The following example shows how to disable TTL evasion protection on flows from network 10.0.0.0 to 20.0.0.0:
hostname(config)# access-list TCP1 extended permit tcp 10.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0hostname(config)# tcp-map tmaphostname(config-tcp-map)# no ttl-evasion-protectionhostname(config)# class-map cmaphostname(config-cmap)# match access-list TCP1hostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
tunnel-group
To create and manage the database of connection-specific records for IPsec and WebVPN tunnels, use the tunnel-group command in global configuration mode. To remove a tunnel group, use the no form of this command.
tunnel-group name type type
no tunnel-group name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
See Note.
•
•
—
Note
Command History
Usage Guidelines
SSL VPN users (both AnyConnect and clientless) can choose which tunnel group to access using these different methods:
•
•
•
This command and subcommands configures the ASA to allow users to select a group via a drop-down menu when they log in to the webvpn service. The groups that appear in the menu are either aliases or URLs of real connection profiles (tunnel groups) configured on the ASA.
The ASA has the following default tunnel groups:
•
•
•
You can change these groups, but not delete them. The ASA uses these groups to configure default tunnel parameters for remote access and LAN-to-LAN tunnel groups when there is no specific tunnel group identified during tunnel negotiation.
After entering the tunnel-group command, you enter the appropriate following commands to configure specific attributes for a particular tunnel group. Each of these commands enters a configuration mode for configuring tunnel-group attributes.
•
•
•
•
For LAN-to-LAN connections, the ASA attempts to select a tunnel group for a connection by matching the peer address specified in the crypto map to a tunnel group of the same name. Therefore, for IPv6 peers, you should configure the tunnel group name as the IPv6 address of the peer. You can specify the tunnel group name in short or long notation. The CLI reduces the name to the shortest notation. For example, if you enter this tunnel group command:
hostname(config)# tunnel-group 2001:0db8:0000:0000:0000:0000:1428:57ab type ipsec-l2lThe tunnel group appears in the configuration as:
tunnel-group 2001:0db8::1428:57ab type ipsec-l2lExamples
The following examples are entered in global configuration mode. The first configures a remote access tunnel group. The group name is group1.
hostname(config)# tunnel-group group1 type remote-accesshostname(config)#The following example shows the tunnel-group command configuring the webvpn tunnel group named "group1". You enter this command in global configuration mode:
hostname(config)# tunnel-group group1 type webvpnhostname(config)#Related Commands
tunnel-group-list enable
To enable the tunnel-groups defined in tunnel-group group-alias, use the tunnel-group-list enable command:
tunnel-group-list enable
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn configuration
•
•
•
—
Usage Guidelines
This command is used in conjuction with the tunnel-group group-alias and group-url commands for clientless and AnyConnect VPN client sessions. It enables the feature so that the tunnel-group drop-down is displayed on the login page. The group-alias is a text string such as employees, engineering, or consultants defined by the ASA administrator to display to end users.
Command History
Examples
hostname# configure terminalhostname(config)# tunnel-group ExampleGroup1 webvpn-atthostname(config-tunnel-webvpn)# group-alias Group1 enablehostname(config-tunnel-webvpn)# exithostname(config)# webvpnhostname(config-webvpn)# tunnel-group-list enableRelated Commands
tunnel-group-preference
To change the VPN preference to a connection profile with a group URL that matches the one specified by the endpoint, use the tunnel-group-preference command in webvpn configuration mode. To remove the command from the configuration, use the no form.
tunnel-group-preference group-url
no tunnel-group-preference group-url
Syntax Description
This command has no arguments or keywords.
Command Default
By default, if the ASA matches a certificate field value specified in a connection profile to the field value of the certificate used by the endpoint, the ASA assigns that profile to the VPN connection. This command overrides the default behavior.
Command Modes
The following table shows the modes in which you can enter the command:
Config-webvpn
•
—
•
—
—
Command History
Usage Guidelines
This command changes the preference of a connection profile during the connection profile selection process. It lets you rely on the group URL preference used by many older ASA software releases. If the endpoint specifies a group URL that is not present in a connection profile, but it specifies a certificate value that matches that of a connection profile, the ASA assigns that connection profile to the VPN session.
Although you enter this command in webvpn configuration mode, it changes the connection profile selection preference for all clientless and AnyConnect VPN connections negotiated by the ASA.
Examples
The following example changes the preference of a connection profile during the connection profile selection process:
hostname(config)# webvpnhostname(config-webvpn)# tunnel-group-preference group-urlhostname(config-webvpn)#Related Commands
tunnel-group general-attributes
To enter the general-attribute configuration mode, use the tunnel-group general-attributes command in global configuration mode. This mode is used to configure settings that are common to all supported tunneling protocols.
