-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Feedback
Table Of Contents
snmp-server enable traps ipsec
snmp-server enable traps isakmp
source interface (Diameter peer)
source-interface (URL parameter-map)
ssid (local RADIUS server group)
subscriber access pppoe unique-key circuit-id
switchport port-security aging
switchport port-security mac-address
switchport port-security maximum
switchport port-security violation
show vasi pair
To display the status of a VRF-Aware Service Infrastructure (VASI) pair, use the show vasi pair command in privileged EXEC mode.
show vasi pair status [number]
Syntax Description
status
Displays the VASI pair status.
number
(Optional) VASI pair number. The range is from 1 to 256.
Command Default
If no interface is specified, all VASI interfaces are displayed.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the show vasi pair command:
Router# show vasi pair status 100Pair name Left state Right state Pair state------------------------------------------------------------------------------VASIPair100 down not configured need vasiright100Table 198 describes the significant fields shown in the display.
Related Commands
show vlan group
To display the VLANs mapped to VLAN groups, use the show vlan group command in privileged EXEC mode.
show vlan group [group-name group-name]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
The show vlan group command displays the existing VLAN groups and lists the VLANs and VLAN ranges that are members of each VLAN group. If the group-name keyword is entered, only the members of the VLAN group specified by the group-name argument are displayed.
Examples
This example shows how to display the members of a specified VLAN group:
Router# show vlan group group-name ganymedeGroup Name Vlans Mapped---------------- -------------------ganymede 7-9Related Commands
show vtemplate
To display information about all configured virtual templates, use the show vtemplate command in privileged EXEC mode.
show vtemplate
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the show vtemplate command:
Router# show vtemplateVirtual access subinterface creation is globally enabledActive Active Subint Pre-clone Pre-clone InterfaceInterface Subinterface Capable Available Limit Type--------- ------------ ------- --------- --------- ---------Vt1 0 0 Yes -- -- SerialVt2 0 0 Yes -- -- SerialVt4 0 0 Yes -- -- SerialVt21 0 0 No -- -- TunnelVt22 0 0 Yes -- -- EtherVt23 0 0 Yes -- -- SerialVt24 0 0 Yes -- -- SerialUsage SummaryInterface Subinterface--------- ------------Current Serial in use 1 0Current Serial free 0 3Current Ether in use 0 0Current Ether free 0 0Current Tunnel in use 0 0Current Tunnel free 0 0Total 1 3Cumulative created 8 4Cumulative freed 0 4Base virtual access interfaces: 1Total create or clone requests: 0Current request queue size: 0Current free pending: 0Maximum request duration: 0 msecAverage request duration: 0 msecLast request duration: 0 msecMaximum processing duration: 0 msecAverage processing duration: 0 msecLast processing duration: 0 msecLast processing duration:0 msecTable 199 describes the significant fields shown in the example.
Related Commands
show webvpn context
To display the operational status and configuration parameters for Secure Socket Layer (SSL) virtual private network (VPN) context configurations, use the show webvpn context command in privileged EXEC mode.
show webvpn context [name | brief]
Syntax Description
name
(Optional) Name of the context for which output will be filtered to display detailed information.
brief
(Optional) Filters the output to display a summary of SSL VPN context configuration.
Command Default
If no arguments or keywords are specified, the output displays general information about the operational status of all SSL VPN contexts.
Command Modes
Privileged EXEC (#)
Command History
12.4(6)T
This command was introduced.
15.0(1)M
This command was modified. The brief keyword was added.
Usage Guidelines
Entering a context name displays more detailed information, such as the operational status and specific configuration information for the named context.
Examples
The following output is an example of brief information that can be displayed for system security officer (SSO) servers configured for the SSL VPN context:
Router# show webvpn context briefCodes: AS - Admin Status, OS - Operation StatusVHost - Virtual HostContext Name Gateway Domain/VHost VRF AS OS------------ ------- ------------ ------- ---- --------Default_context n/a n/a n/a down downcon-1 gw-1 one - up upcon-2 - - - down downTable 200 describes the significant fields shown in the display.
The following is sample output from the show webvpn context command entered with the name of a specific SSL VPN context:
Router# show webvpn context 1234567891234567891secondAdmin Status: downOperation Status: downError and Event Logging: DisabledCSD Status: DisabledCertificate authentication type: All attributes (like CRL) are verifiedAAA Authentication List not configuredAAA Authorization List not configuredAAA Accounting List not configuredAAA Authentication Domain not configuredAuthentication mode: AAA authenticationDefault Group Policy not configuredNot associated with any WebVPN GatewayDomain Name and Virtual Host not configuredMaximum Users Allowed: 1000 (default)NAT Address not configuredVRF Name not configuredVirtual Template not configuredTable 201 describes the significant fields shown in the display.
Related Commands
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
show webvpn gateway
To display the status of a SSL VPN gateway, use the show webvpn gateway command in privileged EXEC mode.
show webvpn gateway [name]
Syntax Description
Command Default
No default behavior or values.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Entering this command without specifying a gateway name, displays general the operational status of all SSL VPN gateways. Entering a gateway name displays the IP address and CA trustpoint.
Examples
The following is sample output from the show webvpn gateway command:
Router# show webvpn gatewayGateway Name Admin Operation------------ ----- ---------GW_1 up upGW_2 down downTable 202 describes the significant fields shown in the display.
The following is sample output from the show webvpn gateway command, entered with a specific SSL VPN gateway name:
Router# show webvpn gateway GW_1Admin Status: upOperation Status: upIP: 10.1.1.1, port: 443SSL Trustpoint: TP-self-signed-26793562Table 203 describes the significant fields shown in the display.
Related Commands
webvpn gateway
Enters webvpn gateway configuration mode to configure a SSL VPN gateway.
show webvpn install
To display the installation status of SVC or CSD client software packages, use the show webvpn install command in EXEC mode.
show webvpn install {file name | package {csd | svc} | status {csd | svc}}
Syntax Description
Command Default
No default behavior or values.
Command Modes
EXEC
Command History
Usage Guidelines
This command is used to display information about Cisco Secure Desktop (CSD) and SSL VPN Client (SVC) software pages that are locally cached for distribution to remote SSL VPN clients. This information includes software versions and build dates.
Examples
The following is sample output from the show webvpn install command, entered with the file keyword:
Router# show webvpn install file \webvpn\stc\version.txtSSLVPN File \webvpn\stc\version.txt installed:CISCO STC win2k+ 1.0.01,1,0,116Fri 06/03/2005 03:02:46.43Table 204 describes the significant fields shown in the display.
The following is sample output from the show webvpn install command, entered with the package svc keywords:
Router# show webvpn install package svcSSLVPN Package SSL-VPN-Client installed:File: \webvpn\stc\1\binaries\detectvm.class, size: 555File: \webvpn\stc\1\binaries\java.htm, size: 309File: \webvpn\stc\1\binaries\main.js, size: 8049File: \webvpn\stc\1\binaries\ocx.htm, size: 244File: \webvpn\stc\1\binaries\setup.cab, size: 176132File: \webvpn\stc\1\binaries\stc.exe, size: 94696File: \webvpn\stc\1\binaries\stcjava.cab, size: 7166File: \webvpn\stc\1\binaries\stcjava.jar, size: 4846File: \webvpn\stc\1\binaries\stcweb.cab, size: 13678File: \webvpn\stc\1\binaries\update.txt, size: 11File: \webvpn\stc\1\empty.html, size: 153File: \webvpn\stc\1\images\alert.gif, size: 2042File: \webvpn\stc\1\images\buttons.gif, size: 1842File: \webvpn\stc\1\images\loading.gif, size: 313File: \webvpn\stc\1\images\title.gif, size: 2739File: \webvpn\stc\1\index.html, size: 4725File: \webvpn\stc\2\index.html, size: 325File: \webvpn\stc\version.txt, size: 63Total files: 18Table 205 describes the significant fields shown in the display.
The following is sample output from the show webvpn install command, entered with the status svc keywords:
Router# show webvpn install status svcSSLVPN Package SSL-VPN-Client version installed:CISCO STC win2k+ 1.0.01,0,2,127Fri 07/22/2005 12:14:45.43Table 206 describes the significant fields shown in the display.
Related Commands
webvpn install
Installs a CSD or SVC package file to a WebVPN gateway for distribution to remote users.
show webvpn license
To display the available count and the current usage, use the show webvpn license command in privileged EXEC mode.
show webvpn license
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show webvpn license command to display the available count and the current usage. To display the current license type and time period left in the case of a nonpermanent licence, use the show license command.
Examples
The following is sample output from the show webvpn license command:
Router# show webvpn licenseAvailable license count : 200Reserved license count : 200In-use count : 3The above output is self-explanatory.
Related Commands
debug webvpn license
Displays debug messages related to license operations, events, and errors.
show webvpn nbns
To display information in the NetBIOS Name Service (NBNS) cache, use the show webvpn nbns command in privileged EXEC mode.
show webvpn nbns {context {all | name}}
Syntax Description
context name
Filters the output to display NBNS information for the named context.
context all
Displays NBNS information for all contexts.
Command Default
No default behavior or values.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command is used to display information about NBNS cache entries. The NetBIOS name, IP address of the Windows Internet Name Service (WINS) server, and associated time stamps.
Examples
The following is sample output from the show webvpn nbns command, entered with the context and all keywords:
Router# show webvpn nbns context allNetBIOS name IP Address Timestamp0 total entriesNetBIOS name IP Address Timestamp0 total entriesNetBIOS name IP Address Timestamp0 total entriesTable 207 describes the significant fields shown in the display.
Related Commands
show webvpn policy
To display the context configuration associated with a policy group, use the show webvpn policy command in user EXEC or privileged EXEC mode.
show webvpn policy group name context {all | name} [detail]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
This command is used to display configuration settings that apply only to the policy group. This command can also be used to display all contexts for which the policy group is configured.
