-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa nas Cisco-nas-port-use-async-info through alert-severity
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through issuer-name
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type inspect through show users
-
show vtemplate through switchport port-security violation
-
tacacs-server administration through tms-class
-
traffic-export through zone security
-
Table Of Contents
crypto isakmp aggressive-mode disable
crypto isakmp client configuration address-pool local
crypto isakmp client configuration browser-proxy
crypto isakmp client configuration group
crypto isakmp invalid-spi-recovery
crypto map client authentication list
crypto map client configuration address
crypto map isakmp authorization list
crypto map redundancy replay-interval
crypto mib ipsec flowmib history failure size
crypto mib ipsec flowmib history tunnel size
crypto isakmp aggressive-mode disable
To block all Internet Security Association and Key Management Protocol (ISAKMP) aggressive mode requests to and from a device, use the crypto isakmp aggressive-mode disable command in global configuration mode. To disable the blocking, use the no form of this command.
crypto isakmp aggressive-mode disable
no crypto isakmp aggressive-mode disable
Syntax Description
This command has no arguments or keywords.
Defaults
If this command is not configured, Cisco IOS software will attempt to process all incoming ISAKMP aggressive mode security association (SA) connections. In addition, if the device has been configured with the crypto isakmp peer address and the set aggressive-mode password or set aggressive-mode client-endpoint commands, the device will initiate aggressive mode if this command is not configured.
Command Modes
Global configuration
Command History
12.3(1)
This command was introduced on all Cisco IOS platforms that support IP Security (IPSec).
Usage Guidelines
If you configure this command, all aggressive mode requests to the device and all aggressive mode requests made by the device are blocked, regardless of the ISAKMP authentication type (preshared keys or Rivest, Shamir, and Adelman [RSA] signatures).
If a request is made by or to the device for aggressive mode, the following syslog notification is sent:
Unable to initiate or respond to Aggressive Mode while disabled
Note
This command will prevent Easy Virtual Private Network (Easy VPN) clients from connecting if they are using preshared keys because Easy VPN clients (hardware and software) use aggressive mode.
Examples
The following example shows that all aggressive mode requests to and from a device are blocked:
Router (config)# crypto isakmp aggressive-mode disablecrypto isakmp client configuration address-pool local
To configure the IP address local pool to reference Internet Key Exchange (IKE) on your router, use the crypto isakmp client configuration address-pool local command in global configuration mode. To restore the default value, use the no form of this command.
crypto isakmp client configuration address-pool local pool-name
no crypto isakmp client configuration address-pool local
Syntax Description
Defaults
IP address local pools do not reference IKE.
Command Modes
Global configuration
Command History
Examples
The following example references IP address local pools to IKE on your router, with "ire" as the pool-name:
crypto isakmp client configuration address-pool local ireRelated Commands
ip local pool
Configures a local pool of IP addresses to be used when a remote peer connects to a point-to-point interface.
crypto isakmp client configuration browser-proxy
To configure browser-proxy parameters for an Easy VPN remote device and to enter ISAKMP browser proxy configuration mode, use the crypto isakmp client configuration browser-proxy command in global configuration mode. To disable the browser-proxy parameters, use the no form of this command.
crypto isakmp client configuration browser-proxy {browser-proxy-name}
no crypto isakmp client configuration browser-proxy {browser-proxy-name}
Syntax Description
Command Default
Browser-proxy parameters are not set.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
While specifying the proxy server, the proxy IP address and port number are separated with a colon. The proxy exception list is a semicolon-delimited string of IP addresses.
After enabling this command, you may specify the following subcommand:
•
Examples
The following example shows various browser-proxy parameter settings for a browser proxy named "bproxy":
crypto isakmp client configuration browser-proxy bproxyproxy auto-detectcrypto isakmp client configuration browser-proxy bproxyproxy nonecrypto isakmp client configuration browser-proxy bproxyproxy server 10.1.1.1:2000proxy exception-list 10.2.2.*,www.*orgproxy by-pass-localRelated Commands
crypto isakmp client configuration group
To specify to which group a policy profile will be defined and to enter crypto ISAKMP group configuration mode, use the crypto isakmp client configuration group command in global configuration mode. To remove this command and all associated subcommands from your configuration, use the no form of this command.
crypto isakmp client configuration group {group-name | default}
no crypto isakmp client configuration group
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use the crypto isakmp client configuration group command to specify group policy information that needs to be defined or changed. You may wish to change the group policy on your router if you decide to connect to the client using a group ID that does not match the group-name argument.
