- Cisco IOS Security Command Reference, Release 12.1
Table Of Contents
Index: Cisco IOS Security Command Reference, Release 12.1
Symbols A C D E F G H I K L M N O P Q R S T U Z
Symbols
A
AAA
aaa accounting command SR-70
aaa accounting connection h323 command SR-73
aaa accounting nested command SR-74
aaa accounting send stop-record authentication failure command SR-75
aaa accounting suppress null-username command SR-76
aaa accounting update command SR-77
aaa authentication arap command SR-4
aaa authentication banner command SR-6
aaa authentication enable default command SR-8
aaa authentication fail-message command SR-10
aaa authentication login command SR-12
aaa authentication nasi command SR-14
aaa authentication password-prompt command SR-16
aaa authentication ppp command SR-17
aaa authentication username-prompt command SR-19
aaa authorization command SR-56
aaa authorization config-commands command SR-60
aaa authorization reverse-access command SR-61
aaa dnis map accounting network group command SR-79
aaa dnis map authentication ppp group command SR-21
aaa group server command SR-117
aaa group server radius command SR-92
aaa nas-port extended command SR-93
aaa new-model command SR-23
aaa processes command SR-24
abbreviating commands
context-sensitive help viii, ix, xv
access-enable command SR-142
access-list (encryption) command SR-250
access lists
dynamic
temporary entries, clearing manually SR-142
See also IPSec
access-profile command SR-26
replace command form
(caution) SR-27
using per-user configuration
(caution) SR-27
access-template command SR-143
accounting (gatekeeper) command SR-83
accounting command SR-81
address command SR-432
addressed-key command SR-434
AESOs
attaching to interfaces SR-500
algorithms
encryption
See IKE, algorithms
hash
See IKE, algorithms
arap authentication command SR-29
using list-names
(caution) SR-29
authentication
CAs SR-406
See also IKE, authentication
authentication (IKE policy) command SR-436
authentication proxy
commands SR-229
authorization command SR-65
Auxiliary Extended Security Options
See AESOs
C
ca-identity mode
enabling SR-415
CAs
authenticating SR-406
CEP
support SR-428
enrolling SR-412
identity
deleting SR-415
LDAP
support SR-428
locations
specifying SR-427
public keys SR-406
URLs
specifying SR-427
See also Certification Authority Interoperability
cautions
access lists SR-254, SR-306, SR-315
access-profile command
replace command form (caution) SR-27
using per-user configuration (caution) SR-27
arap authentication command
using list-names (caution) SR-29
Cisco 7200 series router SR-293
crypto key zeroize dss command SR-293
DSS keys SR-292
enable password command
using encryption-type (caution) SR-472
enable secret command
using encryption-type (caution) SR-474
Java blocking SR-189
key config-key command
unrecoverable DES key (caution) SR-137
login authentication command
using list-names (caution) SR-35
nasi authentication command
using list-names (caution) SR-37
ppp authentication command
using list-names (caution) SR-40
service password-encryption command
security level (caution) SR-482
usage in text ix
CBAC
alert messages
enabling SR-178
application-layer protocols
configuring SR-189
audit trail messages
(example) SR-178
enabling SR-179
configurations
viewing SR-205
denial-of-service attacks
detection SR-199
disabling SR-204
fragment
inspection, configuring SR-191
H.323 inspection
configuring SR-189
half-open sessions
deleting, high threshold SR-182, SR-193
deleting, low threshold SR-184, SR-195
description SR-182
TCP threshold SR-199
inspection rules
applying SR-181
applying (example) SR-181
defining SR-186
removing SR-181
viewing SR-205
Java
blocking SR-187
blocking (caution) SR-189
inspection, configuring SR-189
RPC inspection
configuring SR-190
session information
(example) SR-205
viewing SR-205
SMTP inspection
configuring SR-190
TCP inspection
configuring SR-189
timeouts
DNS idle, specifying SR-180
FIN-exchange, specifying SR-197
overriding SR-190
synwait, specifying SR-201
TCP idle, specifying SR-198
UDP idle, specifying SR-202
UDP inspection
configuring SR-189
CCO
accessing x
definition x
CEP
specifying SR-428
certificate chain configuration mode
enabling SR-408
certificate command SR-402
certificate enrollment protocol
See CEP
certificates
accepting SR-404
adding SR-402
requesting SR-412
requests
resending, number of times SR-423
resending, wait period SR-425
retrieving SR-410
