-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Feedback
Table Of Contents
security authentication failure rate
server (application firewall policy)
service-module ids heartbeat-reset
sa ipsec
To specify the IP security (IPsec) security association (SA) policy information to be used for a Group Domain of Interpretation (GDOI) group and to enter GDOI SA IPsec configuration mode, use the sa ipsec command in GDOI local server configuration mode. To remove the policy information that was specified, use the no form of this command.
sa ipsec {sequence-number}
no sa ipsec {sequence-number}
Syntax Description
Command Default
None
Command Modes
GDOI local server configuration
Command History
Usage Guidelines
IPsec and SA policy information must be specified using this command if the traffic encryption key policy has to be defined.
Examples
The following example shows that three IPsec SA policy numbers (1, 2, and 3) have been specified:
sa ipsec 1profile gdoi-pmatch address ipv4 120sa ipsec 2profile gdoi-qmatch address ipv4 121sa ipsec 3profile gdoi-rmatch address ipv4 122Related Commands
sa receive-only
To specify that an IP security (IPsec) security association (SA) is to be installed by a group member as "inbound only," use the sa receive-only command in GDOI local server configuration mode. To remove the inbound-only specification, use the no form of this command.
sa receive-only
no sa receive-only
Syntax Description
This command has no arguments or keywords.
Command Default
If this command is not configured, IPsec SAs are installed by group members as both inbound and outbound.
Command Modes
GDOI local server configuration (config-local-server)
Command History
12.4(11)T
This command was introduced.
Cisco IOS XE Release 2.3
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
This command is configured on a key server. The command may be used to ease in deployment.
Examples
The following example shows that the Group Domain of Interpretation (GDOI) group is instructed by the key server to install the IPsec SAs as "inbound only":
crypto gdoi group gdoi_groupidentity number 1234server localsa receive-onlysa ipsec 1profile gdoi-pmatch address ipv4 120Related Commands
save-password
To save your extended authentication (Xauth) password locally on your PC, use the save-password command in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode. To disable the Save-Password attribute, use the no form of this command.
save-password
no save-password
Syntax Description
This command has no arguments or keywords.
Defaults
Your Xauth password is not saved locally on your PC, and the Save-Password attribute is not added to the server group profile.
Command Modes
ISAKMP group configuration (config-isakmp-group)
Command History
Usage Guidelines
Save password control allows you to save your Xauth password locally on your PC so that after you have initially entered the password, the Save-Password attribute is pushed from the server to the client. On subsequent authentications, you can activate the password by using the tick box on the software client or by adding the username and password to the Cisco IOS hardware client profile. The password setting remains until the Save-Password attribute is removed from the server group profile. After the password has been activated, the username and password are sent automatically to the server during Xauth without your intervention.
The save-password option is useful only if your password is static, that is, if it is not a one-time password such as one that is generated by a token.
The Save-Password attribute is configured on a Cisco IOS router or in the RADIUS profile.
To configure save password control, use the save-password command.
An example of an attribute-value (AV) pair for the Save-Password attribute is as follows:
ipsec:save-password=1You must enable the crypto isakmp client configuration group command, which specifies group policy information that has to be defined or changed, before enabling the save-password command.
Note
•
•
•
•
Examples
The following example shows that the Save-Password attribute has been configured:
crypto isakmp client configuration group ciscosave-passwordRelated Commands
acl
Configures split tunneling.
crypto isakmp client configuration group
Specifies the DNS domain to which a group belongs.
scheme
To define the redundancy scheme that is used between two devices, use the scheme command in inter-device configuration mode. To disable the redundancy scheme, use the no form of this command.
scheme standby standby-group-name
no scheme standby standby-group-name
Syntax Description
Defaults
A redundancy scheme is not specified.
Command Modes
Inter-device configuration
Command History
Usage Guidelines
Only the active or standby state of the standby group is used for Stateful Switchover (SSO). The virtual IP (VIP) address of the standby group is not required or used by SSO. Also, the standby group does not have to be part of any crypto map configuration.
Examples
The following example shows how to enable SSO and define the standby scheme that is to be used by the active and standby devices:
redundancy inter-devicescheme standby HA-in!!ipc zone defaultassociation 1no shutdownprotocol sctplocal-port 5000local-ip 10.0.0.1remote-port 5000remote-ip 10.0.0.2Related Commands
search-filter
To configure a search request sent by the Lightweight Directory Access Protocol (LDAP) client to the server in order to find the user's node in the Directory Information Tree (DIT), use the search-filter command in LDAP server configuration mode. To delete the search request from the LDAP server group, use the no form of this command.
search-filter user-object-type string
no search-filter user-object-type string
Syntax Description
user-object-type
Adds a user attribute to the search filter.
string
Name of the object class attribute.
Command Default
No default search requests are configured.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Usage Guidelines
You can add multiple search filter attributes by using the search-filter command. The search filter is a mandatory configuration for an LDAP server, because it is used to filter the exact user from the search results. Without this configuration, a user cannot be authenticated. The search-filter command helps you to filter the search results based on the attributes mentioned in the search filter.
Examples
The following example shows how to filter the search results for an LDAP server. After you have specified the search criteria as shown below, the search filter string appears in the "(&(objectclass=person) (&(cn=$userid)(cid=$contextid)))" format.
Router(config)# ldap server server1Router(config-ldap-server)# search-filter user-object-type cnRouter(config-ldap-server)# search-filter user-object-type cidRouter(config-ldap-server)# search-filter user-object-type objectclassRelated Commands
secondary-color
To configure the color of the secondary title bars on the login and portal pages of a SSL VPN website, use the secondary-color command in webvpn context configuration mode. To remove the color from the WebVPN context configuration, use the no form of this command.
secondary-color color
no secondary-color color
Syntax Description
Defaults
The color purple is used if this command is not configured or if the no form is entered.
Command Modes
Webvpn context configuration
Command History
Usage Guidelines
Configuring a new color overrides the color of the preexisting color.
Examples
The following examples show the three forms in which the secondary color is configured:
Router(config-webvpn-context)# secondary-color darkseagreenRouter(config-webvpn-context)# secondary-color #8FBC8FRouter(config-webvpn-context)# secondary-color 143,188,143Related Commands
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
secondary-text-color
To configure the color of the text on the secondary bars of an SSL VPN website, use the secondary-text-color command in webvpn context configuration mode. To revert to the default color, use the no form of this command.
secondary-text-color [black | white]
no secondary-text-color [black | white]
Syntax Description
black
(Optional) Color of the text is black. This is the default value.
white
(Optional) Color of the text is white.
Defaults
The color of the text on secondary bars is black if this command is not configured or if the no form is entered.
Command Modes
Webvpn context configuration
Command History
Usage Guidelines
The color of the text on the secondary bars must be aligned with the color of the text on the title bar.
Examples
The following example sets the secondary text color to white:
Router(config)# webvpn context context1Router(config-webvpn-context)# secondary-text-color whiteRouter(config-webvpn-context)#Related Commands
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
secret
To associate a command-line interface (CLI) view or a superview with a password, use the secret command in view configuration mode.
secret {[0] unencrypted-password | 5 encrypted-password}
Syntax Description
Defaults
The user cannot access a CLI view or superview.
Command Modes
View configuration (config-view)
Command History
Usage Guidelines
A user cannot access any commands within the CLI view or superview until the secret command has been issued.
