-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 4.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show debug -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config logging -- show running-config vpn-sessiondb
-
show service-policy -- show xlate
-
shun -- sysopt uauth allow-http-cache
-
- T through Z Commands
-
Feedback
Table Of Contents
shun through sysopt uauth allow-http-cache Commands
subject-name (crypto ca certificate map)
subject-name (crypto ca trustpoint)
sysopt connection tcp sack-permitted
sysopt connection tcp window-scale
shun through sysopt uauth allow-http-cache Commands
shun
To block connections from an attacking host, use the shun command in privileged EXEC mode. To disable a shun, use the no form of this command.
shun source_ip [dest_ip source_port dest_port [protocol]] [vlan vlan_id]
no shun source_ip [vlan vlan_id]
Syntax Description
Defaults
The default protocol is 0 (any protocol).
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The shun command lets you block connections from an attacking host. All future connections from the source IP address are dropped and logged until the blocking function is removed manually or by the Cisco IPS sensor. The blocking function of the shun command is applied whether or not a connection with the specified host address is currently active.
If you specify the destination address, source and destination ports, and the protocol, then you drop the matching connection as well as placing a shun on all future connections from the source IP address; all future connections are shunned, not just those that match these specific connection parameters.
You can only have one shun command per source IP address.
Because the shun command is used to block attacks dynamically, it is not displayed in the FWSM configuration.
Whenever an interface configuration is removed, all shuns that are attached to that interface are also removed. If you add a new interface or replace the same interface (using the same name), then you must add that interface to the IPS sensor if you want the IPS sensor to monitor that interface.
Examples
The following example shows that the offending host (10.1.1.27) makes a connection with the victim (10.2.2.89) with TCP. The connection in the FWSM connection table reads as follows:
10.1.1.27, 555-> 10.2.2.89, 666 PROT TCPApply the shun command using the following options:
hostname# shun 10.1.1.27 10.2.2.89 555 666 tcpThe command deletes the specific current connection from the FWSM connection table and also prevents all future packets from 10.1.1.27 from going through the FWSM.
Related Commands
clear shun
Disables all the shuns that are currently enabled and clears the shun statistics.
show conn
Shows all active connections.
show shun
Displays the shun information.
shutdown
To disable an interface, use the shutdown command in interface configuration mode. To enable an interface, use the no form of this command.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Defaults
All physical interfaces are shut down by default. Allocated interfaces in security contexts are not shut down in the configuration.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
•
Command History
Usage Guidelines
By default, all physical interfaces are shut down. You must enable the physical interface before any traffic can pass through an enabled subinterface. For multiple context mode, if you allocate a physical interface or subinterface to a context, the interfaces are enabled by default in the context. However, before traffic can pass through the context interface, you must also enable the interface in the system configuration. If you shut down an interface in the system execution space, then that interface is down in all contexts that share it.
Examples
The following example enables a subinterface:
hostname(config)# interface gigabitethernet2.1hostname(config-subif)# vlan 101hostname(config-subif)# nameif dmz1hostname(config-subif)# security-level 50hostname(config-subif)# ip address 10.1.2.1 255.255.255.0hostname(config-subif)# no shutdownThe following example shuts down the subinterface:
hostname(config)# interface gigabitethernet2.1hostname(config-subif)# vlan 101hostname(config-subif)# nameif dmz1hostname(config-subif)# security-level 50hostname(config-subif)# ip address 10.1.2.1 255.255.255.0hostname(config-subif)# shutdownRelated Commands
clear xlate
Resets all translations for existing connections, causing the connections to be reset.
interface
Configures an interface and enters interface configuration mode.
sip-map
To identify a SIP application inspection map, which is required to enable the IP Address Privacy feature, use the sip-map command in global configuration mode. To remove the map, use the no form of this command.
sip-map map_name
no sip-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the sip-map command to identify a SIP application inspection map, which is required to enable the IP Address Privacy feature. When you enter this command, the system enters the SIP map configuration mode, which lets you enter the ip-address-privacy command. After defining the SIP map, you use the inspect sip command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.
Examples
The following example shows how to identify SIP traffic, define a SIP map, define a policy, and apply the policy to the outside interface.
hostname(config)# access-list sip-acl permit tcp any any eq 5060hostname(config)# class-map sip-porthostname(config-cmap)# match access-list sip-aclhostname(config-cmap)# sip-map inbound_siphostname(config-sip-map)# ip-address-privacyhostname(config-sip-map)# policy-map S1_policyhostname(config-pmap)# class sip-porthostname(config-pmap-c)# inspect sip s1_policyhostname(config)#Related Commands
size
To change the size of a memory partition, use the size command in resource partition configuration mode. To restore the size to the default value, use the no form of this command.
size number_of_rules
no size number_of_rules
Syntax Description
Defaults
The default size of a partition depends on the total number of partitions. To view the default partition sizes, enter the show resource partition command.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
The FWSM lets you set the memory size of each partition.
Important Guidelines
Caution
•
•
•
•
•
•
•
•
•
Examples
To view the rules available for increasing partition sizes, enter the show resource partition command.
For example, if you reduced the sizes of partitions 0 through 5 to 15,000, then the output shows that you have 25,314 rules to reallocate to other partitions.
hostname(config)# show resource partitionBootup CurrentPartition Default Partition ConfiguredNumber Size Size Size-----------+---------+----------+-----------0 19219 19219 150001 19219 19219 150002 19219 19219 150003 19219 19219 150004 19219 19219 150005 19219 19219 150006 19219 19219 192197 19219 19219 192198 19219 19219 192199 19219 19219 1921910 19219 19219 1921911 19219 19219 19219backup tree 19219 19219 19219-----------+---------+----------+-----------Total 249847 249847 224533Total Partition size - Configured size = Available to allocate249847 - 224533 = 25314If you want to distribute the rules evenly across the other 6 partitions plus the backup tree, then you can add 3616 rules to each (with 2 left over). Remember that the backup tree must be as large as the largest partition, so you must consider the backup tree in your calculations. For example, if you want to make partition 6 have 24,001 rules, then you can allocate the rules like this:
You can also view the current mapping of contexts to partitions using the show resource acl-partition command.
