-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa nas Cisco-nas-port-use-async-info through alert-severity
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through issuer-name
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type inspect through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through tms-class
-
traffic-export through zone security
-
Table Of Contents
show parameter-map type inspect
show parameter-map type protocol-info
show parameter-map type trend-global
show parameter-map type urlf-glob
show parameter-map type urlfilter
show parameter-map type urlfpolicy
show platform hardware qfp act feature ipsec datapath memory
show platform software ipsec f0 encryption-processor registers
show policy-map type inspect urlfilter
show policy-map type inspect zone-pair
show policy-map type inspect zone-pair urlfilter
show private-hosts access-lists
show private-hosts configuration
show private-hosts interface configuration
show radius local-server statistics
show redundancy linecard-group
show tcp intercept connections
show parameter-map type inspect
To display user-configured or default inspect type parameter maps, use the show parameter-map type inspect command in privileged EXEC mode.
show parameter-map type inspect [default]
Syntax Description
default
(Optional) Displays the default inspect type parameter map values.
Note
Use this keyword when a parameter map is not specified with the inspect action.
Command Modes
Privileged EXEC
Command History
Examples
The following example shows sample output from the show parameter-map type inspect command:
Router# show parameter-map type inspectparameter-map type inspect abcaudit-trail onalert onmax-incomplete low 400max-incomplete high 500one-minute low 400one-minute high 500udp idle-time 30icmp idle-time 10dns-timeout 5tcp idle-time 3600tcp finwait-time 5tcp synwait-time 30tcp max-incomplete host 50 block-time 0The following example shows sample output with the default keyword issued:
Router# show parameter-map type inspect defaultparameter-map type inspect default valuesaudit-trail offalert onmax-incomplete low 400max-incomplete high 500one-minute low 400one-minute high 500udp idle-time 30icmp idle-time 10dns-timeout 5tcp idle-time 3600tcp finwait-time 5tcp synwait-time 30tcp max-incomplete host 50 block-time 0show parameter-map type protocol-info
To display details of an instant messenger (IM) protocol-specific parameter map, use the show parameter-map type protocol-info command in privileged EXEC mode.
show parameter-map type protocol-info [parameter-map-name [dns-cache] | dns-cache zone-pair zone-pair]
Syntax Description
Command Modes
Privileged EXEC
Command History
Examples
The following example shows how to enable the show parameter-map type protocol-info command:
Router# show parameter-map type protocol-info
show parameter-map type trend-global
To display the parameter map for the global parameters for a Trend Micro URL filtering policy, use the show parameter-map type trend-global command in privileged EXEC mode.
show parameter-map type trend-global [parameter-map-name] [default]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XZ
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
Use the show parameter-map type trend-global command to display the global parameters for Trend Micro URL filtering policies.
Examples
The following is sample output from the show parameter-map type trend-global default command:
Router# show parameter-map type trend-global defaultparameter-map type trend-global default valuesserver trps.trendmicro.com http-port 80 https-port 443 retrans 3 timeout 60alert oncache-size 256 KBcache-lifetime 24The following is sample output from the show parameter-map type trend-global command when the server name and maximum cache size have been specified in the parameter map Global-Parameters:
Router# show parameter-map type trend-global Global-Parametersparameter-map type trend-global Global-Parametersserver trps1.example.com http-port 80 https-port 443 retrans 3 timeout 60alert oncache-size 300 KBcache-lifetime 24Related Commands
show parameter-map type urlfpolicy
Displays the parameters for a URL filtering policy.
show parameter-map type urlf-glob
To display the parameter maps for local URL filtering, use the show parameter-map type urlf-glob command in privileged EXEC mode.
show parameter-map type urlf-glob [parameter-map-name]
Syntax Description
Command Default
The parameter maps for all local URL filtering policies are displayed.
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XZ
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
Use the show parameter-map type urlf-glob command to display the parameter maps for local URL filtering policies.
Examples
The following is sample output from the show parameter-map type urlf-glob command when two parameter maps for local URL filtering have been configured:
Router# show parameter-map type urlf-globparameter-map type urlf-glob trusted-domain-parampattern www.example.compattern *.example1.comparameter-map type urlf-glob untrusted-domain-parampattern www.example3.compattern *.example4.comRelated Commands
show parameter-map type urlfilter
Note
To display user-configured or default URL filter type parameter maps, use the show parameter-map type urlfilter command in privileged EXEC mode.
show parameter-map type urlfilter [default]
Syntax Description
default
(Optional) Displays the default urlfilter parameter map values.
Note
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example shows sample output from the show parameter-map type urlfilter command:
Router# show parameter-map type urlfilterparameter-map type urlfilter default valuesurlf-server-log offaudit-trail offalert onmax-request 1000max-resp-pak 200source-interface defaultallow-mode offcache 5000The following example shows sample output from the show parameter-map type urlfilter default command:
Router# show parameter-map type urlfilter defaultparameter-map type urlfilter default valuesurlf-server-log offaudit-trail offalert onmax-request 1000max-resp-pak 200source-interface defaultallow-mode offcache 5000
show parameter-map type urlfpolicy
To display the parameter maps associated with a URL filtering policy, use the show parameter-map type urlfpolicy command in privileged EXEC mode.
show parameter-map type urlfpolicy {local | trend | n2h2 | websense}
[parameter-map-name] [default]Syntax Description
Command Default
The parameter maps for all URL filtering policies of the type specified (local, trend, n2h2, or websense) are displayed.
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XZ
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Examples
The following example shows the default values for a Websense URL filtering policy:
Router# show parameter-map type urlfpolicy websense defaultparameter-map type urlfilter websense default valuesurlf-server-log offaudit-trail offalert onmax-request 1000max-resp-pak 200source-interface defaultallow-mode offcache 5000show parser view
To display command-line interface (CLI) view information, use the show parser view command in privileged EXEC mode.
show parser view [all]
Syntax Description
Command Modes
Privileged EXEC
Command History
12.3(7)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
The show parser view command will display information only about the view that the user is currently in. This command is available for both root view users and lawful intercept view users—except for the all keyword, which is available only to root view users. However, the all keyword can be configured by a user in root view to be available for users in lawful intercept view.
The show parser view command cannot be excluded from any view.
Examples
The following example shows how to display information from the root view and the CLI view "first":
Router# enable viewRouter#01:08:16:%PARSER-6-VIEW_SWITCH:successfully set to view 'root'.Router#! Enable the show parser view command from the root viewRouter# show parser viewCurrent view is 'root'! Enable the show parser view command from the root view to display all viewsRouter# show parser view allViews Present in System:View Name: firstView Name: second! Switch to the CLI view "first."Router# enable view firstRouter#01:08:09:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.! Enable the show parser view command from the CLI view "first."Router# show parser viewCurrent view is 'first'Related Commands
show platform hardware qfp act feature ipsec datapath memory
To display debugging information about the consumption of IPsec datapath memory, use the show platform hardware qfp act feature ipsec datapath memory command in privileged EXEC or diagnostic mode.
show platform hardware qfp act feature ipsec datapath memory
Command Default
No default behavior or values
Command Modes
Privileged EXEC (#)
Diagnostic (diag)
Command History
Cisco IOS XE Release 2.4.2
This command was introduced on the Cisco ASR 1000 Series Routers.
Usage Guidelines
This command displays the consumption of dynamic random access memory (DRAM) on the IPSec Cisco QuantumFlow Processor (QFP) datapath.
show platform hardware qfp act feature ipsec datapath memorypstate chunk totalfree: 80000, allocated: 0Related Commands
show platform software ipsec f0 encryption-processor registers
Displays dubugging information about the crypto engine processor registers.
show platform software ipsec f0 encryption-processor registers
To display debugging information about the crypto engine processor registers, use the show platform software ipsec f0 encryption-processor registers command in privileged EXEC or diagnostic mode.
show platform software ipsec f0 encryption-processor registers
Command Default
No default behavior or values
Command Modes
Privileged EXEC (#)
Diagnostic (diag)
Command History
Cisco IOS XE Release 2.4.2
This command was introduced on the Cisco ASR 1000 Series Routers.