After enabling this command, which puts you in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode, you can specify characteristics for the group policy using the following commands:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Output for the crypto isakmp client configuration group command (using the key subcommand) will show that the preshared key is either encrypted or unencrypted. An output example for an unencrypted preshared key would be as follows:
crypto isakmp client configuration group key testAn output example for a type 6 encrypted preshared key would be as follows:
crypto isakmp client configuration group
key 6 JK_JHZPeJV_XFZTKCQFYAABSession Monitoring and Limiting for Easy VPN Clients
It is possible to mimic the functionality provided by some RADIUS servers for limiting the number of connections to a specific server group and also for limiting the number of simultaneous logins for users in that group.
To limit the number of connections to a specific server group, use the max-users subcommand. To limit the number of simultaneous logins for users in the server group, use the max-logins subcommand.
The following example shows the RADIUS attribute-value (AV) pairs for the maximum users and maximum logins parameters:
ipsec:max-users=1000ipsec:max-logins=1The max-users and max-logins commands can be enabled together or individually to control the usage of resources by any groups or individuals.
If you use a RADIUS server, such as a CiscoSecure access control server (ACS), it is recommended that you enable this session control on the RADIUS server if the functionality is provided. In this way, usage can be controlled across a number of servers by one central repository. When enabling this feature on the router itself, only connections to groups on that specific device are monitored, and load-sharing scenarios are not accurately accounted for.
Examples
The following example shows how to define group policy information for Mode Configuration push. In this example, the first group name is "cisco" and the second group name is "default." Thus, the default policy will be enforced for all users who do not offer a group name that matches "cisco."
crypto isakmp client configuration group ciscokey ciscodns 10.2.2.2 10.2.2.3wins 10.6.6.6domain cisco.compool fredacl 199!crypto isakmp client configuration group defaultkey ciscodns 10.2.2.2 10.3.2.3pool fredacl 199Related Commands
crypto isakmp client firewall
To define the Central Policy Push (CPP) firewall policypush on a server, use the crypto isakmp client firewall command in global configuration mode. To remove the CPP that was configured, use the no form of this command.
crypto isakmp client firewall {policy-name} {required | optional} {firewall-type}
nocrypto isakmp client firewall {policy-name} {required | optional} {firewall-type}
Syntax Description
policy-name
Uniquely identifies a policy. A policy name can be associated with an Easy VPN client group configuration on the server (local group configuration) or on the authentication, authorization, and accounting (AAA) server.
required
Policy is mandatory. If the CPP policy is defined as mandatory and is included in the Easy VPN server configuration, the tunnel setup is allowed only if the Cisco VPN Client confirms this policy. If the policy is not confirmed, the tunnel is terminated.
optional
Policy is optional. If the CPP policy is defined as optional and is included in the Easy VPN server configuration, the tunnel setup continues even if the Cisco VPN Client does not confirm the defined policy.
firewall-type
Type of firewall. See Table 25 for a list of acceptable firewall types.
Command Default
CPP is not configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Table 25 lists firewall types that may be used for the firewall-type argument.
Table 25 Acceptable Firewall Types
Cisco-Integrated-firewall (central-policy-push)
Cisco-Security-Agent (check-presence)
Zonelabs-Zonealarm (both)
Zonelabs-ZonealarmPro (both)
Examples
The following example defines the CPP policy name as "hw-client-g-cpp." The "Cisco-Security-Agent" policy type is mandatory. The CPP inbound list is "192" and the outbound list is "sample":
crypto isakmp client firewall hw-client-g-cpp required Cisco-Security-Agentpolicy central-policy-push access-list in 192policy central-policy-push access-list out samplepolicy check-presenceRelated Commands
crypto isakmp default policy
To enable default policies for Internet Security Association and Key Management Protocol (ISAKMP) protection suite, use the crypto isakmp default policy command in global configuration mode. To disable the default IKE policies, use the no form of this command.
crypto isakmp default policy
no crypto isakmp default policy
Syntax Description
This command has no arguments or keywords.
Command Default
The default ISAKMP policies are enabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
If you have neither manually configured ISAKMP policies with the crypto isakmp policy command nor issued the no crypto isakmp default policy command, IPsec will use the default ISAKMP policies to negotiate IKE proposals. There are eight default ISAKMP default policies supported (see Table 26). The default ISAKMP policies define the following policy set parameters:
•
•
•
•
•
–
–
Examples
The following example disables the default ISAKMP policies and shows the resulting output of the show crypto isakmp default policy command, which is blank:
Router# configure terminalRouter(config)# no crypto isakmp default policyRouter(config)# exitRouter# show crypto isakmp default policyRouter#!There is no output since the default IKE policies have been disabled.The following example enables the default ISAKMP policies and displays the resulting output of the show crypto isakmp default policy command. The default policies are displayed because there are no user configured policies, and the default policies have not been disabled.
