-
Cisco IOS Security Command Reference, Release 12.3
-
Introduction
-
Security Commands: aaa accounting through access-template
-
Security Commands: accounting through crypto ca trustpoint
-
Security Commands: crypto dynamic-map through ctype
-
Security Commands: D through ip audit smtp spam
-
Security Commands: ip auth-proxy through ip tcp intercept
-
Security Commands: ip trigger-authentication through pool
-
Security Commands: ppp accounting through radius-server vsa send
-
Security Commands: reverse-route through show crypto isakmp sa
-
Security Commands: show crypto key mypubkey through wins
-
Table Of Contents
show crypto key pubkey-chain rsa
show crypto mib ipsec flowmib history failure size
show crypto mib ipsec flowmib history tunnel size
show crypto mib ipsec flowmib version
show ip trigger-authentication
show tcp intercept connections
snmp-server enable traps ipsec
snmp-server enable traps isakmp
tacacs-server directed-request
tacacs-server dns-alias-lookup
show crypto key mypubkey rsa
To display the RSA public keys of your router, use the show crypto key mypubkey rsa command in privileged EXEC mode.
show crypto key mypubkey rsa
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command displays the RSA public keys of your router.
Note
Secure Shell (SSH) may generate an additional RSA keypair if you generate a keypair on a router having no RSA keys. The additional keypair is used only by SSH and will have a name such as {router_FQDN}.server. For example, if a router name is "router1.cisco.com," the keyname is "router1.cisco.com.server."
Examples
The following is sample output from the show crypto key mypubkey rsa command. Special usage RSA keys were previously generated for this router using the crypto key generate rsa command.
% Key pair was generated at: 06:07:49 UTC Jan 13 1996Key name: myrouter.example.comUsage: Signature KeyKey Data:005C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB2204AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001% Key pair was generated at: 06:07:50 UTC Jan 13 1996Key name: myrouter.example.comUsage: Encryption KeyKey Data:00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D518242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21The following example shows how to encrypt the RSA key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the RSA key is encrypted (protected) and unlocked.
Router(config)# crypto key encrypt rsa name pki1-72a.cisco.com passphrase cisco1234Router(config)# exitRouter# show crypto key mypubkey rsa% Key pair was generated at:00:15:32 GMT Jun 25 2003
Key name:pki1-72a.cisco.com
Usage:General Purpose Key
*** The key is protected and UNLOCKED. ***
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E0CC9A 1D23B52C
CD00910C ABD392AE BA6D0E3F FC47A0EF 8AFEE340 0EC1E62B D40E7DCC
23C4D09E
03018B98 E0C07B42 3CFD1A32 2A3A13C0 1FF919C5 8DE9565F 1F020301 0001
% Key pair was generated at:00:15:33 GMT Jun 25 2003
Key name:pki1-72a.cisco.com.server
Usage:Encryption Key
Key is exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00D3491E 2A21D383
854D7DA8 58AFBDAC 4E11A7DD E6C40AC6 66473A9F 0C845120 7C0C6EC8 1FFF5757
3A41CE04 FDCB40A4 B9C68B4F BC7D624B 470339A3 DE739D3E F7DDB549 91CD4DA4
DF190D26 7033958C 8A61787B D40D28B8 29BCD0ED 4E6275C0 6D020301 0001
Router#The following example shows how to lock the key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the key is protected (encrypted) and locked.
Router# crypto key lock rsa name pki1-72a.cisco.com passphrase cisco1234!Router# show crypto key mypubkey rsa% Key pair was generated at:20:29:41 GMT Jun 20 2003Key name:pki1-72a.cisco.comUsage:General Purpose Key*** The key is protected and LOCKED. ***Key is exportable.Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D7808D C5FF14AC0D2B55AC 5D199F2F 7CB4B355 C555E07B 6D0DECBE 4519B1F0 75B12D6F 902D6E9FB6FDAD8D 654EF851 5701D5D7 EDA047ED 9A2A619D 5639DF18 EB020301 0001Related Commands
crypto key encrypt rsa
Encrypts the RSA private key.
crypto key generate rsa (IKE)
Generates RSA key pairs.
crypto key lock rsa
Locks the RSA private key in a router.
show crypto key pubkey-chain rsa
To display the RSA public keys of the peer that are stored on your router, use the show crypto key pubkey-chain rsa command in EXEC mode.
show crypto key pubkey-chain rsa [name key-name | address key-address]
Syntax Description
name key-name
(Optional) The name of a particular public key to view.
address key-address
(Optional) The address of a particular public key to view.
Command Modes
EXEC
Command History
Usage Guidelines
This command shows RSA public keys stored on your router. This includes peers' RSA public keys manually configured at your router and keys received by your router via other means (such as by a certificate, if certification authority support is configured).
If a router reboots, any public key derived by certificates will be lost. This is because the router will ask for certificates again, at which time the public key will be derived again.
Use the name or address keywords to display details about a particular RSA public key stored on your router.
If no keywords are used, this command displays a list of all RSA public keys stored on your router.
Examples
The following is sample output from the show crypto key pubkey-chain rsa command:
Router# show crypto key pubkey-chain rsaCodes: M - Manually Configured, C - Extracted from certificateCode Usage IP-address NameM Signature 10.0.0.l myrouter.example.comM Encryption 10.0.0.1 myrouter.example.comC Signature 172.16.0.1 routerA.example.comC Encryption 172.16.0.1 routerA.example.comC General 192.168.10.3 routerB.domain1.comThis sample shows manually configured special usage RSA public keys for the peer "somerouter." This sample also shows three keys obtained from peers' certificates: special usage keys for peer "routerA" and a general purpose key for peer "routerB."
Certificate support is used in the above example; if certificate support was not in use, none of the peers' keys would show "C" in the code column, but would all have to be manually configured.
The following is sample output when you issue the command show crypto key pubkey rsa name somerouter.example.com:
Router# show crypto key pubkey rsa name somerouter.example.comKey name: somerouter.example.comKey address: 10.0.0.1Usage: Signature KeySource: ManualData:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB2204AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001Key name: somerouter.example.comKey address: 10.0.0.1Usage: Encryption KeySource: ManualData:00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D518242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21
Note
The following is sample output when you issue the command show crypto key pubkey rsa address 192.168.10.3:
Router# show crypto key pubkey rsa address 192.168.10.3Key name: routerB.example.comKey address: 192.168.10.3Usage: General Purpose KeySource: CertificateData:0738BC7A 2BC3E9F0 679B00FE 53987BCC 01030201 42DD06AF E228D24C 458AD22858BB5DDD F4836401 2A2D7163 219F882E 64CE69D4 B583748A 241BED0F 6E7F2F160DE0986E DF02031F 4B0B0912 F68200C4 C625C389 0BFF3321 A2598935 C1B1The Source field in the above example indicates "Certificate," meaning that the keys were received by the router by way of the other router's certificate.
show crypto map (IPSec)
To display the crypto map configuration, use the show crypto map command in EXEC mode.
show crypto map [interface interface | tag map-name]
Syntax Description
interface interface
(Optional) Displays only the crypto map set applied to the specified interface.
tag map-name
(Optional) Displays only the crypto map set with the specified map-name.
Command Modes
EXEC
Command History
Examples
The following is sample output for the show crypto map command:
Router# show crypto mapCrypto Map "crypmap" 1 ipsec-isakmpPeer = 172.1.1.1ISAKMP Profile: vpn1Extended IP access list 101access-list 101 permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255access-list 101 permit ip host 192.168.1.1 host 10.2.1.1access-list 101 permit ip 10.3.0.0 0.0.255.255 10.2.0.0 0.0.255.255Current peer: 172.16.1.1Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={vpn1,The following configuration was in effect when the above show crypto map command was issued:
crypto map crypmap 1 ipsec-isakmpset peer 172.16.1.1set transform-set vpn1set isakmp-profile vpn1match address 101Table 32 describes significant fields in the display.