Examples
The following example reduces partitions 0 and 1 to 40000, while increasing partitions 2 and 3 to 56616 and 56615 respectively.
hostname(config)# show resource partitionBootup CurrentPartition Default Partition ConfiguredNumber Size Size Size-----------+---------+----------+-----------0 49970 49970 499701 49969 49969 499692 49969 49969 499693 49969 49969 49969backup tree 49970 49970 49970-----------+---------+----------+-----------Total 249847 249847 249847Total Partition size - Configured size = Available to allocate249847 - 249847 = 0hostname(config)# resource partition 0hostname(config-partition)# size 40000hostname(config-partition)# resource partition 1hostname(config-partition)# size 40000hostname(config-partition)# show resource partitionBootup CurrentPartition Default Partition ConfiguredNumber Size Size Size-----------+---------+----------+-----------0 49970 49970 400001 49969 49969 400002 49969 49969 499693 49969 49969 49969backup tree 49970 49970 49969-----------+---------+----------+-----------Total 249847 249847 249847Total Partition size - Configured size = Available to allocate249847 - 229907 = 19940hostname(config-partition)# resource partition 2hostname(config-partition)# size 56616hostname(config-partition)# resource partition 3hostname(config-partition)# size 56615hostname(config-partition)# show resource partitionBootup CurrentPartition Default Partition ConfiguredNumber Size Size Size-----------+---------+----------+-----------0 49970 49970 400001 49969 49969 400002 49969 49969 566163 49969 49969 56615backup tree 49970 49970 56616-----------+---------+----------+-----------Total 249847 249847 249847Total Partition size - Configured size = Available to allocate249847 - 249847 = 0hostname(config-partition)# reloadRelated Commands
smtp-server
To configure an SMTP server, use the smtp-server command in global configuration mode. To remove the attribute from the configuration, use the no version of this command.
The FWSM includes an internal SMTP client that the Events system can use to notify external entities that a certain event has occurred. You can configure SMTP servers to receive these event notices, and then forward them to specified e-mail addresses. The SMTP facility is active only when you enable E-mail events an the FWSM.
smtp-server {primary_server} [backup_server]
no smtp-server
Syntax Description
Defaults
No SMTP server is configured by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
Examples
The following example shows how to set an SMTP server with an IP address of 10.1.1.24, and a backup SMTP server with an IP address of 10.1.1.34:
hostname(config)#smtp-server 10.1.1.24 10.1.1.34snmp-map
To identify a specific map for defining the parameters for SNMP inspection, use the snmp-map command in global configuration mode. To remove the map, use the no form of this command.
snmp-map map_name
no snmp-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the snmp-map command to identify a specific map to use for defining the parameters for SNMP inspection. When you enter this command, the system enters the SNMP map configuration mode, which lets you enter the different commands used for defining the specific map. After defining the SNMP map, you use the inspect snmp command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.
Examples
The following example shows how to identify SNMP traffic, define a SNMP map, define a policy, and apply the policy to the outside interface.
hostname(config)# access-list snmp-acl permit tcp any any eq 161hostname(config)# access-list snmp-acl permit tcp any any eq 162hostname(config)# class-map snmp-porthostname(config-cmap)# match access-list snmp-aclhostname(config-cmap)# exithostname(config)# snmp-map inbound_snmphostname(config-snmp-map)# deny version 1hostname(config-snmp-map)# exithostname(config)# policy-map inbound_policyhostname(config-pmap)# class snmp-porthostname(config-pmap-c)# inspect snmp inbound_snmphostname(config-pmap-c)# exitRelated Commands
snmp-server community
To set the SNMP community string, use the snmp-server community command in global configuration mode. To remove the community string, use the no form of this command.
snmp-server community text
no snmp-server community [text]
Syntax Description
Defaults
By default, the community string is public.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The SNMP community string is a shared secret among the SNMP management station and the network nodes being managed. The FWSM uses the key to determine if the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the routers, FWSM, and the management station with this same string. The FWSM uses this string and does not respond to requests with an invalid community string.
Note
Examples
The following example sets the community string to wallawallabingbang:
hostname(config)# snmp-server community wallawallabingbangRelated Commands
snmp-server contact
To set the SNMP contact name, use the snmp-server contact command in global configuration mode. To remove the contact name, use the no form of this command.
snmp-server contact text
no snmp-server contact [text]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If the console access rule limit has been met in NP3, and you try to add an snmp-server command, the rule download fails, but the line stays in the running configuration. You can save this setting to the startup configuation so that after a reboot, other console access rule (that is, SSH, Telnet, HTTP, and ICMP) commands are not included in the configuration.
Examples
The following example sets the contact as Pat Johnson:
hostname(config)# snmp-server contact Pat JohnsonRelated Commands
snmp-server enable
To enable the SNMP server on the FWSM, use the snmp-server enable command in global configuration mode. To disable SNMP, use the no form of this command.
snmp-server enable
no snmp-server enable
Syntax Description
This command has no arguments or keywords.
Defaults
By default, the SNMP server is enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
This command lets you enable and disable SNMP easily, without having to configure and reconfigure the SNMP traps or other configuration.
Note
Examples
The following example enables SNMP, configures the SNMP host and traps, and then sends traps as system messages.
hostname(config)# snmp-server enablehostname(config)# snmp-server community wallawallabingbanghostname(config)# snmp-server location Building 42, Sector 54hostname(config)# snmp-server contact Sherlock Holmeshostname(config)# snmp-server host perimeter 10.1.2.42hostname(config)# snmp-server enable traps allhostname(config)# logging history 7hostname(config)# logging enableRelated Commands
snmp-server enable traps
To enable the FWSM to send traps to the NMS, use the snmp-server enable traps command in global configuration mode. To disable traps, use the no form of this command.
snmp-server enable traps [all | syslog | snmp [trap] [...] | cpu threshold [trap] | entity [trap] [...] | ipsec [trap] [...] | nat [trap] | remote-access [trap] | resource [trap]]
no snmp-server enable traps [all | syslog | snmp [trap] [...] | cpu threshold [trap] | entity [trap] [...] | ipsec [trap] [...] | nat [trap] | remote-access [trap] | resource [trap]]
Syntax Description
Defaults
The default configuration has all snmp traps enabled (snmp-server enable traps snmp authentication linkup linkdown coldstart). You can disable these traps using the no form of this command with the snmp keyword. However, the clear configure snmp-server command restores the default enabling of SNMP traps.
If you enter this command and do not specify a trap type, then the default is syslog. (The default snmp traps continue to be enabled along with the syslog trap.)
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
Enter this command for each feature type to enable individual traps or sets of traps, or enter the all keyword to enable all traps.
To send traps to the NMS, enter the logging history command, and enable logging using the logging enable command.
The remote-access option is not available in multi-firewall mode in FWSM Version 4.0(1).