Note
Examples
The following examples show how to configure two CLI views, "first" and "second," and associate each view with a password:
CLI View "first"
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# parser view firstRouter(config-view)#*Dec 9 05:20:03.039: %PARSER-6-VIEW_CREATED: view 'first' successfully created.Router(config-view)# secret firstpasswordRouter(config-view)# secret secondpassword% Overwriting existing secret for the current viewRouter(config-view)# secret 0 thirdpassword% Overwriting existing secret for the current viewRouter(config-view)# secret 5 $1$jj1e$vmYyRbmj5UoU96tT1x7eP1% Overwriting existing secret for the current viewRouter(config-view)# secret 5 invalidpasswordERROR: The secret you entered is not a valid encrypted secret.To enter an UNENCRYPTED secret, do not specify type 5 encryption.When you properly enter an UNENCRYPTED secret, it will be encrypted.Router(config-view)# command exec include show versionRouter(config-view)# command exec include configure terminalRouter(config-view)# command configure include all ipRouter(config-view)# exitCLI View "second"
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# parser view secondRouter(config-view)#*Dec 30 06:11:52.915: %PARSER-6-VIEW_CREATED: view 'second' successfully created.Router(config-view)# secret mypasswdRouter(config-view)# commands exec include pingRouter(config-view)# endRouter# show running-configparser view secondsecret 5 $1$PWs8$lz3lSx6OqAnFrUx2hkI0w0commands exec include ping!The following is an example of show running-config output for a situation in which the secret command has been configured using a level 5 encrypted password:Router: show running-configparser view firstsecret 5 $1$jj1e$vmYyRbmj5UoU96tT1x7eP1commands configure include all ipcommands exec include configure terminalcommands exec include configurecommands exec include show versioncommands exec include show!Related Commands
secret-key
To configure the policy server secret key that is used to secure authentication requests, use the secret-key command in webvpn sso server configuration mode. To remove the secret key, use the no form of this command.
secret-key key-name
no secret-key key-name
Syntax Description
Command Default
A policy server secret key is not configured.
Command Modes
Webvpn sso server configuration
Command History
Usage Guidelines
Note
•
Examples
The following example shows the policy server secret key is "example.123":
webvpn context context1sso-server test-sso-serversecret-key example.123Warning Message
If a web agent URL and policy server secret key are not configured, a message similar to the following is received:
Warning: must configure web agent URL for sso-server "example"Warning: must configure SSO policy server secret key for sso-server "example"Warning: invalid configuration. SSO for "example" being disabledRelated Commands
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
secure boot-config
To take a snapshot of the router running configuration and securely archive it in persistent storage, use the secure boot-config command in global configuration mode. To remove the secure configuration archive and disable configuration resilience, use the no form of this command.
secure boot-config [restore filename]
no secure boot-config
Syntax Description
restore filename
(Optional) Reproduces a copy of the secure configuration archive as the supplied filename.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
Without any parameters, this command takes a snapshot of the router running configuration and securely archives it in persistent storage. Like the image, the configuration archive is hidden and cannot be viewed or removed directly from the command-line interface (CLI) prompt . It is recommended that you run this command after the router has been fully configured to reach a steady state of operation and the running configuration is considered complete for a restoration, if required. A syslog message is printed on the console notifying the user of configuration resilience activation. The secure archive uses the time of creation as its filename. For example, .runcfg-20020616-081702.ar was created July 16 2002 at 8:17:02.
The restore option reproduces a copy of the secure configuration archive as the supplied filename (disk0:running-config, slot1:runcfg, and so on). The restore operation will work only if configuration resilience is enabled. The number of restored copies that can be created is unlimited.
The no form of this command removes the secure configuration archive and disables configuration resilience. An enable, disable, enable sequence has the effect of upgrading the configuration archive if any changes were made to the running configuration since the last time the feature was disabled.
The configuration upgrade scenario is similar to an image upgrade. The feature detects a different version of Cisco IOS and notifies the user of a version mismatch. The same command can be run to upgrade the configuration archive to a newer version after new configuration commands corresponding to features in the new image have been issued.
The correct sequence of steps to upgrade the configuration archive after an image upgrade is as follows:
•
•
Examples
The following example shows the command used to securely archive a snapshot of the router running configuration:
secure boot-configThe following example shows the command used to restore an archived image to the file slot0:rescue-cfg:
Router(config)# secure boot-config restore slot0:rescue-cfgios resilience:configuration successfully restored as slot0:rescue-cfgRelated Commands
secure boot-image
Enables Cisco IOS image resilience.
show secure bootset
Displays the status of image and configuration resilience.
secure boot-image
To enable Cisco IOS image resilience, use the secure boot-image command in global configuration mode. To disable Cisco IOS image resilience and release the secured image so that it can be safely removed, use the no form of this command.
secure boot-image
no secure boot-image
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
This command enables or disables the securing of the running Cisco IOS image. The following two possible scenarios exist with this command.
•
•
ios resilience :Archived image and configuration version 12.2 differs from running version 12.3.Run secure boot-config and image commands to upgrade archives to running version.To upgrade the image archive to the new running image, reenter this command from the console. A message will be displayed about the upgraded image. The old image is released and will be visible in the dir command output.
Caution
Note
Examples
The following example shows the activation of image resilience.
Router(config)# secure boot-imageRelated Commands
secure cipher
To specify the ciphersuite in case of secure connection, use the secure cipher command in Lightweight Directory Access Protocol (LDAP) server configuration mode. To disable the secure connection, use the no form of this command.
secure cipher {3des-ede-cbc-sha | des-cbc-sha | rc4-128-md5 | rc4-128-sha | null-md5} [3des-ede-cbc-sha] [des-cbc-sha] [rc4-128-md5] [rc4-128-sha] [null-md5]
no secure cipher {3des-ede-cbc-sha | des-cbc-sha | rc4-128-md5 | rc4-128-sha} [3des-ede-cbc-sha] [des-cbc-sha] [rc4-128-md5] [rc4-128-sha] [null-md5]
Syntax Description
Command Default
If no ciphersuite is specified, all ciphersuites are considered.
Command Modes
LDAP server configuration (config-ldap-server)
Command History
Usage Guidelines
A ciphersuite is a set of authentication, encryption, and data integrity algorithms used for exchanging messages between network nodes. During a Secure Socket Layer (SSL) handshake, for example, the two nodes negotiate to see which cipher uite they will use when transmitting messages back and forth.
The secure cipher command specifies the crypto methods supported by the Lightweight Directory Access Protocol (LDAP) client in Cisco IOS software. This command is applicable only when the mode secure command is enabled.
Examples
The following example shows how to configure the crypto methods that are supported by LDAP in Cisco IOS software:
Router(config)# ldap server server1Router(config-ldap-server)# secure cipher des-cbc-shaRelated Commands
ldap server
Defines an LDAP server and enters LDAP server configuration mode.
mode secure
Enables the security mode in LDAP server.
security (Diameter peer)
To configure the security protocol for the Diameter peer connection, use the security command in Diameter peer configuration mode. To disable the configured protocol, use the no form of this command.
security {ipsec | tls}
no security {ipsec | tls}
Syntax Description
Command Default
IP security (IPsec) is the default security protocol for Diameter peer connections.
Command Modes
Diameter peer configuration
Command History
Usage Guidelines
If you dynamically change the security protocol for a Diameter peer, the connection to that peer is broken. When you exit the Diameter peer configuration submode, the connection is reestablished.
Examples
The following example shows how to configure IPsec for a Diameter peer:
Router (config-dia-peer)# security ipsecRelated Commands
diameter peer
Configures a Diameter peer and enters Diameter peer configuration submode.
show diameter peer
Displays the Diameter peer configuration.
security authentication failure rate
To configure the number of allowable unsuccessful login attempts, use the security authentication failure rate command in global configuration mode. To disable this functionality, use the no form of this command.
security authentication failure rate threshold-rate log
no security authentication failure rate threshold-rate log
Syntax Description
Defaults
The default number of failed login attempts before a 15-second delay is 10.
Command Modes
Global configuration
Command History
Usage Guidelines
The security authentication failure rate command provides enhanced security access to the router by generating syslog messages after the number of unsuccessful login attempts exceeds the configured threshold rate. This command ensures that there are not any continuous failures to access the router.
Note
Examples
The following example shows how to configure your router to generate a syslog message after eight failed login attempts:
security authentication failure rate 8 logRelated Commands
security passwords min-length
Ensures that all configured passwords are at least a specified length.
security ipsec
To apply a previously configured IP Security (IPSec) profile to the redundancy group communications, use the security ipsec command in inter-device configuration mode. To remove the IPSec profile from the configuration, use the no form of this command.
security ipsec profile-name
no security [ipsec [profile-name]]
Syntax Description
Defaults
The redundancy group is not secured.
