-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 4.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show debug -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config logging -- show running-config vpn-sessiondb
-
show service-policy -- show xlate
-
shun -- sysopt uauth allow-http-cache
-
- T through Z Commands
-
Feedback
Table Of Contents
upgrade-mp through xlate-bypass Commands
user-authentication-idle-timeout
vpn-sessiondb max-session-limit
upgrade-mp through xlate-bypass Commands
upgrade-mp
To upgrade the maintenance partition software, use the upgrade-mp command.
upgrade-mp {http[s]://[user:password@]server[:port]/pathname | tftp[://server/pathname]}
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged mode
•
•
•
—
•
Command History
Examples
The following example shows how to download an image from a TFTP server:
hostname# upgrade-mp tftp://10.192.1.1/c6svc-mp.2-1-1.bin.gzRelated Commands
uri-non-sip
To identify the non-SIP URIs present in the Alert-Info and Call-Info header fields, use the uri-non-sip command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
uri-non-sip action {mask | log} [log}
no uri-non-sip action {mask | log} [log}
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to identify the non-SIP URIs present in the Alert-Info and Call-Info header fields in a SIP inspection policy map:
hostname(config)# policy-map type inspect sip sip_maphostname(config-pmap)# parametershostname(config-pmap-p)# uri-non-sip action logRelated Commands
url
To maintain the list of static URLs for retrieving CRLs, use the url command in crl configure configuration mode. The crl configure configuration mode is accessible from the crypto ca trustpoint configuration mode. To delete an existing URL, use the no form of this command.
url index url
no url index url
Syntax Description
index
Specifies a value from 1 to 5 that determines the rank of each URL in the list. The FWSM tries the URL at index 1 first.
url
Specifies the URL from which to retrieve the CRL.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
CRL configure configuration
•
•
•
•
—
Command History
Usage Guidelines
You cannot overwrite existing URLs. To replace an existing URL, first delete it using the no form of this command.
Examples
The following example enters crl configure configuration mode, and sets up an index 3 for creating and maintaining a list of URLs for CRL retrieval and configures the URL https://example.com from which to retrieve CRLs:
hostname(configure)# crypto ca trustpoint centralhostname(ca-trustpoint)# crl configurehostname(ca-crl)# url 3 https://example.comhostname(ca-crl)#Related Commands
crl configure
Enters ca-crl configuration mode.
crypto ca trustpoint
Enters trustpoint configuration mode.
policy
Specifies the source for retrieving CRLs.
url-block
To manage the URL buffers used for web server responses while waiting for a filtering decision from the filtering server, use the url-block command in global configuration mode. To remove the configuration, use the no form of this command.
url-block block block_buffer_limit
no url-block block block_buffer_limit
Websense only:
url-block url-mempool memory_pool_size
no url-block url-mempool memory_pool_siz
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
For Websense filtering servers, the url-block url-size command allows filtering of long URLs, up to 4 KB. For both Websense and N2H2 filtering servers, the url-block block command causes the FWSM to buffer packets received from a web server in response to a web client request while waiting for a response from the URL filtering server. This improves performance for the web client compared to the default FWSM behavior, which is to drop the packets and to require the web server to retransmit the packets if the connection is permitted.
If you use the url-block block command and the filtering server permits the connection, the FWSM sends the blocks to the web client from the HTTP response buffer and removes the blocks from the buffer. If the filtering server denies the connection, the FWSM sends a deny message to the web client and removes the blocks from the HTTP response buffer.
Use the url-block block command to specify the number of blocks to use for buffering web server responses while waiting for a filtering decision from the filtering server.
Use the url-block url-size command with the url-block url-mempool command to specify the maximum length of a URL to be filtered by a Websense filtering server and the maximum memory to assign to the URL buffer. Use these commands to pass URLs longer than 1159 bytes, up to a maximum of 4096 bytes, to the Websense server. The url-block url-size command stores URLs longer than 1159 bytes in a buffer and then passes the URL to the Websense server (through a TCP packet stream) so that the Websense server can grant or deny access to that URL.
