-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Feedback
Table Of Contents
all (profile map configuration)
application (application firewall policy)
authentication (IKEv2 profile)
authentication command bounce-port ignore
authentication command disable-port ignore
authentication control-direction
authentication critical recovery delay
authentication event no-response action
authentication event server alive action reinitialize
authentication event server dead action authorize
authentication list (tti-registrar)
authentication timer inactivity
authentication timer reauthenticate
authorization list (tti-registrar)
authorization username (tti-registrar)
all (profile map configuration)
To specify that all authentication and authorization requests be cached, use the all command in profile map configuration mode. To disable the caching of all requests, use the no form of this command.
all [no-auth]
no all
Syntax Description
Command Default
No requests are cached.
Command Modes
Profile map configuration (config-profile-map)
Command History
Usage Guidelines
Use the all command to cache all authentication and authorization requests.
Use the all command for specific service authorization requests, but it should be avoided when dealing with authentication requests.
Examples
The following example caches all authorization requests in the localusers cache profile group. No authentication is performed for these users because the no-auth keyword is used.
Router# configure terminalRouter(config)# aaa new-modelRouter(config)# aaa cache profile localusersRouter(config-profile-map)# all no-authRelated Commands
allow-mode
To turn the default mode of the filtering algorithm on or off, use the allow-mode command in URL parameter-map configuration mode. To disable this feature, use the no form of this command.
allow-mode {on | off}
no allow-mode {on | off}
Syntax Description
on
Turns on the default mode of the filtering algorithm. The default is on.
off
Turns off the default mode of the filtering algorithm.
Command Default
The filtering algorithm is turned on.
Command Modes
URL parameter-map configuration
Command History
Usage Guidelines
When you are creating or modifying a URL parameter map, you can enter the allow-mode subcommand after you enter the parameter-map type urlfilter command.
For more detailed information about creating a parameter map, see the parameter-map type urlfilter command.
Examples
The following example turns on the filtering algorithm:
parameter-map type urlfilter eng-filter-profileallow-mode onRelated Commands
parameter-map type urlfilter
Creates or modifies a parameter map for URL filtering parameters.
appfw policy-name
To define an application firewall policy and put the router in application firewall policy configuration mode, use the appfw policy-name command in global configuration mode. To remove a policy from the router configuration, use the no form of this command.
appfw policy-name policy-name
no appfw policy-name policy-name
Syntax Description
Defaults
If this command is not issued, an application firewall policy cannot be created.
Command Modes
Global configuration
Command History
Usage Guidelines
This command puts the router in application firewall policy (appfw-policy-protocol) configuration mode, which allows you to begin defining the application firewall policy that will later be applied to the Cisco IOS Firewall via the ip inspect name command.
What Is an Application Firewall Policy?
The application firewall uses static signatures to detect security violations. A static signature is a collection of parameters that specifies which protocol conditions must be met before an action is taken. (For example, a signature may specify that an HTTP data stream containing the POST method must reset the connection.) These protocol conditions and reactions are defined by the end user via a command-line interface (CLI) to form an application firewall policy (also known as a security policy).
Examples
The following example shows how to define the HTTP application firewall policy "mypolicy." This policy includes all supported HTTP policy rules. After the policy is defined, it is applied to the inspection rule "firewall," which will inspect all HTTP traffic entering the FastEthernet0/0 interface.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpstrict-http action allow alarmcontent-length maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!Related Commands
appl (webvpn)
To configure an application to access a smart tunnel, use the appl command in WebVPN smart tunnel configuration mode. To disable an application from accessing the smart tunnel, use the no form of this command.
appl display-name appl-name windows
no appl display-name appl-name windows
Syntax Description
display-name
Name of the application to be displayed in the smart tunnel application access list on the web browser.
appl-name
Application name or path.
windows
Specifies the Windows platform.
Command Default
No applications have access to a smart tunnel.
Command Modes
WebVPN smart tunnel configuration mode (config-webvpn-smart-tunnel)
Command History
Usage Guidelines
You must configure the correct path and application name to allow the smart tunnel to provide access to applications.
Examples
The following example shows how to configure applications to access the smart tunnel:
Router(config)# webvpn context sslgwRouter(config-webvpn-context)# smart-tunnel list st1Router(config-webvpn-smart-tunnel)# appl ie ieexplore.exe windowsRouter(config-webvpn-smart-tunnel)# appl telnet telnet.exe windowsRelated Commands
smart-tunnel list
Configures the smart tunnel list and enables it within a policy group.
webvpn context
Configures the SSL VPN context.
application (application firewall policy)
To put the router in appfw-policy-protocol configuration mode and begin configuring inspection parameters for a given protocol, use the application command in application firewall policy configuration mode. To remove protocol-specific rules, use the no form of this command.
application protocol
no application protocol
Syntax Description
Command Default
You cannot set up protocol-specific inspection parameters.
Command Modes
cfg-appfw-policy-aim configuration
cfg-appfw-policy-ymsgr configuration
cfg-appfw-policy-msnmsgr configuration
Command History
12.3(14)T
This command was introduced.
12.4(4)T
The im, aol, yahoo, and msn keywords were introduced to support instant message traffic detection and prohibition.
Examples
This command puts the router in appfw-policy-protocol configuration mode, where "protocol" is dependent upon the specified protocol.
HTTP-Specific Inspection Commands
After you issue the application http command and enter the appfw-policy-http configuration mode, begin configuring inspection parameters for HTTP traffic by issuing any of the following commands:
•
audit-trail
•
•
•
•
•
•
•
•
•
Instant Messenger-Specific Inspection Commands
After you issue the application im command and specify an instant messenger application (AOL, Yahoo, or MSN), you can begin configuring inspection parameters for IM traffic by issuing any of the following commands:
•
•
•
•
•
Examples
The following example shows how to define the HTTP application firewall policy "mypolicy." This policy includes all supported HTTP policy rules. After the policy is defined, it is applied to the inspection rule "firewall," which will inspect all HTTP traffic entering the FastEthernet0/0 interface.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpstrict-http action allow alarmcontent-length maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!The following example shows to configure application policy "my-im-policy," which allows text-chat for Yahoo! instant messenger users and blocks instant messenger traffic for all other users:
appfw policy-name my-im-policyapplication httpport-misuse im reset!application im yahooserver permit name scs.msg.yahoo.comserver permit name scsa.msg.yahoo.comserver permit name scsb.msg.yahoo.comserver permit name scsc.msg.yahoo.comservice text-chat action allowservice default action reset!application im aolserver deny name login.user1.aol.com!application im msnserver deny name messenger.hotmail.com!ip inspect name test appfw my-im-policyinterface FastEthernet0/0description Inside interfaceip inspect test inRelated Commands
appfw policy-name
Defines an application firewall policy and puts the router in application firewall policy configuration mode.
application redundancy
To enter redundancy application configuration mode, use the application redundancy command in redundancy configuration mode.
application redundancy
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Redundancy configuration (config-red)
Command History
Examples
The following example shows how to enter redundancy application configuration mode:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)#Related Commands
arap authentication
To enable authentication, authorization, and accounting (AAA) authentication for AppleTalk Remote Access Protocol (ARAP) on a line, use the arap authentication command in line configuration mode. To disable authentication for an ARAP line, use the no form of this command.
arap authentication {default | list-name} [one-time]
no arap authentication {default | list-name}
Caution
Syntax Description
Defaults
ARAP authentication uses the default set with aaa authentication arap command. If no default is set, the local user database is checked.
Command Modes
Line configuration
Command History
Usage Guidelines
This command is a per-line command that specifies the name of a list of AAA authentication methods to try at login. If no list is specified, the default list is used (whether or not it is specified in the command line). You create defaults and lists with the aaa authentication arap command. Entering the no version of arap authentication has the same effect as entering the command with the default keyword. Before issuing this command, create a list of authentication processes by using the aaa authentication arap global configuration command.
Examples
The following example specifies that the TACACS+ authentication list called MIS-access is used on ARAP line 7:
line 7arap authentication MIS-accessRelated Commands
aaa authentication arap
Enables an AAA authentication method for ARAP using TACACS+.
ase collector
Note
To enter the destination IP address of the Automatic Signature Extraction (ASE) collector server, use the ase collector command in global configuration mode. To remove this IP address, use the no form of this command.
ase collector ip-address
no ase collector ip-address
Syntax Description
Command Default
No ASE collector IP address is specified.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
This command is used on the Cisco 1800, 2800, and 7200 series routers, Cisco 7301 router, and Integrated Services Routers (ISRs) as ASE sensors.
Examples
The following example shows how to configure an ASE collector IP address:
Router(config)# ase collector 10.10.10.3Related Commands
ase enable
Note
To enable the Automatic Signature Extraction (ASE) feature on a specified interface, use the ase enable command in interface configuration mode. To disable the ASE feature on a specified interface, use the no form of this command.
ase enable
no ase enable
Syntax Description
This command has no arguments or keywords.
Command Default
The ASE feature is disabled on an interface.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
This command is used on the Cisco 1800, 2800, and 7200 series routers, Cisco 7301 router, and Integrated Services Routers (ISRs) as ASE sensors.
Examples
The following example shows how to enable the ASE feature on a specified interface:
Router(config-if)# ase enableRelated Commands
ase group
Note
To identify the Threat Information Distribution Protocol (TIDP) group number used for exchange between the Automatic Signature Extraction (ASE) sensor and ASE collector, use the ase group command in global configuration mode. To disable this group number, use the no form of this command.
ase group TIDP-group-number
no ase group TIDP-group-number
Syntax Description
TIDP-group-number
TIDP group number for the ASE feature. The range of group numbers is between 1 and 65535.