Examples
The following is sample output from the show webvpn policy command:
Router# show webvpn policy group group1 context allWEBVPN: group policy = group1 ; context = context1url list name = "web-url"cifs url list name = "cifs-url"idle timeout = 2100 secsession timeout = Disabledport forward name = "pflist"functions =file-accessfile-browsefile-entrysvc-enabledcitrix disabledaddress pool name = "70pool"svc home page = "http://wiki-eng.cisco.com/engwiki/SSLVPNTech"webvpn home page = "http://192.0.2.0", redirection time = 10dpd client timeout = 300 secdpd gateway timeout = 300 seckeepalive interval = 30 secSSLVPN Full Tunnel mtu size = 1406 byteskeep sslvpn client installed = enabledrekey interval = 3600 secrekey method =lease duration = 43200 secmsie-proxy = autoie proxy server = "test.com:80"split include = 209.165.200.225 255.255.255.224split include = 209.165.200.226 255.255.255.224See Table 208 for the field description.
The following sample output displays information about an SSO server configured for a policy group of the SSL VPN context:Router# show webvpn policy group ONE context allWV: group policy = sso ; context = test_ssoidle timeout = 2100 secsession timeout = 43200 secsso server name = "server2citrix disableddpd client timeout = 300 secdpd gateway timeout = 300 seckeep sslvpn client installed = disabledrekey interval = 3600 secrekey method =lease duration = 43200 secTable 208 describes the significant fields shown in the displays.
Related Commands
policy group
Enters SSL VPN group policy configuration mode to configure a group policy.
show webvpn session
To display Secure Sockets Layer Virtual Private Network (SSL VPN) user session information, use the show webvpn session command in user EXEC or privileged EXEC mode.
show webvpn session [user user-name] context {context-name | all} [detail]
Syntax Description
Command Default
Session information is not displayed.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
12.4(6)T
This command was introduced.
15.1(1)T
This command was modified. The detail keyword was added.
Usage Guidelines
This command is used to list active SSL VPN connections or to display context configuration policies that apply to the specified end user.
The show webvpn session command provides detailed information about the user session. These details include the username, assigned IP addess, group policy, login time, hash algorithms used for the session, number of clientless tunnels, and the number of full tunnels enabled for the user.
This command is applicable only for user session statistics and tunnel statistics.
Examples
The following is sample output from the show webvpn session command. The output is filtered to display user session information for only the specified context.
Router# show webvpn session context context1WebVPN context name: context1Client_Login_Name Client_IP_Address No_of_Connections Created Last_Useduser1 192.0.2.1 2 04:47:16 00:01:26user2 192.0.2.2 2 04:48:36 00:01:56Table 209 describes the significant fields shown in the display.
The following is sample output from the show webvpn session command. The output is filtered to display session information for a specific user.
Router# show webvpn session user user1 context allSession Type : Full TunnelClient User-Agent : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5)Username : test Num Connection : 1Public IP : 192.0.2.0 VRF Name : NoneContext : context1 Policy Group : defaultLast-Used : 00:00:42 Created : *09:50:38.191 UTC Thu Jan 21 2010Session Timeout : Disabled Idle Timeout : 2100DPD GW Timeout : 300 DPD CL Timeout : 300Address Pool : varun MTU Size : 1206Rekey Time : 3600 Rekey Method :Lease Duration : 43200Tunnel IP : 209.165.200.225 Netmask : 255.255.255.224Rx IP Packets : 0 Tx IP Packets : 1CSTP Started : 00:01:42 Last-Received : 00:01:42CSTP DPD-Req sent : 0 Virtual Access : 1Msie-ProxyServer : None Msie-PxyPolicy : DisabledMsie-Exception :Split Include : 209.165.200.224 255.255.255.224Client Ports : 2538DTLS Port : 2547Table 210 describes the significant fields shown in the display.
The following is sample output from the show webvpn session user context all detail command:
Router# show webvpn session user user1 context all detailSession Type : Full TunnelClient User-Agent : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:10.0.0.1)Username : user1 Num Connection : 1Public IP : 209.165.200.225 VRF Name : NoneContext : context1 Policy Group : defaultLast-Used : 00:00:02 Created : *09:50:38.191 UTC Thu Jan 21 2010Session Timeout : Disabled Idle Timeout : 2100DPD GW Timeout : 300 DPD CL Timeout : 300Address Pool : varun MTU Size : 1206Rekey Time : 3600 Rekey Method :Lease Duration : 43200Tunnel IP : 209.165.200.249 Netmask : 255.255.255.224Rx IP Packets : 0 Tx IP Packets : 2CSTP Started : 00:02:03 Last-Received : 00:02:03CSTP DPD-Req sent : 0 Virtual Access : 1Msie-ProxyServer : None Msie-PxyPolicy : DisabledMsie-Exception :Split Include : 209.165.200.250 255.255.255.224Client Ports : 2538DTLS Port : 2547Detail Session Statistics for User:: user1----------------------------------CSTP Statistics::Rx CSTP Frames : 4 Tx CSTP Frames : 0Rx CSTP Bytes : 32 Tx CSTP Bytes : 0Rx CSTP Data Fr : 0 Tx CSTP Data Fr : 0Rx CSTP CNTL Fr : 4 Tx CSTP CNTL Fr : 0Rx CSTP DPD Req : 0 Tx CSTP DPD Req : 0Rx CSTP DPD Res : 0 Tx CSTP DPD Res : 0Rx Addr Renew Req : 0 Tx Address Renew : 0Rx CDTP Frames : 2 Tx CDTP Frames : 0Rx CDTP Bytes : 122 Tx CDTP Bytes : 0Rx CDTP Data Fr : 2 Tx CDTP Data Fr : 0Rx CDTP CNTL Fr : 0 Tx CDTP CNTL Fr : 0Rx CDTP DPD Req : 0 Tx CSTP DPD Req : 0Rx CDTP DPD Res : 0 Tx CDTP DPD Res : 0Rx IP Packets : 0 Tx IP Packets : 2Rx IP Bytes : 0 Tx IP Bytes : 10CEF Statistics::Rx CSTP Data Fr : 0 Tx CSTP Data Fr : 0Rx CSTP Bytes : 0 Tx CSTP Bytes : 0Table 211 describes the significant fields shown in the display.
show webvpn sessions
Note
Effective with Cisco IOS Release 12.4(6)T, the show webvpn sessions command is replaced by the show webvpn session command. See the show webvpn session command for more information.
To display information about WebVPN sessions, use the show webvpn sessions command in privileged EXEC mode.
show webvpn sessions
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(6)T
This command was replaced by the show webvpn session command.
Examples
The following output example displays information about a WebVPN session:
Router# show webvpn sessionsWebVPN domain name: cisco.comClient Login Name Client IP Address Number of Connectionswebuser 172.16.163.142 4Created 00:14:25, Last-used 00:00:10Client Port: 2366Client Port: 2386Client Port: 2396Client Port: 2486browseruser 172.16.163.142 2Created 00:00:09, Last-used 00:00:08Client Port: 2431Client Port: 2432Table 212 describes the significant fields shown in the display
Related Commands
show webvpn statistics
Note
To display WebVPN statistics, use the show webvpn statistics command in privileged EXEC mode.
show webvpn statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(6)T
This command was replaced by the show webvpn stats command.
Examples
The following is sample output using the show webvpn statistics command:
Router# show webvpn statisticsActive user sessions: 2Active user TCP connections: 6Authentication failures: 3Terminated user sessions: 0Table 212 describes the significant fields shown in the display.
.
Related Commands
show webvpn stats
To display Secure Socket Layer Virtual Private Network (SSL VPN) application and network statistics, use the show webvpn stats command in privileged EXEC mode.
show webvpn stats [cifs | citrix | mangle | port-forward | sso | tunnel] [detail] [context {all | name}]
Syntax Description
Command Default
None
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command is used to display SSL VPN application, authentication, and network statistics and counters.
Examples
The following is sample output from the show webvpn stats command entered with the detail and context keywords:
Router# show webvpn stats detail context context1WebVPN context name : context1User session statistics:Active user sessions : 0 AAA pending reqs : 0Peak user sessions : 0 Peak time : neverActive user TCP conns : 0 Terminated user sessions : 0Session alloc failures : 0 Authentication failures : 0VPN session timeout : 0 VPN idle timeout : 0User cleared VPN sessions: 0 Exceeded ctx user limit : 0CEF switched packets - client: 0 , server: 0CEF punted packets - client: 0 , server: 0Mangling statistics:Relative urls : 0 Absolute urls : 0Non-http(s) absolute urls: 0 Non-standard path urls : 0Interesting tags : 0 Uninteresting tags : 0Interesting attributes : 0 Uninteresting attributes : 0Embedded script statement: 0 Embedded style statement : 0Inline scripts : 0 Inline styles : 0HTML comments : 0 HTTP/1.0 requests : 0HTTP/1.1 requests : 0 Unknown HTTP version : 0GET requests : 0 POST requests : 0CONNECT requests : 0 Other request methods : 0Through requests : 0 Gateway requests : 0Pipelined requests : 0 Req with header size >1K : 0Processed req hdr bytes : 0 Processed req body bytes : 0HTTP/1.0 responses : 0 HTTP/1.1 responses : 0HTML responses : 0 CSS responses : 0XML responses : 0 JS responses : 0Other content type resp : 0 Chunked encoding resp : 0Resp with encoded content: 0 Resp with content length : 0Close after response : 0 Resp with header size >1K: 0Processed resp hdr size : 0 Processed resp body bytes: 0Backend https response : 0 Chunked encoding requests: 0CIFS statistics:SMB related Per Context:TCP VC's : 0 UDP VC's : 0Active VC's : 0 Active Contexts : 0Aborted Conns : 0NetBIOS related Per Context:Name Queries : 0 Name Replies : 0NB DGM Requests : 0 NB DGM Replies : 0NB TCP Connect Fails : 0 NB Name Resolution Fails : 0HTTP related Per Context:Requests : 0 Request Bytes RX : 0Request Packets RX : 0 Response Bytes TX : 0Response Packets TX : 0 Active Connections : 0Active CIFS context : 0 Requests Dropped : 0Socket statistics:Sockets in use : 0 Sock Usr Blocks in use : 0Sock Data Buffers in use : 0 Sock Buf desc in use : 0Select timers in use : 0 Sock Select Timeouts : 0Sock Tx Blocked : 0 Sock Tx Unblocked : 0Sock Rx Blocked : 0 Sock Rx Unblocked : 0Sock UDP Connects : 0 Sock UDP Disconnects : 0Sock Premature Close : 0 Sock Pipe Errors : 0Sock Select Timeout Errs : 0Port Forward statistics:Connections serviced : 0 Server Aborts (idle) : 0Client Serverin pkts : 0 out pkts : 0in bytes : 0 out bytes : 0out pkts : 0 in pkts : 0out bytes : 0 in bytes : 0WEBVPN Citrix statistics:Connections serviced : 0Server ClientPackets in : 0 0Packets out : 0 0Bytes in : 0 0Bytes out : 0 0Tunnel Statistics:Active connections : 0Peak connections : 0 Peak time : neverConnect succeed : 0 Connect failed : 0Reconnect succeed : 0 Reconnect failed : 0SVCIP install IOS succeed: 0 SVCIP install IOS failed : 0SVCIP clear IOS succeed : 0 SVCIP clear IOS failed : 0SVCIP install TCP succeed: 0 SVCIP install TCP failed : 0DPD timeout : 0Client Serverin CSTP frames : 0 out IP pkts : 0in CSTP data : 0 out stitched pkts : 0in CSTP control : 0 out copied pkts : 0in CSTP Addr Reqs : 0 out bad pkts : 0in CSTP DPD Reqs : 0 out filtered pkts : 0in CSTP DPD Resps : 0 out non fwded pkts : 0in CSTP Msg Reqs : 0 out forwarded pkts : 0in CSTP bytes : 0 out IP bytes : 0out CSTP frames : 0 in IP pkts : 0out CSTP data : 0 in invalid pkts : 0out CSTP control : 0 in congested pkts : 0out CSTP Addr Resps : 0 in bad pkts : 0out CSTP DPD Reqs : 0 in nonfwded pkts : 0out CSTP DPD Resps : 0 in forwarded pkts : 0out CSTP Msg Reqs : 0out CSTP bytes : 0 in IP bytes : 0Table 214 describes significant fields in the show webvpn stats detail context display.
