-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Feedback
Table Of Contents
enrollment terminal (ca-profile-enroll)
enrollment terminal (ca-trustpoint)
enrollment url (ca-profile-enroll)
enrollment url (ca-trustpoint)
eap
Note
This command is removed effective with Cisco IOS Release 12.4(6)T.
To specify Extensible Authentication Protocol- (EAP-) specific parameters, use the eap command in identity profile configuration mode. To disable the parameters that were set, use the no form of this command.
eap {username name | password password}
no eap {username name | password password}
Syntax Description
username name
Username that will be sent to Request-Id packets.
password password
Password that should be used when replying to an Message Digest 5 (MD5) challenge.
Defaults
EAP parameters are not set.
Command Modes
Identity profile configuration
Command History
Usage Guidelines
Use this command if your router is configured as a supplicant. This command provides the means for configuring the identity and the EAP MD5 password that will be used by 802.1X to authenticate.
Examples
The following example shows that the EAP username "user1" has been configured:
Router (config)# identity profile dot1xRouter (config-identity-prof)# eap username user1Related Commands
eap (IKEv2 profile)
To derive the name mangler from the remote identity of type Extensible Authentication Protocol (EAP), use the eap command in IKEv2 name mangler configuration mode. To remove the name derived from EAP, use the no form of this command.
eap {all | dn {common-name | country | domain | locality | organization | organization-unit | state} {prefix | suffix {delimiter {. | @ | \}}}
no eap
Syntax Description
Command Default
No default behavior or values.
Command Modes
IKEv2 name mangler configuration (config-ikev2-name-mangler)
Command History
15.1(3)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to derive the name mangler from any field in the remote identity of type EAP.
Examples
The following example shows how to derive a name for the name mangler from a specific delimiter in EAP prefix:
Router(config)# crypto ikev2 name-mangler mangler2Router(config-ikev2-name-mangler)# eap prefix delimiter @Related Commands
eckeypair
To configure the trustpoint to use an Elliptic Curve (EC) key on which certificate requests are generated using ECDSA signatures, use the eckeypair command in ca-trustpoint configuration mode. To remove the encryption key, use the no form of this command.
eckeypair label
no eckeypair label
Syntax Description
label
Specifies the EC key label that is configured using the crypto key generate rsa or crypto key generate ec keysize command in global configuration mode. See the Configuring Internet Key Exchange for IPsec VPNs feature module for more information.
Command Default
The trustpoint is not configured with an EC key.
Command Modes
Ca-trustpoint configuration mode (ca-trustpoint)
Command History
Usage Guidelines
If an ECDSA signed certificate is imported without a trustpoint configuration, then the label defaults to the FQDN value.
Examples
The following example configures the EC key label in a certificate enrollment in a PKI:
Router(config)# crypto pki trustpoint mytpRouter(ca-trustpoint)# eckeypair Router_1_KeyRelated Commands
email (IKEv2 profile)
To derive the name mangler from the remote identity of type e-mail, use the email command in IKEv2 name mangler configuration mode. To remove the name derived from the e-mail, use the no form of this command.
email {all | domain | username}
no email
Syntax Description
all
Derives the name mangler from the entire FQDN.
domain
Derives the name mangler from the domain name in e-mail.
hostname
Derives the name mangler from the username in e-mail.
Command Default
No default behavior or values.
Command Modes
IKEv2 name mangler configuration (config-ikev2-name-mangler)
Command History
15.1(3)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to derive the name mangler from any field in the remote identity of type e-mail.
Examples
The following example shows how to derive a name for the name mangler from the username in e-mail:
Router(config)# crypto ikev2 name-mangler mangler2Router(config-ikev2-name-mangler)# email usernameRelated Commands
enable
To change the privilege level for a CLI session or to use a CLI view for a CLI session, use the enable command in either user EXEC, privileged EXEC, or diagnostic mode.
enable [privilege-level] [view [view-name]]
Syntax Description
Defaults
Privilege-level 15 (privileged EXEC)
Command Modes
User EXEC (>)
Privileged EXEC (#)
Diagnostic Mode (diag)
Command History
Usage Guidelines
By default, using the enable command without the privilege-level argument in user EXEC mode causes the router to enter privileged EXEC mode (privilege-level 15).
Entering privileged EXEC mode enables the use of privileged commands. Because many of the privileged commands set operating parameters, privileged access should be password-protected to prevent unauthorized use. If the system administrator has set a password with the enable password global configuration command, you are prompted to enter the password before being allowed access to privileged EXEC mode. The password is case sensitive.
If an enable password has not been set, only enable mode can be accessed through the console connection.
Security levels can be set by an administrator using the enable password and privilege level commands. Up to 16 privilege levels can be specified, using the numbers 0 through 15. Using these privilege levels, the administrator can allow or deny access to specific commands. Privilege level 0 is associated with user EXEC mode, and privilege level 15 is associated with privileged EXEC mode.
For more information on defined privilege levels, see the Cisco IOS Security Configuration Guide and the Cisco IOS Security Command Reference publications.
If a level is not specified when entering the enable command, the user will enter the default mode of privileged EXEC (level 15).
Accessing a CLI View
CLI views restrict user access to specified CLI and configuration information. To configure and access CLI views, users must first enter into root view, which is accomplished via the enable view command (without the view-name argument). Thereafter, users are prompted for a password, which is the same password as the privilege level 15 password.
The view-name argument is used to switch from one view to another view.
To prevent dictionary attacks, a user is prompted for a password even if an incorrect view name is given. The user is denied access only after an incorrect view name and password are given.
Examples
In the following example, the user enters privileged EXEC mode (changes to privilege-level 15) by using the enable command without a privilege-level argument. The system prompts the user for a password before allowing access to the privileged EXEC mode. The password is not printed to the screen. The user then exits back to user EXEC mode using the disable command. Note that the prompt for user EXEC mode is the greater than symbol (>), and the prompt for privileged EXEC mode is the number sign (#).