Note
Examples
The following example enables SNMP, configures the SNMP host and traps, and then sends traps as system messages.
hostname(config)# snmp-server enablehostname(config)# snmp-server community wallawallabingbanghostname(config)# snmp-server location Building 42, Sector 54hostname(config)# snmp-server contact Sherlock Holmeshostname(config)# snmp-server host perimeter 10.1.2.42hostname(config)# snmp-server enable traps allhostname(config)# logging history 7hostname(config)# logging enableRelated Commands
snmp-server host
To specify the NMS that can use SNMP on the FWSM, use the snmp-server host command in global configuration mode. To disable the NSM, use the no form of this command.
snmp-server host interface_name ip_address [trap | poll] [community text] [version {1 | 2c}] [udp-port port]
no snmp-server host interface_name ip_address [trap | poll] [community text] [version {1 | 2c}] [udp-port port]
Syntax Description
Defaults
The default UDP port is 162.
The default version is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
You can specify up to 32 NMSs.
Note
Examples
The following example sets the host to 10.1.2.42 attached to the perimeter interface:
hostname(config)# snmp-server host perimeter 10.1.2.42Related Commands
snmp-server listen-port
To set the listen port for SNMP requests, use the snmp-server listen-port command in global configuration mode. To restore the default port, use the no form of the command.
snmp-server listen-port lport
no snmp-server listen-port lport
Syntax Description
Defaults
The default port is 161.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
If the console access rule limit has been met in NP3, and you try to add an snmp-server command, the rule download fails, but the line stays in the running configuration. You can save this setting to the startup configuation so that after a reboot, other console access rule (that is, SSH, Telnet, HTTP, and ICMP) commands are not included in the configuration.
Examples
The following example sets the listen port to 192:
hostname(config)# snmp-server listen-port 192Related Commands
snmp-server location
To set the FWSM location for SNMP, use the snmp-server location command in global configuration mode. To remove the location, use the no form of this command.
snmp-server location text
no snmp-server location [text]
Syntax Description
location text
Specifies the security appliance location. The location text is case sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If the console access rule limit has been met in NP3, and you try to add an snmp-server command, the rule download fails, but the line stays in the running configuration. You can save this setting to the startup configuation so that after a reboot, other console access rule (that is, SSH, Telnet, HTTP, and ICMP) commands are not included in the configuration.
Examples
The following example sets the location as Building 42, Sector 54:
hostname(config)# snmp-server location Building 42, Sector 54Related Commands
software-version
To identify the Server and User-Agent header fields, which expose the software version of either a server or an endpoint, use the software-version command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
software-version action {mask | log} [log}
no software-version action {mask | log} [log}
Syntax Description
mask
Masks the software version in the SIP message.
log
Specifies standalone or additional log in case of violation.
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to identify the software version in a SIP inspection policy map:
hostname(config)# policy-map type inspect sip sip_maphostname(config-pmap)# parametershostname(config-pmap-p)# software-version action logRelated Commands
split-dns
To enter a list of domains to be resolved through the split tunnel, use the split-dns command in group-policy configuration mode. To delete a list, use the no form of this command.
split-dns {value domain-name1 domain-name2 domain-nameN | none}
no split-dns [domain-name domain-name2 domain-nameN]
Syntax Description
Defaults
Split DNS is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group policy
•
—
•
—
—
Command History
Usage Guidelines
Use a single space to separate each entry in the list of domains. There is no limit on the number of entries, but the entire string can be no longer than 255 characters. You can use only alphanumeric characters, hyphens (-), and periods (.).
To delete all split tunneling domain lists, use the no split-dns command without arguments. This deletes all configured split tunneling domain lists, including a null list created by issuing the split-dns none command.
When there are no split tunneling domain lists, users inherit any that exist in the default group policy. To prevent users from inheriting such split tunneling domain lists, use the split-dns none command.
Examples
The following example shows how to configure the domains Domain1, Domain2, Domain3 and Domain4 to be resolved through split tunneling for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# split-dns value Domain1 Domain2 Domain3 Domain4Related Commands
split-horizon
To reenable EIGRP split horizon, use the split-horizon command in interface configuration mode. To disable EIGRP split horizon, use the no form of this command.
split-horizon eigrp as-number
no split-horizon eigrp as-number
Syntax Description
Defaults
The split-horizon command is enabled.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
For networks that include links over X.25 packet-switched networks, you can use the neighbor command to defeat the split horizon feature. As an alternative, you can explicitly specify the no split-horizon eigrp command in your configuration. However, if you do so, you must similarly disable split horizon for all routers and access servers in any relevant multicast groups on that network.
In general, it is best that you not change the default state of split horizon unless you are certain that your application requires the change in order to properly advertise routes. If split horizon is disabled on a serial interface and that interface is attached to a packet-switched network, you must disable split horizon for all routers and access servers in any relevant multicast groups on that network.
Examples
The following example disables EIGRP split horizon on interface Vlan10:
hostname(config)# interface Vlan10hostname(config-if)# no split-horizon eigrp 100Related Commands
router eigrp
Creates an EIGRP routing process and enters configuration mode for that process.
split-tunnel-network-list
To create a network list for split tunneling, use the split-tunnel-network-list command in group-policy configuration mode. To delete a network list, use the no form of this command.
split-tunnel-network-list {value access-list name | none}
no split-tunnel-network-list value [access-list name]
Syntax Description
Defaults
By default, there are no split tunneling network lists.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
The FWSM makes split tunneling decisions on the basis of a network list, which is a standard ACL that consists of a list of addresses on the private network.
To delete all split tunneling network lists, use the no split-tunnel-network-list command without arguments. This deletes all configured network lists, including a null list created by issuing the split-tunnel-network-list none command.
When there are no split tunneling network lists, users inherit any network lists that exist in the default or specified group policy. To prevent users from inheriting such network lists, use the split-tunnel-network-list none command.
Split tunneling network lists distinguish networks that require traffic to travel across the tunnel from those that do not require tunneling.