Table 32 show crypto map Field Descriptions
ISAKMP Profile
The Internet Security Association and Key Management Protocol (ISAKMP) profile that is configured on the crypto map entry.
show crypto mib ipsec flowmib history failure size
To display the size of the IP Security (IPSec) failure history table, use the show crypto mib ipsec flowmib history failure size command in privileged EXEC mode.
show crypto mib ipsec flowmib history failure size
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.1(4)E
This command was introduced.
12.2(4)T
This command was integrated into Cisco IOS Release 12.2(4)T.
Examples
The following is sample output from the show crypto mib ipsec flowmib history failure size command:
Router# show crypto mib ipsec flowmib history failure sizeIPSec Failure Window size: 140Related Commands
show crypto mib ipsec flowmib history tunnel size
To display the size of the IP Security (IPSec) tunnel history table, use the show crypto mib ipsec flowmib history tunnel size command in privileged EXEC mode.
show crypto mib ipsec flowmib history tunnel size
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.1(4)E
This command was introduced.
12.2(4)T
This command was integrated into Cisco IOS Release 12.2(4)T.
Examples
The following is sample output from the show crypto mib ipsec flowmib history tunnel size command:
Router# show crypto mib ipsec flowmib history tunnel sizeIPSec History Window Size: 130Related Commands
show crypto mib ipsec flowmib version
To display the IP Security (IPSec) MIB version used by the router, use the show crypto mib ipsec flowmib version command in privileged EXEC mode.
show crypto mib ipsec flowmib version
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.1(4)E
This command was introduced.
12.2(4)T
This command was integrated into Cisco IOS Release 12.2(4)T.
Usage Guidelines
Use the show crypto mib ipsec flowmib version command to display the MIB version used by the management applications to identify the feature set.
Note
Examples
The following is sample output from the show crypto mib ipsec flowmib version command:
Router# show crypto mib ipsec flowmib versionIPSec Flow MIB version: 1Related Commands
show dnsix
To display state information and the current configuration of the DNSIX audit writing module, use the show dnsix command in privileged EXEC mode.
show dnsix
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following is sample output from the show dnsix command:
Router# show dnsixAudit Trail Enabled with Source 192.168.2.5State: PRIMARYConnected to 192.168.2.4Primary 192.168.2.4Transmit Count 1DMDP retries 4Authorization Redirection List:192.168.2.4Record count: 0Packet Count: 0Redirect Rcv: 0
show ip audit configuration
To display additional configuration information, including default values that may not be displayed using the show running-config command, use the show ip audit configuration command in EXEC mode.
show ip audit configuration
Syntax Description
This command has no argument or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show ip audit configuration EXEC command to display additional configuration information, including default values that may not be displayed using the show running-config command.
Examples
The following example displays the output of the show ip audit configuration command:
Event notification through syslog is enabledEvent notification through Net Director is enabledDefault action(s) for info signatures is alarmDefault action(s) for attack signatures is alarmDefault threshold of recipients for spam signature is 25PostOffice:HostID:5 OrgID:100 Addr:10.2.7.3 Msg dropped:0HID:1000 OID:100 S:218 A:3 H:14092 HA:7118 DA:0 R:0CID:1 IP:172.21.160.20 P:45000 S:ESTAB (Curr Conn)Audit Rule ConfigurationAudit name AUDIT.1info actions alarmRelated Commands
clear ip audit statistics
Resets statistics on packets analyzed and alarms sent.
show ip audit interface
To display the interface configuration, use the show ip audit interface command in EXEC mode.
show ip audit interface
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show ip audit interface EXEC command to display the interface configuration.
Examples
The following example displays the output of the show ip audit interface command:
Interface ConfigurationInterface Ethernet0Inbound IDS audit rule is AUDIT.1info actions alarmOutgoing IDS audit rule is not setInterface Ethernet1Inbound IDS audit rule is AUDIT.1info actions alarmOutgoing IDS audit rule is AUDIT.1info actions alarmshow ip audit statistics
To display the number of packets audited and the number of alarms sent, among other information, use the show ip audit statistics command in EXEC mode.
show ip audit statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show ip audit statistics EXEC command to display the number of packets audited and the number of alarms sent, among other information.
Examples
The following displays the output of the show ip audit statistics command:
Signature audit statistics [process switch:fast switch]signature 2000 packets audited: [0:2]signature 2001 packets audited: [9:9]signature 2004 packets audited: [0:2]signature 3151 packets audited: [0:12]Interfaces configured for audit 2Session creations since subsystem startup or last reset 11Current session counts (estab/half-open/terminating) [0:0:0]Maxever session counts (estab/half-open/terminating) [2:1:0]Last session created 19:18:27Last statistic reset neverHID:1000 OID:100 S:218 A:3 H:14085 HA:7114 DA:0 R:0Related Commands
clear ip audit statistics
Resets statistics on packets analyzed and alarms sent.
show ip auth-proxy
To display the authentication proxy entries or the running authentication proxy configuration, use the show ip auth-proxy command in privileged EXEC mode.
show ip auth-proxy {cache | configuration}
Syntax Description
cache
Displays the current list of the authentication proxy entries.
configuration
Displays the running authentication proxy configuration.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show ip auth-proxy to display either the authentication proxy entries or the running authentication proxy configuration. Use the cache keyword to list the host IP address, the source port number, the timeout value for the authentication proxy, and the state for connections using authentication proxy. If authentication proxy state is HTTP_ESTAB, the user authentication was successful.
Use the configuration keyword to display all authentication proxy rules configured on the router.
Examples
The following example shows sample output from the show ip auth-proxy cache command after one user authentication using the authentication proxy:
Router# show ip auth-proxy cacheAuthentication Proxy CacheClient IP 192.168.25.215 Port 57882, timeout 1, state HTTP_ESTABThe following example shows how the show ip auth-proxy configuration command displays the information about the authentication proxy rule pxy. The global idle timeout value is 60 minutes. The idle timeouts value for this named rule is 30 minutes. No host list is specified in the rule, meaning that all connection initiating HTTP traffic at the interface is subject to the authentication proxy rule.
Router# show ip auth-proxy configurationAuthentication cache time is 60 minutesAuthentication Proxy Rule ConfigurationAuth-proxy name pxyhttp list not specified auth-cache-time 30 minutesRelated Commands
show ip inspect
To display Context-based Access Control (CBAC) configuration and session information, use the show ip inspect command in privileged EXEC mode.
show ip inspect {name inspection-name | config | interfaces | session [detail] | all}
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use this command to view the CBAC configuration and session information.
Examples
The following example shows sample output for the show ip inspect name myinspectionrule command, where the inspection rule "myinspectionrule" is configured:
Inspection Rule ConfigurationInspection name myinspectionruletcp timeout 3600udp timeout 30ftp timeout 3600The output shows the protocols that should be inspected by CBAC and the corresponding idle timeouts for each protocol.
The following is sample output for the show ip inspect config command:
Session audit trail is disabledone-minute (sampling period) thresholds are [400:500] connectionsmax-incomplete sessions thresholds are [400:500]max-incomplete tcp connections per host is 50. Block-time 0 minute.tcp synwait-time is 30 sec -- tcp finwait-time is 5 sectcp idle-time is 3600 sec -- udp idle-time is 30 secdns-timeout is 5 secInspection Rule ConfigurationInspection name myinspectionruletcp timeout 3600udp timeout 30ftp timeout 3600The output shows CBAC configuration, including global timeouts, thresholds, and inspection rules.