To remove all general attributes, use the no form of this command.
tunnel-group name general-attributes
no tunnel-group name general-attributes
Syntax Description
general-attributes
Specifies attributes for this tunnel-group.
name
Specifies the name of the tunnel-group.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general-attributes configuration
•
•
•
•
—
Command History
Examples
The following example entered in global configuration mode, creates a remote-access tunnel group for a remote-access connection using the IP address of the LAN-to-LAN peer, then enters general-attributes configuration mode for configuring tunnel-group general attributes. The name of the tunnel group is 209.165.200.225.
hostname(config)# tunnel-group 209.165.200.225 type remote-accesshostname(config)# tunnel-group 209.165.200.225 general-attributeshostname(config-tunnel-general)#The following example entered in global configuration mode, creates a tunnel group named" remotegrp" for an IPsec remote access connection, and then enters general configuration mode for configuring general attributes for the tunnel group named "remotegrp":
hostname(config)# tunnel-group remotegrp type ipsec_rahostname(config)# tunnel-group remotegrp generalhostname(config-tunnel-general)Related Commands
tunnel-group ipsec-attributes
To enter the ipsec-attribute configuration mode, use the tunnel-group ipsec-attributes command in global configuration mode. This mode is used to configure settings that are specific to the IPsec tunneling protocol.
To remove all IPsec attributes, use the no form of this command.
tunnel-group name ipsec-attributes
no tunnel-group name ipsec-attributes
Syntax Description
ipsec-attributes
Specifies attributes for this tunnel-group.
name
Specifies the name of the tunnel-group.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example entered in global configuration, creates a tunnel group for the IPsec remote-access tunnel group named remotegrp, and then specifies IPsec group attributes:
hostname(config)# tunnel-group remotegrp type ipsec_rahostname(config)# tunnel-group remotegrp ipsec-attributeshostname(config-tunnel-ipsec)Related Commands
tunnel-group ppp-attributes
To enter the ppp-attributes configuration mode and configure PPP settings that are used by L2TP over IPsec connections, use the tunnel-group ppp-attributes command in global configuration mode.
To remove all PPP attributes, use the no form of this command.
tunnel-group name ppp-attributes
no tunnel-group name ppp-attributes
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Command History
7.2(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Usage Guidelines
Examples
The following example creates the tunnel group telecommuters and enters ppp-attributes configuration mode:
hostname(config)# tunnel-group telecommuters type pppoehostname(config)# tunnel-group telecommuters ppp-attributeshostname(tunnel-group-ppp)#Related Commands
tunnel-group webvpn-attributes
To enter the webvpn-attribute configuration mode, use the tunnel-group webvpn-attributes command in global configuration mode. This mode configures settings that are common to WebVPN tunneling.
To remove all WebVPN attributes, use the no form of this command.
tunnel-group name webvpn-attributes
no tunnel-group name webvpn-attributes
Syntax Description
webvpn-attributes
Specifies WebVPN attributes for this tunnel-group.
name
Specifies the name of the tunnel-group.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Command History
7.1(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Usage Guidelines
In addition to the general attributes, you can also configure the following attributes specific to WebVPN connections in webvpn-attribute mode:
•
•
•
•
•
•
Examples
The following example entered in global configuration mode, creates a tunnel group for a WebVPN connection using the IP address of the LAN-to-LAN peer, then enters webvpn-configuration mode for configuring WebVPN attributes. The name of the tunnel group is 209.165.200.225.
hostname(config)# tunnel-group 209.165.200.225 type webvpnhostname(config)# tunnel-group 209.165.200.225 webvpn-attributeshostname(config-tunnel-webvpn)#The following example entered in global configuration mode, creates a tunnel group named" remotegrp" for a WebVPN connection, and then enters webvpn configuration mode for configuring WebVPN attributes for the tunnel group named "remotegrp":
hostname(config)# tunnel-group remotegrp type webvpnhostname(config)# tunnel-group remotegrp webvpn-attributeshostname(config-tunnel-webvpn)#Related Commands
tunnel-group-map
When the adaptive security appliance receives an IPsec connection request with client certificate authentication, it assigns a connection profile to the connection according to a policy you configure.
That policy can be to use rules you configure, use the certificate OU field, use the IKE identity (i.e. hostname, IP address, key ID), the client's IP address, or a default connection profile to assign the connection profile. For SSL connections, the adaptive security appliance only uses the rules you configure to assign the connection profile.