Command Modes
Inter-device configuration
Command History
Usage Guidelines
The security ipsec command allows you to secure a redundancy group via a previously configured IPSec profile. If you are certain that the Stateful Switchover (SSO) traffic between the redundancy group runs on a physically secure interface, you do not have to configure this command.
Note
Examples
The following example shows how to configure SSO traffic protection:
crypto ipsec transform-set trans2 ah-md5-hmac esp-aes!crypto ipsec profile sso-secureset transform-set trans2!redundancy inter-devicescheme standby HA-insecurity ipsec sso-secureRelated Commands
security passwords min-length
To ensure that all configured passwords are at least a specified length, use the security passwords min-length command in global configuration mode. To disable this functionality, use the no form of this command.
security passwords min-length length
no security passwords min-length length
Syntax Description
Defaults
Six characters
Command Modes
Global configuration
Command History
12.3(1)
This command was introduced.
12.2(27)SBC
This command was integrated into Cisco IOS Release 12.2(27)SBC.
Usage Guidelines
The security passwords min-length command provides enhanced security access to the router by allowing you to specify a minimum password length, eliminating common passwords that are prevalent on most networks, such as "lab" and "cisco." This command affects user passwords, enable passwords and secrets, and line passwords. After this command is enabled, any password that is less than the specified length will fail.
Examples
The following example shows both how to specify a minimum password length of six characters and what happens when the password does not adhere to the minimum length:
security password min-length 6enable password lab% Password too short - must be at least 6 characters. Password not configured.Related Commands
self-identity
To define the identity that the local Internet Key Exchange (IKE) uses to identify itself to the remote peer, use the self-identity command in ISAKMP profile configuration mode. To remove the Internet Security Association and Key Management Protocol (ISAKMP) identity that was defined for the IKE, use the no form of this command.
self-identity {address | address ipv6] | fqdn | user-fqdn user-fqdn}
no self-identity {address | address ipv6] | fqdn | user-fqdn user-fqdn}
Syntax Description
Command Default
If no ISAKMP identity is defined in the ISAKMP profile configuration, global configuration is the default.
Command Modes
ISAKMP profile configuration (config-isa-prof)
Command History
12.2(15)T
This command was introduced.
12.4(4)T
The address ipv6 keyword was added.
Cisco IOS XE Release 2.1
This command was introduced on Cisco ASR 1000 Series Routers.
Examples
The following example shows that the IKE identity is the user FQDN "user@vpn.com":
crypto isakmp profile vpnprofileself-identity user-fqdn user@vpn.comRelated Commands
serial-number (ca-trustpoint)
To specify whether the router serial number should be included in the certificate request, use the serial-number command in ca-trustpoint configuration mode. To restore the default behavior, use the no form of this command.
serial-number [none]
no serial-number
Syntax Description
Defaults
Not configured. You will be prompted for the serial number during certificate enrollment.
Command Modes
Ca-trustpoint configuration
Command History
12.2(8)T
This command was introduced.
12.4(24)T
Support for IPv6 Secure Neighbor Discovery (SeND) command was introduced.
Usage Guidelines
Before you can issue the serial-number command, you must enable the crypto ca trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode.
Use this command to specify the router serial number in the certificate request, or use the none keyword to specify that a serial number should not be included in the certificate request.
Examples
The following example shows how to omit a serial number from the "root" certificate request:
crypto ca trustpoint rootenrollment url http://10.3.0.7:80ip-address nonefqdn noneserial-number nonesubject-name CN=jack, OU=PKI, O=Cisco Systems, C=UScrypto ca trustpoint rootenrollment url http://10.3.0.7:80serial-numberRelated Commands
serial-number (pubkey)
To define the serial number for the Rivest, Shamir, and Adelman (RSA) manual key to be used for encryption or signatures during Internet Key Exchange (IKE) authentication, use the serial-number command in pubkey configuration mode. To remove the manual key that was defined, use the no form of this command.
serial-number serial-number
no serial-number serial-number
Syntax Description
Defaults
No default behavior or values
Command Modes
Pubkey configuration (config-pubkey-key)
Command History
12.2(15)T
This command was introduced.
Cisco IOS XE Release 2.6
This command was integrated into Cisco IOS XE Release 2.6.
Examples
The following example shows that the public key of an IP Security (IPSec) peer has been specified:
Router(config)# crypto keyring vpnkeyringRouter(conf-keyring)# rsa-pubkey name host.vpn.comRouter(config-pubkey-key)# address 10.5.5.1Router(config-pubkey-key)# serial-number 1000000Router(config-pubkey)# key-stringRouter(config-pubkey)# 00302017 4A7D385B 1234EF29 335FC973Router(config-pubkey)# 2DD50A37 C4F4B0FD 9DADE748 429618D5Router(config-pubkey)# 18242BA3 2EDFBDD3 4296142A DDF7D3D8Router(config-pubkey)# 08407685 2F2190A0 0B43F1BD 9A8A26DBRouter(config-pubkey)# 07953829 791FCDE9 A98420F0 6A82045BRouter(config-pubkey)# 90288A26 DBC64468 7789F76E EE21Router(config-pubkey)# quitRouter(config-pubkey-key)# exitRouter(conf-keyring)# exitRelated Commands
address
Specifies the IP address of the remote RSA public key of the remote peer that you will manually configure.
key-string (IKE)
Specifies the RSA public key of a remote peer.
server (application firewall policy)
To configure a set of Domain Name System (DNS) servers for which the specified instant messenger application will be interacting, use the server command in the appropriate configuration mode. To change or remove a configured set of DNS servers, use the no form of this command.
server {permit | deny} {name string | ip-address {ip-address | range ip-address-start ip-address-end}
no server {permit | deny} {name string | ip-address {ip-address | range ip-address-start ip-address-end}
Syntax Description
Command Default
If this command is not issued, instant messenger application polices cannot be enforced.
Command Modes
cfg-appfw-policy-aim configuration
cfg-appfw-policy-ymsgr configuration
cfg-appfw-policy-msnmsgr configuration
Command History
Usage Guidelines
The server command helps the instant messenger application engine to recognize the port-hopping instant messenger traffic and to enforce the security policy for that instant messenger application; thus, if this command is not issued, the security policy cannot be enforced if IM applications use port-hopping techniques.
To deploy IM traffic enforcement policies effectively, it is recommended that you issue the appropriate server command.
Note
To configure more than one set of servers, you can issue the server command multiple times within an instant messenger's application policy. Multiple entries are treated cumulatively.
The server name Command
The server command (with the name keyword) internally resolves the DNS name of the server. This command sends DNS queries multiple times to gather all possible IP addresses for the IM servers, which return different IP addresses at different times in response to DNS queries of the same names. It uses the Time to Live (TTL) field found in DNS responses to refresh its cache. After a certain period, the DNS cache in IM applications stabilize. It is recommended that you allow a couple of minutes for the DNS cache to populate with the IM server IP addresses before the IM traffic reaches the Cisco IOS firewall. All existing IM application connections are not subjected to IM policy enforcement.
Denying Access to a Particular Instant Messenger Application
You can deny traffic to a particular instant messenger application in one of the following ways:
•
Note
•
•
Examples
The following example shows to configure application policy "my-im-policy," which allows text-chat for Yahoo! instant messenger users and blocks instant messenger traffic for all other users:
appfw policy-name my-im-policyapplication httpport-misuse im reset!application im yahooserver permit name scs.msg.yahoo.comserver permit name scsa.msg.yahoo.comserver permit name scsb.msg.yahoo.comserver permit name scsc.msg.yahoo.comservice text-chat action allowservice default action reset!application im aolserver deny name login.cat.aol.com!application im msnserver deny name messenger.hotmail.com!ip inspect name test appfw my-im-policyinterface FastEthernet0/0description Inside interfaceip inspect test inRelated Commands
service
Specifies an action when a specific service is detected in the instant messenger traffic.
server
To associate a Diameter server with a Diameter authentication, authorization, and accounting (AAA) server group, use the server command in Diameter server group configuration submode. To remove a server from the server group, enter the no form of this command.
server name
no server name
Syntax Description
name
Character string used to name the Diameter server.
Note
Command Default
No server is associated with a Diameter AAA server group.
Command Modes
Diameter server group configuration
Command History
Usage Guidelines
The server command allows you to associate a Diameter server with a Diameter server group.
Examples
The following example shows how to associate a Diameter server with a Diameter server group:
Router (config-sg-diameter)# server dia_peer_1Related Commands
server (ldap)
To associate a particular Lightweight Directory Access Protocol (LDAP) server with a AAA server group, use the server command in LDAP server group configuration mode. To delete a server name from the LDAP server, use the no form of this command.
server name
no server name
Syntax Description
Command Default
No server name is configured in the LDAP server.
Command Modes
LDAP server group configuration (config-ldap-server)
Command History
Examples
The following example shows how to associate an LDAP server named server1 with a AAA server group:
Router(config)# aaa group server ldap name1Router(config-ldap-sg)# server server1Related Commands
server (parameter-map)
To configure a set of Domain Name System (DNS) servers with which a given instant messenger application interacts, use the server command in parameter-map configuration mode. To disable the configuration, use the no form of this command.
server {name string [snoop] | ip {ip-address | range ip-address-start ip-address-end}
no server {name string [snoop] | ip {ip-address | range ip-address-start ip-address-end}
Syntax Description
Command Default
At least one server instance should be configured for the configured instant messenger policy to be enforced; otherwise, the parameter map will not have any definitions to enforce.
Command Modes
Parameter-map configuration (config-profile)
Command History
Usage Guidelines
The server command helps the instant messenger application engine to recognize traffic from an instant messenger and to enforce the configured policy for that instant messenger application.
Before you can issue the server command, you must issue the parameter-map type command, which allows you to specify parameters that control the behavior of actions and match criteria specified under a policy map and a class map, respectively.
Note
To configure more than one set of servers, you can configure the server command multiple times within an instant messenger's parameter map. Multiple entries are treated cumulatively.
DNS Snooping
In Cisco IOS Release 12.4(20)T, users can enable DNS snooping on an access router to easily obtain address names. When DNS snooping is enabled, the Cisco IOS firewall that is running on the access router can "snoop" the DNS responses that are going through the router. The firewall can obtain the necessary addresses from the DNS responses because the DNS inspection engine decodes the DNS response packets and returns a list of addresses to the address database.
When using DNS snooping, network administrators no longer have to give a complete address, such as abcd.example1.example.com; instead, they can specify a partial address with a "wildcard character," such as *.example1.example.com.
Examples
The following example shows how to configure an IM-based firewall policy. In this example, all Yahoo Messenger and AOL traffic is allowed to pass through, while all MSN Messenger traffic is blocked. Also, parameter maps are defined to control all Yahoo Messenger and AOL traffic on a more granular level.
! Define Layer 7 class-maps.class-map type inspect ymsgr match-any l7-cmap-ymsgrmatch service text-chat!class-map type inspect aol match-any l7-cmap-aolmatch service text-chatmatch service any!! Define Layer 7 policy-maps.policy-map type inspect im l7-pmap-ymsgrclass-type inspect ymsgr l7-cmap-ymsgrallowalarm!!policy-map type inspect im l7-pmap-aolclass-type inspect aol l7-cmap-aolallowalarm!!! Define parameter map.parameter-map type protocol-info ymsgrserver name sdsc.msg.yahoo.comserver ip 10.1.1.1!parameter-map type protocol-info aolserver name sdsc.msg.aol.comserver ip 172.16.1.1.The following example shows how to configure an access router to block ICQ and Yahoo IM applications while allowing only text chat with Windows Messenger. In this example, snooping is enabled to obtain addressess for all IM applications.
! Define the servers for ICQ.parameter-map type protocol-info icq-serversserver name *.icq.com snoopserver name oam-d09a.blue.aol.com! Define the servers for Windows Messenger.parameter-map type protocol-info winmsgr-serversserver name messenger.msn.com snoop! Define servers for yahoo.parameter-map type protocol-info yahoo-serversserver name scs*.msg.yahoo.com snoopserver name c*.msg.yahoo.com snoop! Define class-map to match ICQ traffic.class-map type inspect icq-trafficmatch protocol icq icq-servers! Define class-map to match windows Messenger traffic.class-map type inspect winmsgr-trafficmatch protocol winmsgr winmsgr-servers!! Define class-map to match text-chat for windows messenger.class-map type inspect winmsgr winmsgr-textchatmatch service text-chat!Define class-map to match default serviceclass-map type inspect winmsgr winmsgr-defaultservicematch service any!! Define a Layer 7 IM policy-map to permit text-chat and block everything else.policy-map type inspect im im-policyclass type inspect winmsgr winmsgr-textchatallow!class type inspect winmsgr winmsgr-defaultservicereset!!! Define the Layer 4 policy to block ICQ and Yahoo Messenger and allow yahoo text-chat ! with Windows Messengerpolicy-map type inspect firewall-policyclass type inspect winmsgr-trafficinspectservice-policy type inspect im im-policy!class type inspect icq-trafficdrop!class type inspect yahoo-trafficdropRelated Commands
server (RADIUS)
To configure the IP address of the RADIUS server for the group server, use the server command in server-group configuration mode. To remove the associated server from the authentication, authorization, and accounting (AAA) group server, use the no form of this command.
server ip-address [auth-port port-number] [acct-port port-number]
no server ip-address [auth-port port-number] [acct-port port-number]
Syntax Description
Defaults
If no port attributes are defined, the defaults are as follows:
•
•
Command Modes
Server-group configuration
Command History
Usage Guidelines
Use the server command to associate a particular server with a defined group server. There are two different ways in which you can identify a server, depending on the way you want to offer AAA services. You can identify the server simply by using its IP address, or you can identify multiple host instances or entries using the optional auth-port and acct-port keywords.
When you use the optional keywords, the network access server identifies RADIUS security servers and host instances associated with a group server on the basis of their IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS host entries providing a specific AAA service. If two different host entries on the same RADIUS server are configured for the same service—for example, accounting—the second host entry configured acts as failover backup to the first one. Using this example, if the first host entry fails to provide accounting services, the network access server will try the second host entry configured on the same device for accounting services. (The RADIUS host entries will be tried in the order they are configured.)
Examples
Configuring Multiple Entries for the Same Server IP Address
The following example shows the network access server configured to recognize several RADIUS host entries with the same IP address. Two different host entries on the same RADIUS server are configured for the same services—authentication and accounting. The second host entry configured acts as fail-over backup to the first one. (The RADIUS host entries are tried in the order in which they are configured.)
! This command enables AAA.aaa new-model! The next command configures default RADIUS parameters.aaa authentication ppp default radius! The next set of commands configures multiple host entries for the same IP address.radius-server host 172.20.0.1 auth-port 1000 acct-port 1001radius-server host 172.20.0.1 auth-port 2000 acct-port 2000Configuring Multiple Entries Using AAA Group Servers
In this example, the network access server is configured to recognize two different RADIUS group servers. One of these groups, group1, has two different host entries on the same RADIUS server configured for the same services. The second host entry configured acts as failover backup to the first one.
! This command enables AAA.aaa new-model! The next command configures default RADIUS parameters.aaa authentication ppp default group group1! The following commands define the group1 RADIUS group server and associates servers ! with it. aaa group server radius group1server 172.20.0.1 auth-port 1000 acct-port 1001! The following commands define the group2 RADIUS group server and associates servers ! with it. aaa group server radius group2server 172.20.0.1 auth-port 2000 acct-port 2001! The following set of commands configures the RADIUS attributes for each host entry ! associated with one of the defined group servers.radius-server host 172.20.0.1 auth-port 1000 acct-port 1001radius-server host 172.20.0.1 auth-port 1000 acct-port 1001radius-server host 172.31.0.1 auth-port 1645 acct-port 1646Related Commands
server (TACACS+)
To configure the IP address of the TACACS+ server for the group server, use the server command in TACACS+ group server configuration mode. To remove the IP address of the RADIUS server, use the no form of this command.
server ip-address
no server ip-address
Syntax Description
Defaults
No default behavior or values.
Command Modes
TACACS+ group server configuration
Command History
Usage Guidelines
You must configure the aaa group server tacacs command before configuring this command.
Enter the server command to specify the IP address of the TACACS+ server. Also configure a matching tacacs-server host entry in the global list. If there is no response from the first host entry, the next host entry is tried.
Examples
The following example shows server host entries configured for the RADIUS server:
aaa new-modelaaa authentication ppp default group g1aaa group server tacacs+ g1server 10.0.0.1server 10.2.0.1tacacs-server host 10.0.0.1tacacs-server host 10.2.0.1Related Commands
server address ipv4
To specify the address of the server that a Group Domain of Interpretation (GDOI) group is trying to reach, use the server address ipv4 command in GDOI group configuration mode. To disable the address, use the no form of this command.
server address ipv4 {address | hostname}
no server address ipv4 {address | hostname}
Syntax Description
Command Default
None
Command Modes
GDOI group configuration
Command History
Usage Guidelines
The server address ipv4 command can be used only on a group member. This command must be specified or the group configuration on the group member is not complete.
Examples
The following example shows that the GDOI group is trying to reach the server with the IP address "10.34.255.57":
server address ipv4 10.34.255.57Related Commands
server local
To designate a device as a Group Domain of Interpretation (GDOI) key server and enter GDOI local server configuration mode, use the server local command in GDOI group configuration mode. To remove a device as a key server, use the no form of this command.
server local
no server local
Syntax Description
This command has no arguments or keywords.
Command Default
A device is not designated as a GDOI key server.
Command Modes
GDOI group configuration
Command History
Usage Guidelines
This command is used on the key server to specify the key server policy that will be downloaded to the group members that are registered with the key server.
Examples
The following example shows that the device has been designated as a GDOI key server:
server localRelated Commands
crypto gdoi group
Identifies a GDOI group and enters GDOI group configuration mode.
server vendor
To specify the URL filtering server, use the server vendor command in URL parameter-map configuration mode. To remove a server from the configuration, use the no form of this command.
server vendor {n2h2 | websense} {ip-address | hostname} [outside] [port port-number] [retrans retransmission-count] [timeout seconds]
no server vendor {n2h2 | websense} {ip-address | hostname} [outside] [port port-number] [retrans retransmission-count] [timeout seconds]
Syntax Description
Command Default
No URL filtering is performed.
Command Modes
URL parameter-map configuration (config-profile)
Command History
Usage Guidelines
Use the server vendor command to specify the URL filtering server. If there is no server, there can be no URL filtering.
When you are creating a URL filter parameter map, you can use the server vendor command after entering the parameter-map type urlfilter command. For more detailed information about creating a parameter map, see the parameter-map type urlfilter command.
Use the server vendor command to configure a Websense or N2H2 server, which will interact with the Cisco IOS firewall to filter HTTP requests on the basis of a specified policy—global filtering, user- or group-based filtering, keyword-based filtering, category-based filtering, or customized filtering.
If the firewall has not received a response from the vendor server within the time specified in the timeout seconds keyword and argument, the firewall checks the retrans retransmission-count keyword and argument configured for the vendor server. If the firewall has not exceeded the maximum retransmit tries allowed, it resends the HTTP lookup request. If the firewall has exceeded the maximum retransmit tries allowed, it deletes the outstanding request from the queue and checks the value specified in the allow-mode command. The firewall forwards the request if the allow mode is on; otherwise, it drops the request.
By default, URL lookup requests that are made to the vendor server contain nonnatted client IP addresses because the vendor server is deployed on the inside network. The outside keyword allows the vendor server to be deployed on the outside network. Cisco IOS software sends, in the URL lookup request, the client's IP address that has undergone network address translation (NAT).
Primary and Secondary Servers
When you configure multiple vendor servers, the Cisco IOS firewall uses only one server at a time—the primary server; all other servers are called secondary servers. When the primary server becomes unavailable for any reason, it becomes a secondary server and one of the secondary servers becomes the primary server.
A firewall marks a primary server as down when sending a request to or receiving a response from the server fails. When a primary server goes down, the system goes to the beginning of the configured servers list and tries to activate the first server on the list. If the first server on the list is unavailable, it tries the second server on the list; the system keeps trying to activate a server until it is successful or until it reaches the end of the server list. If the system reaches the end of the server list, it sets a flag indicating that all of the servers are down, and it enters allow mode. When allow mode is on, HTTP traffic is permitted.
Examples
The following example shows how to specify the N2H2 vendor server for URL filtering:
parameter-map type urlfilter u1server vendor n2h2 10.193.64.22 port 3128 outsideRelated Commands
server-private (RADIUS)
To configure the IP address of the private RADIUS server for the group server, use the server-private command in server-group configuration mode. To remove the associated private server from the authentication, authorization, and accounting (AAA) group server, use the no form of this command.
server-private ip-address [auth-port port-number | acct-port port-number] [non-standard] [timeout seconds] [retransmit retries] [key string]
no server-private ip-address [auth-port port-number | acct-port port-number] [non-standard] [timeout seconds] [retransmit retries] [key string]
Syntax Description
Defaults
If server-private parameters are not specified, global configurations will be used; if global configurations are not specified, default values will be used.
Command Modes
Server-group configuration
Command History
Usage Guidelines
Use the server-private command to associate a particular private server with a defined server group. To prevent possible overlapping of private addresses between Virtual Route Forwardings (VRFs), private servers (servers with private addresses) can be defined within the server group and remain hidden from other groups, while the servers in the global pool (default "radius" server group) can still be referred to by IP addresses and port numbers. Thus, the list of servers in server groups includes references to the hosts in the global configuration and the definitions of private servers.
Note
Examples
The following example shows how to define the sg_water RADIUS group server and associate private servers with it:
aaa group server radius sg_waterserver-private 10.1.1.1 timeout 5 retransmit 3 key xyzserver-private 10.2.2.2 timeout 5 retransmit 3 key xyzRelated Commands
server-private (TACACS+)
To configure the IP address of the private TACACS+ server for the group server, use the server-private command in server-group configuration mode. To remove the associated private server from the authentication, authorization, and accounting (AAA) group server, use the no form of this command.
server-private {ip-address | name} [nat] [single-connection] [port port-number] [timeout seconds] [key [0 | 7] string]
no server-private
Syntax Description
Command Default
If server-private parameters are not specified, global configurations will be used; if global configurations are not specified, default values will be used.
Command Modes
Server-group configuration (server-group)
Command History
Usage Guidelines
Use the server-private command to associate a particular private server with a defined server group. To prevent possible overlapping of private addresses between virtual route forwardings (VRFs), private servers (servers with private addresses) can be defined within the server group and remain hidden from other groups, while the servers in the global pool (default "TACACS+" server group) can still be referred to by IP addresses and port numbers. Thus, the list of servers in server groups includes references to the hosts in the global configuration and the definitions of private servers.
Examples
The following example shows how to define the tacacs1 TACACS+ group server and associate private servers with it:
aaa group server tacacs+ tacacs1server-private 10.1.1.1 port 19 key ciscoip vrf ciscord 100:1interface Loopback0ip address 10.0.0.2 255.0.0.0ip vrf forwarding ciscoRelated Commands
server-key
To configure the RADIUS key to be shared between a device and RADIUS clients, use the server-key command in dynamic authorization local server configuration mode. To remove this configuration, use the no form of this command.
server-key [0 | 7] word
no server-key [0 | 7] word
Syntax Description
0
(Optional) An unencrypted key will follow.
7
(Optional) A hidden key will follow.
word
Unencrypted server key.
Command Default
A server key is not configured.
Command Modes
Dynamic authorization local server configuration (config-locsvr-da-radius)
Command History
12.2(28)SB
This command was introduced.
Cisco IOS XE Release 2.6
This command was integrated into Cisco IOS XE Release 2.6.
Usage Guidelines
A device (such as a router) can be configured to allow an external policy server to dynamically send updates to the router. This functionality is facilitated by the CoA RADIUS extension. CoA introduced peer-to-peer capability to RADIUS, enabling a router and external policy server each to act as a RADIUS client and server. Use the server-key command to configure the key to be shared between the Intelligent Services Gateway (ISG) and RADIUS clients.
Examples
The following example configures "cisco" as the shared server key:
aaa server radius dynamic-authorclient 10.0.0.1server-key ciscoRelated Commands
aaa server radius dynamic-author
Configures a device as a AAA server to facilitate interaction with an external policy server.
service action
To specify an action when a specific service is detected in the instant messenger traffic, use the service action command in the appropriate configuration mode. To disable or change a specified action, use the no form of this command.
service {default | text-chat} action {allow [alarm] | reset [alarm] | alarm}
no service {default | text-chat} action {allow [alarm] | reset [alarm] | alarm}
Syntax Description
Command Default
If the command is not configured, the default is service default action reset.
Command Modes
cfg-appfw-policy-aim configuration
cfg-appfw-policy-ymsgr configuration
cfg-appfw-policy-msnmsgr configuration
Command History
Usage Guidelines
When the reset keyword is used, the connection is reset if TCP is used, and the packet is dropped if UDP is used. When dropping a packet from a UDP connection, the session will not be immediately deleted; instead, the session will time out to prevent additional sessions from being immediately created.
The alarm keyword can be specified alone or with the allow or reset keywords; however, the allow or reset keywords are mutually exclusive.
Examples
The following example shows to configure application policy "my-im-policy," which allows text-chat for Yahoo! instant messenger users and blocks instant messenger traffic for all other users:
appfw policy-name my-im-policyapplication httpport-misuse im reset!application im yahooserver permit name scs.msg.yahoo.comserver permit name scsa.msg.yahoo.comserver permit name scsb.msg.yahoo.comserver permit name scsc.msg.yahoo.comservice text-chat action allowservice default action reset!application im aolserver deny name login.user1.aol.com!application im msnserver deny name messenger.hotmail.com!ip inspect name test appfw my-im-policyinterface FastEthernet0/0description Inside interfaceip inspect test inservice password-encryption
To encrypt passwords, use the service password-encryption command in global configuration mode. To restore the default, use the no form of this command.
service password-encryption
no service password-encryption
Syntax Description
This command has no arguments or keywords.
Command Default
No passwords are encrypted.
Command Modes
Global configuration
Command History
Usage Guidelines
The actual encryption process occurs when the current configuration is written or when a password is configured. Password encryption is applied to all passwords, including username passwords, authentication key passwords, the privileged command password, console and virtual terminal line access passwords, and Border Gateway Protocol neighbor passwords. This command is primarily useful for keeping unauthorized individuals from viewing your password in your configuration file.
When password encryption is enabled, the encrypted form of the passwords is displayed when a more system:running-config command is entered.
Caution
Note
Examples
The following example causes password encryption to take place:
service password-encryptionRelated Commands
service password-recovery
To enable password recovery capability, use the service password-recovery command in global configuration mode. To disable password recovery capability, use the no service password-recovery command.
service password-recovery
no service password-recovery
Syntax Description
This command has no arguments or keywords.
Defaults
Password recovery capability is enabled.
Command Modes
Global configuration
Command History
12.3(8)YA
This command was introduced.
12.3(14)T
This command was integrated into Cisco IOS Release 12.3(14)T.
Usage Guidelines
Note
If you plan to disable the password recovery capability with the the no service password-recovery command, we recommend that you save a copy of the system configuration file in a location away from the switch or router. If you are using a switch that is operating in VTP transparent mode, we recommend that you also save a copy of the vlan.dat file in a location away from the switch.
Caution
The configuration register boot bit must be enabled so that there is no way to break into ROMMON when this command is configured. Cisco IOS software should prevent the user from configuring the boot field in the config register.
Bit 6, which ignores the startup configuration, and bit 8, which enables a break should be set.
The Break key should be disabled while the router is booting up and disabled in Cisco IOS software when this feature is enabled.
It may be necessary to use the config-register global configuration command to set the configuration register to autoboot before entering the no service password-recovery command. The last line of the show version EXEC command displays the configuration register setting. Use the show version EXEC command to obtain the current configuration register value, configure the router to autoboot with the config-register command if necessary, then enter the no service password-recovery command.
Once disabled, the following configuration register values are invalid for the no service password-recovery command:
•
•
•
•
Catalyst Switch Operation
Use the service password-recovery command to reenable the password-recovery mechanism (the default). This mechanism allows a user with physical access to the switch to hold down the Mode button and interrupt the boot process while the switch is powering up and to assign a new password. Use the no form of this command to disable the password-recovery capability.
When the password-recovery mechanism is disabled, interrupting the boot process is allowed only if the user agrees to set the system back to the default configuration. Use the show version EXEC command to verify if password recovery is enabled or disabled on a switch.
The service password-recovery command is valid only on Catalyst 3550 Fast Ethernet switches; it is not available for Gigabit Ethernet switches.
Examples
Router Configuration Examples
The following example shows how to obtain the configuration register setting (which in this example is set to autoboot), disable the password-recovery capability, and then verify that the configuration persists through a system reload. The noconfirm keyword prevents a confirmation prompt from interrupting the booting process.
Router# show versionCisco Internetwork Operating System SoftwareIOS (tm) 5300 Software (C7200-P-M), Version 12.3(8)YA, RELEASE SOFTWARE (fc1)TAC Support: http://www.cisco.com/tacCopyright (c) 1986-2004 by Cisco Systems, Inc.Compiled Wed 05-Mar-03 10:16 by xxxImage text-base: 0x60008954, data-base: 0x61964000ROM: System Bootstrap, Version 12.3(8)YA, RELEASE SOFTWARE (fc1)BOOTLDR: 7200 Software (C7200-KBOOT-M), Version 12.3(8)YA, RELEASE SOFTWARE (fc1)Router uptime is 10 minutesSystem returned to ROM by reload at 16:28:11 UTC Thu Mar 6 2003...125440K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes).8192K bytes of Flash internal SIMM (Sector size 256K).Configuration register is 0x2012Router# configure terminalRouter(config)# no service password-recovery noconfirmWARNING:Executing this command will disable the password recovery mechanism.Do not execute this command without another plan for password recovery.Are you sure you want to continue? [yes/no]: yes...Router(config)# exitRouter#Router# reloadProceed with reload? [confirm] yes00:01:54: %SYS-5-RELOAD: Reload requestedSystem Bootstrap, 12.3(8)YA...Copyright (c) 1994-2004 by cisco Systems, Inc.C7400 platform with 262144 Kbytes of main memoryPASSWORD RECOVERY FUNCTIONALITY IS DISABLED...The following example shows what happens when a break is confirmed and when a break is not confirmed.
Confirmed Break
PASSWORD RECOVERY FUNCTIONALITY IS DISABLEDprogram load complete, entry point: 0x80013000, size: 0x8396a8Self decompressing the image :########################################################################################## ################################# [OK] !The 5-second window starts.telnet> send breakRestricted Rights LegendUse, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and ComputerSoftware clause at DFARS sec. 252.227-7013.Cisco Systems, Inc.170 West Tasman DriveSan Jose, California 95134-1706Cisco IOS Software, C831 Software (C831-K9O3SY6-M), Version 12.3(8)YACopyright (c) 1986-2004 by Cisco Systems, Inc.Compiled Fri 13-Aug-04 03:21Image text-base: 0x80013200, data-base: 0x81020514PASSWORD RECOVERY IS DISABLED.Do you want to reset the router to factory default configuration and proceed [y/n]?!The user enters "y" here.Reset router configuration to factory default.This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately.A summary of U.S. laws governing Cisco cryptographic products may be found at:http://www.cisco.com/wwl/export/crypto/tool/stqrg.htmlIf you require further assistance please contact us by sending email to export@cisco.com.Cisco C831 (MPC857DSL) processor (revision 0x00) with 46695K/2457K bytes of memory.Processor board ID 0000 (1314672220), with hardware revision 0000 CPU rev number 73 Ethernet interfaces4 FastEthernet interfaces128K bytes of NVRAM24576K bytes of processor board System flash (Read/Write)2048K bytes of processor board Web flash (Read/Write)--- System Configuration Dialog ---Would you like to enter the initial configuration dialog? [yes/no]: no!Start up config is erased.SETUP: new interface FastEthernet1 placed in "up" stateSETUP: new interface FastEthernet2 placed in "up" stateSETUP: new interface FastEthernet3 placed in "up" stateSETUP: new interface FastEthernet4 placed in "up" statePress RETURN to get started!Router> enableRouter# show startup configurationstartup-config is not presentRouter# show running-config | incl serviceno service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption !The "no service password-recovery" is disabled.==========================================================================================Unconfirmed Break
PASSWORD RECOVERY FUNCTIONALITY IS DISABLEDtelnet> send breakprogram load complete, entry point: 0x80013000, size: 0x8396a8Self decompressing the image :########################################################################################## ########################################################################## [OK]telnet> send breakRestricted Rights LegendUse, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and ComputerSoftware clause at DFARS sec. 252.227-7013.Cisco Systems, Inc.170 West Tasman DriveSan Jose, California 95134-1706Cisco IOS Software, C831 Software (C831-K9O3SY6-M), Version 12.3(8)YACopyright (c) 1986-2004 by Cisco Systems, Inc.Compiled Fri 13-Aug-04 03:21Image text-base: 0x80013200, data-base: 0x81020514PASSWORD RECOVERY IS DISABLED.Do you want to reset the router to factory default configuration and proceed [y/n]?!The user enters "n" here.This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption.Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately.A summary of U.S. laws governing Cisco cryptographic products may be found at:http://www.cisco.com/wwl/export/crypto/tool/stqrg.htmlIf you require further assistance please contact us by sending email to export@cisco.com.Cisco C831 (MPC857DSL) processor (revision 0x00) with 46695K/2457K bytes of memory.Processor board ID 0000 (1314672220), with hardware revision 0000 CPU rev number 73 Ethernet interfaces4 FastEthernet interfaces128K bytes of NVRAM24576K bytes of processor board System flash (Read/Write)2048K bytes of processor board Web flash (Read/Write)Press RETURN to get started! !The Cisco IOS software boots as if it is not interrupted.Router> enableRouter# show startup configurationUsing 984 out of 131072 bytes!version 12.3no service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryptionno service password-recovery!hostname Router!boot-start-markerboot-end-marker!memory-size iomem 5!no aaa new-modelip subnet-zero!ip ips po max-events 100no ftp-server write-enable!interface Ethernet0no ip addressshutdown!interface Ethernet1no ip addressshutdownduplex auto!interface Ethernet2no ip addressshutdown!interface FastEthernet1no ip addressduplex autospeed auto!interface FastEthernet2no ip addressduplex autospeed auto!interface FastEthernet3no ip addressduplex autospeed auto!interface FastEthernet4no ip addressduplex autospeed auto!ip classless!ip http serverno ip http secure-server!control-plane!line con 0no modem enabletransport preferred alltransport output allline aux 0line vty 0 4!scheduler max-task-time 5000endRouter# show running-configuration | incl serviceno service padservice timestamps debug datetime msecservice timestamps log datetime msecno service password-encryptionno service password-recoveryConfiguration Register Messages Example
The no service password-recovery command expects the router configuration register to be configured to autoboot. If the configuration register is set to something other than to autoboot before the no service password-recovery command is entered, you will see a prompt like the one shown in the following example asking you to use the config-register global configuration command to change the setting.
Router(config)# no service password-recoveryPlease setup auto boot using config-register first.
Note
Once password recovery is disabled, you will not be able set bit pattern 0x40, 0x8000 or set the value to 0x0 to disable autoboot. The following example shows the messages displayed when invalid configuration register settings are attempted on a router with password recovery disabled.
Router(config)# config-register 0x2143Password recovery is disabled, cannot enable diag or ignore configuration.The command will reset the invalid bit pattern and continue to allow modification of nonrelated bit patterns. The configuration register value will be reset to 0x3 at the next system reload, which can be verified by checking the last line of the show version command output:
Configuration register is 0x2012 (will be 0x3 at next reload)Catalyst Switch Example
The following example shows how to disable password recovery on a switch so that a user can only reset a password by agreeing to return to the default configuration:
Switch(config)# no service-password recoverySwitch(config)# exitThe password-recovery mechanism has been triggered, but is currently disabled. Access to the boot loader prompt through the password-recovery mechanism is disallowed at this point. However, if you agree to let the system be reset back to the default system configuration, access to the boot loader prompt can still be allowed.Would you like to reset the system back to the default configuration (y/n)?If you choose not to reset the system back to the default configuration, the normal boot process continues, as if the Mode button had not been pressed. If you choose to reset the system back to the default configuration, the configuration file in flash memory is deleted and the VLAN database file, flash:vlan.dat (if present), is deleted.
The following is sample output from the show version privileged EXEC command on a switch when password recovery is disabled:
Switch# show versionCisco Internetwork Operating System SoftwareIOS (tm) C3550 Software (C3550-I9Q3L2-M), Version 12.3(8)YA, RELEASE SOFTWARE (fc1)Copyright (c) 1986-2004 by cisco Systems, Inc.Compiled Wed 24-Oct-01 06:20 by xxxImage text-base: 0x00003000, data-base: 0x004C1864ROM: Bootstrap program is C3550 boot loaderflam-1-6 uptime is 1 week, 6 days, 3 hours, 59 minutesSystem returned to ROM by power-onCisco WS-C3550-48 (PowerPC) processor with 65526K/8192K bytes of memory.Last reset from warm-resetRunning Layer2 Switching Only ImageEthernet-controller 1 has 12 Fast Ethernet/IEEE 802.3 interfacesEthernet-controller 2 has 12 Fast Ethernet/IEEE 802.3 interfacesEthernet-controller 3 has 12 Fast Ethernet/IEEE 802.3 interfacesEthernet-controller 4 has 12 Fast Ethernet/IEEE 802.3 interfacesEthernet-controller 5 has 1 Gigabit Ethernet/IEEE 802.3 interfaceEthernet-controller 6 has 1 Gigabit Ethernet/IEEE 802.3 interface48 FastEthernet/IEEE 802.3 interface(s)2 Gigabit Ethernet/IEEE 802.3 interface(s)The password-recovery mechanism is disabled.32K bytes of flash-simulated non-volatile configuration memory.Base ethernet MAC Address: AA:00:0B:2B:02:00Configuration register is 0x10FRelated Commands
config-register
Changes the configuration register settings.
show version
Displays version information for the hardware and firmware.
service-module ids bootmode
To enter failsafe or normal boot mode for a Cisco Intrusion Prevention System (IPS) network module (also referred to as the Cisco Intrusion Detection System [IDS] network module and as the NME-IPS), use the service-module ids bootmode command in privileged EXEC mode.
service-module ids slot/port bootmode {failsafe | normal}
Syntax Description
Defaults
None
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XY
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
If a confirmation prompt is displayed, press Enter to confirm the action, or press n to cancel.
Examples
The following example enters the IDS failsafe boot mode on the Cisco IPS network module in slot 1:
Router# service-module ids 1/0 bootmode failsafeThe following example enters the IDS failsafe boot mode on the Cisco IPS network module in slot 1:
Router# service-module ids 1/0 bootmode normalRelated Commands
service-module ids heartbeat-reset
To prevent the Cisco IOS software from rebooting the Cisco Intrusion Prevention System (IPS) network module (also referred to as the Cisco Intrusion Detection System [IDS] network module and as the NME-IPS), when the heartbeat is lost, use the service-module ids heartbeat-reset command in privileged EXEC mode.
service-module ids slot/port heartbeat-reset {enable | disable}
Syntax Description
Defaults
None
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XY
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
When the Cisco IPS network module, or NME-IPS, is booted in failsafe mode or is undergoing an upgrade, the service-module ids heartbeat-reset command does not permit a reboot during the process.
When the NME-IPS heartbeat is lost, the router applies a fail-open or fail-close configuration option to the NME-IPS and stops sending traffic to the NME-IPS, and sets the NME-IPS to error state. The router performs a hardware reset on the NME-IPS and monitors the NME-IPS until the heartbeat is reestablished.
Examples
The following example disables the IDS heartbeat on the Cisco IPS network module in slot 1:
Router# service-module ids 1/0 heartbeat-reset disableThe following example enables the IDS heartbeat on the Cisco IPS network module in slot 1:
Router# service-module ids 1/0 heartbeat-reset enableThe status of the heartbeat-reset is displayed by using the service-module ids slot/port status command:
Router# service-module ids 0/0 statusService Module is Cisco IDS-Sensor 0/0Service Module supports session via TTY line 194Service Module heartbeat-reset is enabled <=====Related Commands
service-policy (policy-map)
Note
To attach a Layer 7 policy map to the top-level Layer 3 or Layer 4 policy map, use the service-policy command in policy-map-class configuration mode. To disable the attachment, use the no form of this command.
service-policy {h323 | http | im | imap | p2p | pop3 | sip | smtp | sunrpc | urlfilter} policy-map
no service-policy {h323 | http | im | imap | p2p | pop3 | sip | smtp | sunrpc | urlfilter} policy-map
Syntax Description
Command Default
Disabled.
Command Modes
Policy-map-class configuration (config-pmap-c)
Command History
12.4(20)T
This command was introduced. This command replaces the service policy-inspect command.
Usage Guidelines
The service-policy (policy-map) command attaches a Layer 7 policy-map to the top-level Layer 3 or Layer 4 policy map. The Layer 7 policy is a nested policy of the top-level policy, and it is called a child policy.
Examples
The following example creates a Layer 3 or Layer 4 policy called test, attaches a Layer 7 policy called p11 to that policy, and inspects H.323 traffic.!class-map type inspect match-all testmatch protocol h323class-map type inspect h323 match-any c1match message setup!policy-map type inspect h323 p11class type inspect h323 c1lograte-limit 15policy-map type inspect testclass type inspect testinspectservice-policy h323 p11class class-defaultdrop!Related Commands
policy-map type inspect
Creates a Layer 3, Layer 4 inspect type policy map or a Layer 7 application-specific inspect type policy map.
service-policy (zones)
To attach a Layer 7 policy map to a top-level policy map, use the service-policy command in zone-pair configuration mode. To delete a Layer 7 policy map from a top-level policy map, use the no form of this command.
service-policy policy-map-name
no service-policy policy-map-name
Syntax Description
Command Default
None
Command Modes
Zone-pair configuration
Command History
Usage Guidelines
You can enter the service-policy (zones) command after entering the zone-pair command.
Examples
The following example attaches a Layer 7 policy map to a top-level policy map:
policy-map type inspect p1class type inspect c1inspectservice-policy http myhttppolicyRelated Commands
service-policy inspect
Note
To attach a Layer 7 policy map to the top-level Layer 3 or Layer 4 policy map, use the service-policy inspect command in policy-map-class configuration mode. To disable the attachment, use the no form of this command.
service-policy inspect {http | imap | pop3 | smtp | sunrpc} policy-map
no service-policy inspect {http | imap | pop3 | smtp | sunrpc} policy-map
Syntax Description
Command Default
Disabled.
Command Modes
Policy-map-class configuration
Command History
12.4(6)T
This command was introduced.
12.4(20)T
This command was replaced by the service-policy (policy-map) command.
Usage Guidelines
The service-policy inspect command attaches a Layer 7 policy-map to the top-level Layer 3 or Layer 4 policy map. The Layer 7 policy is considered to be a nested policy of the top-level policy, and it is called a child policy.
Examples
The following example creates a Layer 3 or Layer 4 policy map p1, attaches a Layer 7 policy called p11 to that policy, and inspects HTTP traffic.policy-map type inspect p1class type inspect c1service-policy inspect http p11service-policy type inspect
To attach a firewall policy map to a zone-pair, use the service-policy type inspect command in zone-pair configuration mode. To disable this attachment to a zone-pair, use the no form of this command.
service-policy type inspect policy-map-name
no service-policy type inspect policy-map-name
Syntax Description
Command Default
None
Command Modes
Zone-pair configuration (config-sec-zone-pair)
Command History
Usage Guidelines
Use the service-policy type inspect command to attach a policy-map and its associated actions to a zone-pair.
Enter the command after entering the zone-pair security command.
Examples
The following example defines zone-pair z1-z2 and attaches the service policy p1 to the zone-pair:
!zone security z1zone security z2!class-map type inspect match-all c1match protocol tcppolicy-map type inspect p1class type inspect c1inspect!zone-pair security zp source z1 destination z2service-policy type inspect p1!Related Commands
sessions maximum
To set the maximum number of allowed sessions that can exist on a zone pair, use the sessions maximum command in parameter-map configuration mode. To change the number of allowed sessions, use the no form of this command.
sessions maximum sessions
no sessions maximum
Syntax Description
Command Default
Default value is unlimited.
Command Modes
Parameter-map configuration
Command History
Usage Guidelines
Use the sessions maximum command to limit the number of inspect sessions that match a certain class. Session limiting is activated when this parameter is configured.
This command is available only within an inspect type parameter map and takes effect only when the parameter map is associated with an inspect action in a policy.
If the sessions maximum command is configured, the number of established sessions on the router can be shown via the show policy-map type inspect zone-pair command.
Examples
The following example shows how to limit the maximum number of allowed sessions to 200 and how verify the number of established sessions:
parameter map type inspect abcsessions maximum 200Router# show policy-map type inspect zone-pairZone-pair: zpService-policy inspect : test-udpClass-map: check-udp (match-all)Match: protocol udpInspectPacket inspection statistics [process switch:fast switch]udp packets: [3:4454]Session creations since subsystem startup or last reset 92Current session counts (estab/half-open/terminating) [5:33:0]<---Maxever session counts (estab/half-open/terminating) [5:59:0]Last session created 00:00:06Last statistic reset neverLast session creation rate 61Last half-open session total 33Policerate 8000 bps,1000 limitconformed 2327 packets, 139620 bytes; actions: transmitexceeded 36601 packets, 2196060 bytes; actions: dropconformed 6000 bps, exceed 61000 bpsClass-map: class-default (match-any)Match: anyDrop (default action)0 packets, 0 bytesRelated Commands
sessions rate
To specify a time duration for defining the session quota, use the sessions rate command in parameter-map type inspect configuration mode. To disable the specified time duration, use the no form of this command.
sessions rate {high number-of-connections | low number-of-connections } time duration
no sessions rate {high | low}
Syntax Description
Command Default
The system does not start or stop deleting half-open sessions.
Command Modes
Parameter-map type inspect configuration (config-profile)
Command History
Usage Guidelines
You can use the one-minute command to define session quota within one minute. You can use the sessions rate command to specify the time duration in which session quota can be defined. The sessions rate command and the one-minute command are mutually exclusive. If the one-minute command is configured in an inspect parameter map, the sessions rate command is rejected, and vice versa.
Examples
The following example shows how to configure a session rate of 25 seconds:
Router> enableRouter# configure terminalRouter(config)# parameter-type inspect type par1Router(config-profile)# sessions-rate high 250 time 25Related Commands