Examples
The following example assigns 56 1550-byte blocks for buffering responses from the URL filtering server:
hostname#(config)# url-block block 56Related Commands
url-cache
To enable URL caching while pending responses from an N2H2 or Websense server and to set the size of the cache, use the url-cache command in global configuration mode. To remove the configuration, use the no form of this command.
url-cache {dst | src_dst} kbytes[kb]
no url-cache {dst | src_dst} kbytes[kb]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The url-cache command provides a configuration option to buffer the response from a web server if its response is faster than that from the N2H2 or Websense filtering service server. This prevents the web server response from being loaded twice.
Use the url-cache command to enable URL caching, set the size of the cache, and display cache statistics.
Caching stores URL access privileges in memory on the FWSM. When a host requests a connection, the FWSM first looks in the URL cache for matching access privileges instead of forwarding the request to the N2H2 or Websense server. Disable caching with the no url-cache command.
Note
Using the URL cache does not update the Websense accounting logs for Websense protocol Version 1. If you are using Websense protocol Version 1, let Websense run to accumulate logs so that you can view the Websense accounting information. After you get a usage profile that meets your security needs, enable url-cache to increase throughput. Accounting logs are updated for Websense protocol Version 4 and for N2H2 URL filtering while using the url-cache command.
Examples
The following example caches all outbound HTTP connections based on the source and destination addresses:
hostname(config)# url-cache src_dst 128Related Commands
url-server
To identify a smartfilter (formerly N2H2) or Websense server for use with the filter command, use the url-server command in global configuration mode. To remove the configuration, use the no form of this command.
smartfilter (formerly N2H2)
url-server [<(if_name)>] vendor {smartfilter | n2h2} host <local_ip> [port <number>] [timeout <seconds>] [protocol {TCP [connections <number>]} | UDP]
no url-server [<(if_name)>] vendor {smartfilter | n2h2} host <local_ip> [port <number>] [timeout <seconds>] [protocol {TCP [connections <number>]} | UDP]
Websense
url-server (if_name) vendor websense host local_ip [timeout seconds] [protocol {TCP | UDP | connections num_conns] | version 1|4][context-name]
no url-server (if_name) vendor websense host local_ip [timeout seconds] [protocol {TCP | UDP [connections num_conns] | version 1|4][context-name]
Syntax Description
smartfilter (formerly N2H2)
Websense
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The url-server command designates the server running the smartfilter (formerly N2H2) or Websense URL filtering application. The limit is 16 URL servers; however, you can use only one application at a time, either smartfilter (formerly N2H2) or Websense. Additionally, changing your configuration on the FWSM does not update the configuration on the application server; this must be done separately, according to the vendor instructions.
The url-server command must be configured before issuing the filter command for URL, HTTPS and FTP filtering. Before removing all the url-servers from the server list, associated filter commands must be removed.
Once you designate the server, enable the filtering service with the filter url command.
To filter URLs, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
For more information about Filtering by smartfilter (formerly N2H2), visit the smartfilter (formerly N2H2) website at:
http://www.n2h2.com
Note
For more information on Websense filtering services, visit the following website:
http://www.websense.com/
Examples
Using smartfilter (formerly N2H2), the following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
hostname(config)# url-server (perimeter) vendor n2h2 host 10.0.1.1hostname(config)# filter url http 0 0 0 0hostname(config)# filter url except 10.0.2.54 255.255.255.255 0 0Using Websense, the following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
hostname(config)# url-server (perimeter) host 10.0.1.1 protocol TCP version 4hostname(config)# filter url http 0 0 0 0hostname(config)# filter url except 10.0.2.54 255.255.255.255 0 0Using Websense, the following example uses the context-name feature:url-server (inside) host 10.1.1.10 protocol TCP version 4 connections 5 context-nameurl-server (inside) host 10.1.1.10 timeout 20 protocol UDP version 4 context-nameRelated Commands
user-authentication
To enable user authentication, use the user-authentication enable command in group-policy configuration mode. To disable user authentication, use the user-authentication disable command. To remove the user authentication attribute from the running configuration, use the no form of this command. This option allows inheritance of a value for user authentication from another group policy.
When enabled, user authentication requires that individual users behind a hardware client authenticate to gain access to the network across the tunnel.
user-authentication {enable | disable}
no user-authentication
Syntax Description
Defaults
User authentication is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
Individual users authenticate according to the order of authentication servers that you configure.
If you require user authentication on the primary FWSM, be sure to configure it on any backup servers as well.