The tunnel-group-map command assigns a connection profile to the connection based on rules you configure by associating an existing map name with a connection profile.
Use the no form of this command to disassociate a connection profile with a map name. The no form of the command does not delete the map name, just its association with a connection profile.
This is the syntax of the command:
tunnel-group-map [mapname] [rule-index] [connection-profile]
no tunnel-group-map [mapname] [rule-index]
Note
crypto ca certificate map [mapname] [rule-index]•
Syntax Description
Syntax DescriptionSyntax Description
Defaults
If a tunnel-group-map is not defined, and the ASA receives an IPsec connection request with client certificate authentication, the ASA assigns a connection profile by trying to match the certificate authentication request to one of these policies, in this order:
Certificate ou field—Determines connection profile based on the value of the organizational unit (OU) field in the subject distinguished name (DN).
IKE identity—Determines the connection profile based on the content of the phase1 IKE ID.
peer-ip—Determines the connection profile based on the established client IP address.
Default Connection Profile—If the ASA does not match the previous three policies, it assigns the default connection profile. The default profile is DefaultRAGroup. The default connection profile would otherwise be configured using the tunnel-group-map default-group command.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Command History
7.0(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Usage Guidelines
The map name you specify must already exist before you can associate it with a connection profile. You create a map name using the crypto ca certificate map command. Refer to the documentation on the crypto ca certificate map command for more information.
Once you have associated map names with connection profiles, you need to enable the tunnel-group-map to use the rules you have configured rather than the default polices described earlier. To do this you must run the tunnel-group-map enable rules command in global configuration mode.
Examples
The following example associates the map name SalesGroup, with rule index 10, to the SalesConnectionProfile connection profile.
hostname(config)# tunnel-group-map SalesGroup 10 SalesConnectionProfilehostname(config)#Related Commands
tunnel-group-map default-group
The tunnel-group-map default-group command specifies the default tunnel-group to use if the name could not be determined using other configured methods.
Use the no form of this command to eliminate a tunnel-group-map.
tunnel-group-map [rule-index] default-group tunnel-group-name
no tunnel-group-map
Syntax Description
Syntax DescriptionSyntax Description
Defaults
The default value for the tunnel-group-map default-group is DefaultRAGroup.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Usage Guidelines
The tunnel-group-map commands configure the policy and rules by which certificate-based IKE sessions are mapped to tunnel groups. To associate the certificate map entries, created using the crypto ca certificate map command, with tunnel groups, use the tunnel-group-map command in global configuration mode. You can invoke this command multiple times as long as each invocation is unique and you do not reference a map index more than once.
The crypto ca certificate map command maintains a prioritized list of certificate mapping rules. There can be only one map. But this map can have up to 65535 rules. Refer to the documentation on the crypto ca certificate map command for more information.
The processing that derives the tunnel-group name from the certificate ignores entries in the certificate map that are not associated with a tunnel group (any map rule not identified by this command).
Examples
The following example entered in global configuration mode, specifies a default tunnel group to use when the name cannot be derived by other configured methods. The name of the tunnel group to use is group1:
hostname(config)# tunnel-group-map default-group group1hostname(config)#Related Commands
tunnel-group-map enable
The tunnel-group-map enable command configures the policy and rules by which certificate-based IKE sessions are mapped to tunnel groups. Use the no form of this command to restore the default values.
tunnel-group-map [rule-index] enable policy
no tunnel-group-map enable [rule-index]
Syntax Description
Syntax DescriptionSyntax Description
Defaults
The default values for the tunnel-group-map command are enable ou and default-group set to DefaultRAGroup.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
This command was introduced.
9.0(1)
Support for multiple context mode was added.
Usage Guidelines
The crypto ca certificate map command maintains a prioritized list of certificate mapping rules. There can be only one map. But this map can have up to 65535 rules. Refer to the documentation on the crypto ca certificate map command for more information.
Examples
The following example enables mapping of certificate-based IKE sessions to a tunnel group based on the content of the phase1 IKE ID:
hostname(config)# tunnel-group-map enable ike-idhostname(config)#The following example enables mapping of certificate-based IKE sessions to a tunnel group based on the established IP address of the peer:
hostname(config)# tunnel-group-map enable peer-iphostname(config)#The following example enables mapping of certificate-based IKE sessions based on the organizational unit (OU) in the subject distinguished name (DN):
hostname(config)# tunnel-group-map enable ouhostname(config)#The following example enables mapping of certificate-based IKE sessions based on established rules:
hostname(config)# tunnel-group-map enable ruleshostname(config)#Related Commands
tunnel-limit
To specify the maximum number of GTP tunnels allowed to be active on the ASA, use the tunnel limit command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no to set the tunnel limit back to its default.
tunnel-limit max_tunnels
no tunnel-limit max_tunnels
Syntax Description
max_tunnels
This is the maximum number of tunnels allowed. The ranges is from 1 to 4294967295 for the global overall tunnel limit.