Examples
The following example shows how to set a network list called FirstList for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# split-tunnel-network-list FirstListRelated Commands
split-tunnel-policy
To set a split tunneling policy, use the split-tunnel-policy command in group-policy configuration mode. To remove the split-tunnel-policy attribute from the running configuration, use the no form of this command. This enables inheritance of a value for split tunneling from another group policy.
split-tunnel-policy {tunnelall | tunnelspecified | excludespecified}
no split-tunnel-policy
Syntax Description
Defaults
Split tunneling is disabled by default, which is tunnelall.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
Split tunneling is primarily a traffic management feature, not a security feature. In fact, for optimum security, we recommend that you not enable split tunneling. Split tunneling lets a remote-access IPSec client conditionally direct packets over an IPSec tunnel in encrypted form, or to a network interface in cleartext form. With split-tunneling enabled, packets not bound for destinations on the other side of the IPSec tunnel do not have to be encrypted, sent across the tunnel, decrypted, and then routed to a final destination.
This command applies this split tunneling policy to a specific network.
Examples
The following example shows how to set a split tunneling policy of tunneling only specified networks for the group policy named FirstGroup:
hostname(config)#group-policy FirstGroup attributeshostname(config-group-policy)#split-tunnel-policy tunnelspecifiedRelated Commands
ssh
To add SSH access to the FWSM, use the ssh command in global configuration mode. To disable SSH access to the FWSM, use the no form of this command. This command supports IPv4 and IPv6 addresses.
ssh {ip_address mask | ipv6_address/prefix} interface
no ssh {ip_address mask | ipv6_address/prefix} interface
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The ssh ip_address command specifies hosts or networks that are authorized to initiate an SSH connection to the FWSM. You can have multiple ssh commands in the configuration. The no form of the command removes a specific SSH command from the configuration. Use the clear configure ssh command to remove all SSH commands.
Before you can begin using SSH to the FWSM, you must generate a default RSA key using the crypto key generate rsa command.
The following security algorithms and ciphers are supported on the FWSM:
•
•
•
•
The following SSH Version 2 features are not supported on the FWSM:
•
•
•
•
•
Examples
The following example shows how to configure the inside interface to accept SSH version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssh disconnect
To disconnect an active SSH session, use the ssh disconnect command in privileged EXEC mode.
ssh disconnect session_id
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You must specify a session ID. Use the show ssh sessions command to obtain the ID of the SSH session you want to disconnect.
Examples
The following example shows an SSH session being disconnected:
hostname# show ssh sessionsSID Client IP Version Mode Encryption Hmac State Username0 172.69.39.39 1.99 IN aes128-cbc md5 SessionStarted patOUT aes128-cbc md5 SessionStarted pat1 172.23.56.236 1.5 - 3DES - SessionStarted pat2 172.69.39.29 1.99 IN 3des-cbc sha1 SessionStarted patOUT 3des-cbc sha1 SessionStarted pathostname# ssh disconnect 2hostname# show ssh sessionsSID Client IP Version Mode Encryption Hmac State Username0 172.69.39.29 1.99 IN aes128-cbc md5 SessionStarted patOUT aes128-cbc md5 SessionStarted pat1 172.23.56.236 1.5 - 3DES - SessionStarted patRelated Commands
show ssh sessions
Displays information about active SSH sessions to the FWSM.
ssh timeout
Sets the timeout value for idle SSH sessions.
ssh scopy enable
To enable Secure Copy (SCP) on the FWSM, use the ssh scopy enable command in global configuration mode. To disable SCP, use the no form of this command.
ssh scopy enable
no ssh scopy enable
Syntax Description
This command has no keywords or arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
•
Command History
Usage Guidelines
SCP is a server-only implementation; it will be able to accept and terminate connections for SCP but can not initiate them. The FWSM has the following restrictions:
•
•
•
•
Examples
The following example shows how to configure the inside interface to accept SSH Version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssh timeout
To change the default SSH session idle timeout value, use the ssh timeout command in global configuration mode. To restore the default timeout value, use the no form of this command.
ssh timeout number
no ssh timeout
Syntax Description
number
Specifies the duration in minutes that an SSH session can remain inactive before being disconnected. Valid values are from 1 to 60 minutes.
Defaults
The default session timeout value is 5 minutes.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The ssh timeout command specifies the duration in minutes that a session can be idle before being disconnected. The default duration is 5 minutes.
Examples
The following example shows how to configure the inside interface to accept only SSH version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssh version
To restrict the version of SSH accepted by the FWSM, use the ssh version command in global configuration mode. To restore the default value, use the no form of this command.
ssh version {1 | 2}
no ssh version [1 | 2]
Syntax Description
1
Specifies that only SSH Version 1 connections are supported.
2
Specifies that only SSH Version 2 connections are supported.
Defaults
By default, both SSH Version 1 and SSH Version 2 are supported.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
1 and 2 specify which version of SSH the FWSM is restricted to using. The no form of the command returns the FWSM to the default stance, which is compatible mode (both version can be used). The default values permit SSH Version 1 and SSH Version 2 connections to the FWSM.
Examples
The following example shows how to configure the inside interface to accept SSH Version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssl server-version
To specify the SSL/TLS protocol version FWSM uses when acting as a server, use the ssl server-version command in global configuration mode. To revert to the default, any, use the no version of this command. This command lets you restrict the versions of SSL/TSL that FWSM accepts.
ssl server-version [any | sslv3 | tlsv1 | sslv3-only | tlsv1-only]
no ssl server-version
Syntax Description
Defaults
The default value is any.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
Use the ssl server-version command to enforce what version of SSL is accepted when HTTPS clients connect directly to the firewall for management of the firewall. On the FWSM, the command does not support the WebVPN feature.
Examples
The following example shows how to configure FWSM to communicate using only TLSv1 when acting as an SSL server:
hostname(config)#ssl server-version tlsv1-onlystate-checking
To enforce state checking for H.323, use the state-checking command in parameters configuration mode. To disable this feature, use the no form of this command.
state-checking [h225 | ras]
no state-checking [h225 | ras]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to enforce state checking for RAS on an H.323 call:
hostname(config)# policy-map type inspect h323 h323_maphostname(config-pmap)# parametershostname(config-pmap-p)# state-checking rasRelated Commandshostname(config-pmap-p)# rtp-conformance
static
To configure a persistent one-to-one address translation rule by mapping a real IP address to a mapped IP address, use the static command in global configuration mode. To restore the default settings, use the no form of this command.