Usage Guidelines
This command displays debugging information for crypto engine processor registers.
show platform software ipsec f0 encryption-processor registersForwarding Manager Encryption-processor Registersreg_addr : 00000000, reg_val : 0000ca5breg_addr : 00000008, reg_val : 00000000reg_addr : 00000010, reg_val : 00000000reg_addr : 00000018, reg_val : 22f10038reg_addr : 00000020, reg_val : 00000800reg_addr : 00000028, reg_val : 00002040reg_addr : 00000030, reg_val : 00000000reg_addr : 00000038, reg_val : 23158838Related Commands
show platform hardware qfp act feature ipsec datapath memory
Displays debugging information about the consumption of IPsec datapath memory.
show policy-map type inspect
To display a specified policy map, use the show policy-map type inspect command in privileged EXEC mode.
show policy-map type inspect [policy-map-name] [class class-map-name]
Syntax Description
policy-map-name
(Optional) Name of the policy map.
class class-map-name
(Optional) Name of the class map.
Command Default
If a policy-map name is not specified, all Level 7 policy maps are displayed.
Command Modes
Privileged EXEC
Command History
Examples
The following example displays the policy map for policy map p1:
Router # show policy-map type inspect p1Policy Map type inspect p1Class c1InspectThe following example shows sample command output:
Router# show policy-map type inspect p_insidePolicy Map type inspect p_insideDescription: Policy map with inspect actionClass c_permitPassClass c_testClass class-defaultTable 143 describes the significant fields shown in the display.
show policy-map type inspect urlfilter
To display the details of a URL filtering policy map, use the show policy-map type inspect urlfilter command in privileged EXEC mode.
show policy-map type inspect urlfilter [policy-map-name]
Syntax Description
Command Default
The details of all URL filtering policy maps are displayed.
Command Modes
Privileged EXEC (#)
Command History
12.4(15)XZ
This command was introduced.
12.4(20)T
This command was integrated into Cisco IOS Release 12.4(20)T.
Usage Guidelines
Use the show policy-map type inspect urlfilter command to display the details of all URL filtering policy maps. To display the details of a particular URL filtering policy map, specify the name of the policy map.
Examples
The following is sample output from the show policy-map type inspect urlfilter command for a policy map named websense-policy:
Router# show policy-map type inspect urlfilter websense-policypolicy-map type inspect urlfilter url-websense-policyparameter-map urlfpolicy websense websense-parameter-mapclass type urlfilter trusted-domain-listsallowclass type urlfilter untrusted-domain-listsresetclass type urlfilter block-url-keyword-listsresetclass type urlfilter websense websense-mapserver-specified-actionshow policy-map type inspect zone-pair
To display the runtime inspect type policy map statistics and other information such as sessions existing on a specified zone pair, use the show policy-map type inspect zone-pair command in privileged EXEC mode.
show policy-map type inspect zone-pair [zone-pair-name] [sessions]
Syntax Description
Command Default
Information about policy maps for all zone pairs is displayed.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If you do not specify a zone-pair name (via the zone-pair-name argument), the policy maps on all zone pairs are displayed.
When packets are matched to an access group (match access-group), protocol (match protocol) or class map (match class-map), a traffic rate is generated for these packets. In a zone-based firewall policy, only the first packet that creates a session matches the policy. Subsequent packets in this flow do not match the filters in the configured policy, but instead match the session directly. The statistics related to subsequent packets are shown as part of the 'inspect' action. This information is shown when using the show policy-map type inspect zone-pair sessions command.
Command Limitations
The cumulative counters in the show policy-map type inspect zone-pair command output do not increment for match statements in a nested class-map configuration in Cisco IOS Releases 12.4(20)T and 12.4(15)T. The problem with the counters exists regardless of whether the top level class-map uses the match-any or match-all keywords.
The following configuration example causes the match counter problem in the show policy-map type inspect zone-pair command output:
class-map type inspect match-any ymatch protocol tcpmatch protocol icmpclass-map type inspect match-all xmatch class yHowever, cumulative counters for the above configuration is displayed in the show policy-map type inspect zone-pair command output if the class-map matches any class-map:
#show policy-map type inspect zone sessionpolicy exists on zp zpZone-pair: zpService-policy inspect : fwClass-map: x (match-any)Match: class-map match-any y2 packets, 48 bytes <======== Cumulative class map counters are incrementing.30 second rate 0 bpsMatch: protocol tcp0 packets, 0 bytes <===== The match for the protocol is not incrementing.30 second rate 0 bpsMatch: protocol icmp0 packets, 0 bytes30 second rate 0 bpsInspectNumber of Established Sessions = 1Established SessionsSession 53105C0 (1.1.1.2:19180)=>(2.1.1.2:23) tacacs:tcp SIS_OPENCreated 00:00:02, Last heard 00:00:02Bytes sent (initiator:responder) [30:69]Class-map: class-default (match-any)Match: anyDrop0 packets, 0 bytesExamples
The following example shows sample output when a zone pair name is specified:
Router# show policy-map type inspect zone-pair zpZone-pair: zpService-policy : p1Class-map: c1 (match-all)Match: protocol tcpInspectSession creations since subsystem startup or last reset 0Current session counts (estab/half-open/terminating) [0:0:0]Maxever session counts (estab/half-open/terminating) [0:0:0]Last session created neverLast statistic reset neverLast session creation rate 0half-open session total 0Class-map: c2 (match-all)Match: protocol udpPass0 packets, 0 bytesClass-map: class-default (match-any)Match: anyDrop0 packets, 0 bytesThe following example shows sample output when the sessions keyword is specified:
Note
Router# show policy-map type inspect zone-pair sessionsZone-pair: zp_insideService-policy inspect : p_insideClass-map: c_permit (match-all)Match: access-group 110Pass0 packets, 0 bytesClass-map: c_test (match-any)Match: protocol ftp7 packets, 196 bytes30 second rate 0 bpsInspectEstablished SessionsSession 663D2098 (192.168.5.1:59391)=>(192.168.105.1:1024) ftpSIS_OPENCreated 00:00:40, Last heard 00:00:00Bytes sent (initiator:responder) [71:475]Session 663D1B48 (192.168.5.1:59393)=>(192.168.105.1:1026) ftpSIS_OPENCreated 00:00:35, Last heard 00:00:00Bytes sent (initiator:responder) [71:414]Session 663D18A0 (192.168.105.1:20)=>(192.168.5.1:59395)ftp-data SIS_OPENCreated 00:00:00, Last heard 00:00:00Bytes sent (initiator:responder) [319488:0]Session 663D15F8 (192.168.105.1:41789)=>(192.168.5.1:59396)ftp-data SIS_OPENCreated 00:00:00, Last heard 00:00:00Bytes sent (initiator:responder) [322004:0]Session 663D1DF0 (192.168.5.1:59392)=>(192.168.105.1:1025) ftpSIS_OPENCreated 00:00:39, Last heard 00:00:01Bytes sent (initiator:responder) [71:475]Session 663D2340 (192.168.5.1:59390)=>(192.168.105.1:21) ftpSIS_OPENCreated 00:00:44, Last heard 00:00:01Bytes sent (initiator:responder) [71:221]Session 663D10A8 (192.168.105.1:41791)=>(192.168.5.1:59398)ftp-data SIS_OPENCreated 00:00:01, Last heard 00:00:00Bytes sent (initiator:responder) [195312:0]Session 663D1350 (192.168.105.1:41790)=>(192.168.5.1:59397)ftp-data SIS_OPENCreated 00:00:01, Last heard 00:00:00Bytes sent (initiator:responder) [240408:0]Class-map: class-default (match-any)Match: anyDrop (default action)4 packets, 104 bytesZone-pair: zp_outsideService-policy inspect : p_outsideClass-map: c_permit (match-all)Match: access-group 110Pass2 packets, 128 bytesClass-map: class-default (match-any)Match: anyDrop (default action)0 packets, 0 bytesThe following example is sample output from the show policy-map type inspect zone-pair command, which can now be used to verify the police action configuration:
Router# show policy-map type inspect zone-pairZone-pair: zpService-policy inspect : test-udpClass-map: check-udp (match-all)Match: protocol udpInspectPacket inspection statistics [process switch:fast switch]udp packets: [3:4454]Session creations since subsystem startup or last reset 92Current session counts (estab/half-open/terminating) [5:33:0]Maxever session counts (estab/half-open/terminating) [5:59:0]Last session created 00:00:06Last statistic reset neverLast session creation rate 61Last half-open session total 33Policerate 8000 bps,1000 limitconformed 2327 packets, 139620 bytes; actions: transmitexceeded 36601 packets, 2196060 bytes; actions: dropconformed 6000 bps, exceed 61000 bpsClass-map: class-default (match-any)Match: anyDrop (default action)0 packets, 0 bytesshow policy-map type inspect zone-pair urlfilter
To display the details of a URL filtering policy map—URL filter state, URL filter statistics, and URL filter server details—use the show policy-map type inspect zone-pair urlfilter command in privileged EXEC mode.
