-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Feedback
Table Of Contents
ip access-list hardware permit fragments
ip access-list logging interval
ip access-list logging hash-generation
ip auth-proxy (global configuration)
ip auth-proxy (interface configuration)
ip auth-proxy auth-proxy-banner
ip auth-proxy max-login-attempts
ip dhcp client broadcast-flag (interface)
ip dhcp support tunnel unicast
icmp idle-timeout
To configure the timeout for Internet Control Message Protocol (ICMP) sessions, use the icmp idle-timeout command in parameter-map type inspect configuration mode. To disable the timeout, use the no form of this command.
icmp idle-timeout seconds
no icmp idle-timeout seconds
Syntax Description
Command Default
The ICMP timeout is disabled.
Command Modes
Parameter-map type inspect configuration
Command History
Usage Guidelines
When you are configuring an inspect type parameter map, you can enter the icmp idle-timeout subcommand after you enter the parameter-map type inspect command. For more detailed information about creating a parameter map, see the parameter-map type inspect command.
Examples
The following example specifies that the ICMP session will timeout in 90 seconds:
parameter-map type inspect insp-paramsicmp idle-timeout 90Related Commands
parameter-map type inspect
Configures an inspect parameter map for connecting thresholds, timeouts, and other parameters pertaining to the inspect action.
ida-client server url
To specify the IDA-server url that the IOS IDA client communicates with to download files from the Cisco.com server, use the ida-client server url command in global configuration mode. To revert back to the default value, use the no form of this command.
ida-client server url url
no ida-client server url url
Syntax Description
url
Specifies the IDA-server url. You must enter the following URL: https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl
Command Default
The default IDA-server URL is: https://www.cisco.com/cgi-bin/ida/locator/locator.pl
Note
Do not use the default URL in your configuration.
Command Modes
Global configuration
Command History
15.0(1)M
This command was introduced.
15.1(1)T
This command was modified to include a default IDA-server URL.
Usage Guidelines
Enter the following URL for the ida-client server url command to specify the IDA-server URL:
Router(config)# ida-client server url https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.plRelated CommandsRouter(config-ips-auto-update)#occur-at weekly 0-1 30 18 Router(config-ips-auto-update)#exit Router(config)#do sh ip ips auto IPS Auto Update Configuration URL : unix:IOS-S369-amogh.pkg Username : not configured Password : not configured Auto Update Intervals minutes (0-59) : 30 hours (0-23) : 18 days of month (1-31) : days of week: (0-6) : 0-1 Next scheduled load time : 25 minutes
identity local
To specify the local Internet Key Exchange Version 2 (IKEv2) identity type, use the identity local command in IKEv2 profile configuration mode. To remove the identity, use the no form of this command.
identity local {address {ipv4-address | ipv6-address} | dn | fqdn fqdn-string | email e-mail-string | key-id opaque-string}
no identity local
Syntax Description
Command Default
If the local authentication method is a preshared key, the default local identity is the IP address (IPv4 or IPv6). If the local authentication method is an RSA signature, the default local identity is Distinguished Name.
Command Modes
IKEv2 profile configuration (config-ikev2-profile)
Command History
Usage Guidelines
Use this command to specify the local IKEv2 identity type as an IPv4 address or IPv6 address, a DN, an FQDN, an e-mail ID, or a key ID. The local IKEv2 identity is used by the local IKEv2 peer to identify itself to the remote IKEv2 peers in the AUTH exchange using the IDi field.
Note
Examples
The following example shows how to specify an IPv4 address as the local IKEv2 identity:
Router(config)# crypto ikev2 profile profile1Router(config-ikev2-profile)# identity local address 10.0.0.1The following example shows how to specify an IPv6 address as the local IKEv2 identity:Router(config)# crypto ikev2 profile profile1Router(config-ikev2-profile)# identity local address 2001:DB8:0::1Related Commands
identity (IKEv2 keyring)
To identify a peer with Internet Key Exchange Version 2 (IKEv2) types of identity, use the identity command in IKEv2 keyring peer configuration mode. To remove the identity, use the no form of this command.
identity{address {ipv4-address | ipv6-address} | fqdn name | email e-mail-id | key-id key-id}
no identity
Syntax Description
Command Default
Identity types are not specified to a peer.
Command Modes
IKEv2 keyring peer configuration (config-ikev2-keyring-peer)
Command History
Usage Guidelines
Use this command to identify the peer using IKEv2 types of identity such as an IPv4 or IPv6 address, an FQDN, an email, or a key ID. Key lookup using IKEv2 identity is available only on the responder because the peer ID is not available on the initiator at the time of starting the IKEv2 session and the initiator looks up keys during session startup.
Examples
The following example shows how to associate an FQDN to the peer:
Router(config)# crypto ikev2 keyring keyring-4Router(config-keyring)# peer abcRouter(config-keyring-peer)# description abc domainRouter(config-keyring-peer)# identity fqdn example.comRelated Commands
identity (IKEv2 profile)
To specify how the local or remote router identifies itself to the peer and communicates with the peer in the Rivest, Shamir and Adleman (RSA) authentication exchange, use the identity command in IKEv2 profile configuration mode. To delete a match, use the no form of this command.
identity [local {dn [trustpoint trustpoint-name [serial certificate-serial]] | address ip-address | fqdn string | email string} | remote {dn [ou=..., o=...] | address ip-address | fqdn string | email string}]
no identity [local {dn [trustpoint trustpoint-name [serial certificate-serial]] | address ip-address | fqdn string | email string} | remote {dn [ou=..., o=...] | address ip-address | fqdn string | email string}]
Syntax Description
Command Default
An identity profile is not specified for a local or remote router regarding the RSA authentication exchange.
Command Modes
IKEv2 profile configuration (crypto-ikev2-profile)#
Command History
15.1(1)T
This command was introduced.
15.1(2)T
This command was modified. The local, dn, trustpoint, serial, and ou= keywords were added to this command.
Usage Guidelines
Use the identity command to identify the local or remote router by its DN, trustpoint, IP address, FQDN, or email address.
Examples
The following example shows how an IKEv2 profile is matched on the remote identity. The following profile caters to peers that identify using fqdn example.com and authenticate with rsa-signature using trustpoint-remote. The local node authenticates with pre-share using keyring-1.
Router(config)# crypto ikev2 profile profile2Router(config-ikev2-profile)# match identity remote fqdn example.comRouter(config-ikev2-profile)# identity local email router2@example.comRouter(config-ikev2-profile)# authentication local pre-shareRouter(config-ikev2-profile)# authentication remote rsa-sigRouter(config-ikev2-profile)# keyring keyring-1Router(config-ikev2-profile)# pki trustpoint trustpoint-remote verifyRouter(config-ikev2-profile)# lifetime 300Router(config-ikev2-profile)# dpd 5 10 on-demandRouter(config-ikev2-profile)# virtual-template 1Related Commands
identity address ipv4
To identify a Group Domain of Interpretation (GDOI) group address, use the identity address ipv4 command in GDOI group configuration mode. To remove the group address, use the no form of this command.
identity address ipv4 {address}
no identity address ipv4 {address}
Syntax Description
Command Default
A group address is not identified.
Command Modes
GDOI group configuration
Command History
Usage Guidelines
This command or the identity number command is required for a GDOI configuration.
Examples
The following example shows that the identity address is 10.2.2.2:
identity address ipv4 10.2.2.2Related Commands
crypto gdoi group
Identifies a GDOI group.
identity number
Identifies a GDOI group number.
identity number
To identify a Group Domain of Interpretation (GDOI) group number, use the identity number command in GDOI group configuration mode. To remove the group number, use the no form of this command.
identity number {number}
no identity number {number}
Syntax Description
Command Default
A GDOI group number is not identified.
Command Modes
GDOI group configuration
Command History
Usage Guidelines
This command or the identity address ipv4 command is required for a GDOI configuration.
Examples
The following example shows the group number is 3333:
identity number 3333Related Commands
crypto gdoi group
Identifies a GDOI group and enters GDOI group configuration mode.
identity address ipv4
Identifies a GDOI group address.
identity policy
To create an identity policy and to enter identity policy configuration mode, use the identity policy command in global configuration mode. To remove the policy, use the no form of this command.
identity policy policy-name [access-group group-name | description line-of-description | redirect url | template [virtual-template interface-number]]
no identity policy policy-name [access-group name | description line-of-description | redirect url | template [virtual-template interface-number]]
Syntax Description
Defaults
An identity policy is not created.
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
An identity policy has to be associated with an identity profile.
Examples
The following example shows that an access policy named "policyname2" is being created. The access-group attribute is set to "allow-access." The redirect URL is set to "http://remediate-url.com." This access policy will be associated with a statically authorized device in the identity profile.
Router (config)# identity policy policyname2Router (config-identity-policy)# access-group allow-accessRouter (config-identity-policy)# redirect url http://remediate-url.comRelated Commands
identity profile
To create an identity profile and to enter identity profile configuration mode, use the identity profile command in global configuration mode. To disable an identity profile, use the no form of this command.
identity profile {default | dot1x | eapoudp | auth-proxy}
no identity profile {default | dot1x | eapoudp | auth-proxy}
Syntax Description
default
Service type is default.
dot1x
Service type for 802.1X.
eapoudp
Service type for Extensible Authentication Protocol over UDP (EAPoUDP).
auth-proxy
Service type for authentication proxy.
Command Default
An identity profile is not created.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The identity profile command and default keyword allow you to configure static MAC addresses of a client computer that does not support 802.1X and to authorize or unauthorize them statically. After you have issued the identity profile command and default keyword and the router is in identity profile configuration mode, you can specify the configuration of a template that can be used to create the virtual access interface to which unauthenticated supplicants (client computers) will be mapped.
The identity profile command and the dot1x keyword are used by the supplicant and authenticator. Using the dot1x keyword, you can set the username, password, or other identity-related information for an 802.1X authentication.
Using the identity profile command and the eapoudp keyword, you can statically authenticate or unauthenticate a device either on the basis of the device IP address or MAC address or on the type, and the corresponding network access policy can be specified using the identity policy command.
Examples
The following example shows that an identity profile and its description have been specified:
Router (config)# identity profile defaultRouter (config-identity-prof)# description description_entered_hereThe following example shows that an EAPoUDP identity profile has been created:
Router (config)# identity policy eapoudpRelated Commands
identity profile eapoudp
To create an identity profile and to enter Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) profile configuration mode, use the identity profile eapoudp command in global configuration mode. To remove the policy, use the no form of this command.
identity profile eapoudp
no identity profile eapoudp
Syntax Description
This command has no arguments or keywords.