Command Default
No TIDP group number is specified.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
This command is used on the Cisco 1800, 2800, and 7200 series routers, Cisco 7301 router, and Integrated Services Routers (ISRs) as ASE sensors.
Examples
The following example shows how to configure a TIDP group number for the ASE feature:
Router(config)# ase group 10Related Commands
ase signature extraction
Note
To enable the Automatic Signature Extraction (ASE) feature globally on the router, use the ase signature extraction command in global configuration mode. To disable the ASE feature globally on the router, use the no form of this command.
ase signature extraction
no ase signature extraction
Syntax Description
This command has no arguments or keywords.
Command Default
The ASE feature is disabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
This command is used on the Cisco 1800, 2800, and 7200 series routers, Cisco 7301 router, and Integrated Services Routers (ISRs) as ASE sensors.
Examples
The following example shows how to enable the ASE feature globally on the router:
Router(config)# ase signature extractionRelated Commands
attribute (server-group)
To add attributes to an accept or reject list, use the attribute command in server-group configuration mode. To remove attributes from the list, use the no form of this command.
attribute number [number [number]...]
no attribute number [number [number]...]
Syntax Description
Defaults
If this command is not enabled, all attributes are sent to the network access server (NAS).
Command Modes
Server-group configuration
Command History
Usage Guidelines
Used in conjunction with the radius-server attribute list command (which defines the list name), the attribute command can be used to add attributes to an accept or reject list (also known as a filter). Filters are used to prevent the network access server (NAS) from receiving and processing unwanted attributes for authorization or accounting.
The attribute command can be used multiple times to add attributes to a filter. However, if a required attribute is specified in a reject list, the NAS will override the command and accept the attribute. Required attributes are as follows:
Note
•
–
–
–
•
–
–
–
–
Note
Examples
The following example shows how to add attributes 2, 4, 12, 217, 6-10, 13, 64-69, and 218 to the list name "standard":
radius-server attribute list standardattribute 2,4,12,217,6-10,13attribute 64-69,218Related Commands
attribute map
To attach an attribute map to a particular Lightweight Directory Access Protocol (LDAP) server, use the attribute map command in LDAP server configuration mode. To remove the attribute maps, use the no form of this command.
attribute map map-name
no attribute map map-name
Syntax Description
Command Default
No attribute maps exist for any LDAP servers.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Usage Guidelines
To use the attribute mapping features correctly, you need to understand the Cisco LDAP attribute names and values as well as the user-defined attribute names and values.
Examples
The following example shows how to attach an attrribute map named attribute att_map_1 in an LDAP server:
Router(config)# ldap server server1Router(config-ldap-server)# attribute map att_map_1Related Commands
attribute nas-port format
To configure services to use specific named methods for different service types, which can be set to use their own respective RADIUS server groups, use the attribute nas-port format command in server-group configuration mode. To remove the override, which is to use specific named methods for different service types, use the no form of this command.
attribute nas-port format format-type [string]
no attribute nas-port format format-type [string]
Syntax Description
format-type
Type of format (see Table 13).
string
(Optional) Pattern of the data format (see Table 14).
Defaults
Default format type is used for all services.
Command Modes
Server-group configuration
Command History
12.3(14)T
This command was introduced.
12.2(28)SB
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
The following format types may be configured.
Table 13 Format Types
a
Format is type, channel, or port.
b
Either interface(16), isdn(16), or async(16).
c
Data format (bits): shelf(2), slot(4), port(5), or channel(5).
d
Data format (bits): slot(4), module(1), port(3), vpi(8), or vci(16).
e
Configurable data format (see Table 14).
The following characters may be used in the string pattern of the data format.
Examples
The following example shows that a leased-line PPP client has chosen to send no RADIUS Attribute 5 while the default is set for format d:
interface Serial2/0no ip addressencapsulation pppppp accounting SerialAccountingppp authentication papaaa accounting network default start-stop group radiusaaa accounting network SerialAccounting start-stop group group1aaa group server radius group1server 10.101.159.172 auth-port 1645 acct-port 1646attribute nas-port noneradius-server host 10.101.159.172 auth-port 1645 acct-port 1646radius-server attribute nas-port format dRelated Commands
attribute type
To define an attribute type that is to be added to an attribute list locally on a router, use the attribute type command in global configuration mode. To remove the attribute type from the list, use the no form of this command.
attribute type name value [service service] [protocol protocol] [tag]
no attribute type name value [service service] [protocol protocol] [tag]
Syntax Description
Command Default
An attribute type is not added to the attribute list.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Attributes are added to the attribute list each time a new attribute type is defined. Attributes are not validated at configuration. The AAA subsystem "knows" only the format that is expected by the services when the service defines a given attribute inside a definition file. However, it cannot validate the attribute information itself. This validation is done by a service when it first uses the attribute. This validation is applicable to both RADIUS and TACACS+ AAA servers. Thus, if you are not familiar in configuring a AAA server, Cisco recommends that you test your attribute list on a test device with the service that will be using the list before configuring and using it in a production environment.
Examples
The following example shows that the attribute list named "TEST" is to be added to the subscriber profile "example.com." The attribute TEST includes the attribute types interface-config "ip unnumbered FastEthernet0" and interface-config "ip vrf forwarding vrf1."
aaa authentication ppp template1 localaaa authorization network template1 local!aaa attribute list TESTattribute type interface-config "ip unnumbered FastEthernet0" service ppp protocol lcpattribute type interface-config "ip vrf forwarding vrf1" service ppp protocol lcp!ip vrf bluedescription vrf vrf1 template1rd 1:1route-target export 1:1route-target import 1:1!subscriber authorization enable!subscriber profile example.comservice localaaa attribute list TEST!bba-group pppoe grp1virtual-template 1service profile example.com!interface Virtual-Template1no ip addressno snmp trap link-statusno peer default ip addressno keepaliveppp authentication pap template1ppp authorization template1!
Related Commands
audit filesize
To change the size of the audit file, use the audit filesize command in global configuration mode. To return the audit file to its default size, use the no form of this command.
audit filesize size
no audit filesize size
Syntax Description
size
Size of the audit file in KB. Valid values range from 32 KB to 128 KB.
32 KB is the default size.
Defaults
The audit file is 32 KB.
Command Modes
Global configuration
Command History
Usage Guidelines
The audit file is a fixed file size in the disk file system. The audit file contains syslog messages (also referred to as hashes), which monitor changes that have been made to your router. Because the audit file that is stored on the disk is circular, the number of messages that can be stored is dependent on the size of the selected file. Also, the size determines the number of messages that can be stored on the disk before a wrap around occurs.
You should always ensure that the audit file is secure. The audit file should be access protected so that only the audit subsystem can access it.
Note
Examples
The following example shows how to change the audit file size to 128 KB:
Router(config)# audit filesize 128Related Commands
audit interval
Changes the time interval that is used for calculating hashes.
show audit
Displays contents of the audit file.
audit interval
To change the time interval that is used for calculating hashes, use the audit interval command in global configuration mode. To return to the default value, which is 5 minutes, use the no form of this command.
audit interval seconds
no audit interval seconds
Syntax Description
seconds
Time interval, in seconds, between hash calculations. Valid values range from 120 seconds to 3600 seconds. The default value is 300 seconds (5 minutes).
Defaults
300 seconds (5 minutes)
Command Modes
Global configuration
Command History
Usage Guidelines
Hashes are used to monitor changes in your router. A separate hash is maintained for each of the following areas:
•
•
•
•
•
By default, the hashes are calculated every 5 minutes to see if any changes (events) have been made to the network. The time interval prevents a large number of hashes from being generated.
Note
Examples
The following example shows how to specify hashes to be calculated every 120 seconds (2 minutes):
Router(config)# audit interval 120Related Commands
audit filesize
Changes the size of the audit file.
show audit
Displays contents of the audit file.
audit-trail
To enable message logging for established or torn-down connections, use the audit-trail command in the appropriate configuration mode. To return to the default value, use the no form of this command.
audit-trail {on | off}
no audit-trail {on | off}
Syntax Description
Defaults
If this command is not issued, the default value specified via the ip inspect audit-trail command will be used.
Command Modes
cfg-appfw-policy-http configuration
cfg-appfw-policy-aim configuration
cfg-appfw-policy-ymsgr configuration
cfg-appfw-policy-msnmsgr configuration
Command History
12.3(14)T
This command was introduced.
12.4(4)T
Support for the inspection of instant messenger applications was introduced.
Usage Guidelines
The audit-trail command will override the ip inspect audit-trail global command.
Before you can issue the audit-trail command, you must enable protocol inspection via the application command, which allows you to specify whether you want to inspect HTTP traffic or instant messenger application traffic. The application command puts the router in appfw-policy-protocol configuration mode, where "protocol" is dependent upon the specified protocol.
Examples
The following example, which shows how to define the HTTP application firewall policy "mypolicy," enables audit trail messages for the given policy. This policy includes all supported HTTP policy rules. After the policy is defined, it is applied to the inspection rule "firewall," which will inspect all HTTP traffic entering the FastEthernet0/0 interface.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpaudit trail onstrict-http action allow alarmcontent-length maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!Related Commands
audit-trail (zone)
To turn audit trail messages on or off, use the audit-trail command in parameter-map type inspect configuration mode or URL parameter-map configuration mode. To disable this feature, use the no form of this command.
audit trail {on | off}
no audit trail {on | off}
Syntax Description
Command Default
There are no audit trail messages.