The following example displays SSO statistics:
Router# show webvpn stats ssoAuth Requests : 4 Pending Auth Requests : 0Successful Requests : 1 Failed Requests : 3Retranmissions : 0 DNS Errors : 0Connection Errors : 0 Request Timeouts : 0Unknown Responses : 0Table 215 describes significant fields in the show webvpn stats sso display.
The following example displays information about CEF:
Router# show webvpn statsUser session statistics:Active user sessions : 1 AAA pending reqs : 0Peak user sessions : 1 Peak time : 00:12:01Active user TCP conns : 1 Terminated user sessions : 1Session alloc failures : 0 Authentication failures : 0VPN session timeout : 0 VPN idle timeout : 0User cleared VPN sessions: 0 Exceeded ctx user limit : 0Exceeded total user limit: 0Client process rcvd pkts : 37 Server process rcvd pkts : 0Client process sent pkts : 1052 Server process sent pkts : 0Client CEF received pkts : 69 Server CEF received pkts : 0Client CEF rcv punt pkts : 1 Server CEF rcv punt pkts : 0Client CEF sent pkts : 1102 Server CEF sent pkts : 0Client CEF sent punt pkts: 448 Server CEF sent punt pkts: 0SSLVPN appl bufs inuse : 0 SSLVPN eng bufs inuse : 0Active server TCP conns : 0Table 216 describes fields in the show webvpn stats display.
Related Commands
clear webvpn stats
Clears application and access counters on an SSL VPN gateway.
show wlccp wds
To display information either about the wireless domain services (WDS) device or about client devices, use the show wlccp wds command in privileged EXEC mode.
show wlccp wds [ap | mn] [detail] [mac-addr mac-address]
Syntax Description
Defaults
If you do not enter any options with the show wlccp wds command, this command displays the IP address of the WDS device, the MAC address, the priority, and the interface state. If the interface state is backup, the command also displays the IP address of the current WDS device, the MAC address, and the priority.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
To show information about the WDS device, do not enter any keywords with this command.
Examples
The following command entry displays information about the WDS device:
Router# show wlccp wds apThe following command entry displays cached information, including details, about the client device with the specified MAC address:
Router# show wlccp wds mn detail mac-addr 00-05-C2-00-01-F5The following is sample output from the show wlccp wds command:
Router# show wlccp wdsMAC:0001.28e0.a400, IP-ADDR:10.0.0.1 , Priority:255Interface Vlan1, State:Administratively StandAlone - ACTIVEAP Count:1 , MN Count:0 , MAX AP Count:50Table 217 describes the significant fields shown in the display.
Related Commands
show zone security
To display zone security information, use the show zone security command in user EXEC or privileged EXEC mode.
show zone security [security-zone-name]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
12.4(24)T
This command was introduced in a release earlier than Cisco IOS Release 12.4(24)T.
Cisco IOS 2.1 XE
This command was integrated into Cisco IOS XE Release 2.1.
Usage Guidelines
Use this command to display zone security information.
Examples
The following is sample output from the show zone security command. The fields are self-explanatory.
Router# show zone securityzone selfDescription: System defined zoneshow zone-pair security
To display the source zone, destination zone, and policy attached to the zone-pair, use the show zone-pair security command in privileged EXEC mode. To disable the display, use the no form of this command.
show zone-pair security [source source-zone-name] [destination destination-zone-name]
no show zone-pair security [source source-zone-name] [destination destination-zone-name]
Syntax Description
source source-zone-name
(Optional) Name of the source zone.
destination destination-zone-name
(Optional) Name of the destination zone.
Command Default
If you do not specify a source or destination zone, the system displays all the zone-pairs for the source, destination, and the associated policy.
Command Modes
Privileged EXEC
Command History
Examples
The following example displays the source zone, destination zone, and policy attached to the zone-pair:
Router# show zone-pair security source z1 destination z2zone-pair name zpSource-Zone z1 Destination-Zone z2service-policy p1Table 218 describes the significant fields shown in the display.
shutdown (firewall)
To shut down a group manually, use the shutdown command in redundancy application group configuration mode. To enable a redundancy group, use the no form of this command.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Command Default
The group is active.
Command Modes
Redundancy application group configuration (config-red-app-grp)
Command History
Usage Guidelines
When a group is shut down, it does not participate in the role negotiation. The group remains in the shutdown state until you execute the no shutdown command.
Examples
The following example shows how to shut down a group named group1:
Router# configure terminalRouter(config)# redundancyRouter(config-red)# application redundancyRouter(config-red-app)# group 1Router(config-red-app-grp)# shutdownRelated Commands
shutdown (certificate server)
To allow a certificate server to be disabled without removing the configuration, use the shutdown command in certificate server configuration mode. To reenable the certificate server, use the no form of this command.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Defaults
no shutdown
Command Modes
Certificate server configuration
Command History
Usage Guidelines
You should issue the no shutdown command only after you have completely configured your certificate server.
The shutdown command disables the certificate server. If you prefer to disable simple certificate enrollment protocol (SCEP) but still want the certificate server for manual certificate enrollment, use the no ip http server command.
Examples
To ensure that the specified URL is working correctly, configure the database url command before you issue the no shutdown command on the certificate server for the first time. If the URL is broken, you will see output as follows:
Router(config)# crypto pki server mycsRouter(cs-server)# database url ftp://myftpserverRouter(cs-server)# no shutdown% Once you start the server, you can no longer change some of% the configuration.Are you sure you want to do this? [yes/no]: yesTranslating "myftpserver"% Failed to generate CA certificate - 0xFFFFFFFF% The Certificate Server has been disabled.Related Commands
signature
To specify a signature for which the command-line interface (CLI) user tunings will be changed, use the signature command in signature-definition-signature (config-sigdef-sig) configuration mode. To remove the CLI user tunings and revert to the default values, use the no version of this command.
signature signature-id [subsignature-id]
no signature signature-id [subsignature-id]
Syntax Description
Command Default
Default signature parameters cannot be changed.
Command Modes
Signature-definition-signature configuration (config-sigdef-sig)
Command History
Usage Guidelines
Use the signature command to specify a signature whose CLI user tunings are to be customized. Thereafter, you can begin to specify which signature parameters (user tunings) are to be changed.
Examples
The following example shows how to modify signature 5081/0 to "produce alert" and "reset tcp connection":
Router(config)# ip ips signature-definitionRouter(config-sigdef-sig)# signature 5081 0Router(config-sigdef-action)# engineRouter(config-sigdef-action-engine)# event-action produce-alert reset-tcp-connectionRouter(config-sigdef-action-engine)# ^ZDo you want to accept these changes:[confirmm]yRelated Commands
ip ips signature-definition
Enters signature-definition-signature configuration mode, which allows you to define a signature for CLI user tunings.
smart-tunnel list
To configure the smart tunnel list and enable it within a policy group, use the smart-tunnel list command in WebVPN context configuration mode or WebVPN group policy configuration mode. To disable the smart tunnel configuration, use the no form of this command.
smart-tunnel list name
no smart-tunnel list
Syntax Description
Command Default
No smart tunnel list is created and enabled.
Command Modes
WebVPN context configuration mode (config-webvpn-context)
WebVPN group policy configuration mode (config-webvpn-group)Command History
Usage Guidelines
Before a smart tunnel list can be enabled within a group policy, it must be created. Applications that are to be directed to the smart tunnel then must be specified within the list. This list must later be applied to the group policy.
Note
Examples
The following example shows how to create a smart tunnel list named "st1" and configure the applications for smart tunneling:
Router(config)# webvpn context sslgwRouter(config-webvpn-context)# smart-tunnel list st1Router(config-webvpn-smart-tunnel)# appl ie ieexplore.exe windowsRouter(config-webvpn-smart-tunnel)# appl telnet telnet.exe windowsThe following example shows how to enable the smart tunnel list "st1" within a group policy:
Router(config)# webvpn context sslgwRouter(config-webvpn-context)# policy group newRouter(config-webvpn-group)# smart-tunnel list st1Related Commands
webvpn context
Configures the SSL VPN context.
app (webvpn)
Configures applications to access smart tunnel.
snmp-server enable traps ipsec
To enable the router to send IP Security (IPSec) Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps ipsec command in global configuration mode. To disable IPSec SNMP notifications, use the no form of this command.
snmp-server enable traps ipsec [cryptomap [add | delete | attach | detach] | tunnel [start | stop] | too-many-sas]
no snmp-server enable traps ipsec [cryptomap [add | delete | attach | detach] | tunnel [start | stop] | too-many-sas]
Syntax Description
Defaults
SNMP notifications are disabled by default.