Defaults
No EAPoUDP identity profile exists.
Command Modes
Global configuration (config)
Command History
12.3(8)T
This command was introduced.
12.2(33)SXI
This command was integrated into Cisco IOS Release 12.2(33)SXI.
Usage Guidelines
Using this command, you can statically authenticate or unauthenticate a device either on the basis of the device IP address or MAC address or on the type, and the corresponding network access policy can be specified using the identity policy command.
Examples
The following example shows that an EAPoUDP identity profile has been created:
Router (config)# identity profile eapoudpRelated Commands
idle-timeout (WebVPN)
Note
To set the default idle timeout for a Secure Sockets Layer Virtual Private Network (SSLVPN) if no idle timeout has been defined or if the idle timeout is zero (0), use the idle-timeout command in Web VPN configuration mode. To revert to the default value, use the no form of this command.
idle-timeout [never | seconds]
no idle-timeout [never | seconds]
Syntax Description
never
(Optional) The idle timeout function is disabled.
seconds
(Optional) Idle timeout in seconds. The values are from 180 seconds (3 minutes) to 86400 seconds (24 hours).
Defaults
If command is not configured, the default idle timeout is 1800 seconds (30 minutes).
Command Modes
Web VPN configuration
Command History
Usage Guidelines
Configuring this command prevents stale sessions.
Examples
The following example shows that the idle timeout has been set for 1200 seconds:
Router (config)# webvpnRouter (config-webvpn)# idle-timeout 1200The following example shows that the idle timeout function is disabled:Router (config)# webvpnRouter (config-webvpn)# idle-timeout neverRelated Commands
if-state nhrp
To enable the Next Hop Resolution Protocol (NHRP) to control the state of the tunnel interface, use the if-state nhrp command in interface configuration mode. To disable NHRP control of the tunnel interface state, use the no form of this command.
if-state nhrp
no if-state nhrp
Syntax Description
This command has no arguments or keywords.
Command Default
NHRP tunnel interface state control is disabled.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
If the system detects that one or more of the Next Hop Servers (NHSs) configured on the interface is up, then the tunnel interface state is also declared as `up'. If all NHSs configured on the interface are down, then the tunnel interface state is also declared as `down'.
The system does not consider NHSs configured with `no-reply' when determining the interface state.
Examples
The following example shows how to enable NHRP control of the tunnel interface state:
Router(config)# interface tunnel 1Router(config-if)# if-state nhrpRelated Commands
show ip interface
Displays the usability status of interfaces configured for IP.
show ip nhrp nhs
Displays NHRP NHS information.
import
To import a user-defined URL list into a webvpn context, use the import command in the webvpn URL list configuration mode. To disable the URL list, use the no form of this command.
import device:file
no import device:file
Syntax Description
device:file
•
Command Default
A user-defined URL list is not imported.
Command Modes
Webvpn URL list configuration (config-webvpn-url)
Command History
Usage Guidelines
If this command is used under the url-list command, the url-text command is not allowed. The import command and the url-list commands are mutually exclusive when used for a particular URL list. (If you use them together, you will receive this message: "Please remove the imported url-list.")
Also, if a URL list is configured using the url-text command, the import command is not allowed. (If you use them together, you will receive this message: "Please remove all the URLs before importing a file.")
Examples
The following example shows that the URL list file "test-url.xml" is being imported from flash:
Router (config)# webvpn contextRouter (config-webvpn-context)# url-list testRouter (config-webvpn-url)# import flash:est-url.xmlRelated Commands
webvpn create template
Creates templates for multilanguage support for messages in an SSL VPN.
include-local-lan
To configure the Include-Local-LAN attribute to allow a nonsplit-tunneling connection to access the local subnetwork at the same time as the client, use the include-local-lan command in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode. To disable the attribute that allows the nonsplit-tunneling connection, use the no form of this command.
include-local-lan
no include-local-lan
Syntax Description
This command has no arguments or keywords.
Defaults
A nonsplit-tunneling connection is not able to access the local subnet at the same time as the client.
Command Modes
ISAKMP group configuration (config-isakmp-group)
Command History
Usage Guidelines
If split tunneling is not in use (that is, the SPLIT_INCLUDE attribute was not negotiated), you lose not only Internet access, but also access to resources on the local subnetworks. The Include-Local-LAN attribute allows the server to push the attribute to the client, which allows for a nonsplit-tunneling connection to access the local subnetwork at the same time as the client (that is, the connection is to the subnetwork to which the client is directly attached).
The Include-Local-LAN attribute is configured on a Cisco IOS router or in the RADIUS profile.
To configure the Include-Local-LAN attribute, use the include-local-lan command.
An example of an attribute-value (AV) pair for the Include-Local-LAN attribute is as follows:
ipsec:include-local-lan=1You must enable the crypto isakmp client configuration group command, which specifies group policy information that has to be defined or changed, before enabling the include-local-lan command.
Note
•
•
•
Examples
The following example shows that the Include-Local-LAN has been configured:
crypto isakmp client configuration group ciscoinclude-local-lanSyntax Description
acl
Configures split tunneling.
crypto isakmp client configuration group
Specifies the DNS domain to which a group belongs.
incoming
To configure filtering for incoming IP traffic, use the incoming command in router IP traffic export (RITE) configuration mode. To disable filtering for incoming traffic, use the no form of this command.
incoming {access-list {standard | extended | named} | sample one-in-every packet-number}
no incoming {access-list {standard | extended | named} | sample one-in-every packet-number}
Syntax Description
Defaults
If this command is not enabled, all incoming IP traffic will be filtered via sampling.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
When configuring a network device for exporting IP traffic, you can issue the incoming command to filter unwanted traffic via the following methods:
•
•
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the ACL "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
ip traffic-export profile
Creates or edits an IP traffic export profile and enables the profile on an ingress interface.
outgoing
Configures filtering for outgoing export traffic.
initiate mode
To configure the Phase 1 mode of an Internet Key Exchange (IKE), use the initiate mode command in ISAKMP profile configuration mode. To remove the mode that was configured, use the no form of this command.
initiate mode aggressive
no initiate mode aggressive
Syntax Description
Defaults
IKE initiates main mode.
Command Modes
ISAKMP profile configuration (config-isa-prof)
Command History
12.2(15)T
This command was introduced.
Cisco IOS XE Release 2.6
This command was integrated into Cisco IOS XE Release 2.6.
Usage Guidelines
Use this command if you want to initiate an IKE aggressive mode exchange instead of a main mode exchange.
Examples
The following example shows that aggressive mode has been configured:
crypto isakmp profile vpnprofileinitiate mode aggressiveinservice (WebVPN)
To enable a SSL VPN gateway or context process, use the inservice command in webvpn gateway configuration or webvpn context configuration mode. To disable a SSL VPN gateway or context process without removing the configuration from the router configuration file, use the no form of this command.
inservice
no inservice
Syntax Description
This command has no arguments or keywords.
Command Default
A SSL VPN gateway or context process is not enabled.
Command Modes
Webvpn gateway configuration
Webvpn context configurationCommand History
Usage Guidelines
The enable form of this command initializes required system data structures, initializes TCP sockets, and performs other start-up tasks related to the SSL VPN gateway or context process. The gateway and context processes must both be "inservice" to enable SSL VPN.
Examples
The following example enables the SSL VPN gateway process named SSL_GATEWAY:
Router(config)# webvpn gateway SSL_GATEWAYRouter(config-webvpn-gateway)# inserviceThe following example configures and activates the SSL VPN context configuration:
Router(config)# webvpn context context1Router(config-webvpn-context)# inserviceRelated Commands
webvpn context
Enters webvpn configuration mode to configure the SSL VPN context.
webvpn gateway
Defines a SSL VPN gateway and enters webvpn gateway configuration mode.
inspect
To enable Cisco IOS stateful packet inspection, use the inspect command in policy-map-class configuration mode. To disable stateful packet inspection, use the no form of this command.
inspect [parameter-map-name]
no inspect [parameter-map-name]
Syntax Description
parameter-map-name
(Optional) Name of a previously configured inspect parameter-map. If you do not specify a parameter map name, the software uses the default values for all the parameters.
Command Default
None
Command Modes
Policy-map-class configuration
Command History
Usage Guidelines
You can use this subcommand after entering the policy-map type inspect, class type inspect, and parameter-map type inspect commands.
To enable Cisco IOS stateful packet inspection, enter the name of an inspect parameter-map that was previously configured by using the parameter-map type inspect command.
This command lets you specify the attributes that will be used for the inspection.
Examples
The following example specifies inspection parameters for alert and audit-trail, and requests the inspect action with the specified parameters:
parameter-map type inspect insp-paramsalert onaudit-trail onpolicy-map type inspect mypolicyclass type inspect inspect-trafficinspect inspect-paramsRelated Commands
integrity
To specify one or more integrity algorithms for an Internet Key Exchange Version 2 (IKEv2) proposal, use the integrity command in IKEv2 proposal configuration mode. To remove the configuration of the hash algorithm, use the no form of this command.
integrity {sha1} {sha256} {sha384} {sha512} {md5}
no integrity
Syntax Description
Command Default
The default integrity algorithm is used.
Command Modes
IKEv2 proposal configuration (config-ikev2-proposal)
Command History
Usage Guidelines
Use this command to specify the integrity algorithm to be used in an IKEv2 proposal. The default integrity algorithms in the default proposal are SHA-1 and MD5.
Note
Suite-B adds support for the SHA-2 family (HMAC variant) hash algorithm used to authenticate packet data and verify the integrity verification mechanisms for the IKEv2 proposal configuration. HMAC is a variant that provides an additional level of hashing.
Examples
The following example configures an IKEv2 proposal with the MD5 integrity algorithm:
Router(config)# crypto ikev2 proposal proposal1Router(config-ikev2-proposal)# integrity md5Related Commands
interface (RITE)
To specify the outgoing interface for exporting traffic, use the interface command in router IP traffic export (RITE) configuration mode. To disable an interface, use the no form of this command.
interface interface-name
no interface interface-name
Syntax Description
Defaults
If this command is not enabled, the exported IP traffic profile does not recognize an interface in which to send captured IP traffic.
Command Modes
RITE configuration
Command History
12.3(4)T
This command was introduced.
12.2(25)S
This command was integrated into Cisco IOS Release 12.2(25)S.