Examples
The following example shows how to enable user authentication for the group policy named "FirstGroup":
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# user-authentication enableRelated Commands
user-authentication-idle-timeout
To set an idle timeout for individual users behind hardware clients, use the user-authentication-idle-timeout command in group-policy configuration mode. To delete the idle timeout value, use the no form of this command.
user-authentication-idle-timeout {minutes | none}
no user-authentication-idle-timeout
Syntax Description
Defaults
30 minutes.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
This option allows inheritance of an idle timeout value from another group policy. To prevent inheriting an idle timeout value, use the user-authentication-idle-timeout none command.
If there is no communication activity by a user behind a hardware client in the idle timeout period, the FWSM terminates the connection.
The minimum is 1 minute, the default is 30 minutes, and the maximum is 10,080 minutes.
Examples
The following example shows how to set an idle timeout value of 45 minutes for the group policy named "FirstGroup":
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# user-authentication-idle-timeout 45Related Commands
user-authentication
Requires users behind hardware clients to identify themselves to the FWSM before connecting.
username
To add a user to the FWSM local database, enter the username command in global configuration mode. To remove a user, use the no version of this command with the username you want to remove. To remove all usernames, use the no version of this command without appending a username.
username {name} {nopassword | password password [encrypted]} [privilege priv_level]}
no username [name]
Syntax Description
Defaults
The default privilege level is 2.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
1.1(1)
This command was introduced.
3.2(1)
This command was removed from the system execution space. The system now uses the admin context username database where applicable.
Usage Guidelines
The login command uses this database for authentication.
If you add users to the local database who can gain access to the CLI and whom you do not want to enter privileged mode, you should enable command authorization. (See the aaa authorization command command.) Without command authorization, users can access privileged EXEC mode (and all commands) at the CLI using their own password if their privilege level is 2 or greater (2 is the default). Alternatively, you can use AAA authentication so the user will not be able to use the login command, or you can set all local users to level 1 so you can control who can use the enable password to access privileged EXEC mode.
You cannot enter the username command in the system execution space. However, when you use the login command in system, or use Telnet authentication when you session to the FWSM from the switch, the FWSM uses the admin context username database (Telnet authentication for the system execution space is also configured in the admin context).
By default, VPN users that you add with this command have no attributes or group policy association. You must configure all values explicitly using the username attributes command.
Examples
The following example shows how to configure a user named "anyuser" with a password of 12345678 and a privilege level of 12:
hostname(config)#username anyuser password 12345678 privilege 12Related Commands
username attributes
To enter the username attributes mode, use the username attributes command in username configuration mode. To remove all attributes for a particular user, use the no form of this command and append the username. To remove all attributes for all users, use the no form of this command without appending a username. The attributes mode lets you configure AVPs for a specified user.
username {name} attributes
no username [name] attributes
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Username
•
—
•
—
—
Command History
Usage Guidelines
The internal user authentication database consists of the users entered with the username command. The login command uses this database for authentication.
The syntax of the commands in attributes mode have the following characteristics in common:
•
•
•
Examples
The following example shows how to enter username attributes configuration mode for a user named anyuser:
hostname(config)# username anyuser attributeshostname(config-username)#Related Commands
virtual http
To configure a virtual HTTP server, use the virtual http command in global configuration mode. To disable the virtual server, use the no form of this command.
virtual http ip_address [host hostname] [warning]
no virtual http ip_address [host hostname] [warning]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
1.1(1)
This command was introduced.
3.2(1)
The host keyword was added. Direct authentication with the FWSM was added.
Usage Guidelines
This command enables two functions:
•
This command redirects all HTTP connections that require AAA authentication to the virtual HTTP server on the FWSM. The FWSM prompts for the AAA server username and password. After the AAA server authenticates the user, the FWSM redirects the HTTP connection back to the original server, but it does not include the AAA server username and password. Because the username and password are not included in the HTTP packet, the HTTP server prompts the user separately for the HTTP server username and password.
Note
•
You must configure authentication for HTTP access to the virtual HTTP address as well as the other services you want to authenticate using the authentication match or aaa authentication include command.
When an unauthenticated user connects to the virtual HTTP IP address, the user is challenged for a username and password, and then authenticated by the AAA server. Once authenticated, the user can successfully access other services that require authentication.
To log out from the FWSM, reconnect to the virtual HTTP IP address; you are prompted to log out.