Router> enablePassword: <letmein>Router# disableRouter>The following example shows which commands are available inside the CLI view "first" after the user has logged into this view:
Router# enable view firstPassword:00:28:23:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.Router# ?Exec commands:configure Enter configuration modeenable Turn on privileged commandsexit Exit from the EXECshow Show running system informationRouter# show ?ip IP informationparser Display parser informationversion System hardware and software statusRouter# show ip ?access-lists List IP access listsaccounting The active IP accounting databasealiases IP alias tablearp IP ARP tableas-path-access-list List AS path access listsbgp BGP informationcache IP fast-switching route cachecasa display casa informationcef Cisco Express Forwardingcommunity-list List community-listdfp DFP informationdhcp Show items in the DHCP databasedrp Director response protocoldvmrp DVMRP informationeigrp IP-EIGRP show commandsextcommunity-list List extended-community listflow NetFlow switchinghelper-address helper-address tablehttp HTTP informationigmp IGMP informationirdp ICMP Router Discovery Protocol..The following example shows how to use the enable view command to switch from the root view to the CLI view "first":
Router# enable viewRouter#01:08:16:%PARSER-6-VIEW_SWITCH:successfully set to view 'root'.Router#! Enable the show parser view command from the root viewRouter# show parser viewCurrent view is 'root'! Enable the show parser view command from the root view to display all viewsRouter# show parser view allViews Present in System:View Name: firstView Name: second! Switch to the CLI view "first."Router# enable view firstRouter#01:08:09:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.! Enable the show parser view command from the CLI view "first."Router# show parser viewCurrent view is 'first'Related Commands
enable password
To set a local password to control access to various privilege levels, use the enable password command in global configuration mode. To remove the password requirement, use the no form of this command.
enable password [level level] {password | [encryption-type] encrypted-password}
no enable password [level level]
Syntax Description
Defaults
No password is defined. The default is level 15.
Command Modes
Global configuration
Command History
Usage Guidelines
Caution
Use this command with the level option to define a password for a specific privilege level. After you specify the level and the password, give the password to the users who need to access this level. Use the privilege level configuration command to specify commands accessible at various levels.
You will not ordinarily enter an encryption type. Typically you enter an encryption type only if you copy and paste into this command a password that has already been encrypted by a Cisco router.
Caution
If the service password-encryption command is set, the encrypted form of the password you create with the enable password command is displayed when a more nvram:startup-config command is entered.
You can enable or disable password encryption with the service password-encryption command.
An enable password is defined as follows:
•
•
•
•
–
–
–
When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-v; you can simply enter abc?123 at the password prompt.
Examples
The following example enables the password "pswd2" for privilege level 2:
enable password level 2 pswd2The following example sets the encrypted password "$1$i5Rkls3LoyxzS8t9", which has been copied from a router configuration file, for privilege level 2 using encryption type 7:
enable password level 2 5 $1$i5Rkls3LoyxzS8t9Related Commands
enable secret
To specify an additional layer of security over the enable password command, use the enable secret command in global configuration mode. To turn off the enable secret function, use the no form of this command.
enable secret [level level] {password | 0 | 4 | 5 [encryption-type] encrypted-password }
no enable secret [level level] {password | 0 | 4 | 5 [encryption-type] encrypted-password }
Syntax Description
Command Default
No password is defined. The default level is 15.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Caution
Use this command to provide an additional layer of security over the enable password. The enable secret command provides better security by storing the enable secret password using a non reversible cryptographic function. The added layer of security encryption provides is useful in environments where the password crosses the network or is stored on a TFTP server.
You will not ordinarily enter an encryption type. Typically you enter an encryption type only if you paste into this command an encrypted password that you copied from a router configuration file.
Caution
If you use the same password for the enable password and enable secret commands, you receive an error message warning that this practice is not recommended, but the password will be accepted. By using the same password, however, you undermine the additional security the enable secret command provides.
Note
If service password-encryption is set, the encrypted form of the password you create here is displayed when a more nvram:startup-config command is entered.
You can enable or disable password encryption with the service password-encryption command.
An enable password is defined as follows:
•
•
•
•
–
–
–
When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-v; you can simply enter abc?123 at the password prompt.
Examples
The following example specifies the enable secret password of "password":
enable secret passwordAfter specifying an enable secret password, users must enter this password to gain access. Any passwords set through enable password will no longer work.
Password: passwordThe following example enables the encrypted password "$1$FaD0$Xyti5Rkls3LoyxzS8", which has been copied from a router configuration file, for privilege level 2 using encryption type 5:
enable password level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8Related Commands
enable
Enters privileged EXEC mode.
enable password
Sets a local password to control access to various privilege levels.
service password-encryption
Encrypt passwords.
enabled (IPS)
To change the enabled status of a given signature or signature category, use the enabled command in signature-definition-status (config-sigdef-status) or IPS-category-action (config-ips-category-action) configuration mode. To return to the default action, use the no form of this command.
enabled {true | false}
no enabled
Syntax Description
true
Enables a specified signature or all signatures within a specified category.
false
Disables a specified signature or all signatures within a specified category.
Command Default
All commands are enabled.
Command Modes
Signature-definition-status configuration (config-sigdef-status)
IPS-category-action configuration (config-ips-category-action)Command History
Usage Guidelines
Use the enabled command to change the status of a signature or signature category to active (true) or inactive (false).