For static NAT:
static (real_ifc,mapped_ifc) {mapped_ip | interface} {real_ip [netmask mask] | access-list access_list_name} [dns] [[tcp] max_conns [emb_lim]] [udp udp_max_conns] [norandomseq]
no static (real_ifc,mapped_ifc) {mapped_ip | interface} {real_ip [netmask mask] | access-list access_list_name} [dns] [[tcp] max_conns [emb_lim]] [udp udp_max_conns] [norandomseq]
For static PAT:
static (real_ifc,mapped_ifc) {tcp | udp} {mapped_ip | interface} mapped_port {real_ip real_port [netmask mask] | access-list access_list_name} [dns] [[tcp] max_conns [emb_lim]] [udp udp_max_conns] [norandomseq]
no static (real_ifc,mapped_ifc) {tcp | udp} {mapped_ip | interface} mapped_port {real_ip real_port [netmask mask] | access-list access_list_name} [dns] [[tcp] max_conns [emb_lim]] [udp udp_max_conns] [norandomseq]
Syntax Description
Defaults
The default value for tcp_max_conns, emb_limit, and udp_max_conns is 0 (unlimited), which is the maximum available.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Static NAT creates a fixed translation of real address(es) to mapped address(es).With dynamic NAT and PAT, each host uses a different address or port for each subsequent translation. Because the mapped address is the same for each consecutive connection with static NAT, and a persistent translation rule exists, static NAT allows hosts on the destination network to initiate traffic to a translated host (if there is an access list that allows it).
Note
Matching ports can be used for static policy NAT. Matching ports are not supported for NAT.
The main difference between dynamic NAT and a range of addresses for static NAT is that static NAT allows a remote host to initiate a connection to a translated host (if there is an access list that allows it), while dynamic NAT does not. You also need an equal number of mapped addresses as real addresses with static NAT.
Static PAT is the same as static NAT, except that it lets you specify the protocol (TCP or UDP) and port for the real and mapped addresses.
This feature lets you identify the same mapped address across many different static statements, so long as the port is different for each statement.
You cannot use the same real or mapped address in multiple static commands between the same two interfaces, unless you use static PAT. Do not use a mapped address in the static command that is also defined in a global command for the same mapped interface.
When you specify the ports in policy NAT for applications that require application inspection for secondary channels (FTP, VoIP, and so on), the FWSM automatically translates the secondary ports.
You can alternatively set connection limits (but not embryonic connection limits) using the Modular Policy Framework. See the set connection commands for more information. You can only set embryonic connection limits using NAT. If you configure these settings for the same traffic using both methods, then the FWSM uses the lower limit. For TCP sequence randomization, if it is disabled using either method, then the FWSM disables TCP sequence randomization.
If you specify a network for translation (for example, 10.1.1.0 255.255.255.0), then the FWSM translates the .0 and .255 addresses. If you want to prevent access to these addresses, be sure to configure an access list to deny access.
If you change or remove a static command, existing connections that use the translation are not affected. To remove these connections, enter the clear local-host or the clear xlate command. The clear xlate command clears all connections, even when xlate-bypass is enabled and when a connection does not have an xlate.
Examples
Static NAT Examples
For example, the following policy static NAT example shows a single real address that is translated to two mapped addresses depending on the destination address:
hostname(config)# access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224hostname(config)# access-list NET2 permit ip host 10.1.2.27 209.165.200.224 255.255.255.224hostname(config)# static (inside,outside) 209.165.202.129 access-list NET1hostname(config)# static (inside,outside) 209.165.202.130 access-list NET2The following command maps an inside IP address (10.1.1.3) to an outside IP address (209.165.201.12):
hostname(config)# static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255The following command maps the outside address (209.165.201.15) to an inside address (10.1.1.6):
hostname(config)# static (outside,inside) 10.1.1.6 209.165.201.15 netmask 255.255.255.255The following command statically maps an entire subnet:
hostname(config)# static (inside,dmz) 10.1.1.0 10.1.2.0 netmask 255.255.255.0The following example shows how to permit a finite number of users to call in through H.323 using Intel Internet Phone, CU-SeeMe, CU-SeeMe Pro, MeetingPoint, or Microsoft NetMeeting. The static command maps addresses 209.165.201.0 through 209.165.201.30 to local addresses 10.1.1.0 through 10.1.1.30 (209.165.201.1 maps to 10.1.1.1, 209.165.201.10 maps to 10.1.1.10, and so on).
hostname(config)# static (inside, outside) 209.165.201.0 10.1.1.0 netmask 255.255.255.224hostname(config)# access-list acl_out permit tcp any 209.165.201.0 255.255.255.224 eq h323hostname(config)# access-group acl_out in interface outsideThe following example shows the commands that are used to disable Mail Guard:
hostname(config)# static (dmz1,outside) 209.165.201.1 10.1.1.1 netmask 255.255.255.255hostname(config)# access-list acl_out permit tcp any host 209.165.201.1 eq smtphostname(config)# access-group acl_out in interface outsidehostname(config)# no fixup protocol smtp 25In the example, the static command allows you to set up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. You shoud set the MX record for DNS to point to the 209.165.201.1 address so that mail is sent to this address. The access-list command allows the outside users to access the global address through the SMTP port (25). The no fixup protocol command disables Mail Guard.
Static PAT Examples
For example, for Telnet traffic initiated from hosts on the 10.1.3.0 network to the FWSM outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering the following commands:
hostname(config)# access-list TELNET permit tcp host 10.1.1.15 10.1.3.0 255.255.255.0 eq telnethostname(config)# static (inside,outside) tcp 10.1.2.14 telnet access-list TELNETFor HTTP traffic initiated from hosts on the 10.1.3.0 network to the FWSM outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering:
hostname(config)# access-list HTTP permit tcp host 10.1.1.15 10.1.3.0 255.255.255.0 eq httphostname(config)# static (inside,outside) tcp 10.1.2.14 http access-list HTTPTo redirect Telnet traffic from the FWSM outside interface (10.1.2.14) to the inside host at 10.1.1.15, enter the following command:
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255If you want to allow the preceding real Telnet server to initiate connections, though, then you need to provide additional translation. For example, to translate all other types of traffic, enter the following commands. The original static command provides translation for Telnet to the server, while the nat and global commands provide PAT for outbound connections from the server.
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255hostname(config)# global (outside) 1 10.1.2.14If you also have a separate translation for all inside traffic, and the inside hosts use a different mapped address from the Telnet server, you can still configure traffic initiated from the Telnet server to use the same mapped address as the static statement that allows Telnet traffic to the server. You need to create a more exclusive nat statement just for the Telnet server. Because nat statements are read for the best match, more exclusive nat statements are matched before general statements. The following example shows the Telnet static statement, the more exclusive nat statement for initiated traffic from the Telnet server, and the statement for other inside hosts, which uses a different mapped address.
