-
Cisco IOS XR Virtual Firewall Command Reference, Release 3.8
-
Preface
-
Virtual Firewall Commands on Cisco IOS XR Software
-
Class Map Commands
-
Access Control List Commands
-
Policy Map Commands
-
Virtual Firewall Interface Commands
-
Virtualization Commands
-
High Availability Commands
-
TCP/IP Normalization and IP Reassembly Parameters Commands
-
Parameter Map Commands
-
Terminal and Session Commands
-
Authentication and Accounting Commands
-
System and File Management Commands
-
SNMP Commands
-
Logging Commands
-
VASI Commands on Cisco IOS XR Software
-
Index
-
Table Of Contents
Access Control List Commands on the Virtual Firewall
Access Control List Commands on the Virtual Firewall
This module describes the commands necessary to configure access control lists (ACLs) on the VFW application.
Note
The commands described in this module are SanOS (Linux) commands used on the VFW application. Before you can access any of these commands, you must attach from the route processor to the VFW application using the service firewall attach location command. For more information, see the "Attaching to the VFW Application" section in Cisco IOS XR Virtual Firewall Configuration Guide.
access-group
To apply an access control list (ACL) to the inbound or outbound direction of an interface and make the ACL active, use the access-group command in the appropriate interface configuration mode. To remove an ACL from an interface, use the no form of this command.
access-group {input | output} acl_name
no access-group {input | output} acl_name
Syntax Description
Defaults
No default behavior or values
Command Modes
Interface configuration
Management interface configurationCommand History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
You must apply ACLs to an interface to allow the passing of traffic on an interface. You can apply one ACL of each type (extended and EtherType) to both directions of the interface. For connectionless protocols, you need to apply the ACL to the source and destination interfaces if you want traffic to pass in both directions. For example, you can allow BGP in an ACL in transparent mode, but you must apply the ACL to both interfaces.
A bridge group interface supports extended ACLs for IP traffic, and EtherType ACLs for non-IP traffic. For non-IP traffic, configure an EtherType ACL. EtherType ACLs support Ethernet V2 frames. You can configure the VFW application to pass one or any of the following non-IP EtherTypes: Multiprotocol Label Switching (MPLS), Internet Protocol version 6 (IPv6), and bridge protocol data units (BDPUs).
The output option is not allowed for EtherType ACLs.
To apply an ACL globally to all interfaces in a context, use the access-group (global) command.
Examples
The following example shows how to apply an ACL named INBOUND to the inbound direction of an interface:
firewall/Admin(config)# interface xyfirewall/Admin(config-if)# access-group input INBOUNDThe following example shows how to remove an ACL from an interface:
firewall/Admin(config-if)# no access-group input INBOUNDRelated Commands
Applies an ACL to the inbound direction on all interfaces in a context and makes the ACL active.
Creates an extended ACL.
Displays statistics associated with a specific ACL.
access-group (global)
To apply an access control list (ACL) to the inbound direction on all interfaces in a context and make the ACL active, use the access-group command in configuration mode. To remove an ACL from all interfaces in a context, use the no form of this command.
access-group input acl_name
no access-group input acl_name
Syntax Description
input
Specifies the inbound direction of all interfaces in a context on which you want to apply the ACL
acl_name
Identifier of an existing ACL that you want to apply to an interface
Defaults
No default behavior or values
Command Modes
Configuration
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
You must apply an ACL to an interface to allow the passing of traffic on that interface. This command enables you to apply an ACL to all interfaces in a context in the inbound direction only and to allow traffic on all interfaces simultaneously. The following considerations apply:
•
•
•
•
•
Examples
The following example shows how to apply an ACL named INBOUND to the inbound direction of all interfaces in the Admin context:
firewall/Admin(config)# access-group input INBOUNDRelated Commands
access-list extended
To create an extended access control list (ACL), use the access-list extended command in configuration mode. To delete the ACL, use the no form of this command.