Note
To use Telnet or SSH instead of HTTP, use the virtual telnet or virtual ssh command.
Be sure to include the virtual HTTP address as a destination interface in the access list applied to the source interface.
For inbound users (from lower security to higher security), you must add a static command for the virtual HTTP IP address, even if NAT is not required (using the no nat-control command). An identity NAT command is typically used (where you translate the address to itself). For outbound users, a static statement is not required.
Examples
This example shows how to enable virtual HTTP for direct connection along with AAA authentication for other services:
hostname(config)# virtual http 209.165.202.129hostname(config)# access-list ACL-IN extended permit tcp any host 209.165.200.225 eq smtphostname(config)# access-list ACL-IN remark This is the SMTP server on the insidehostname(config)# access-list ACL-IN extended permit tcp any host 209.165.202.129 eq httphostname(config)# access-list ACL-IN remark This is the virtual HTTP addresshostname(config)# access-group ACL-IN in interface outsidehostname(config)# static (inside, outside) 209.165.202.129 209.165.202.129 netmask 255.255.255.255hostname(config)# access-list AUTH extended permit tcp any host 209.165.200.225 eq smtphostname(config)# access-list AUTH remark This is the SMTP server on the insidehostname(config)# access-list AUTH extended permit tcp any host 209.165.202.129 eq httphostname(config)# access-list AUTH remark This is the virtual HTTP addresshostname(config)# aaa authentication match AUTH outside tacacs+Related Commands
virtual ssh
To configure a virtual SSH server on the FWSM, use the virtual ssh command in global configuration mode. To disable the server, use the no form of this command. You might need to authenticate users with the virtual SSH server if you require authentication for types of traffic for which the FWSM does not supply an authentication prompt.
virtual ssh ip_address
no virtual ssh ip_address
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Although you can configure network access authentication for any protocol or service (see the aaa authentication match or aaa authentication include command), you can authenticate directly with HTTP, Telnet, or FTP only. A user must first authenticate with one of these services before other traffic that requires authentication is allowed through. If you do not want to allow HTTP, Telnet, or FTP through the FWSM, but want to authenticate other types of traffic, you can configure virtual SSH; the user connects using SSH to a given IP address configured on the FWSM, and the FWSM provides an SSH prompt.
When an unauthenticated user connects to the virtual SSH IP address, the user is challenged for a username and password, and then authenticated by the AAA server. Once authenticated, the user sees the message "Authentication Successful." Then, the user can successfully access other services that require authentication.
To log out from the FWSM, reconnect to the virtual SSH IP address; you are prompted to log out.
To use Telnet or HTTP instead of SSH, use the virtual telnet or virtual http command.
Examples
The following example shows how to enable virtual SSH along with AAA authentication for other services:
hostname(config)# access-list AUTH extended permit tcp 10.1.1.0 host 10.1.2.1 eq telnethostname(config)# access-list AUTH extended permit tcp 10.1.1.0 host 209.165.200.225 eq smtphostname(config)# aaa authentication match AUTH inside tacacs+hostname(config)# virtual ssh 10.1.2.1Related Commands
virtual telnet
To configure a virtual Telnet server on the FWSM, use the virtual telnet command in global configuration mode. You might need to authenticate users with the virtual Telnet server if you require authentication for other types of traffic for which the FWSM does not supply an authentication prompt. To disable the server, use the no form of this command.
virtual telnet ip_address
no virtual telnet ip_address
Syntax Description
ip_address
Sets the IP address for the virtual Telnet server on the FWSM. Make sure this address is an unused address that is routed to the FWSM.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Although you can configure network access authentication for any protocol or service (see the aaa authentication match or aaa authentication include command), you can authenticate directly with HTTP, Telnet, or FTP only. A user must first authenticate with one of these services before other traffic that requires authentication is allowed through. If you do not want to allow HTTP, Telnet, or FTP through the FWSM, but want to authenticate other types of traffic, you can configure virtual Telnet; the user Telnets to a given IP address configured on the FWSM, and the FWSM provides a Telnet prompt.
You must configure authentication for Telnet access to the virtual Telnet address as well as the other services you want to authenticate using the authentication match or aaa authentication include command.
When an unauthenticated user connects to the virtual Telnet IP address, the user is challenged for a username and password, and then authenticated by the AAA server. Once authenticated, the user sees the message "Authentication Successful." Then, the user can successfully access other services that require authentication.