Examples
The following example shows how to change the status of signature 9000:0 to enabled:
Router(config)# ip ips signature-definitionRouter(config-sig)# signature 9000 0Router(config-sig-sig)# statusRouter(config-sigdef-status)# enabled trueRelated Commands
encryption (IKE policy)
To specify the encryption algorithm within an Internet Key Exchange (IKE) policy, use the encryption command in Internet Security Association Key Management Protocol (ISAKMP) policy configuration mode. IKE policies define a set of parameters to be used during IKE negotiation. To reset the encryption algorithm to the default value, use the no form of this command.
encryption {des | 3des | aes | aes 192 | aes 256}
no encryption
Syntax Description
Command History
The 56-bit DES-CBC encryption algorithm
Command Modes
ISAKMP policy configuration
Command History
Usage Guidelines
Use this command to specify the encryption algorithm to be used in an IKE policy.
If a user enters an IKE encryption method that the hardware does not support, a warning message will be displayed immediately after the encryption command is entered.
Examples
The following example configures an IKE policy with the 3DES encryption algorithm (all other parameters are set to the defaults):
crypto isakmp policyencryption 3desexitThe following example is a sample warning message that is displayed when a user enters an IKE encryption method that the hardware does not support:
encryption aes 256WARNING:encryption hardware does not support the configuredencryption method for ISAKMP policy 1Related Commands
encryption (IKEv2 proposal)
To specify one or more encryption algorithms for an Internet Key Exchange Version 2 (IKEv2) proposal, use the encryption command in IKEv2 proposal configuration mode. To remove the encryption algorithm, use the no form of this command.
encryption {3des} {aes-cbc-128} {aes-cbc-192} {aes-cbc-256}
no encryption
Syntax Description
Command Default
The encryption algorithm is not specified.
Command Modes
IKEv2 proposal configuration (config-ikev2-proposal)
Command History
15.1(1)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to specify the encryption algorithm to be used in an IKEv2 proposal. The default encryption algorithm in the default proposal is 128-bit AES-CBC and 3 DES encryption algorithm.
Note
Examples
The following example configures an IKE proposal with the 3DES encryption algorithm:
Router(config)# crypto ikev2 proposal proposal1Router(config-ikev2-proposal)# encryption 3desRelated Commands
enforce-checksum
To enforce checksum verification for Flexible Packet Matching (FPM), use the enforce-checksum command in fpm package-info mode. To disable the checksum verification, use the no form of this command.
enforce-checksum
no enforce-checksum
Syntax Description
This command has no keywords and arguments.
Command Default
enforce checksum is enabled.
Command Modes
fpm package-info (config-fpm-pak-info)
Command History
Usage Guidelines
The enforce-checksum command ensures that the FPM verifies the checksum of the package during load and that the package has not been tampered. This command is useful when you want to define your own filters inside the FPM packages by disabling enforce-checksum using no enforce-checksum command. However, it is recommended to keep the enforce-checksum enabled.
Examples
The following example shows how to enable the enforce-checksum command:
Router# configure terminalRouter(config)# fpm package-infoRouter(config-fpm-pak-info)# enforce-checksumengine (IPS)
To enter signature-definition-action-engine configuration mode, which allows you to change router actions for a specified signature, use the engine command in signature-definition-action configuration mode.
engine
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Signature-definition-action configuration (config-sigdef-action)
Command History
Usage Guidelines
If you wish to change router actions for a specific signature, you must issue the engine command to enter the appropriate configuration mode, which allows you to issue the event-action command and specify any supported action.
Examples
The following example shows how to configure signature 5726 to reset all TCP connections and produce an alert:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ip ips signature-definitionRouter(config-sigdef)# signature 5726 0Router(config-sigdef-sig)# engineRouter(config-sigdef-sig-engine)# event-action reset-tcp-connection produce-alertRouter(config-sigdef-sig-engine)# exitRouter(config-sigdef-sig)# exitRouter(config-sigdef)#^ZDo you want to accept these changes? [confirm]Router#*Nov 9 21:50:55.847: %IPS-6-ENGINE_BUILDING: multi-string - 3 signatures - 12 of 11 engines*Nov 9 21:50:55.859: %IPS-6-ENGINE_READY: multi-string - build time 12 ms - packets for this engine will be scanned*Nov 9 21:50:55.859: %SYS-5-CONFIG_I: Configured from console by cisco on consoleRelated Commands
event-action
Changes router actions for a signature or signature category.
signature
Specifies a signature for which the CLI user tunings will be changed.
enrollment
To specify the enrollment parameters of your certification authority (CA), use the enrollment command in ca-trustpoint configuration mode. To remove any of the configured parameters, use the no form of this command.
enrollment {mode ra | retry count number | retry period minutes | url url}
no enrollment {mode ra | retry count number | retry period minutes | url url}
Syntax Description
Defaults
RA mode is disabled.
After the router sends the first certificate request to the CA, it waits for 1 minute before sending a second request. After the second request, the interval between requests (the retry period) increases exponentially, with an additional 1 minute interval added at each increment.
The router sends a maximum of ten requests.
Your router does not know the CA URL until you specify it using url url.
Command Modes
CA-trustpoint configuration (ca-trustpoint)
Command History
Usage Guidelines
Use the mode keyword to specify the mode supported by the CA. This keyword is required if your CA system provides an RA.
Use the retry period minutes option to change the retry period from the default value. After requesting a certificate, the router waits to receive a certificate from the CA. If the router does not receive a certificate within a period of time (the retry period), the router will send another certificate request. The router will continue to send requests until it receives a valid certificate, until the CA returns an enrollment error, or until the configured number of retries is exceeded.
By default, the router sends a maximum of ten requests; you can change this parameter using the retry count number option. It stops sending requests when it receives a valid certificate, when the CA returns an enrollment error, or when the configured number of requests is reached.
Use the url url option to specify or change the URL of the CA. You can specify enrollment with Simple Certificate Enrollment Protocol (SCEP) using a HTTP URl or with TFTP using a TFTP URL.