Command Modes
Parameter-map type inspect configuration
URL parameter-map configurationCommand History
Usage Guidelines
You can use the audit-trail subcommand when you are creating a parameter map. For each inspected protocol, you can set the audit trail to on or off.
When you are configuring an inspect type parameter map, you can enter the audit-trail subcommand after you enter the parameter-map type inspect command.
When you are creating or modifying a URL parameter map, you can enter the audit-trail subcommand after you enter the parameter-map type urlfilter command.
For more detailed information about creating a parameter map, see the parameter-map type inspect or parameter-map type urlfilter command.
Examples
The following example generates audit trail messages:
parameter-map type inspect insp-paramsaudit-trail onRelated Commands
authentication
To configure clear text authentication and MD5 authentication under a redundancy group protocol, use the authentication command in redundancy application protocol configuration mode. To disable the authentication settings in the redundancy group, use the no form of this command.
authentication {text string | md5 key-string [0 | 7] key | md5 key-chain key-chain-name}
no authentication {text string | md5 key-string [0 | 7] key | md5 key-chain key-chain-name}
Syntax Description
Command Default
The key is not encrypted.
Command Modes
Redundancy application protocol configuration (config-red-app-prtcl)
Command History
Examples
The following example shows how to configure clear text authentication for a redundancy group:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# protocol 1Router(config-red-app-prtcl)# authentication text name1Related Commands
authentication (IKE policy)
To specify the authentication method within an Internet Key Exchange (IKE) policy, use the authentication command in ISAKMP policy configuration mode. IKE policies define a set of parameters to be used during IKE negotiation. To reset the authentication method to the default value, use the no form of this command.
authentication {rsa-sig | rsa-encr | pre-share | ecdsa-sig}
no authentication
Syntax Description
Command Default
The RSA signatures authentication method is used.
Command Modes
ISAKMP policy configuration (config-isakmp)
Command History
Usage Guidelines
Use this command to specify the authentication method to be used in an IKE policy.
If you specify RSA signatures, you must configure your peer routers to obtain certificates from a certification authority (CA).
If you specify RSA encrypted nonces, you must ensure that each peer has the other peer's RSA public keys. (See the crypto key pubkey-chain rsa, addressed-key, named-key, address, and commands.)
If you specify preshared keys, you must also separately configure these preshared keys. (See the crypto isakmp identity and crypto isakmp key commands.)
Examples
The following example configures an IKE policy with preshared keys as the authentication method (all other parameters are set to the defaults):
Router(config)# crypto isakmp policy 15Router(config-isakmp)# authentication pre-shareRouter(config-isakmp)# exitRelated Commands
authentication (IKEv2 profile)
To specify the local and remote authentication methods in an Internet Key Exchange Version 2 (IKEv2) profile, use the authentication command in IKEv2 profile configuration mode. To delete the authentication method, use the no form of this command.
authentication {local {rsa-sig | pre-share | ecdsa-sig} | remote {eap [query-identity]| rsa-sig | pre-share | ecdsa-sig}
no authentication {local {rsa-sig | pre-share | ecdsa-sig} | remote {eap | rsa-sig | pre-share | ecdsa-sig}
Syntax Description
Command Default
The default local and remote authentication method is pre-share.
Command Modes
IKEv2 profile configuration (crypto-ikev2-profile)
Command History
Usage Guidelines
Use this command to specify the local and remote authentication methods in an IKEv2 profile. You can configure only one local authentication method and multiple remote authentication methods. Multiple remote authentication methods are allowed as the profile caters to multiple peers and the authentication method that a peer uses is not known. However, each remote authentication method must be specified in a separate command.
If the RSA signature is configured as the local or remote authentication method, you must specify the PKI trustpoints to obtain the signing and verification certificates using the pki trustpoint command.
If a preshared key is configured as the local or remote authentication method, you must separately configure the preshared keys and the keyring using the command keyring to specify the local and remote keys.
If the query-identity keyword is specified, the EAP identity request is sent when the remote peer indicates the intent to use EAP authentication by skipping Auth payload in the IKE-AUTH request and the local policy allows EAP authentication for remote peer. The remote EAP identity is used in the following scenarios:
•
•
•
Examples
The following example shows how to specify an authentication method to an IKEv2 profile:
Router(config)# crypto ikev2 profile profile1Router(config-ikev2-profile)# match identity remote address 192.168.1.1Router(config-ikev2-profile)# authentication local pre-shareRouter(config-ikev2-profile)# authentication remote pre-shareRouter(config-ikev2-profile)# authentication remote rsa-sigRouter(config-ikev2-profile)# identity local email user1@abc.comRouter(config-ikev2-profile)# keyring keyring-1Router(config-ikev2-profile)# pki trustpoint tp-remote verifyIn the above example, the profile profile1 specifies pre-share as the local authentication method and pre-share and rsa-sig as the remote authentication methods that use keyring keyring-1 and the trustpoint tp-remote.
The following example shows how to configure an IKEv2 profile for two peers using different authentication methods:
Router(config)# crypto ikev2 profile profile2Router(config-ikev2-profile)# match identity local email user1@abc.comRouter(config-ikev2-profile)# match identity remote email user2@abc.comRouter(config-ikev2-profile)# authentication local pre-shareRouter(config-ikev2-profile)# authentication remote pre-shareThe above profile caters to two peers: user1@abc.com authenticated with pre-share and user2@abc.com authenticated with rsa-signature.
Related Commands
authentication bind-first
To configure the sequence of search and bind of an authentication request in the Lightweight Directory Access Protocol (LDAP) server, use the authentication bind-first command in LDAP server configuration mode. To remove the search and bind configuration, use the no form of this command.
authentication bind-first
no authentication bind-first
Syntax Description
This command has no arguments or keywords.
Command Default
The search operation is performed first and bind operation is performed later.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Usage Guidelines
In an LDAP deployment, search operation is performed first and bind operation is performed later. This operation is performed because, if the password attribute is returned as part of the search operation, then password verification can be done locally on the LDAP client and there is no need for an extra bind operation. If the password attribute is not returned, a bind operation can be performed later. Another advantage of performing the search operation first and bind operation later is that the distinguished name (DN) received in the search result can be used as the user DN instead of forming a DN by prefixing the username (cn attribute) with base DN.
Examples
The following example shows how to configure the search and bind operations for an authentication request:
Router(config)# ldap server server1Router(config-ldap-server)# authentication bind-firstRelated Commands
authentication command
To specify the HTTP command that is sent to the certification authority (CA) for authentication, use the authentication command in ca-profile-enroll configuration mode.
authentication command {http-command}
Syntax Description
Defaults
No default behavior or values
Command Modes
Ca-profile-enroll configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
Use the authentication command to send the HTTP request to the CA server for certificate authentication. Before enabling this command, you must use the authentication url command.
After enabling this command, you can use the parameter command to specify enrollment parameters for your enrollment profile.
Examples
The following example shows how to configure certificate authentication via HTTP for the enrollment profile named "E":
crypto ca trustpoint Entrustenrollment profile Eserialcrypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
authentication command bounce-port ignore
To configure the router to ignore a RADIUS Change of Authorization (CoA) bounce port command, use the authentication command bounce-port ignore command in global configuration mode. Use the no form of this command to return to the default status.
authentication command bounce-port ignore
no authentication command bounce-port ignore
Syntax Description
This command has no arguments or keywords.
Defaults
The router accepts a RADIUS CoA bounce port command.
Command Modes
Global configuration
Command History
12.2(52)SE
This command was introduced.
12.2(33)SXI4
This command was integrated into Cisco IOS Release 12.2(33)SXI4.
Usage Guidelines
A RADIUS CoA bounce port command sent from a RADIUS server can cause a link flap on an authentication port, which triggers DHCP renegotiation from one or more hosts connected to this port. This incident can occur when there is a VLAN change and the endpoint is a device (such as a printer), that does not have a mechanism to detect a change on this authentication port. The authentication command bounce-port ignore command configures the router to ignore the RADIUS CoA bounce port command to prevent a link flap from occuring on any host(s) that are connected to an authentication port.
Examples
This example shows how to configure the router to ignore a CoA bounce port command:
Router(config)# aaa new-modelRouter(config)# authentication command bounce-port ignoreRelated Commands
authentication command disable-port ignore
Configures the router to ignore a RADIUS server CoA disable port command.
authentication command disable-port ignore
To allow the router to ignore a RADIUS server Change of Authorization (CoA) disable port command, use the authentication command disable-port ignore command in global configuration mode. Use the no form of this command to return to the default status.
authentication command disable-port ignore
no authentication command disable-port ignore
Syntax Description
This command has no arguments or keywords.
Defaults
The router accepts a RADIUS CoA disable port command.
Command Modes
Global configuration
Command History
12.2(52)SE
This command was introduced.
12.2(33)SXI4
This command was integrated into Cisco IOS Release 12.2(33)SXI4.
Usage Guidelines
The RADIUS server CoA disable port command administratively shuts down the authentication port that is hosting a session, resulting in session termination. Use the authentication command disable-port ignore command to configure the router to ignore the RADIUS server CoA disable port command so that the authentication port and other hosts on this authentication port are not disconnected.