revoking SR-412
storing SR-410
viewing SR-429
Certification Authority Interoperability
CA authentication SR-406
CEP
specifying SR-428
challenge password SR-412
commands SR-401
LDAP support
specifying SR-428
NVRAM memory usage SR-410
See also CAs
See also certificates
See also CRLs
See also RSA keys
Cisco Connection Online
See CCO
Cisco IOS
saving configuration changes xviii
clear access-template command SR-145
clear crypto connection command SR-258
clear crypto isakmp command SR-438
clear crypto sa command SR-354
clear ip audit configuration command SR-210
clear ip audit statistics command SR-211
clear ip auth-proxy cache command SR-230
clear ip trigger-authentication command SR-31
clear kerberos creds command SR-126
command modes
summary (table) xiv
config-isakmp command mode
enabling SR-445
configuration, saving xviii
crl optional command SR-404
CRLs
certificates
accepting SR-404
revoking SR-411
checking SR-404
downloading SR-411
requesting SR-411
retrieving SR-410
storing SR-410
See also CAs
See also certificates
crypto algorithm 40-bit-des command
See crypto cisco algorithm 40-bit-des command
crypto algorithm des command
See crypto cisco algorithm des command
crypto ca authenticate command SR-406
crypto ca certificate chain command SR-408
crypto ca certificate query command SR-410
crypto ca crl request command SR-411
crypto ca enroll command SR-412
crypto ca identity command SR-415
crypto card clear-latch command SR-264
crypto card command SR-262
crypto cisco algorithm 40-bit-des command SR-266
crypto cisco algorithm des command SR-268
crypto cisco connections command
crypto cisco entities command SR-272
crypto cisco key-timeout command SR-274
crypto cisco pregen-dh-pairs command SR-275
crypto clear-latch command
See crypto card clear-latch command
crypto dynamic-map command SR-356
crypto esa command
See crypto card command
crypto gen-signature-keys command
See crypto key generate dss command
crypto ipsec security-association lifetime command SR-359
crypto ipsec transform-set command SR-361
crypto isakmp enable command SR-440
crypto isakmp identity command SR-441
crypto isakmp key command SR-443
crypto isakmp policy command SR-445
crypto key-exchange command
See crypto key exchange dss command
crypto key exchange dss command SR-281
crypto key exchange dss passive command SR-283
crypto key-exchange passive command
See crypto key exchange dss passive command
crypto key generate dss command SR-286
crypto key generate rsa (CA) command SR-417
crypto key generate rsa (IKE) command SR-447
crypto key pubkey-chain dss command SR-289
crypto key pubkey-chain rsa command SR-450
crypto key-timeout command
See crypto cisco key-timeout command
crypto key zeroize dss command SR-292
crypto key zeroize rsa command SR-420
crypto map (CET global) command SR-294
crypto map (CET interface) command SR-297
crypto map (IPSec global) command SR-365
crypto map (IPSec interface) command SR-370
crypto map local-address command SR-372
crypto pregen-dh-pairs command
See crypto cisco pregen-dh-pairs command
crypto public-key command
See crypto key pubkey-chain dss command
crypto sdu connections command
See crypto cisco connections command
crypto sdu entities command
See crypto cisco entities command
crypto transform configuration mode
enabling SR-363
crypto zeroize command
See crypto key zeroize dss command
D
default form of a command
using xvii
deny (CET) command SR-303
Diffie-Hellman
See IKE, DH
DNS idle timeout
specifying SR-180
DNSIX
collection center, specifying SR-493
enabling SR-496
hosts that receive messages
alternate SR-495
primary SR-494
number of records in a packet, specifying SR-497
retransmit count SR-492
dnsix-dmdp retries command SR-492
dnsix-nat authorized-redirection command SR-493
dnsix-nat primary command SR-494
dnsix-nat secondary command SR-495
dnsix-nat source command SR-496
dnsix-nat transmit-count command SR-497
E
enable password command SR-472
using encryption-type
(caution) SR-472
enable secret command SR-474
using encryption-type
(caution) SR-474
encryption algorithm
See IKE, algorithms
encryption (IKE policy) command SR-453
enrollment mode ra command SR-422
enrollment retry-count command SR-423
enrollment retry-period command SR-425
enrollment url command SR-427
evaluate command SR-148
examples
CBAC
audit trail messages SR-178
half-open sessions, high threshold SR-182, SR-193
half-open sessions, low threshold SR-184, SR-195