If you are using (SCEP) for enrollment, url must be in the form http://CA_name, where CA_name is the CA's host Domain Name System (DNS) name or IP address. If you are using TFTP for enrollment, url must be in the form tftp://certserver/file_specification.
TFTP enrollment is used to send the enrollment request and retrieve the certificate of the CA and the certificate of the router. If the file_specification is included in the URL, the router will append an extension onto the file specification. When the crypto ca authenticate command is entered, the router will retrieve the certificate of the CA from the specified TFTP server. As appropriate, the router will append the extension ".ca" to the filename or the fully qualified domain name (FQDN). If the url url option does not include a file specification, the router's FQDN will be used.
Note
Examples
The following example shows how to declare a CA named ka and how to specify registration authority mode. It also shows how to set a retry count of 8 and a retry period of 2 minutes:
Router(config)# crypto ca trustpoint kaRouter(ca-trustpoint)# enrollment mode raRouter(ca-trustpoint)# enrollment retry count 8Router(ca-trustpoint)# enrollment retry period 2The following example shows how to declare a CA named ka and how to specify the URL of the CA as http://example:80:
Router(config)# crypto ca trustpoint kaRouter(ca-trustpoint)# enrollment url http://example:80Related Commands
enrollment command
To specify the HTTP command that is sent to the certification authority (CA) for enrollment, use the enrollment command command in ca-profile-enroll configuration mode.
enrollment command
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
Ca-profile-enroll configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
After enabling this command, you can use the parameter command to specify enrollment parameters for your enrollment profile.
Examples
The following example shows how to configure the enrollment profile name "E" for certificate enrollment:
crypto ca trustpoint Entrustenrollment profile Eserialcrypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
crypto ca profile enrollment
Defines an enrollment profile.
parameter
Specifies parameters for an enrollment profile.
enrollment credential
To specify an existing trustpoint from another vendor that is to be enrolled with the Cisco IOS certificate server, use the enrollment credential command in ca-profile-enroll configuration mode.
enrollment credential label
Syntax Description
Defaults
No default behavior or values.
Command Modes
Ca-profile-enroll configuration
Command History
Usage Guidelines
To configure a router that is already enrolled with a CA of another vendor that is to be enrolled with a Cisco IOS certificate server, you must configure a certificate enrollment profile (via the crypto pki profile enrollment command). Thereafter, you should issue the enrollment credential command, which specifies the trustpoint of another vendor that has to be enrolled with a Cisco IOS certificate server.
Examples
The following example shows how to configure a client router and a Cisco IOS certificate server to exchange enrollment requests via a certificate enrollment profile:
! Define the trustpoint "msca-root" that points to the non-Cisco IOS CA and enroll and ! authenticate the client with the non-Cisco IOS CA.crypto pki trustpoint msca-rootenrollment mode raenrollment url http://msca-root:80/certsrv/mscep/mscep.dllip-address FastEthernet2/0revocation-check crl!! Configure trustpoint "cs" for Cisco IOS CA.crypto pki trustpoint csenrollment profile cs1revocation-check crl!! Define enrollment profile "cs1," which points to Cisco IOS CA and mention (via the ! enrollment credential command) that "msca-root" is being initially enrolled with the ! Cisco IOS CA.crypto pki profile enrollment cs1enrollment url http://cs:80enrollment credential msca-root!! Configure the certificate server, and issue and the grant auto trustpoint command to ! instruct the certificate server to accept enrollment request only from clients who are ! already enrolled with trustpoint "msca-root."crypto pki server csdatabase level minimumdatabase url nvram:issuer-name CN=csgrant auto trustpoint msca-root!crypto pki trustpoint csrevocation-check crlrsakeypair cs!crypto pki trustpoint msca-rootenrollment mode raenrollment url http://msca-root:80/certsrv/mscep/mscep.dllrevocation-check crlRelated Commands
enrollment http-proxy
To access the certification authority (CA) by HTTP through the proxy server, use the enrollment http-proxy command in ca-trustpoint configuration mode.
enrollment http-proxy host-name port-num
Syntax Description
host-name
Defines the proxy server used to get the CA.
port-num
Specifies the port number used to access the CA.
Defaults
If this command is not enabled, the CA will not be accessed via HTTP.
Command Modes
Ca-trustpoint configuration
Command History
12.2(8)T
This command was introduced.
12.2(18)SXD
This command was integrated into Cisco IOS Release 12.2(18)SXD.
Usage Guidelines
The enrollment http-proxy command must be used in conjunction with the enrollment command, which specifies the enrollment parameters for the CA.
Examples
The following example shows how to access the CA named "ka" by HTTP through the bomborra proxy server:
crypto ca trustpoint kaenrollment url http://kahuluienrollment http-proxy bomborra 8080crl optionalRelated Commands
crypto ca trustpoint
Declares the CA that your router should use.
enrollment
Specifies the enrollment parameters of your CA.
enrollment mode ra
The enrollment mode ra command is replaced by the enrollment command command. See the enrollment command command for more information.
enrollment profile
To specify that an enrollment profile can be used for certificate authentication and enrollment, use the enrollment profile command in ca-trustpoint configuration mode. To delete an enrollment profile from your configuration, use the no form of this command.
enrollment profile label
no enrollment profile label
Syntax Description
Defaults
Your router does not recognize any enrollment profiles until you declare one using this command.
Command Modes
Ca-trustpoint configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
Before you can enable this command, you must enter the crypto ca trustpoint command.
The enrollment profile command enables your router to accept an enrollment profile, which can be configured via the crypto ca profile enrollment command. The enrollment profile, which consists of two templates, can be used to specify different URLs or methods for certificate authentication and enrollment.