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255hostname(config)# global (outside) 1 10.1.2.14hostname(config)# nat (inside) 2 10.1.1.0 255.255.255.0hostname(config)# global (outside) 2 10.1.2.78To translate a well-known port (80) to another port (8080), enter the following command:
hostname(config)# static (inside,outside) tcp 10.1.2.45 80 10.1.1.16 8080 netmask 255.255.255.255Related Commands
strict-header-validation
To enable strict validation of the header fields in the SIP messages according to RFC 3261, use the strict-header-validation command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
strict-header-validation action {drop | drop-connection | reset | log} [log}
no strict-header-validation action {drop | drop-connection | reset | log} [log}
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Usage Guidelines
To send a TCP reset from the universal access concentrator (UAC) to the user agent server (UAS) when there is a violation in SIP message header, you must configure the service resetinbound command in addition to entering the reset log keywords for the strict-header-validation command.
When the security level is different on the inside and outside interfaces, the reset is sent to the inside host only. To send the reset to the outside, you must configure the service resetinbound command and enter the reset log keywords for the strict-header-validation command.
Examples
The following example shows how to enable strict validation of SIP header fields in a SIP inspection policy map:
hostname(config)# policy-map type inspect sip sip_maphostname(config-pmap)# parametershostname(config-pmap-p)# strict-header-validation action logRelated Commands
strict-http
To allow forwarding of non-compliant HTTP traffic, use the strict-http command in HTTP map configuration mode, which is accessible using the http-map command. To reset this feature to its default behavior, use the no form of the command.
strict-http action {allow | reset | drop} [log]
no strict-http action {allow | reset | drop} [log]
Syntax Description
Defaults
This command is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
HTTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
Although strict HTTP inspection cannot be disabled, the strict-http action allow command causes the FWSM to allow forwarding of non-compliant HTTP traffic. This command overrides the default behavior, which is to deny forwarding of non-compliant HTTP traffic.
Examples
The following example allows forwarding of non-compliant HTTP traffic:
hostname(config)# http-map inbound_httphostname(config-http-map)# strict-http allowRelated Commands
strip-group
This command applies only to usernames received in the form user@realm. A realm is an administrative domain appended to a username with the @ delimiter (juser@abc).
To enable or disable strip-group processing, use the strip-group command in tunnel-group general-attributes mode. The FWSM selects the tunnel group for PPP connections by obtaining the group name from the username presented by the VPN client. When strip-group processing is enabled, the FWSM sends only the user part of the username for authorization/authentication. Otherwise (if disabled), the FWSM sends the entire username including the realm.
To disable strip-group processing, use the no form of this command.
strip-group
no strip-group
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting for this command is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute only to the IPSec remote access and L2TP/IPSec tunnel-type.
Examples
The following example configures a remote access tunnel group named "remotegrp" for type IPSec remote access, then enters general configuration mode, sets the tunnel group named "remotegrp" as the default group policy, and then enables strip group for that tunnel group:
hostname(config)# tunnel-group remotegrp type IPSec_rahostname(config)# tunnel-group remotegrp generalhostname(config-general)# default-group-policy remotegrphostname(config-general)# strip-grouphostname(config-general)Related Commands
strip-realm
To enable or disable strip-realm processing, use the strip-realm command in tunnel-group general-attributes configuration mode. Strip-realm processing removes the realm from the username when sending the username to the authentication or authorization server. A realm is an administrative domain appended to a username with the @ delimiter (username@realm). If the command is enabled, the FWSM sends only the user part of the username authorization/authentication. Otherwise, the FWSM sends the entire username.
To disable strip-realm processing, use the no form of this command.
strip-realm
no strip-realm
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting for this command is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute only to the IPSec remote access tunnel-type.
Examples
The following example configures a remote access tunnel group named "remotegrp" for type IPSec remote access, then enters general configuration mode, sets the tunnel group named "remotegrp" as the default group policy, and then enables strip realm for that tunnel group:
hostname(config)# tunnel-group remotegrp type IPSec_rahostname(config)# tunnel-group remotegrp generalhostname(config-general)# default-group-policy remotegrphostname(config-general)# strip-realmRelated Commandshostname(config-general)
subject-name (crypto ca certificate map)
To indicate that rule entry is applied to the subject DN of the IPSec peer certificate, use the subject-name command in CA certificate map configuration mode. To remove a subject-name, use the no form of the command.
subject-name [attr tag] {eq | ne | co | nc} string
no subject-name [attr tag] {eq | ne | co | nc} string
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca certificate map configuration
•
•
•
•
—
Command History
Examples
The following example enters the CA certificate map mode for certificate map 1 and creates a rule entry indicating that the Organization attribute of the certificate subject name must be equal to Central.
hostname(config)# crypto ca certificate map 1hostname(ca-certificate-map)# subject-name attr o eq centralhostname(ca-certificate-map)# exithostname(config)#Related Commands
subject-name (crypto ca trustpoint)
To include the indicated subject DN in the certificate during enrollment, use the subject-name command in crypto ca trustpoint configuration mode. This is the person or system that uses the certificate. To restore the default setting, use the no form of the command.
subject-name X.500_name
no subject-name
Syntax Description
X.500_name
Defines the X.500 distinguished name, for example: cn=crl,ou=certs,o=CAName,c=US. The maximum length is 1K characters (effectively unbounded).
Defaults
The default setting is not to include the subject name.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
•
•
•
•
—
Command History
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and sets up automatic enrollment at the URL https//:www.example.com and includes the subject DN OU cisco.example in the the enrollment request for trustpoint central:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# enrollment url http://www.example.com/hostname(ca-trustpoint)# subject-name ou=cisco.examplehostname(ca-trustpoint)#Related Commands
summary-address eigrp
To configure a summary for EIGRP on a specific interface, use the summary-address eigrp command in interface configuration mode. To remove the summary address, use the no form of this command.
summary-address eigrp as-number addr mask [admin-distance]
no summary-address as-number addr mask
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
—
•
—
—
Command History
Usage Guidelines
By default, EIGRP summarizes subnet routes to the network level. Use the no auto-summary command to disable automatic route summarization. Using the summary-address eigrp command lets you manually define subnet route summaries on a per-interface basis.