Defaults
The default for the tunnel limit is 500.
Command Modes
The following table shows the modes in which you can enter the command:
Gtp map configuration
•
•
•
•
—
Command History
Usage Guidelines
New requests will be dropped once the number of tunnels specified by this command is reached.
Examples
The following example specifies a maximum of 10,000 tunnels for GTP traffic:
hostname(config)# gtp-map qtp-policyhostname(config-gtpmap)# tunnel-limit 10000Related Commands
tx-ring-limit
To specify the depth of the priority queues, use the tx-ring-limit command in priority-queue mode. To remove this specification, use the no form of this command.
Note
This command is not supported on the ASA Services Module.
tx-ring-limit number-of-packets
no tx-ring-limit number-of-packets
Syntax Description
Defaults
The default tx-ring-limit is 128 packets.
Command Modes
The following table shows the modes in which you can enter the command:
Priority-queue
•
•
•
•
—
Command History
Usage Guidelines
The ASA allows two classes of traffic: low-latency queuing (LLQ) for higher priority, latency sensitive traffic (such as voice and video) and best-effort, the default, for all other traffic. The ASA recognizes priority traffic and enforces appropriate Quality of Service (QoS) policies. You can configure the size and depth of the priority queue to fine-tune the traffic flow.
You must use the priority-queue command to create the priority queue for an interface before priority queuing takes effect. You can apply one priority-queue command to any interface that can be defined by the nameif command.
The priority-queue command enters priority-queue mode, as shown by the prompt. In priority-queue mode, you can configure the maximum number of packets allowed in the transmit queue at any given time (tx-ring-limit command) and the number of packets of either type (priority or best -effort) allowed to be buffered before dropping packets (queue-limit command).
Note
The tx-ring-limit and the queue-limit that you specify affect both the higher priority low-latency queue and the best-effort queue. The tx-ring-limit is the number of either type of packets allowed into the driver before the driver pushes back to the queues sitting in front of the interface to let them buffer packets until the congestion clears. In general, you can adjust these two parameters to optimize the flow of low-latency traffic.
Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is tail drop. To avoid having the queue fill up, you can use the queue-limit command to increase the queue buffer size.
Note
On ASA Model 5505 (only), configuring priority-queue on one interface overwrites the same configuration on all other interfaces. That is, only the last applied configuration is present on all interfaces. Further, if the priority-queue configuration is removed from one interface, it is removed from all interfaces.
To work around this issue, configure the priority-queue command on only one interface. If different interfaces need different settings for the queue-limit and/or tx-ring-limit commands, use the largest of all queue-limits and smallest of all tx-ring-limits on any one interface (CSCsi13132).
Examples
The following example configures a priority queue for the interface named test, specifying a queue limit of 2048 packets and a transmit queue limit of 256 packets.
hostname(config)# priority-queue testhostname(priority-queue)# queue-limit 2048hostname(priority-queue)# tx-ring-limit 256Related Commands
type echo
To configure the SLA operation as an echo response time probe operation, use the type echo command in SLA monitor configuration mode. To remove the type from teh SLA configuration, use the no form of this command.
type echo protocol ipIcmpEcho target interface if-name
no type echoprotocol ipIcmpEcho target interface if-name
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
SLA monitor configuration
•
•
•
•
—
Command History
Usage Guidelines
The default size of the payload of the ICMP packets is 28 bytes, creating a total ICMP packet size of 64 bytes. The payload size can be changed using the request-data-size command.
Examples
The following example configures an SLA operation with an ID of 123 that uses an ICMP echo request/response time probe operation. It creates a tracking entry with the ID of 1 to track the reachability of the SLA. The frequency of the SLA operation is set to 10 seconds, the threshold to 2500 milliseconds, and the timeout value us set to 4000 milliseconds.
hostname(config)# sla monitor 123hostname(config-sla-monitor)# type echo protocol ipIcmpEcho 10.1.1.1 interface outsidehostname(config-sla-monitor-echo)# threshold 2500hostname(config-sla-monitor-echo)# timeout 4000hostname(config-sla-monitor-echo)# frequency 10hostname(config)# sla monitor schedule 123 life forever start-time nowhostname(config)# track 1 rtr 123 reachabilityRelated Commands