Examples
The following example shows how to declare the enrollment profile named "E":
crypto ca trustpoint Entrustenrollment profile Eserialcrypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
crypto ca profile enrollment
Defines an enrollment profile.
crypto ca trustpoint
Declares the CA that your router should use.
enrollment retry count
The enrollment retry count command is replaced by the enrollment command. See the enrollment command for more information.
enrollment retry period
The enrollment retry period command is replaced by the enrollment command. See the enrollment command for more information.
enrollment selfsigned
To specify self-signed enrollment for a trustpoint, use the enrollment selfsigned command in ca-trustpoint configuration mode. To delete self-signed enrollment from a trustpoint, use the no form of this command.
enrollment selfsigned
no enrollment selfsigned
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default behavior or values.
Command Modes
ca-trustpoint configuration (ca-trustpoint)
Command History
Usage Guidelines
Before you can use the enrollment selfsigned command, you must enable the crypto pki trustpoint command, which defines the trustpoint and enters ca-trustpoint configuration mode.
If you do not use this command, you should specify another enrollment method for the router by using an enrollment command such as enrollment url or enrollment terminal.
Examples
The following example shows a self-signed certificate being designated for a trustpoint named local:
crypto pki trustpoint localenrollment selfsignedRelated Commands
enrollment terminal (ca-profile-enroll)
To specify manual cut-and-paste certificate enrollment, use the enrollment terminal command in ca-profile-enroll configuration mode. To delete a current enrollment request, use the no form of this command.
enrollment terminal
no enrollment terminal
Syntax Description
This command has no arguments or keywords.
Defaults
A certificate enrollment request is not specified.
Command Modes
Ca-profile-enroll configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
A user may manually cut-and-paste certificate authentication requests and certificates when a network connection between the router and certification authority (CA) is unavailable. After this command is enabled, the certificate request is printed on the console terminal so that it can be manually copied (cut) by the user.
Note
Examples
The following example shows how to configure the enrollment profile named "E" to perform certificate authentication via HTTP and manual certificate enrollment:
crypto ca profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment terminalparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
enrollment terminal (ca-trustpoint)
To specify manual cut-and-paste certificate enrollment, use the enrollment terminal command in ca-trustpoint configuration mode. To delete a current enrollment request, use the no form of this command.
enrollment terminal [pem]
no enrollment terminal [pem]
Syntax Description
Defaults
No default behavior or values
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
A user may want to manually cut-and-paste certificate requests and certificates when he or she does not have a network connection between the router and certification authority (CA). When this command is enabled, the router displays the certificate request on the console terminal, allowing the user to enter the issued certificate on the terminal.
The pem Keyword
Use the pem keyword to issue certificate requests (via the crypto ca enroll command) or receive issued certificates (via the crypto ca import certificate command) in PEM-formatted files through the console terminal. If the CA server does not support simple certificate enrollment protocol (SCEP), the certificate request can be presented to the CA server manually.
Note
Examples
The following example shows how to manually specify certificate enrollment via cut-and-paste. In this example, the CA trustpoint is "MS."
crypto ca trustpoint MSenrollment terminalcrypto ca authenticate MS!crypto ca enroll MScrypto ca import MS certificateRelated Commands
enrollment url (ca-identity)
The enrollment url (ca-identity) command is replaced by the enrollment url (ca-trustpoint) command. See the enrollment url (ca-trustpoint) command for more information.
enrollment url (ca-profile-enroll)
To specify the URL of the certification authority (CA) server to which to send enrollment requests, use the enrollment url command in ca-profile-enroll configuration mode. To delete the enrollment URL from your enrollment profile, use the no form of this command.
enrollment url url
no enrollment url url
Syntax Description
Defaults
Your router does not recognize the CA URL until you specify it using this command.
Command Modes
Ca-profile-enroll configuration
Command History
12.2(13)ZH
This command was introduced.
12.3(4)T
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
This command allows the user to specify a different URL or a different method for authenticating a certificate and enrolling a certificate; for example, manual authentication and TFTP enrollment.
Examples
The following example shows how to enable certificate enrollment via HTTP for the profile name "E":
crypto pki trustpoint Entrustenrollment profile Eserialcrypto pki profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
enrollment url (ca-trustpoint)
To specify the enrollment parameters of a certification authority (CA), use the enrollment url command in ca-trustpoint configuration mode. To remove any of the configured parameters, use the no form of this command.
enrollment [mode] [retry period minutes] [retry count number] url url [pem]
no enrollment [mode] [retry period minutes] [retry count number] url url [pem]
Syntax Description
mode
(Optional) Specifies the registration authority (RA) mode, if your CA system provides an RA. By default, RA mode is disabled.
retry period minutes
(Optional) Specifies the period in which the router will wait before sending the CA another certificate request. The default is 1 minute between retries. (Specify from 1 to 60 minutes.)
retry count number
(Optional) Specifies the number of times a router will resend a certificate request when it does not receive a response from the previous request. The default is 10 retries. (Specify from 1 to 100 retries.)
url url
Specifies the URL of the file system where your router should send certificate requests. For enrollment method options, see Table 32.
pem
(Optional) Adds privacy-enhanced mail (PEM) boundaries to the certificate request.
Defaults
Your router does not know the CA URL until you specify it using the url url keyword and argument.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Use the mode keyword to specify the mode supported by the CA. This keyword is required if your CA system provides an RA.
Use the retry period minutes option to change the retry period from the default of 1 minute between retries. After requesting a certificate, the router waits to receive a certificate from the CA. If the router does not receive a certificate within a specified period of time (the retry period), the router will send another certificate request. By default, the router will send a maximum of ten requests until it receives a valid certificate, until the CA returns an enrollment error, or until the configured number of retries (specified via the retry count number option) is exceeded.
Use the pem keyword to issue certificate requests (using the crypto pki enroll command) or receive issued certificates (using the crypto pki import certificate command) in PEM-formatted files.
Note
Use the url url option to specify or change the URL of the CA. Table 32 lists the available enrollment methods.