The following is sample output for the show ip inspect interfaces command:
Interface ConfigurationInterface Ethernet0Inbound inspection rule is myinspectionruletcp timeout 3600udp timeout 30ftp timeout 3600Outgoing inspection rule is not setInbound access list is not setOutgoing access list is not setThe following is sample output for the show ip inspect sessions command:
Established SessionsSession 25A3318 (10.0.0.1:20)=>(10.1.0.1:46068) ftp-data SIS_OPENSession 25A6E1C (10.1.0.1:46065)=>(10.0.0.1:21) ftp SIS_OPENThe output shows the source and destination addresses and port numbers (separated by colons), and it indicates that the session is an FTP session.
The following is sample output for the show ip inspect sessions detail command:
Established SessionsSession 25A335C (40.0.0.1:20)=>(30.0.0.1:46069) ftp-data SIS_OPENCreated 00:00:07, Last heard 00:00:00Bytes sent (initiator:responder) [0:3416064] acl created 1Inbound access-list 111 applied to interface Ethernet1Session 25A6E1C (30.0.0.1:46065)=>(40.0.0.1:21) ftp SIS_OPENCreated 00:01:34, Last heard 00:00:07Bytes sent (initiator:responder) [196:616] acl created 1Inbound access-list 111 applied to interface Ethernet1The output includes times, number of bytes sent, and which access list is applied.
The following is sample output for the show ip inspect all command:
Session audit trail is disabledone-minute (sampling period) thresholds are [400:500] connectionsmax-incomplete sessions thresholds are [400:500]max-incomplete tcp connections per host is 50. Block-time 0 minute.tcp synwait-time is 30 sec -- tcp finwait-time is 5 sectcp idle-time is 3600 sec -- udp idle-time is 30 secdns-timeout is 5 secInspection Rule ConfigurationInspection name alltcp timeout 3600udp timeout 30ftp timeout 3600Interface ConfigurationInterface Ethernet0Inbound inspection rule is alltcp timeout 3600udp timeout 30ftp timeout 3600Outgoing inspection rule is not setInbound access list is not setOutgoing access list is not setEstablished SessionsSession 25A6E1C (30.0.0.1:46065)=>(40.0.0.1:21) ftp SIS_OPENSession 25A34A0 (40.0.0.1:20)=>(30.0.0.1:46072) ftp-data SIS_OPENshow ip port-map
To display the Port to Application Mapping (PAM) information, use the show ip port-map command in privileged EXEC mode.
show ip port-map [appl-name | port port-num]
Syntax Description
appl-name
(Optional) Specifies the name of the application to which to apply the port mapping.
port port-num
(Optional) Specifies the alternative port number that maps to the application.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use this command to display the port mapping information at the firewall, including the system-defined and user-defined information. Include the application name to display the list of entries by application. Include the port number to display the entries by port.
Examples
The following is sample output for the show ip port-map command, including system-defined mapping information:
Router# show ip port-mapDefault mapping: vdolive port 7000 system definedDefault mapping: sunrpc port 111 system definedDefault mapping: netshow port 1755 system definedDefault mapping: cuseeme port 7648 system definedDefault mapping: tftp port 69 system definedDefault mapping: real-audio-video port 7070 system definedDefault mapping: streamworks port 1558 system definedDefault mapping: ftp port 21 system definedDefault mapping: h323 port 1720 system definedDefault mapping: smtp port 25 system definedDefault mapping: http port 80 system definedDefault mapping: msrpc port 135 system definedDefault mapping: exec port 512 system definedDefault mapping: login port 513 system definedDefault mapping: sql-net port 1521 system definedDefault mapping: tftp port 70 user definedHost specific: ftp port 1000 in list 10 user definedHost specific: netshow port 70 in list 10 user definedHost specific: smtp port 70 in list 50 user definedThe following example shows the port mapping information for file transfer protocol services:
show ip port-map ftpDefault mapping: ftp port 21 system definedHost specific: ftp port 1000 in list 10 user definedThe following example shows the ports associated with the NetShow application, including both the default and host-specific port mapping information:
show ip port-map netshowDefault mapping: netshow port 1755 system definedHost specific: netshow port 21 in list 10 user definedThe following example shows the applications associated with port 69, including both the default and host-specific port mapping information:
show ip port-map port 69Default mapping: tftp port 69 user definedHost specific: netshow port 69 in list 50 user definedHost specific: smtp port 69 in list 10 user definedRelated Commands
show ip ssh
To display the version and configuration data for Secure Shell (SSH), use the show ip ssh command in privileged EXEC mode.
show ip ssh
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show ip ssh command to view the status of configured options such as retries and timeouts. This command allows you to see if SSH is enabled or disabled.
Examples
The following is sample output from the show ip ssh command when SSH has been enabled:
Router# show ip sshSSH Enabled - version 1.5Authentication timeout: 120 secs; Authentication retries: 3The following is sample output from the show ip ssh command when SSH has been disabled:Router# show ip ssh%SSH has not been enabledRelated Commands
show ip trigger-authentication
To display the list of remote hosts for which automated double authentication has been attempted, use the show ip trigger-authentication command in privileged EXEC mode.
show ip trigger-authentication
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Whenever a remote user needs to be user-authenticated in the second stage of automated double authentication, the local device sends a User Datagram Protocol (UDP) packet to the remote user's host. When the UDP packet is sent, the user's host IP address is added to a table. If additional UDP packets are sent to the same remote host, a new table entry is not created; instead, the existing entry is updated with a new time stamp. This remote host table contains a cumulative list of host entries; entries are deleted after a timeout period or after you manually clear the table using the
clear ip trigger-authentication command. You can change the timeout period with the
ip trigger-authentication (global) command.Use this command to view the list of remote hosts for which automated double authentication has been attempted.
Examples
The following example shows output from the show ip trigger-authentication command:
Router# show ip trigger-authenticationTrigger-authentication Host Table:Remote Host Time Stamp209.165.200.230 2940514234This output shows that automated double authentication was attempted for a remote user; the remote user's host has the IP address 209.165.200.230. The attempt to automatically double authenticate occurred when the local host (myfirewall) sent the remote host (209.165.200.230) a packet to UDP port 7500. (The default port was not changed in this example.)
Related Commands
clear ip trigger-authentication
Clears the list of remote hosts for which automated double authentication has been attempted.
show ip urlfilter cache
To display the maximum number of entries that can be cached into the cache table and the number of entries and the destination IP addresses that are cached into the cache table, use the show ip urlfilter cache command in EXEC mode.
show ip urlfilter cache
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
12.2(11)YU
This command was introduced.
12.2(15)T
This command was integrated into Cisco IOS Release 12.2(15)T.
Examples
The following example is sample output from the show ip urlfilter cache command:
Router# show ip urlfilter cacheMaximum number of entries allowed: 5000Number of entries cached: 5IP addresses cached ....10.64.128.54172.28.139.2110.76.82.25192.168.0.110.0.1.2Table 33 describes the significant fields shown in the display.
Related Commands
clear ip urlfilter cache
Clears the cache table.
ip urlfilter cache
Configures cache parameters.
show ip urlfilter config
To display the size of the cache, the maximum number of outstanding requests, the allow mode state, and the list of configured vendor servers, use the show ip urlfilter config command in EXEC mode.
show ip urlfilter config
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
12.2(11)YU
This command was introduced.
12.2(15)T
This command was integrated into Cisco IOS Release 12.2(15)T.