Examples
This example shows how to configure the router to ignore a CoA disable port command:
Router(config)# aaa new-modelRouter(config)# authentication command disable-port ignoreRelated Commands
authentication command bounce-port ignore
Configures the router to ignore a RADIUS server CoA bounce port command.
authentication compare
To replace a bind request with a compare request for an authentication, use the authentication compare command in LDAP server configuration mode. To disable the comparison of bind operations for the authentication requests, use the no form of this command.
authentication compare
no authentication compare
Syntax Description
This command has no arguments or keywords.
Command Default
Authentication request is performed with bind request.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Examples
The following example shows how to replace a bind request with a compare request for an authentication:
Router(config)# ldap server server1Router(config-ldap-server)# authentication compareRelated Commands
authentication control-direction
To set the direction of authentication control on a port, use the authentication control-direction command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication control-direction {both | in}
no authentication control-direction
Syntax Description
Command Default
The port is set to bidirectional mode.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The IEEE 802.1x standard is implemented to block traffic between the nonauthenticated clients and network resources. This means that nonauthenticated clients cannot communicate with any device on the network except the authenticator. The reverse is true, except for one circumstance—when the port has been configured as a unidirectional controlled port.
Unidirectional State
The IEEE 802.1x standard defines a unidirectional controlled port, which enables a device on the network to "wake up" a client so that it continues to be reauthenticated. When you use the authentication control-direction in command to configure the port as unidirectional, the port changes to the spanning-tree forwarding state, thus allowing a device on the network to wake the client, and force it to reauthenticate.
Bidirectional State
When you use the authentication control-direction both command to configure a port as bidirectional, access to the port is controlled in both directions. In this state, the port does not receive or send packets.
Examples
The following example shows how to enable unidirectional control:
Switch(config-if)# authentication control-direction inThe following examples show how to enable bidirectional control:
Switch(config-if)# authentication control-direction bothauthentication critical recovery delay
To configure the Auth Manager critical recovery delay, use the authentication critical recovery delay command in global configuration mode. To remove a previously configured recovery delay, us the no form of this command.
authentication critical recovery delay milliseconds
no authentication critical recovery delay
Syntax Description
milliseconds
The period of time, in milliseconds, that the Auth Manager waits to reinitialize a critical port when an unavailable RADIUS server becomes available; valid values are from 1 to 10000.
Command Default
The default delay is 1000 milliseconds.
Command Modes
Global configuration (config)
Command History
Examples
The following example shows how to configure the critical recovery delay period to 1500 milliseconds:
Switch(config)# authentication critical recovery delay 1500authentication event fail
To specify how the Auth Manager handles authentication failures as a result of unrecognized user credentials, use the authentication event fail command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication event fail [retry retry-count] action {authorize vlan vlan-id | next-method}
no authentication event fail
Syntax Description
Command Default
Authentication is attempted two times after the initial failed attempt.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Only the dot1x authentication method can signal this type of authentication failure.
Examples
The following example specifies that after three failed authentication attempts the port is assigned to a restricted VLAN:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet0/3Switch(config-if)# authentication event fail retry 3 action authorize vlan 40Switch(config-if)# endRelated Commands
authentication event no-response action
To specify how the Auth Manager handles authentication failures as a result of a nonresponsive host, use the authentication event no-response action command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication event no-response action authorize vlan vlan-id
no authentication event no-response
Syntax Description
authorize vlan vlan-id
Authorizes a restricted VLAN on a port after a failed authentication attempt.
Command Default
Authentication fails.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication event no-response action command to specify how to handle authentication failures as a result of a nonresponsive host.
Examples
The following example specifies that when authentication fails as a result of a non-responsive host, the port is assigned to a VLAN:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet0/3Switch(config-if)# authentication event no-response action authorize vlan 40Switch(config-if)# endRelated Commands
authentication event fail
Specifies how the Auth Manager handles authentication failures as a result of unrecognized user credentials
authentication event server alive action reinitialize
To reinitialize an authorized Auth Manager session when a previously unreachable authentication, authorization, and accounting (AAA) server becomes available, use the authentication event server alive action reinitialize command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication event server alive action reinitialize
no authentication event server alive action reinitialize
Syntax Description
This command has no arguments or keywords.
Command Default
The session is not reinitialized.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication event server alive action reinitialize command to reinitialize authorized sessions when a previously unreachable AAA server becomes available.
Examples
The following example specifies that authorized sessions are reinitialized when a previously unreachable AAA server becomes available:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet0/3Switch(config-if)# authentication event server alive action reinitializeSwitch(config-if)# endRelated Commands:
authentication event server dead action authorize
Specifies how to handle authorized sessions when the AAA server is unreachable.
authentication event server dead action authorize
To authorize Auth Manager sessions when the authentication, authorization, and accounting (AAA) server becomes unreachable, use the authentication event server dead action authorize command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication event server dead action authorize vlan vlan-id
no authentication event server dead action authorize
Syntax Description
Command Default
No session is authorized.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication event server dead action authorize command to authorize sessions even when the AAA server is unavailable.
Examples
The following example specifies that when the AAA server becomes unreachable, the port is assigned to a VLAN:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet0/3Switch(config-if)# authentication event server dead action authorize vlan 40Switch(config-if)# endRelated Commands
authentication event server alive action reinitialize
Reinitializes an authorized session when a previously unreachable AAA server becomes available.
authentication fallback
To enable a web authentication fallback method, use the authentication fallback command in interface configuration mode. To disable web authentication fallback, use the no form of this command.
authentication fallback fallback-profile
no authentication fallback
Syntax Description
Command Default
Web authentication fallback is not enabled.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication fallback command to specify the fallback profile for web authentication. Use the fallback profile command to specify the details of the profile.
Examples
The following example shows how to specify a fallback profile on a port:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet1/0/3Switch(config-if)# authentication fallback profile1Switch(config-if)# endRelated Commands
authentication host-mode
To allow hosts to gain access to a controlled port, use the authentication host-mode command in interface configuration mode. To return to the default setting, use the no form of this command.
authentication host-mode {single-host | multi-auth | multi-domain | multi-host} [open]
no authentication host-mode
Syntax Description
Command Default
Access to a port is not allowed.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Before you use this command, you must use the authentication port-control command with the keyword auto.
In multi-host mode, only one of the attached hosts has to be successfully authorized for all hosts to be granted network access. If the port becomes unauthorized (reauthentication fails or an Extensible Authentication Protocol over LAN [EAPOL] logoff message is received), all attached clients are denied access to the network.
Examples
:The following example shows how to enable authentication in multi-host mode:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet2/0/1Switch(config-if)# authentication port-control autoSwitch(config-if)# authentication host-mode multi-hostauthentication list (tti-registrar)
To authenticate the introducer in an Secure Device Provisioning (SDP) transaction, use the authentication list command in tti-registrar configuration mode. To disable the authentication, use the no form of this command.
authentication list list-name
no authentication list list-name
Syntax Description
Defaults
An introducer is not authenticated.
Command Modes
tti-registrar configuration
Command History
Usage Guidelines
This command is used in SDP transactions. When the command is configured, the RADIUS or TACACS+ AAA server checks for a valid account by looking at the username and password.
The authentication list and the authorization list will usually both point to the same AAA list, but it is possible that the lists can be on different databases. This latter scenario is not recommended.
Examples
The following example shows that an authentication list named "authen-tac" has been configured. In this example, the authentication list is on a TACACS+ AAA server and the authorization list is on a RADIUS AAA server.
Router(config)# crypto wui tti registrarRouter(tti-registrar)# pki-server mycsRouter(tti-registrar)# authentication list authen-tacRouter(tti-registrar)# authorization list author-radRouter(tti-registrar)# template username ftpuser password ftppwdRouter(tti-registrar)# template config ftp://ftp-server/iossnippet.txtRouter(tti-registrar)# endRelated Commands
authentication open
To enable open access on this port, use the authentication open command in interface configuration mode. To disable open access on this port, use the no form of this command.
authentication open
no authentication open
Syntax Description
This command has no arguments or keywords.
Command Default
Disabled.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Open Access allows clients or devices to gain network access before authentication is performed.
You can verify your settings by entering the show authentication privileged EXEC command.
This command overrides the authentication host-mode session-type open global configuration mode command for the port only.
Examples
The following example shows how to enable open access to a port:
Router(config-if)# authentication openRouter(config-if)#The following example shows how to enable open access to a port:
Router(config-if)# no authentication openRouter(config-if)#Related Commands
authentication order
To specify the order in which the Auth Manager attempts to authenticate a client on a port, use the authentication order command in interface configuration mode. To return to the default authentication order, use the no form of this command.
authentication order {dot1x [mab | webauth] [webauth] | mab [dot1x | webauth] [webauth] | webauth}
no authentication order
Syntax Description
dot1x
Specifies IEEE 802.1X authentication.
mab
Specifies MAC-based authentication.
webauth
Specifies web-based authentication.
Command Default
The default authentication order is dot1x, mab, and webauth.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication order command to specify explicitly which authentication methods are run and the order in which they are run. Each method may be entered only once in the list and no method can be listed after webauth.
Examples
The following example sets the authentication order for a port:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet0/1Switch(config-if)# authentication order mab dot1xSwitch(config-if)# endSwitch#Related Commands
authentication periodic
To enable automatic reauthentication on a port, use the authentication periodic command in interface configuration mode. To disable, use the no form of this command.
Note
authentication periodic
no authentication periodic
Syntax Description
This command has no arguments or keywords.