Command Modes
Global configuration
Command History
Usage Guidelines
SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests.
A cryptomap is a table that maps an IPSec Phase-2 tunnel to the corresponding IPSec Policy element.
For a complete description of the notification types and additional MIB functions, refer to the CISCO-IP-SEC.my and CISCO-IPSEC-FLOW-MONITOR-MIB.my files, available on Cisco.com through:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
The snmp-server enable traps ipsec command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send SNMP notifications, you must configure at least one snmp-server host command.
Examples
In the following example, the router is configured to send IPSec MIB inform notifications to the host nms.cisco.com using the community string named "public":
snmp-server enable traps ipsecsnmp-server host nms.cisco.com informs public ipsecRelated Commands
snmp-server enable traps isakmp
To enable the router to send IP Security (IPSec) Internet Security Association and Key Exchange Protocol (ISAKMP) Simple Network Management Protocol (SNMP) notifications, use the snmp-server enable traps isakmp command in global configuration mode. To disable ISAKMP IPSec SNMP notifications, use the no form of this command.
snmp-server enable traps isakmp [policy {add | delete} | tunnel {start | stop}]
no snmp-server enable traps isakmp [policy {add | delete} | tunnel {start | stop}]
Syntax Description
Defaults
SNMP notifications are disabled by default.
If no keywords are specified, all available ISAKMP traps are enabled (or disabled if the no form is used).
Command Modes
Global configuration
Command History
Usage Guidelines
SNMP notifications can be sent as traps or inform requests. This command enables both ISAKMP trap and inform requests.
For a complete description of these notifications and additional MIB functions, refer to the CISCO-IPSEC-MIB.myand CISCO-IPSEC-FLOW-MONITOR-MIB.my files, available on Cisco.com through:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
The snmp-server enable traps isakmp command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send SNMP notifications, you must configure at least one snmp-server host command.
Examples
In the following example, the router is configured to send IPSec MIB inform notifications to the host nms.cisco.com using the community string named "public":
snmp-server enable traps isakmpsnmp-server host nms.cisco.com informs public ipsecRelated Commands
snmp-server host
Specifies the recipient of an SNMP notification operation.
snmp-server trap-source
Specifies the interface that an SNMP trap should originate from.
snmp-server enable traps nhrp
To enable Simple Network Management Protocol (SNMP) notifications for the Next Hop Resolution Protocol (NHRP), use the snmp-server enable traps nhrp command in global configuration mode. To disable SNMP NHRP notifications, use the no form of this command.
snmp-server enable traps nhrp [nhc [down | up] | nhp [down | up] | nhs [down | up] | quota-exceeded]
no snmp-server enable traps nhrp [nhc [down | up] | nhp [down | up] | nhs [down | up] | quota-exceeded]
Syntax Description
Command Default
No notifications (traps) are enabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
By default all notifications (traps) are disabled. You must explicitly enable any notifications that you need in your system. After you enable traps in your system, you can use the snmp-server host traps command to control which traps are sent to a particular trap receiver.
The snmp-server host traps nhrp command enables the default NHRP traps only (it does not enable all NHRP traps). The default traps include the NHS, NHC, and quota-exceeded traps.
Examples
The following example shows how to enable the default NHRP traps, and how to send these NHRP traps to the notification receiver with the IP address 192.40.3.130 using the community string public:
Router(config)# snmp-server enable traps nhrpRouter(config)# snmp-server host 192.40.3.130 traps version 2c public nhrpThe following example shows how to disable NHC traps and enable rate limit traps:
Router(config)# no snmp-server enable traps nhrp nhcRouter(config)# snmp-server enable traps nhrp quota-exceededRelated Commands
debug snmp mib nhrp
Displays messages about the SNMP NHRP MIB.
snmp-server host
Specifies the recipient of an SNMP notification operation.
snmp trap ip verify drop-rate
To configure the router to send a Simple Network Management Protocol (SNMP) notification when the Unicast Reverse Path Forwarding (RPF) drop rate exceeds the configured threshold, use the snmp trap ip verify drop-rate command in interface configuration mode. To disable SNMP notification, use the no form of this command.
snmp trap ip verify drop-rate
no snmp trap ip verify drop-rate
Syntax Description
This command has no arguments or keywords.
Command Default
No SNMP notifications are sent.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
This command enables cipUrpfIfDropRateNotify notification. This notification is sent when the Unicast RPF drop rate exceeds the threshold.
Examples
The following example shows how to configure SNMP notification for the Unicast RPF drop rate on Ethernet interface 3/0:
Router> enableRouter# configure terminalRouter(config)# interface ethernet 3/0
Router(config-if)# snmp trap ip verify drop-rateRelated Commands
source interface
To specify the address of an interface to be used as the source address for all outgoing TCP connections associated with a trustpoint, use the source interface command in ca-trustpoint configuration mode. To disable the interface that was specified, use the no form of this command.
source interface interface-name
no source interface interface-name
Syntax Description
interface-name
Interface address to be used as the source address for all outgoing TCP connections associated with a trustpoint.
Defaults
If this command is not specified, the address of the outgoing interface is used.
Command Modes
Ca-trustpoint configuration
Command History
12.2(15)T
This command was introduced.
12.2(18)SXD
This command was integrated into Cisco IOS Release 12.2(18)SXD.
Usage Guidelines
This command must be used following the crypto ca trustpoint command. If this command is used and the address of the outgoing interface is specified, the router uses the specified address (or address of the specified interface) as the source address for any datagrams that are sent to the certification authority (CA) server or Lightweight Directory Access Protocol (LDAP) server during authentication, enrollment, and if appropriate, when obtaining certificate revocation lists (CRLs).
Examples
In the following example, the router is located in a branch office. The router uses IP Security (IPSec) to communicate with the main office. Ethernet 1 is the "outside" interface that connects to the Internet Service Provider (ISP). Ethernet 0 is the interface connected to the LAN of the branch office. To access the CA server located in the main office the router needs to send its IP datagrams out interface Ethernet 1 (address 10.2.2.205) using the IPSec tunnel. Address 10.2.2.205 is assigned by the ISP. Address 10.2.2.205 is not a part of the branch office or main office.
The CA cannot access any address outside the company because of a firewall. The CA sees a message coming from 10.2.2.205 and cannot respond (that is, it does not know that the router is located in a branch office at address 10.1.1.1, which it is able to reach).
Adding the source interface command tells the router to use address 10.1.1.1 as the source address of the IP datagram that it sends to the CA. The CA is able to respond to 10.1.1.1.
This scenario is configured using the source interface command and the interface addresses as described above.
crypto ca trustpoint ms-caenrollment url http://yourname:80/certsrv/mscep/mscep.dllsource interface ethernet0!interface ethernet 0description inside interfaceip address 10.1.1.1 255.255.255.0!interface ethernet 1description outside interfaceip address 10.2.2.205 255.255.255.0crypto map main-officeRelated Commands
source interface (Diameter peer)
To configure the interface to be used for the Diameter peer connection, use the source interface command in Diameter peer configuration mode. To disable the interface configuration, use the no form of this command.
source interface {interface}
no source interface {interface}
Syntax Description
Command Default
No source interface is defined.
Command Modes
Diameter peer configuration
Command History
Usage Guidelines
The Diameter client uses the configured source address and port to initiate a TCP connection to the Diameter peer.
Examples
The following example shows how to configure a source address and port on the Diameter client:
Router (config-dia-peer)# source interface interface_01Related Commands
diameter peer
Configures a Diameter peer and enters Diameter peer configuration submode.
show diameter peer
Displays the Diameter peer configuration.
source-interface (URL parameter-map)
To specify the interface whose IP address will be used as the source IP address while making a TCP connection to the URL filter server, use the source-interface command in URL parameter-map configuration mode. To stop using the IP address of the specified interface, use the no form of this command.
source-interface interface-name
no source-interface interface-name
Syntax Description
Command Default
None
Command Modes
URL parameter-map configuration
Command History
Usage Guidelines
When you are creating or modifying a URL parameter map, you can enter the source-interface subcommand after you enter the parameter-map type urlfilter command.
Examples
The following example specifies that the IP address of Ethernet0 will be used as the source IP address while making a TCP connection to the URL filter server:
parameter-map type urlfilter u1source-interface ethernet0Related Commands
parameter-map type urlfilter
Creates or modifies a parameter map for URL filtering parameters
split-dns
To specify a domain name that must be tunneled or resolved to the private network, use the split-dns command in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode. To remove a domain name, use the no form of this command.
split-dns domain-name
no split-dns domain-name
Syntax Description
domain-name
Name of the Domain Name System (DNS) domain that must be tunneled or resolved to the private network.
Defaults
All domain names are resolved via the public DNS server.
Command Modes
ISAKMP group configuration (config-isakmp-group)
Command History
Usage Guidelines
If you configure the split-dns command, the split-dns attribute will be added to the policy group. The attribute will include the list of domain names that you configured. All other names will be resolved via the public DNS server.
You must enable the crypto isakmp client configuration group command, which specifies group policy information that needs to be defined or changed, before enabling the split-dns command.
Note
Examples
The following example shows that the domain names "green.com" and "acme.org" will be added to the policy group:
Router (config)# crypto isakmp client configuration group ciscoRouter (config-isakmp-group)# key ciscoRouter (config-isakmp-group)# dns 10.2.2.2 10.2.2.3Router (config-isakmp-group)# wins 10.6.6.6Router (config-isakmp-group)# domain cisco.comRouter (config-isakmp-group)# pool greenRouter (config-isakmp-group)# acl 199Router (config-isakmp-group)# split-dns green.comRouter (config-isakmp-group)# split-dns acme.orgRelated Commands
acl
Configures split tunneling.
crypto isakmp client configuration group
Specifies group policy information that needs to be defined or changed.
ssh
To start an encrypted session with a remote networking device, use the ssh command in privileged EXEC or user EXEC mode.
ssh [-v {1 | 2}] [-c {3des | aes128-cbc | aes192-cbc | aes256-cbc}] [-l userid | -l userid:vrfname number ip-address | -l userid:rotarynumber ip-address] [-m {hmac-md5 | hmac-md5-96 | hmac-sha1 | hmac-sha1-96}] [-o numberofpasswordprompts n] [-p port-num] {ip-addr | hostname} [command] [-vrf]
Syntax Description
Command Default
No encrypted session exists if the command is not used.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The ssh command enables a Cisco router to make a secure, encrypted connection to another Cisco router or device running an SSH Version 1 or Version 2 server. This connection provides functionality that is similar to that of an outbound Telnet connection except that the connection is encrypted. With authentication and encryption, the SSH client allows for a secure communication over an insecure network.