Be sure to include the virtual Telnet address as a destination interface in the access list applied to the source interface.
For inbound users (from lower security to higher security), you must add a static command for the virtual Telnet IP address, even if NAT is not required (using the no nat-control command). An identity NAT command is typically used (where you translate the address to itself). For outbound users, a static statement is not required.
To logout from the FWSM, reconnect to the virtual Telnet IP address; you are prompted to log out.
To use SSH or HTTP instead of Telnet, use the virtual ssh or virtual http command.
Examples
This example shows how to enable virtual Telnet along with AAA authentication for other services:
hostname(config)# virtual telnet 209.165.202.129hostname(config)# access-list ACL-IN extended permit tcp any host 209.165.200.225 eq smtphostname(config)# access-list ACL-IN remark This is the SMTP server on the insidehostname(config)# access-list ACL-IN extended permit tcp any host 209.165.202.129 eq telnethostname(config)# access-list ACL-IN remark This is the virtual Telnet addresshostname(config)# access-group ACL-IN in interface outsidehostname(config)# static (inside, outside) 209.165.202.129 209.165.202.129 netmask 255.255.255.255hostname(config)# access-list AUTH extended permit tcp any host 209.165.200.225 eq smtphostname(config)# access-list AUTH remark This is the SMTP server on the insidehostname(config)# access-list AUTH extended permit tcp any host 209.165.202.129 eq telnethostname(config)# access-list AUTH remark This is the virtual Telnet addresshostname(config)# aaa authentication match AUTH outside tacacs+Related Commands
vpn-access-hours
To associate a group policy with a configured time-range policy, use the vpn-access-hours command in group-policy configuration mode or username configuration mode. To remove the attribute from the running configuration, use the no form of this command. This option allows inheritance of a time-range value from another group policy. To prevent inheriting a value, use the vpn-access-hours none command.
vpn-access hours value {time-range} | none
no vpn-access hours
Syntax Description
Defaults
Unrestricted.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
•
•
•
—
Username
•
•
•
•
—
Command History
Usage Guidelines
Examples
The following example shows how to associate the group policy named FirstGroup with a time-range policy called 824:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# vpn-access-hours 824Related Commands
time-range
Sets days of the week and hours of the day for access to the network, including start and end dates.
vpn-addr-assign
To specify a method for assigning IP addresses to remote access clients, use the vpn-addr-assign command in global configuration mode. To remove the attribute from the configuration, use the no form of this command. To remove all configured VPN address assignment methods from the FWSM, user the no form of this command without arguments.
vpn-addr-assign {aaa | dhcp | local}
no vpn-addr-assign [aaa | dhcp | local]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you choose DHCP, you must also use the dhcp-network-scope command to define the range of IP addresses that the DHCP server can use.
If you choose local, you must also use the ip-local-pool command to define the range of IP addresses to use. You then use the vpn-framed-ip-address and vpn-framed-netmask commands to assign IP addresses and netmasks to individual users.
If you choose AAA, you obtain IP addresses from either a previously configured RADIUS server.
Examples
The following example shows how to configure DHCP as the address assignment method:
hostname(config)#vpn-addr-assign dhcpRelated Commands
vpn-filter
To specify the name of the access list to use for VPN connections, use the vpn-filter command in group policy or username mode. To remove the access list, including a null value created by issuing the vpn-filter none command, use the no form of this command. The no option allows inheritance of a value from another group policy. To prevent inheriting values, use the vpn-filter none command.
You configure access lists to permit or deny various types of traffic for this user or group policy. You then use the vpn-filter command to apply those access lists.
vpn-filter {value acl_name | none}
no vpn-filter
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
•
•
•
—
Username
•
•
•
•
—
Command History
Usage Guidelines
WebVPN does not use the access list defined in the vpn-filter command.