show policy-map type inspect zone-pair [zone-pair-name] urlfilter cache [detail]
Syntax Description
Command Default
The URL filter information for all zone pairs is displayed. Details about the URL filtering cache are not displayed.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example shows sample output for a Websense URL filtering server:
Router# show policy-map type inspect zone-pair urlfilter cacheZone-pair: zpUrlfilterWebsense URL Filtering is ENABLEDWebsense Primary server: 10.3.3.3(port : 15868)recount: 0Current packet buffer count(in use): 0Current cache entry count: 0Maxever request count: 0Maxever packet buffer count: 0Maxever cache entry count: 0Total requests sent to URL Filter Server :0Total responses received from URL Filter Server :0Total requests allowed: 0Total requests blocked: 0Drop (default action)packets, 0 bytesService-policy inspect : testClass-map: test (match-all)Match: protocol httpClass-map: class-default (match-any)Match: anyThe following example shows sample output for a Trend Micro URL filtering server, including the cache details:
Router# show policy-map type inspect zone-pair urlfilter cache detailpolicy exists on zp zp_inZone-pair: zp_inService-policy inspect : trend-global-policyClass-map: http-class (match-all)Match: protocol httpMatch: access-group 101InspectPacket inspection statistics [process switch:fast switch]tcp packets: [3353:0]Session creations since subsystem startup or last reset 21Current session counts (estab/half-open/terminating) [3:0:0]Maxever session counts (estab/half-open/terminating) [4:1:1]Last session created 00:00:22Last statistic reset neverLast session creation rate 7Maxever session creation rate 14Last half-open session total 0Maximum number of bytes in cache: 131072000Time to live for eache cache entry (in hrs): 1Total number of bytes used by cache: 442Number of bytes used by domain type cache: 442Number of bytes used by directory type cache: 0------------------------------------------------------------URL Age Access #/ Cat::Rep(Directory cache end with /) (day:h:m:s) Idle Time------------------------------------------------------------example.com 0:00:00:23 28 58::100example1.com 0:00:00:25 1 56::100example.example2.com 0:00:00:34 1 56::100Class-map: class-default (match-any)Match: anyDrop0 packets, 0 bytespolicy exists on zp zp_outZone-pair: zp_outService-policy inspect : icmp_permitClass-map: icmp_permit (match-all)Match: access-group 110Pass0 packets, 0 bytesClass-map: class-default (match-any)Match: anyDrop0 packets, 0 bytesshow port-security
To display information about the port-security setting in EXEC command mode, use the show port-security command.
show port-security [interface interface interface-number]
show port-security [interface interface interface-number] {address | vlan}
Syntax Description
Defaults
This command has no default settings.
Command Modes
EXEC
Command History
Usage Guidelines
The vlan keyword is supported on trunk ports only and displays per-Vlan maximums set on a trunk port.
The interface-number argument designates the module and port number. Valid values for interface-number depend on the specified interface type and the chassis and module that are used. For example, if you specify a Gigabit Ethernet interface and have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the module number are from 1 to 13 and valid values for the port number are from 1 to 48.
Examples
This example shows the output from the show port-security command when you do not enter any options:
Router# show port-securitySecure Port MaxSecureAddr CurrentAddr SecurityViolation SecurityAction(Count) (Count) (Count)----------------------------------------------------------------------------Fa5/1 11 11 0 ShutdownFa5/5 15 5 0 RestrictFa5/11 5 4 0 Protect----------------------------------------------------------------------------Total Addresses in System: 21Max Addresses limit in System: 128Router#This example shows how to display port-security information for a specified interface:
Router# show port-security interface fastethernet 5/1Port Security: EnabledPort status: SecureUpViolation mode: ShutdownMaximum MAC Addresses: 11Total MAC Addresses: 11Configured MAC Addresses: 3Aging time: 20 minsAging type: InactivitySecureStatic address aging: EnabledSecurity Violation count: 0Router#This example show how to display all the secure MAC addresses that are configured on all the switch interfaces or on a specified interface with aging information for each address:
Router# show port-security addressDefault maximum: 10VLAN Maximum Current1 5 32 4 43 6 4Router#Related Commands
clear port-security
Deletes configured secure MAC addresses and sticky MAC addresses from the MAC address table.
show ppp queues
To monitor the number of requests processed by each authentication, authorization, and accounting (AAA) background process, use the show ppp queues command in privileged EXEC mode.
show ppp queues
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show ppp queues command to display the number of requests handled by each AAA background process, the average amount of time it takes to complete each request, and the requests still pending in the work queue. This information can help you balance the data load between the network access server and the AAA server.
This command displays information about the background processes configured by the aaa processes global configuration command. Each line in the display contains information about one of the background processes. If there are AAA requests in the queue when you enter this command, the requests will be printed as well as the background process data.
Examples
The following example shows output from the show ppp queues command:
Router# show ppp queuesProc #0 pid=73 authens=59 avg. rtt=118s. authors=160 avg. rtt=94s.Proc #1 pid=74 authens=52 avg. rtt=119s. authors=127 avg. rtt=115s.Proc #2 pid=75 authens=69 avg. rtt=130s. authors=80 avg. rtt=122s.Proc #3 pid=76 authens=44 avg. rtt=114s. authors=55 avg. rtt=106s.Proc #4 pid=77 authens=70 avg. rtt=141s. authors=76 avg. rtt=118s.Proc #5 pid=78 authens=64 avg. rtt=131s. authors=97 avg. rtt=113s.Proc #6 pid=79 authens=56 avg. rtt=121s. authors=57 avg. rtt=117s.Proc #7 pid=80 authens=43 avg. rtt=126s. authors=54 avg. rtt=105s.Proc #8 pid=81 authens=139 avg. rtt=141s. authors=120 avg. rtt=122s.Proc #9 pid=82 authens=63 avg. rtt=128s. authors=199 avg. rtt=80s.queue len=0 max len=499Table 144 describes the fields shown in the example.
Related Commands
aaa processes
Allocates a specific number of background processes to be used to process AAA authentication and authorization requests for PPP.
show private-hosts access-lists
To display the access lists for your Private Hosts configuration, use the show private-hosts access-lists command in privileged EXEC mode.
show private-hosts access-lists
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.2(33)SRB
This command was introduced.
12.2(33)SXH
This command was integrated into Cisco IOS Release 12.2(33)SXH.
Examples
The following example shows how to display the Private Hosts access lists for your configuration:
Router# show private-hosts access-listsPromiscuous ACLsAction Permit Sequence # 010Source:0000.1111.4001 0000.0000.0000 Destination:0000.0000.0000 ffff.ffff.ffffAction Deny Sequence # 020Source:0000.0000.0000 ffff.ffff.ffff Destination:0000.0000.0000 ffff.ffff.ffffIsolated ACLsAction Deny Sequence # 010Source:0000.1111.4001 0000.0000.0000 Destination:0000.0000.0000 ffff.ffff.ffffAction Permit Sequence # 020Source:0000.0000.0000 ffff.ffff.ffff Destination:0000.1111.4001 0000.0000.0000 Action Redirect Sequence # 030 Redirect index 6Source:0000.0000.0000 ffff.ffff.ffff Destination:ffff.ffff.ffff 0000.0000.0000Action Permit Sequence # 040Source:0000.0000.0000 ffff.ffff.ffff Destination:0100.5e00.0000 0000.007f.ffffSource:0000.0000.0000 ffff.ffff.ffff Destination:3333.0000.0000 0000.ffff.ffffAction Deny Sequence # 050Source:0000.0000.0000 ffff.ffff.ffff Destination:0000.0000.0000 ffff.ffff.ffffMixed ACLsAction Permit Sequence # 010Source:0000.1111.4001 0000.0000.0000 Destination:ffff.ffff.ffff 0000.0000.0000 Action Redirect Sequence # 020 Redirect index 6Source:0000.0000.0000 ffff.ffff.ffff Destination:ffff.ffff.ffff 0000.0000.0000Action Permit Sequence # 030Source:0000.1111.4001 0000.0000.0000 Destination:0000.0000.0000 ffff.ffff.ffffAction Permit Sequence # 040Source:0000.0000.0000 ffff.ffff.ffff Destination:0000.1111.4001 0000.0000.0000Action Deny Sequence # 050Source:0000.0000.0000 ffff.ffff.ffff Destination:0000.0000.0000 ffff.ffff.ffffRelated Commands
show private-hosts configuration
To display information about the Private Hosts configuration on the router, use the show private-hosts configuration command in privileged EXEC mode.
show private-hosts configuration
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.2(33)SRB
This command was introduced.