Command Default
Reauthentication is disabled.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication periodic command to enable automatic reauthentication on a port. To configure the interval between reauthentication attempts, use the authentication timer reauthenticate command.
Examples
The following example enables reauthentication and sets the interval to 1800 seconds:
Switch(config)# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface fastethernet0/2Switch(config-if)# authentication periodicSwitch(config-if)# authentication timer reauthenticate 1800Related Commands
authentication timer reauthenticate
Specifies the period of time between attempts to reauthenticate an authorized port.
authentication port-control
To configure the authorization state of a controlled port, use the authentication port-control command in interface configuration mode. To disable the port-control value, use the no form of this command.
Note
authentication port-control {auto | force-authorized | force-unauthorized}
no authentication port-control
Syntax Description
Command Default
Ports authorized without authentication exchanges.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
To verify port-control settings, use the show interfaces command and check the Status column in the 802.1X Port Summary section of the display. An enabled status means that the port-control value is set to auto or to force-unauthorized.
The authentication process begins when the link state of the port transitions from down to up or when an EAPOL-start frame is received. The system requests the identity of the client and begins relaying authentication messages between the client and the authentication server.
Examples
The following specifies that the authorization status of the client will be determined by the authentication process:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface ethernet0/2Switch(config-if)# authentication port-control autoRelated Commands
authentication priority
To specify the priority of authentication methods on a port, use the authentication priority command in interface configuration mode. To return to the default, use the no form of this command.
authentication order {dot1x [mab | webauth] [webauth] | mab [dot1x | webauth] [webauth] | webauth}
no authentication order
Syntax Description
dot1x
Specifies IEEE 802.1X authentication.
mab
Specifies MAC-based authentication.
webauth
Specifies web-based authentication.
Command Default
The default priority order is dot1x, mab, and webauth.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
The authentication order command specifies the order in which authentication methods are attempted. This order is the default priority. To override the default priority and allow higher priority methods to interrupt a running authentication method, use the authentication priority command.
Examples
The following example configures the authentication order and the authentication priority on a port:
Switch# configure terminalSwitch(config)# interface fastethernet0/1Switch(config-if)# authentication order mab dot1x webauthSwitch(config-if)# authentication priority dot1x mabSwitch(config-if)# endSwitch#Related Commands
authentication order
Specifies the order in which the Auth Manager attempts to authenticate a client on a port.
authentication terminal
To manually cut-and-paste certificate authentication requests, use the authentication terminal command in ca-profile-enroll configuration mode. To delete a current authentication request, use the no form of this command.
authentication terminal
no authentication terminal
Syntax Description
This command has no arguments or keywords.
Defaults
An authentication request is not specified.
Command Modes
Ca-profile-enroll configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
A user may manually cut-and-paste certificate authentication requests when a network connection between the router and certification authority (CA) is not available. After this command is enabled, the authentication request is printed on the console terminal so that it can be manually copied (cut) by the user.
Examples
The following example shows how to specify manual certificate authentication and certificate enrollment via HTTP:
crypto ca profile enrollment Eauthentication terminalenrollment terminalenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
authentication timer inactivity
To configure the time after which an inactive Auth Manager session is terminated, use the authentication timer inactivity command in interface configuration mode. To disable the inactivity timer, use the no form of this command.
authentication timer inactivity {seconds | server}
no authentication timer inactivity
Syntax Description
Command Default
The inactivity timer is disabled.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
In order to prevent reauthentication of inactive sessions, use the authentication timer inactivity command to set the inactivity timer to an interval shorter than the reauthentication interval set with the authentication timer reauthenticate command.
Examples
The following example sets the inactivity interval on a port to 900 seconds:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface GigabitEthernet6/0Switch(config-if)# authentication timer inactivity 900Switch(config-if)# endRelated Commands
authentication timer reauthenticate
To specify the period of time between which the Auth Manager attempts to reauthenticate authorized ports, use the authentication timer reauthenticate command in interface configuration mode. To reset the reauthentication interval to the default, use the no form of this command.
authentication timer reauthenticate {seconds | server}
no authentication timer reauthenticate
Syntax Description
Command Default
The automatic reauthentication interval is set to 3600 seconds.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication timer reauthenticate command to set the automatic reauthentication interval of an authorized port. If you use the authentication timer inactivity command to configure an inactivity interval, configure the reauthentication interval to be longer than the inactivity interval.
Examples
The following example sets the reauthentication interval on a port to 1800 seconds:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface GigabitEthernet6/0Switch(config-if)# authentication timer reauthenticate 1800Switch(config-if)# endRelated Commands
authentication timer restart
To specify the period of time after which the Auth Manager attempts to authenticate an unauthorized port, use the authentication timer restart command in interface configuration mode. To reset the interval to the default value, use the no form of this command.
authentication timer restart seconds
no authentication timer restart
Syntax Description
seconds
The number of seconds between attempts to authenticate an unauthorized port. The range is 1 to 65535. The default is 60.
Command Default
No attempt is made to authenticate unauthorized ports.
Command Modes
Configuration interface (config-if)
Command History
Usage Guidelines
Use the authentication timer restart command to specify the interval between attempts to authenticate an unauthorized port. The default interval is 60 seconds.
Examples
The following example sets the authentication timer interval to 120 seconds:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface GigabitEthernet6/0Switch(config-if)# authentication timer restart 120Switch(config-if)# endRelated Commands
authentication trustpoint
To specify the trustpoint used to authenticate the Secure Device Provisioning (SDP) petitioner device's existing certificate, use the authentication trustpoint command in tti-registrar configuration mode. To change the specified trustpoint or use the default trustpoint, use the no form of this command.
authentication trustpoint {trustpoint-label | use-any}
no authentication trustpoint {trustpoint-label | use-any}
Syntax Description
Defaults
If this command is not specified, the petitioner-signing certificate is not verified.
Command Modes
tti-registrar configuration
Command History
Usage Guidelines
Issue the authentication trustpoint command in tti-registrar configuration mode to validate the signing certificate that the petitioner used.
Examples
The following example shows how to specify the trustpoint mytrust for the petitioner-signing certificate:
crypto provisioning registrarauthentication trustpoint mytrustAfter the SDP exchange is complete, the petitioner automatically enrolls with the registrar and obtains a certificate. The following sample output from the show running-config command shows an automatically generated configuration with the default trustpoint tti:
crypto pki trustpoint ttienrollment url http://pki1-36a.cisco.com:80revocation-check crlrsakeypair tti 1024auto-enroll 70Related Commands
authentication violation
To specify the action to be taken when a security violation occurs on a port, use the authentication violation command in interface configuration mode. To return to the default action, use the no form of this command.
authentication violation {restrict | shutdown}
no authentication violation
Syntax Description
restrict
Specifies that the port restrict traffic with the domain from which the security violation occurs.
shutdown
Specifies that the port shuts down upon a security violation.
Command Default
Ports are shut down when a security violation occurs.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Use the authentication violation command to specify the action to be taken when a security violation occurs on a port.
Examples
The following example configures the GigabitEthernet interface to restrict traffic when a security violation occurs:
Switch(config)# interface GigabitEthernet6/2Enter configuration commands, one per line. End with CNTL/Z.Switch(config-if)# authentication violation restrictSwitch(config-if)# endauthentication url
To specify the URL of the certification authority (CA) server to which to send authentication requests, use the authentication url command in ca-profile-enroll configuration mode. To delete the authentication URL from your enrollment profile, use the no form of this command.
authentication url url
no authentication url url
Syntax Description
Defaults
Your router does not recognize the CA URL until you declare one using this command.
Command Modes
Ca-profile-enroll configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
If you do not specify the authentication command after you enable the authentication url command, the authentication url command functions the same as the enrollment url url command in trustpoint configuration mode. That is, the authentication url command will then be used only for certificate enrollment—not authentication.
This command allows the user to specify a different URL or a different method for authenticating a certificate and enrolling a certificate; for example, manual authentication and TFTP enrollment.
Examples
The following example shows how to configure an enrollment profile for direct HTTP enrollment with a CA server. In this example, the authentication command is also present.
crypto ca trustpoint Entrustenrollment profile Eserialcrypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001The following example shows how to configure the enrollment profile named "E" to perform certificate authentication via HTTP and manual certificate enrollment:
crypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment terminalparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
authorization
To enable authentication, authorization, and accounting (AAA) authorization for a specific line or group of lines, use the authorization command in line configuration mode. To disable authorization, use the no form of this command.
authorization {arap | commands level | exec | reverse-access} [default | list-name]
no authorization {arap | commands level | exec | reverse-access} [default | list-name]
Syntax Description
Defaults
Authorization is not enabled.
Command Modes
Line configuration
Command History
Usage Guidelines
After you enable the aaa authorization command and define a named authorization method list (or use the default method list) for a particular type of authorization, you must apply the defined lists to the appropriate lines for authorization to take place. Use the authorization command to apply the specified method lists (or if none is specified, the default method list) to the selected line or group of lines.
Examples
The following example enables command authorization (for level 15) using the method list named charlie on line 10:
line 10authorization commands 15 charlieRelated Commands
authorization (server-group)
To filter attributes in outbound Access Requests to the RADIUS server for purposes of authentication or authorization, use the authorization command in server-group configuration mode. To remove the filter on the authorization request or reply, use the no form of the command.
authorization [request | reply] [accept | reject] list-name
no authorization [request | reply] [accept | reject] list-name
Syntax Description
Command Default
If specific attributes are not accepted or rejected, all attributes will be accepted.