IP extended ACL
access-list name [line number] extended {deny | permit} protocol {src_ip_address netmask | any | host src_ip_address | object-group network_grp_name} {dest_ip_address netmask | any | host dest_ip_address | object-group network_grp_name}
no access-list name
TCP or a UDP extended ACL
access-list name [line number] extended {deny | permit} {tcp | udp} {src_ip_address netmask | any | host src_ip_address | object-group network_grp_name} [operator port [port2]] {dest_ip_address netmask | any | host dest_ip_address | object-group network_grp_name} [operator port3 [port4]]
no access-list name
ICMP extended ACL:
access-list name [line number] extended {deny | permit} icmp {src_ip_address netmask | any | host src_ip_address | object-group network_grp_name} {dest_ip_address netmask | any | host dest_ip_address | object-group network_grp_name} [icmp_type code operator code]
no access-list name
Object group extended ACL:
access-list name [line number] extended {deny | permit} object-group service_grp_name {src_ip_address netmask | any | host src_ip_address | object-group network_grp_name} {dest_ip_address netmask | any | host dest_ip_address | object-group network_grp_name}
no access-list name
Syntax Description
name
Unique identifier of the ACL. Enter an unquoted text string with a maximum of 64 characters.
line number
(Optional) Specifies the line number position where you want the entry you are configuring to appear in the ACL. The position of an entry affects the lookup order of the entries in an ACL. If you do not configure the line number of an entry, the VFW application applies a default increment and a line number to the entry and appends it at the end of the ACL.
extended
Specifies an extended ACL. Extended ACLs allow you to specify the destination IP address and subnet mask and other parameters not available with a standard ACL.
deny
Blocks connections on the assigned interface.
permit
Allows connections on the assigned interface.
protocol
Name or number of an IP protocol. Enter a protocol name or an integer from 0 to 255 that represents an IP protocol number. Valid protocol choices are provided in Table 1.
src_ip_address netmask
Traffic from a source defined by the IP address and the network mask. Use these arguments to specify network traffic from a range of source IP addresses.
host src_ip_address
Specifies the IP address of the host from which network traffic originates. Use this keyword and argument to specify network traffic from a single IP address.
any
Specifies network traffic from any source.
port [port2]
TCP or UDP source port name or number from which you permit or deny services access. To enter an inclusive range of ports, enter two port numbers. Port2 must be greater than or equal to port1. See Table 3 for a list of well-known port names and numbers.
dest_ip_address netmask
Specifies the IP address of the network or host to which the packet is being sent and the network mask bits to be applied to the destination IP address. Use these arguments to specify a range of destination IP addresses.
host destination_address
IP address and subnet mask of the destination of the packets in a flow. Use this keyword and argument to specify network traffic destined to a single IP address.
port3 [port4]
TCP or UDP destination port name or number to which you permit or deny services access. To enter an optional inclusive range of ports, enter two port numbers. Port4 must be greater than or equal to port3. See Table 3 for a list of well-known ports.
icmp_type
(Optional) Type of ICMP messaging. Enter either an integer corresponding to the ICMP code number or one of the ICMP types as described in Table 2.
icmp_operator
An operator that the VFW application applies to the ICMP code number that follows. Enter one of the following operators:
•
•
•
•
•
code
ICMP code number that corresponds to an ICMP type. See Table 3. If you entered the range operator, enter a second ICMP code value to define the upper limit of the range.
object-group service_grp_name
Specifies the identifier of an existing service object group. To use service object groups in an ACL, replace the normal service (protocol operator port) or ICMP type (icmp_type) arguments with the object-group service_grp_name keyword and argument.
object-group network_grp_name
Specifies the identifier of an existing network object group. To use network object groups in an ACL, replace the normal network (source_address, mask, and so on) arguments with the object-group network_grp_name keyword and argument.
Defaults
No default behavior or values
Command Modes
Configuration
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
The VFW application does not explicitly support standard ACLs. To configure a standard ACL, specify the ports and destination addresses as "any" in an extended ACL.
There are three major types of extended ACLs:
•
•
•
For TCP and UDP connections, you do not need to also apply an ACL on the destination interface to allow returning traffic, because the VFW application allows all returning traffic for established connections.