Table 32 Certificate Enrollment Methods
bootflash
Enroll via bootflash: file system
cns
Enroll via Cisco Networking Services (CNS): file system
flash
Enroll via flash: file system
ftp
Enroll via FTP: file system
null
Enroll via null: file system
nvram
Enroll via NVRAM: file system
rcp
Enroll via remote copy protocol (rcp): file system
scp
Enroll via secure copy protocol (scp): file system
SCEP1
Enroll via Simple Certificate Enrollment Protocol (SCEP) (an HTTP URL)
system
Enroll via system: file system
TFTP2
Enroll via TFTP: file system
1 If you are using SCEP for enrollment, the URL must be in the form http://CA_name, where CA_name is the host Domain Name System (DNS) name or IP address of the CA.
2 If you are using TFTP for enrollment, the URL must be in the form tftp://certserver/file_specification. (The file_specification is optional. See the section "TFTP Certificate Enrollment" for additional information.)
TFTP Certificate Enrollment
TFTP enrollment is used to send the enrollment request and retrieve the certificate of the CA and the certificate of the router. If the file_specification is included in the URL, the router will append an extension onto the file specification. When the crypto pki authenticate command is entered, the router will retrieve the certificate of the CA from the specified TFTP server. As appropriate, the router will append the extension ".ca" to the filename or the fully qualified domain name (FQDN). (If the url url option does not include a file specification, the FQDN of the router will be used.)
Note
Examples
The following example shows how to declare a CA named "trustpoint" and specify the URL of the CA as "http://example:80":
crypto pki trustpoint trustpointenrollment url http://example:80Related Commands
eou allow
To allow additional Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) options, use the eou allow command in global configuration mode. To disable the options that have been set, use the no form of this command.
eou allow {clientless | ip-station-id}
no eou allow {clientless | ip-station-id}
Syntax Description
clientless
Allows authentication of clientless hosts (systems that do not run Cisco Trust Agent).
ip-station-id
Allows an IP address in the station-id field.
Defaults
No additional EAPoUDP options are allowed.
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
The eou allow command used with the clientless keyword requires that a user group be configured on the Cisco Access Control Server (ACS) using the same username and password that are specified using the eou clientless command.
Examples
The following example shows that clientless hosts are allowed:
Router (config)# eou allow clientlessRelated Commands
eou clientless
To set user group credentials for clientless hosts, use the eou clientless command in global configuration mode. To remove the user group credentials, use the no form of this command.
eou clientless {password password | username username}
no eou clientless {password | username}
Syntax Description
Defaults
Username and password values are clientless.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
For this command to be effective, the eou allow command must also be enabled.
Examples
The following example shows that a clientless host with the username "user1" has been configured:
Router (config)# eou clientless username user1The following example shows that a clientless host with the password "user123" has been configured:
Router (config)# eou clientless password user123Related Commands
eou default
To set global Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) parameters to the default values, use the eou default command in global or interface configuration mode.
eou default
Syntax Description
This command has no arguments or keywords.
Defaults
The EAPoUDP parameters are set to their default values.
Command Modes
Global configuration (config)
Interface configuration (config-if)Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
You can configure this command globally by using global configuration mode or for a specific interface by using interface configuration mode.
Using this command, you can reset existing values to their default values.
Examples
The following configuration example shows that EAPoUDP parameters have been set to their default values:
Router (config)# eou defaulteou initialize
To manually initialize Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) state machines, use the eou initialize command in global configuration mode. This command does not have a no form.
eou initialize {all | authentication {clientless | eap | static} | interface interface-name | ip ip-address | mac mac-address | posturetoken string}
Syntax Description
Command Default
None
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
If this command is used, existing EAPoUDP state machines will be reset.
Examples
The following example shows that all EAPoUDP state machines have been reauthenticated:
Router (config)# eou initialize allRelated Commands
eou logging
To enable Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) system logging events, use the eou logging command in global configuration mode. To remove EAPoUDP logging, use the no form of this command.
eou logging
no eou logging
Syntax Description
This command has no arguments or keywords.
Defaults
Logging is disabled.
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Examples
The following example shows that EAPoUDP logging has been enabled:
Router (config)# eou loggingThe following is sample EAPoUDP logging output:
Apr 9 10:04:09.824: %EOU-6-SESSION: IP=10.0.0.1| HOST=DETECTED| Interface=FastEthernet0/0*Apr 9 10:04:09.900: %EOU-6-CTA: IP=10.0.0.1| CiscoTrustAgent=DETECTED*Apr 9 10:06:19.576: %EOU-6-POLICY: IP=10.0.0.1| TOKEN=Healthy*Apr 9 10:06:19.576: %EOU-6-POLICY: IP=10.0.0.1| ACLNAME=#ACSACL#-IP-HealthyACL-40921e54*Apr 9 10:06:19.576: %EOU-6-POSTURE: IP=10.0.0.1| HOST=AUTHORIZED| Interface=FastEthernet0/0.420*Apr 9 10:06:19.580: %EOU-6-AUTHTYPE: IP=10.0.0.1| AuthType=EAP*Apr 9 10:06:04.424: %EOU-6-SESSION: IP=192.168.2.1| HOST=REMOVED| Interface=FastEthernet0/0.420eou max-retry
To set the number of maximum retry attempts for Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP), use the eou max-retry command in global or interface configuration mode. To remove the number of retries that were entered, use the no form of this command.
eou max-retry number-of-retries
no eou max-retry number-of-retries
Syntax Description
number-of-retries
Number of maximum retries that may be attempted. The value ranges from 1 through 10. The default is 3.
Defaults
The default number of retries is 3.
Command Modes
Global configuration (config)
Interface configuration (config-if)Command History
Usage Guidelines
You can configure this command globally by using global configuration mode or for a specific interface by using interface configuration mode.