Examples
The following example is sample output from the show ip urlfilter config command:
Router# show ip urlfilter configURL filter is ENABLEDPrimary Websense server configurations===========================Websense server IP address: 10.0.0.3Websense server port: 15868Websense retransmit time out: 5 (seconds)Websense number of retransmit:2Secondary Websense server configurations:==============================None.Other configurations===============Allow mode: OFFSystem Alert: ONLog message on the router: OFFLog message on URL filter server:ONMaximum number of cache entries :5000Cache timeout :12 (hours)Maximum number of packet buffers:200Maximum outstanding requests:1000Related Commands
show ip urlfilter statistics
To display URL filtering statistics, use the show ip urlfilter statistics command in EXEC mode.
show ip urlfilter statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
12.2(11)YU
This command was introduced.
12.2(15)T
This command was integrated into Cisco IOS Release 12.2(15)T.
Usage Guidelines
This command shows information, such as the number of requests that are sent to the vendor server (Websense or N2H2), the number of responses received from the vendor server, the numberof pending requests in the system, the number of failed requests, and the number of blocked URLs.
Examples
The following example is sample output from the show ip urlfilter statistics command:
Router# show ip urlfilter statisticsURL filtering statistics================Current requests count:25Current packet buffer count(in use):40Current cache entry count:3100Maxever request count:526Maxever packet buffer count:120Maxever cache entry count:5000Total requests sent to URL Filter Server: 44765Total responses received from URL Filter Server: 44550Total requests allowed: 44320Total requests blocked: 224Table 34 describes the significant fields shown in the display.
Table 34 show ip urlfilter statistics Field Descriptions
Current requests count1
Number of requests that have been sent to the vendor server.
Current packet buffer count (in use)2
Number of HTTP responses that are currently in the packet buffer of the firewall.
Current cache entry count3
Number of destination IP addresses that have been cached into the cache table.
Maxever request count1
Maximum number of requests that have been sent to the vendor server since power on.
Maxever packet buffer count2
Maximum number of HTTP responses that have been stored in the packet buffer of the firewall since power on.
Maxever cache entry count3
Maximum number of destination IP addresses that have been cached into the cache table since power on.
1 This value can be specified via the ip urlfilter max-request command.
2 This value can be specified via the ip urlfilter max-resp-pak command.
3 This value can be specified via the ip urlfilter cache command.
Related Commands
show kerberos creds
To display the contents of your credentials cache, use the show kerberos creds command in privileged EXEC mode.
show kerberos creds
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The show kerberos creds command is equivalent to the UNIX klist command.
When users authenticate themselves with Kerberos, they are issued an authentication ticket called a credential. The credential is stored in a credential cache.
Examples
The following example displays entries in the credentials cache:
Router > show kerberos credsDefault Principal: user@example.comValid Starting Expires Service Principal18-Dec-1995 16:21:07 19-Dec-1995 00:22:24 krbtgt/EXAMPLE.COM@EXAMPLE.COMThe following example returns output that acknowledges that credentials do not exist in the credentials cache:
Router > show kerberos credsNo Kerberos credentialsRelated Commands
show ppp queues
To monitor the number of requests processed by each authentication, authorization, and accounting (AAA) background process, use the show ppp queues command in privileged EXEC mode.
show ppp queues
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show ppp queues command to display the number of requests handled by each AAA background process, the average amount of time it takes to complete each request, and the requests still pending in the work queue. This information can help you balance the data load between the network access server and the AAA server.
This command displays information about the background processes configured by the aaa processes global configuration command. Each line in the display contains information about one of the background processes. If there are AAA requests in the queue when you enter this command, the requests will be printed as well as the background process data.
Examples
The following example shows output from the show ppp queues command:
Router# show ppp queuesProc #0 pid=73 authens=59 avg. rtt=118s. authors=160 avg. rtt=94s.Proc #1 pid=74 authens=52 avg. rtt=119s. authors=127 avg. rtt=115s.Proc #2 pid=75 authens=69 avg. rtt=130s. authors=80 avg. rtt=122s.Proc #3 pid=76 authens=44 avg. rtt=114s. authors=55 avg. rtt=106s.Proc #4 pid=77 authens=70 avg. rtt=141s. authors=76 avg. rtt=118s.Proc #5 pid=78 authens=64 avg. rtt=131s. authors=97 avg. rtt=113s.Proc #6 pid=79 authens=56 avg. rtt=121s. authors=57 avg. rtt=117s.Proc #7 pid=80 authens=43 avg. rtt=126s. authors=54 avg. rtt=105s.Proc #8 pid=81 authens=139 avg. rtt=141s. authors=120 avg. rtt=122s.Proc #9 pid=82 authens=63 avg. rtt=128s. authors=199 avg. rtt=80s.queue len=0 max len=499Table 35 describes the fields shown in the example.
Related Commands
aaa processes
Allocates a specific number of background processes to be used to process AAA authentication and authorization requests for PPP.
show privilege
To display your current level of privilege, use the show privilege command in EXEC mode.
show privilege
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following example shows sample output from the show privilege command. The current privilege level is 15.
Router# show privilegeCurrent privilege level is 15Related Commands
enable password
Sets a local password to control access to various privilege levels.
enable secret
Specifies an additional layer of security over the enable password command.
show radius server-group
To display properties for the RADIUS server group, use the show radius server-group command in privileged or user EXEC mode.
show radius server-group {server-group name | all}
Syntax Description
server-group name
Displays properties for the server group named.
all
Displays properties for all the server groups.
Command Modes
Privileged EXEC
User EXECCommand History
Examples
The following show radius server-group command output displays properties for the server group "rad_sg":
Router# show radius server-group rad_sgserver group rad-sgSharecount = 1 sg_unconfigured = FALSEType = standard Memlocks = 1Table 36 describes the output in the display.
Related Commands
show radius statistics
To display the RADIUS statistics for accounting and authentication packets, use the show radius statistics command in EXEC mode.
show radius statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following example is sample output for the show radius statistics command:
Router# show radius statisticsAuth. Acct. BothMaximum inQ length: NA NA 1Maximum waitQ length: NA NA 1Maximum doneQ length: NA NA 1Total responses seen: 3 0 3Packets with responses: 3 0 3Packets without responses: 0 0 0Average response delay(ms): 5006 0 5006Maximum response delay(ms): 15008 0 15008Number of Radius timeouts: 3 0 3Duplicate ID detects: 0 0 0Table 37 describes significant fields shown in the display.
Related Commands
show ssh
To display the status of Secure Shell (SSH) server connections, use the show ssh command in privileged EXEC mode.
show ssh
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show ssh command to display the status of the SSH connections on your router. This command does not display any SSH configuration data; use the show ip ssh command for SSH configuration information such as timeouts and retries.
Examples
The following is sample output from the show ssh command with SSH enabled:
Router# show sshConnection Version Encryption State Username0 1.5 3DES Session Started guestThe following is sample output from the show ssh command with SSH disabled:
Router# show ssh%No SSH server connections running.Related Commands
show tacacs
To display statistics for a TACACS+ server, use the show tacacs command in EXEC mode.
show tacacs
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following example is sample output for the show tacacs command:
Router# show tacacsTacacs+ Server : 172.19.192.80/49Socket opens: 3Socket closes: 3Socket aborts: 0Socket errors: 0Socket Timeouts: 0Failed Connect Attempts: 0Total Packets Sent: 7Total Packets Recv: 7Expected Replies: 0No current connectionTable 38 describes the significant fields shown in the display.
Related Commands
show tcp intercept connections
To display TCP incomplete and established connections, use the show tcp intercept connections command in EXEC mode.
show tcp intercept connections
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show tcp intercept connections command to display TCP incomplete and established connections.