Command Modes
Server-group configuration
Command History
Usage Guidelines
An accept or reject list (also known as a filter) for RADIUS authorization allows users to configure the network access server (NAS) to restrict the use of specific attributes, thereby preventing the NAS from processing unwanted attributes.
Only one filter may be used for RADIUS authorization per server group.
Note
Examples
The following example shows how to configure accept list "min-author" in an Access-Accept packet from the RADIUS server:
aaa new-modelaaa authentication ppp default group radius-sgaaa authorization network default group radius-sgaaa group server radius radius-sgserver 10.1.1.1authorization accept min-author!radius-server host 10.1.1.1 key mykey1radius-server attribute list min-authorattribute 6-7The following example shows that the attribute "all-attr" will be rejected in all outbound authorization Access Request messages:
aaa group server radius rasserver 192.168.192.238 auth-port 1745 acct-port 1746authorization request reject all-attrRelated Commands
authorization (tti-registrar)
To enable authentication, authorization, and accounting (AAA) authorization for an introducer or a certificate, use the authorization command in tti-registrar configuration mode. To disable authorization, use the no form of this command.
authorization {login} | {certificate} | {login certificate}
no authorization {login} | {certificate} | {login certificate}
Syntax Description
Defaults
If an authorization list is configured, then authorization is enabled by default.
Command Modes
tti-registrar configuration
Command History
Usage Guidelines
This command controls the authorization of the introduction. Authorization can be based on the following:
•
•
•
If you issue the authorization login command, the introducer logs in with a username and password such as ttiuser and mypassword, which are used against the configured authorization list to contact the AAA server and determine the appropriate authorization.
If you issue the authorization certificate command, the certificate of the petitioner is used to build an AAA username, which is used to obtain authorization information.
If you issue the authorization login certificate command, authorization for the introducer combines with authorization for the petitioner's current certificate. This means that two AAA authorization lookups occur. In the first lookup, the introducer username is used to retrieve any AAA attributes associated with the introducer. The second lookup is done using the configured certificate name field. If an AAA attribute appears in both lookups, the second one prevails.
Examples
The following example shows how to specify authorization for both the introducer and the current certificate of the petitioner:
crypto provisioning registrarauthorization login certificateRelated Commands
authorization address ipv4
To specify a list of addresses for a Group Domain of Interpretation (GDOI) group, use the authorization address ipv4 command in GDOI local server configuration mode. To remove an address from the group, use the no form of this command.
authorization address ipv4 {access- list-name | access-list number}
no authorization address ipv4 {access- list-name | access-list number}
Syntax Description
access-list-name
Name of an access control list (ACL).
access-list number
Standard IP access list number. Value: 1 through 99
Command Default
A list of addresses is not specified.
Command Modes
GDOI local server configuration
Command History
Usage Guidelines
If the identity of the Internet Key Exchange (IKE) authentication matches an entry in the access control list, the address is authorized.
Examples
The following example shows that access list number 99 has been specified to be part of a GDOI group:
authorization address ipv4 99Related Commands
authorization identity
To specify an authorization identity for a Group Domain of Interpretation (GDOI) group based on a distinguished name (DN) or Fully Qualified Domain Name (FQDN), use the authorization identity command in GDOI local server configuration mode. To delete a GDOI group authorization identity, use the no form of this command.
authorization identity name
no authorization identity name
Syntax Description
Command Default
An authorization identity for a GDOI group is not defined.
Command Modes
GDOI local server configuration (gdoi-local-server)
Command History
Usage Guidelines
Cisco Group Encrypted Transport Virtual Private Network (GET VPN) supports GDOI group member (GM) authorization using the authorization identity command when using Public Key Infrastructure (PKI) authentication between the GM and a key server (KS).
An authorization identity for a GDOI group is used to restrict registration of group members within a GDOI group. In order to successfully register with the KS, the DN or FQDN of the group members should match the configured identity string in this command. Use the authorization identity command to configure an authorization identity for a GDOI group.
Examples
The following example specifies an authorization identity using a DN called GETVPN_FILTER for the GETVPN GDOI group:
Router(config)# crypto gdoi group GETVPNRouter(config-gdoi-group)# server localRouter(gdoi-local-server)# authorization identity GETVPN_FILTERRouter(gdoi-local-server)# exitRouter(config-gdoi-group)# exitRouter(config)# crypto indentity GETVPN_FILTERRelated Commands
authoization list (global)
To specify the authentication, authorization, and accounting (AAA) authorization list, use the authorization list command in global configuration mode. To disable the authorization list, use the no form of this command.
authorization list list-name
no authorization list list-name
Syntax Description
Defaults
An authorization list is not configured.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the authorization list command to specify a AAA authorization list. For components that do not support specifying the application label, a default label of "any" from the AAA server will provide authorization. Likewise, a label of "none" from the AAA database indicates that the specified certificate is not valid. (The absence of any application label is equivalent to a label of "none," but "none" is included for completeness and clarity.)
Examples
The following example shows that the AAA authorization list "maxaa" is specified:
aaa authorization network maxaaa group tacac+aaa new-modelcrypto ca trustpoint mscaenrollment url http://caserver.mycompany.comauthorization list maxaaauthorization username subjectname serialnumberRelated Commands
authorization username
Specifies the parameters for the different certificate fields that are used to build the AAA username.
authorization list (tti-registrar)
To specify the appropriate authorized fields for both the certificate subject name and the list of template variables to be expanded into the Cisco IOS command-line interface (CLI) snippet that is sent back to the petitioner in an Secure Device Provisioning (SDP) operation, use the authorization list command in tti-registrar configuration mode. To disable the subject name and list of template variables, use the no form of this command.
authorization list list-name
no authorization list list-name
Syntax Description
Defaults
There is no authorization list on the AAA server.
Command Modes
tti-registrar configuration
Command History
Usage Guidelines
This command is used in SDP operations. When the command is used, the RADIUS or TACACS+ AAA server stores the subject name and template variables. The name and variables are sent back to the petitioner in the Cisco IOS CLI snippets. This list and the authorization list are usually on the same database, but they can be on different AAA databases. (Storing lists on different databases is not recommended.)
When a petitioner makes an introducer request, multiple queries are sent to the AAA list database on the RADIUS or TACACS+ server. The queries search for entries of the following form:
user Password <userpassword>cisco-avpair="ttti:subjectname=<<DN subjectname>>"cisco-avpair="tti:iosconfig#<<value>>"cisco-avpair="tti:iosconfig#<<value>>"cisco-avpair="tti:iosconfig#=<<value>>"
Note
If a subject name was received in the authorization response, the TTI registrar stores it in the enrollment database, and that "subjectname" overrides the subject name that is supplied in the subsequent certificate request (PKCS10) from the petitioner device.
The numbered "tti:iosconfig" values are expanded into the TTI Cisco IOS snippet that is sent to the petitioner. The configurations replace any numbered ($1 through $9) template variable. Because the default Cisco IOS snippet template does not include the variables $1 through $9, these variables are ignored unless you configure an external Cisco IOS snippet template. To specify an external configuration, use the template config command.
Note
Examples
The following example shows that the authorization list name is "author-rad." In this example, the authentication list is on a TACACS+ AAA server and the authorization list is on a RADIUS AAA server.
Router(config)# crypto wui tti registrarRouter(tti-registrar)# pki-server mycsRouter(tti-registrar)# authentication list authen-tacRouter(tti-registrar)# authorization list author-radRouter(tti-registrar)# template username ftpuser password ftppwdRouter(tti-registrar)# template config ftp://ftp-server/iossnippet.txtRouter(tti-registrar)# endRelated Commands
authorization username
To specify the parameters for the different certificate fields that are used to build the authentication, authorization and accounting (AAA) username, use the authorization username command in global configuration mode. To disable the parameters, use the no form of this command.
authorization username {subjectname subjectname}
no authorization username {subjectname subjectname}
Syntax Description
Defaults
Parameters for the certificate fields are not specified.
Command Modes
Global configuration
Command History
12.3(1)
This command was introduced.
12.3(11)T
The all option for the subjectname argument was added.
12.2(18)SXE
This command was integrated into Cisco IOS Release 12.2(18)SXE.
Examples
The following example shows that the serialnumber option is to be used as the authorization username:
aaa authorization network maxaaa group tacac+aaa new-modelcrypto ca trustpoint mscaenrollment url http://caserver.mycompany.comauthorization list maxaaaauthorization username subjectname serialnumberRelated Commands
authorization username (tti-registrar)
To specify the parameters for the different certificate fields that are used to build the authentication, authorization, and accounting (AAA) username, use the authorization username command in tti-registrar configuration mode. To disable the parameters, use the no form of this command.
authorization username {subjectname subjectname}
no authorization username {subjectname subjectname}
Syntax Description
Defaults
Parameters for the certificate fields are not specified.
Command Modes
tti-registrar configuration
Command History
Examples
The following example shows that the serialnumber option is used as the authorization username:
aaa authorization network maxaaa group tacac+aaa new-modelcrypto ca trustpoint mscaenrollment url http://caserver.mycompany.comauthorization list maxaaaauthorization username subjectname serialnumberRelated Commands
authorize accept identity
To configure an identity policy profile, use the authorize accept identity command in parameter-map-type consent configuration mode. To remove an identity policy profile, use the no form of this command with the configured policy name.
authorize accept identity identity-policy-name
no authorize accept identity identity-policy-name
Syntax Description
Command Default
An identity policy does not exist.