Usage Guidelines
After you configure an IP traffic export profile via the ip traffic-export profile global configuration command, you should issue the interface command; otherwise, the profile will be unable to export the captured IP packets. If you do not specify the interface command, you will receive a warning, which states that the profile is incomplete, when you attempt to apply the profile to an interface via the ip traffic-export apply profile interface configuration command.
Note
Examples
The following example shows how to configure the profile "corp1," which will send captured IP traffic to host "00a.8aab.90a0" at the interface "FastEthernet 0/1." This profile is also configured to export one in every 50 packets and to allow incoming traffic only from the access control list ACL "ham_ACL."
Router(config)# ip traffic-export profile corp1Router(config-rite)# interface FastEthernet 0/1Router(config-rite)# bidirectionalRouter(config-rite)# mac-address 00a.8aab.90a0Router(config-rite)# outgoing sample one-in-every 50Router(config-rite)# incoming access-list ham_aclRouter(config-rite)# exitRouter(config)# interface FastEthernet 0/0Router(config-if)# ip traffic-export apply corp1Related Commands
interface (VASI)
To configure a Virtual Routing and Forwarding (VRF)-Aware Software Infrastructure (VASI) virtual interface, use the interface command in global configuration mode. To remove a VASI configuration, use the no form of this command.
interface {vasileft | vasiright} number
no interface {vasileft | vasiright} number
Syntax Description
vasileft
Configures the vasileft interface.
vasiright
Configures the vasiright interface.
number
Identifier of the VASI interface. The range is from 1 to 1000.
Command Default
VASI interface is not configured.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The vasileft and vasiright interfaces must be configured before the VASI interface becomes active. The two halves of the interface pair must be configured separately. If only one half of the interface is configured and not the other half, then the VASI interface does not become active.
Examples
The following example shows how to configure vasileft and vasiright interfaces:
Router(config)# interface vasileft 200router(config-if)# vrf forwarding table1Router(config-if)# ip address 192.168.0.1 255.255.255.0Router(config-if)# exitRouter(config)# interface vasiright 200router(config-if)# vrf forwarding table2Router(config-if)# ip address 192.168.1.1 255.255.255.0Router(config-if)# exitRelated Commands
interface virtual-template
To create a virtual template interface that can be configured and applied dynamically in creating virtual access interfaces, use the interface virtual-template command in global configuration mode. To remove a virtual template interface, use the no form of this command.
interface virtual-template number
no interface virtual-template number
Syntax Description
Command Default
No virtual template interface is defined.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
A virtual template interface is used to provide the configuration for dynamically created virtual access interfaces. It is created by users and can be saved in NVRAM.
After the virtual template interface is created, it can be configured in the same way as a serial interface.
Virtual template interfaces can be created and applied by various applications such as virtual profiles, virtual private dialup networks (VPDNs), PPP over ATM, protocol translation, and Multichassis Multilink PPP (MMP).
Cisco 10000 Series Router
You can configure up to 4095 total virtual template interfaces on the Cisco 10000 series router.
To ensure proper scaling and to minimize CPU utilization, we recommend the following virtual template interface settings:
•
•
•
•
When a virtual template interface is applied dynamically to an incoming user session, a virtual access interface (VAI) is created.
If you configure a virtual template interface with interface-specific commands, the Cisco 10000 series router does not achieve the highest possible scaling. To verify that the router does not have interface-specific commands within the virtual template interface configuration, use the test virtual-template <number> subinterface command.
In Cisco IOS Release 12.2(33)SB, the default configuration for the virtual-template snmp command was changed to no virtual-template snmp. This prevents large numbers of entries into the MIB ifTable, thereby avoiding CPU Hog messages as SNMP uses the interfaces MIB and other related MIBs. If you configure the no virtual-template snmp command, the router no longer accepts the snmp trap link-status command under a virtual-template interface. Instead, the router displays a configuration error message such as the following:
Router(config)# interface virtual-template 1Router(config-if)# snmp trap link-status%Unable set link-status enable/disable for interfaceIf your configuration already has the snmp trap link-status command configured under a virtual-template interface and you upgrade to Cisco IOS Release 12.2(33)SB, the configuration error occurs when the router reloads even though the virtual template interface is already registered in the interfaces MIB.
Examples
Cisco 10000 Series Router
The following example creates a virtual template interface called Virtual-Template1:
Router(config)# interface Virtual-Template1Router(config-if)# ip unnumbered Loopback1Router(config-if)# keepalive 60Router(config-if)# no peer default ip addressRouter(config-if)# ppp authentication papRouter(config-if)# ppp authorization vpn1Router(config-if)# ppp accounting vpn1Router(config-if)# no logging event link-statusRouter(config-if)# no virtual-template snmpVirtual Template with PPP Authentication Example
The following example creates and configures virtual template interface 1:
interface virtual-template 1 type ethernetip unnumbered ethernet 0ppp multilinkppp authentication chapIPsec Virtual Template Example
The following example shows how to configure a virtual template for an IPsec virtual tunnel interface.
interface virtual-template1 type tunnelip unnumbered Loopback1tunnel mode ipsec ipv4tunnel protection ipsec profile virtualtunnelinterfaceRelated Commands
ip (webvpn url rewrite)
To configure the IP address of the site to be mangled on a Secure Socket Layer virtual private network (SSL VPN) gateway, use the ip command in webvpn url rewrite configuration mode. To deselect the IP address, use the no form of this command.
ip ip-address
no ip ip-address
Syntax Description
Command Default
A site is not selected for mangling.
Command Modes
Webvpn url rewrite (config-webvpn-url-rewrite)
Command History
Examples
The following example shows that the IP address 10.1.0.0 255.255.0.0 has been selected for mangling:
Router (config)# webvpn contextRouter (config-webvpn-context)# url rewriteRouter (config-webvpn-url-rewrite)# ip 10.1.0.0 255.255.0.0Related Commands
ip access-group
To apply an IP access list or object group access control list (OGACL) to an interface or a service policy map, use the ip access-group command in the appropriate configuration mode. To remove an IP access list or OGACL, use the no form of this command.
ip access-group {access-list-name | access-list-number} {in | out}
no ip access-group {access-list-number | access-list-name} {in | out}
Syntax Description
Defaults
An access list is not applied.
Command Modes
Interface configuration (config-if)
Service policy-map configuration (config-service-policymap)Command History
Usage Guidelines
If the specified access list does not exist, all packets are passed (no warning message is issued).
Applying Access Lists to Interfaces
Access lists or OGACLs are applied on either outbound or inbound interfaces. For standard inbound access lists, after an interface receives a packet, the Cisco IOS software checks the source address of the packet against the access list. For extended access lists or OGACLs, the networking device also checks the destination access list or OGACL. If the access list or OGACL permits the address, the software continues to process the packet. If the access list or OGACL rejects the address, the software discards the packet and returns an Internet Control Management Protocol (ICMP) host unreachable message.
For standard outbound access lists, after a device receives and routes a packet to a controlled interface, the software checks the source address of the packet against the access list. For extended access lists or OGACLs, the networking device also checks the destination access list or OGACL. If the access list or OGACL permits the address, the software sends the packet. If the access list or OGACL rejects the address, the software discards the packet and returns an ICMP host unreachable message.
When you enable outbound access lists or OGACLs, you automatically disable autonomous switching for that interface. When you enable inbound access lists or OGACLs on any CBus or CxBus interface, you automatically disable autonomous switching for all interfaces (with one exception—a Storage Services Enabler (SSE) configured with simple access lists can still switch packets, on output only).
Applying Access Lists or OGACLs to Service Policy Maps
You can use the ip access-group command to configure Intelligent Services Gateway (ISG) per-subscriber firewalls. Per-subscriber firewalls are Cisco IOS IP access lists or OGACLs that are used to prevent subscribers, services, and pass-through traffic from accessing specific IP addresses and ports.
ACLs and OGACLs can be configured in user profiles or service profiles on an authentication, authorization, and accounting (AAA) server or in service policy maps on an ISG. OGACLS or numbered or named IP access lists can be configured on the ISG, or the ACL or OGACL statements can be included in the profile configuration.
When an ACL or OGACL is added to a service, all subscribers of that service are prevented from accessing the specified IP address, subnet mask, and port combinations through the service.
Examples
The following example applies list 101 on packets outbound from Ethernet interface 0:
Router> enableRouter# configure terminalRouter(config)# interface ethernet 0Router(config-if)# ip access-group 101 outRelated Commands
ip access-list
To define an IP access list or object-group access control list (ACL) by name or number or to enable filtering for packets with IP helper-address destinations, use the ip access-list command in global configuration mode. To remove the IP access list or object-group ACL or to disable filtering for packets with IP helper-address destinations, use the no form of this command.
ip access-list {{standard | extended} {access-list-name | access-list-number} |
helper egress check}no ip access-list {{standard | extended} {access-list-name | access-list-number} |
helper egress check}Syntax Description
Command Default
No IP access list or object-group ACL is defined, and outbound ACLs do not match and filter IP helper relayed traffic.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Use this command to configure a named or numbered IP access list or an object-group ACL. This command places the router in access-list configuration mode, where you must define the denied or permitted access conditions by using the deny and permit commands.
Specifying the standard or extended keyword with the ip access-list command determines the prompt that appears when you enter access-list configuration mode. You must use the extended keyword when defining object-group ACLs.
You can create object groups and IP access lists or object-group ACLs independently, which means that you can use object-group names that do not yet exist.
Named access lists are not compatible with Cisco IOS software releases prior to Release 11.2.
Use the ip access-group command to apply the access list to an interface.
The ip access-list helper egress check command enables outbound ACL matching for permit or deny capability on packets with IP helper-address destinations. When you use an outbound extended ACL with this command, you can permit or deny IP helper relayed traffic based on source or destination User Datagram Protocol (UDP) ports. The ip access-list helper egress check command is disabled by default; outbound ACLs will not match and filter IP helper relayed traffic.
Examples
The following example defines a standard access list named Internetfilter:
Router> enableRouter# configure terminalRouter(config)# ip access-list standard InternetfilterRouter(config-std-nacl)# permit 192.168.255.0 0.0.0.255Router(config-std-nacl)# permit 10.88.0.0 0.0.255.255Router(config-std-nacl)# permit 10.0.0.0 0.255.255.255The following example shows how to create an object-group ACL that permits packets from the users in my_network_object_group if the protocol ports match the ports specified in my_service_object_group:
Router> enableRouter# configure terminalRouter(config)# ip access-list extended my_ogacl_policyRouter(config-ext-nacl)# permit tcp object-group my_network_object_group portgroup my_service_object_group anyRouter(config-ext-nacl)# deny tcp any anyThe following example shows how to enable outbound ACL filtering on packets with helper-address destinations:
Router> enableRouter# configure terminalRouter(config)# ip access-list helper egress checkRelated Commands
ip access-list hardware permit fragments
To permit all noninitial fragments in the hardware, use the ip access-list hardware permit fragments command in global configuration mode. To return to the default settings, use the no form of this command.
ip access-list hardware permit fragments
no ip access-list hardware permit fragments
Syntax Description
This command has no arguments or keywords.