You can apply only one ACL of each type (extended and EtherType) to each direction of an interface. You can also apply the same ACLs on multiple interfaces.
Valid protocol choices for an IP extended ACL are provided in Valid IP Protocols for access-list extended CommandTable 1.
Table 1 Valid IP Protocols for access-list extended Command
ah
51
Authentication Header
eigrp
88
Enhanced IGRP
esp
50
Encapsulated Security Payload
gre
47
Generic Routing Encapsulation
icmp
1
Internet Control Message Protocol (See Table 2 for optional ICMP messaging types)
igmp
2
Internet Group Management Protocol
ip
0
Internet Protocol
ip-in-ip
4
IP-in-IP Layer 3 Tunneling protocol
ospf
89
Open Shortest Path First
pim
103
Protocol Independent Multicast
tcp
6
Transmission Control Protocol
udp
17
User Datagram Protocol
If you selected icmp as the IP protocol type, you can optionally specify the type of ICMP messaging. Enter either an integer corresponding to the ICMP code number or one of the ICMP messaging types as described in Table 2.
Examples
The following example shows how to configure a TCP extended ACL:
firewall/Admin(config)# access-list INBOUND line 10 extended permit tcp 192.168.12.0 255.255.255.0 gt 1024 172.27.16.0 255.255.255.0 lt 4000The following example shows how to remove an entry from an extended ACL:
firewall/Admin(config)# no access-list INBOUND line 10The following example shows how to allow an external host with IP address 192.168.12.5 to be able to ping a host behind the VFW application with an IP address of 10.0.0.5:
firewall/Admin(config)# access-list INBOUND permit icmp host 192.168.12.5 host 10.0.0.5Related Commands
Clears access control list (ACL) statistics.
Displays statistics associated with a specific ACL.
access-list remark
To add a comment to an access control list (ACL), use the access-list remark command in configuration mode. To remove an ACL remark, use the no form of this command.
access-list name remark text
no access-list name remark text
Syntax Description
Defaults
No default behavior or values
Command Modes
Configuration
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Use the access-list remark command to add comments about an ACL to clarify the function of the ACL. You can enter only one comment per ACL; the comment appears at the top of the ACL
If you delete an ACL using the no access-list name command, then the remarks are also removed.
Examples
The following example shows how to add a comment to an ACL:
firewall/Admin(config)# access-list INBOUND remark This is a remarkThe following example shows how to remove comments from an ACL:
firewall/Admin(config)# no access-list INBOUND line 200 remarkRelated Commands
Clears access control list (ACL) statistics.
Displays statistics associated with a specific ACL.
access-list resequence
To resequence the access control list (ACL) entries in an ACL with a specific starting number and interval, use the access-list resequence command in configuration mode. To reset the number assigned to an ACL entry to the default of 10, use the no form of this command.
access-list name resequence number1 number2 delay
no access-list name
Syntax Description
Defaults
The default resequence value is 10.
The default delay value is 20 seconds.Command Modes
Configuration
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Examples
The following example shows how to resequence the ACL entries by multiples of 15, starting with 5:
firewall/Admin(config)# access-list INBOUND resequence 5 15Related Commands
Clears access control list (ACL) statistics.
Displays statistics associated with a specific ACL.
clear access-list
To clear access control list (ACL) statistics, use the clear access-list command in EXEC mode.
clear access-list name
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Examples
The following example shows how to clear the statistics for access control list ACL1:
firewall/Admin# clear access-list ACL1Related Commands
description (object group)
To provide a description for an object group, use the description command in the appropriate object group configuration mode. To delete the description, use the no form of this command.
description text
no description
Syntax Description
text
Description for the interface. Enter an unquoted text string containing a maximum of 240 characters including spaces.
Defaults
No default behavior or values
Command Modes
Network object group configuration
Service object group configurationCommand History
Release 3.8.0
This command was introduced on the Multi-Service Blade (MSB) for the Cisco XR 12000 Series Router.
Usage Guidelines
Use the description command to add a description to an object group configuration. The maximum number of characters is 240.