Examples
The following example shows how to set a filter that invokes an access list named acl_vpn for the group policy named FirstGroup:
hostname(config)#group-policy FirstGroup attributeshostname(config-group-policy)#vpn-filter value acl_vpnRelated Commands
vpn-framed-ip-address
To specify the IP address to assign to a particular user, use the vpn-framed-ip-address command in username mode. To remove the IP address, use the no form of this command.
vpn-framed-ip-address {ip_address}
no vpn-framed-ip-address
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Username
•
•
•
•
—
Command History
Examples
The following example shows how to set an IP address of 10.92.166.7 for a user named anyuser:
hostname(config)#username anyuser attributeshostname(config-username)#vpn-framed-ip-address 10.92.166.7Related Commands
vpn-framed-ip-netmask
To specify the subnet mask to assign to a particular user, use the vpn-framed-ip-netmask command in username mode. To remove the subnet mask, use the no form of this command.
vpn-framed-ip-netmask {netmask}
no vpn-framed-ip-netmask
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Username attributes configuration
•
•
•
•
—
Command History
Examples
The following example shows how to set a subnet mask of 255.255.255. 254 for a user named anyuser:
hostname(config)#username anyuser attributeshostname(config-username)#vpn-framed-ip-netmask 255.255.255.254Related Commands
vpn-group-policy
To have a user inherit attributes from a configured group policy, use the vpn-group-policy command in username configuration mode. To remove a group policy from a user configuration, use the no version of this command. Using this command lets users inherit attributes that you have not configured at the username level.
vpn-group-policy {group-policy name}
no vpn-group-policy {group-policy name}
Syntax Description
Defaults
By default, VPN users have no group policy association.
Command Modes
The following table shows the modes in which you can enter the command:
Username attributes configuration
•
•
•
•
—
Command History
Usage Guidelines
You can override the value of an attribute in a group policy for a particular user by configuring it in username mode, if that attribute is available in username mode.
Examples
The following example shows how to configure a user named anyuser to use attributes from the group policy named FirstGroup:
hostname(config)#username anyuser attributeshostname(config-username)#vpn-group-policy FirstGroupRelated Commands
vpn-idle-timeout
To configure a user timeout period use the vpn-idle-timeout command in group-policy configuration mode or in username configuration mode. If there is no communication activity on the connection in this period, the FWSM terminates the connection.
To remove the attribute from the running configuration, use the no form of this command. This option allows inheritance of a time-out value from another group policy. To prevent inheriting a value, use the vpn-idle-timeout none command.
vpn-idle-timeout {minutes | none}
no vpn-idle-timeout
Syntax Description
Defaults
30 minutes.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
•
•
•
—
Username
•
•
•
•
—
Command History
Examples
The following example shows how to set a VPN idle timeout of 15 minutes for the group policy named "FirstGroup":
hostname(config)#group-policy FirstGroup attributeshostname(config-group-policy)#vpn-idle-timeout 30Related Commands
vpn-sessiondb logoff
To log off all or selected VPN sessions, use the vpn-sessiondb logoff command in global configuration mode.
vpn-sessiondb logoff {remote | l2l | email-proxy | protocol protocol-name | name username | ipaddress IPaddr | tunnel-group groupname | index indexnumber | all}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example shows how to log off all remote-access sessions:
hostname# vpn-sessiondb logoff remoteThe following example shows how to log off all IPSec sessions:
hostnamevpn-sessiondb logoff protocol IPSecvpn-sessiondb max-session-limit
To limit VPN sessions to a lower value than the FWSM allows, use the vpn-sessiondb max-session-limit command in global configuration mode. To remove the session limit, use the no form of this command. To overwrite the current setting, use the command again.
vpn-sessiondb max-session-limit {session-limit}
no vpn-sessiondb max-session-limit
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
This command applies to all types of VPN sessions, including WebVPN.
Examples
The following example shows how to set a maximum VPN session limit of 450:
hostname# vpn-sessiondb max-session-limit 450vpn-session-timeout
To configure a maximum amount of time allowed for VPN connections, use the vpn-session-timeout command in group-policy configuration mode or in username configuration mode. At the end of this period of time, the FWSM terminates the connection.
To remove the attribute from the running configuration, use the no form of this command. This option allows inheritance of a time-out value from another group policy. To prevent inheriting a value, use the vpn-session-timeout none command.
vpn-session-timeout {minutes | none}
no vpn-session-timeout
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
•
•
•
—
Username
•
•
•
•
—
Command History
Examples
The following example shows how to set a VPN session timeout of 180 minutes for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# vpn-session-timeout 180Related Commands
vpn-simultaneous-logins
To configure the number of simultaneous logins permitted for a user, use the vpn-simultaneous-logins command in group-policy configuration mode or username configuration mode. To remove the attribute from the running configuration, use the no form of this command. This option allows inheritance of a value from another group policy. Enter 0 to disable login and prevent user access.
vpn-simultaneous-logins {integer}
no vpn-simultaneous-logins
Syntax Description
Defaults
The default is 3 simultaneous logins.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
•
•
•
—
Username
•
•
•
•
—
Command History
Usage Guidelines
Enter 0 to disable login and prevent user access.