Defaults
All fragments from flows that are received from an ACE with Layer 4 ports and permit action are permitted. All other fragments are dropped in the hardware. This action also applies to flows that are handled in the software regardless of this command setting.
Command Modes
Global configuration
Command History
Usage Guidelines
Flow fragments that match ACEs with Layer 4 ports and permit results are permitted in the hardware, and all other fragments are dropped. An entry is added in the TCAM for each ACE with Layer 4 ports and permit action. This action could cause large ACLs to not fit in the TCAM. If this is the case, use the ip access-list hardware permit fragments command to permit all noninitial fragments in the hardware.
Note
Note
The initial flow fragments that match the ACEs with Layer 4 ports and permit results are permitted in the hardware. All other initial fragments are dropped in the hardware.
Catalyst 6500 Series Switches
The following restrictions apply to Cisco IOS releases before Cisco IOS Release 12.2(18)SX5:
Note
Note
In Cisco IOS releases after Cisco IOS Release 12.2(18)SX5, this command affects all ACLs currently applied to interfaces and not just newly-applied ACLs.
Examples
This example shows how to permit all noninitial fragments in the hardware:
Router(config)# ip access-list hardware permit fragmentsThis example shows how to return to the default settings:
Router(config)# no ip access-list hardware permit fragmentsRelated Commands
show ip interface
Displays the usability status of interfaces that are configured for IP.
ip access-list logging interval
To configure the logging interval for access list entries, use the ip access-list logging interval command in global configuration mode. To disable the configuration, use the no form of this command.
ip access-list logging interval interval
no ip access-list logging interval
Syntax Description
Command Default
Access list logging intervals are not configured.
Command Modes
Global configuration (config)
Command History
Examples
The following example shows how to set the access list logging interval to 100 milliseconds:
Router# configure terminalRouter(config)# ip access-list logging interval 100Related Commands
ip access-list logging hash-generation
Enables hash-value generation for ACE syslog entries.
ip access-list log-update
To set the threshold number of packets that generate a log message if they match an access list, use the ip access-list log-update command in global configuration mode. To remove the threshold, use the no form of this command.
ip access-list log-update threshold number-of-matches
no ip access-list log-update
Syntax Description
number-of-matches
Threshold number of packets necessary to match an access list before a log message is generated. The range is 0 to 2147483647. There is no default number of matches.
Defaults
Log messages are sent at the first matching packet and at 5-minute intervals after that.
Command Modes
Global configuration
Command History
Usage Guidelines
Log messages are generated if you have specified the log keyword in the access-list (IP standard), access-list (IP extended), deny (IP), dynamic, or permit command.
Log messages provide information about the packets that are permitted or denied by an access list. By default, log messages appear at the console. (The level of messages logged to the console is controlled by the logging console command.) The log message includes the access list number, whether the packet was permitted or denied, and other information.
By default, the log messages are sent at the first matching packet and after that, identical messages are accumulated for 5-minute intervals, with a single message being sent with the number of packets permitted and denied during that interval. However, you can use the ip access-list log-update command to set the number of packets that, when match an access list (and are permitted or denied), cause the system to generate a log message. You might want to do this to receive log messages more frequently than at 5-minute intervals.
Caution
Even if you use the ip access-list log-update command, the 5-minute timer remains in effect, so the cache is emptied at the end of 5 minutes, regardless of the count of messages in the cache. Regardless of when the log message is sent, the cache is flushed and the count reset to 0 for that message the same way it is when a threshold is not specified.
If the syslog server is not directly connected to a LAN that the router shares, any intermediate router might drop the log messages because they are UDP (unreliable) messages.
Examples
The following example enables logging whenever the 1000th packet matches an access list entry:
ip access-list log-update threshold 1000Related Commands
ip access-list resequence
ip access-list resequence access-list-name starting-sequence-number increment
Syntax Description
Defaults
Disabled
Command Modes
Global configuration
Command History
Usage Guidelines
This command allows the permit and deny entries of a specified access list to be resequenced with an initial sequence number value determined by the starting-sequence-number argument, and continuing in increments determined by the increment argument. If the highest sequence number exceeds the maximum possible sequence number, then no sequencing occurs.
For backward compatibility with previous releases, if entries with no sequence numbers are applied, the first entry is assigned a sequence number of 10, and successive entries are incremented by 10. The maximum sequence number is 2147483647. If the generated sequence number exceeds this maximum number, the following message is displayed:
Exceeded maximum sequence number.If the user enters an entry without a sequence number, it is assigned a sequence number that is 10 greater than the last sequence number in that access list and is placed at the end of the list.
If the user enters an entry that matches an already existing entry (except for the sequence number), then no changes are made.
If the user enters a sequence number that is already present, the following error message is generated:
Duplicate sequence number.If a new access list is entered from global configuration mode, then sequence numbers for that access list are generated automatically.
Distributed support is provided so that the sequence numbers of entries in the Route Processor (RP) and line card (LC) are in synchronization at all times.
Sequence numbers are not saved in NVRAM. That is, the sequence numbers themselves are not saved. In the event that the system is reloaded, the configured sequence numbers revert to the default sequence starting number and increment.
This command works with named standard and extended IP access lists. Because the name of an access list can be designated as a number, numbers are acceptable as names as long as they are entered in named access list configuration mode.
Examples
The following example resequences an access list named kmd1. The starting sequence number is 100, and the increment value is 5:
ip access-list resequence kmd1 100 5Related Commands
deny (IP)
Sets conditions under which a packet does not pass a named IP access list.
permit (IP)
Sets conditions under which a packet passes a named IP access list.
ip access-list logging hash-generation
To enable hash-value generation for access control entry (ACE) syslog entries, use the ip access-list logging hash-generation command in global configuration mode. To disable hash value generation, use the no form of this command.
ip access-list logging hash-generation
no ip access-list logging hash-generation
Syntax Description
This command has no arguments or keywords.
Command Default
Hash value generation is disabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
Cisco IOS routers generate syslog entries for log-enabled ACEs. The system appends a tag (either a user-defined cookie or a router-generated MD5 hash value) to ACE syslog entries. This tag uniquely identifies the ACE, within an access control list (ACL), that generated the syslog entry.
Use this command to generate an MD5 hash value for all the log enabled ACEs in the system that do not have a user-defined cookie. The system attaches the router-generated hash value to the corresponding ACE. The hash value is stored locally in the router's NVRAM and persists through router reloads.
Examples
The following example shows how to enable hash value generation on the router, for IP access list syslog entries:
Router(config)# ip access-list logging hash-generationRouter(config)#
*Aug 7 01:10:12.077: %IPACL-HASHGEN: ACL: 101 seq no : 20 Hash code is 0x75F079
Related Commands
ip-address (ca-trustpoint)
To specify a dotted IP address or an interface that will be included as "unstructuredAddress" in the certificate request, use the ip-address command in ca-trustpoint configuration mode. To restore the default behavior, use the no form of this command.
ip-address {ip-address | interface | none]
no ip-address
Syntax Description
Defaults
An IP address is not configured. You will be prompted for the IP address during certificate enrollment.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Before you can issue this command, you must enable the crypto ca | pki trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode. The ip-address command is a subcommand that allows you to specify a certificate enrollment parameter.
Use the ip-address command to include the IP address of the specified interface in the certificate request or to specify that an IP address should not be included in the certificate request.
If this command is enabled, you will not be prompted for an IP address during certificate enrollment.
Examples
The following example shows how to include the IP address of the Ethernet-0 interface in the certificate request for the trustpoint "frog":
crypto ca trustpoint frogenrollment url http://frog.phoobin.com/subject-name OU=Spiral Dept., O=tiedye.comip-address ethernet-0The following example shows that an IP address is not to be included in the certificate request:
crypto ca trustpoint rootenrollment url http://10.3.0.7:80fqdn noneip-address nonesubject-name CN=subject1, OU=PKI, O=Cisco Systems, C=USRelated Commands
ip address dhcp
To acquire an IP address on an interface from the DHCP, use the ip address dhcp command in interface configuration mode. To remove any address that was acquired, use the no form of this command.
ip address dhcp [client-id interface-type number] [hostname hostname]
no ip address dhcp [client-id interface-type number] [hostname hostname]
Syntax Description
Defaults
The hostname is the globally configured hostname of the router.
The client identifier is an ASCII value.Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
Note
The ip address dhcp command allows any interface to dynamically learn its IP address by using the DHCP protocol. It is especially useful on Ethernet interfaces that dynamically connect to an Internet service provider (ISP). Once assigned a dynamic address, the interface can be used with the Port Address Translation (PAT) of Cisco IOS Network Address Translation (NAT) to provide Internet access to a privately addressed network attached to the router.
The ip address dhcp command also works with ATM point-to-point interfaces and will accept any encapsulation type. However, for ATM multipoint interfaces you must specify Inverse ARP via the protocol ip inarp interface configuration command and use only the aa15snap encapsulation type.
Some ISPs require that the DHCPDISCOVER message have a specific hostname and client identifier that is the MAC address of the interface. The most typical usage of the ip address dhcp client-id interface-type number hostname hostname command is when interface-type is the Ethernet interface where the command is configured and interface-type number is the hostname provided by the ISP.
A client identifier (DHCP option 61) can be a hexadecimal or an ASCII value. By default, the client identifier is an ASCII value. The client-id interface-type number option overrides the default and forces the use of the hexadecimal MAC address of the named interface.
Note
If a Cisco router is configured to obtain its IP address from a DHCP server, it sends a DHCPDISCOVER message to provide information about itself to the DHCP server on the network.
If you use the ip address dhcp command with or without any of the optional keywords, the DHCP option 12 field (hostname option) is included in the DISCOVER message. By default, the hostname specified in option 12 will be the globally configured hostname of the router. However, you can use the ip address dhcp hostname hostname command to place a different name in the DHCP option 12 field than the globally configured hostname of the router.
The no ip address dhcp command removes any IP address that was acquired, thus sending a DHCPRELEASE message.
You might need to experiment with different configurations to determine the one required by your DHCP server. Table 34 shows the possible configuration methods and the information placed in the DISCOVER message for each method.