half-open sessions, TCP threshold SR-200
session information, viewing SR-205
timeouts, synwait SR-201
timeouts, UDP idle SR-203
pre-shared keys
specifying SR-444
F
FIN-exchange timeout
specifying SR-197
G
gatekeeper
security, enabling SR-83
global configuration commands
aaa accounting SR-70
aaa accounting connection h323 command SR-73
aaa accounting nested SR-74
aaa accounting send stop-record authentication failure command SR-75
aaa accounting suppress null-username SR-76
aaa accounting update SR-77
aaa authentication arap SR-4
aaa authentication banner SR-6
aaa authentication enable default SR-8
aaa authentication fail-message SR-10
aaa authentication login SR-12
aaa authentication nasi SR-14
aaa authentication password-prompt SR-16
aaa authentication ppp SR-17
aaa authentication username-prompt SR-19
aaa authorization SR-56
aaa authorization config-commands SR-60
aaa authorization reverse-access SR-61
aaa dnis map accounting network group SR-79
aaa dnis map authentication ppp group SR-21
aaa group server SR-117
aaa group server radius command SR-92
aaa nas-port extended SR-93
aaa new-model SR-23
aaa processes SR-24
ip radius source-interface SR-95
ip tacacs source-interface SR-118
ip trigger-authentication (global) SR-32
kerberos clients mandatory SR-127
kerberos credentials forward SR-128
kerberos instance map SR-129
kerberos local-realm SR-130
kerberos preauth SR-131
kerberos realm SR-132
kerberos server SR-133
kerberos srvtab entry SR-134
kerberos srvtab remote SR-136
key config-key SR-137
radius-server attribute nas-port extended SR-97
radius-server configure-nas SR-98
radius-server deadtime SR-99
radius-server host SR-101
radius-server host non-standard SR-104
radius-server key SR-105
radius-server optional passwords SR-107
radius-server retransmit SR-108
radius-server timeout SR-109
radius-server vsa SR-110
tacacs-server directed-request SR-121
tacacs-server host SR-122
tacacs-server key SR-124
global configuration mode
summary xiv
group (IKE policy) command SR-454
H
hash (IKE policy) command SR-455
hash algorithm
See IKE, algorithms
I
IKE
algorithms
encryption, specifying SR-453
hash, specifying SR-455
authentication
methods, specifying SR-436
commands SR-431
connections
clearing SR-438
DH
group identifier, specifying SR-454
disabling SR-440
enabling SR-440
group identifier
specifying SR-454
keys
See keys, pre-shared
negotiations
states SR-464
policies
multiple SR-445
parameters, specifying SR-445
parameters, viewing SR-462
viewing SR-462
requirements
IPSec peers SR-440
See also IPSec
See also SAs
interface configuration commands
ip trigger-authentication (interface) SR-34
ppp accounting SR-84
ppp authentication SR-39
ppp chap hostname SR-41
ppp chap password SR-43
ppp chap refuse SR-45
ppp chap wait SR-47
ppp pap sent-username SR-49
interface configuration mode
summary xiv
Internet Key Exchange Security Protocol
See IKE
IP
See also IPSO
ip access-list extended (encryption) command SR-308
ip audit attack command SR-213
ip audit command SR-212
ip audit info command SR-214
ip audit name command SR-215
ip audit notify command SR-217
ip audit po local command SR-218
ip audit po max-events command SR-219
ip audit po protected command SR-220
ip audit po remote command SR-221
ip audit signature command SR-223
ip audit smtp command SR-224
ip auth-proxy auth-cache-time command SR-232
ip auth-proxy auth-proxy-banner command SR-233
ip auth-proxy command SR-231
ip auth-proxy name command SR-234
ip inspect (interface configuration) command SR-181
ip inspect alert-off command SR-178
ip inspect audit trail command SR-179
ip inspect dns-timeout command SR-180
ip inspect max-incomplete high command SR-182
ip inspect max-incomplete low command SR-184
ip inspect name command SR-186
ip inspect one-minute high command SR-193
ip inspect one-minute low command SR-195
ip inspect tcp finwait-time command SR-197
ip inspect tcp idle-time command SR-198
ip inspect tcp max-incomplete host command SR-199
ip inspect tcp synwait-time command SR-201
ip inspect udp idle-time command SR-202
ip port-map command SR-240
ip radius source-interface command SR-95
ip reflexive-list timeout command SR-150
IPSec
commands SR-353
crypto access lists
crypto map entries
lifetime values, overriding SR-384
specifying a peer SR-378
crypto maps
applying SR-370
dynamic, creating SR-356
dynamic, priorities SR-367
dynamic, viewing SR-392
interfaces, identifying SR-372
purpose SR-366
viewing SR-398