12.2(33)SXH
This command was integrated into Cisco IOS Release 12.2(33)SXH.
Examples
The following example shows sample command output:
Router# show private-hosts configurationPrivate hosts enabled. BR INDEX 6 State 0000000FPrivated hosts vlans lists:200Privated promiscuous MAC configuration:A '*' mark behind the mac list indicates non-existent mac-list--------------------------------------------------------------------------------MAC-list VLAN list--------------------------------------------------------------------------------bras-list *** Uses the isolated vlans (if any) ***The following example shows sample command output:
Router# show private-hosts configurationPrivate-hosts enabledIsolated vlan-list 10,12,15,200-300Promiscuous MAC configuration:------------------------------------------------------------------------------------MAC-List VLAN List-----------------------------------------------------------------------------------Bras_list 10,12,15,200-300Mcast_server_list 10,12,15Router#Related Commands
show private-hosts interface configuration
To display information about the Private Hosts configuration on individual interfaces (ports), use the show private-hosts interface configuration command in privileged EXEC mode.
show private-hosts interface configuration
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.2(33)SRB
This command was introduced.
12.2(33)SXH
This command was integrated in Cisco IOS Release 12.2(33)SXH.
Examples
The following example shows sample command output:
Router# show private-hosts interface configurationPrivate hosts enabledDebug Events: 0 Acl: 0 API: 0Promiscuous interface list--------------------------GigabitEthernet1/1 promiscuous connected Facing BRAS JupiterIsolated interface list-------------------------FastEthernet3/1-14 isolated connected Facing DSLAM AB-125-1Mixed mode interface list--------------------------GigabitEthernet1/4-5 mixed connected Facing Server MarsRouter#Related Commands
show private-hosts mac-list
To display the contents of the MAC address lists defined for Private Hosts, use the show private-hosts mac-list command in privileged EXEC mode.
show private-hosts mac-list [list-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.2(33)SRB
This command was introduced.
12.2(33)SXH
This command was integrated into Cisco IOS Release 12.2(33)SXH.
Examples
The following example shows sample command output:
Router# show private-hosts mac-listMAC-List: bras-list------------------------------------------------------------------MAC address Description------------------------------------------------------------------0000.1111.1111 BRAS-SERVERRelated Commands
private-hosts mac-list
Creates a MAC address list that identifies a content server that is being used to provide broadband services to isolated hosts.
show privilege
To display your current level of privilege, use the show privilege command in EXEC mode.
show privilege
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following example shows sample output from the show privilege command. The current privilege level is 15.
Router# show privilegeCurrent privilege level is 15Related Commands
enable password
Sets a local password to control access to various privilege levels.
enable secret
Specifies an additional layer of security over the enable password command.
show radius local-server statistics
To display the statistics for the local authentication server, use the show radius local-server statistics command in privileged EXEC mode.
show radius local-server statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following output displays statistics for the local authentication server.
Router# show radius local-server statisticsSuccesses : 11262 Unknown usernames : 0Client blocks : 0 Invalid passwords : 8Unknown NAS : 0 Invalid packet from NAS: 0NAS : 10.0.0.1Successes : 11262 Unknown usernames : 0Client blocks : 0 Invalid passwords : 8Corrupted packet : 0 Unknown RADIUS message : 0No username attribute : 0 Missing auth attribute : 0Shared key mismatch : 0 Invalid state attribute: 0Unknown EAP message : 0 Unknown EAP auth type : 0PAC refresh : 0 Invalid PAC received : 0Maximum number of configurable users: 50, current user count: 11Username Successes Failures Blocksvayu-ap-1 2235 0 0vayu-ap-2 2235 0 0vayu-ap-3 2246 0 0vayu-ap-4 2247 0 0vayu-ap-5 2247 0 0vayu-11 3 0 0vayu-12 5 0 0vayu-13 5 0 0vayu-14 30 0 0vayu-15 3 0 0scm-test 1 8 0The first section of statistics lists cumulative statistics from the local authenticator.
The second section lists statistics for each access point (NAS) authorized to use the local authenticator. The EAP-FAST statistics in this section include the following:
•
•
•
•
The third section lists stats for individual users. If a user is blocked and the lockout time is set to infinite, blocked appears at the end of the stat line for that user. If the lockout time is not infinite, Unblocked in x seconds appears at the end of the stat line for that user.
Use the clear radius local-server statistics command in privileged EXEC mode to reset local authenticator statistics to zero.
Related Commands
show radius server-group
To display properties for the RADIUS server group, use the show radius server-group command in user EXEC or privileged EXEC mode.
show radius server-group {server-group-name | all | 123}
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
12.2(2)T
This command was introduced.
12.2(33)SRA
The server argument was introduced.
Usage Guidelines
Use the show radius server-group command to display the server groups that you defined by using the aaa group server radius command.
Examples
The following show radius server-group command output displays properties for the server group "rad_sg":
Router# show radius server-group rad_sgserver group rad-sgSharecount = 1 sg_unconfigured = FALSEType = standard Memlocks = 1The following show radius server-group command output displays the properties for two server groups, 123 and 456, respectively. Using the aaa group server radius command, the configuration of each server group is also shown.
Router(config)# aaa new-model!!Router(config)# aaa group server radius 123server 10.9.8.1 auth-port 1645 acct-port 1646!Router(config)# aaa group server radius 456server 10.9.8.2 auth-port 1645 acct-port 1646Router(config)# exitRouter# show radius server-group allServer group 123Sharecount = 1 sg_unconfigured = FALSEType = standardServer group 456Sharecount = 1 sg_unconfigured = FALSEType = standardRouter# show radius server-group 123Server group 123Sharecount = 1 sg_unconfigured = FALSEType = standardTable 145 describes the significant fields shown in the display.
Related Commands
show radius statistics
To display the RADIUS statistics for accounting and authentication packets, use the show radius statistics command in EXEC mode.
show radius statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example is sample output for the show radius statistics command:
Router# show radius statisticsAuth. Acct. BothMaximum inQ length: NA NA 1Maximum waitQ length: NA NA 2Maximum doneQ length: NA NA 1Total responses seen: 33 67 100Packets with responses: 33 67 100Packets without responses: 0 0 0Access Rejects : 0Average response delay(ms) : 1331 124 523Maximum response delay(ms): 5720 4800 5720Number of Radius timeouts: 8 2 10Duplicate ID detects: 0 0 0Buffer Allocation Failures: 0 0 0Maximum Buffer Size (bytes): 156 327 327Malformed Responses : 0 0 0Bad Authenticators : 0 0 0Source Port Range: (2 ports only)1645 - 1646Last used Source Port/Identifier:1645/331646/69Table 146 describes significant fields shown in the display.
Related Commands
show radius table attributes
To display a list of all attributes supported by the RADIUS subsystem, use the show radius table attributes command in user EXEC or privileged EXEC mode.
show radius table attributes
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
This command enables you to verify that a required RADIUS attribute is supported in a specific release.
Examples
The following example displays the complete table attribute list from the show radius table attributes command.