Examples
The following example shows that the maximum number of retries for an EAPoUDP session has been set for 2:
Router (config)# eou max-retry 2Related Commands
show eou
Displays information about EAPoUDP global values or EAPoUDP session cache entries.
eou port
To set the UDP port for Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP), use the eou port command in global configuration mode. This command has no no form.
eou port port-number
Syntax Description
Defaults
The default port-number value is 27186.
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
Ensure that the port you set does not conflict with other UDP applications.
Examples
The following example shows that the port for an EAPoUDP session has been set to 200:
Router (config)# eou port 200Related Commands
eou rate-limit
To set the number of simultaneous posture validations for Extensible Authentication Protocol over UDP (EAPoUDP), use the eou rate-limit command in global configuration mode. This command has no no form.
eou rate-limit number-of-validations
Syntax Description
number-of-validations
Number of clients that can be simultaneously validated. The value ranges from 1 through 200. The default value is 20.
Defaults
No default behaviors or values
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
If you set the rate limit to 0 (zero), rate limiting will be turned off.
If the rate limit is set to 100 and there are 101 clients, validation will not occur until one drops off.
To return to the default value, use the eou default command.
Examples
The following example shows that the number of posture validations has been set to 100:
Router (config)# eou rate-limit 100Related Commands
eou default
Sets global EAPoUDP parameters to the default values.
show eou
Displays information about EAPoUDP.
eou revalidate
To revalidate an Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) association, use the eou revalidate command in privileged EXEC mode. To disable the revalidation, use the no form of this command.
eou revalidate {all | authentication {clientless | eap | static} | interface interface-name | ip ip-address | mac mac-address | posturetoken string}
no eou revalidate {all | authentication {clientless | eap | static} | interface interface-name | ip ip-address | mac mac-address | posturetoken string}
Syntax Description
all
Enables revalidation of all EAPoUDP clients. This keyword option is the default.
authentication
Specifies the authentication type.
clientless
Clientless authentication type.
eap
EAP authentication type.
static
Static authentication type.
interface interface-name
Name of the interface. (See Table 33 for the types of interface that may be shown.)
ip ip-address
IP address of the client.
mac mac-address
The 48-bit hardware address of the client.
posturetoken string
Name of the posture token.
Command Default
None
Command Modes
Privileged EXEC (#)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
If you use this command, existing EAPoUDP sessions will be revalidated.
Table 33 lists the interface types that may be used with the interface keyword.
Examples
The following example shows that all EAPoUDP clients are to be revalidated:
Router# eou revalidate all
Related Commands
eou timeout
To set the Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) timeout values, use the eou timeout command in global or interface configuration mode. To remove the value that was set, use the no form of this command.
eou timeout {aaa seconds | hold-period seconds | retransmit seconds | revalidation seconds | status query seconds}
no timeout {aaa seconds | hold-period seconds | retransmit seconds | revalidation seconds | status query seconds}
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration (config)
Interface configuration (config-if)Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
You can configure this command globally by using global configuration mode or for a specific interface by using interface configuration mode.
Examples
The following example shows that the status query period after revalidation is set to 30:
Router (config)# eou timeout status query 30Related Commands
error-msg
To display a specific error message when a user logs on to a Secure Sockets Layer Virtual Private Network (SSL VPN) gateway, use the error-msg command in webvpn acl configuration mode. To remove the error message, use the no form of this command.
error-msg message-string
no error-msg message-string
Syntax Description
Command Default
No special error message is displayed.
Command Modes
Webvpn acl configuration
Command History
Usage Guidelines
If the error-url command is configured, the user is redirected to the error URL for every request that is not allowed. If the error-url command is not configured, the user gets a standard, gateway-generated information page showing the message that was configured using the error-msg command.
Examples
This example shows that the following error message will be displayed when the user logs on to the SSL VPN gateway:
webvpn context context1acl acl1error-msg "If you have any questions, please contact <a href+mailto:employee1@example.com>Employee1</a>."Related Commands
error-url
To define a URL as an access control list (ACL) violation page using a Secure Socket Layer Virtual Private Network (SSL VPN) gateway, use the error-url command in webvpn acl configuration mode. To remove the ACL violation page, use the no form of this command.
error-url access-deny-page-url
no error-url access-deny-page-url
Syntax Description
Command Default
If this command is not configured, the gateway redirects the ACL violation page to a predefined URL.
Command Modes
Webvpn acl configuration
Command History
Usage Guidelines
If the error-url command is configured, the user is redirected to a predefined URL for every request that is not allowed. If the error-url command is not configured, the user gets a standard, gateway-generated error page.
Examples
The following example shows that the URL "http://www.example.com" has been defined as the ACL violation page:
webvpn context context1acl acl1error-url "http://www.example.com"Related Commands
evaluate
To nest a reflexive access list within an access list, use the evaluate command in access-list configuration mode. To remove a nested reflexive access list from the access list, use the no form of this command.
evaluate name
no evaluate name
Syntax Description
name
The name of the reflexive access list that you want evaluated for IP traffic entering your internal network. This is the name defined in the permit (reflexive) command.
Defaults
Reflexive access lists are not evaluated.
Command Modes
Access-list configuration
Command History
Usage Guidelines
This command is used to achieve reflexive filtering, a form of session filtering.
Before this command will work, you must define the reflexive access list using the permit (reflexive) command.
This command nests a reflexive access list within an extended named IP access list.
If you are configuring reflexive access lists for an external interface, the extended named IP access list should be one which is applied to inbound traffic. If you are configuring reflexive access lists for an internal interface, the extended named IP access list should be one which is applied to outbound traffic. (In other words, use the access list opposite of the one used to define the reflexive access list.)
This command allows IP traffic entering your internal network to be evaluated against the reflexive access list. Use this command as an entry (condition statement) in the IP access list; the entry "points" to the reflexive access list to be evaluated.