Router# configure terminalRouter(config)# crypto isakmp default policyRouter(config)# exitRouter# show crypto isakmp default policyDefault IKE policyDefault protection suite of priority 65507encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65508encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65509encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65510encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65511encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65512encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65513encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65514encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitRelated Commands
show crypto isakmp default policy
Displays the default ISAKMP policies currently in use.
crypto isakmp enable
To globally enable Internet Key Exchange (IKE) for your peer router, use the crypto isakmp enable command in global configuration mode. To disable IKE for the peer, use the no form of this command.
crypto isakmp enable
no crypto isakmp enable
Syntax Description
This command has no arguments or keywords.
Defaults
IKE is enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
IKE is enabled by default. IKE does not have to be enabled for individual interfaces, but is enabled globally for all interfaces at the router.
If you do not want IKE to be used for your IPSec implementation, you can disable IKE for all your IP Security peers. If you disable IKE for one peer, you must disable it for all IPSec peers.
If you disable IKE, you will have to make these concessions at the peers:
•
•
•
•
•
Note
Examples
The following example disables IKE at one peer. (The same command should be issued for all remote peers.)
no crypto isakmp enablecrypto isakmp fragmentation
To enable fragmentation of large Internet Key Exchange (IKE) packets into a series of smaller IKE packets to avoid fragmentation at the User Datagram Protocol (UDP) layer, use the crypto isakmp fragmentation command in global configuration mode. To disable fragmentation, use the no form of this command.
crypto isakmp fragmentation
no crypto isakmp fragmentation
Syntax Description
This command has no arguments or keywords.
Command Default
Fragmentation is not allowed.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Do not configure IKE fragmentation on a Cisco IOS router with Cisco Easy VPN Client versions 5.01 through 5.03. Versions earlier than version 5.01 and version 5.04 or a later release should be all right.
Examples
The following example shows that fragmentation has been enabled:
crypto isakmp fragmentationcrypto isakmp policy 1encryption 3descrypto isakmp profile ezvpn-SWmatch group frag-clientsvrf fragscrypto isakmp identity
To define the identity used by the router when participating in the Internet Key Exchange (IKE) protocol, use the crypto isakmp identity command in global configuration mode. Set an Internet Security Association Key Management Protocol (ISAKMP) identity whenever you specify preshared keys. To reset the ISAKMP identity to the default value (address), use the no form of this command.
crypto isakmp identity {address | hostname}
no crypto isakmp identity
Syntax Description
Command Default
The IP address is used for the ISAKMP identity.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to specify an ISAKMP identity either by IP address or by host name.
The address keyword is typically used when there is only one interface (and therefore only one IP address) that will be used by the peer for IKE negotiations, and the IP address is known.
The hostname keyword should be used if there is more than one interface on the peer that might be used for IKE negotiations, or if the interface's IP address is unknown (such as with dynamically assigned IP addresses).
As a general rule, you should set all peers' identities in the same way, either by IP address or by host name.
Examples
The following example uses preshared keys at two peers and sets both their ISAKMP identities to IP address.
At the local peer (at 10.0.0.1) the ISAKMP identity is set and the preshared key is specified.
crypto isakmp identity addresscrypto isakmp key sharedkeystring address 192.168.1.33At the remote peer (at 192.168.1.33) the ISAKMP identity is set and the same preshared key is specified.
crypto isakmp identity addresscrypto isakmp key sharedkeystring address 10.0.0.1
Note
The following example uses preshared keys at two peers and sets both their ISAKMP identities to host name.
At the local peer the ISAKMP identity is set and the preshared key is specified.
crypto isakmp identity hostnamecrypto isakmp key sharedkeystring hostname RemoteRouter.example.comip host RemoteRouter.example.com 192.168.0.1At the remote peer the ISAKMP identity is set and the same preshared key is specified.
crypto isakmp identity hostnamecrypto isakmp key sharedkeystring hostname LocalRouter.example.comip host LocalRouter.example.com 10.0.0.1 10.0.0.2In the above example, host names are used for the peers' identities because the local peer has two interfaces that might be used during an IKE negotiation.
In the above example the IP addresses are also mapped to the host names; this mapping is not necessary if the routers' host names are already mapped in DNS.
Related Commands
crypto ipsec security-association lifetime
Specifies the authentication method within an IKE policy.
crypto isakmp key
Configures a preshared authentication key.
crypto isakmp invalid-spi-recovery
To initiate the Internet Key Exchange (IKE) security association (SA) to notify the receiving IP Security (IPSec) peer that there is an "Invalid SPI" error, use the crypto isakmp invalid-spi-recovery command in global configuration mode. To disable the notification process, use the no form of this command.
crypto isakmp invalid-spi-recovery
no crypto isakmp invalid-spi-recovery
Syntax Description
This command has no arguments or keywords.
Defaults
The IKE notification process is not enabled.
Command Modes
Global configuration
Command History
12.3(2)T
This command was introduced.