Router# show radius table attributesIETF ATTRIBUTE LIST:Name User-Name Format StringName User-Password Format BinaryName CHAP-Password Format BinaryName NAS-IP-Address Format IPv4 AddressName NAS-Port Format UlongName Service-Type Format EnumName Framed-Protocol Format EnumName Framed-IP-Address Format IPv4 AddressName Framed-IP-Netmask Format IPv4 AddressName Framed-Routing Format UlongName Filter-Id Format BinaryName Framed-MTU Format UlongName Framed-Compression Format EnumName login-ip-addr-host Format IPv4 AddressName Login-Service Format EnumName login-tcp-port Format UlongName Reply-Message Format BinaryName Callback-Number Format StringName Framed-Route Format StringName Framed-IPX-Network Format IPv4 AddressName State Format BinaryName Class Format BinaryName Vendor-Specific Format BinaryName Session-Timeout Format UlongName Idle-Timeout Format UlongName Termination-Action Format BooleanName Called-Station-Id Format StringName Calling-Station-Id Format StringName Nas-Identifier Format StringName Acct-Status-Type Format EnumName Acct-Delay-Time Format UlongName Acct-Input-Octets Format UlongName Acct-Output-Octets Format UlongName Acct-Session-Id Format StringName Acct-Authentic Format EnumName Acct-Session-Time Format UlongName Acct-Input-Packets Format UlongName Acct-Output-Packets Format UlongName Acct-Terminate-Cause Format EnumName Multilink-Session-ID Format StringName Acct-Link-Count Format UlongName Acct-Input-Giga-Words Format UlongName Acct-Output-Giga-Words Format UlongName Event-Timestamp Format UlongName CHAP-Challenge Format BinaryName NAS-Port-Type Format EnumName Port-Limit Format UlongName Tunnel-Type Format EnumName Tunnel-Medium-Type Format EnumName Tunnel-Client-Endpoint Format StringName Tunnel-Server-Endpoint Format StringName Acct-Tunnel-Connection Format StringName Tunnel-Password Format BinaryName Prompt Format EnumName Connect-Info Format StringName EAP-Message Format BinaryName Message-Authenticator Format BinaryName Tunnel-Private-Group-Id Format StringName Tunnel-Assignment-Id Format StringName Tunnel-Preference Format UlongName Acct-Interim-Interval Format UlongName Tunnel-Packets-Lost Format UlongName NAS-Port-Id Format StringName Tunnel-Client-Auth-ID Format StringName Tunnel-Server-Auth-ID Format StringName Framed-Interface-Id Format BinaryName Framed-IPv6-Prefix Format BinaryName login-ip-addr-host Format BinaryName Framed-IPv6-Route Format StringName Framed-IPv6-Pool Format StringName Dynamic-Author-Error-Cause Format EnumNon Standard ATTRIBUTE LIST:Name Old-Password Format BinaryName Ascend-Filter-Required Format EnumName Ascend-Cache-Refresh Format EnumName Ascend-Cache-Time Format UlongName Ascend-Auth-Type Format UlongName Ascend-Redirect-Number Format StringName Ascend-Private-Route Format StringName Ascend-Shared-Profile-Enable Format BooleanName Ascend-Client-Primary-DNS Format IPv4 AddressName Ascend-Client-Secondary-DNS Format IPv4 AddressName Ascend-Client-Assign-DNS Format UlongName Ascend-Session-Svr-Key Format StringName Ascend-Multicast-Rate-Limit Format UlongName Ascend-Multicast-Client Format UlongName Ascend-Multilink-Session-ID Format UlongName Ascend-Num-In-Multilink Format UlongName Ascend-Presession-Octets-In Format UlongName Ascend-Presession-Octets-Out Format UlongName Ascend-Presession-Packets-In Format UlongName Ascend-Presession-Packets-Out Format UlongName Ascend-Max-Time Format UlongName Ascend-Disconnect-Cause Format EnumName Ascend-Connection-Progress Format EnumName Ascend-Data-Rate Format UlongName Ascend-Presession-Time Format UlongName Ascend-Require-Auth Format UlongName Ascend-PW-Liftime Format UlongName Ascend-IP-Direct Format IPv4 AddressName Ascend-PPP-VJ-Slot-Comp Format BooleanName Ascend-Asyncmap Format UlongName Ascend-Send-Secret Format BinaryName ascend_pool_definition Format StringName Ascend-IP-Pool Format UlongName Ascend-Dial-Number Format StringName Ascend-Route-IP Format BooleanName Ascend-Send-Auth Format EnumName Ascend-Link-Compression Format EnumName Ascend-Target-Util Format UlongName Ascend-Max-Channels Format UlongName Ascend-Data-Filter Format BinaryName Ascend-Call-Filter Format BinaryName Ascend-Idle-Limit Format UlongName Ascend-Data-Service Format UlongName Ascend-Force-56 Format UlongName Ascend-Xmit-Rate Format UlongCisco VSA ATTRIBUTE LIST:Name Cisco AVpair Format StringName cisco-nas-port Format StringName fax_account_id_origin Format StringName fax_msg_id Format StringName fax_pages Format StringName fax_modem_time Format StringName fax_connect_speed Format StringName fax_mdn_address Format StringName fax_mdn_flag Format StringName fax_auth_status Format StringName email_server_address Format StringName email_server_ack_flag Format StringName gateway_id Format StringName call_type Format StringName port_used Format StringName abort_cause Format StringName h323-remote-address Format StringName Conf-Id Format StringName h323-setup-time Format StringName h323-call-origin Format StringName h323-call-type Format StringName h323-connect-time Format StringName h323-disconnect-time Format StringName h323-disconnect-cause Format StringName h323-voice-quality Format StringName h323-gw-id Format StringName Cisco AVpair Format BinaryName Cisco encrypted string vsa Format StringName Sub_Policy_In Format StringName Sub_Policy_Out Format StringName h323-credit-amount Format StringName h323-credit-time Format StringName h323-return-code Format StringName h323-prompt-id Format StringName h323-time-and-day Format StringName h323-redirect-number Format StringName h323-preferred-lang Format StringName h323-redirect-ip-address Format StringName h323-billing-model Format StringName h323-currency Format StringName ssg-account-info Format StringName ssg-service-info Format StringName ssg-command-code Format BinaryName ssg-control-info Format StringMicrosoft VSA ATTRIBUTE LIST:Name MS-CHAP-Response Format BinaryName MS-CHAP-ERROR Format BinaryName MS-CHAP-CPW-1 Format BinaryName MS-CHAP-CPW-2 Format BinaryName MS-CHAP-LM-Enc-PW Format BinaryName MS-CHAP-NT-Enc-PW Format BinaryName MS-MPPE-Enc-Policy Format BinaryName MS-MPPE-Enc-Type Format BinaryName MS-RAS-Vendor Format StringName MS-CHAP-DOMAIN Format StringName MSCHAP_Challenge Format BinaryName MS-CHAP-MPPE-Keys Format BinaryName MS-BAP-Usage Format BinaryName MS-Link-Util-Thresh Format BinaryName MS-Link-Drop-Time-Limit Format BinaryName MS-MPPE-Send-Key Format BinaryName MS-MPPE-Recv-Key Format BinaryName MS-RAS-Version Format StringName MS-Old-ARAP-Password Format BinaryName New-ARAP-Password Format BinaryName MS-ARAP-PW-Change-Reason Format BinaryName MS-Filter Format BinaryName MS-Acct-Auth-Type Format BinaryName MS-MPPE-EAP-Type Format BinaryName MS-CHAP-V2-Response Format BinaryName MS-CHAP-V2-Success Format StringName MS-CHAP-CPW-2 Format BinaryName MS-Primary-DNS Format IPv4 AddressName MS-Secondary-DNS Format IPv4 AddressName MS-1st-NBNS-Server Format IPv4 AddressName MS-2nd-NBNS-Server Format IPv4 AddressName MS-ARAP-Challenge Format Binary3GPP VSA ATTRIBUTE LIST:Name Charging-ID Format UlongName PDP Type Format EnumName Charging-Gateway-Address Format IPv4 AddressName GPRS-QoS-Profile Format StringName SGSN-Address Format IPv4 AddressName GGSN-Address Format IPv4 AddressName IMSI-MCC-MNC Format StringName GGSN-MCC-MNC Format StringName NSAPI Format StringName Session-Stop-Ind Format BinaryName Selection-Mode Format StringName Charging-Characteristics Format String3GPP2 VSA ATTRIBUTE LIST:Name cdma-reverse-tnl-spec Format UlongName cdma-diff-svc-class-opt Format UlongName cdma-container Format StringName cdma-ha-ip-addr Format IPv4 AddressName cdma-pcf-ip-addr Format IPv4 AddressName cdma-bs-msc-addr Format StringName cdma-user-id Format UlongName cdma-forward-mux Format UlongName cdma-reverse-mux Format UlongName cdma-forward-rate Format UlongName cdma-reverse-rate Format UlongName cdma-service-option Format UlongName cdma-forward-type Format UlongName cdma-reverse-type Format UlongName cdma-frame-size Format UlongName cdma-forward-rc Format UlongName cdma-reverse-rc Format UlongName cdma-ip-tech Format UlongName cdma-comp-flag Format EnumName cdma-reason-ind Format EnumName cdma-bad-frame-count Format UlongName cdma-num-active Format UlongName cdma-sdb-input-octets Format UlongName cdma-sdb-output-octets Format UlongName cdma-numsdb-input Format UlongName cdma-numsdb-output Format UlongName cdma-ip-qos Format UlongName cdma-airlink-qos Format UlongName cdma-rp-session-id Format UlongName cdma-hdlc-layer-bytes-in Format UlongName cdma-correlation-id Format StringName cdma-moip-inbound Format UlongName cdma-moip-outbound Format UlongName cdma-session-continue Format UlongName cdma-active-time Format UlongName cdma-frame-size Format UlongName cdma-esn Format StringName cdma-mn-ha-spi Format UlongName cdma-mn-ha-shared-key Format BinaryName cdma-sess-term-capability Format UlongName cdma-disconnect-reason Format UlongVerizon VSA ATTRIBUTE LIST:Name mip-key-data Format BinaryName aaa-authenticator Format BinaryName public-key-invalid Format BinaryTable 145 describes the significant fields shown in the display.