lifetimes
viewing SR-396
requirements
IKE SR-440
SAs
clearing SR-354
lifetimes, changing SR-359
requesting SR-382
viewing SR-393
session keys
manually specifying SR-387
transforms
allowed combinations SR-362
changing SR-363
selecting SR-363
transform sets
defining SR-361
mode, changing SR-376
specifying SR-390
viewing SR-397
ip security add command SR-498
ip security aeso command SR-500
ip security allow-reserved command SR-515
ip security dedicated command SR-501
ip security eso-info command SR-503
ip security eso-max command SR-504
ip security eso-min command SR-506
ip security extended-allowed command SR-508
ip security first command SR-509
ip security ignore-authorities command SR-510
ip security implicit-labelling command SR-511
ip security multilevel command SR-513
IP security option
See IPSO
ip security strip command SR-517
IPSO
authorities and bit patterns
(table) SR-502
definition SR-502
basic
configuring SR-498
extended
configuring SR-500
defaults SR-503
maximum sensitivity levels SR-504
minimum sensitivity levels SR-506
labels
definition SR-502
levels and bit patterns
(table) SR-501
definition SR-501
ip tacacs source-interface command SR-118
ip tcp intercept connection-timeout command SR-158
ip tcp intercept drop-mode command SR-159
ip tcp intercept finrst-timeout command SR-161
ip tcp intercept list command SR-162
ip tcp intercept max-incomplete high command SR-163
ip tcp intercept max-incomplete low command SR-165
ip tcp intercept mode command SR-167
ip tcp intercept one-minute high command SR-168
ip tcp intercept one-minute low command SR-170
ip tcp intercept watch-timeout command SR-172
ip trigger-authentication (global) command SR-32
ip trigger-authentication (interface) command SR-34
ip verify unicast reverse-path command SR-520
ISAKMP
See also IKE
K
kerberos clients mandatory command SR-127
kerberos crednetials forward command SR-128
kerberos instance map command SR-129
kerberos local-realm command SR-130
kerberos preauth command SR-131
kerberos realm command SR-132
kerberos server command SR-133
kerberos srvtab entry command SR-134
kerberos srvtab remote command SR-136
key config-key command SR-137
unrecoverable DES key
(caution) SR-137
keys
pre-shared
deleting SR-443
specifying SR-443
specifying (example) SR-444
key-string (IKE) command SR-456
L
LDAP protocol support
specifying SR-428
lifetime (IKE policy) command SR-458
line configuration commands
accounting SR-81
arap authentication SR-29
authorization SR-65
login authentication SR-35
nasi authentication SR-37
timeout login response SR-54
lock-and-key
idle timeouts SR-142
temporary entries
clearing manually SR-142, SR-145
creating manually SR-143
enabling SR-142
login authentication command SR-35
using list-names
(caution) SR-35
M
match address (CET) command SR-310
match address (IPSec) command SR-374
memory usage
Certification Authority Interoperability SR-410
mode (IPSec) command SR-376
modes
ca-identity
enabling SR-415
certificate chain configuration
enabling SR-408
query
enabling SR-410
RA
enabling SR-422
See command modes
N
named-key command SR-460
nasi authentication command SR-37
using list-names
(caution) SR-37
no form of a command
using xvii
no ip inspect command SR-204
notes
usage in text ix
O
Oakley key exchange protocol
See also IKE
online documentation
See CCO
P
PAM
commands SR-239
password command SR-476
perfect forward secrecy
See PFS
permit (reflexive) command SR-152
permit command SR-312
PFS
specifying SR-380
PKI protocol
See CEP
ppp accounting command SR-84
ppp authentication command
using list-names
(caution) SR-40
ppp chap hostname command SR-41
ppp chap password command SR-43
ppp chap refuse command SR-45
ppp chap wait command SR-47
ppp pap sent-username command SR-49
privileged EXEC commands
access-enable command SR-142
clear ip trigger-authentication SR-31
clear kerberos creds SR-126
show accounting SR-85
show ip trigger-authentication SR-51
show kerberos creds SR-138
show ppp queues SR-52
privileged EXEC mode
summary xiv
privilege level (global) command SR-477
privilege level (line) command SR-480
prompts
system xiv
public key configuration mode
Q
query mode
enabling SR-410
query url command SR-428
question command xv
R
radius-server attribute nas-port extended command SR-97
radius-server configure-nas command SR-98
radius-server deadtime command SR-99
radius-server host command SR-101
radius-server host non-standard command SR-104