Examples
In the examples that follow, the command ip address dhcp is entered for Ethernet interface 1. The DISCOVER message sent by a router configured as shown in the following example would contain "cisco- mac-address -Eth1" in the client-ID field, and the value abc in the option 12 field.
hostname abc!interface Ethernet 1ip address dhcpThe DISCOVER message sent by a router configured as shown in the following example would contain "cisco- mac-address -Eth1" in the client-ID field, and the value def in the option 12 field.
hostname abc!interface Ethernet 1ip address dhcp hostname defThe DISCOVER message sent by a router configured as shown in the following example would contain the MAC address of Ethernet interface 1 in the client-id field, and the value abc in the option 12 field.
hostname abc!interface Ethernet 1ip address dhcp client-id Ethernet 1The DISCOVER message sent by a router configured as shown in the following example would contain the MAC address of Ethernet interface 1 in the client-id field, and the value def in the option 12 field.
hostname abc!interface Ethernet 1ip address dhcp client-id Ethernet 1 hostname defRelated Commands
ip dhcp pool
Configures a DHCP address pool on a Cisco IOS DHCP server and enters DHCP pool configuration mode.
ip address (WebVPN)
To configure a proxy IP address on a Secure Socket Layer virtual private network (SSL VPN) gateway, use the ip address command in webvpn gateway configuration mode. To remove the proxy IP address from the SSL VPN gateway, use the no form of this command.
ip address ip-address [port port-number] [standby name]
no ip address
Syntax Description
Command Default
A proxy IP address is not configured.
Command Modes
Webvpn gateway configuration (config-webvpn-gateway)
Command History
12.4(6)T
This command was introduced.
12.4(20)T
The standby keyword and name arguments were added.
Usage Guidelines
The ip address command is used to configure a proxy IP address for an SSL VPN gateway. The IP address is the termination point for all SSL VPN client connections. This IP address can be any routable IP address assigned to a valid interface.
Examples
The following example configures 192.168.1.1 as a proxy address on an SSL VPN gateway. Proxy traffic is directed over port 443.
Router(config)# webvpn gateway SSL_GATEWAYRouter(config-webvpn-gateway)# ip address 192.168.1.1 port 443The following example shows that Router 1 and Router 2 are configured for HSRP on Gateway Webvpn:
Router 1 Configuration
Router# configure terminalRouter config)# interface g0/1Router (config-if)# standby 0 ip 10.1.1.1Router (config-if)# standby 0 name SSLVPNRouter (config-if)# exitRouter (config)# webvpn gateway WebvpnRouter (config-webvpn-gateway)# ip address 10.1.1.1 port 443 standby SSLVPNRouter 2 Configuration
Router# configure terminalRouter (config)# interface g0/0Router (config-if)# standby 0 ip 10.1.1.1Router (config-if)# standby 0 name SSLVPN2Router (config-if)# exitRouter (config)# webvpn gateway WebvpnRouter (config-webvpn-gateway)# ip address 10.1.1.1 port 443 standby SSLVPN2Related Commands
standby name
Configures the name of the standby group.
webvpn gateway
Defines an SSL VPN gateway and enters webvpn gateway configuration mode.
ip admission
To create a Layer 3 network admission control rule to be applied to the interface, or to create a policy that can be applied on an interface when the authentication, authorization and accounting (AAA) server is unreachable, use the ip admission command in interface configuration mode. To create a global policy that can be applied on a network access device, use the ip admission command with the optional keywords and argument in global configuration mode. To remove the admission control rule, use the no form of this command.
ip admission admission-name [event timeout aaa policy identity identity-policy-name]
no ip admission admission-name [event timeout aaa policy identity identity-policy-name]
Syntax Description
Command Default
A network admission control rule is not applied to the interface.
Command Modes
Interface configuration (config-if)
Global configuration (config)Command History
Usage Guidelines
The admission rule defines how you apply admission control.
The optional keywords and argument define the network admission policy to be applied to a network access device or an interface when no AAA server is reachable. The command can be used to associate a default identity policy with Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) sessions.
Examples
The following example shows how to apply a network admission control rule named "nacrule1" to the interface:
Router (config-if)# ip admission nacrule1The following example shows how to apply an identity policy named "example" to the device when the AAA server is unreachable:
Router (config)# ip admission nacrule1 event timeout aaa policy identity exampleRelated Commands
ip admission consent banner
To display a banner on the authentication proxy consent webpage, use the ip admission consent banner command in global configuration mode. To disable a display of the banner, use the no form of this command.
ip admission consent banner {file file-name | text banner-text}
no ip admission consent banner
Syntax Description
Command Default
A banner is not displayed on the authentication proxy consent webpage.
Command Modes
Global configuration
Command History
Usage Guidelines
The ip admission consent banner command allows users to configure one of two possible scenarios:
•
In this scenario, the administrator supplies the location and name of the file that is to be used for the consent webpage.
•
In this scenario, the administrator can supply multiline text that will be converted to HTML by the auth-proxy parser code. Thus, only the multiline text is displayed on the authentication proxy login page.
Note
Note
Examples
The following example shows how to display the file "consent_page.html" located in flash:
ip admission consent-banner file flash:consent_page.htmlThe following example shows how to specify the custom banner "Consent-Page-Banner-Text" to be displayed in the authentication proxy consent webpage:
ip admission consent-banner text ^C Consent-Page-Banner-Text ^CRelated Commands
ip auth-proxy auth-proxy-banner
Displays a banner, such as the router name, in the authentication proxy login page.
ip admission name
To create an IP network admission control rule, use the ip admission name command in global configuration mode. To remove the network admission control rule, use the no form of this command.
ip admission name admission-name [eapoudp [bypass] | proxy {ftp | http | telnet} | service-policy type tag {service-policy-name}] [list {acl | acl-name}] [event] [timeout aaa] [policy identity {identity-policy-name}]
no ip admission name admission-name [eapoudp [bypass] | proxy {ftp | http | telnet} | service-policy type tag {service-policy-name}] [list {acl | acl-name}] [event] [timeout aaa] [policy identity {identity-policy-name}]
Syntax for Authentication Proxy Consent Webpage
ip admission name admission-name consent [[absolute-timer minutes] [event] [inactivity-time minutes] [list {acl | acl-name}] [parameter-map consent-parameter-map-name]]
no ip admission name admission-name consent [[absolute-timer minutes] [event] [inactivity-time minutes] [list {acl | acl-name}] [parameter-map consent-parameter-map-name]]
Syntax Description
Command Default
An IP network admission control rule is not created.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The admission rule defines how you apply admission control.
You can associate the named rule with an ACL, providing control over which hosts use the admission control feature. If no standard access list is defined, the named admission rule intercepts IP traffic from all hosts whose connection-initiating packets are received at the configured interface.
The bypass keyword allows an administrator the choice of not having to use the EAPoUDP-based posture validation for the hosts that are trying to connect on the port. The bypass can be used if an administrator knows that the hosts that are connected on the port do not have the Cisco Trust Agent client installed.
The service-policy type tag {service-policy-name} keywords and argument allow you to associate the service policy of the type tag with the IP admission rule. On the network access device (NAD), a set of policies can be associated with an arbitrary tag string, and if the AAA server sends the same tag in response to the posture validation or authentication response, the policies that are associated with the tag can be applied on the host. The service policy keyword is an optional keyword, and if the service policy is not associated with the IP admission name, the policies that are received from the AAA server are applied on the host.
The list keyword option allows you to apply a standard, extended (1 through 199) or named access list to a named admission control rule. IP connections that are initiated by hosts in the access list are intercepted by the admission control feature.
The event keyword option allows you to specify the condition that triggered application of an identity policy.
The timeout aaa keyword option specifies that the AAA server is unreachable, and this condition is triggering the application of an identity policy.
The policy identity keyword and the identity-policy-name argument allow you to configure application of an identity policy and specify the policy type to be applied while the AAA server is unreachable.
The consent keyword and the parameter-map consent-parameter-map-name keyword and argument allow you to associate the authentication proxy consent feature with an IP admission rule. The consent feature enables customers to display a consent webpage to an end user, providing access to wireless services only after the end user accepts the agreement.
Examples
"Tag and Template" Feature Examples
The following example shows that an IP admission control rule is named "greentree" and that it is associated with ACL "101." Any IP traffic that is destined to a previously configured network (using the access-list command) will be subjected to antivirus state validation using EAPoUDP.
Router (config)# ip admission name greentree eapoudp list 101The following example shows that EAPoUDP bypass has been configured:
Router (config)# ip admission name greentree eapoudp bypass list 101In the following service policy example, tags named "healthy" and "non_healthy" can be received from an AAA server, the policy map is defined on the NAD, and the tag policy type is associated with the IP admission name "greentree."
Class Map Definition for the "healthy class" Type Tag
Router (config)# class-map type tag healthy_classRouter(config-cmap)# match tag healthyRouter(config-cmap)# endClass Map Definition for the "non_healthy_class" Type Tag
Router (config)# class-map type tag non_healthy_classRouter (config-cmap)# match tag non_healthyRouter (config-cmap)# endPolicy Map Definition
! The following line will be associated with the IP admission name.Router (config)# policy-map type control tag global_class! The following line refers to the healthy class map that was defined above.Router (config-pmap)# class healthy_classRouter (config-pmap-c)# identity policy healthy_policyRouter(config-pmap-c)# exitThe following line refers to the non_healthy class that was defined above.Router (config-pmap)# class non_healthy_classRouter(config-pmap-c)# identity policy non_healthy_policyRouter (config-pmap-c)# endIdentity Policy Definition
Router (config)# identity policy healthy_policy! The following line is the IP access list for healthy users.Router (config-identity-policy)# access-group healthyRouter (config-identity-policy)# endRouter (config)# identity policy non_healthy_policyRouter (config-identity-policy)# access-group non_healthyRouter (config-identity-policy)# endDefining Access Lists
Router (config)# ip access-list extended healthy_class! The following line can be anything, but as an example, traffic is being allowed.Router (config-ext-nacl)# permit ip any anyRouter (config-ext-nac)# endRouter (config)# ip access-list extended non_healthy_class! The following line is only an example. In practical cases, you could prevent a user from accessing specific networks.Router (config-ext-nacl)# deny ip any anyRouter (config-ext-nac)# endAssociating the Policy Map with the IP Admission Name
Router (config)# ip admission name greentree service-policy type tag global_class! In the next line, the admission name can be associated with the interface.Router (config)# interface fastethernet 1/0Router (config-if)# ip admission greentreeIn the above configuration, if the AAA server sends a tag named "healthy" or "non_healthy" for any host, the policies that are associated with the appropriate identity policy will be applied on the host.