Related Commands
show radius
Displays information about the RADIUS servers that are configured in the system.
show redundancy linecard-group
To display the components of a Blade Failure Group, use the show redundancy linecard-group command in privileged EXEC mode.
show redundancy linecard-group group-id
Syntax Description
Defaults
No default behavior or values.
Command Modes
Privileged EXEC
Command History
12.2(18)SXE2
This command was introduced.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
Examples
The following example shows the components of a Blade Failure Group:
Router# show redundancy linecard-group 1Line Card Redundancy Group:1 Mode:feature-cardClass:load-sharingCards:Slot:3 Subslot:0Slot:5 Subslot:0Related Commands
show running-config
To display the contents of the current running configuration file or the configuration for a specific module, Layer 2 VLAN, class map, interface, map class, policy map, or virtual circuit (VC) class, use the show running-config command in user EXEC or privileged EXEC mode.
show running-config [options]
Syntax Description
Command Default
The default syntax, show running-config, displays the contents of the running configuration file, except commands configured with default parameters.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The show running-config command is technically a command alias (substitute or replacement syntax) of the more system:running-config command. Although more commands are recommended (due to their uniform structure across platforms and their expandable syntax), the show running-config command remains enabled to accommodate its widespread use, and to allow typing shortcuts such as show run.
The show running-config interface command is useful when there are multiple interfaces and you want to look at the configuration of a specific interface.
The linenum keyword causes line numbers to be displayed in the output. This option is useful for identifying a particular portion of a very large configuration.
You can enter additional output modifiers in the command syntax by including a pipe character (|) after the optional keyword. For example, show running-config interface serial 2/1 linenum | begin 3. To display output modifiers that are available for a keyword, enter | ? after the keyword.
Prior to Cisco IOS Release 12.2(33)SXH, show running-config command output omitted configuration commands set with default values. Effective with Release 12.2(33)SXH, the show running-config all command displays more complete configuration information, including default settings and values. For example, if the Cisco Discovery Protocol (abbreviated as CDP in the output) holdtime value is set to its default of 180:
•
•
If the Cisco Discovery Protocol holdtime is changed to a nondefault value (for example, 100), the output of the show running-config and show running-config all commands is the same; that is, the configured parameter is displayed.
Note
Cisco 7600 Series Router
In some cases, you might see a difference in the duplex mode that is displayed between the show interfaces command and the show running-config command. The duplex mode that is displayed in the show interfaces command is the actual duplex mode that the interface is running. The show interfaces command displays the operating mode for an interface, and the show running-config command displays the configured mode for an interface.
The show running-config command output for an interface might display the duplex mode but no configuration for the speed. This output indicates that the interface speed is configured as auto and that the duplex mode shown becomes the operational setting once the speed is configured to something other than auto. With this configuration, it is possible that the operating duplex mode for that interface does not match the duplex mode that is displayed with the show running-config command.
Examples
The following example shows the configuration for serial interface 1:
Router# show running-config interface serial 1Building configuration...Current configuration:!interface Serial1no ip addressno ip directed-broadcastno ip route-cacheno ip mroute-cacheshutdownendThe following example shows the configuration for Ethernet interface 0/0. Line numbers are displayed in the output.
Router# show running-config interface ethernet 0/0 linenumBuilding configuration...Current configuration : 104 bytes1 : !2 : interface Ethernet0/03 : ip address 10.4.2.63 255.255.255.04 : no ip route-cache5 : no ip mroute-cache6 : endThe following example shows how to set line numbers in the command output and then use the output modifier to start the display at line 10:
Router# show running-config linenum | begin 1010 : boot-start-marker11 : boot-end-marker12 : !13 : no logging buffered14 : enable password #####15 : !16 : spe 1/0 1/717 : firmware location bootflash:mica-modem-pw.172.16.0.0.bin18 : !19 : !20 : resource-pool disable21 : !22 : no aaa new-model23 : ip subnet-zero24 : ip domain name cisco.com25 : ip name-server 172.16.11.4826 : ip name-server 172.16.2.13327 : !28 : !29 : isdn switch-type primary-5ess30 : !...126 : endThe following example shows how to display the module and status configuration for all modules on a Cisco 7600 series router:
Router# show running-configBuilding configuration...Current configuration:!version 12.0service timestamps debug datetime localtimeservice timestamps log datetime localtimeno service password-encryption!hostname Router!boot buffersize 126968boot system flash slot0:7600rboot bootldr bootflash:c6msfc-boot-mz.120-6.5T.XE1.0.83.binenable password lab!clock timezone Pacific -8clock summer-time Daylight recurringredundancymain-cpuauto-sync standard!ip subnet-zero!ip multicast-routingip dvmrp route-limit 20000ip cefmls flow ip destinationmls flow ipx destinationcns event-service server!spanning-tree portfast bpdu-guardspanning-tree uplinkfastspanning-tree vlan 200 forward-time 21port-channel load-balance sdip!!!shutdown!!...In the following sample output from the show running-config command, the shape average command indicates that traffic shaping overhead accounting for ATM is enabled. The BRAS-DSLAM encapsulation type is qinq and the subscriber line encapsulation type is snap-rbe based on the AAL5 service.
Router# show running-config...subscriber policy recording rules limit 64no mpls traffic-eng auto-bw timers frequency 0call rsvp-sync!controller T1 2/0framing sflinecode ami!controller T1 2/1framing sflinecode ami!!policy-map unit-testclass class-defaultshape average percent 10 account qinq aal5 snap-rbe!Related Commands
show running-config vrf
To display the subset of the running configuration of a router that is linked to a specific Virtual Private Network (VPN) routing and forwarding (VRF) instance or to all VRFs configured on the router, use the show running-config vrf command in user EXEC or privileged EXEC mode.
show running-config vrf [vrf-name]
Syntax Description
Command Default
If you do not specify a vrf-name argument, the running configurations of all VRFs on the router are displayed.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
Use the show running-config vrf command to display a specific VRF configuration or to display all VRF configurations on the router. To display the configuration of a specific VRF, enter the name of the VRF as an argument to the command.
This command displays the following elements of the VRF configuration:
•
•
•
Examples
The following is sample output from the show running-config vrf command. It includes a base VRF configuration for VRF vpn3 and Border Gateway Protocol (BGP) and Open Shortest Path First (OSPF) configurations associated with VRF vpn3.
Router# show running-config vrf vpn3Building configuration...Current configuration : 604 bytesip vrf vpn3rd 100:3route-target export 100:3route-target import 100:3!!interface Loopback1ip vrf forwarding vpn3ip address 10.43.43.43 255.255.255.255!interface Ethernet6/0ip vrf forwarding vpn3ip address 172.17.0.1 255.0.0.0no ip redirectsduplex half!router bgp 100!address-family ipv4 vrf vpn3redistribute connectedredistribute ospf 101 match external 1 external 2no auto-summaryno synchronizationexit-address-family!router ospf 101 vrf vpn3log-adjacency-changesarea 1 sham-link 10.43.43.43 10.23.23.23 cost 10network 172.17.0.0 0.255.255.255 area 1!endTable 148 describes the significant fields shown in the display.