radius-server key command SR-105
radius-server optional passwords command SR-107
radius-server retransmit command SR-108
radius-server timeout command SR-109
radius-server vsa send command SR-110
RA mode
enabling SR-422
RAs
enabling SR-422
Reflexive Access Lists
configuring
temporary entries
characteristics SR-154
timeouts, global
(examples) SR-150
ROM monitor mode
summary xiv
RPC inspection
See CBAC, RPC inspection
RSA encrypted nonces
requirements SR-436
RSA keys
deleting SR-420
general purpose keys SR-418, SR-448
sample times required SR-418, SR-448
IP address
specifying SR-432
manually specifying SR-450
public key record SR-406
remote peer
specifying SR-456
special usage keys SR-417, SR-447
generating SR-447
specifying SR-434
RSA signatures
requirements SR-436
S
SAs
lifetimes
configuring SR-458
parameters SR-445
viewing SR-464
saving configuration changes xviii
security
H.323 gatekeeper, enabling SR-83
See also IPSO
See also lock-and-key
security associations
See SAs
server (RADIUS) command SR-112
server (TACACS+) command SR-120
server hosts
RADIUS SR-92
TACACS+ SR-117
service password-encryption command SR-482
security level
(caution) SR-482
set algorithm 40-bit-des command SR-317
set algorithm des command SR-319
set peer (CET) command SR-321
set peer (IPSec) command SR-378
set peer command SR-378
set pfs command SR-380
set security-association level per-host command SR-382
set security-association lifetime command SR-384
set session-key command SR-387
set transform-set command SR-390
show accounting command SR-85
show crypto algorithms command
See show crypto cisco algorithms command
show crypto ca certificates command SR-429
show crypto card command SR-323
show crypto cisco algorithms command SR-325
show crypto cisco connections command SR-326
show crypto cisco key-timeout command SR-328
show crypto cisco pregen-dh-pairs command SR-329
show crypto connections command
See show crypto cisco connections command
show crypto dynamic- map command SR-392
show crypto engine brief command SR-332
show crypto engine configuration command SR-334
show crypto engine connections active command SR-336
show crypto engine connections dropped-packets command SR-338
show crypto ipsec sa command SR-393, SR-396
show crypto ipsec security-association lifetime command SR-396
show crypto ipsec transform-set command SR-397
show crypto isakmp policy command SR-462
show crypto isakmp sa command SR-464
show crypto key mypubkey dss command SR-339
show crypto key mypubkey rsa command SR-466
show crypto key pubkey-chain dss command SR-340
show crypto key pubkey-chain rsa command SR-467
show crypto key-timeout command
See show crypto cisco key-timeout command
show crypto map (CET) command SR-343
show crypto map (IPSec) command SR-398
show crypto mypubkey command
See show crypto key mypubkey command
show crypto pregen-dh-pairs command
See show crypto cisco pregen-dh-pairs command
show crypto pubkey command
See show crypto key pubkey-chain dss command
show crypto pubkey name command
See show crypto key pubkey-chain dss name command
show crypto pubkey serial command
See show crypto key pubkey-chain dss serial command
show dnsix command SR-518
show ip audit configuration command SR-225
show ip audit interface command SR-226
show ip audit statistics command SR-227
show ip auth-proxy command SR-236
show ip inspect command SR-205
show ip port-map command SR-244
show ip trigger-authentication command SR-51
show kerberos creds command SR-138
show ppp queues command SR-52
show privilege command SR-484
show tcp intercept connections command SR-173
show tcp intercept statistics command SR-175
Skeme key exchange protocol
See also IKE
subinterface configuration mode
summary xiv
T
Tab key
command completion xv
TACACS+
command comparison
(table) SR-115
server hosts SR-117
tacacs-server directed request command SR-121
tacacs-server host command SR-122
tacacs-server key command SR-124
TCP idle timeout
specifying SR-198
TCP Intercept
enabling SR-162
modes
intercept mode SR-167
watch mode SR-167
timeouts SR-161
test crypto initiate-session command SR-351
thresholds
See also CBAC, thresholds
timeout intervals
See also CBAC, timeouts
timeout login response command SR-54
transport mode SR-377
tunnel mode SR-376
U
UDP idle timeout
specifying SR-202
Unicast RPF
commands SR-520
user EXEC commands
access-profile SR-26
user EXEC mode
summary xiv
username command SR-485
Z
access lists
See also IPSec