NAC—Auth Fail Open Feature Examples
The following example shows how to define an IP admission control rule named "samplerule" and attach it to a specific interface:
Router (config)# ip admission name samplerule eapoudp list 101 event timeout aaa policy identity aaa_fail_policyRouter (config)# interface fastethernet 1/1
Router (config-if)# ip admission samplerule
Router (config-if)# end
In the above configuration, if the specified interface is not already authorized when the AAA server becomes unreachable, it will operate under the specified policy until revalidation is possible.
Authentication Proxy Consent Webpage Example
The following example shows how to configure an IP admission consent rule and associate the consent rule with the definitions of the parameter map "consent_parameter_map":
ip admission name consent-rule consent inactivity-time 204 absolute-timer 304 parameter-map consent_parameter_map list 103ip admission consent-banner file flash:consent_page.htmlip admission consent-banner text ^C Consen-Page-Banner-Text ^Cip admission max-login-attempts 5ip admission init-state-timer 15ip admission auth-proxy-auditip admission inactivity-timer 205ip admission absolute-timer 305ip admission ratelimit 100ip http serverip http secure-server!interface FastEthernet 0/0description ### CLIENT-N/W ###ip address 192.168.100.170 255.255.255.0ip access-group 102 inip admission consent-ruleno shutexit!interface FastEthernet 0/1description ### AAA-DHCP-AUDIT-SERVER-N/W ###ip address 192.168.104.170 255.255.255.0no shutexit!line con 0exec-timeout 0 0login authentication noAAAexit!line vty 0 15exec-timeout 0 0login authentication noAAAexit!
Related Commands
ip admission proxy http
To specify the display of custom authentication proxy web pages during web-based authentication, use the ip admission proxy http command in global configuration mode. To specify the use of the default web page, use the no form of this command.
ip admission proxy http {{login | success | failure | login expired} page file device:file-name} | {success redirect url}}
no ip admission proxy http {{login | success | failure | login expired} page file device:file-name} | {success redirect url}}
Syntax Description
Command Default
The internal default authentication proxy web pages are displayed during web-based authentication.
Command Modes
Global configuration
Command History
Usage Guidelines
When configuring the use of customized authentication proxy web pages, consider the following guidelines:
•
•
•
•
•
•
•
•
–
–
•
–
–
Examples
The following example shows how to configure custom authentication proxy web pages:
Router(config)# ip admission proxy http login page file disk1:login.htmRouter(config)# ip admission proxy http success page file disk1:success.htmRouter(config)# ip admission proxy http fail page file disk1:fail.htmRouter(config)# ip admission proxy http login expired page file disk1:expired.htmThe following example shows how to verify the configuration of custom authentication proxy web pages:
Router# show ip admission configurationAuthentication proxy webpageLogin page : disk1:login.htmSuccess page : disk1:success.htmFail Page : disk1:fail.htmLogin expired Page : disk1:expired.htmAuthentication global cache time is 60 minutesAuthentication global absolute time is 0 minutesAuthentication global init state time is 2 minutesAuthentication Proxy Session ratelimit is 100Authentication Proxy Watch-list is disabledAuthentication Proxy Auditing is disabledMax Login attempts per user is 5The following example shows how to configure a redirection URL for successful login:
Router(config)# ip admission proxy http success redirect www.example.comThe following example shows how to verify the redirection URL for successful login:
Router# show ip admission configurationAuthentication Proxy Banner not configuredCustomizable Authentication Proxy webpage not configuredHTTP Authentication success redirect to URL: http://www.example.comAuthentication global cache time is 60 minutesAuthentication global absolute time is 0 minutesAuthentication global init state time is 2 minutesAuthentication Proxy Watch-list is disabledAuthentication Proxy Max HTTP process is 7Authentication Proxy Auditing is disabledMax Login attempts per user is 5Related Commands
ip http server
ip https serverEnables the HTTP server within the switch.
show ip admission configuration
Displays the configuration of web-based authentication ip admission.
ip audit
To apply an audit specification created with the ip audit command to a specific interface and for a specific direction, use the ip audit command in interface configuration mode. To disable auditing of the interface for the specified direction, use the no version of this command.
ip audit audit-name {in | out}
no ip audit audit-name {in | out}
Syntax Description
Defaults
No audit specifications are applied to an interface or direction.
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the ip audit interface configuration command to apply an audit specification created with the
ip audit command to a specific interface and for a specific direction.Examples
In the following example, the audit specification MARCUS is applied to an interface and direction:
interface e0ip audit MARCUS inIn the following example, the audit specification MARCUS is removed from the interface on which it was previously added:
interface e0no ip audit MARCUS inip audit attack
To specify the default actions for attack signatures, use the ip audit attack command in global configuration mode. To set the default action for attack signatures, use the no form of this command.
ip audit attack {action [alarm] [drop] [reset]}
no ip audit attack
Syntax Description
Defaults
The default action is alarm.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the ip audit attack global configuration command to specify the default actions for attack signatures.
Examples
In the following example, the default action for attack signatures is set to all three actions:
ip audit attack action alarm drop resetip audit info
To specify the default actions for info signatures, use the ip audit info command in global configuration mode. To set the default action for info signatures, use the no form of this command.
ip audit info {action [alarm] [drop] [reset]}
no ip audit info
Syntax Description
Defaults
The default action is alarm.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the ip audit info global configuration command to specify the default actions for info signatures.
Examples
In the following example, the default action for info signatures is set to all three actions:
ip audit info action alarm drop resetip audit name
To create audit rules for info and attack signature types, use the ip audit name command in global configuration mode. To delete an audit rule, use the no form of this command.
ip audit name audit-name {info | attack} [list standard-acl] [action [alarm] [drop] [reset]]
no ip audit name audit-name {info | attack}
Syntax Description
Defaults
If an action is not specified, the default action is alarm.
Command Modes
Global configuration
Command History
Usage Guidelines
Any signatures disabled with the ip audit signature command do not become a part of the audit rule created with the ip audit name command.
Examples
In the following example, an audit rule called INFO.2 is created, and configured with all three actions:
ip audit name INFO.2 info action alarm drop resetIn the following example, an info signature is disabled and an audit rule called INFO.3 is created:
ip audit signature 1000 disableip audit name INFO.3 info action alarm drop resetIn the following example, an audit rule called ATTACK.2 is created with an attached ACL 91, and the ACL is created:
ip audit name ATTACK.2 list 91access-list 91 deny 10.1.0.0 0.0.255.255access-list 91 permit anyip audit notify
To specify the method of event notification, use the ip audit notify command in global configuration mode. To disable event notifications, use the no form of this command.
ip audit notify {nr-director | log}
no ip audit notify {nr-director | log}
Syntax Description
nr-director
Send messages in NetRanger format to the NetRanger Director or Sensor.
log
Send messages in syslog format.
Defaults
The default is to send messages in syslog format.
Command Modes
Global configuration
Command History
Usage Guidelines
If messages are sent to the NetRanger Director, then you must also configure the NetRanger Director's Post Office transport parameters using the ip audit po remote command.
Examples
In the following example, event notifications are specified to be sent in NetRanger format:
ip audit notify nr-directorRelated Commands
ip audit po local
To specify the local Post Office parameters used when sending event notifications to the NetRanger Director, use the ip audit po local command in global configuration mode. To set the local Post Office parameters to their default settings, use the no form of this command.
ip audit po local hostid id-number orgid id-number
no ip audit po local [hostid id-number orgid id-number]
Syntax Description
Defaults
The default organization ID is 1. The default host ID is 1.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the ip audit po local global configuration command to specify the local Post Office parameters used when sending event notifications to the NetRanger Director.
Examples
In the following example, the local host is assigned a host ID of 10 and an organization ID of 500:
ip audit po local hostid 10 orgid 500ip audit po max-events
To specify the maximum number of event notifications that are placed in the router's event queue, use the ip audit po max-events command in global configuration mode. To set the number of recipients to the default setting, use the no version of this command.
ip audit po max-events number-of-events
no ip audit po max-events
Syntax Description
number-of-events
Integer in the range from 1 to 65535 that designates the maximum number of events allowable in the event queue. The default is 100 events.
Defaults
The default number of events is 100.
Command Modes
Global configuration
Command History
Usage Guidelines
Raising the number of events past 100 may cause memory and performance impacts because each event in the event queue requires 32 KB of memory.
Examples
In the following example, the number of events in the event queue is set to 250:
ip audit po max-events 250ip audit po protected
To specify whether an address is on a protected network, use the ip audit po protected command in global configuration mode. To remove network addresses from the protected network list, use the no form of this command.
ip audit po protected ip-addr [to ip-addr]
no ip audit po protected [ip-addr]
Syntax Description
Defaults
If no addresses are defined as protected, then all addresses are considered outside the protected network.
Command Modes
Global configuration
Command History
Usage Guidelines
You can enter a single address at a time or a range of addresses at a time. You can also make as many entries to the protected networks list as you want. When an attack is detected, the corresponding event contains a flag that denotes whether the source or destination of the packet belongs to a protected network or not.
If you specify an IP address for removal, that address is removed from the list. If you do not specify an address, then all IP addresses are removed from the list.
Examples
In the following example, a range of addresses is added to the protected network list:
ip audit po protected 10.1.1.0 to 10.1.1.255In the following example, three individual addresses are added to the protected network list:
ip audit po protected 10.4.1.1ip audit po protected 10.4.1.8ip audit po protected 10.4.1.25In the following example, an address is removed from the protected network list:
no ip audit po protected 10.4.1.1ip audit po remote
To specify one or more set of Post Office parameters for NetRanger Directors receiving event notifications from the router, use the ip audit po remote global configuration command. To remove a NetRanger Director's Post Office parameters as defined by host ID, organization ID, and IP address, use the no form of this command.
ip audit po remote hostid host-id orgid org-id rmtaddress ip-address localaddress ip-address [port port-number] [preference preference-number] [timeout seconds] [application {director | logger}]
no ip audit po remote hostid host-id orgid org-id rmtaddress ip-address
Syntax Description
Defaults
The default organization ID is 1.
The default host ID is 1.
The default UDP port number is 45000.
The default preference is 1.
The default heartbeat timeout is 5 seconds.
The default application is director.
Command Modes
Global configuration
Command History
Usage Guidelines
A router can report to more than one NetRanger Director. In this case, use the ip audit po remote command to add each NetRanger Director to which the router sends notifications.