Examples
The following is sample output from the show tcp intercept connections command:
Router# show tcp intercept connectionsIncomplete:Client Server State Create Timeout Mode172.19.160.17:58190 10.1.1.30:23 SYNRCVD 00:00:09 00:00:05 I172.19.160.17:57934 10.1.1.30:23 SYNRCVD 00:00:09 00:00:05 IEstablished:Client Server State Create Timeout Mode171.69.232.23:1045 10.1.1.30:23 ESTAB 00:00:08 23:59:54 ITable 39 describes significant fields shown in the display.
Related Commands
show tcp intercept statistics
To display TCP intercept statistics, use the show tcp intercept statistics command in EXEC mode.
show tcp intercept statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show tcp intercept statistics command to display TCP intercept statistics.
Examples
The following is sample output from the show tcp intercept statistics command:
Router# show tcp intercept statisticsintercepting new connections using access-list 1012 incomplete, 1 established connections (total 3)1 minute connection request rate 2 requests/secRelated Commands
snmp-server enable traps ipsec
To enable the router to send IP Security (IPSec) Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps ipsec command in global configuration mode. To disable IPSec SNMP notifications, use the no form of this command.
snmp-server enable traps ipsec [cryptomap [add | delete | attach | detach] | tunnel [start | stop] | too-many-sas]
no snmp-server enable traps ipsec [cryptomap [add | delete | attach | detach] | tunnel [start | stop] | too-many-sas]
Syntax Description
Defaults
SNMP notifications are disabled by default.
Command Modes
Global configuration
Command History
Usage Guidelines
SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests.
A cryptomap is a table that maps an IPSec Phase-2 tunnel to the corresponding IPSec Policy element.
For a complete description of the notification types and additional MIB functions, refer to the CISCO-IP-SEC.my and CISCO-IPSEC-FLOW-MONITOR-MIB.my files, available on Cisco.com through:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
The snmp-server enable traps ipsec command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send SNMP notifications, you must configure at least one snmp-server host command.
Examples
In the following example, the router is configured to send IPSec MIB inform notifications to the host nms.cisco.com using the community string named "public":
snmp-server enable traps ipsecsnmp-server host nms.cisco.com informs public ipsecRelated Commands
snmp-server enable traps isakmp
To enable the router to send IP Security (IPSec) Internet Security Association and Key Exchange Protocol (ISAKMP) Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps isakmp command in global configuration mode. To disable ISAKMP IPSec SNMP notifications, use the no form of this command.
snmp-server enable traps isakmp [policy {add | delete} | tunnel {start | stop}]
no snmp-server enable traps isakmp [policy {add | delete} | tunnel {start | stop}]
Syntax Description
Defaults
SNMP notifications are disabled by default.
If no keywords are specified, all available ISAKMP traps are enabled (or disabled if the no form is used).
Command Modes
Global configuration
Command History
Usage Guidelines
SNMP notifications can be sent as traps or inform requests. This command enables both ISAKMP trap and inform requests.
For a complete description of these notifications and additional MIB functions, refer to the CISCO-IPSEC-MIB.myand CISCO-IPSEC-FLOW-MONITOR-MIB.my files, available on Cisco.com through:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
The snmp-server enable traps isakmp command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send SNMP notifications, you must configure at least one snmp-server host command.
Examples
In the following example, the router is configured to send IPSec MIB inform notifications to the host nms.cisco.com using the community string named "public":
snmp-server enable traps isakmpsnmp-server host nms.cisco.com informs public ipsecRelated Commands
snmp-server host
Specifies the recipient of an SNMP notification operation.
snmp-server trap-source
Specifies the interface that an SNMP trap should originate from.
source interface
To specify the address of an interface to be used as the source address for all outgoing TCP connections associated with a trustpoint, use the source interface command in ca-trustpoint configuration mode. To disable the interface that was specified, use the no form of this command.
source interface interface-name
no source interface interface-name
Syntax Description
interface-name
Interface address to be used as the source address for all outgoing TCP connections associated with a trustpoint.
Defaults
If this command is not specified, the address of the outgoing interface is used.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
This command must be used following the crypto ca trustpoint command. If this command is used and the address of the outgoing interface is specified, the router uses the specified address (or address of the specified interface) as the source address for any datagrams that are sent to the certification authority (CA) server or Lightweight Directory Access Protocol (LDAP) server during authentication, enrollment, and if appropriate, when obtaining certificate revocation lists (CRLs).
Examples
In the following example, the router is located in a branch office. The router uses IP Security (IPSec) to communicate with the main office. Ethernet 1 is the "outside" interface that connects to the Internet Service Provider (ISP). Ethernet 0 is the interface connected to the LAN of the branch office. To access the CA server located in the main office the router needs to send its IP datagrams out interface Ethernet 1 (address 10.2.2.205) using the IPSec tunnel. Address 10.2.2.205 is assigned by the ISP. Address 10.2.2.205 is not a part of the branch office or main office.
The CA cannot access any address outside the company because of a firewall. The CA sees a message coming from 10.2.2.205 and cannot respond (that is, it does not know that the router is located in a branch office at address 10.1.1.1, which it is able to reach).
Adding the source interface command tells the router to use address 10.1.1.1 as the source address of the IP datagram that it sends to the CA. The CA is able to respond to 10.1.1.1.
This scenario is configured using the source interface command and the interface addresses as described above.
crypto ca trustpoint ms-caenrollment url http://yourname:80/certsrv/mscep/mscep.dllsource interface ethernet0!interface ethernet 0description inside interfaceip address 10.1.1.1 255.255.255.0!interface ethernet 1description outside interfaceip address 10.2.2.205 255.255.255.0crypto map main-officeRelated Commands
ssh
To start an encrypted session with a remote networking device, use the ssh command in privileged EXEC or user EXEC mode.
ssh [-v {1 | 2}] [-c {3des | aes128-cbc | aes192-cbc | aes256-cbc}] [-l userid | -l userid:number ip-address | -l userid:rotarynumber ip-address] [-m {hmac-md5 | hmac-md5-96 | hmac-sha1 | hmac-sha1-96}] [-o numberofpasswordprompts n] [-p port-num] {ip-addr | hostname} [command]
Syntax Description
Defaults
Disabled
Command Modes
User EXEC
Privileged EXECCommand History
Usage Guidelines
The ssh command enables a Cisco router to make a secure, encrypted connection to another Cisco router or device running an SSH Version 1 or Version 2 server. This connection provides functionality that is similar to that of an outbound Telnet connection except that the connection is encrypted. With authentication and encryption, the SSH client allows for a secure communication over an insecure network.