Examples
The following example shows how to allow a maximum of 4 simultaneous logins for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# vpn-simultaneous-logins 4vpn-tunnel-protocol
To configure a VPN tunnel type (IPSec), use the vpn-tunnel-protocol command in group-policy configuration mode or username configuration mode. To remove the attribute from the running configuration, use the no form of this command.
vpn-tunnel-protocol IPSec
no vpn-tunnel-protocol [IPSec]
Syntax Description
Defaults
IPSec.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
•
•
•
—
Username
•
•
•
•
—
Command History
Usage Guidelines
Use this command to configure one or more tunneling modes. You must configure at least one tunneling mode for users to connect over a VPN tunnel.
Examples
The following example shows how to configure IPSec tunneling modes for the group policy named "FirstGroup":
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# vpn-tunnel-protocol IPSecwho
To display active Telnet administration sessions on the FWSM, use the who command in privileged EXEC mode.
who [local_ip]
Syntax Description
local_ip
(Optional) Specifies to limit the listing to one internal IP address or network address, either IPv4 or IPv6.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The who command allows you to display the TTY_ID and IP address of each Telnet client that is currently logged into the FWSM.
Examples
The following example shows the output of the who command when a client is logged into the FWSM through a Telnet session:
hostname# who0: 100.0.0.2hostname# who 100.0.0.20: 100.0.0.2hostname#Related Commands
kill
Terminate a Telnet session.
telnet
Adds Telnet access to the FWSM console and sets the idle timeout.
wins-server
To set the IP address of the primary and secondary WINS servers, use the wins-server command in group-policy configuration mode. To remove the attribute from the running configuration, use the no form of this command. This option allows inheritance of a WINS server from another group policy. To prevent inheriting a server, use the wins-server none command.
wins-server value {ip_address} [ip_address] | none
no wins-server
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
Every time you issue the wins-server command you overwrite the existing setting. For example, if you configure WINS server x.x.x.x and then configure WINS server y.y.y.y, the second command overwrites the first, and y.y.y.y becomes the sole WINS server. The same holds true for multiple servers. To add a WINS server rather than overwrite previously configured servers, include the IP addresses of all WINS servers when you enter this command.
Examples
The following example shows how to configure WINS servers with the IP addresses 10.10.10.15, 10.10.10.30, and 10.10.10.45 for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# wins-server value 10.10.10.15 10.10.10.30 10.10.10.45write erase
To erase the startup configuration, use the write erase command in privileged EXEC mode. The running configuration remains intact.
write erase
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
This command is not supported within a security context. Context startup configurations are identified by the config-url command in the system configuration. If you want to delete a context configuration, you can remove the file manually from the remote server (if specified) or clear the file from Flash memory using the delete command in the system execution space.
Examples
The following example erases the startup configuration:
hostname# write eraseErase configuration in flash memory? [confirm] yRelated Commands
write memory
To save the running configuration to the startup configuration, use the write memory command in privileged EXEC mode.
write memory [all [/noconfirm]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
1.1(1)
This command was introduced.
3.1(1)
You can now save all context configurations with the all keyword.
Usage Guidelines
The running configuration is the configuration currently running in memory, including any changes you made at the command line. Changes are only preserved between reboots if you save them to the startup configuration, which is the configuration loaded into running memory at startup. The startup configuration for single context mode and for the system in multiple context mode is a hidden file. For multiple context mode, a context startup configuration is at the location specified by the config-url command in the system configuration.