Note
•
•
The following example illustrates the initiation of a secure session between the local router and the remote host HQhost to run the show users command. The result of the show users command is a list of valid users who are logged in to HQhost. The remote host will prompt for the adminHQ password to authenticate the user adminHQ. If the authentication step is successful, the remote host will return the result of the show users command to the local router and will then close the session.
ssh -l adminHQ HQhost "show users"The following example illustrates the initiation of a secure session between the local router and the edge router HQedge to run the show ip route command. In this example, the edge router prompts for the adminHQ password to authenticate the user. If the authentication step is successful, the edge router will return the result of the show ip route command to the local router.
ssh -l adminHQ HQedge "show ip route"The following example shows the SSH client using 3DES to initiate a secure remote command connection with the HQedge router. The SSH server running on HQedge authenticates the session for the admin7 user on the HQedge router using standard authentication methods. The HQedge router must have SSH enabled for authentication to work.
ssh -l admin7 -c 3des -o numberofpasswordprompts 5 HQedgeThe following example shows a secure session between the local router and a remote IPv6 router with the address 3ffe:1111:2222:1044::72 to run the show running-config command. In this example, the remote IPv6 router prompts for the adminHQ password to authenticate the user. If the authentication step is successful, the remote IPv6 router will return the result of the show running-config command to the local router and will then close the session.
ssh -l adminHQ 3ffe:1111:2222:1044::72 "show running-config"
Note
The following example shows a SSH Version 2 session using the crypto algorithm aes256-cbc and an HMAC of hmac-sha1-96. The user ID is user2, and the IP address is 10.76.82.24.
ssh -v 2 -c aes256-cbc -m hmac-sha1-96 -1 user2 10.76.82.24The following example shows that reverse SSH has been configured on the SSH client:
ssh -l lab:1 router.example.comThe following command shows that Reverse SSH will connect to the first free line in the rotary group:
ssh -l lab:rotary1 router.example.comRelated Commands
ssid (local RADIUS server group)
To assign up to 20 service set identifiers (SSIDs) to a user group, use the ssid command in local RADIUS server group configuration mode. To instruct the access point (AP) to not check if the client has come in on a list of specified SSIDs, use the no form of this command.
ssid ssid-number
no ssid ssid-number
Syntax Description
Defaults
No default behavior or values
Command Modes
Local RADIUS server group configuration
Command History
Usage Guidelines
You can enter up to 20 SSIDs to limit users to those SSIDs.
Examples
The following example shows that the SSID "green" has been added to the local user group:
ssid greenRelated Commands
ssl encryption
To specify the encryption algorithm that the Secure Sockets Layer (SSL) protocol uses for SSL Virtual Private Network (SSL VPN) connections, use the ssl encryption command in webvpn gateway configuration mode. To remove an algorithm from the SSL VPN gateway, use the no form of this command.
ssl encryption [3des-sha1] [aes-sha1] [rc4-md5]
no ssl encryption
Syntax Description
3des-sha1
(Optional) Configures the 3 DES-SHA1 encryption algorithm.
aes-sha1
(Optional) Configures the AES-SHA1 encryption algorithm.
rc4-md5
(Optional) Configures the RC4-MD5 encryption algorithm.
Defaults
All algorithms are available in the order shown above.
Command Modes
Webvpn gateway configuration
Command History
Usage Guidelines
The SSL VPN provides remote-access connectivity from almost any Internet-enabled location using only a Web browser and its native SSL encryption. Configuring this command allows you to restrict the encryption algorithms that SSL uses in Cisco IOS software. The ordering of the algorithms specifies the preference. If you specify this command after you have specified an algorithm, the previous setting is overridden.
Examples
The following example configures the gateway to use, in order, the 3DES-SHA1, AES-SHA1, or RC4-MD5 encryption algorithms for SSL connections:
Router(config)# webvpn gateway SSL_GATEWAYRouter(config-webvpn-gateway)# ssl encryption rc4-md5Router(config-webvpn-gateway)#Related Commands
webvpn gateway
Defines a SSL VPN gateway and enters webvpn gateway configuration mode.
ssl-proxy module allowed-vlan
To add the VLANs allowed over the trunk to the Secure Socket Layer (SSL) Services Module, enter the ssl-proxy module allowed-vlan command in global configuration mode. To remove the SSL Services Module from the specified VLAN, use the no form of this command.
ssl-proxy module mod allowed-vlan vlan-id
no ssl-proxy module mod allowed-vlan vlan-id
Syntax Description
Defaults
This command has no default settings.
Command Modes
Global configuration
Command History
12.2(18)SXD
Support for this command was introduced on the Supervisor Engine 720.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
Usage Guidelines
This command is supported on Cisco 7600 series routers that are configured with a Wireless LAN Services Module (WLSM) only.
One of the allowed VLANs must be the administrative VLAN.
To verify the configuration, enter the show spanning-tree vlan command.
To display the spanning-tree state for the specified VLAN, enter the show ssl-proxy module state command.
Examples
This example shows how to add an SSL Services Module installed in slot 6 to a specific VLAN:
Router (config)# ssl-proxy module 6 allowed-vlan 100Router (config)#This example shows how to remove the SSL Services Module from the specified VLAN:
Router (config)# no ssl-proxy module 6 allowed-vlan 100Router (config)#Related Commands
show ssl-proxy module state
Displays the spanning-tree state for the specified VLAN.
ssl truspoint
To configure the certificate trustpoint on a SSL VPN gateway, use the ssl trustpoint command in webvpn gateway configuration mode. To remove the trustpoint association, use the no form of this command.
ssl trustpoint name
no ssl trustpoint
Syntax Description
Defaults
This command has no default behavior or values.
Command Modes
SSLVPN gateway configuration
Command History
Usage Guidelines
You can configure a persistent self-signed certificate or an external CA server to generate a valid trustpoint.
Examples
The following example configures a trustpoint named CA_CERT:
Router(config)# webvpn gateway SSL_GATEWAYRouter(config-webvpn-gateway)# ssl trustpoint CA_CERTRelated Commands
webvpn gateway
Defines a SSL VPN gateway and enters webvpn gateway configuration mode.
sso-server
To create a Single SignOn (SSO) server name under a Secure Sockets Layer Virtual Private Network (SSL VPN) context and to enter webvpn sso server configuration mode—and to attach an SSO server to a policy group—use the sso-server command in webvpn sso server configuration and group policy configuration modes, respectively. To remove an SSO server name, use the no form of this command.
sso-server name
no sso-server name
Syntax Description
Command Default
A SSO server is not created or attached to a policy group.
Command Modes
Webvpn sso server configuration
Group policy configurationCommand History
Command Modes
Command HistoryWebvpn sso server configuration
Webvpn group policy configuration
Usage Guidelines
The SSO server name is configured under the SSL VPN context in webvpn context configuration mode. All SSO server-related parameters, such as web agent URL and policy server secret key, are configured under the SSO server name. The SSO server name is attached to the policy group in webvpn group policy configuration mode.
Examples
The following example shows that the SSO server "test-sso-server" is created under the SSL VPN context and attached to a policy group named "ONE":
webvpn context context1sso-server "test-sso-server"web-agent-url "http://webagent.example.com"secret-key "12345"retries 3timeout 15policy group ONEsso-server "test-sso-server"Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
status
To enter the signature-definition-status configuration mode, which allows you to change the enabled or retired status of an individual signature, use the status command in signature-definition-action configuration mode. To return to the default action, use the no form of this command.
status
Syntax Description
This command has no arguments or keywords.
Command Default
None
Command Modes
Signature-definition-action configuration (config-sigdef-action)
Command History
Usage Guidelines
Before issuing the status command, you must specify at least one signature via the signature command.
Examples
The following example shows how to change the status of signature 9000:0 to enabled:
Router(config)# ip ips signature-definitionRouter(config-sigdef-sig)# signature 9000 0Router(config-sigdef-action)# statusRouter(config-sigdef-status)# enabled trueRelated Commands
strict-http
To allow HTTP messages to pass through the firewall or to reset the TCP connection when HTTP noncompliant traffic is detected, use the strict-http command in appfw-policy-http configuration mode. To disable configured settings, use the no form of this command.
strict-http action {reset | allow} [alarm]
no strict-http action {reset | allow} [alarm]
Syntax Description
Defaults
If this command is not enabled, all traffic will be allowed through the firewall.
Command Modes
appfw-policy-http configuration
Command History
Examples
The following example shows how to define the HTTP application firewall policy "mypolicy." This policy includes all supported HTTP policy rules. After the policy is defined, it is applied to the inspection rule "firewall," which will inspect all HTTP traffic entering the FastEthernet0/0 interface.
! Define the HTTP policy.appfw policy-name mypolicyapplication httpstrict-http action allow alarmcontent-length maximum 1 action allow alarmcontent-type-verification match-req-rsp action allow alarmmax-header-length request 1 response 1 action allow alarmmax-uri-length 1 action allow alarmport-misuse default action allow alarmrequest-method rfc default action allow alarmrequest-method extension default action allow alarmtransfer-encoding type default action allow alarm!!! Apply the policy to an inspection rule.ip inspect name firewall appfw mypolicyip inspect name firewall http!!! Apply the inspection rule to all HTTP traffic entering the FastEthernet0/0 interface.interface FastEthernet0/0ip inspect firewall in!!subject-alt-name
To specify the trustpoint certificate name in the Subject Alternative Name (subjectAltName) field in the X.509 certificate, which is contained in the trustpoint certificate, use the subject-alt-name in ca-trustpoint configuration mode. To remove this configuration, use the no form of this command.
subject-alt-name name
no subject-alt-name name
Syntax Description
Command Default
The Subject Alternative Name field is not included in the X.509 certificate.