Command Modes
Parameter-map-type consent (config-profile)
Command History
Usage Guidelines
If an identity policy is not configured, the interface policy will be used.
Examples
The following example shows how to configure accept policies within the consent-specific parameter maps:
parameter-map type consent consent_parameter_mapcopy tftp://192.168.104.136/consent_page.html flash:consent_page.htmlauthorize accept identity consent_identity_policytimeout file download 35791file flash:consent_page.htmllogging enabledexit!parameter-map type consent defaultcopy tftp://192.168.104.136/consent_page.html flash:consent_page.htmlauthorize accept identity test_identity_policytimeout file download 35791file flash:consent_page.htmllogging enabledexit!auth-type
To set policy for devices that are dynamically authenticated or unauthenticated, use the auth-type command in identity profile configuration mode. To remove the policy that was specified, use the no form of this command.
auth-type {authorize | not-authorize} policy policy-name
no auth-type {authorize | not-authorize} policy policy-name
Syntax Description
Defaults
A policy is not set for authorized or unauthorized devices.
Command Modes
Identity profile configuration
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
This command is used when a device is dynamically authenticated or unauthenticated by the network access device, and the device requires the name of the policy that should be applied for that authentication result.
Examples
The following example shows that 802.1x authentication applies to the identity policy "grant" for all dynamically authenticated hosts:
Router (config)# ip access-list extended allow-aclRouter (config-ext-nacl)# permit ip any anyRouter (config-ext-nacl)# exitRouter (config)# identity policy grantRouter (config-identity-policy)# access-group allow-aclRouter (config-identity-policy)# exitRouter (config)# identity profile dot1xRouter (config-identity-prof)# auth-type authorize policy grantRelated Commands
identity policy
Creates an identity policy.
identity profile dot1x
Creates an 802.1x identity profile.
auth-type (ISG)
To specify the type of authorization Intelligent Services Gateway (ISG) will use for RADIUS clients, use the auth-type command in dynamic authorization local server configuration mode. To return to the default authorization type, use the no form of this command.
auth-type {all | any | session-key}
no auth-type {all | any | session-key}
Syntax Description
Command Default
All attributes must match for authorization to be successful.
Command Modes
Dynamic authorization local server configuration
Command History
Usage Guidelines
An ISG can be configured to allow external policy servers to dynamically send policies to the ISG. This functionality is facilitated by the Change of Authorization (CoA) RADIUS extension. CoA introduced peer to peer capability to RADIUS, enabling ISG and the external policy server each to act as a RADIUS client and server. Use the auth-type command to specify the type of authorization ISG will use for RADIUS clients.
Examples
The following example configures the ISG authorization type:
aaa server radius dynamic-authorclient 10.0.0.1auth-type anyRelated Commands
aaa server radius dynamic-author
Configures an ISG as a AAA server to facilitate interaction with an external policy server.
auto-enroll
To enable certificate autoenrollment, use the auto-enroll command in ca-trustpoint configuration mode. To disable certificate autoenrollment, use the no form of this command.
auto-enroll [percent] [regenerate]
no auto-enroll [percent] [regenerate]
Syntax Description
Command Default
Certificate autoenrollment is not enabled.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Use the auto-enroll command to automatically request a router certificate from the CA that is using the parameters in the configuration. This command will generate a new Rivest, Shamir, and Adelman (RSA) key only if a new key does not exist with the requested label.
A trustpoint that is configured for certificate autoenrollment will attempt to reenroll when the router certificate expires.
Use the regenerate keyword to provide seamless key rollover for manual certificate enrollment. A new key pair is created with a temporary name, and the old certificate and key pair are retained until a new certificate is received from the CA. When the new certificate is received, the old certificate and key pair are discarded and the new key pair is renamed with the name of the original key pair. Some CAs require a new key for reenrollment to work.
If the key pair being rolled over is exportable, the new key pair will also be exportable. The following comment will appear in the trustpoint configuration to indicate whether the key pair is exportable:
! RSA keypair associated with trustpoint is exportable
Note
Examples
The following example shows how to configure the router to autoenroll with the CA named "trustme1" on startup. In this example, the regenerate keyword is issued, so a new key will be generated for the certificate. The renewal percentage is configured as 90; so if the certificate has a lifetime of one year, a new certificate is requested 36.5 days before the old certificate expires.
crypto ca trustpoint trustme1enrollment url http://trustme1.example.com/subject-name OU=Spiral Dept., O=example1.comip-address ethernet0serial-number noneauto-enroll 90 regeneratepassword revokemersakeypair trustme1 2048exitcrypto ca authenticate trustme1Related Commands
crypto ca authenticate
Retrieves the CA certificate and authenticates it.
crypto ca trustpoint
Declares the CA that your router should use.
auto-rollover
To enable the automated certificate authority (CA) certificate rollover functionality, use the auto-rollover command in certificate server mode. To disable the automated rollover functionality, use the no form of this command.
auto-rollover [time-period]
no auto-rollover
Syntax Description
Defaults
Automated CA rollover is not enabled.
Command Modes
Certificate server configuration
Command History
Usage Guidelines
CAs, like their clients, have certificates with expiration dates that have to be reissued when the current certificate is about to expire. CAs also have key pairs used to sign client certificates. When the CA certificate is expiring it must generate a new certificate and possibly a new key pair. This process, called rollover, allows for continuous operation of the network while clients and the certificate server are switching from an expiring CA certificate to a new CA certificate.
The command auto-rollover initiates the automatic CA certificate rollover process.
Examples
The following example shows how to configure automated CA certificate rollover.
Router(config)# crypto pki server mycsRouter(cs-server)# auto-rollover 25Router(cs-server)# no shut%Some server settings cannot be changed after CA certificate generation.% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]% Exporting Certificate Server signing certificate and keys...% Certificate Server enabled.Router(cs-server)#With auto rollover enabled, the show crypto pki server command displays the current configuration of the certificate server.
Router# show crypto pki serverCertificate Server mycs:Status:enabledServer's configuration is locked (enter "shut" to unlock it)Issuer name:CN=mycsCA cert fingerprint:70AFECA9 211CDDCC 6AA9D7FF 3ADB03AEGranting mode is:manualLast certificate issued serial number:0x1CA certificate expiration timer:00:49:26 PDT Jun 20 2008CRL NextUpdate timer:00:49:29 PDT Jun 28 2005Current storage dir:nvram:Database Level:Minimum - no cert data written to storageAuto-Rollover configured, overlap period 25 daysAutorollover timer:00:49:26 PDT May 26 2008....Related Commands
auto secure
To secure the management and forwarding planes of the router, use the auto secure command in privileged EXEC mode.
auto secure [management | forwarding] [no-interact | full] [ntp | login | ssh | firewall | tcp-intercept]
Syntax Description
Defaults
Autosecure is not enabled.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The auto secure command allows a user to disable common IP services that can be exploited for network attacks by using a single CLI. This command eliminates the complexity of securing a router both by automating the configuration of security features and by disabling certain features that are enabled by default and that could be exploited for security holes.
Caution
This command takes you through a semi-interactive session (also known as the AutoSecure dialogue) in which to secure the management and forwarding planes. This command gives you the option to secure just the management or forwarding plane; if neither option is selected, the dialogue will ask you to configure both planes.
Caution
This command also allows you to go through all noninteractive configuration portions of the dialogue before the interactive portions. The noninteractive portions of the dialogue can be enabled by selecting the optional no-interact keyword.
Roll-back and System Logging Message Support
In Cisco IOS Release 12.3(8)T, support for roll-back of the AutoSecure configuration is introduced. Roll-back enables a router to revert back to its preautosecure configuration state if the AutoSecure configuration fails.
System Logging Messages capture any changes or tampering of the AutoSecure configuration that were applied on the running configuration.
Note
Examples
The following example shows how to enable AutoSecure to secure only the management plane:
Router# auto secure managementRelated Commands
ip http server
Enables the HTTP server on your system, including the Cisco web browser user interface.
show auto secure config
Displays AutoSecure configurations.
auto-update client
To configure automatic update parameters for an Easy VPN remote device, use the auto-update client command in global configuration mode. To disable the parameters, use the no form of this command.
auto-update client {type-of-system} {url url} {rev review-version}
no auto-update client {type-of-system} {url url} {rev review-version}
Syntax Description
type-of-system
Free-format string (see Table 15).
url url
URL from which the Easy VPN device obtains the automatic update.
rev review-version
The version number is a comma-delimited string of acceptable versions.
Command Default
Automatic updates cannot occur.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The URL is a generic way to specify the protocol, username, password, address of the server, directory, and filename. The format of a URL is as follows: protocol://username:password@server address:port/directory/filename.
The automatic update on the remote device is triggered only if the current version of the software is earlier than the one specified in the revision string. Otherwise, the automatic update is ignored.
Table 15 lists possible free-format strings to be used for the type-of-system argument.
Examples
The following example shows update parameters have been set for a Windows 2000 operating system, a URL of http:www.ourcompanysite.com/newclient, and versions 3.0.1(Rel) and 3.1(Rel):
crypto isakmp client configuration group {group-name}auto-update client Win2000 url http:www.ourcompanysite.com/newclient rev 3.0.1(Rel), 3.1(Rel)backoff exponential
To configure the router for exponential backoff retransmit of accounting requests per RADIUS server group, enter the backoff exponential command in server-group RADIUS configuration mode. To disable this functionality, use the no form of this command.
backoff exponential [max-delay minutes] [backoff-retry retransmits]
no backoff exponential [max-delay minutes] [backoff-retry retransmits]
Syntax Description
Command Default
This command is not enabled.