In multiple context mode, you can enter the write memory command in each context to save the current context configuration. To save all context configurations, enter the write memory all command in the system execution space. Context startup configurations can reside on external servers. In this case, the FWSM saves the configuration back to the server specified by the config-url command, except for HTTP and HTTPS URLs, which do not allow you to save the configuration back to the server. After the FWSM saves each context with the write memory all command, the following message appears:
`Saving context `b' ... ( 1/3 contexts saved ) 'Sometimes, a context is not saved because of an error. See the following information for errors:
•
The context 'context a' could not be saved due to Unavailability of resources•
The context 'context a' could not be saved due to non-reachability of destination•
Unable to save the configuration for the following contexts as these contexts are locked.context `a' , context `x' , context `z' .A context is only locked if another user is already saving the configuration or in the process of deleting the context.
•
Unable to save the configuration for the following contexts as these contexts have read-only config-urls:context `a' , context `b' , context `c' .•
The context 'context a' could not be saved due to Unknown errorsBecause the system uses the admin context interfaces to access context startup configurations, the write memory command also uses the admin context interfaces. The write net command, however, uses the context interfaces to write a configuration to a TFTP server.
The write memory command is equivalent to the copy running-config startup-config command.
Examples
The following example saves the running configuration to the startup configuration:
hostname# write memoryBuilding configuration...Cryptochecksum: e43e0621 9772bebe b685e74f 748e445419319 bytes copied in 3.570 secs (6439 bytes/sec)[OK]hostname#Related Commands
write net
To save the running configuration to a TFTP server, use the write net command in privileged EXEC mode.
write net [server:[filename] | :filename]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The running configuration is the configuration currently running in memory, including any changes you made at the command line.
In multiple context mode, this command saves only the current configuration; you cannot save all contexts with a single command. You must enter this command separately for the system and for each context. The write net command uses the context interfaces to write a configuration to a TFTP server. The write memory command, however, uses the admin context interfaces to save to the startup configuration because the system uses the admin context interfaces to access context startup configurations.
The write net command is equivalent to the copy running-config tftp command.
Examples
The following example sets the TFTP server and filename in the tftp-server command:
hostname# tftp-server inside 10.1.1.1 /configs/contextbackup.cfghostname# write netThe following example sets the server and filename in the write net command. The tftp-server command is not populated.
hostname# write net 10.1.1.1:/configs/contextbackup.cfgThe following example sets the server and filename in the write net command. The tftp-server command supplies the directory name, and the server address is overridden.
hostname# tftp-server 10.1.1.1 configshostname# write net 10.1.2.1:context.cfgRelated Commands
write standby
To copy the FWSM or context running configuration to the failover standby unit, use the write standby command in privileged EXEC mode.
write standby
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
For Active/Standby failover, the write standby command writes the configuration stored in the RAM of the active failover unit to the RAM on the standby unit. Use the write standby command if the primary and secondary unit configurations have different information. Enter this command on the active unit.
For Active/Active failover, the write standby command behaves as follows:
•
•
Note
Examples
The following example writes the current running configuration to the standby unit:
hostname# write standbyBuilding configuration...[OK]hostname#Related Commands
write terminal
To show the running configuration on the terminal, use the write terminal command in privileged EXEC mode.
write terminal
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command is equivalent to the show running-config command.
Examples
The following example writes the running configuration to the terminal:
hostname# write terminal: Saved:ASA Version 7.0(0)61multicast-routingnamesname 10.10.4.200 outside!interface GigabitEthernet0/0nameif insidesecurity-level 100ip address 10.86.194.60 255.255.254.0webvpn enable...Related Commands
xlate-bypass
To disable NAT sessions for untranslated traffic, use the xlate-bypass command in global configuration mode. To disable xlate bypass, use the no form of this command.
xlate-bypass
no xlate-bypass
Syntax Description
This command has no arguments or keywords.
Defaults
Xlate bypass is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
By default, the FWSM creates NAT sessions for all connections even if you do not use NAT. For example, a session is created for each untranslated connection even if you do not enable NAT control, you use NAT exemption or identity NAT, or you use same security interfaces and do not configure NAT. Because there is a maximum number of NAT sessions (see the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide), these kinds of NAT sessions might cause you to run into the limit.
To avoid running into the limit, you can disable NAT sessions for untranslated traffic using the xlate-bypass command. If you disable NAT control and have untranslated traffic or use NAT exemption, or you enable NAT control (using the nat-control command) and use NAT exemption, then with xlate bypass, the FWSM does not create a session for these types of untranslated traffic. NAT sessions are still created in the following instances:
•
•
•
Examples
The following example enables xlate bypass:
hostname(config)# xlate-bypassRelated Commands