Examples
The following example configures route summarization with a tag set to 3:
hostname(config-router)# summary-address 1.1.0.0 255.255.0.0hostname(config-router)#The following example shows how to use the no form of the summary-address command with an option to set that option back to the default value. In this example, the tag value, set to 3 in the previous example, is removed from the summary-address command.
hostname(config-router)# no summary-address 1.1.0.0 255.255.0.0hostname(config-router)#The following example removes the summary-address command from the configuration:
hostname(config-router)# no summary-address 1.1.0.0 255.255.0.0hostname(config-router)#Related Commands
auto-summary
Automatically creates summary addresses for the EIGRP routing process.
summary-address
To create aggregate addresses for OSPF, use the summary-address command in router configuration mode. To remove the summary address or specific summary address options, use the no form of this command.
summary-address addr mask [not-advertise] [tag tag_value]
no summary-address addr mask [not-advertise] [tag tag_value]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
Routes learned from other routing protocols can be summarized. Using this command for OSPF causes an OSPF Autonomous System Boundary Router (ASBR) to advertise one external route as an aggregate for all redistributed routes that are covered by the address. This command summarizes only routes from other routing protocols that are being redistributed into OSPF. Use the area range command for route summarization between OSPF areas.
To remove a summary-address command from the configuration, use the no form of the command without specifying any of the optional keywords or arguments. To remove an option from a summary command in the configuration, use the no form of the command with the options that you want removed. See the "Examples" section for more information.
Examples
The following example configures route summarization with a tag set to 3:
hostname(config-router)# summary-address 1.1.0.0 255.255.0.0 tag 3hostname(config-router)#The following example shows how to use the no form of the summary-address command with an option to set that option back to the default value. In this example, the tag value, set to 3 in the previous example, is removed from the summary-address command.
hostname(config-router)# no summary-address 1.1.0.0 255.255.0.0 tag 3hostname(config-router)#The following example removes the summary-address command from the configuration:
hostname(config-router)# no summary-address 1.1.0.0 255.255.0.0hostname(config-router)#Related Commands
sunrpc-server
To create entries in the SunRPC services table, use the sunrpc-server command in global configuration mode. To remove SunRPC services table entries from the configuration, use the no form of this command.
sunrpc-server ifc_name ip_addr mask service service_type {protocol {tcp | udp}} port port [- port ] timeout hh:mm:ss
no sunrpc-server ifc_name ip_addr mask service service_type {protocol {tcp | udp}} port port [- port] timeout hh:mm:ss
no sunrpc-server active service service_type server ip_addr
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
2.2(1)
The rpc-server command was introduced.
3.1(1)
This command was changed from rpc-server.
Usage Guidelines
The SunRPC services table is used to allow SunRPC traffic through the FWSM based on an established SunRPC session for the duration specified by the timeout.
Examples
The following examples show how to create an SunRPC services table.
hostname(config)#sunrpc-server outside 10.10.10.10 255.255.255.255 service 100003 protocol TCP port 111 timeout 0:10:00hostname(config)#sunrpc-server outside 10.10.10.0 255.255.255.0 service 100003 protocol TCP port 111 timeout 0:10:00In the first example, ip_addr contains the IP address of the server host; therefore, the netmask should be 255.255.255.255. In the second example, ip_addr contains the network IP address of the server: therefore, the netmask should be 255.255.255.0.
Related Commands
support-user-cert-validation
To validate a remote user certificate based on the current trustpoint, provided that this trustpoint is authenticated to the CA that issued the remote certificate, use the support-user-cert-validation command in crypto ca trustpoint configuration mode. To restore the default setting, use the no form of the command.
support-user-cert-validation
no support-user-cert-validation
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting is to support user certificate validation.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
•
•
•
•
—
Command History
Usage Guidelines
The FWSM can have two trustpoints with the same CA resulting in two different identity certificates from the same CA. This option is automatically disabled if the trustpoint is authenticated to a CA that is already associated with another trustpoint that has enabled this feature. This prevents ambiguity in the choice of path-validation parameters. If the user attempts to activate this feature on a trustpoint that has been authenticated to a CA already associated with another trustpoint that has enabled this feature, the action is not permitted. No two trustpoints can have this setting enabled and be authenticated to the same CA.
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and enables the trustpoint central to accept user validation:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# support-user-cert-validationhostname(ca-trustpoint)#Related Commands
crypto ca trustpoint
Enters trustpoint configuration mode.
default enrollment
Returns enrollment parameters to their defaults.
sysopt connection tcpmss
To ensure that the maximum TCP segment size does not exceed the value you set and that the maximum is not less than a specified size, use the sysopt connection tcpmss command in global configuration mode. To restore the default setting, use the no form of this command.
sysopt connection tcpmss [minimum] bytes
no sysopt connection tcpmss [minimum] [bytes]
Syntax Description
Defaults
The default maximum value is 1380 bytes. The minimum feature is disabled by default (set to 0).
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Both the host and the server can set the maximum segment size when they first establish a connection. If either maximum exceeds the value you set with the sysopt connection tcpmss command, then the FWSM overrides the maximum and inserts the value you set. If either maximum is less than the value you set with the sysopt connection tcpmss minimum command, then the FWSM overrides the maximum and inserts the "minimum" value you set (the minimum value is actually the smallest maximum allowed). For example, if you set a maximum size of 1200 bytes and a minimum size of 400 bytes, when a host requests a maximum size of 1300 bytes, then the FWSM alters the packet to request 1200 bytes (the maximum). If another host requests a maximum value of 300 bytes, then the FWSM alters the packet to request 400 bytes (the minimum).
The default of 1380 bytes allows room for header information so that the total packet size does not exceed 1500 bytes, which is the default MTU for Ethernet. See the following calculation:
1380 data + 20 TCP + 20 IP + 24 AH + 24 ESP_CIPHER + 12 ESP_AUTH + 20 IP = 1500 bytes
If the host or server does not request a maximum segment size, the FWSM assumes that the RFC 793 default value of 536 bytes is in effect.
If you set the maximum size to be greater than 1380, packets might become fragmented, depending on the MTU size (which is 1500 by default). Large numbers of fragments can impact the performance of the FWSM when it uses the Frag Guard feature. Setting the minimum size prevents the TCP server from sending many small TCP data packets to the client and impacting the performance of the server and the network.
Note
Examples
The following example sets the maximum size to 1200 and the minimum to 400:
hostname(config)# sysopt connection tcpmss 1200hostname(config)# sysopt connection tcpmss minimum 400Related Commands
clear configure sysopt
Clears the sysopt command configuration.
show running-config sysopt
Shows the sysopt command configuration.
sysopt connection tcp sack-permitted
To allow the Selective-ACK-Permitted option (type 4) exchanged during the TCP 3-way handshake, use the sysopt connection tcp sack-permitted command in global configuration mode. To clear the Selective-ACK-Permitted option, use the no form of this command. Because the FWSM does not support the Selective-ACK option (type 5) in TCP packets, the no form of this command prevents the sender from including the SACK option in packets.
sysopt connection tcp sack-permitted
no sysopt connection tcp sack-permitted
Syntax Description
This command has no arguments or keywords.