More than one route can be established to the same NetRanger Director. In this case, you must give each route a preference number that establishes the relative priority of routes. The router always attempts to use the lowest numbered route, switching automatically to the next higher number when a route fails, and then switching back when the route begins functioning again.
A router can also report to a NetRanger Sensor. In this case, use the ip audit po remote command and specify logger as the application.
Examples
In the following example, two communication routes for the same dual-homed NetRanger Director are defined:
ip audit po remote hostid 30 orgid 500 rmtaddress 10.1.99.100 localaddress 10.1.99.1 preference 1ip audit po remote hostid 30 orgid 500 rmtaddress 10.1.4.30 localaddress 10.1.4.1 preference 2The router uses the first entry to establish communication with the NetRanger Director defined with host ID 30 and organization ID 500. If this route fails, then the router will switch to the secondary communications route. As soon as the first route begins functioning again, the router switches back to the primary route and closes the secondary route.
In the following example, a different Director is assigned a longer heartbeat timeout value because of network congestion, and is designated as a logger application:
ip audit po remote hostid 70 orgid 500 rmtaddress 10.1.8.1 localaddress 10.1.8.100 timeout 10 application directorip audit signature
To attach a policy to a signature, use the ip audit signature command in global configuration mode. To remove the policy, use the no form of this command. If the policy disabled a signature, then the no form of this command reenables the signature. If the policy attached an access list to the signature, the no form of this command removes the access list.
ip audit signature signature-id {disable | list acl-list}
no ip audit signature signature-id
Syntax Description
Defaults
No policy is attached to a signature.
Command Modes
Global configuration
Command History
Usage Guidelines
This command allow you to set two policies: disable the audit of a signature or qualify the audit of a signature with an access list.
If you are attaching an access control list to a signature, then you also need to create an audit rule with the ip audit name command and apply it to an interface with the ip audit command.
Examples
In the following example, a signature is disabled, another signature has ACL 99 attached to it, and ACL 99 is defined:
ip audit signature 6150 disableip audit signature 1000 list 99access-list 99 deny 10.1.10.0 0.0.0.255access-list 99 permit anyip audit smtp
To specify the number of recipients in a mail message over which a spam attack is suspected, use the ip audit smtp command in global configuration mode. To set the number of recipients to the default setting, use the no form of this command.
ip audit smtp spam number-of-recipients
no ip audit smtp spam
Syntax Description
Defaults
The default number of recipients is 250.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the ip audit smtp global configuration command to specify the number of recipients in a mail message over which a spam attack is suspected.
Examples
In the following example, the number of recipients is set to 300:
ip audit smtp spam 300ip auth-proxy (global configuration)
To set the the authentication proxy idle timeout or maximum number of idle connections, use the ip auth-proxy command in global configuration mode. To return the idle timeout or maximum number of idle connections to their default values, use the no form of this command.
ip auth-proxy {absolute-timer min | inactivity-timer min | init-state-timer min| max-nodata-conns number}
no ip auth-proxy [absolute-timer] [inactivity-timer] [init-state-timer] [max-nodata-conns]
Syntax Description
Command Default
The absolute timer is enabled indefinitely. The inactivity timer, and the INIT state timer are enabled. The limit on the number of global idle TCP connections is enabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
You use the ip auth-proxy command to set the global idle timeout value for the authentication proxy. The idle timeout value is the length of time an authentication cache entry, along with its associated dynamic user access control list, is cleared after a period of inactivity.
You use the absolute-timer keyword to configure the length of time during which the authentication proxy on the enabled interface is active. After the absolute timer expires, the authentication proxy is disabled regardless of any activity. You can override the global absolute timeout value with the local (per protocol) value, which you can enable by using the ip auth-proxy name command. The absolute timer is turned off by default, and the authentication proxy is enabled indefinitely.
You must set the value of the inactivity-timer keyword to a higher value than the idle timeout of any Context-Based Access Control (CBAC) protocols. Otherwise, when the authentication proxy removes the user profile (and its associated dynamic user ACLs), there might be idle connections monitored by CBAC. Removing these user-specific ACLs could cause those idle connections to hang. If the CBAC idle timeout value is shorter, CBAC resets these connections when the CBAC idle timeout expires, which is before the authentication proxy removes the user profile.
You use the init-state-timer keyword to configure the amount of time that the authentication proxy is allowed to clear connections that are in the INIT state. Authentication attempts can remain in the INIT state when the router is loaded heavily and the authentication is not completed in two minutes. This problem is more likely if HTTPS is used for authenticating users. The default value of two minutes is usually sufficient to handle most cases, but if not, you should use the init-state-timer keyword to increase this value.
You use the max-nodata-conns keyword to limit the number of idle TCP connections (TCP sessions that are active but do not transmit data for a long period of time). There is no timer associated with this number.
Examples
The following example sets the inactivity timer to 30 minutes:
Router> enableRouter# configure terminalRouter(config)# ip auth-proxy inactivity-timer 30The following example sets the INIT state timer to 15 minutes:
Router> enableRouter# configure terminalRouter(config)# ip auth-proxy init-state-timer 15Related Commands
ip auth-proxy (interface configuration)
To apply an authentication proxy rule at a firewall interface, use the ip auth-proxy command in interface configuration mode. To remove the authentication proxy rules, use the no form of this command.
ip auth-proxy auth-proxy-name
no ip auth-proxy auth-proxy-name
Syntax Description
auth-proxy-name
Specifies the name of the authentication proxy rule to apply to the interface configuration. The authentication proxy rule is established with the ip auth-proxy name command.
Defaults
No default behavior or values.
Command Modes
Interface configuration
Command History
Usage Guidelines
Use the ip auth-proxy command to enable the named authentication proxy rule at the firewall interface. Traffic passing through the interface from hosts with an IP address matching the standard access list and protocol type (HTTP) is intercepted for authentication if no corresponding authentication cache entry exists. If no access list is defined, the authentication proxy intercepts traffic from all hosts whose connection initiating packets are received at the configured interface.
Use the no form of this command with a rule name to disable the authentication proxy for a given rule on a specific interface. If a rule is not specified, the no form of this command disables the authentication proxy on the interface.
Examples
The following example configures interface Ethernet0 with the HQ_users rule:
interface e0ip address 172.21.127.210 255.255.255.0ip access-group 111 inip auth-proxy HQ_usersip nat insideRelated Commands
ip auth-proxy auth-proxy-banner
To display a banner, such as the router name, in the authentication proxy login page, use the ip auth-proxy auth-proxy-banner command in global configuration mode. To disable display of the banner, use the no form of this command.
ip auth-proxy auth-proxy-banner {ftp | http | telnet} [banner-text]
no ip auth-proxy auth-proxy-banner {ftp | http | telnet}
Syntax Description
Defaults
This command is not enabled, and a banner is not displayed on the authentication proxy login page.
Command Modes
Global configuration
Command History
Usage Guidelines
The ip auth-proxy auth-proxy-banner command allows users to configure one of two possible scenarios:
•
In this scenario, the administrator has not supplied any text. Thus, a default banner that states the following: "Cisco Systems, <router's hostname> Authentication" will be displayed in the authentication proxy login page. This scenario is most commonly used.
•
In this scenario, the administrator can supply multiline text that will be converted to HTML by the auth-proxy parser code. Thus, only the multiline text will displayed in the authentication proxy login page. You will not see the default banner, "Cisco Systems, <router's hostname> Authentication."
Note
Examples
The following example causes the router name to be displayed in the authentication proxy login page:
ip auth-proxy auth-proxy-banner ftpThe following example shows how to specify the custom banner "whozat" to be displayed in the authentication proxy login page:
ip auth-proxy auth-proxy-banner telnet CwhozatCRelated Commands
ip auth-proxy max-login-attempts
To limit the number of login attempts at a firewall interface in the interface configuration command mode, use the ip auth-proxy max-login-attempts command. Use the no form of this command to return to the default settings.
ip auth-proxy max-login-attempts number
no ip auth-proxy max-login-attempts
Syntax Description
number
Maximum number of login attempts. The range is 1 to 2147483647. The default value depends on the authentication mechanism:
•
•
•
Defaults
Enabled.
Command Modes
Interface configuration
Command History
12.2(17d)SXB
Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB.
12.2(33)SRA
This command was integrated into Cisco IOS release 12.(33)SRA.
Usage Guidelines
This command is supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2 only.
This command is supported on the firewall interfaces only.
The maximum login attempt functionality is independent of the watch-list feature. (You create a watch list with the ip access-list hardware permit fragments command.) If you do not configure a watch list, the existing authentication proxy behavior occurs, but it displays the new number for retries. If you configure a watch list, when the maximum is reached, the session is blocked and the IP address is put in the watch list.
Examples
This example shows how to set a limit to the number of login attempts at a firewall interface:
Router(config-if)# ip auth-proxy max-login-attempts 4Router(config-if)#Related Commands
ip auth-proxy name
To create an authentication proxy rule, use the ip auth-proxy name command in global configuration mode. To remove the authentication proxy rules, use the no form of this command.
Cisco IOS 12.4(6)T and Later Releases
ip auth-proxy name auth-proxy-name {ftp | http | telnet} [event timeout aaa policy identity id-policy-name] [absolute-timer timeout] [auth-cache-time timeout] [inactivity-time timeout] [list {list-num [service-policy type tag policy-name] | std-list-num | list-name}] [service-policy type tag service-policy-name]
no ip auth-proxy name auth-proxy-name {ftp | http | telnet}
Cisco IOS Release 12.2(33)SRA, 12.2SX, and Later Releases
ip auth-proxy name auth-proxy-name {ftp | http | telnet} [event timeout aaa policy identity id-policy-name] [absolute-timer timeout] [auth-cache-time timeout] [inactivity-time timeout] [list {list-num | std-list-num | list-name}]
no ip auth-proxy name auth-proxy-name {ftp | http | telnet}
Syntax Description
Command Default
The default value is equal to the value set with the ip auth-proxy auth-cache-time command.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
This command creates a named authentication proxy rule, and it allows you to associate that rule with an access control list (ACL), providing control over which hosts use the authentication proxy. The rule is applied to an interface on a router using the ip auth-proxy command.
Use the inactivity-time timeout option to override the global the authentication proxy cache timer. This option provides control over timeout values for specific authentication proxy rules. The authentication proxy cache timer monitors the length of time (in minutes) that an authentication cache entry, along with its associated dynamic user access control list, is managed after a period of inactivity. When that period of inactivity (idle time) expires, the authentication entry and the associated dynamic access lists are deleted.