As with all access list entries, the order of entries is important. Normally, when a packet is evaluated against entries in an access list, the entries are evaluated in sequential order, and when a match occurs, no more entries are evaluated. With a reflexive access list nested in an extended access list, the extended access list entries are evaluated sequentially up to the nested entry, then the reflexive access list entries are evaluated sequentially, and then the remaining entries in the extended access list are evaluated sequentially. As usual, after a packet matches any of these entries, no more entries will be evaluated.
Examples
The following example shows reflexive filtering at an external interface. This example defines an extended named IP access list inboundfilters, and applies it to inbound traffic at the interface. The access list definition permits all Border Gateway Protocol and Enhanced Interior Gateway Routing Protocol traffic, denies all Internet Control Message Protocol traffic, and causes all Transmission Control Protocol traffic to be evaluated against the reflexive access list tcptraffic.
If the reflexive access list tcptraffic has an entry that matches an inbound packet, the packet will be permitted into the network. tcptraffic only has entries that permit inbound traffic for existing TCP sessions.
interface Serial 1description Access to the Internet via this interfaceip access-group inboundfilters in!ip access-list extended inboundfilterspermit 190 any anypermit eigrp any anydeny icmp any anyevaluate tcptrafficRelated Commands
event-action
To change router actions for a signature or signature category, use the event-action command in signature-definition-action-engine or IPS-category-action configuration mode. To revert to the default router action values, use the no form of this command.
event-action action
no event-action
Syntax Description
Command Default
Default values for the signature or signature category will be used.
Command Modes
Signature-definition-action-engine configuration (config-sigdef-action-engine)
IPS-category-action configuration (config-ips-category-action)Command History
Usage Guidelines
Signature-Based Changes
After signature-based changes are complete, Cisco IOS Intrusion Prevention System (IPS) prompts the user to confirm whether or not the changes are acceptable. Confirming the changes instructs Cisco IOS IPS to compile the changes for the signature and modify memory structures to reflect the change. Also, Cisco IOS IPS will save the changes to the location specified via the ip ips config location command (for example, flash:ips5/*.xml).
You can issue the show ip ips signatures command to verify the event-action configuration. (The show running-config command does not show individual signature tuning information.)
Signature Category-Based Changes
After signature category-based changes are complete, the category tuning information is saved in the command-line interface (CLI) configuration.
Category configuration information is processed in the order that it is entered. Thus, it is recommended that the process of retiring all signatures occur before all other category tuning.
If a category is configured more than once, the parameters entered in the second configuration will be added to or will replace the previous configuration.
Examples
The following example shows how to configure signature 5726 to reset all TCP connections and produce an alert:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ip ips signature-definitionRouter(config-sigdef)# signature 5726 0Router(config-sigdef-sig)# engineRouter(config-sigdef-sig-engine)# event-action reset-tcp-connection produce-alertRouter(config-sigdef-sig-engine)# exitRouter(config-sigdef-sig)# exitRouter(config-sigdef)#^ZDo you want to accept these changes? [confirm]Router#*Nov 9 21:50:55.847: %IPS-6-ENGINE_BUILDING: multi-string - 3 signatures - 12 of 11 engines*Nov 9 21:50:55.859: %IPS-6-ENGINE_READY: multi-string - build time 12 ms - packets for this engine will be scanned*Nov 9 21:50:55.859: %SYS-5-CONFIG_I: Configured from console by cisco on consoleThe following example shows how to tune event-action parameters for the signature category "adware/spyware." All the tuning information will be applied to all signatures that belong to the adware/spyware signature category.
Router(config)# ip ips signature categoryRouter(config-ips-category)# category attack adware/spywareRouter(config-ips-category-action)# event-action produce-alertRouter(config-ips-category-action)# event-action deny-packet-inlineRouter(config-ips-category-action)# event-action reset-tcp-connectionRouter(config-ips-category-action)# retired falseRouter(config-ips-category-action)# ^ZDo you want to accept these changes:[confirmm]yRelated Commands
exclusive-domain
To add or remove a domain name to or from the exclusive domain list so that the Cisco IOS firewall does not have to send lookup requests to the vendor server, use the exclusive-domain command in URL parameter-map configuration mode. To disable this capability, use the no form of this command.
exclusive-domain {deny | permit} domain-name
no exclusive-domain {deny | permit} domain-name
Syntax Description
Command Default
Disabled.
Command Modes
URL parameter-map configuration
Command History
Usage Guidelines
When you are creating or modifying a URL parameter map, you can enter the exclusive-domain subcommand after you enter the parameter-map type urlfilter command. For detailed information about creating a parameter map, see the parameter-map type urlfilter command.
The exclusive-domain command allows you to specify a list of domain names (exclusive domains) so that the Cisco IOS firewall does not create a lookup request for the traffic that is destined for one of the domains in the exclusive list. Thus, you can avoid sending lookup requests to the web server for traffic that is destined for a host that is completely allowed to all users. You can enter the complete domain name or a partial domain name.
Complete Domain Name
If you add a complete domain name, such as www.example.com, to the exclusive domain list, all traffic whose URLs are destined for this domain (such as www.example.com/news and www.example.com/index) is excluded from the URL filtering policies of the vendor server. On the basis of the configuration, the URLs are permitted or blocked (denied).
Partial Domain Name
If you add only a partial domain name to the exclusive domain list, such as example.com, all URLs whose domain names end with this partial domain name (such as www.example.com/products and www.example.com/eng) are excluded from the URL filtering policies of the vendor server. On the basis of the configuration, the URLs are permitted or blocked (denied).
Examples
The following example adds cisco.com to the exclusive domain list:
parameter-map type urlfilter u1exclusive-domain permit example.comRelated Commands