Command Default
This command is enabled by default, and the Selective-ACK-Permitted option remains intact.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The FWSM does not support the Selective-ACK option (type 5). If the Selective-ACK option is enabled in a connection where sequence number randomization is enabled (the default), then you might see poor performance because the FWSM does not properly adjust the sequence numbers present inside the Selective-ACK option according to the randomized sequence. For example, the data sender unnecessarily retransmits segments that have been correctly received.
To prevent the receipt of packets with the Selective-ACK option, the no sysopt connection tcp sack-permitted command disables the Selective-ACK negotiation during the handshake by clearing the Selective-ACK-Permitted option. The FWSM will replace the Selective-ACK-Permitted option with no operation (NOP) option, without changing the total length of the packet. Using the no form of this command prevents unnecessary retransmissions, and prevents you from having to disable Initial Sequence Number (ISN) randomization.
Examples
The following example clears the Selective-ACK-Permitted option:
hostname(config)# no sysopt connection tcp sack-permittedRelated Commands
sysopt connection tcpmss
Ensures that the maximum TCP segment size does not exceed the value you set and that the maximum is not less than a specified size.
sysopt connection tcp window-scale
To allow the TCP window-scale option, use the sysopt connection tcp window-scale command in global configuration mode. To replace the TCP window scale option with the no operation (NOP) option,without changing the total length of the packet, use the no form of this command.
sysopt connection tcp window-scale
no sysopt connection tcp window-scale
Syntax Description
This command has no arguments or keywords.
Command Default
This command is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
You should disable this command if you want to disable window scaling. For example, certain inspection engines (SIP, Skinny) use TCP Proxy to reassemble the application payload spanning multiple TCP segments. The TCP Proxy is unaware of TCP Window Scaling options on the segments, and it is unable to reassemble such flows correctly unless you disable window scaling.
Examples
The following example disables window scaling:
hostname(config)# no sysopt connection tcp window-scaleRelated Commands
sysopt nodnsalias
To disable DNS inspection that alters the DNS A record address when you use the alias command, use the sysopt nodnsalias command in global configuration mode. To disable this feature, use the no form of this command. You might want to disable DNS application inspection if you want the alias command to perform only NAT, and DNS packet alteration is undesirable.
sysopt nodnsalias {inbound | outbound}
no sysopt nodnsalias {inbound | outbound}
Syntax Description
Defaults
This feature is disabled by default (DNS record address alteration is enabled).
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Command History
Usage Guidelines
The alias command performs NAT and DNS A record address alteration. In some cases, you might want to disable the DNS record alteration.
Examples
The following example disables the DNS address alteration for inbound packets:
hostname(config)# sysopt nodnsalias inboundRelated Commands
sysopt noproxyarp
To disable proxy ARP for NAT global addresses on an interface, use the sysopt noproxyarp command in global configuration mode. To reenable proxy ARP for global addresses, use the no form of this command.
sysopt noproxyarp interface_name
no sysopt noproxyarp interface_name
Syntax Description
Defaults
Proxy ARP for global addresses is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
In rare circumstances, you might want to disable proxy ARP for global addresses.
When a host sends IP traffic to another device on the same Ethernet network, the host needs to know the MAC address of the device. ARP is a Layer 2 protocol that resolves an IP address to a MAC address. A host sends an ARP request asking "Who is this IP address?" The device owning the IP address replies, "I own that IP address; here is my MAC address."
Proxy ARP is when a device responds to an ARP request with its own MAC address, even though the device does not own the IP address. The FWSM uses proxy ARP when you configure NAT and specify a global address that is on the same network as the FWSM interface. The only way traffic can reach the hosts is if the FWSM uses proxy ARP to claim that the FWSM MAC address is assigned to destination global addresses.
Examples
The following example disables proxy ARP on the inside interface:
hostname(config)# sysopt noproxyarp insideRelated Commands
sysopt np completion-unit
To enable the hardware completion unit in the accelerated path network processors (NPs), which ensures that packets are forwarded out in the same order they were received in the ingress queues of the NPs., use the sysopt np completion-unit command in global configuration mode. To restore the default setting, use the no form of this command.
sysopt np completion-unit
no sysopt np completion-unit
Syntax Description
This command has no arguments or keywords.
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
When you enable this command in the admin context, it is enabled for the whole device. You cannot configure this command separately for each context.
Because of design constraints:
•
•
•
•
Examples
The following example enables the hardware completion unit:
hostname(config)# sysopt np completion-unitRelated Commands
clear configure sysopt
Clears the sysopt command configuration.
show running-config sysopt
Shows the sysopt command configuration.
sysopt radius ignore-secret
To ignore the authentication key in RADIUS accounting responses, use the sysopt radius ignore-secret command in global configuration mode. To disable this feature, use the no form of this command. You might need to ignore the key for compatibility with some RADIUS servers.
sysopt radius ignore-secret
no sysopt radius ignore-secret
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Some RADIUS servers, such as Livingston Version 1.16, have a usage caveat where they do not include the key in the authenticator hash in the accounting acknowledgment response. This situation can cause the FWSM to continually retransmit the accounting request. Use the sysopt radius ignore-secret command to ignore the key in the authenticator of accounting acknowledgments thus avoiding the retransmit problem. (The key described here is the key you set with the aaa-server host command.)
Examples
The following example ignores the authentication key in accounting responses:
hostname(config)# sysopt radius ignore-secretRelated Commands
aaa-server host
Identifies a AAA server.
clear configure sysopt
Clears the sysopt command configuration.
show running-config sysopt
Shows the sysopt command configuration.
sysopt uauth allow-http-cache
To let the web browser supply a username and password from its cache when it reauthenticates with the virtual HTTP server on the FWSM (see the virtual http command), use the sysopt uauth allow-http-cache command in global configuration mode. If you do not allow the HTTP cache, then after your authentication session times out, the next time you connect to the virtual HTTP server, you are prompted again for your username and password. To disable this feature, use the no form of this command.
sysopt uauth allow-http-cache
no sysopt uauth allow-http-cache
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example allows the HTTP cache to be used:
hostname(config)# sysopt uauth allow-http-cacheRelated Commands