Command Modes
Ca-trustpoint (ca-trustpoint)
Command History
Usage Guidelines
The subject-alt-name command is used to create a self-signed trustpoint certificate for the router that contains the trustpoint name in the Subject Alternative Name (subjectAltName) field. This Subject Alternative Name can be used only when the trustpoint enrollment option is specified for self-signed enrollment in the trustpoint policy.
Note
Examples
The following example shows how to create a self-signed trustpoint certificate for the router that contains the trustpoint name in the Subject Alternative Name (subjectAltName) field:
Router> enableRouter# configure terminalRouter(config)# crypto pki trustpoint TESTCARouter(ca-trustpoint)# enrollment selfsignedRouter(ca-trustpoint)# subject-alt-name TESTCARouter(ca-trustpoint)# exitRouter(config)# cypto pki enroll TESTCA% Include the router serial number in the subject name? [yes/no]: no% Include an IP address in the subject name? [no]:Generate Self Signed Router Certificate? [yes/no]: yesRouter Self Signed Certificate successfully createdRouter(config)# exitThe following certificate is created:
Certificate:Data:Version: 3 (0x2)Serial Number: 2 (0x2)Signature Algorithm: md5WithRSAEncryptionIssuer: CN=TESTCA/unstructuredName=r1.cisco.comValidityNot Before: Mar 22 20:26:20 2010 GMTNot After : Jan 1 00:00:00 2020 GMTSubject: CN=TESTCA/unstructuredName=r1.cisco.comSubject Public Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (512 bit)Modulus (512 bit):00:8d:71:2e:3b:eb:a2:e2:f3:44:d9:bc:a9:85:88:f4:a9:bd:c9:7f:f0:69:f5:e7:75:8f:00:f2:8e:3e:2f:ca:5e:c5:08:43:95:8c:a2:6a:ae:ce:a0:ae:82:61:61:ff:4e:8c:8f:89:d1:56:d8:35:34:b7:95:93:1a:72:03:71:fbExponent: 65537 (0x10001)X509v3 extensions:X509v3 Basic Constraints: criticalCA:TRUEX509v3 Subject Alternative Name:DNS:TESTCAX509v3 Authority Key Identifier:keyid:F9:A4:95:87:5F:A4:CA:7D:65:FA:BE:38:20:55:18:F9:4C:6C:D5:F3X509v3 Subject Key Identifier:F9:A4:95:87:5F:A4:CA:7D:65:FA:BE:38:20:55:18:F9:4C:6C:D5:F3Signature Algorithm: md5WithRSAEncryption6d:92:e7:a8:a5:1a:5a:ef:13:58:02:1b:79:17:93:41:37:c9:2d:9f:1a:a3:f5:3a:73:05:cd:d1:02:84:43:7e:e0:84:07:46:55:f9:45:59:51:ba:25:48:6f:d8:e1:0d:35:44:07:5c:16:17:35:45:99:e2:80:6e:53:e5:35:76-----BEGIN CERTIFICATE-----MIIBszCCAV2gAwIBAgIBAjANBgkqhkiG9w0BAQQFADAuMQ8wDQYDVQQDEwZURVNUQ0ExGzAZBgkqhkiG9w0BCQIWDHIxLmNpc2NvLmNvbTAeFw0xMDAzMjIyMDI2MjBaFw0yMDAxMDEwMDAwMDBaMC4xDzANBgNVBAMTBlRFU1RDQTEbMBkGCSqGSIb3DQEJAhYMcjEuY2lzY28uY29tMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAI1xLjvrouLzRNm8qYWI9Km9yX/wafXndY8A8o4+L8pexQhDlYyiaq7OoK6CYWH/ToyPidFW2DU0t5WTGnIDcfsCAwEAAaNmMGQwDwYDVR0TAQH/BAUwAwEB/zARBgNVHREECjAIggZURVNUQ0EwHwYDVR0jBBgwFoAU+aSVh1+kyn1l+r44IFUY+Uxs1fMwHQYDVR0OBBYEFPmklYdfpMp9Zfq+OCBVGPlMbNXzMA0GCSqGSIb3DQEBBAUAA0EAbZLnqKUaWu8TWAIbeReTQTfJLZ8ao/U6cwXN0QKEQ37ghAdGVflFWVG6JUhv2OENNUQHXBYXNUWZ4oBuU+U1dg==-----END CERTIFICATE-----Related Commands
subject-name
To specify the subject name in the certificate request, use the subject-name command in ca-trustpoint configuration mode. To clear any subject name from the configuration, use the no form of this command.
subject-name [x.500-name]
no subject-name [x.500-name]
Syntax Description
Defaults
If the x-500-name argument is not specified, the fully qualified domain name (FQDN), which is the default subject name, will be used.
Command Modes
Ca-trustpoint configuration
Command History
12.2(8)T
This command was introduced.
12.4(24)T
Support for IPv6 Secure Neighbor Discovery (SeND) was added.
Usage Guidelines
Before you can issue the subject-name command, you must enable the crypto ca trustpoint command, which declares the certification authority (CA) that your router should use and enters ca-trustpoint configuration mode.
The subject-name command is an attribute that can be set for autoenrollment; thus, issuing this command prevents you from being prompted for a subject name during enrollment.
Examples
The following example shows how to specify the subject name for the "frog" certificate:
crypto ca trustpoint frogenrollment url http://frog.phoobin.com/subject-name OU=Spiral Dept., O=tiedye.comip-address ethernet-0auto-enroll regeneratepassword revokmeRelated Commands
subnet-acl (IKEv2)
To configure split tunneling, use the subnet-acl command in IKEv2 authorization policy configuration mode. To remove this command from your configuration and restore the default value, use the no form of this command.
subnet-acl {acl-number | acl-name}
no subnet-acl
Syntax Description
Command Default
Split tunneling is disabled.
Command Modes
IKEv2 authorization policy configuration (config-ikev2-author-policy)
Command History
15.1(3)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use the subnet-acl command to specify that the groups of ACLs represent protected subnets for split tunneling. Split tunneling is the ability to have a secure tunnel to the central site and simultaneous clear text tunnels to the Internet.
You must enable the crypto ikev2 authorization policy command, which specifies local group policy group authorization parameters that have to be defined or changed, before enabling the subnet-acl command.
Examples
The following example shows how to apply split tunneling for the group name "cisco." In this example, all traffic sourced from the client and destined to the subnet 192.168.1.0 will be sent through the VPN tunnel.
crypto ikev2 authorization policy ciscokey ciscodns 10.2.2.2 10.3.2.3pool dogsubnet-acl 199!access-list 199 permit ip 192.168.1.0 0.0.0.255 anyRelated Commands
crypto ikev2 authorization policy
Specifies an IKEv2 authorization policy group.
subscriber access pppoe unique-key circuit-id
To specify a unique circuit ID tag for a PPP over Ethernet (PPPoE) user session to be tapped on the router, use the subscriber access pppoe unique-key circuit-id command in global configuration mode. To restore the default value, use the no form of this command.
subscriber access pppoe unique-key circuit-id
no subscriber access pppoe unique-key circuit-id
Syntax Description
This command has no arguments or keywords.
Defaults
A unique circuit ID tag for PPPoE user session is not specified.
Command Modes
Global configuration
Command History
Usage Guidelines
In Cisco IOS XE Release 2.6, a user session is tapped based on the unique PPPoE circuit ID tag. This circuit ID tag serves as a unique parameter for the PPPoE user session on the device. The tapped user session is provisioned through SNMP, and user session data packets and RADIUS authentication data packets are tapped. This command is used in conjunction with the Lawful Intercept feature.
Related Commands
subscriber service
To enable per-subscriber services, use the subscriber service command in global configuration mode. To disable per-subscriber services, use the no form of this command.
subscriber service {accounting interim-interval minutes | coa-rfc-compliant | ignore | multiple-accept | password | police | session-accounting | shaper | target-atm-vc | vc-ignore-cos}
no subscriber service {accounting interim-interval minutes | coa-rfc-compliant | ignore | multiple-accept | password | police | session-accounting | shaper | target-atm-vc | vc-ignore-cos}
Syntax Description
Command Default
Service accounting is disabled.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
The subscriber service session-accounting command enables the router to include all activated services in a single accounting Session-Start message for a session.
RADIUS can activate a service using the RADIUS Access-Accept message. When RADIUS activates a service on the router after the router sends the accounting Session-Start message, the router generates an accounting session update that includes all activated services.
When a session stops, all currently active services are included in the accounting session stop record.
The subscriber service accounting interim-interval command enables the router to generate interim service accounting records at periodic intervals for subscribers. RADIUS Attribute 85 in the user service profile always takes precedence over the configured interim-interval value. RADIUS Attribute 85 must be in the user service profile. See the RADIUS Attributes Overview and RADIUS IETF Attributes feature document for more information.
Note
Examples
The following example enables per-service accounting:
Router(config)# subscriber service session-accountingRelated Commands
bandwidth account
Enables class-based fair queuing and ATM overhead accounting.
shape account
Shapes traffic to the indicated bit rate and enables ATM overhead accounting.
svc address-pool
To configure a pool of IP addresses to assign to end users in a policy group, use the svc address-pool command in webvpn group policy configuration mode. To remove the address pool from the policy group configuration, use the no form of this command.
svc address-pool name [netmask ip-netmask]
no svc address-pool
Syntax Description
Command Default
IP address pools are not assigned to end users.
Command Modes
Webvpn group policy configuration (config-webvpn-group)
Command History
12.4(6)T
This command was introduced.
15.1(1)T
This command was modified. The netmask keyword and ip-netmask argument were added.
Usage Guidelines
Before configuring the svc address-pool command, use the ip local pool command to define the address pool. The standard configuration assumes that the IP addresses in the pool are reachable from a directly connected network.
Configuring Address Pools for Networks That Are Not Directly Connected
If you need to configure an address pool for IP addresses from a network that is not directly connected, perform the following steps:
1.
2.
3.
See the "Examples" section for an example of how to configure a pool of IP addresses to assign to end users in a policy group.
Note
Examples
Directly Connected Network Example
The following example shows how to configure the 192.168.1/24 network as an address pool:
Router(config)# ip local pool ADDRESSES 192.168.1.1 192.168.1.254Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc address-pool ADDRESSESRouter(config-webvpn-group)# endNondirectly Connected Network Example
The following example shows how to configure the 172.16.1/24 network as an address pool. Because the network is not directly connected, a local loopback is configured.