Related Commands
show secure bootset
To display the status of Cisco IOS image and configuration resilience, use the show secure bootset command in privileged EXEC mode.
show secure bootset
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show secure bootset command instead of the dir command, the Cisco IOS directory listing command, to verify the existence of an image archive. This command will also display output that shows whether the image or configuration archive is ready for upgrade.
Examples
The following is self-explanatory sample output from the show secure bootset command:
Router# show secure bootset%IOS image and configuration resilience is not activeRouter# show secure bootsetIOS resilience router id JMX0704L5GHIOS image resilience version 12.3 activated at 08:16:51 UTC Sun Jun 16 2002Secure archive slot0:c3745-js2-mz type is image (elf) []file size is 25469248 bytes, run size is 25634900 bytesRunnable image, entry point 0x80008000, run from ramIOS configuration resilience version 12.3 activated at 08:17:02 UTC Sun Jun 16 2002Secure archive slot0:.runcfg-20020616-081702.ar type is configconfiguration archive size 1059 bytesRelated Commands
show snmp mib nhrp status
To display status information about the Next Hop Resolution Protocol (NHRP) MIB, use the show snmp mib nhrp status command in privileged EXEC mode.
show snmp mib nhrp status
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command is used to display the status of the MIB for NHRP and whether the NHRP MIB is enabled or disabled.
Examples
The following output is from the show snmp mib nhrp status command:
Spoke_103# show snmp mib nhrp statusNHRP-SNMP Agent Feature: EnabledNHRP-SNMP Tree State: GoodListEnqueue Count = 0 Node Malloc Counts = 1Spoke_103#Table 1 describes the significant fields shown in the display.
Related Commands
show ssh
To display the status of Secure Shell (SSH) server connections, use the show ssh command in privileged EXEC mode.
show ssh
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show ssh command to display the status of the SSH connections on your router. This command does not display any SSH configuration data; use the show ip ssh command for SSH configuration information such as timeouts and retries.
Examples
The following is sample output from the show ssh command with SSH enabled:
Router# show sshConnection Version Encryption State Username0 1.5 3DES Session Started guestThe following is sample output from the show ssh command with SSH disabled:
Router# show ssh%No SSH server connections running.Related Commands
show ssl-proxy module state
To display the spanning-tree state for the specified VLAN, enter the show ssl-proxy module state command in EXEC mode.
show ssl-proxy module mod state
Syntax Description
Defaults
This command has no default settings.
Command Modes
EXEC
Command History
12.2(18)SXD
Support for this command was introduced on the Supervisor Engine 720.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
Usage Guidelines
This command is supported on Cisco 7600 series routers that are configured with a Secure Sockets Layer (SSL) Services Module only.
Examples
This example shows how to verify that the VLAN information displayed matches the VLAN configuration:
Router# show ssl-proxy module 6 stateSSL-services module 6 data-port:Switchport:EnabledAdministrative Mode:trunkOperational Mode:trunkAdministrative Trunking Encapsulation:dot1qOperational Trunking Encapsulation:dot1qNegotiation of Trunking:OffAccess Mode VLAN:1 (default)Trunking Native Mode VLAN:1 (default)Trunking VLANs Enabled:100Pruning VLANs Enabled:2-1001Vlans allowed on trunk:100Vlans allowed and active in management domain:100Vlans in spanning tree forwarding state and not pruned:100Allowed-vlan :100Router#Related Commands
ssl-proxy module allowed-vlan
Adds the VLANs allowed over the trunk to the SSL Services Module.
show tacacs
To display statistics for a TACACS+ server, use the show tacacs command in EXEC mode.
show tacacs
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following example is sample output for the show tacacs command:
Router# show tacacsTacacs+ Server : 172.19.192.80/49Socket opens: 3Socket closes: 3Socket aborts: 0Socket errors: 0Socket Timeouts: 0Failed Connect Attempts: 0Total Packets Sent: 7Total Packets Recv: 7Expected Replies: 0No current connectionTable 150 describes the significant fields shown in the display.
Related Commands
show tcp intercept connections
To display TCP incomplete and established connections, use the show tcp intercept connections command in EXEC mode.
show tcp intercept connections
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show tcp intercept connections command to display TCP incomplete and established connections.
Examples
The following is sample output from the show tcp intercept connections command:
Router# show tcp intercept connectionsIncomplete:Client Server State Create Timeout Mode172.19.160.17:58190 10.1.1.30:23 SYNRCVD 00:00:09 00:00:05 I172.19.160.17:57934 10.1.1.30:23 SYNRCVD 00:00:09 00:00:05 IEstablished:Client Server State Create Timeout Mode172.16.232.23:1045 10.1.1.30:23 ESTAB 00:00:08 23:59:54 ITable 151 describes significant fields shown in the display.
Related Commands
show tcp intercept statistics
To display TCP intercept statistics, use the show tcp intercept statistics command in EXEC mode.
show tcp intercept statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
Use the show tcp intercept statistics command to display TCP intercept statistics.
Examples
The following is sample output from the show tcp intercept statistics command:
Router# show tcp intercept statisticsintercepting new connections using access-list 1012 incomplete, 1 established connections (total 3)1 minute connection request rate 2 requests/secRelated Commands
show tech-support
To display general information about the router when it reports a problem, use the show tech-support command in privileged EXEC mode.
show tech-support [page] [password] [cef | ipc | ipmulticast [vrf vrf-name] | isis | mpls | ospf [process-id | detail] | rsvp]
Cisco 7600 Series
show tech-support [cef | ipmulticast [vrf vrf-name] | isis | password [page] | platform | page | rsvp]
Syntax Description
Defaults
The output scrolls without page breaks.
Passwords and other security information are removed from the output.Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
To interrupt and terminate the show tech-support output, simultaneously press and release the CTRL, ALT, and 6 keys.
Press the Return key to display the next line of output, or press the Spacebar to display the next page of information. If you do not enter the page keyword, the output scrolls (that is, it does not stop for page breaks).
If you do not enter the password keyword, passwords and other security-sensitive information in the output are replaced with the label "<removed>."
The show tech-support command is useful for collecting a large amount of information about your routing device for troubleshooting purposes. The output of this command can be provided to technical support representatives when reporting a problem.
Note
The show tech-support command displays the output of a number of show commands at once. The output from this command varies depending on your platform and configuration. For example, access servers display voice-related show command output. Additionally, the show protocol traffic commands are displayed for only the protocols enabled on your device. For a sample display of the output of the show tech-support command, see the individual show command listed.
If you enter the show tech-support command without arguments, the output displays, but is not limited to, the equivalent of these show commands:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
If you enter the show tech-support command on a virtual switch (VS), the output displays the output of the show module command and the show power command for both the active and standby switches.
Use of the optional cef, ipc, ipmulticast, isis, mpls, ospf, or rsvp keywords provides a way to display a number of show commands specific to a particular protocol or process in addition to the show commands listed previously.
For example, if your Technical Assistance Center (TAC) support representative suspects that you may have a problem in your Cisco Express Forwarding (CEF) configuration, you may be asked to provide the output of the show tech-support cef command. The show tech-support [page] [password] cef command will display the output from the following commands in addition to the output for the standard show tech-support command:
•
•
•
•
•
•
•
•
•
•
If you enter the ipmulticast keyword, the output displays, but is not limited to, these show commands:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
For a sample display of the output from the show tech-support command, refer to the documentation for the show commands listed in the "Usage Guidelines" section.
Related Commands
show tech-support ipsec
To display IP Security (IPsec) information to assist in troubleshooting, use the show tech-support ipsec command in privileged EXEC mode.
show tech-support ipsec [peer ipv4address | vrf vrf-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
The show tech-support ipsec simplifies the collection of the IPsec related information if you are troubleshooting a problem. There are three variations of the show tech-support ipsec command:
•
•
•
Output of the show tech-support ipsec Command
If you enter the show tech-support ipsec command without any keywords, the command output displays the following show commands, in order of output:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Output of the show tech-support ipsec peer Command
If you enter the show tech-support ipsec command with the peer keyword and the ipv4address argument, the output displays the following show commands, in order of output for the specified peer:
•
•
•
•
•
•
•
•
•
•
•
Output of the show tech-support ipsec vrf Command
If you enter the show tech-support ipsec command with the vrf keyword and the vrf-name argument, the output displays the following show commands, in order of output for the specified VRF:
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
For a sample display of the output from the show tech-support ipsec command, see the documentation for the individual show commands listed in the "Usage Guidelines" section.