Note
•
•
Examples
The following example illustrates the initiation of a secure session between the local router and the remote host HQhost to run the show users command. The result of the show users command is a list of valid users who are logged in to HQhost. The remote host will prompt for the adminHQ password to authenticate the user adminHQ. If the authentication step is successful, the remote host will return the result of the show users command to the local router and will then close the session.
ssh -l adminHQ HQhost "show users"The following example illustrates the initiation of a secure session between the local router and the edge router HQedge to run the show ip route command. In this example, the edge router prompts for the adminHQ password to authenticate the user. If the authentication step is successful, the edge router will return the result of the show ip route command to the local router.
ssh -l adminHQ HQedge "show ip route"The following example shows the SSH client using 3DES to initiate a secure remote command connection with the HQedge router. The SSH server running on HQedge authenticates the session for the admin7 user on the HQedge router using standard authentication methods. The HQedge router must have SSH enabled for authentication to work.
ssh -l admin7 -c 3des -o numberofpasswordprompts 5 HQedgeThe following example shows a secure session between the local router and a remote IPv6 router with the address 3ffe:1111:2222:1044::72 to run the show running-config command. In this example, the remote IPv6 router prompts for the adminHQ password to authenticate the user. If the authentication step is successful, the remote IPv6 router will return the result of the show running-config command to the local router and will then close the session.
ssh -l adminHQ 3ffe:1111:2222:1044::72 "show running-config"
Note
The following example shows a SSH Version 2 session using the crypto algorithm aes256-cbc and an HMAC of hmac-sha1-96. The user ID is user2, and the IP address is 10.76.82.24.
ssh -v 2 -c aes256-cbc -m hmac-sha1-96 -1 user2 10.76.82.24The following example shows that reverse SSH has been configured on the SSH client:
ssh -l lab:1 router.example.comThe following command shows that Reverse SSH will connect to the first free line in the rotary group:
ssh -l lab:rotary1 router.example.comRelated Commands
subject-name
To specify the subject name in the certificate request, use the subject-name command in ca-trustpoint configuration mode. To clear any subject name from the configuration, use the no form of this command.
subject-name [x.500-name]
no subject-name [x.500-name]
Syntax Description
Defaults
If the x-500-name argument is not specified, the fully qualified domain name (FQDN), which is the default subject name, will be used.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Before you can issue the subject-name command, you must enable the crypto ca trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode.
The subject-name command is an attribute that can be set for autoenrollment; thus, issuing this command prevents you from being prompted for a subject name during enrollment.
Examples
The following example shows how to specify the subject name for the "frog" certificate:
crypto ca trustpoint frogenrollment url http://frog.phoobin.com/subject-name OU=Spiral Dept., O=tiedye.comip-address ethernet-0auto-enroll regeneratepassword revokmeRelated Commands
tacacs-server administration
To enable the handling of administrative messages by the TACACS+ daemon, use the tacacs-server administration command in global configuration mode. To disable the handling of administrative messages by the TACACS+ daemon, use the no form of this command.
tacacs-server administration
no tacacs-server administration
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Global configuration
Command History
Examples
The following example shows that the TACACS+ daemon is enabled to handle administrative messages:
tacacs-server administrationtacacs-server directed-request
To send only a username to a specified server when a direct request is issued, use the tacacs-server directed-request command in global configuration mode. To send the entire string to the TACACS+ server, use the no form of this command.
tacacs-server directed-request [restricted] [no-truncate]
no tacacs-server directed-request
Syntax Description
restricted
(Optional) Restrict queries to directed request servers only.
no-truncate
(Optional) Do not truncate the @hostname from the username.
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
This command sends only the portion of the username before the "@" symbol to the host specified after the "@" symbol. In other words, with the directed-request feature enabled, you can direct a request to any of the configured servers, and only the username is sent to the specified server.
Disabling tacacs-server directed-request causes the whole string, both before and after the "@" symbol, to be sent to the default TACACS+ server. When the directed-request feature is disabled, the router queries the list of servers, starting with the first one in the list, sending the whole string, and accepting the first response that it gets from the server. The tacacs-server directed-request command is useful for sites that have developed their own TACACS+ server software that parses the whole string and makes decisions based on it.
With tacacs-server directed-request enabled, only configured TACACS+ servers can be specified by the user after the "@" symbol. If the host name specified by the user does not match the IP address of a TACACS+ server configured by the administrator, the user input is rejected.
Use no tacacs-server directed-request to disable the ability of the user to choose between configured TACACS+ servers and to cause the entire string to be passed to the default server.
Examples
The following example disables tacacs-server directed-request so that the entire user input is passed to the default TACACS+ server:
no tacacs-server directed-requesttacacs-server dns-alias-lookup
To enable IP Domain Name System (DNS) alias lookup for TACACS+ servers, use the command in global configuration mode. To disable IP DNS alias lookup, use the no form of this command.
tacacs-server dns-alias-lookup
no tacacs-server dns-alias-lookup
Syntax Description
This command has no arguments or keywords.
Command Default
IP DNS alias lookup is disabled.
Command Modes
global configuration
Command History
Examples
The following example shows that IP DNS alias lookup has been enabled:
tacacs-server dns-alias-lookuptacacs-server host
To specify a TACACS+ host, use the tacacs-server host command in global configuration mode. To delete the specified name or address, use the no form of this command.
tacacs-server host {host-name | host-ip-address} [key string] [nat] [port [integer]] [single-connection] [timeout [integer]]
no tacacs-server host {host-name | host-ip-address}
Syntax Description
Defaults
No TACACS+ host is specified.
Command Modes
Global configuration
Command History
10.0
This command was introduced.
12.1(11), 12.2(6)
The nat keyword was added.
12.2(8)T
The nat keyword was integrated into Cisco IOS Release 12.2(8)T.
Usage Guidelines
You can use multiple tacacs-server host commands to specify additional hosts. The Cisco IOS software searches for hosts in the order in which you specify them. Use the port, timeout, key, single-connection, and nat keywords only when running a AAA/TACACS+ server.
Because some of the parameters of the tacacs-server host command override global settings made by the tacacs-server timeout and tacacs-server key commands, you can use this command to enhance security on your network by uniquely configuring individual routers.
The single-connection keyword specifies a single connection (only valid with CiscoSecure Release 1.0.1 or later). Rather than have the router open and close a TCP connection to the server each time it must communicate, the single-connection option maintains a single open connection between the router and the server. The single connection is more efficient because it allows the server to handle a higher number of TACACS operations.
Examples
The following example specifies a TACACS+ host named Sea_Change:
tacacs-server host Sea_ChangeThe following example specifies that, for authentication, authorization, and accounting (AAA) confirmation, the router consults the TACACS+ server host named Sea_Cure on port number 51. The timeout value for requests on this connection is three seconds; the encryption key is a_secret.
tacacs-server host Sea_Cure port 51 timeout 3 key a_secretRelated Commands
tacacs-server key
To set the authentication encryption key used for all TACACS+ communications between the access server and the TACACS+ daemon, use the tacacs-server key command in global configuration mode. To disable the key, use the no form of this command.
tacacs-server key key
no tacacs-server key [key]
Syntax Description
key
Key used to set authentication and encryption. This key must match the key used on the TACACS+ daemon.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
After enabling authentication, authorization, and accounting (AAA) with the aaa new-model command, you must set the authentication and encryption key using the tacacs-server key command.
The key entered must match the key used on the TACACS+ daemon. All leading spaces are ignored; spaces within and at the end of the key are not. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
Examples
The following example sets the authentication and encryption key to "dare to go":
tacacs-server key dare to goRelated Commands
aaa new-model
Enables the AAA access control model.
tacacs-server host
Specifies a TACACS+ host.
tacacs-server packet
To modify TACACS+ packet options, use the tacacs-server packet command in global configuration mode. To disable the modified packet options, use the no form of this command.
tacacs-server packet maxsize
no tacacs-server packet
Syntax Description
Command Default
None
Command Modes
Global configuration
Command History
Examples
The following example shows that the TACACS+ packet size has been set to the minimum value of 10240:
tacacs-server packet 10240tacacs-server timeout
To set the interval for which the server waits for a server host to reply, use the tacacs-server timeout command in global configuration mode. To restore the default, use the no form of this command.
tacacs-server timeout seconds
no tacacs-server timeout seconds
Syntax Description
Command Default
If the command is not configured, the timeout interval is 5.