Examples
The following example shows how to configure a description for an object group:
firewall/admin(config-objgroup-serv)# description Object Group DescriptionRelated Commands
Creates an object group made up of a group of hosts or subnet IP addresses.
Creates an object group made up of a group of TCP or UDP port specifications.
host
To associate a host IP address with a network object group, use the host command in network object group configuration mode. To remove a host from the network object group, use the no form of this command.
host ip_address
no host ip_address
Syntax Description
ip_address
Host IP address associated with the network object group. Enter an IP address in dotted-decimal notation.
Command Modes
Network object group configuration
Command History
Release 3.8.0
This command was introduced on the Multi-Service Blade (MSB) for the Cisco XR 12000 Series Router.
Usage Guidelines
This command has no usage guidelines.
Examples
The following example shows how to associate host IP address 192.168.12.15 with a network object group:
host1/Admin(config-objgrp-netw)# host 192.168.12.15Related Commands
Creates an object group made up of a group of hosts or subnet IP addresses.
Creates an object group made up of a group of TCP or UDP port specifications.
object-group network
To create an object group comprising a group of hosts or subnet IP addresses, use the object-group network command in configuration mode. To remove the network object group from the configuration, use the no form of this command.
object-group network name
no object-group network name
Syntax Description
name
Unique identifier for the object group. Enter the object group name as an unquoted, alphanumeric string from 1 to 64 characters.
Command Modes
Configuration
Command History
Release 3.8.0
This command was introduced on the Multi-Service Blade (MSB) for the Cisco XR 12000 Series Router.
Usage Guidelines
Object groups allow you to streamline the creation of multiple ACL entries in an ACL. A network object groups is made up of a group of hosts or subnet IP addresses. After you create a group, you can use a single ACL entry to allow trusted hosts to make specific service requests to a group of public servers.
You associate a network IP address with a network object group by typing in the address and network mask at the object group network configuration mode command prompt. Alternatively, you can use the host comand to specify a host to be associated with the object group. Refer to Cisco IOS XR Virtual Firewall Configuration Guide for more information.
If you add new members to an existing object group that is already in use by an entry in a large ACL, recommitting the ACL can take a long time, depending on the size of the ACL and the object group. In some cases, making this change can cause the VFW application to devote over an hour to committing the ACL, during which time you cannot access the terminal. We recommend that you first remove the ACL entry that refers to the object group, make your change, and then add the ACL entry back into the ACL.
Examples
The following example shows how to create a network object group, with the IP address 192.168.12.15:
firewall/Admin(config)# object-group network NET_OBJ_GROUP1firewall/Admin(config-objgrp-netw)# 192.168.12.15 255.255.255.0Related Commands
Associates a host IP address with a network object group.
Displays statistics associated with a specific access control list (ACL).
object-group service
To create an object group comprising a group of TCP or UDP port specifications, use the object-group service command in configuration mode. To remove the service object group from the configuration, use the no form of this command.
object-group service name
no object-group service name
Syntax Description
name
Unique identifier for the object group. Enter the object group name as an unquoted, alphanumeric string from 1 to 64 characters.
Command Modes
Configuration
Command History
Release 3.8.0
This command was introduced on the Multi-Service Blade (MSB) for the Cisco XR 12000 Series Router.
Usage Guidelines
Object groups allow you to streamline the creation of multiple ACL entries in an ACL. A service object group is made up of a group of TCP or UDP port specifications. After you create a group, you can use a single ACL entry to allow trusted hosts to make specific service requests to a group of public servers.
You associate a protocol and port designation with a service object group by typing the protocol name or number at the object group service configuration mode command prompt. Refer to Cisco IOS XR Virtual Firewall Configuration Guide for more information.
Valid protocol choices for a service object group are provided in Table 4.