Related Commands
show tech-support
Displays general information about the router when it reports a problem.
show tms controller
To display TIDP Based Mitigation Services (TMS) information on a TMS controller, use the show tms controller command in privileged EXEC mode.
show tms controller
Syntax Description
This command has no arguments or keywords.
Command Default
TMS information on a TMS controller is not displayed.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The output from this command displays the TMS groups and consumers for which the controller performs. This information includes specific consumer membership information and registration status.
Examples
The following is sample output from the show tms controller command:
Router# show tms controllerTIDP-Group TMS-Consumer-IP Status---------- ----------------- ------10 10.3.3.2 Registered Successfully10 10.1.1.2 Registered Successfully20 10.3.3.2 Registered Successfully20 10.1.1.2 Registered SuccessfullyTable 152 describes the significant fields shown in the display.
Related Commands
show tms controller group
To display TIDP Based Mitigation Services (TMS) group information on a TMS controller, use the show tms controller group command in privileged EXEC mode.
show tms controller group {group-id [owner {owner-id | any} tid {threat-id | all} [consumer ipv4 ip-address] [verbose] | threats] | all owner {owner-id | any} tid {threat-id | all} [consumer ipv4 ip-address] [verbose]}
Syntax Description
Command Default
TMS group information on a TMS controller is not displayed.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command is used to display specific information about Threat Information Messages (TIMs) sent to a TMS consumer or group from the controller. This information includes the threat ID (TID) number, the message version number, the TMS group ID number, the controller IP address, the active or inactive registration status, and the mitigation enforcement action.
Examples
The following is sample output from the show tms controller group command:
Router# show tms controller group 10TMS-Controller# show tms controller group all owner any tid all verboseOwnerID TID Ver Group Consumer Status ActionTaken-------- ---- ---- ------ --------- -------- --------------1 1 1 Load Active1 1 1 10 10.1.1.2 Active Redirect 172.16.1.11 2 1 Load Active1 2 1 10 10.1.1.2 Active Redirect NULL1 3 1 Load Active1 3 1 10 10.1.1.2 Inactive Threat Inactive2 10 1 Load Active2 10 1 10 10.1.1.2 Active ACL-Drop2 20 1 Load Active2 20 1 10 10.1.1.2 Active ACL-DropTable 153 describes the significant fields shown in the display.
show tunnel endpoints
To display the contents of the tunnel endpoint database that is used for tunnel endpoint address resolution, when running a tunnel in multipoint generic routing encapsulation (mGRE) mode, use the show tunnel endpoints command in privileged EXEC mode.
show tunnel endpoints [tunnel tunnel-number]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The output of show tunnel endpoints command displays the tunnel destination and transport address together with any overlay or virtual private network (VPN) address that resolves to it.
Examples
The following example shows that there are two tunnel endpoints in the database that are associated with tunnel 1 (192.0.2.0 and 192.0.2.1). Through these endpoints, VPN destination 192.0.2.3 is reachable by tunneling to endpoint 192.0.2.0 and VPN destination 192.0.2.2 is reachable by tunneling to endpoint 192.0.2.1.
Router# show tunnel endpointsTunnel0 running in multi-GRE/IP modeEndpoint transport 20.20.20.20 Refcount 4 Base 0x55BCC5E8 Create Time 00:01:08overlay ::FFFF:20.20.20.20 Refcount 2 Parent 0x55BCC5E8 Create Time 00:01:08overlay 20.20.20.20 Refcount 2 Parent 0x55BCC5E8 Create Time 00:01:08Table 154 describes the significant fields shown in the display..
Related Commands
tunnel mode
Sets the encapsulation mode for the tunnel interface.
tunnel protection
Associates a tunnel interface with an IPSec profile.
show usb controllers
To display USB host controller information, use the show usb controllers command in privileged EXEC mode.
show usb controllers [controller-number]
Syntax Description
Defaults
Information about all controllers on the system are displayed.
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
Use the show usb controllers command to display content such as controller register specific information, current asynchronous buffer addresses, and period scheduling information. You can also use this command to verify that copy operations are occurring successfully onto a USB flash module.
Examples
The following example is sample output from the show usb controllers command:
Router# show usb controllersName:1362HCDController ID:1Controller Specific Information:Revision:0x11Control:0x80Command Status:0x0Hardware Interrupt Status:0x24Hardware Interrupt Enable:0x80000040Hardware Interrupt Disable:0x80000040Frame Interval:0x27782EDFFrame Remaining:0x13C1Frame Number:0xDA4CLSThreshold:0x628RhDescriptorA:0x19000202RhDescriptorB:0x0RhStatus:0x0RhPort1Status:0x100103RhPort2Status:0x100303Hardware Configuration:0x3029DMA Configuration:0x0Transfer Counter:0x1Interrupt:0x9Interrupt Enable:0x196Chip ID:0x3630Buffer Status:0x0Direct Address Length:0x80A00ATL Buffer Size:0x600ATL Buffer Port:0x0ATL Block Size:0x100ATL PTD Skip Map:0xFFFFFFFFATL PTD Last:0x20ATL Current Active PTD:0x0ATL Threshold Count:0x1ATL Threshold Timeout:0xFFInt Level:1Transfer Completion Codes:Success :920 CRC :0Bit Stuff :0 Stall :0No Response :0 Overrun :0Underrun :0 Other :0Buffer Overrun :0 Buffer Underrun :0Transfer Errors:Canceled Transfers :2 Control Timeout :0Transfer Failures:Interrupt Transfer :0 Bulk Transfer :0Isochronous Transfer :0 Control Transfer:0Transfer Successes:Interrupt Transfer :0 Bulk Transfer :26Isochronous Transfer :0 Control Transfer:894USBD Failures:Enumeration Failures :0 No Class Driver Found:0Power Budget Exceeded:0USB MSCD SCSI Class Driver Counters:Good Status Failures :3 Command Fail :0Good Status Timed out:0 Device not Found:0Device Never Opened :0 Drive Init Fail :0Illegal App Handle :0 Bad API Command :0Invalid Unit Number :0 Invalid Argument:0Application Overflow :0 Device in use :0Control Pipe Stall :0 Malloc Error :0Device Stalled :0 Bad Command Code:0Device Detached :0 Unknown Error :0Invalid Logic Unit Num:0USB Aladdin Token Driver Counters:Token Inserted :1 Token Removed :0Send Insert Msg Fail :0 Response Txns :434Dev Entry Add Fail :0 Request Txns :434Dev Entry Remove Fail:0 Request Txn Fail:0Response Txn Fail :0 Command Txn Fail:0Txn Invalid Dev Handle:0USB Flash File System Counters:Flash Disconnected :0 Flash Connected :1Flash Device Fail :0 Flash Ok :1Flash startstop Fail :0 Flash FS Fail :0USB Secure Token File System Counters:Token Inserted :1 Token Detached :0Token FS success :1 Token FS Fail :0Token Max Inserted :0 Create Talker Failures:0Token Event :0 Destroy Talker Failures:0Watched Boolean Create Failures:0show usb device
To display USB device information, use the show usb device command in privileged EXEC mode.
show usb device [controller-ID [device-address]]
Syntax Description
controller-ID
(Optional) Displays information only for the devices under the specified controller.
device-address
(Optional) Displays information only for the device with the specified address.
Defaults
Information for all devices attached to the system are displayed.
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
Use the show usb device command to display information for either a USB flash drive or a USB eToken, as appropriate.
Examples
The following example is sample output from the show usb device command:
Router# show usb deviceHost Controller:1Address:0x1Device Configured:YESDevice Supported:YESDescription:DiskOnKeyManufacturer:M-SysVersion:2.0Serial Number:0750D84030316868Device Handle:0x1000000USB Version Compliance:2.0Class Code:0x0Subclass Code:0x0Protocol:0x0Vendor ID:0x8ECProduct ID:0x15Max. Packet Size of Endpoint Zero:64Number of Configurations:1Speed:FullSelected Configuration:1Selected Interface:0Configuration:Number:1Number of Interfaces:1Description:Attributes:NoneMax Power:140 mAInterface:Number:0Description:Class Code:8