Command Modes
Global configuration
Command History
Examples
The following example changes the interval timeout to 10 seconds:
Router (config)# tacacs-server timeout 10test aaa group
To associate a dialed number identification service (DNIS) or calling line identification (CLID) user profile with the record that is sent to the RADIUS server, use the test aaa group command in privileged EXEC mode.
test aaa group {group-name | radius} username password new-code [profile profile-name]
Syntax Description
Defaults
If this command is not enabled, DNIS or CLID attribute values will not be sent to the RADIUS server.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the test aaa group command to associate a DNIS or CLID named user profile with the record that is sent to the RADIUS server, which can then access DNIS or CLID information when the server receives a RADIUS record.
Note
Examples
The following example shows how to configure a dnis = dnisvalue user profile named "prfl1" and associate it with a test aaa group command:
aaa user profile prfl1aaa attribute dnisaaa attribute dnis dnisvalueno aaa attribute clid! Attribute not found.aaa attribute clid clidvalueno aaa attribute clidexit!! Associate the dnis user profile with the test aaa group command.test aaa group radius user1 pass new-code profile prfl1Related Commands
aaa attribute
Adds DNIS or CLID attribute values to a user profile.
aaa user profile
Creates an AAA user profile.
timeout login response
To specify how long the system will wait for login input (such as username and password) before timing out, use the timeout login response command in line configuration mode. To set the timeout value to 30 seconds (which is the default timeout value), use the no form of this command.
timeout login response seconds
no timeout login response seconds
Syntax Description
seconds
Integer that determines the number of seconds the system will wait for login input before timing out. Available settings are from 1 to 300 seconds. The default value is 30 seconds.
Defaults
The default login timeout value is 30 seconds.
Command Modes
Line configuration
Command History
Examples
The following example changes the login timeout value to 60 seconds:
line 10timeout login response 60tunnel protection
To associate a tunnel interface with an IP Security (IPSec) profile, use the tunnel protection command in interface configuration mode. To disassociate a tunnel with an IPSec profile, use the no form of this command.
tunnel protection ipsec-profile name [shared]
no tunnel protection ipsec-profile name [shared]
Syntax Description
Defaults
This command is not enabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the tunnel protection command to specify that IPSec encryption will be performed after the GRE has been added to the tunnel packet. The tunnel protection command can be used with multipoint GRE (mGRE) and point-to-point GRE (p-pGRE) tunnels. With p-pGRE tunnels, the tunnel destination address will be used as the IPSec peer address. With mGRE tunnels, multiple IPSec peers are possible; the corresponding Next Hop Resolution Protocol (NHRP) mapping nonbroadcast multiaccess (NBMA) destination addresses will be used as the IPSec peer addresses.
The shared Keyword
If you wish to configure two Dynamic Multipoint VPN (DMVPN) mGRE and IPSec tunnels on the same router, you must issue the shared keyword.
The dynamic crypto map that is created by the tunnel protection command is always unique from a crypto map that is configured directly on the interface.
Note
Examples
The following example shows how to associate the IPSec profile "vpnprof" with a mGRE tunnel interface. In this example, the IPSec source peer address will be the IP address from interface Ethernet0. There is a static NHRP mapping for 10.0.0.3 --> 172.16.2.1, so for this NHRP mapping the IPSec destination peer address will be 172.16.2.1. The IPSec proxy will be as follows: permit gre host ethernet0-ip-address host 172.16.2.1. Other NHRP mappings (static or dynamic) will automatically create additional IPSec security associations (SAs) with the same source peer address and the destination peer address from the NHRP mapping. The IPSec proxy for these NHRP mappings will be as follows: permit gre host ethernet0-ip-address host NHRP-mapping-NBMA-address.
crypto ipsec profile vpnprofset transform-set trans2!interface Tunnel0bandwith 1000ip address 10.0.0.1 255.255.255.0! Ensures longer packets are fragmented before they are encrypted; otherwise, the ! receiving router would have to do the reassembly.ip mtu 1416ip nhrp authentication donttellip nhrp map multicast dynamicip nhrp network-id 99ip nhrp holdtime 300! Turns off split horizon on the mGRE tunnel interface; otherwise, EIGRP will not ! advertise routes that are learned via the mGRE interface back out that interface.no ip split-horizon eigrp 1no ip next-hop-self eigrp 1delay 1000! Sets IPSec peer address to Ethernet interface's public address.tunnel source Ethernet0tunnel mode gre multipoint! The following line must match on all nodes that want to use this mGRE tunnel.tunnel key 100000tunnel protection ipsec profile vpnprofThe following example shows how to associate the IPSec profile "vpnprof" with a p=pGRE tunnel interface. In this example, the IPSec source peer address will be the IP address from interface Ethernet0. The IPSec destination peer address will be 172.16.1.10 (via the tunnel destination address command). The IPSec proxy will be as follows: permit gre host ethernet0-ip-address host 172.16.1.10.
interface Tunnel1 ip address 10.0.1.1 255.255.255.252 ! Ensures longer packets are fragmented before they are encrypted; otherwise, the ! receiving router would have to do the reassembly. ip mtu 1420 tunnel source Ethernet0 tunnel destination 172.16.1.10 tunnel protection ipsec profile vpnprofRelated Commands
usage
To specify the intended use for the certificate, use the usage command in ca-trustpoint configuration mode. To restore the default behavior, use the no form of this command.
usage method1 [method2 [method3]]
no usage method1 [method2 [method3]]
Syntax Description
method1
[method2 [method3]]Intended use for the certificate; the available options are ike, ssl-client, and ssl-server.
You must choose at least one method, and you may choose all three methods.
Defaults
ike
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Before you can issue the usage command, you must enable the crypto ca trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode.
This command may be used as a hint to set or clear key usage or other attributes in the certificate request.
Examples
The following example shows how to specify the certificate named "frog" for Internet Key Exchange (IKE):
crypto ca trustpoint frogenrollment url http://frog.phoobin.com/subject-name OU=Spiral Dept., O=tiedye.comip-address ethernet-0usage ikeauto-enroll regeneratepassword revokemersa-key frog 2048Related Commands
username
To establish a username-based authentication system, use the username command in global configuration mode. Use the no form of this command to remove an established username-based authentication.
username name {nopassword | password password | password encryption-type encrypted-password}
username name password secret
username name [access-class number]
username name [autocommand command]
username name [callback-dialstring telephone-number]
username name [callback-rotary rotary-group-number]
username name [callback-line [tty] line-number [ending-line-number]]
username name dnis
username name [nocallback-verify]
username name [noescape] [nohangup]
username name [privilege level]
username name user-maxlinks number
username [lawful-intercept] name [privilege privilege-level | view view-name] password password
no username name
Syntax Description
Defaults
No username-based authentication system is established.
Command Modes
Global configuration
Command History
Usage Guidelines
The username command provides username or password authentication, or both, for login purposes only.
Multiple username commands can be used to specify options for a single user.
Add a username entry for each remote system with which the local router communicates and from which it requires authentication. The remote device must have a username entry for the local router. This entry must have the same password as the local router's entry for that remote device.
This command can be useful for defining usernames that get special treatment. For example, you can use this command to define an "info" username that does not require a password but connects the user to a general purpose information service.
The username command is required as part of the configuration for the Challenge Handshake Authentication Protocol (CHAP). Add a username entry for each remote system from which the local router requires authentication.
Note
Note
Note
CLI and Lawful Intercept Views
Both CLI views and lawful intercept views restrict access to specified commands and configuration information. A lawful intercept view allows a user to secure access to lawful intercept commands that are held within the TAP-MIB, which is a special set of simple network management protocol (SNMP) commands that stores information about calls and users.
Users who are specified via the lawful-intercept keyword are placed in the lawful-intercept view, by default, if no other privilege level or view name has been explicitly specified.