Router(config)# interface loopback 0Router(config-int)# ip address 172.16.1.128 255.255.255.0Router(config-int)# no shutdownRouter(config-int)# exitRouter(config)# ip local pool ADDRESSES 172.16.1.1 172.16.1.254Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc address-pool ADDRESSESRelated Commands
svc default-domain
To configure the Cisco AnyConnect VPN Client domain for a policy group, use the svc default-domain command in webvpn group policy configuration mode. To remove the domain from the policy group configuration, use the no form of this command.
svc default-domain name
no svc default-domain
Syntax Description
Command Default
Cisco AnyConnect VPN Client domain is not configured.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Note
Examples
The following example configures cisco.com as the default domain:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc default-domain cisco.comRelated Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc dns-server
To configure Domain Name System (DNS) servers for policy group end users, use the svc dns-server command in webvpn group policy configuration mode. To remove a DNS server from the policy group configuration, use the no form of this command.
svc dns-server {primary | secondary} ip-address
no svc dns-server {primary | secondary}
Syntax Description
primary | secondary
Configures the primary or secondary DNS server.
ip-address
An IPv4 address is entered to identify the server.
Command Default
DNS servers are not configured.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Note
Examples
The following example configures primary and secondary DNS servers for the policy group:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc dns-server primary 192.168.3.1Router(config-webvpn-group)# svc dns-server secondary 192.168.4.1Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc dpd-interval
To configure the dead peer detection (DPD) timer value for the gateway or client, use the svc dpd-interval command in webvpn group policy configuration mode. To remove a DPD timer value from the policy group configuration, use the no form of this command.
svc dpd-interval {client | gateway} seconds
no svc dpd-interval {client | gateway}
Syntax Description
client | gateway
Specifies the client or gateway.
seconds
Sets the time interval, in seconds, for the DPD timer. A number from 0 through 3600 is entered.
Command Default
The DPD timer is reset every time a packet is received over the Secure Sockets Layer Virtual Private Network (SSL VPN) tunnel from the gateway or end user.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Note
Examples
The following example sets the DPD timer to 30 seconds for a SSL VPN gateway and to 5 minutes for end users (remote PC or device):
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc dpd-interval gateway 30Router(config-webvpn-group)# svc dpd-interval client 300Router(config-webvpn-group)#Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc dtls
To enable Datagram Transport Layer Security (DTLS) support on the Cisco IOS Secure Socket Layer Virtual Private Network (SSL VPN), use the svc dtls command in WebVPN group policy configuration mode. To disable the configuration, use the no form of this command.
svc dtls
no svc dtls
Syntax Description
This command has no arguments or keywords.
Command Default
DTLS is enabled by default on the Cisco ISR G2 series routers (3900, 2900, 1900, 890, and 880) and is disabled on other routers.
Command Modes
WebVPN group policy configuration (config-webvpn-group)
Command History
Usage Guidelines
The DTLS Support for IOS SSL VPN feature enables DTLS as a transport protocol for the traffic tunneled through SSL VPN. The DTLS Support for IOS SSL VPN feature is enabled by default on the Cisco IOS SSL VPN. You can use the no svc dtls command to disable DTLS support on the SSL VPN.
Examples
The following example shows how to disable DTLS support on the Cisco IOS SSL VPN gateway:
Router# configure terminalRouter(config)# webvpn context context1Router(config-webvpn-context)# policy group group1Router(config-webvpn-group)# no svc dtlsRelated Commands
svc homepage
To configure the URL of the web page that is displayed upon successful user login, use the svc homepage command in webvpn group policy configuration mode. To remove the URL from the policy group configuration, use the no form of this command.
svc homepage string
no svc homepage
Syntax Description
string
The string argument is entered as an HTTP URL. The URL can be up to 255 characters in length.
Command Default
URL of the home page is not configured.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Note
Examples
The following example configures www.cisco.com as the Cisco AnyConnect VPN Client home page:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc homepage www.cisco.comRelated Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc keepalive
To specify the Secure Socket Layer Virtual Private Network Client (SVC) keepalive value, use the svc keepalive command in webvpn group policy configuration mode. To return the svc keepalive command to its default, use the no form of this command.
svc keepalive seconds
no svc keepalive
Syntax Description
Command Default
The SVC is enabled to send keepalive messages by default with a frequency of 30 seconds.
Command Modes
Webvpn group policy configuration (config-webvpn-group)
Command History
Usage Guidelines
You can adjust the frequency of keepalive messages to ensure that an SVC connection through a proxy, IOS firewall, or Network Address Translation (NAT) device remains active, even if the device limits the time that the connection can be idle. Adjusting the frequency also ensures that the SVC does not disconnect and reconnect when the remote user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft Internet Explorer.
If the svc keepalive command is configured with a value of 0 seconds, then the keepalive function is disabled.
Note
Examples
In the following example, the security appliance is configured to enable the SVC to send keepalive messages with a frequency of 300 seconds (5 minutes), for the existing group-policy group "ONE":
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc keepalive 300Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc keep-client-installed
To configure the end user to keep Cisco AnyConnect VPN Client software installed when the SSL VPN connection is not enabled, use the svc keep-client-installed command in webvpn group policy configuration mode. To remove the software installation requirement from the policy group configuration, use the no form of this command.
svc keep-client-installed
no svc keep-client-installed
Syntax Description
This command has no keywords or arguments.
Command Default
No default behavior or values.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
The configuration of this command removes the overhead of pushing the Cisco AnyConnect VPN Client software to the end user on each connection attempt.
Note
Examples
The following example configures end users to keep Cisco AnyConnect VPN Client software installed:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc keep-client-installedRelated Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc module
To configure Start Before Logon (SBL) functionality support for a Cisco IOS Secure Sockets Layer Virtual Private Network (SSL VPN) headend, use the svc module command in webvpn group policy configuration mode. To disable the configuration, use the no form of this command.
svc module module-name
no svc module
Syntax Description
Command Default
The SBL functionality is disabled by default.
Command Modes
Webvpn group policy configuration (config-webvpn-group)
Command History
Usage Guidelines
The SBL functionality connects the client PC to the enterprise network even before the users log in to the PC. This functionality allows the administrator to run the logon scripts even if the user is not connected to the enterprise network.
Use the svc module command to configure the SBL functionality support for the Cisco IOS SSL VPN headend. This command sets the module in the WebVPN cookie for the AnyConnect client, and thereby helps in downloading the SBL components to the client from the SSL VPN headend.
Examples
The following example shows how to configure the vpn1 AnyConnect module to Cisco IOS SSL VPN headend:
Router# configure terminalRouter(config)# webvpn context context1Router(config-webvpn-context)# policy group group1Router(config-webvpn-group)# svc module vpn1Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
svc msie-proxy
To configure Microsoft Internet Explorer (MSIE) browser proxy settings for policy group end users, use the svc msie-proxy command in webvpn group policy configuration mode. To remove a MSIE proxy setting from the policy group configuration, use the no form of this command.
svc msie-proxy {server host | exception host | option {auto | bypass-local | none}}
no svc msie-proxy {server host | exception host | option {auto | bypass-local | none}}
Syntax Description
Command Default
MSIE browser proxy settings are not configured for policy group end users.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
The configuration of this command is applied to end users that use a MSIE browser. The configuration of this command has no effect on any other browser type.
Note
Examples
The following example configures automatic detection of MSIE proxy settings and configures proxy exceptions for traffic from www.example.com and the 10.20.20.1 host:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc msie-proxy option autoRouter(config-webvpn-group)# svc msie-proxy exception www.example.comRouter(config-webvpn-group)# svc msie-proxy exception 10.20.20.1The following example configures a connection to an MSIE proxy server through a fully qualified domain name (FQDN) and a port number:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc msie-proxy server www.example.com:80The following example configures a connection to an MSIE proxy server through an IP address and port number:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc msie-proxy server 10.10.10.1:80Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc msie-proxy server
To specify a Microsoft Internet Explorer (MSIE) proxy server for policy group end users, use the svc msie-proxy server command in SSLVPN group policy configuration mode. To remove the proxy server from the policy group configuration, use the no form of this command.
svc msie-proxy server host
no svc msie-proxy server
Syntax Description
host
Specifies the location of the MSIE server. The host argument is configured as an IPv4 address or fully qualified domain name, followed by a colon and port number.
Command Default
No default behavior or values.
Command Modes
SSLVPN group policy configuration
Command History
Examples
The following example configures a connection to an MSIE proxy server through a fully qualified domain name and a port number:
Router(config)# webvpn context SSLVPNRouter(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc msie-proxy server www.cisco.com:80Router(config-webvpn-group)#The following example configures a connection to an MSIE proxy server through an IP address and port number:
Router(config)# webvpn context SSLVPNRouter(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc msie-proxy server 10.10.10.1:80Router(config-webvpn-group)#Related Commands
policy group
Enters SSLVPN group policy configuration mode to configure a group policy.
webvpn context
Enters SSLVPN configuration mode to configure the WebVPN context.
svc mtu
To configure the MTU size for a policy group at the client end, use the svc mtu command in webvpn group policy configuration mode. To set the MTU size to its default, use the no form of this command.
svc mtu size
no svc mtu
Syntax Description
Command Default
The default MTU size is 1406.
Command Modes
Webvpn group policy configuration (config-webvpn-group)
Command History
Usage Guidelines
The maximum size of prefragmented packets that is supported by the adapter is only 1406 bytes. Sending packets larger than 1406 bytes could cause potential problems; as a result, there is a size restriction.