Command Modes
Server-group RADIUS configuration (config-sg-radius)
Command History
12.2(15)B
This command was introduced.
12.2(33)SRC
This command was integrated into Cisco IOS Release 12.2(33)SRC.
Usage Guidelines
Before enabling this command, you must configure the aaa group server radius command, which allows you to specify a server group and enter server-group RADIUS configuration mode.
The backoff exponential command allows you to configure an exponential backoff retransmission per RADIUS server group. That is, after the normally configured retransmission retries have been used, the router will keep on trying with an interval that doubles on each retransmit failure until a configured maximum interval is reached. This functionality allows you to retransmit accounting requests for many hours without overloading the RADIUS server when it does come back up.
Examples
The following example shows how to configure an exponential backoff retransmission:
aaa group server radius catbackoff exponential max-delay 90 backoff-retry 10Related Commands
backup-gateway
To configure a server to "push down" a list of backup gateways to the client, use the backup-gateway command in global configuration mode. To remove a backup gateway, use the no form of this command.
backup-gateway {ip-address | hostname}
no backup-gateway {ip-address | hostname}
Syntax Description
Defaults
A list of backup gateways is not configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Before using the backup-gateway command, you must first configure the crypto isakmp client configuration group command.
An example of an attribute-value (AV) pair for the backup gateway attribute is as follows:
ipsec:ipsec-backup-gateway=10.1.1.1
Note
•
Examples
The following example shows that gateway 10.1.1.1 has been configured as a backup gateway:
crypto isakmp client configuration group group1backup-gateway 10.1.1.1The following output example shows that five backup gateways have been configured:
crypto isakmp client configuration group sdmkey 6 RMZPPMRQMSdiZNJg`EBbCWTKSTi\d[pool POOL1acl 150backup-gateway 172.16.12.12backup-gateway 172.16.12.13backup-gateway 172.16.12.14backup-gateway 172.16.12.130backup-gateway 172.16.12.131max-users 250max-logins 2Related Commands
crypto isakmp client configuration group
Specifies to which group a policy profile will be defined.
banner
To configure an extended authentication (Xauth) banner string under a group policy definition, use the banner command in global configuration mode. To disable the banner, use the no form of this command.
banner c {banner-text} c
no c {banner-text} c
Syntax Description
Command Default
If a banner is not configured, a banner will not be displayed.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Follow this command with one or more blank spaces and a delimiting character of your choice. Then enter one or more lines of text, terminating the message with the second occurrence of the delimiting character.
Examples
The following example shows that the banner "The quick brown fox jumped over the lazy dog" has been specified:
crypto isakmp client configuration group EZVPNbanner @ The quick brown fox jumped over the lazy dog @Related Commands
crypto isakmp client configuration group
Specifies to which group a policy profile will be defined.
banner (WebVPN)
To configure a banner to be displayed after a successful login, use the banner command in webvpn group policy configuration mode. To remove the banner from the policy group configuration, use the no form of this command.
banner string
no banner
Syntax Description
string
Text string that contains 7-bit ASCII values and HTML tags and escape sequences. The text banner must be in quotation marks if it contains spaces.
Command Default
A banner is not displayed after a successful login.
Command Modes
Webvpn group policy configuration
Command History
Examples
The following example configures "Login Successful" to be displayed after login:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# banner "Login Successful"Router(config-webvpn-group)#Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
base-dn
To configure a base distinguished name (DN) that you want to use to perform search operations in the Lightweight Directory Access Protocol (LDAP) server directory tree, use the base-dn command in LDAP server configuration mode. To delete a configured base DN for the LDAP server, use the no form of this command.
base-dn string
no base-dn string
Syntax Description
Command Default
No distinguished names are created.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Usage Guidelines
This command is valid only for LDAP servers. A base DN can take a form such as dc=example,dc=domain, where the base DN uses the Domain Name Server (DNS) domain name as its basis and is split into the domain components.
Examples
The following example shows how to configure the base DN for an LDAP server:
Router(config)# ldap server server1Router(config-ldap-server)# base-dn "dc=sns,dc=example,dc=com"Related Commands
bidirectional
To enable incoming and outgoing IP traffic to be exported across a monitored interface, use the bidirectional command in router IP traffic export (RITE) configuration mode. To return to the default functionality, use the no form of this command.
bidirectional
no bidirectional
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not enabled, only incoming traffic is exported.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
By default, only incoming IP traffic is exported. If you choose to export outgoing IP traffic, you must issue both the bidirectional command, which enables outgoing traffic to be exported, and the outgoing command, which specifies how the outgoing traffic will be filtered.
The ip traffic-export profile command allows you to begin a profile that can be configured to export IP packets as they arrive or leave a selected router ingress interface. A designated egress interface exports the captured IP packets out of the router. Thus, the router can export unaltered IP packets to a directly connected device.
Examples
The following example shows how to export both incoming and outgoing IP traffic on the FastEthernet interface:
Router(config)# ip traffic-export profile johndoeRouter(config-rite)# interface FastEthernet1/0.1Router(config-rite)# bidirectionalRouter(config-rite)# incoming access-list 101Router(config-rite)# outgoing access-list 101Router(config-rite)# mac-address 6666.6666.3333Related Commands
binary file
To specify the binary file location on the registrar and the destination binary file location on the petitioner, use the binary file command in tti-registrar configuration mode.
binary file sourceURL destinationURL
Syntax Description
sourceURL
Specifies the source URL on the registrar for the binary file using one of the keywords in Table 15.
destinationURL
Specifies the destination URL on the petitioner for binary file using one of the keywords in Table 15.
Command Default
None
Command Modes
tti-registrar configuration (tti-registrar)
Command History
Usage Guidelines
Use the binary file command to specify the location where a binary file will be retrieved from and copied to during the Trusted Transitive Introduction (TTI) exchange. There may be up to nine binary files transferred, each with a different source and destination location. A destination URL could also be a token on the petitioner, such as usbtoken0:
The binary files are retrieved from the registrar and copied to the petitioner. Source URLs for the binary file location are expanded on the registrar. Destination URLs are expanded on the petitioner. Binary files are not processed through the binary expansion functions.
Examples
The following example shows how to specify on the registrar where the source binary files are located and where the binary files will be copied to on the petitioner:
crypto provisioning registrarpki-server cs1binary file http://myserver/file1 usbtoken0://file1binary file http://myserver/file2 flash://file2Related Commands
bind authenticate
To authenticate the client to a Lightweight Directory Access Protocol (LDAP) server, use the bind authenticate command in LDAP server configuration mode. To disable authenticated bind and to allow anonymous bind, use the no form of this command.
bind authenticate root-dn username password [0 string | 7 string] string
no bind authenticate root-dn username password [0 string | 7 string] string
Syntax Description
Command Default
Anonymous bind is performed. Anonymous bind refers to a simple bind operation with no DN and password.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Examples
The following example shows how to authenticate the user named user1 to the LDAP server using the password 123:
Router(config)# ldap server server1Router(config-ldap-server)# bind authenticate root-dn cn=user1,cn=users,dc=nac-blr2,dc=example,dc=com password 123Related Commands
block count
To lock out group members for a length of time after a set number of incorrect passwords are entered, use the block count command in local RADIUS server group configuration mode. To remove the user block after invalid login attempts, use the no form of this command.
block count count time {seconds | infinite}
no block count count time {seconds | infinite}
Syntax Description
Defaults
No default behavior or values
Command Modes
Local RADIUS server group configuration
Command History
Usage Guidelines
If the infinite keyword is entered, an administrator must manually unblock the locked username.
Examples
The following command locks out group members for 120 seconds after three incorrect passwords are entered:
Router(config-radsrv-group)# block count 3 time 120Related Commands
browser-attribute import
To import user-defined browser attributes into a webvpn context, use the browser-attribute import command in webvpn context configuration mode. To remove a browser attribute, use the no form of this command.
browser-attribute import device:file
no browser-attribute import device:file
Syntax Description
device:file
•
•
Command Default
Default values of the attributes are used.
Command Modes
Webvpn context configuration (config-webvpn-context)
Command History
Usage Guidelines
This command will override any other browser attributes that have already been configured using command-line interface (CLI).
Examples
The following example shows that the file "test-attr.xml" is to be imported from flash:
Router (config)# webvpn context sslvpnRouter (config-webvpn-context)# browser-attribute import flash:test-attr.xmlRelated Commands
webvpn create template
Creates templates for multilanguage support for messages in an SSL VPN.
browser-proxy
To apply browser-proxy parameter settings to a group, use the browser-proxy command in ISAKMP group configuration mode. To disable the parameter settings, use the no form of this command.
browser-proxy {browser-proxy-map-name}
no browser-proxy {browser-proxy-map-name}
Syntax Description
Command Default
Browser-proxy settings are not applied to a group.
Command Modes
ISAKMP group configuration (config-isakmp-group)
Command History
Usage Guidelines
Ensure that you define the browser proxy name before you define the crypto Internet Security Association and Key Management Protocol (ISAKMP) client configuration group name. The two names have to be the same.
Examples
The following example shows that browser proxy map "EZVPN" has been applied to the group "EZVPN":
crypto isakmp client configuration group EZVPNbrowser-proxy EZVPNRelated Commands
crypto isakmp client configuration group
Specifies to which group a policy profile will be defined.