Use the list option to associate a set of specific IP addresses or a named ACL with the ip auth-proxy name command.
Use the no form of this command with a rule name to remove the authentication proxy rules. If no rule is specified, the no form of this command removes all the authentication rules on the router, and disables the proxy at all interfaces.
Note
Examples
The following example shows how to create the HQ_users authentication proxy rule. Because an access list is not specified in the rule, all connection-initiating HTTP traffic is subjected to authentication.
ip auth-proxy name HQ_users httpThe following example shows how to create the Mfg_users authentication proxy rule and apply it to hosts specified in ACL 10:
access-list 10 192.168.7.0 0.0.0.255ip auth-proxy name Mfg_users http list 10The following example shows how to set the timeout value for Mfg_users to 30 minutes:
access-list 15 anyip auth-proxy name Mfg_users http inactivity-timer 30 list 15The following example shows how to disable the Mfg_users rule:
no ip auth-proxy name Mfg_usersThe following example shows how to disable the authentication proxy at all interfaces and remove all the rules from the router configuration:
no ip auth-proxy xyz ftpRelated Commands
ip auth-proxy watch-list
To enable and configure an authentication proxy watch list in the interface configuration command mode, use the ip auth-proxy watch-list command. To disable the watch-list functionality, remove an IP address from the watch list. Or, to return to the default setting, use the no form of this command.
ip auth-proxy watch-list {add-item ip-addr | enable | expiry-time minutes}
no ip auth-proxy watch-list [add-item ip-addr | expiry-time]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
Interface configuration
Command History
12.2(17d)SXB
Support for this command on the Supervisor Engine 2 was extended to Release 12.2(17d)SXB.
12.2(33)SRA
This command was integrated into Cisco IOS release 12.(33)SRA.
Usage Guidelines
This command is supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2 only.
The valid values for minutes are from 0 to the largest 32-bit positive number (0x7FFFFFFF or 2147483647 in decimal). Setting the minutes to 0 (zero) places the entries in the list permanently.
This command is supported on the firewall interfaces only.
Use the no form of this command to do the following:
•
•
•
A watch list consists of IP addresses that have opened TCP connections to port 80 and have not sent any data. No new connections are accepted from this type of IP address (to port 80) and the packet is dropped.
An entry remains in the watch list for the time that is specified by expiry-time minutes.
When you disable a watch list, no new entries are put into the watch list, but the sessions are put in SERVICE_DENIED state. The timer deletes sessions after 2 minutes.
Examples
This example shows how to enable an authentication proxy watch list:
Router(config-if)# ip auth-proxy watch-list enableRouter(config-if)#This example shows how to disable an authentication proxy watch list:
Router(config-if)# no ip auth-proxy watch-listRouter(config-if)#This example shows how to add an IP address to a watch list:
Router(config-if)# ip auth-proxy watch-list add-item 10.0.0.2Router(config-if)#This example shows how to set the duration of time that an entry is in a watch list:
Router(config-if)# ip auth-proxy watch-list expiry-time 29Router(config-if)#Related Commands
ip dhcp client broadcast-flag (interface)
To configure a DHCP client to set or clear the broadcast flag, use the ip dhcp client broadcast-flag command in interface configuration mode. To disable the configuration, use the no form of this command.
ip dhcp client broadcast-flag {clear | set}
no ip dhcp client broadcast-flag
Syntax Description
Command Default
The broadcast flag is set.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
For a DHCP server to work on a Dynamic Multipoint VPN (DMVPN) network, the DHCP client available on the spoke must unicast the DHCP messages from the server to the client. By default, the DHCP client on the spoke broadcasts the DHCP messages. The broadcast flag is set during broadcast. Hence, the DHCP client on the spoke must have an option to clear the DHCP broadcast flag. You can use the ip dhcp client broadcast-flag command to configure the DHCP client to set or clear the broadcast flag.
Examples
The following example shows how to configure a DHCP client to clear the broadcast flag:
Router(config)# tunnel 1Router(config-if)# ip dhcp client broadcast-flag clearRelated Commands
ip dhcp support tunnel unicast
To configure a spoke-to-hub tunnel to unicast DHCP replies over a Dynamic Multipoint VPN (DMVPN) network, use the ip dhcp support tunnel unicast command in global configuration mode. To disable the configuration, use the no form of this command.
ip dhcp support tunnel unicast
no ip dhcp support tunnel unicast
Syntax Description
This command has no arguments or keywords.
Command Default
A spoke-to-hub tunnel broadcasts the replies over the DMVPN network.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
By default, the DHCP replies are broadcast from the DMVPN hub to the spoke. The DHCP relay agent must unicast the DHCP messages for a DHCP server to be functional in the DMVPN environment. Hence for the DHCP to be functional in DMVPN environment, you must configure the DHCP relay agent to unicast the DHCP messages.
Use the ip dhcp support tunnel unicast command to configure the DHCP relay agent to unicast the DHCP protocol messages from the server (hub) to the client (spoke). The relay agent uses the nonbroadcast multiaccess (NBMA) address to create temporary routes in Next Hop Resolution Protocol (NHRP) to help unicast the DHCPOFFER and DHCPACK messages to the spoke.
Examples
The following example shows how to configure a spoke-to-hub tunnel to unicast the replies over a DMVPN network:
Router(config)# ip dhcp support tunnel unicastRelated Commands
ip address dhcp
Configures an IP address on an interface acquired through DHCP.
ip dhcp client broadcast-flag
Configures the DHCP client to set or clear the broadcast flag.
ip-extension
To specify that IP extensions are included in a certificate request either for enrollment or generation of a certificate authority (CA) certificate for the Cisco IOS CA, use the ip-extension command in ca-trustpoint configuration mode. To remove a previously specified IP extension, use the no form of this command.
ip-extension [multicast | unicast] {inherit [ipv4 | ipv6] | prefix ipaddress | range min-ipaddress max-ipaddress}
no ip-extension [multicast | unicast] {inherit [ipv4 | ipv6] | prefix ipaddress | range min-ipaddress max-ipaddress}
Syntax Description
Command Default
No IP extensions will be included in a certificate request.
Command Modes
Ca-trustpoint configuration (ca-trustpoint)
Command History
12.4(22)T
This command was introduced.
12.4(24)T
Support for IPv6 Secure Neighbor Discovery (SeND) was added.
Usage Guidelines
The ip-extension command may be used to specify IP extensions for a public key infrastructure (PKI) server or client and may be issued one or more times, including multiple issuances with the inherit, prefix, and range keywords. For the inherit option, if the address family is not specified, both IPv4 and IPv6 addresses will be inherited. When the IPv4 or IPv6 address family is not specified for prefix or range, the address family will be determined from the address format.
Note
Examples
The following example shows how to specify that multiple IP extensions are included in the server certificate request:
Router(ca-trustpoint)# ip-extension multicast prefix 10.64.0.0/11! Only multicast traffic with the IPv4 prefix 10.64.0.0/11 will be included in certificate requests.Router(ca-trustpoint)# ip-extension prefix 2001:100:1::/48
! Multicast and unicast traffic with the IPv6 prefix 2001:100:1::/48 will be included in certificate requests.
Router(ca-trustpoint)# ip-extension inherit
! Multicast and unicast traffic with IPv4 and IPv6 addresses will be inherited from the issuer's certificate.
Router(ca-trustpoint)# ip-extension inherit ipv6
! Multicast and unicast traffic with IPv6 addresses only will be inherited from the issuer's certificate.
Router(ca-trustpoint)# ip-extension unicast range 209.165.200.225 143.255.55.255
! Unicast traffic within the specified IPv4 address range will be included in the certificate request.Router(ca-trustpoint)# ip-extension range 2001:1:1::1 2001:1:2:ffff:ffff:ffff:ffff:ffff! Multicast and unicast traffic within the specified IPv6 address range will be included in the certificate request.The following is sample output from the show crypto pki certificates verbose command. The output displays X.509 certificate IP address extension information where the IPv4 multicast prefix has been set to 10.64.0.0/11, and the IPv4 unicast range has been set to 209.165.201.1 209.165.201.30.
CA CertificateStatus: AvailableVersion: 3Certificate Serial Number (hex): 01Certificate Usage: SignatureIssuer:cn=srtr1Subject:cn=srtr1Validity Date:start date: 21:50:11 PST Sep 29 2008end date: 21:50:11 PST Sep 29 2011Subject Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (1024 bit)Signature Algorithm: MD5 with RSA EncryptionFingerprint MD5: 30C1C9B6 BC17815F DF6095CD EDE2A5F3Fingerprint SHA1: A67C451E 49E94E87 8EB0F71D 5BE642CF C68901EFX509v3 extensions:X509v3 Key Usage: 86000000Digital SignatureKey Cert SignCRL SignatureX509v3 Subject Key ID: B593E52F F711094F 1CCAA4AE 683049AE 4ACE8E8CX509v3 Basic Constraints:CA: TRUEX509v3 Authority Key ID: B593E52F F711094F 1CCAA4AE 683049AE 4ACE8E8CAuthority Info Access:X509v3 IP Extension:IPv4 (Unicast):209.165.202.129-209.165.202.158IPv4 (Multicast):10.64.0.0/11Associated Trustpoints: srtr1Related Commands
show crypto pki certificates
Displays information about the CA certificate.
show crypto pki trustpoints
Displays information about trustpoints that are configured on the router.
ip http ezvpn
To enable the Cisco Easy VPN remote web server interface, use the ip http ezvpn command in global configuration mode. To disable the Cisco Easy VPN remote web server interface, use the no form of this command.
Cisco uBR905 and Cisco BR925 cable access routers
ip http ezvpn
no ip http ezvpn
Syntax Description
This command has no arguments or keywords.
Defaults
The Cisco Easy VPN Remote web server interface is disabled by default.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
This command enables the Cisco Easy VPN Remote web server, an onboard web server that allows users to connect an IPSec Easy VPN tunnel and to provide the required authentication information. The Cisco Easy VPN Remote web server allows the user to perform these functions without having to use the Cisco command-line interface (CLI).
Before using this command, you must first enable the Cisco web server that is onboard the cable access router by entering the ip http server command. Then use the ip http ezvpn command to enable the Cisco Easy VPN remote web server. You can then access the web server by entering the IP address for the Ethernet interface of the router in your web browser.
Note
Examples
The following example shows how to enable the Cisco Easy VPN remote web server interface:
Router# configure terminalRouter(config)# ip http serverRouter(config)# ip http ezvpnRouter(config)# exitRouter# copy running-config startup-configRelated Commands