Examples
The following example configures the MTU size to 778 bytes:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc mtu 778Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure an SSL VPN context.
svc rekey
To configure the time and method that a tunnel key is refreshed for policy group end users, use the svc rekey command in webvpn group policy configuration mode. To remove the tunnel key configuration from the policy group configuration, use the no form of this command.
svc rekey {method {new-tunnel | ssl} | time seconds}
no svc rekey {method {new-tunnel | ssl} | time seconds}
Syntax Description
Command Default
Time and method are not configured.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Note
Examples
The following example configures the tunnel key to be refreshed by initiating a new tunnel connection once an hour:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc rekey method new-tunnelRouter(config-webvpn-group)# svc rekey time 3600Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn configuration mode to configure the SSL VPN context.
svc split
To enable split tunneling for Cisco AnyConnect VPN Client tunnel clients, use the svc split command in webvpn group policy configuration mode. To remove the split tunneling configuration from the policy group configuration, use the no form of this command.
svc split {include | exclude [local-lans]} {ip-address mask | acl {access-list-number | access-list-name}}
no svc split {include | exclude [local-lans]} {ip-address mask | acl}
Syntax Description
Command Default
Split tunneling is not enabled for Cisco AnyConnect VPN Client tunnel clients.
Command Modes
WebVPN group policy configuration (config-webvpn-group)
Command History
12.4(6)T
This command was introduced.
15.1(1)T
This command was modified. The acl keyword and the access-list and access-list-name arguments were added.
Usage Guidelines
Split tunnel support allows you to configure a policy that permits specific traffic to be carried outside the Cisco AnyConnect VPN Client tunnel. Traffic is either included (resolved in tunnel) or excluded (resolved through the Internet service provider [ISP] or WAN connection). Tunnel resolution configuration is mutually exclusive. An IP address cannot be both included and excluded at the same time. Entering the local-lans keyword permits the remote user to access resources on a local LAN, such as a network printer.
Note
Examples
The following example shows how to configure a list of IP addresses to be resolved over the tunnel (included) and a list to be resolved outside of the tunnel (excluded):
Router(config-webvpn-group)# svc split exclude 192.168.1.0 255.255.255.0Router(config-webvpn-group)# svc split include 172.16.1.0 255.255.255.0Related Commands
policy group
Enters WebVPN group policy configuration mode to configure a policy group.
webvpn context
Enters WebVPN configuration mode to configure the SSL VPN context.
svc split dns
To configure the Secure Sockets Layers Virtual Private Network (SSL VPN) gateway to resolve the specified fully qualified Domain Name System (DNS) names through the Cisco AnyConnect VPN Client tunnel, use the svc split dns command in webvpn group policy configuration mode. To remove the split DNS statement from the policy group configuration, use the no form of this command.
svc split dns name
no svc split dns name
Syntax Description
Command Default
The SSL VPN gateway is not configured to resolve the specified fully qualified DNS names through the Cisco AnyConnect VPN Client tunnel.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Entering this command configures the SSL VPN gateway to resolve the specified DNS suffixes (domains) through the tunnel. The gateway automatically incudes the default domain into the list of domains that are resolved through the tunnel. Up to 10 DNS statements can be configured.
Note
Examples
The following example configures primary and secondary DNS servers for the policy group:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc split dns cisco.comRouter(config-webvpn-group)# svc split dns my.company.netRelated Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
svc wins-server
To configure Windows Internet Name Service (WINS) servers for policy group end users, use the svc wins-server command in webvpn group policy configuration mode. To remove a WINS server from the policy group configuration, use the no form of this command.
svc wins-server {primary | secondary} ip-address
no svc dns-server {primary | secondary}
Syntax Description
primary | secondary
Configures the primary or secondary WINS server.
ip-address
An IPv4 address is entered to identify the server.
Command Default
WINS servers are not configured for policy group end users.
Command Modes
Webvpn group policy configuration
Command History
Usage Guidelines
Note
Examples
The following example configures primary and secondary WINS servers for the policy group:
Router(config)# webvpn context context1Router(config-webvpn-context)# policy group ONERouter(config-webvpn-group)# svc wins-server primary 172.31.1.1Router(config-webvpn-group)# svc wins-server secondary 172.31.2.1Related Commands
policy group
Enters webvpn group policy configuration mode to configure a policy group.
webvpn context
Enters webvpn context configuration mode to configure the SSL VPN context.
switchport port-security
To enable port security on an interface, use the switchport port-security command in interface configuration mode. To disable port security, use the no form of this command.
switchport port-security
no switchport port-security
Syntax Description
This command has no keywords or arguments.
Defaults
Disabled
Command Modes
Interface configuration
Command History
Usage Guidelines
Follow these guidelines when configuring port security:
•
•
•
•
•
•
•
•
Examples
This example shows how to enable port security:
Router(config-if)# switchport port-securityThis example shows how to disable port security:
Related Commands
switchport port-security aging
To configure the port security aging, use the switchport port-security aging time command in interface configuration mode. To disable aging, use the no form of this command.
switchport port-security aging {time time | type {absolute | inactivity}}
no switchport port-security aging
Syntax Description
Defaults
The defaults are as follows:
•
•
–
–
Command Modes
Interface configuration
Command History
Usage Guidelines
Follow these guidelines when configuring port security:
•
•
You can apply one of two types of aging for automatically learned addresses on a secure port:
•
•
Examples
This example shows how to set the aging time as 2 hours:
Router(config-if)# switchport port-security aging time 120This example shows how to set the aging time as 2 minutes:
Router(config-if)# switchport port-security aging time 2This example shows how to set the aging type on a port to absolute aging:
Router(config-if) switchport port-security aging type absoluteThis example shows how to set the aging type on a port to inactivity aging:
Router(config-if) switchport port-security aging type inactivityRelated Commands
switchport port-security mac-address
To add a MAC address to the list of secure MAC addresses, use the switchport port-security mac-address command. To remove a MAC address from the list of secure MAC addresses, use the no form of this command.
switchport port-security mac-address {mac-addr | {sticky [mac-addr]} [vlan vlan | vlan-list]}
no switchport port-security mac-address {mac-addr | {sticky [mac-addr]} [vlan vlan | vlan-list]}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Interface configuration
Command History
Usage Guidelines
If you configure fewer secure MAC addresses than the maximum number of secure MAC addresses on all interfaces, the remaining MAC addresses are dynamically learned.
To clear multiple MAC addresses, you must enter the no form of this command once for each MAC address to be cleared.
The vlan-list argument is visible only if the port has been configured and is operational as a trunk. Enter the switchport mode trunk command and then enter the switchport nonegotiate command.
The sticky keyword configures the dynamic MAC addresses as sticky on an interface. Sticky MAC addresses configure the static Layer 2 entry to stay sticky to a particular interface. This feature can prevent MAC moves or prevent the entry from being learned on a different interface.
You can configure the sticky feature even when the port security feature is not enabled on the interface. It becomes operational once port security is enabled on the interface.
Note
When port security is enabled, disabling the sticky feature causes all configured and learned sticky addresses to be deleted from the configuration and converted into dynamic secure addresses.
When port security is disabled, disabling the sticky feature causes all configured and learned sticky addresses to be deleted from the configuration.
Examples
This example shows how to configure a secure MAC address:
Router(config-if)# switchport port-security mac-address 1000.2000.3000This example shows how to delete a secure MAC address from the address table:
Router(config-if)# no switchport port-security mac-address 1000.2000.3000This example shows how to enable the sticky feature on an interface:
Router(config-if)# switchport port-security mac-address stickyThis example shows how to disable the sticky feature on an interface:
Router(config-if)# no switchport port-security mac-address stickyThis example shows how to make a specific MAC address as a sticky address:
Router(config-if)# switchport port-security mac-address sticky 0000.0000.0001This example shows how to delete a specific sticky address:
Router(config-if)# no switchport port-security mac-address sticky 0000.0000.0001This example shows how to delete all sticky and static addresses that are configured on an interface:
Router(config-if)# no switchport port-security mac-addressRelated Commands
switchport port-security maximum
To set the maximum number of secure MAC addresses on a port, use the switchport port-security maximum command in interface configuration mode. To return to the default settings, use the no form of this command.
switchport port-security maximum maximum [vlan vlan | vlan-list]
no switchport port-security maximum
Syntax Description
Defaults
This command has no default setings.
Command Modes
Interface configuration
Command History
Usage Guidelines
If you enter this command more than once, subsequent use of this command overrides the previous value of maximum. If the new maximum argument is larger than the current number of the secured addresses on this port, there is no effect except to increase the value of the maximum.
If the new maximum is smaller than the old maximum and there are more secure addresses on the old maximum, the command is rejected.
If you configure fewer secure MAC addresses than the maximum number of secure MAC addresses on the port, the remaining MAC addresses are dynamically learned.
Once the maximum number of secure MAC addresses for the port is reached, no more addresses are learned on that port even if the per-VLAN port maximum is different from the aggregate maximum number.
You can override the maximum number of secure MAC addresses for the port for a specific VLAN or VLANs by entering the switchport port-security maximum maximum vlan vlan | vlan-list command.
The vlan-list argument allows you to enter ranges, commas, and delimited entries such as 1,7,9-15,17.
The vlan-list argument is visible only if the port has been configured and is operational as a trunk. Enter the switchport mode trunk command and then enter the switchport nonegotiate command.
Examples
This example shows how to set the maximum number of secure MAC addresses that are allowed on this port:
Router(config-if)# switchport port-security maximum 5This command shows how to override the maximum set for a specific VLAN:
Router(config-if)# switchport port-security maximum 3 vlan 102Related Commands
show port-security
Display information about the port-security setting.
switchport nonegotiate
Configures the LAN port into permanent trunking mode.
switchport port-security violation
To set the action to be taken when a security violation is detected, use the switchport port-security violation command in interface configuration mode. To return to the default settings, use the no form of this command.
switchport port-security violation{shutdown | restrict | protect}
no switchport port-security violation{shutdown | restrict | protect}
Syntax Description
Command Default
The port security violation is shutdown.
Command Modes
Interface configuration (config-if)
Command History
Usage Guidelines
When a security violation is detected, one of the following actions occurs:
•
Platform port-security disable traps is configurable only when the violation mode is set to protect. When this option is configured, drop entries will not be installed into hardware for violating addresses, thus allowing traffic to continue to flow to violating address from legitimate ports. To protect switch CPU against overload when this option is enabled, we recommend that you configure the port-security rate-limiter to 2000 packets per second with a burst rate of 10.
Note
•
•
Note
Examples
This example shows how to set the action to be taken when a security violation is detected:
Router(config-if)# switchport port-security violation restrictThis example allows the traffic to a secured MAC address on one port to flow even in the presence of violations on other ports while in protect mode.
Router(config-if)# switchport port-security violation protectRouter(config-if)# platform port-security disable trapsRelated Commands