12.2(18)SXE
This command was integrated into Cisco IOS Release 12.2(18)SXE.
Usage Guidelines
This command allows you to configure your router so that when an invalid security parameter index error (shown as "Invalid SPI") occurs, an IKE SA is initiated. The "IKE" module, which serves as a checkpoint in the IPSec session, recognizes the "Invalid SPI" situation. The IKE module then sends an "Invalid Error" message to the packet-receiving peer so that synchronization of the security association databases (SADBs) of the two peers can be attempted. As soon as the SADBs are resynchronized, packets are no longer dropped.
Note
Caution
Examples
The following example shows that the IKE module process has been initiated to notify the receiving peer that there is an "Invalid SPI" error:
Router (config)# crypto isakmp invalid-spi-recoverycrypto isakmp keepalive
To allow the gateway to send dead peer detection (DPD) messages to the peer, use the crypto isakmp keepalive command in global configuration mode. To disable keepalives, use the no form of this command.
crypto isakmp keepalive seconds [retries] [periodic | on-demand]
no crypto isakmp keepalive seconds [retries] [periodic | on-demand]
Syntax Description
Command Default
No DPD messages are sent.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use the crypto isakmp keepalive command to enable the gateway to send DPD messages to the peer. DPD is a keepalives scheme that allows the router to query the liveliness of its Internet Key Exchange (IKE) peer.
Use the periodic keyword to configure your router so that DPD messages are "forced" at regular intervals. This forced approach results in earlier detection of dead peers than with the on-demand approach. If you do not configure the periodic option, the router defaults to the on-demand approach.
Note
Note
Examples
The following example shows how to configure DPD messages to be sent every 60 seconds and every 5 seconds between retries if the peer does not respond:
crypto isakmp keepalive 60 5The following example shows that periodic DPD messages are to be sent at intervals of 10 seconds:
crypto isakmp keepalive 10 periodicThe following example shows that the above periodic behavior is being disabled:
crypto isakmp keepalive 10 on-demandThe following example shows that DPD has been configured with IPsec HA. The number of seconds between DPD messages is 10, and the number of seconds between DPD retries is 5. DPD messages are to be sent at regular intervals.
crypto isakmp keepalive 10 5 periodicRelated Commands
crypto isakmp key
To configure a preshared authentication key, use the crypto isakmp key command in global configuration mode. To delete a preshared authentication key, use the no form of this command.
crypto isakmp key enc-type-digit keystring {address peer-address [mask] | ipv6 ipv6-address/ipv6-prefix | hostname hostname} [no-xauth]
no crypto isakmp key enc-type-digit keystring {address peer-address [mask] | ipv6 ipv6-address/ipv6-prefix | hostname hostname} [no-xauth]
Syntax Description
Command Default
There is no default preshared authentication key.
Command Modes
Global configuration
Command History
Usage Guidelines
You must use this command to configure a key whenever you specify preshared keys in an Internet Key Exchange (IKE) policy; you must enable this command at both peers.
If an IKE policy includes preshared keys as the authentication method, these preshared keys must be configured at both peers—otherwise the policy cannot be used (the policy will not be submitted for matching by the IKE process). The crypto isakmp key command is the second task required to configure the preshared keys at the peers. (The first task is accomplished using the crypto isakmp identity command.)
Use the address keyword if the remote peer ISAKMP identity was set with its IP address.
With the address keyword, you can also use the mask argument to indicate the remote peer ISAKMP identity will be established using the preshared key only. If the mask argument is used, preshared keys are no longer restricted between two users.
Note
When using IKE main mode, preshared keys are indexed by IP address only because the identity payload has not yet been received. This means that the hostname keyword in the identity statement is not used to look up a preshared key and will be used only when sending and processing the identity payloads later in the main mode exchange. The identity keyword can be used when preshared keys are used with IKE aggressive mode, and keys may be indexed by identity types other than IP address as the identity payload is received in the first IKE aggressive mode packet.
If crypto isakmp identity hostname is configured as identity, the preshared key must be configured with the peer's IP address for the process to work when using IKE in main mode.
Use the no-xauth keyword to prevent the router from prompting the peer for Xauth information (username and password). This keyword disables Xauth for static IPSec peers. The no-xauth keyword should be enabled when configuring the preshared key for router-to-router IPSec—not VPN-client-to-Cisco-IOS IPSec.
Output for the crypto isakmp key command will show that the preshared key is either encrypted or unencrypted. An output example for an unencrypted preshared key would be as follows:
crypto isakmp key test123 address 10.1.0.1An output example for a type 6 encrypted preshared key would be as follows:
crypto isakmp key 6 RHZE[JACMUI\bcbTdELISAAB address 10.1.0.1Examples
In the following example, the remote peer "RemoteRouter" specifies an ISAKMP identity by address:
