-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Table Of Contents
set aggressive-mode client-endpoint
set security-association idle-time
set security-association level per-host
set security-association lifetime
set security-association replay disable
set security-association replay window-size
show access-group mode interface
show authentication registrations
show call admission statistics
set aggressive-mode client-endpoint
To specify the Tunnel-Client-Endpoint attribute within an Internet Security Association Key Management Protocol (ISAKMP) peer configuration, use the set aggressive-mode client-endpoint command in ISAKMP policy configuration mode. To remove this attribute from your configuration, use the no form of this command.
set aggressive-mode client-endpoint client-endpoint
no set aggressive-mode client-endpoint client-endpoint
Syntax Description
Command Default
The Tunnel-Client-Endpoint attribute is not defined.
Command Modes
ISAKMP policy configuration
Command History
Usage Guidelines
Before you can use this command, you must enable the crypto isakmp peer command.
To initiate an IKE aggressive mode negotiation and specify the RADIUS Tunnel-Client-Endpoint attribute, the set aggressive-mode client-endpoint command, along with the set aggressive-mode password command, must be configured in the ISAKMP peer policy. The Tunnel-Client-Endpoint attribute will be communicated to the server by encoding it in the appropriate IKE identity payload.
Examples
The following example shows how to initiate aggressive mode using RADIUS tunnel attributes:
crypto isakmp peer address 10.4.4.1set aggressive-mode client-endpoint user-fqdn user@cisco.comset aggressive-mode password cisco123Related Commands
set aggressive-mode password
To specify the Tunnel-Password attribute within an Internet Security Association Key Management Protocol (ISAKMP) peer configuration, use the set aggressive-mode password command in ISAKMP policy configuration mode. To remove this attribute from your configuration, use the no form of this command.
set aggressive-mode password password
no set aggressive-mode password password
Syntax Description
password
Password that is used to authenticate the peer to a remote server. The tunnel password is used as the Internet Key Exchange (IKE) preshared key.
Defaults
The Tunnel-Password attribute is not defined.
Command Modes
ISAKMP policy configuration
Command History
Usage Guidelines
Before you can use this command, you must enable the crypto isakmp peer command.
To initiate an IKE aggressive mode negotiation, the set aggressive-mode password command, along with the set aggressive-mode client-endpoint command, must be configured in the ISAKMP peer policy. The Tunnel-Password attribute will be used as the IKE preshared key for the aggressive mode negotiation.
Output for the set aggressive-mode password command will show that the preshared key is either unencrypted or encrypted. An output example for an unencrypted preshared key would be as follows:
set aggressive-mode password test123An output example for a type 6 encrypted preshared key would be as follows:
set aggressive-mode password 6 DV'P[aTVWWbcgKU]T\T\QhZAABExamples
The following example shows how to initiate aggressive mode using RADIUS tunnel attributes:
Router (config)# crypto isakmp peer address 10.4.4.1Router (config-isakmp-peer)# set aggressive-mode client-endpoint user-fqdn user@cisco.comRouter (config-isakmp-peer)# set aggressive-mode password cisco123Related Commands
set group
To set the Group Domain of Interpretation (GDOI) crypto map to the GDOI group that has already been defined, use the set group command in crypto map configuration mode. To remove the GDOI crypto map, use the no form of this command.
set group {group-name}
no set group {group-name}
Syntax Description
Command Default
None
Command Modes
crypto map configuration
Command History
Usage Guidelines
This command must be configured for the GDOI crypto map to be complete.
Note
This crypto map is specifically a GDOI crypto map, that is, the crypto map must be named as a GDOI crypto map, as in this example: crypto map test 10 gdoi
Examples
The following example shows that the group name is "hsrp-group":
set group hsrp-groupRelated Commands
set identity
To set the identity to the crypto map, use the set identity command in crypto map configuration mode.
set identity name
Syntax Description
Defaults
If this command is not enabled, the encrypted connection does not have any restrictions other than the IP address of the encrypting peer.
Command Modes
Crypto map configuration
Command History
Usage Guidelines
Use the set identity command to set the identity to the configured crypto maps. When this command is applied, only the hosts that match a configuration listed within the name argument can use that crypto map.
Examples
The following example shows how to configure two IP Security (IPSec) crypto maps and apply the identity to each crypto map. That is, the identity is set to "to-bigbiz" for the first crypto map and "to-little-com" for the second crypto map.
! The following is an IPSec crypto map (part of IPSec configuration). It can be used only! by peers that have been authenticated by DN and if the certificate belongs to BigBiz.crypto map map-to-bigbiz 10 ipsec-isakmpset peer 172.21.114.196set transform-set my-transformsetmatch address 124set identity to-bigbiz!crypto identity to-bigbizdn ou=BigBiz!!! This crypto map can be used only by peers that have been authenticated by hostname! and if the certificate belongs to little.com.crypto map map-to-little-com 10 ipsec-isakmpset peer 172.21.115.119set transform-set my-transformsetmatch address 125identity to-little-com!crypto identity to-little-comfqdn little.comRelated Commands
set ip access-group
To check a preencrypted or postdecrypted packet against an access control list (ACL) without having to use the outside physical interface ACL, use the set ip access-group command in crypto map configuration mode. To disable the check, use the no form of this command.
set ip access-group {access-list-number | access-list-name} {in | out}
no set ip access-group {access-list-number | access-list-name} {in | out}
Syntax Description
Defaults
No crypto map access ACLs are defined to filter clear-text packets going through the IPSec tunnel.
Command Modes
Crypto map configuration
Command History
Usage Guidelines
The set ip access-group command is used after the crypto map has been configured.
Examples
The following example shows that a crypto map access ACL has been configured:
Router (config)# crypto map map vpn1 10Router (config-crypto-map)# set ip access-group 151 inRelated Commands
crypto map
Assigns a previously defined crypto map set to an interface so that the interface can provide IPSec services.
set isakmp-profile
To set the Internet Security Association and Key Management Protocol (ISAKMP) profile name, use the set isakmp-profile command in crypto map configuration mode. To remove the ISAKMP profile name, use the no form of this command.
set isakmp-profile profile-name
no set isakmp-profile profile-name
Syntax Description
Defaults
If the ISAKMP profile is not specified in the crypto map entry, the default is to the ISAKMP profile that is on the head. If there is no ISAKMP profile on the head, the default is "none."
Command Modes
Crypto map configuration
Command History
Usage Guidelines
This command describes the ISAKMP profile to use when you start the Internet Key Exchange (IKE) exchange.
Before configuring an ISAKMP profile on a crypto map, you should set up the ISAKMP profile.
Examples
The following example shows that an ISAKMP profile has been configured on a crypto map:
crypto map vpnmap 10 ipsec-isakmpset isakmp-profile vpnprofileRelated Commands
set nat demux
To enable L2TP—IPSec support for NAT or PAT Windows clients, use the set nat demux command in crypto map configuration mode. To disable L2TP—IPSec support, use the no form of this command.
set nat demux
no set nat demux
Syntax Description
This command has no arguments or keywords.
Command Default
With this command disabled, Windows clients lose connection when another Windows client establishes an IP Security (IPSec) protected Cisco IOS Layer 2 Tunneling Protocol (L2TP) tunnel to the same Cisco IOS L2TP Network Server (LNS) when there is a network address translation (NAT) or port address translation (PAT) server between the Windows clients and the LNS.
Command Modes
Crypto map configuration
Command History
12.3(11)T4
This command was introduced.
12.4(1)
This command was integrated into Release 12.4(1).
Usage Guidelines
Use this command if you have an environment with IPSec enabled and consisting of an LNS, and a network address translation (NAT) or port address translation (PAT) server between the Windows clients and the LNS.
This command has been tested only with Windows 2000 L2TP/IPsec clients running hotfix 818043.
You must enter the crypto map command if you are using static crypto maps or the crypto dynamic-map command if you are using dynamic crypto maps before issuing the set nat demux command.
Note
Examples
The following example shows how to enable L2TP—IPSec support for NAT or PAT Windows clients for a dynamic crypto map:
...!Enable virtual private networking.vpdn enable! Default L2TP VPDN groupvpdn-group 1!!Enables the LNS to accept dial in requests; specifies L2TP as the tunneling protocol; specifies the number of the virtual templates used to clone virtual-access interfaces; specifies an alternate IP address for a VPDN tunnelaccept-dialin.protocol l2tpvirtual-template 1source-ip 10.0.0.1!!Disables Layer 2 Tunneling Protocol (L2TP) tunnel authentication.no l2tp tunnel authentication!!Defines an Internet Key Exchange (IKE) policy and assigns priority 1.crypto isakmp policy 1encr 3desgroup 2!crypto isakmp policy 2encr 3desauthentication pre-sharegroup 2!!Defines a transform set.crypto ipsec transform-set vpn esp-3des esp-md5-hmacmode transportcrypto mib ipsec flowmib history tunnel size 2crypto mib ipsec flowmib history failure size 2!!Names the dynamic crypto map entry to create (or modify) and enters crypto map configuration mode.crypto dynamic-map dyn_map 1!Specifies which transform sets can be used with the crypto map entryset transform-set vpn!Enables L2TP—IPSec support.set nat demux...Related Commands
set peer (IPsec)
To specify an IP Security (IPsec) peer in a crypto map entry, use the set peer command in crypto map configuration mode. To remove an IPsec peer from a crypto map entry, use the no form of this command.
set peer {host-name [dynamic] [default] | ip-address [default] }
no set peer {host-name [dynamic] [default] | ip-address [default] }
Syntax Description
Command Default
No peer is defined.
Command Modes
Crypto map configuration (config-crypto-map)
Command History
Usage Guidelines
Use this command to specify an IPsec peer for a crypto map.
This command is required for all static crypto maps. If you are defining a dynamic crypto map (with the crypto dynamic-map command), this command is not required, and in most cases is not used (because, in general, the peer is unknown).
For crypto map entries created with the crypto map map-name seq-num ipsec-isakmp command, you can specify multiple peers by repeating this command. The peer that packets are actually sent to is determined by the last peer that the router heard from (received either traffic or a negotiation request from) for a given data flow. If the attempt fails with the first peer, Internet Key Exchange (IKE) tries the next peer on the crypto map list.
For crypto map entries created with the crypto map map-name seq-num ipsec-manual command, you can specify only one IPsec peer per crypto map. If you want to change the peer, you must first delete the old peer and then specify the new peer.
You can specify the remote IPsec peer by its hostname only if the hostname is mapped to the peer's IP address in a DNS or if you manually map the hostname to the IP address with the ip host command.
The dynamic Keyword
When specifying the hostname of a remote IPsec peer via the set peer command, you can also issue the dynamic keyword, which defers DNS resolution of the hostname until right before the IPsec tunnel has been established. Deferring resolution enables the Cisco IOS software to detect whether the IP address of the remote IPsec peer has changed. Thus, the software can contact the peer at the new IP address.
If the dynamic keyword is not issued, the hostname is resolved immediately after it is specified. So, the Cisco IOS software cannot detect an IP address change and, therefore, attempts to connect to the IP address that it previously resolved.
The default Keyword
If there are multiple peers and you specify the default keyword, the first peer is designated as the default peer.
If dead peer detection (DPD) detects a failure, the default peer is retried before there is an attempt to connect to the next peer in the peer list.
If the default peer is unresponsive, the next peer in the peer list becomes the new current peer. Future connections through the crypto map will try that peer.
Examples
The following example shows a crypto map configuration when IKE will be used to establish the security associations (SAs). In this example, an SA could be set up to either the IPsec peer at 10.0.0.1 or the peer at 10.0.0.2.
crypto map mymap 10 ipsec-isakmpmatch address 101set transform-set my_t_set1set peer 10.0.0.1set peer 10.0.0.2The following example shows how to configure a router to perform real-time Domain Name System (DNS) resolution with a remote IPsec peer; that is, the hostname of peer is resolved via a DNS lookup right before the router establishes a connection (an IPsec tunnel) with the peer.
crypto map secure_b 10 ipsec-isakmpmatch address 140set peer b.cisco.com dynamicset transform-set xsetinterface serial1ip address 10.30.0.1crypto map secure_baccess-list 140 permit ...The following example shows that the first peer, at IP address 10.1.1.1, is the default peer:
crypto map tohub 1 ipsec-isakmpset peer 10.1.1.1 defaultset peer 10.2.2.2The following example shows that the peer with the hostname user1 is the default peer.
crypto map tohub 2 ipsec-isakmpset peer user1 dynamic defaultset peer user2 dynamicRelated Commands
set pfs
To optionally specify that IP security (IPsec) requests the perfect forward secrecy (PFS) Diffie-Hellman (DH) prime modulus group identifier when requesting new security associations (SAs) for a crypto map entry or when IPsec requires PFS when receiving requests for new SAs, use the set pfs command in crypto map configuration mode. To specify that IPsec should not request PFS during the DH exchange, use the no form of this command.
set pfs {group1 | group2 | group5 | group14 | group15 | group16 | group19 | group20}
no set pfs
Syntax Description
Defaults
By default, PFS is not requested. If no group is specified with this command, the group1 keyword is used as the default.
Command Modes
Crypto map configuration (config-crypto-map)
Command History
Usage Guidelines
This command is available for ipsec-isakmp crypto map entries and dynamic crypto map entries for both IKEv1 and IKEv2.
During negotiation, this command causes IPsec to request PFS when requesting new security associations for the crypto map entry. The default (group1) is sent if the set pfs statement does not specify a group. If the peer initiates the negotiation and the local configuration specifies PFS, the remote peer must perform a PFS exchange or the negotiation will fail. If the local configuration does not specify a group, a default of group1 will be assumed, and an offer of either group1 or group2 will be accepted. If the local configuration specifies group2, that group must be part of the offer of the peer or the negotiation will fail. If the local configuration does not specify PFS, it will accept any offer of PFS from the peer.
PFS adds another level of security; if one key is ever cracked by an attacker, then only the data sent with that key will be compromised. Without PFS, data sent with other keys could be compromised also.
With PFS, every time a new security association is negotiated, a new DH exchange occurs. (This exchange requires additional processing time.)
The 1024-bit DH prime modulus group, group2, provides more security than group1 but requires more processing time than group1.
The group chosen must be strong enough (have enough bits) to protect the IPsec keys during negotiation. While there is some disagreement regarding how many bits are necessary in the DH group to protect a specific key size, it is generally agreed that group14 is good protection for 128-bit keys, group15 is good protection for 192-bit keys, and group16 is good protection for 256-bit keys.
Note
The ISAKMP group and the IPsec PFS group should be the same if PFS is used. If PFS is not used, a group is not configured in the IPsec crypto map.
Examples
The following example specifies that PFS should be used whenever a new security association is negotiated for the crypto map mymap 10:
crypto map mymap 10 ipsec-isakmpset pfs group2Related Commands
set reverse-route
To define a distance metric for each static route or to tag a reverse route injection (RRI)-created route, use the set reverse-route command in crypto map configuration or IPsec profile configuration mode. To delete the tag or distance metric, use the no form of the command.
set reverse-route [distance number | tag tag-id | gateway next-hop]
no set reverse-route [distance number | tag tag-id | gateway]
Syntax Description
Command Default
The distance metric is 1 and the tag is 0.
Command Modes
Crypto map configuration (config-crypto-map)
IPsec profile configuration (config-crypto-profile)Command History
Usage Guidelines
This command can be applied on a per-crypto map basis or to a virtual tunnel interface (VTI) in a reverse route injection configuration.
RRI provides a scalable mechanism to dynamically learn and advertise the IP address and subnets, which belong to a remote site that connects through an IP Security (IPsec) Virtual Private Network (VPN) tunnel.
When enabled in an IPsec crypto map, RRI learns all the subnets from any network that is defined in the crypto access control list (ACL) as the destination network. The learned routes are installed into the local routing table as static routes that point to the encrypted interface. When the IPsec tunnel is torn down, the associated static routes are removed. These static routes may then be redistributed into other dynamic routing protocols so that they can be advertised to other parts of the network (usually by redistributing RRI routes into dynamic routing protocols on the core side).
The set reverse-route command provides a way to configure a server so that a dynamically learned route can take precedence over static routes. The static routes are used only in the absence of the dynamically learned route.
Inserting an RRI in the remote peer through a gateway that is configured in the crypto IPsec profile ensures that the traffic to the remote peer is always routed through the configured gateway.
If you configure the RRI gateway when there are no sessions, then no changes occur. A route to the remote peer is added only when a new security association (SA) becomes active.
To change to a new gateway when there are active sessions, you must delete the active sessions. You cannot add, delete, or change a gateway configuration when there are active sessions.
The gateway configuration scenarios with respect to sessions are exhibited irrespective of whether Front Virtual Routing and Forwarding (FVRF) has been configured or not.
Examples
The following example shows how to set the value of the metric distance for each dynamic route to 20 in a crypto map situation. The configuration is on an Easy VPN server.
crypto dynamic-map mode 1set security-association lifetime seconds 300set transform-set 3desshaset isakmp-profile profile2set reverse-route distance 20reverse-routeThe following example shows how to set the value of the metric distance for each dynamic route to 20 for a virtual tunnel interface (VTI). The configuration is on an Easy VPN server.
crypto isakmp profile profile1keyring mykeyringmatch identity group examplegroupclient authentication list authenlistisakmp authorization list autholistclient configuration address respondvirtual-template 1crypto ipsec profile viset transform-set 3desshaset reverse-route distance 20set reverse-route gateway 10.0.0.1set isakmp-profile profile1!interface Virtual-Template1 type tunnelip unnumberedtunnel mode ipsec ipv4tunnel protection ipsec profile vi
Related Commands
debug crypto ipsec
Displays IPsec events.
reverse-route
Creates source proxy information for a crypto map entry.
set security-association idle-time
To specify the maximum amount of time for which the current peer can be idle before the default peer is used, use the set security-association idle-time command in crypto map configuration mode. To disable this feature, use the no form of this command.
set security-association idle-time seconds [default]
no set security-association idle-time seconds [default]
Syntax Description
Command Default
The default peer is not used if the current peer times out.
Command Modes
Crypto map configuration (config-crypto-map)
Command History
Usage Guidelines
This command is optional. Use this command if you want the default peer to be used if the current peer times out. If there is a timeout to the current peer, the connection to that peer is closed. The next time a connection is initiated, it is directed to the default peer specified in the set peer command.
The configured value for seconds is rounded up to the next multiple of 600 seconds (ten minutes), and the rounded value becomes the polling interval for peer idle detection. Because the idle condition must be observed in two successive pollings, the period of inactivity may last up to twice the polling period before the connection to the idle peer can be closed.
Examples
In the following example, if the current peer is idle for at least 750 seconds, the default peer 10.1.1.1 (which was specified in the set peer command) is used for the next attempted connection:
crypto map tohub 1 ipsec-isakmpset peer 10.1.1.1 defaultset peer 10.2.2.2set security-association idle-time 750 defaultIn this example, the configured value of 750 seconds will be rounded up to 1200 seconds (the next multiple of 600), which becomes the idle polling interval. The connection to the idle peer will be closed after two successive idle pollings, resulting in an inactivity period of between 1200 and 2400 seconds before the connection is closed.
Related Commands
set security-association level per-host
To specify that separate IP Security security associations should be requested for each source/destination host pair, use the set security-association level per-host command in crypto map configuration mode. To specify that one security association should be requested for each crypto map access list permit entry, use the no form of this command.
set security-association level per-host
no set security-association level per-host
Syntax Description
This command has no arguments or keywords.
Defaults
For a given crypto map, all traffic between two IPSec peers matching a single crypto map access list permit entry will share the same security association.
Command Modes
Crypto map configuration
Command History
Usage Guidelines
This command is only available for ipsec-isakmp crypto map entries and is not supported for dynamic crypto map entries.
When you use this command, you need to specify that a separate security association should be used for each source/destination host pair.
Normally, within a given crypto map, IPSec will attempt to request security associations at the granularity specified by the access list entry. For example, if the access list entry permits IP protocol traffic between subnet A and subnet B, IPSec will attempt to request security associations between subnet A and subnet B (for any IP protocol), and unless finer-grained security associations are established (by a peer request), all IPSec-protected traffic between these two subnets would use the same security association.
This command causes IPSec to request separate security associations for each source/destination host pair. In this case, each host pairing (where one host was in subnet A and the other host was in subnet B) would cause IPSec to request a separate security association.
With this command, one security association would be requested to protect traffic between host A and host B, and a different security association would be requested to protect traffic between host A and host C.
The access list entry can specify local and remote subnets, or it can specify a host-and-subnet combination. If the access list entry specifies protocols and ports, these values are applied when establishing the unique security associations.
Use this command with care, as multiple streams between given subnets can rapidly consume system resources.
Examples
The following example shows what happens with an access list entry of permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 and a per-host level:
•
•
•
Without the per-host level, any of the above packets will initiate a single security association request originated via permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255.
Related Commands
set security-association lifetime
To override (for a particular crypto map entry) the global lifetime value, which is used when negotiating IP Security security associations, use the set security-association lifetime command in crypto map configuration mode. To reset a crypto map entry's lifetime value to the global value, use the no form of this command.
set security-association lifetime {seconds seconds | kilobytes kilobytes | kilobytes disable}
no set security-association lifetime {seconds | kilobytes | kilobytes disable}
Syntax Description
Defaults
The crypto map's security associations are negotiated according to the global lifetimes.
Command Modes
Crypto map configuration (config-crypto-map)
Command History
Usage Guidelines
This command is available only for ipsec-isakmp crypto map entries and dynamic crypto map entries.
IPsec security associations use shared secret keys. These keys and their security associations time out together.
Assuming that the particular crypto map entry has lifetime values configured, when the router requests new security associations during security association negotiation, it will specify its crypto map lifetime value in the request to the peer; it will use this value as the lifetime of the new security associations. When the router receives a negotiation request from the peer, it will use the smaller of the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations.
There are two lifetimes: a "timed" lifetime and a "traffic-volume" lifetime. The session keys or security association expires after the first of these lifetimes is reached.
Note
If you change a lifetime, the change will not be applied to existing security associations, but will be used in subsequent negotiations to establish security associations for data flows supported by this crypto map entry. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command. Refer to the clear crypto sa command for more detail.
To change the timed lifetime, use the set security-association lifetime seconds form of the command. The timed lifetime causes the keys and security association to time out after the specified number of seconds have passed.
To change the traffic-volume lifetime, use the set security-association lifetime kilobytes form of the command. The traffic-volume lifetime causes the key and security association to time out after the specified amount of traffic (in kilobytes) has been protected by the security association's key.
Shorter lifetimes can make it harder to mount a successful key recovery attack, because the attacker has less data encrypted under the same key to work with. However, shorter lifetimes need more CPU processing time.
The lifetime values are ignored for manually established security associations (security associations installed via an ipsec-manual crypto map entry).
How The Lifetimes Work
Assuming that the particular crypto map entry does not have lifetime values configured, when the router requests new security associations it will specify its global lifetime values in the request to the peer; it will use this value as the lifetime of the new security associations. When the router receives a negotiation request from the peer, it will use the smaller of either the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations.
The security association (and corresponding keys) will expire according to whichever occurs sooner, either after the seconds time out or after the kilobytes amount of traffic is passed.
A new security association is negotiated before the lifetime threshold of the existing security association is reached, to ensure that a new security association is ready for use when the old one expires. The seconds lifetime and the kilobytes lifetime each have a jitter mechanism to avoid security association rekey collisions. The new security association is negotiated either (30 plus a random number of) seconds before the seconds lifetime expires or when the traffic volume reaches (90 minus a random number of) percent of the kilobytes lifetime (whichever occurs first).
If no traffic has passed through the tunnel during the entire life of the security association, a new security association is not negotiated when the lifetime expires. Instead, a new security association will be negotiated only when IPsec sees another packet that should be protected.
Disabling the Traffic-Volume Lifetime
The set security-association lifetime kilobytes disable form of the command disables the traffic-volume lifetime. Disabling the traffic-volume lifetime affects only the router on which IPsec SA rekey based on traffic-volume lifetime is configured. It does not affect the peer router's behavior or the current router's IPsec SA time-based (seconds) rekey. The set security-association lifetime kilobytes disable form of the command is useful when the IPsec SAs are protecting a high bandwidth data link (10-gigabit Ethernet). This option can be used to reduce packet loss in high traffic environments and to prevent frequent rekeys that are triggered by reaching the volume lifetimes.
Note
Examples
The following example shortens the timed lifetime for a particular crypto map entry, because there is a higher risk that the keys could be compromised for security associations belonging to the crypto map entry. The traffic-volume lifetime is not changed because there is not a high volume of traffic anticipated for these security associations. The timed lifetime is shortened to 2700 seconds (45 minutes).
crypto map mymap 10 ipsec-isakmpset security-association lifetime seconds 2700The following example shows that the kilobytes disable keyword has been used to disable the volume lifetime.
set security-association lifetime kilobytes disable
Related Commands
set security-association replay disable
To disable anti-replay checking for a particular crypto map, dynamic crypto map, or crypto profile, use the set security-association replay disable command in crypto map configuration or crypto profile configuration mode. To enable anti-replay checking, use the no form of this command.
set security-association replay disable
no set security-association replay disable
Syntax Description
This command has no arguments or keywords.
Defaults
Anti-replay checking is enabled.
Command Modes
Crypto map configuration
Crypto profile configurationCommand History
Examples
The following example shows that anti-replay checking has been disabled for the crypto map named "mymap."
crypto map mymap 30set security-association replay disableRelated Commands
set security-association replay window-size
Controls the SAs that are created using the policy specified by a particular crypto map, dynamic crypto map, or crypto profile.
set security-association replay window-size
To control the security associations (SAs) that are created using the policy specified by a particular crypto map, dynamic crypto map, or crypto profile, use the set security-association replay window-size command in crypto map configuration or crypto profile configuration mode. To reset the crypto map to follow the global configuration that was specified by the crypto ipsec security-association replay window-size command, use the no form of this command.
set security-association replay window-size [N]
no set security-association replay window-size
Syntax Description
N
(Optional) Size of the window. The value can be 64, 128, 256, 512, or 1024. This value sets the window size for a particular crypto map, dynamic crypto map, or crypto profile.
Defaults
Window size is not set.
Command Modes
Crypto map configuration
Crypto profile configurationCommand History
Examples
The following example shows that the SA window size has been set to 256 for the crypto map named "mymap":
crypto map mymap 10set security-association replay window-size 256Related Commands
set security-association replay disable
Disables anti-replay checking for a particular crypto map, dynamic crypto map, or crypto profile.
set security-policy limit
To define an upper limit to the number of flows that can be created for an individual virtual access interface, use the set security-policy limit command in IPsec profile configuration mode. To remove the limitation, use the no form of the command.
set security-policy limit maximum-limit
no set security-policy limit
Syntax Description
maximum-limit
The number of security policy entries that can be negotiated with the peer. The range is from 0 to 50000.
Command Default
The upper limit to the number of flows that can be created for an individual virtual access interface is not defined.
Command Modes
IPsec profile configuration (config-crypto-profile)
Command History
Usage Guidelines
The set security-policy limit command is disabled by default. If the maximum limit is changed, this change is applied to the existing session. If the maximum limit is set to 0, then no new IPsec security associations (SAs) are created.
Examples
The following example shows how to limit the number of flows that can be created for an individual virtual access interface to 5.
crypto ipsec profile ipsec-profile-1set security-policy limit 5Related Commands
set session-key
To manually specify the IP Security session keys within a crypto map entry, use the set session-key command in crypto map configuration mode. This command is available only for ipsec-manual crypto map entries. To remove IPSec session keys from a crypto map entry, use the no form of this command.
Authentication Header (AH) Protocol Syntax
set session-key {inbound | outbound} ah spi hex-key-string
no set session-key {inbound | outbound} ah
Encapsulation Security Protocol (ESP) Syntax
set session-key {inbound | outbound} esp spi cipher hex-key-string [authenticator hex-key-string]
no set session-key {inbound | outbound} esp
Syntax Description
Defaults
No session keys are defined by default.
Command Modes
Crypto map configuration
Command History
Usage Guidelines
Use this command to define IPSec keys for security associations via ipsec-manual crypto map entries. (In the case of ipsec-isakmp crypto map entries, the security associations with their corresponding keys are automatically established via the IKE negotiation.)
If the crypto map's transform set includes an AH protocol, you must define IPSec keys for AH for both inbound and outbound traffic. If the crypto map's transform set includes an ESP encryption protocol, you must define IPSec keys for ESP encryption for both inbound and outbound traffic. If your transform set includes an ESP authentication protocol, you must define IPSec keys for ESP authentication for inbound and outbound traffic.
When you define multiple IPSec session keys within a single crypto map, you can assign the same security parameter index (SPI) number to all the keys. The SPI is used to identify the security association used with the crypto map. However, not all peers have the same flexibility in SPI assignment. You should coordinate SPI assignment with your peer's operator, making certain that the same SPI is not used more than once for the same destination address/protocol combination.
Security associations established via this command do not expire (unlike security associations established via IKE).
Session keys at one peer must match the session keys at the remote peer.
If you change a session key, the security association using the key will be deleted and reinitialized.
Examples
The following example shows a crypto map entry for manually established security associations. The transform set "t_set" includes only an AH protocol.
crypto ipsec transform-set t_set ah-sha-hmaccrypto map mymap 20 ipsec-manualmatch address 102set transform-set t_setset peer 10.0.0.21set session-key inbound ah 300 1111111111111111111111111111111111111111set session-key outbound ah 300 2222222222222222222222222222222222222222The following example shows a crypto map entry for manually established security associations. The transform set "someset" includes both an AH and an ESP protocol, so session keys are configured for both AH and ESP for both inbound and outbound traffic. The transform set includes both encryption and authentication ESP transforms, so session keys are created for both using the cipher and authenticator keywords.
crypto ipsec transform-set someset ah-sha-hmac esp-des esp-sha-hmaccrypto map mymap 10 ipsec-manualmatch address 101set transform-set somesetset peer 10.0.0.1set session-key inbound ah 300 9876543210987654321098765432109876543210set session-key outbound ah 300 fedcbafedcbafedcbafedcbafedcbafedcbafedcset session-key inbound esp 300 cipher 0123456789012345authenticator 0000111122223333444455556666777788889999set session-key outbound esp 300 cipher abcdefabcdefabcdauthenticator 9999888877776666555544443333222211110000Related Commands
set transform-set
To specify which transform sets can be used with the crypto map entry, use the set transform-set command in crypto map configuration mode. To remove all transform sets from a crypto map entry, use the no form of this command.
set transform-set transform-set-name [transform-set-name2...transform-set-name6]
no set transform-set
Syntax Description
Command Default
No transform sets are included by default.
Command Modes
Crypto map configuration
Command History
Usage Guidelines
This command is required for all static and dynamic crypto map entries.
Use this command to specify which transform sets to include in a crypto map entry.
For an ipsec-isakmp crypto map entry, you can list multiple transform sets with this command. List the higher priority transform sets first.
If the local router initiates the negotiation, the transform sets are presented to the peer in the order specified in the crypto map entry. If the peer initiates the negotiation, the local router accepts the first transform set that matches one of the transform sets specified in the crypto map entry.
The first matching transform set that is found at both peers is used for the security association. If no match is found, IPSec will not establish a security association. The traffic will be dropped because there is no security association to protect the traffic.
For an ipsec-manual crypto map entry, you can specify only one transform set. If the transform set does not match the transform set at the remote peer's crypto map, the two peers will fail to correctly communicate because the peers are using different rules to process the traffic.
If you want to change the list of transform sets, re-specify the new list of transform sets to replace the old list. This change is only applied to crypto map entries that reference this transform set. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command.
Any transform sets included in a crypto map must previously have been defined using the crypto ipsec transform-set command.
Examples
The following example defines two transform sets and specifies that they can both be used within a crypto map entry. (This example applies only when IKE is used to establish security associations. With crypto maps used for manually established security associations, only one transform set can be included in a given crypto map entry.)
crypto ipsec transform-set my_t_set1 esp-des esp-sha-hmaccrypto ipsec transform-set my_t_set2 ah-sha-hmac esp-des esp-sha-hmaccrypto map mymap 10 ipsec-isakmpmatch address 101set transform-set my_t_set1 my_t_set2set peer 10.0.0.1set peer 10.0.0.2In this example, when traffic matches access list 101, the security association can use either transform set "my_t_set1" (first priority) or "my_t_set2" (second priority) depending on which transform set matches the remote peer's transform sets.
sgbp aaa authentication
To enable a Stack Group Bidding Protocol (SGBP) authentication list, use the sgbp aaa authentication command in global configuration mode. To disable the SGBP authentication list, use the no form of this command.
sgbp aaa authentication list list-name
no sgbp aaa authentication list list-name
Syntax Description
Defaults
A SGBP authentication list is not enabled. You must use the same authentication, authorization and accounting (AAA) method list as PPP usersl.
Command Modes
Global configuration
Command History
Usage Guidelines
Use the sgbp aaa authentication command to create a list different from the AAA list that is used by PPP users.
Examples
The following example shows how to create the AAA list "SGBP" that is to be used by SGBP users:
Router(config)# sgbp aaa authentication list SGBPRelated Commands
show aaa attributes
To display the mapping between an authentication, authorization, and accounting (AAA) attribute number and the corresponding AAA attribute name, use the show aaa attributes command in EXEC configuration mode.
show aaa attributes [protocol radius]
Syntax Description
protocol radius
(Optional) Displays the mapping between a RADIUS attribute and a AAA attribute name and number.
Command Modes
EXEC
Command History
Examples
The following example is sample output for the show aaa attributes command. In this example, all RADIUS attributes that have been enabled are displayed.
Router# show aaa attributes protocol radiusAAA ATTRIBUTE LIST:Type=1 Name=disc-cause-ext Format=EnumProtocol:RADIUSNon-Standard Type=195 Name=Ascend-Disconnect-Cau Format=EnumCisco VSA Type=1 Name=Cisco AVpair Format=StringType=2 Name=Acct-Status-Type Format=EnumProtocol:RADIUSIETF Type=40 Name=Acct-Status-Type Format=EnumType=3 Name=acl Format=UlongProtocol:RADIUSIETF Type=11 Name=Filter-Id Format=BinaryType=4 Name=addr Format=IPv4 AddressProtocol:RADIUSIETF Type=8 Name=Framed-IP-Address Format=IPv4 AddreType=5 Name=addr-pool Format=StringProtocol:RADIUSNon-Standard Type=218 Name=Ascend-IP-Pool Format=UlongType=6 Name=asyncmap Format=UlongProtocol:RADIUSNon-Standard Type=212 Name=Ascend-Asyncmap Format=UlongType=7 Name=Authentic Format=EnumProtocol:RADIUSIETF Type=45 Name=Authentic Format=EnumType=8 Name=autocmd Format=StringThe following example is sample output for the show aaa attributes command. In this example, all the T.38 fax relay statistics are displayed.
Router# show aaa attributes!Type=485 Name=originating-line-info Format=UlongType=486 Name=charge-number Format=StringType=487 Name=transmission-medium-req Format=UlongType=488 Name=redirecting-number Format=StringType=489 Name=backward-call-indicators Format=StringType=490 Name=remote-media-udp-port Format=UlongType=491 Name=remote-media-id Format=StringType=492 Name=supp-svc-xfer-by Format=StringType=493 Name=faxrelay-start-time Format=StringType=494 Name=faxrelay-max-jit-buf-depth Format=StringType=495 Name=faxrelay-jit-buf-ovflow Format=StringType=496 Name=faxrelay-mr-hs-mod Format=StringType=497 Name=faxrelay-init-hs-mod Format=StringType=498 Name=faxrelay-num-pages Format=StringType=499 Name=faxrelay-direction Format=StringType=500 Name=faxrelay-ecm-in-use Format=StringType=501 Name=faxrelay-encap-prot Format=StringType=502 Name=faxrelay-nsf-country-code Format=StringType=503 Name=faxrelay-nsf-manuf-code Format=StringType=504 Name=faxrelay-fax-success Format=StringType=505 Name=faxrelay-tx-packets Format=StringType=506 Name=faxrelay-rx-packets Format=StringTable 62 provides an alphabetical listing of the fields displayed in the output of the show aaa attributes command displaying T.38 statistics and a description of each field.
Related Commands
debug voip aaa
Enables debugging messages for gateway authentication, authorization, and accounting (AAA) to be sent to the system console.
show aaa cache filterserver
To display the cache status, use the show aaa cache filterserver command in user EXEC or privileged EXEC mode.
show aaa cache filterserver {acl | pending}
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The show aaa cache filterserver command shows how many times a particular filter has been referenced or refreshed. This function may be used in administration to determine which filters are actually being used.
Examples
The following is sample output for the show aaa cache filterserver command using the acl and pending keywords:
Router# show aaa cache filterserver aclFilter Server Age Expires Refresh Access-Control-Lists--------------------------------------------------------------------------------aol 10.2.3.4 0 1440 100 ip in icmp dropip out icmp dropip out forward tcp dstip 10.2.3.4msn 10.2.3.4 N/A Never 2 ip in tcp dropmsn2 10.2.3.4 N/A Never 2 ip in tcp dropvone 10.2.3.4 N/A Never 0 ip in tcp dropThe following is sample output for the show aaa cache filterserver command using the pending keyword:
Router# show aaa cache filterserver pendingAAA pending cache:Filter Age Expires Refresh--------------------------------------------------------------------------------myfilter N/A Never N/A call 0x501802D8 (00000085)Table 63 describes the significant fields shown in the display.
Related Commands
aaa authorization cache filterserver
Enables AAA authorization caches and the downloading of ACL configurations from a RADIUS filter server.
show aaa cache group
To display all the cache entries stored by the authentication, authorization, and accounting (AAA) cache, use the show aaa cache group command in privileged EXEC mode.
show aaa cache group name {all | profile name}
Syntax Description
name
Text string representing a cache server group.
all
Displays all server group profile details.
profile name
Displays the specified individual server group profile details.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show aaa cache group command to display all cache entries for a specific group.
Examples
The following example shows how to display all cache entries for a group. The fields are self-explanatory.
Router# show aaa cache group sg1----------------------------------------------------------Entries in Profile dB SG1 for exact match----------------------------------------------------------Profile: .*user*Updated: 00:00:33Parse User: YAuthen User: Y6462F2F0 0 00000001 service-type(253) 4 26462F304 0 00000001 Framed-Protocol(66) 4 16462F318 0 00000009 policy-directive(339) 29 apply service internet_bronzeProfile: .*internet*Updated: 00:00:33Parse User: YAuthen User: Y64630088 0 00000001 service-type(253) 4 56463009C 0 00000009 ssg-service-info(350) 16 IBronze Internet646300B0 0 00000001 timeout(313) 4 90(5A)----------------------------------------------------------Entries in Profile dB SG1 for regexp match----------------------------------------------------------Profile: .*internet*,Updated: 00:00:33Parse User: YAuthen User: Y64630088 0 00000001 service-type(253) 4 56463009C 0 00000009 ssg-service-info(350) 16 IBronze Internet646300B0 0 00000001 timeout(313) 4 90(5A)Profile: .*user*,Updated: 00:00:34Parse User: YAuthen User: Y6462F2F0 0 00000001 service-type(253) 4 26462F304 0 00000001 Framed-Protocol(66) 4 16462F318 0 00000009 policy-directive(339) 29 apply service internet_bronzeRelated Commands
show aaa dead-criteria
To display dead-criteria detection information for an authentication, authorization, and accounting (AAA) server, use the show aaa dead-criteria command in privileged EXEC mode.
show aaa dead-criteria {security-protocol ip-address} [auth-port port-number] [acct-port port-number] [server-group-name]
Syntax Description
Defaults
Currently, the port-number argument for the auth-port keyword and the port-number argument for the acct-port keyword default to 1645 and 1646, respectively. The default for the server-group-name argument is radius.
Command Modes
Privileged EXEC
Command History
12.3(6)
This command was introduced.
12.3(7)T
This command was integrated into Cisco IOS Release 12.3(7)T.
Usage Guidelines
Multiple RADIUS servers having the same IP address can be configured on a router. The auth-port and acct-port keywords are used to differentiate the servers. The dead-detect interval of a server that is associated with a specified server group can be obtained by using the server-group-name keyword. (The dead-detect interval and retransmit values of a RADIUS server are set on the basis of the server group to which the server belongs. The same server can be part of multiple server groups.)
Examples
The following example shows that dead-criteria-detection information has been requested for a RADIUS server at the IP address 172.19.192.80:
Router# show aaa dead-criteria radius 172.19.192.80 radiusRADIUS Server Dead Critieria:=============================Server Details:Address : 172.19.192.80Auth Port : 1645Acct Port : 1646Server Group : radiusDead Criteria Details:Configured Retransmits : 62Configured Timeout : 27Estimated Outstanding Transactions: 5Dead Detect Time : 25sComputed Retransmit Tries: 22Statistics Gathered Since Last Successful Transaction=====================================================Max Computed Outstanding Transactions: 5Max Computed Dead Detect Time: 25sMax Computed Retransmits : 22The "Max Computed Dead Detect Time" is displayed in seconds. The other fields shown in the display are self-explanatory.
Related Commands
show aaa local user lockout
To display a list of all locked-out users, use the show aaa local user lockout command in privileged EXEC mode.
show aaa local user lockout
Syntax Description
This command has no arguments or keywords.
Defaults
Names of locked-out users are not displayed.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command can be used only by users having root privilege.
Examples
The following output of the show aaa local user lockout command illustrates that user1 is locked out:
Router# show aaa local user lockoutLocal-user Lock timeuser1 04:28:49 UTC Sat Jun 19 2004The fields in the output example are self-explanatory.Related Commands
show aaa memory
To display the output of the AAA data structure memory tracing information, use the show aaa memory command in user EXEC or privileged EXEC mode.
show aaa memory [detailed [component [line]] | stats {all | attr_list | cursor | event | request | summary}]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#Command History
Usage Guidelines
Use the show aaa memory to display the status of various AAA data structures actively used by AAA clients and statistics of data structure usage.
Examples
The following is sample output from the show aaa memory detailed command:
Router# show aaa memory detailedAAA (accounting) In-use Asked-For/Allocated Count Size Cfg/Max----------------------------------------------------------------------------aaa_acct_rec : -- --/-- -- 72 --/--aaa_acct_rec_node : -- --/-- -- 24 --/--AAA (attribute) In-use Asked-For/Allocated Count Size Cfg/Max----------------------------------------------------------------------------aaa_attr : -- --/-- -- 16 --/--aaa_attr_list : -- --/-- -- 20 --/--AAA (database) In-use Asked-For/Allocated Count Size Cfg/Max----------------------------------------------------------------------------hash_elt : -- --/-- -- 64 --/--aaa_acct_db : -- --/-- -- 160 --/--aaa_db_elt_chunk : 128 61568/912 2 64 2048/0aaa_uid_hash_table_str : 4096 4096/4148 1 4096 --/--Total : 4224 65664/5060 3 -- --/--AAA (misc) In-use Asked-For/Allocated Count Size Cfg/Max----------------------------------------------------------------------------aaa_interface : -- --/-- -- 280 --/--aaa_idb_name : -- --/-- -- 232 --/--aaa_general_db : -- --/-- -- 644 --/--aaa_chunks : -- 0/0 -- 28 200/0aaa_interface_struct : 560 560/664 2 280 --/--Total : 560 560/664 2 -- --/--RADIUS In-use Asked-For/Allocated Count Size Cfg/Max----------------------------------------------------------------------------Total allocated: 0.004 Mb, 5 Kb, 5724 bytesAAA Low Memory Statistics:__________________________Authentication low-memory threshold : 3%Accounting low-memory threshold : 2%AAA Unique ID Failure : 0Local server Packet dropped : 0CoA Packet dropped : 0PoD Packet dropped : 0The following is sample output from the show aaa memory stats all command:
Router# show aaa memory stats allAAA Memory trace summary:--------------------------------------------------------------------------------TYPE mallocs frees failures active max-usage--------------------------------------------------------------------------------AAA_ATTR_L 41 40 0 1 6AAA_CURSOR 88 88 0 0 2AAA_EVENT 5 5 0 0 1AAA_REQUES 2 2 0 0 1--------------------------------------------------------------------------------AAA_ATTR_LIST data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs-----------------------------------------------------------------0x01956360 aaa_attr_list_alloc 1-----------------------------------------------------------------AAA_CURSOR data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs----------------------------------------------------------------------------------------------------------------------------------AAA_EVENT data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs----------------------------------------------------------------------------------------------------------------------------------AAA_REQUEST data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs----------------------------------------------------------------------------------------------------------------------------------Table 64 describes the significant fields in the display.
The following is sample output from the show aaa memory stats with the attr_list keyword:
Router# show aaa memory stats attr_listAAA_ATTR_LIST data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs-----------------------------------------------------------------0x01956360 aaa_attr_list_alloc 1-----------------------------------------------------------------Table 65 describes the significant fields in the display.
The following is sample output from the show aaa memory stats cursor command:
Router# show aaa memory stats cursorAAA_CURSOR data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs-----------------------------------------------------------------The following is sample output from the show aaa memory stats event command:
Router# show aaa memory stats eventAAA_EVENT data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs----------------------------------------------------------------------------------------------------------------------------------The following is sample output from the show aaa memory stats request command:
Router# show aaa memory stats requestAAA_REQUEST data-structure active allocations trace:-----------------------------------------------------------------Allocator-PC AAA API Active Mallocs----------------------------------------------------------------------------------------------------------------------------------show aaa method-lists
To display all the named method lists defined in the authentication, authorization, and accounting (AAA) subsystem, use the show aaa method-lists command in user EXEC or privileged EXEC mode.
show aaa method-lists {accounting | all | authentication | authorization}
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Examples
The following example shows how to display method lists for the accounting services:
Router# show aaa method-lists accountingacct queue=AAA_ML_ACCT_SHELLname=Permanent None valid=TRUE id=0 Action=NOT_SET :state=ALIVEacct queue=AAA_ML_ACCT_AUTH_PROXYname=default valid=TRUE id=0 Action=START STOP :state=DEAD : SERVER_GROUP tac+acct queue=AAA_ML_ACCT_NETname=methodtest valid=TRUE id=BA000002 Action=START STOP :state=DEAD :name=tunnel valid=TRUE id=48000003 Action=START STOP :state=DEAD : SERVER_GROsname=session valid=TRUE id=5C000004 Action=START STOP :state=DEAD : SERVER_GRsacct queue=AAA_ML_ACCT_CONNacct queue=AAA_ML_ACCT_SYSTEMname= valid=TRUE id=82000005 Action=START STOP :state=DEAD : SERVER_GROUP radsacct queue=AAA_ML_ACCT_RESOURCEacct queue=AAA_ML_ACCT_RMpermanent listsTable 66 describes the significant fields shown in the display.
The following example shows how to display method lists for authentication services. Table 66 describes the significant fields shown in the display.
Router# show aaa method-lists authenticationauthen queue=AAA_ML_AUTHEN_LOGINname=default valid=TRUE id=0 :state=DEAD : SERVER_GROUP radiusauthen queue=AAA_ML_AUTHEN_ENABLEname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+ ENABLE NONEauthen queue=AAA_ML_AUTHEN_PPPauthen queue=AAA_ML_AUTHEN_SGBPauthen queue=AAA_ML_AUTHEN_ARAPname=default valid=TRUE id=0 :state=DEAD : SERVER_GROUP tacacs+name=MIS-access valid=TRUE id=FF000006 :state=DEAD : SERVER_GROUP tacacs+authen queue=AAA_ML_AUTHEN_DOT1Xname=default valid=TRUE id=0 :state=DEAD : SERVER_GROUP radiusauthen queue=AAA_ML_AUTHEN_EAPOUDPname=default valid=TRUE id=0 :state=ALIVE : ENABLE SERVER_GROUP radiusauthen queue=AAA_ML_AUTHEN_8021Xpermanent listsname=Permanent Enable None valid=TRUE id=0 :state=ALIVE : ENABLE NONEname=Permanent Enable valid=TRUE id=0 :state=ALIVE : ENABLEname=Permanent None valid=TRUE id=0 :state=ALIVE : NONEname=Permanent Local valid=TRUE id=0 :state=ALIVE : LOCALThe following example shows how to display method lists for authorization services. Table 66 describes the significant fields shown in the display.
Router# show aaa method-lists authorizationauthor queue=AAA_ML_AUTHOR_SHELLauthor queue=AAA_ML_AUTHOR_NETname=method1 valid=TRUE id=12000001 :state=ALIVE : NONEname=mygroup valid=TRUE id=6D000007 :state=ALIVE : SERVER_GROUP radius LOCALname=list11 valid=TRUE id=6C000009 :state=DEAD : SERVER_GROUP radiusauthor queue=AAA_ML_AUTHOR_CONNname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+author queue=AAA_ML_AUTHOR_IPMOBILEauthor queue=AAA_ML_AUTHOR_RMauthor queue=AAA_ML_AUTHOR_CONFIGauthor queue=AAA_ML_AUTHOR_AUTH_PROXYname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+author queue=AAA_ML_AUTHOR_PREAUTHauthor queue=AAA_ML_AUTHOR_FLTSVname=default valid=TRUE id=0 :state=DEAD : SERVER_GROUP grp1name=group valid=TRUE id=48000008 :state=ALIVE : SERVER_GROUP tacacs+ NONEpermanent listsname=local-list valid=TRUE id=0 :state=ALIVE : LOCALThe following example shows how to display method lists for all the services. Table 66 describes the significant fields shown in the display.
Router# show aaa method-lists allauthen queue=AAA_ML_AUTHEN_LOGINname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+authen queue=AAA_ML_AUTHEN_ENABLEname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+ ENABLE NONEauthen queue=AAA_ML_AUTHEN_PPPauthen queue=AAA_ML_AUTHEN_SGBPauthen queue=AAA_ML_AUTHEN_ARAPname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+name=MIS-access valid=TRUE id=FF000006 :state=ALIVE : SERVER_GROUP tacacs+authen queue=AAA_ML_AUTHEN_DOT1Xname=default valid=TRUE id=0 :state=DEAD : SERVER_GROUP radiusauthen queue=AAA_ML_AUTHEN_EAPOUDPname=default valid=TRUE id=0 :state=ALIVE : ENABLE SERVER_GROUP radiusauthen queue=AAA_ML_AUTHEN_8021Xpermanent listsname=Permanent Enable None valid=TRUE id=0 :state=ALIVE : ENABLE NONEname=Permanent Enable valid=TRUE id=0 :state=ALIVE : ENABLEname=Permanent None valid=TRUE id=0 :state=ALIVE : NONEname=Permanent Local valid=TRUE id=0 :state=ALIVE : LOCALauthor queue=AAA_ML_AUTHOR_SHELLauthor queue=AAA_ML_AUTHOR_NETname=method1 valid=TRUE id=12000001 :state=ALIVE : NONEname=mygroup valid=TRUE id=6D000007 :state=ALIVE : SERVER_GROUP radius LOCALname=list11 valid=TRUE id=6C000009 :state=DEAD : SERVER_GROUP radiusauthor queue=AAA_ML_AUTHOR_CONNname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+author queue=AAA_ML_AUTHOR_IPMOBILEauthor queue=AAA_ML_AUTHOR_RMauthor queue=AAA_ML_AUTHOR_CONFIGauthor queue=AAA_ML_AUTHOR_AUTH_PROXYname=default valid=TRUE id=0 :state=ALIVE : SERVER_GROUP tacacs+author queue=AAA_ML_AUTHOR_PREAUTHauthor queue=AAA_ML_AUTHOR_FLTSVname=default valid=TRUE id=0 :state=DEAD : SERVER_GROUP grp1name=group valid=TRUE id=48000008 :state=ALIVE : SERVER_GROUP tacacs+ NONEpermanent listsname=local-list valid=TRUE id=0 :state=ALIVE : LOCALacct queue=AAA_ML_ACCT_SHELLacct queue=AAA_ML_ACCT_AUTH_PROXYname=default valid=TRUE id=0 Action=START STOP :state=ALIVE : SERVER_GROUP ta+acct queue=AAA_ML_ACCT_NETname=methodtest valid=TRUE id=BA000002 Action=START STOP :state=DEAD :name=tunnel valid=TRUE id=48000003 Action=START STOP :state=DEAD : SERVER_GROsname=session valid=TRUE id=5C000004 Action=START STOP :state=DEAD : SERVER_GRsacct queue=AAA_ML_ACCT_CONNacct queue=AAA_ML_ACCT_SYSTEMname= valid=TRUE id=82000005 Action=START STOP :state=DEAD : SERVER_GROUP radsacct queue=AAA_ML_ACCT_RESOURCEacct queue=AAA_ML_ACCT_RMpermanent listsname=Permanent None valid=TRUE id=0 Action=NOT_SET :state=ALIVERelated Commands
show aaa service-profiles
To display the service profiles downloaded and stored by an authentication, authorization, and accounting (AAA) session, use the show aaa service-profiles command in user EXEC or privileged EXEC mode.
show aaa service-profiles
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Examples
The following is sample output from the show aaa service-profiles command. The field description is self-explantory.
Router# show aaa service-profilesService Name: example.comRelated Commands
aaa service-profiles
Configures the service profile parameters for a AAA session.
show aaa servers
To display the status and number of packets that are sent to and received from all public and private authentication, authorization, and accounting (AAA) RADIUS servers as interpretted by the AAA Server MIB, use the show aaa servers command in user EXEC or privileged EXEC mode.
show aaa servers [private | public]
Syntax Description
private
Displays private AAA servers only, which are also displayed by the AAA Server MIB.
public
Displays public AAA servers only, which are also displayed by the AAA Server MIB.
Command Modes
User EXEC or privileged EXEC
Command History
Usage Guidelines
Only RADIUS servers are supported by the show aaa servers command.
The command displays information about packets sent and received for all AAA transaction types—authentication, authorization, and accounting.
Examples
The following is sample output from the show aaa servers private command. Only the first four lines of the display pertain to the status of private RADIUS servers, and the output fields in this part of the display are described in Table 67.
Router# show aaa servers privateRADIUS: id 24, priority 1, host 172.31.164.120, auth-port 1645,acct-port 1646State: current UP, duration 18s, previous duration 0sDead: total time 0s, count 0Authen: request 0, timeouts 0Response: unexpected 0, server error 0, incorrect 0, time 0msTransaction: success 0, failure 0Author: request 0, timeouts 0Response: unexpected 0, server error 0, incorrect 0, time 0msTransaction: success 0, failure 0Account: request 0, timeouts 0Response: unexpected 0, server error 0, incorrect 0, time 0msTransaction: success 0, failure 0Elapsed time since counters last cleared: 2h1mTable 67 describes the significant fields in the display.
The fields in the output are mapped to Simple Network Management Protocol (SNMP) objects in the Cisco AAA-SERVER-MIB and are used in SNMP reporting. The first line of the report is mapped to the Cisco AAA-SERVER-MIB as follows:
•
•
•
•
•
Mapping the following set of objects listed in the Cisco AAA-SERVER-MIB map to fields displayed by the show aaa servers command is more straightforward. For example, the casAuthenRequests field corresponds to the Authen: request portion of the report, casAuthenRequestTimeouts corresponds to the Authen: timeouts portion of the report, and so on.
casStatisticsGroup OBJECT-GROUPOBJECTS {casAuthenRequests,casAuthenRequestTimeouts,casAuthenUnexpectedResponses,casAuthenServerErrorResponses,casAuthenIncorrectResponses,casAuthenResponseTime,casAuthenTransactionSuccesses,casAuthenTransactionFailures,casAuthorRequests,casAuthorRequestTimeouts,casAuthorUnexpectedResponses,casAuthorServerErrorResponses,casAuthorIncorrectResponses,casAuthorResponseTime,casAuthorTransactionSuccesses,casAuthorTransactionFailures,casAcctRequests,casAcctRequestTimeouts,casAcctUnexpectedResponses,casAcctServerErrorResponses,casAcctIncorrectResponses,casAcctResponseTime,casAcctTransactionSuccesses,casAcctTransactionFailures,casState,casCurrentStateDuration,casPreviousStateDuration,casTotalDeadTime,casDeadCount}To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
http://www.cisco.com/go/mibsRelated Commands
show aaa subscriber profile
To display all the subscriber profiles under the specified namestring in the authentication, authorization, and accounting (AAA) subsystem, use the show aaa subscriber profile command in user EXEC or privileged EXEC mode.
show aaa subscriber profile profile-name
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
This command display all the subscriber profile CLIs under the specified namestring. If no namestring is specified, all the subscriber profiles in the subscriber profile database will be displayed.
Examples
The following example shows how to display subscriber profile information:
Router# show aaa subscriber profile db----------------------------------------------------------Entries in Profile dB subscribers for exact match----------------------------------------------------------Profile: prof1Updated: 00:00:55Parse User: NAuthen User: NQuery Count: 46897DBDC 0 0000000A service-name(381) 8 service1, service none, protocol ne----------------------------------------------------------Entries in Profile dB subscribers for regexp match----------------------------------------------------------No entries found for regexp matchTable 66 describes the significant fields shown in the display.
Related Commands
show aaa user
To display attributes related to an authentication, authorization, and accounting (AAA) session, use the show aaa user command in privileged EXEC mode.
show aaa user {all | unique id}
Syntax Description
all
Displays information about all users for which AAA currently has knowledge.
unique id
Displays information for only this user.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
When a user logs into a Cisco router and uses AAA, a unique ID is assigned to the session. Throughout the life of the session, various attributes that are related to the session are collected and stored internally within a AAA database. These attributes can include the IP address of the user, the protocol being used to access the router (such as PPP or Serial Line Internet Protocol [SLIP]), the speed of the connection, and the number of packets or bytes that are received or transmitted.
The output of this command provides a snapshot of various subdatabases that are associated with a AAA unique ID. Some of the more important ones are listed in Table 68.
The output also shows various AAA call events that are associated with a particular session. For example, when a session comes up, the events generally recorded are CALL START, NET UP, and IP Control Protocol UP (IPCP UP).
In addition, the output provides a snapshot of the dynamic attributes that are associated with a particular session. (Dynamic attributes are those that keep changing values throughout the life of the session.) Some of the more important ones are listed in Table 68.
The unique ID of a session can be obtained from the output of the show aaa sessions command.
Note
Note
Examples
The following example shows that information is requested for all users:
Router# show aaa user allThe following example shows that information is requested for user 5:
Router# show aaa user 5The following is sample output from the show aaa user command. The session information displayed is for a PPP over Ethernet over Ethernet (PPPoEoE) session.
Router# show aaa user 3Load for five secs: 0%/0%; one minute: 0%; five minutes: 0%Time source is hardware calendar, *20:32:49.199 PST Wed Dec 172003Unique id 3 is currently in use.Accounting:log=0x20C201Events recorded :CALL STARTNET UPIPCP_PASSINTERIM STARTVPDN NET UPupdate method(s) :NONEupdate interval = 0Outstanding Stop Records : 0Dynamic attribute list:63CCF138 0 00000001 connect-progress(30) 4 LAN Ses Up63CCF14C 0 00000001 pre-session-time(239) 4 3(3)63CCF160 0 00000001 nas-tx-speed(337) 4 102400000(61A8000)63CCF174 0 00000001 nas-rx-speed(33) 4 102400000(61A8000)63CCF188 0 00000001 elapsed_time(296) 4 2205(89D)63CCF19C 0 00000001 bytes_in(97) 4 6072(17B8)63CCF1B0 0 00000001 bytes_out(223) 4 6072(17B8)63CCF1C4 0 00000001 pre-bytes-in(235) 4 86(56)63CCF1D8 0 00000001 pre-bytes-out(236) 4 90(5A)63CCF1EC 0 00000001 paks_in(98) 4 434(1B2)63CCF244 0 00000001 paks_out(224) 4 434(1B2)63CCF258 0 00000001 pre-paks-in(237) 4 7(7)63CCF26C 0 00000001 pre-paks-out(238) 4 9(9)No data for type EXECNo data for type CONNNET: Username=peer1Session Id=00000003 Unique Id=00000003Start Sent=1 Stop Only=Nstop_has_been_sent=NMethod List=63B4A10C : Name = defaultAttribute list:63CCF138 0 00000001 session-id(293) 4 3(3)63CCF14C 0 00000001 Framed-Protocol(62) 4 PPP63CCF160 0 00000001 protocol(241) 4 ip63CCF174 0 00000001 addr(5) 4 70.0.0.1No data for type CMDNo data for type SYSTEMNo data for type RM CALLNo data for type RM VPDNNo data for type AUTH PROXYNo data for type IPSEC-TUNNELNo data for type RESOURCENo data for type 10No data for type CALLDebg: No data availableRadi: 641AACACInterface:TTY Num = -1Stop Received = 0Byte/Packet Counts till Call Start:Start Bytes In = 106 Start Bytes Out = 168Start Paks In = 3 Start Paks Out = 4Byte/Packet Counts till Service Up:Pre Bytes In = 192 Pre Bytes Out = 258Pre Paks In = 10 Pre Paks Out = 13Cumulative Byte/Packet Counts :Bytes In = 6264 Bytes Out = 6330Paks In = 444 Paks Out = 447StartTime = 19:56:01 PST Dec 17 2003AuthenTime = 19:56:04 PST Dec 17 2003Component = PPoEAuthen: service=PPP type=CHAP method=RADIUSKerb: No data availableMeth: No data availablePreauth: No Preauth data.General:Unique Id = 00000003Session Id = 00000003Attribute List:63CCF180 0 00000001 port-type(156) 4 PPP over Ethernet63CCF194 0 00000009 interface(152) 7 0/0/0/0PerU: No data availableTable 68 lists the significant fields shown in the display.
Related Commands
show aaa sessions
Displays information about AAA sessions as seen in the AAA Session MIB.
show access-group mode interface
To display the Access Control List (ACL) configuration on a Layer 2 interface, use the show access-group mode interface command in privileged EXEC mode.
show access-group mode interface [interface interface-number]
Syntax Description
type
(Optional) Interface type; valid values are fastethernet, gigabitethernet, tengigabitethernet, and port-channel.
number
(Optional) Interface number.
Command Default
This command has no default settings.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The valid values for the port number depend on the chassis used.
Examples
This example shows how to display the ACL configuration mode on Fast Ethernet interface 6/1:
Router# show access-group mode interface fastethernet 6/1Interface FastEthernet6/1:Access group mode is: mergeRouter#Related Commands
show access-lists compiled
To display a table showing Turbo Access Control Lists (ACLs), use the show access-lists compiled command in user EXEC or privileged EXEC mode.
show access-lists compiled
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
This command is used to display the status and condition of the Turbo ACL tables associated with each access list. The Turbo ACL feature processes access lists more expediently, providing faster functionality for routers equipped with the feature. The Turbo ACL feature compiles the ACLs into a set of lookup tables, while maintaining the first match requirements. Packet headers are used to access these tables in a small, fixed number of lookups, independently of the existing number of ACL entries. The memory usage is displayed for each table; large and complex access lists may require substantial amounts of memory. If the memory usage is greater than the memory available, you can disable the Turbo ACL feature so that memory exhaustion does not occur, but the acceleration of the access lists is not then enabled.
Examples
The following is partial sample output from the show access-lists compiled command:
Router# show access-lists compiledCompiled ACL statistics:12 ACLs loaded, 12 compiled tablesACL State Tables Entries Config Fragment Redundant Memory1 Operational 1 2 1 0 0 1Kb2 Operational 1 3 2 0 0 1Kb3 Operational 1 4 3 0 0 1Kb4 Operational 1 3 2 0 0 1Kb5 Operational 1 5 4 0 0 1Kb9 Operational 1 3 2 0 0 1Kb20 Operational 1 9 8 0 0 1Kb21 Operational 1 5 4 0 0 1Kb101 Operational 1 15 9 7 2 1Kb102 Operational 1 13 6 6 0 1Kb120 Operational 1 2 1 0 0 1Kb199 Operational 1 4 3 0 0 1KbFirst level lookup tables:Block Use Rows Columns Memory used0 TOS/Protocol 6/16 12/16 660481 IP Source (MS) 10/16 12/16 660482 IP Source (LS) 27/32 12/16 1320963 IP Dest (MS) 3/16 12/16 660484 IP Dest (LS) 9/16 12/16 660485 TCP/UDP Src Port 1/16 12/16 660486 TCP/UDP Dest Port 3/16 12/16 660487 TCP Flags/Fragment 3/16 12/16 66048Table 70 describes the significant fields shown in the display.
Related Commands
show access-lists
To display the contents of current access lists, use the show access-lists command in user EXEC or privileged EXEC mode.
show access-lists [access-list-number | access-list-name]
Syntax Description
access-list-number
(Optional) Number of the access list to display. The system displays all access lists by default.
access-list-name
(Optional) Name of the IP access list to display.
Defaults
The system displays all access lists.
Command Modes
User EXEC
Privileged EXECCommand History
Usage Guidelines
The show access-lists command is used to display the current ACLs operating in the router. Each access list is flagged using the Compiled indication if it is operating as an accelerated ACL.
The display also shows how many packets have been matched against each entry in the ACLs, enabling the user to monitor the particular packets that have been permitted or denied. This command also indicates whether the access list is running as a compiled access list.
Examples
The following is sample output from the show access-lists command when access list 101 is specified:
Router# show access-lists 101Extended IP access list 101permit tcp host 198.92.32.130 any established (4304 matches) check=5permit udp host 198.92.32.130 any eq domain (129 matches)permit icmp host 198.92.32.130 anypermit tcp host 198.92.32.130 host 171.69.2.141 gt 1023permit tcp host 198.92.32.130 host 171.69.2.135 eq smtp (2 matches)permit tcp host 198.92.32.130 host 198.92.30.32 eq smtppermit tcp host 198.92.32.130 host 171.69.108.33 eq smtppermit udp host 198.92.32.130 host 171.68.225.190 eq syslogpermit udp host 198.92.32.130 host 171.68.225.126 eq syslogdeny ip 150.136.0.0 0.0.255.255 224.0.0.0 15.255.255.255deny ip 171.68.0.0 0.1.255.255 224.0.0.0 15.255.255.255 (2 matches) check=1deny ip 172.24.24.0 0.0.1.255 224.0.0.0 15.255.255.255deny ip 192.82.152.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.122.173.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.122.174.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.135.239.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.135.240.0 0.0.7.255 224.0.0.0 15.255.255.255deny ip 192.135.248.0 0.0.3.255 224.0.0.0 15.255.255.255An access list counter counts how many packets are allowed by each line of the access list. This number is displayed as the number of matches. Check denotes how many times a packet was compared to the access list but did not match.
The following is sample output from the show access-lists command when the Turbo Access Control List (ACL) feature is configured on all of the following access lists.
Note
Router# show access-listsStandard IP access list 1 (Compiled)deny anyStandard IP access list 2 (Compiled)deny 192.168.0.0, wildcard bits 0.0.0.255permit anyStandard IP access list 3 (Compiled)deny 0.0.0.0deny 192.168.0.1, wildcard bits 0.0.0.255permit anyStandard IP access list 4 (Compiled)permit 0.0.0.0permit 192.168.0.2, wildcard bits 0.0.0.255The following is sample output from the show access-lists command that shows information for IPv6 access lists when IPv6 is configured on the network:
Router# show access-listsIPv6 access list list2deny ipv6 FEC0:0:0:2::/64 any sequence 10permit ipv6 any any sequence 20Related Commands
show accounting
The show accounting command is replaced by the show aaa user command. See the show aaa user command for more information.
show appfw
To display application firewall policy information, use the show appfw command in user EXEC or privileged EXEC mode.
show appfw {configuration | dns [cache [policy policy-name]] | name appfw-name}
Syntax Description
Command Default
If no policies are specified, information for all policies is displayed.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
Use this command to display information regarding the application firewall policy configuration or the IP addresses of the DNS cache.
Use the show appfw command in conjunction with the show ip inspect config command to display the complete firewall configuration.
If you do not specify a policy using the policy policy-name option, the IP addresses gathered for all DNS names and policies are displayed.
Examples
This following output for the show appfw configuration command displays the configuration for the inspection rule "mypolicy," which is applied to all incoming HTTP traffic on FastEthernet interface 0/0. In this example, all available HTTP inspection parameters have been defined.
Router# show appfw configurationApplication Firewall Rule configurationApplication Policy name mypolicyApplication httpstrict-http action allow alarmcontent-length minimum 0 maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request length 1 response length 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding default action allow alarmTable 71 describes the significant fields shown in the display.
Related Commands
show ase
Note
To display the Automatic Signature Extraction (ASE) run-time status or detected signatures, use the show ase command in privileged EXEC mode.
show ase [dispersion-table num-entries-to-display | prevalence-table num-entries-to-display | signatures | special-case-table num-entries-to-display | statistics]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show ase command without any keywords to display the run-time status. Use the show ase command with the signatures keyword to display the detected ASE signatures.
This command is used on the Cisco 1800, 2800, and 7200 series routers, Cisco 7301 router, and Integrated Services Routers (ISRs) as ASE sensors.
Examples
The following example output displays the ASE run-time status:
Note
Router# show aseASE Information:Collector IP: 10.10.10.3TIDP Group : 10Status : OnlinePackets inspected: 1105071Address Dispersion Threshold: 20Prevalence Threshold: 10Sampling set to: 1 in 64Address Dispersion Inactivity Timer: 3600sPrevalence Table Refresh Time: 60sTable 72 describes the significant fields shown in the display.
The following example output displays the detected ASE signatures:
Router# show ase signatureAutomatic Signature Extraction Detected Signatures==================================================Signature Hash: 0x1E4A2076AAEA19B1, Offset: 54, Dest Port: TCP 135,Signature: 05 00 00 03 10 00 00 00 F0 00 10 00 01 00 00 00 B8 00 00 00 00 00 03 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Signature Hash: 0x24EC60FB1CF9A800, Offset: 72, Dest Port: TCP 445,Signature: 00 00 00 00 00 00 00 00 00 00 00 00 FF FE 00 00 00 00 00 62 00 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 52 41 4DSignature Hash: 0x0B0275535FFF480C, Offset: 54, Dest Port: TCP 445,Signature: 00 00 00 85 FF 53 4D 42 72 00 00 00 00 18 53 C8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE 00 00 00 00 00 62 00 02Related Commands
show audit
To display the contents of an audit file, use the show audit command in privileged EXEC mode.
show audit [filestat]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The audit file is a fixed file size in the disk file system. The audit file contains syslog messages (also known as hashes), which monitor changes that are made to your router. A separate hash is maintained for each of the following areas: running version, running configuration, startup configuration, file system, and hardware configuration. The show audit command will display any changes that are made to any of these areas.
Note
Examples
The following example is sample output from the show audit command:
Router# show audit*Sep 14 18:37:31.535:%AUDIT-1-RUN_VERSION:Hash:
24D98B13B87D106E7E6A7E5D1B3CE0AD User:
*Sep 14 18:37:31.583:%AUDIT-1-RUN_CONFIG:Hash:4AC2D776AA6FCA8FD7653CEB8969B695 User:*Sep 14 18:37:31.595:%AUDIT-1-STARTUP_CONFIG:Hash:95DD497B1BB61AB33A629124CBFEC0FC User:*Sep 14 18:37:32.107:%AUDIT-1-FILESYSTEM:Hash:330E7111F2B526F0B850C24ED5774EDE User:*Sep 14 18:37:32.107:%AUDIT-1-HARDWARE_CONFIG:Hash:32F66463DDA802CC9171AF6386663D20 User:Table 73 describes the significant fields shown in the display.
Related Commands
audit filesize
Changes the size of the audit file.
audit interval
Changes the time interval that is used for calculating hashes.
show authentication interface
To display information about the Auth Manager for a given interface, use the show authentication interface command in privileged EXEC mode.
show authentication interface type number
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show authentication interface command to display information about the Auth Manager for a given interface.
Examples
The following is sample output from the show authentication interface command:
Switch# show authentication interface g1/0/23Client list:MAC Address Domain Status Handle Interface000e.84af.59bd DATA Authz Success 0xE0000000 GigabitEthernet1/0/23Available methods list:Handle Priority Name3 0 dot1xRunnable methods list:Handle Priority Name3 0 dot1xTable 74 describes the significant fields shown in the display. Other fields are self-explanatory.
Related Commands
show authentication registrations
To display information about the authentication methods that are registered with the Auth Manager, use the show authentication registrations command in privileged EXEC mode.
show authentication registrations
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show authentication registrations command to display information about all methods registered with the Auth Manager.
Examples
The following is sample output for the show authentication registrations command:
Switch# show authentication registrationsAuth Methods registered with the Auth Manager:Handle Priority Name3 0 dot1x2 1 mab1 2 webauthTable 75 describes the significant fields shown in the display.
Related Commands
show authentication sessions
To display information about current Auth Manager sessions, use the show authentication sessions command in privileged EXEC mode.
Note
show authentication sessions [handle handle-id] [interface type number] [mac mac-address] [method method-name [interface type number]] [session-id session-id]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.2(33)SXH
Support for this command was introduced.
12.2(33)SXI
This command was changed to add the handle handle keyword and argument and add information to the output.
Usage Guidelines
Use the show authentication sessions command to display information about all current Auth Manager sessions. To display information about specific Auth Manager sessions, use one or more of the keywords.
Table 1-76 shows the possible operating states for the reported authentication sessions.
Table 1-77 shows the possible authentication methods.
Table 1-77 Authentication Method States
dot1x
802.1X
mab
MAC authentication bypass
webauth
web authentication
Examples
The following example shows how to display all authentication sessions on the switch:
Router# show authentication sessionsInterface MAC Address Method Domain Status Session IDGi1/48 0015.63b0.f676 dot1x DATA Authz Success 0A3462B1000000102983C05CGi1/5 000f.23c4.a401 mab DATA Authz Success 0A3462B10000000D24F80B58Gi1/5 0014.bf5d.d26d dot1x DATA Authz Success 0A3462B10000000E29811B94The following example shows how to display all authentication sessions on an interface:
Router# show authentication sessions interface gigabitethernet2/47Interface: GigabitEthernet2/47MAC Address: UnknownIP Address: UnknownStatus: Authz SuccessDomain: DATAOper host mode: multi-hostOper control dir: bothAuthorized By: Guest VlanVlan Policy: 20Session timeout: N/AIdle timeout: N/ACommon Session ID: 0A3462C8000000000002763CAcct Session ID: 0x00000002Handle: 0x25000000Runnable methods list:Method Statemab Failed overdot1x Failed over----------------------------------------Interface: GigabitEthernet2/47MAC Address: 0005.5e7c.da05IP Address: UnknownUser-Name: 00055e7cda05Status: Authz SuccessDomain: VOICEOper host mode: multi-domainOper control dir: bothAuthorized By: Authentication ServerSession timeout: N/AIdle timeout: N/ACommon Session ID: 0A3462C8000000010002A238Acct Session ID: 0x00000003Handle: 0x91000001Runnable methods list:Method Statemab Authc Successdot1x Not runThe following example shows how to display the authentication session for a specified session ID:
Router# show authentication sessions session-id 0B0101C70000004F2ED55218Interface: GigabitEthernet9/2MAC Address: 0000.0000.0011IP Address: 20.0.0.7Username: johndoeStatus: Authz SuccessDomain: DATAOper host mode: multi-hostOper control dir: bothAuthorized By: Critical AuthVlan policy: N/ASession timeout: N/AIdle timeout: N/ACommon Session ID: 0B0101C70000004F2ED55218Acct Session ID: 0x00000003Handle: 0x91000001Runnable methods list:Method Statemab Authc Successdot1x Not runThe following examples show how to display all clients authorized by the specified authentication method:
Router# show authentication sessions method mabNo Auth Manager contexts match supplied criteriaRouter# show authentication sessions method dot1xInterface MAC Address Domain Status Session IDGi9/2 0000.0000.0011 DATA Authz Success 0B0101C70000004F2ED55218Table 74 describes the significant fields shown in the display.
Related Commands
show auto secure config
To display AutoSecure configurations, use the show auto secure config command in privileged EXEC mode.
show auto secure config
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following sample output from the show auto secure config command shows what has been enabled and disabled via the auto secure command:
Router# show auto secure configno service fingerno service padno service udp-small-serversno service tcp-small-serversservice password-encryptionservice tcp-keepalives-inservice tcp-keepalives-outno cdp runno ip bootp serverno ip http serverno ip fingerno ip source-routeno ip gratuitous-arpsno ip identdsecurity passwords min-length 6security authentication failure rate 10 logenable secret 5 $1$CZ6G$GkGOnHdNJCO3CjNHHyTUA.aaa new-modelaaa authentication login local_auth localline console 0login authentication local_authexec-timeout 5 0transport output telnetline aux 0login authentication local_authexec-timeout 10 0transport output telnetline vty 0 4login authentication local_authtransport input telnetip domain-name cisco.comcrypto key generate rsa general-keys modulus 1024ip ssh time-out 60ip ssh authentication-retries 2line vty 0 4transport input ssh telnetservice timestamps debug datetime localtime show-timezone msecservice timestamps log datetime localtime show-timezone mseclogging facility local2logging trap debuggingservice sequence-numberslogging console criticallogging bufferedinterface FastEthernet0/1no ip redirectsno ip proxy-arpno ip unreachablesno ip directed-broadcastno ip mask-replyno mop enabled!interface FastEthernet1/0no ip redirectsno ip proxy-arpno ip unreachablesno ip directed-broadcastno ip mask-replyno mop enabled!interface FastEthernet1/1no ip redirectsno ip proxy-arpno ip unreachablesno ip directed-broadcastno ip mask-replyno mop enabled!interface FastEthernet0/0no ip redirectsno ip proxy-arpno ip unreachablesno ip directed-broadcastno ip mask-replyno mop enabled!ip cefinterface FastEthernet0/0ip verify unicast reverse-pathip inspect audit-trailip inspect dns-timeout 7ip inspect tcp idle-time 14400ip inspect udp idle-time 1800ip inspect name autosec_inspect cuseeme timeout 3600ip inspect name autosec_inspect ftp timeout 3600ip inspect name autosec_inspect http timeout 3600ip inspect name autosec_inspect rcmd timeout 3600ip inspect name autosec_inspect realaudio timeout 3600ip inspect name autosec_inspect smtp timeout 3600ip inspect name autosec_inspect tftp timeout 30ip inspect name autosec_inspect udp timeout 15ip inspect name autosec_inspect tcp timeout 3600access-list 100 deny ip any anyinterface FastEthernet0/0ip inspect autosec_inspect outip access-group 100 inRelated Commands
show call admission statistics
To monitor the global Call Admission Control (CAC) configuration parameters and the behavior of CAC, use the show call admission statistics command in user EXEC or privileged EXEC mode.
show call admission statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Privileged EXECCommand History
Examples
The following is sample output from the show call admission statistics command:
Router# show call admission statisticsTotal Call admission charges: 0, limit 25Total calls rejected 12, accepted 51Load metric: charge 0, unscaled 0Table 79 describes the significant fields shown in the display.
Related Commands
show class-map type inspect
To display Layer 3 and Layer 4 or Layer 7 (application-specific) inspect type class maps and their matching criteria, use the show class-map type inspect command in privileged EXEC mode.
show class-map type inspect [protocol-name] [class-map-name]
Syntax Description
Command Default
Information for all inspect type class maps is displayed.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show class-map type inspect command to display class maps for a particular inspect type class map.
Examples
The following is sample output from the show class-map type inspect command with all class maps:
Router# show class-map type inspectClass Map type inspect match-all classe0 (id 7)Match access-group 34Class Map type inspect match-all c1 (id 5)Match access-group 101Match protocol httpClass Map type inspect match-all class1 (id 1)Match noneThe following is sample output from the show class-map type inspect with the class map classe0 specified:
Router# show class-map type inspect classe0Class Map type inspect match-all classe0 (id 7)Match access-group 34Table 80 describes the significant fields shown in the display.
Related Commands
show class-map type port-filter
Displays port-filter class maps and their matching criteria.
show class-map type urlfilter
To display URL filter class maps and their matching criteria, use the show class-map type urlfilter command in privileged EXEC mode.
show class-map type urlfilter [trend | n2h2 | websense] [class-map-name]
Syntax Description
Command Default
Information for all local URL filter class maps is displayed.
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XZ
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
Use the show class-map type urlfilter command to display all local URL filter class maps and their matching criteria. To display class maps for a particular URL filtering server type—Trend Micro, SmartFilter or Websense—include the appropriate keyword. To display the matching criteria for a particular class map, specify the class map name.
Examples
The following is sample output from the show class-map type urlfilter command when three local URL filtering class maps have been configured:
Router# show class-map type urlfilterClass Map type urlfilter match-any untrusted-domain-class (id 1)Match server-domain urlf-glob untrusted-domain-paramClass Map type urlfilter match-any trusted-domain-class (id 2)Match server-domain urlf-glob trusted-domain-paramClass Map type urlfilter match-any keyword-class (id 4)Match url-keyword urlf-glob keyword-paramThe following is sample output from the show class-map type urlfilter trend command when one Trend Micro URL filtering class map has been configured:
Router# show class-map type urlfilter trendClass Map type urlfilter trend match-any drop-category (id 3)Match url category Adult-Mature-ContentMatch url category GamblingMatch url category Personals-DatingThe following is sample output from the show class-map type urlfilter websense command:
Router# show class-map type urlfilter websenseClass Map type urlfilter websense match-any websense-map (id 5)Match server-response anyTable 81 describes the significant fields shown in the display.