If there is no secret specified and the debug serial-interface command is enabled, an error is displayed when a link is established and the CHAP challenge is not implemented. CHAP debugging information is available using the debug ppp negotiation, debug serial-interface, and debug serial-packet commands. For more information about debug commands, refer to the Cisco IOS Debug
Command Reference.Examples
The following example implements a service similar to the UNIX who command, which can be entered at the login prompt and lists the current users of the router:
username who nopassword nohangup autocommand show usersThe following example implements an information service that does not require a password to be used. The command takes the following form:
username info nopassword noescape autocommand telnet nic.ddn.milThe following example implements an ID that works even if all the TACACS+ servers break. The command takes the following form:
username superuser password superpasswordThe following example enables CHAP on interface serial 0 of "server_l." It also defines a password for a remote server named "server_r."
hostname server_l username server_r password theirsystem interface serial 0 encapsulation ppp ppp authentication chapWhen you look at your configuration file, the passwords will be encrypted, and the display will look similar to the following:
hostname server_l username server_r password 7 121F0A18 interface serial 0 encapsulation ppp ppp authentication chapIn both of the following configuration examples, a privilege level 1 user is denied access to privilege levels higher than 1:
username user privilege 0 password 0 ciscousername user 2 privilege 2 password 0 ciscoThe following example removes the username-based authentication for user 2:
no username user 2Related Commands
username secret
To encrypt a user password with Message Digest 5 (MD5) encryption, use the username secret command in global configuration mode.
username name secret {[0] password | 5 encrypted-secret}
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
Use the username secret command to configure a username and MD5-encrypted user password. The optional 0 keyword enables MD5 encryption on a clear text password; the 5 keyword enters an MD5 encryption string and saves it as the user MD5-encrypted secret. MD5 encryption is a strong encryption method that is not retrievable; thus, you cannot use MD5 encryption with protocols that require clear text passwords, such as Challenge Handshake Authentication Protocol (CHAP).
The username secret command provides an additional layer of security over the username password. It also provides better security by encrypting the password using nonreversible MD5 encryption and storing the encrypted text. The added layer of MD5 encryption is useful in environments in which the password crosses the network or is stored on a TFTP server.
Use MD5 as the encryption type if you paste into this command an encrypted password that you copied from a router configuration file.
Examples
The following example shows how to configure username "abc" and enable MD5 encryption on the clear text password "xyz":
username abc secret xyzThe following example shows how to configure username "cde" and enter an MD5 encrypted text string that is stored as the username password:
username cde secret 5 $1$feb0$a104Qd9UZ./Ak00KTggPD0Related Commands
vpdn aaa attribute
To enable reporting of network access server (NAS) authentication, authorization, and accounting (AAA) attributes related to a virtual private dialup network (VPDN) to the AAA server, use the vpdn aaa attribute command in global configuration mode. To disable reporting of AAA attributes related to VPDN, use the no form of this command.
vpdn aaa attribute {nas-ip-address vpdn-nas | nas-port {vpdn-nas | physical-channel-id}}
no vpdn aaa attribute {nas-ip-address vpdn-nas | nas-port}
Syntax Description
Command Default
AAA attributes are not reported to the AAA server.
Command Modes
Global configuration
Command History
Usage Guidelines
This command can be used with RADIUS or TACACS+, and is applicable only on the VPDN tunnel server.
The PPP extended NAS-Port format enables the NAS-Port and NAS-Port-Type attributes to provide port details to a RADIUS server when one of the following protocols is configured:
•
•
•
Before PPP extended NAS-Port format attributes can be reported to the RADIUS server, the radius-server attribute nas-port format command with the d keyword must be configured on both the tunnel server and the NAS, and the tunnel server and the NAS must both be Cisco routers.
Examples
The following example configures VPDN on a tunnel server and enables reporting of VPDN AAA attributes to the AAA server:
vpdn enablevpdn-group 1accept-dialinprotocol anyvirtual-template 1!terminate-from hostname nas1local name ts1!vpdn aaa attribute nas-ip-address vpdn-nasvpdn aaa attribute nas-port vpdn-nasvpdn aaa attribute nas-port physical-channel-idThe following example configures the tunnel server for VPDN, enables AAA, configures a RADIUS AAA server, and enables reporting of PPP extended NAS-Port format values to the RADIUS server. PPP extended NAS-Port format must also be configured on the NAS for this configuration to be effective.
vpdn enablevpdn-group L2TP-tunnelaccept-dialinprotocol l2tpvirtual-template 1!terminate-from hostname nas1local name ts1!aaa new-modelaaa authentication ppp default local group radiusaaa authorization network default local group radiusaaa accounting network default start-stop group radius!radius-server host 171.79.79.76 auth-port 1645 acct-port 1646radius-server retransmit 3radius-server attribute nas-port format dradius-server key ts123!vpdn aaa attribute nas-port vpdn-nasRelated Commands
radius-server attribute nas-port format
Selects the NAS-Port format used for RADIUS accounting features.
vrf (isakmp profile)
To define the virtual routing and forwarding (VRF) value to which the IP Security (IPSec) tunnel will be mapped, use the vrf command in Internet Security Association Key Management (ISAKMP) profile configuration mode. To disable the VRF that was defined, use the no form of this command.
vrf ivrf
no vrf ivrf
Syntax Description
Defaults
The VRF will be the same as the front door VRF (FVRF).
Command Modes
ISAKMP profile configuration
Command History
Usage Guidelines
Use this command to map IPSec tunnels that terminate on a global interface to a specific Virtual Private Network (VPN).
If traffic from the router to a certification authority (CA) (for authentication, enrollment, or for obtaining a certificate revocation list [CRL]) or to a Lightweight Directory Access Protocol (LDAP) server (for obtaining a CRL) needs to be routed via a VRF, the vrf command must be added to the trustpoint. Otherwise, such traffic will use the default routing table.
If a profile does not specify one or more trustpoints, all trustpoints in the router will be used to attempt to validate the certificate of the peer (Internet Key Exchange [IKE] main mode or signature authentication). If one or more trustpoints are specified, only those trustpoints will be used.
Examples
The following example shows that two IPSec tunnels to VPN 1 and VPN 2 are terminated:
crypto isakmp profile vpn1vrf vpn1keyring vpn1match identity address 172.16.1.1 255.255.255.255crypto isakmp profile vpn2vrf vpn2keyring vpn2match identity address 10.1.1.1 255.255.255.255crypto ipsec transform-set vpn1 esp-3des esp-sha-hmaccrypto ipsec transform-set vpn2 esp-3des esp-md5-hmac!crypto map crypmap 1 ipsec-isakmpset peer 172.16.1.1set transform-set vpn1set isakmp-profile vpn1match address 101crypto map crypmap 3 ipsec-isakmpset peer 10.1.1.1set transform-set vpn2set isakmp-profile vpn2match address 102!!interface Ethernet1/2ip address 172.26.1.1 255.255.255.0duplex halfno keepaliveno cdp enablecrypto map crypmapwins
To specify the primary and secondary Windows Internet Naming Service (WINS) servers, use the wins command in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode. To remove this command from your configuration, use the no form of this command.
wins primary-server secondary-server
no wins primary-server secondary-server
Syntax Description
Defaults
No default behavior or values.
Command Modes
ISAKMP group configuration
Command History
Usage Guidelines
You must enable the crypto isakmp client configuration group command, which specifies group policy information that needs to be defined or changed, before enabling the wins command.
Examples
The following example shows how to define a primary and secondary WINS server for the group "cisco":
crypto isakmp client configuration group ciscokey ciscodns 2.2.2.2 2.3.2.3pool dogacl 199wins 1.1.1.2 1.1.1.3Related Commands
crypto isakmp client configuration group
Specifies which group's policy profile will be defined.