Table 4 Valid IP Protocols for Service Object Groups
ah
51
Authentication Header
eigrp
88
Enhanced IGRP
esp
50
Encapsulated Security Payload
gre
47
Generic Routing Encapsulation
icmp
1
Internet Control Message Protocol (See Table 5 for optional ICMP messaging types)
igmp
2
Internet Group Management Protocol
ip
0
Internet Protocol
ip-in-ip
4
IP-in-IP Layer 3 Tunneling protocol
ospf
89
Open Shortest Path First
pim
103
Protocol Independent Multicast
tcp
6
Transmission Control Protocol (See Table 6 for optional port numbers and keywords)
udp
17
User Datagram Protocol (See Table 6 for optional port numbers and keywords)
If you selected icmp as the IP protocol type, you can optionally specify the type of ICMP messaging. Enter either an integer corresponding to the ICMP code number or one of the ICMP messaging types as described in Table 5.
Available port numbers and keywords for defining TCP and UDP ports are provided in Table 6.
If you add new members to an existing object group that is already in use by an entry in a large ACL, recommitting the ACL can take a long time, depending on the size of the ACL and the object group. In some cases, making this change can cause the VFW application to devote over an hour to committing the ACL, during which time you cannot access the terminal. We recommend that you first remove the ACL entry that refers to the object group, make your change, and then add the ACL entry back into the ACL.
Examples
The following example shows how to create a service object group for ICMP information-reply messages:
firewall/Admin(config)# object-group network ICMP_OBJ_GROUP1firewall/Admin(config-objgroup-serv)# icmp 16The following example shows how to create a service object group for HTTP messages:
firewall/Admin(config)# object-group network HTTP_OBJ_GROUP1firewall/Admin(config-objgroup-serv)# tcp eq 80Related Commands
show access-list
To display statistics associated with a specific access control list (ACL), use the show access-list command in EXEC mode.
show access-list name [detail]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
The ACL information the VFW application displays when you execute the show access-list command includes the ACL name, number of elements in the ACL, operating status of the ACL (ACTIVE or NOT ACTIVE), any configured remarks, the ACL entry, and the ACL hit count.
Examples
The following example shows how to display statistical and configuration information for the ACL ACL1:
firewall/Admin# show access-list ACL1access-list:ACL_IN, elements: 10, status: ACTIVEremark : "object group acl to deny specific hosts"access-list ACL_IN line 8 extended deny tcp object-group DENIED object-group WEB eq wwwaccess-list ACL_IN line 8 extended deny tcp host 10.1.1.4 host 209.165.201.29 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.4 host 209.165.201.16 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.4 host 209.165.201.78 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.78 host 209.165.201.29 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.78 host 209.165.201.16 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.78 host 209.165.201.78 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.89 host 209.165.201.29 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.89 host 209.165.201.16 eq www (hitcount=0)access-list ACL_IN line 8 extended deny tcp host 10.1.1.89 host 209.165.201.78 eq www (hitcount=0)access-list ACL_IN line 16 extended permit ip any any (hitcount=0)The following example illustrates output from the show access-list command using the detail keyword.
firewall/Admin# show access-list acl1 detailaccess-list:acl1, elements: 1, status: ACTIVEremark : xxxaccess-list acl1 line 10 extended permit ip any any (hitcount=0) [0x7c7685e4]Table 7 describes the fields in the show access-list command output.
Related Commands
show acl-merge
To display statistics related to merged access control lists (ACLs), use the show acl-merge command in EXEC mode.
show acl-merge {acls interface interface_name {in | out} [summary] | match interface interface_name {in | out} ip_address1 ip_address2 protocol src_port dest_port | merged-list interface interface_name {in | out} [non-redundant | summary]}
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the access-list feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
The show acl-merge command is intended for use by trained Cisco personnel for troubleshooting purposes only.
The ACL merge list number (instance ID) is locally generated (not synchronized) on each VFW application in a redundant configuration. The number assigned depends on the order in which the ACLs are applied to the interfaces. This number can be different on the two modules. Even the ACL merged list could be different on the two modules depending on when redundancy is enabled.
Examples
The following example shows how to display the ACL merge information for interface abc:
firewall/Admin# show acl-merge acls interface abc in summaryRelated Commands
This command has no related commands.
