-
Cisco IOS XR Virtual Firewall Command Reference, Release 3.8
-
Preface
-
Virtual Firewall Commands on Cisco IOS XR Software
-
Class Map Commands
-
Access Control List Commands
-
Policy Map Commands
-
Virtual Firewall Interface Commands
-
Virtualization Commands
-
High Availability Commands
-
TCP/IP Normalization and IP Reassembly Parameters Commands
-
Parameter Map Commands
-
Terminal and Session Commands
-
Authentication and Accounting Commands
-
System and File Management Commands
-
SNMP Commands
-
Logging Commands
-
VASI Commands on Cisco IOS XR Software
-
Index
-
Table Of Contents
Virtualization Commands on the Virtual Firewall
Virtualization Commands on the Virtual Firewall
You can operate your VFW application in a single context or in multiple contexts. Multiple contexts use the concept of virtualization to partition your VFW application into multiple virtual devices or contexts. Each context contains its own set of policies, interfaces, resources, and administrators. Virtualization commands provide you with the tools to more closely and efficiently manage the system resources and users of the VFW application, and the services you provide to your customers.
Note
The commands described in this module are SanOS (Linux) commands used on the VFW application. Before you can access any of these commands, you must attach from the route processor to the VFW application using the service firewall attach location command. For more information, see the "Attaching to the VFW Application" section in Cisco IOS XR Virtual Firewall Configuration Guide.
add-object
To associate a configuration object with a domain, use the add-object command in domain configuration mode. To remove an object added to the domain, use the no form of this command.
add-object {access-list extended | all | class-map | interface | object-group | parameter-map | policy-map} name
no add-object {access-list extended | all | class-map | interface | parameter-map | policy-map} name
Syntax Description
Defaults
No default behavior or values
Command Modes
Domain configuration
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
After you have created a domain, you can associate configurable objects with that domain (for example, an interface). To associate a configurable object with a domain, use the add-object command in domain configuration mode.
Examples
The following example shows how to associate an interface called xyz with a domain D1:
firewall/Admin(config)# domain D1firewall/Admin(config-domain)# add-object interface xyzRelated Commands
Creates a domain and enters domain configuration mode.
Displays the information about the configured domains in the VFW application.
changeto
To move from one context on the VFW application to another, use the changeto command in EXEC mode.
changeto context_name
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the changeto feature in your user role (as found in all the predefined user roles). For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Only users authorized in the Admin context can use the changeto command to navigate between the various contexts. Context administrators, who have access to multiple contexts, must explicitly log in to the other contexts to which they have access.
The command prompt indicates the context you are currently in (see the following example).
Examples
The following example shows how to change from the Admin context to the context CTX1:
firewall/Admin# changeto CTX1firewall/CTX1#Related Commands
clear user
To clear a user session, use the clear user command in EXEC mode.
clear user name
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the AAA feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
To display the list of users that are currently logged in to the VFW application, use the show users command.
Examples
The following example shows how to log out the user USER1:
firewall/Admin# clear user USER1Related Commands
Displays the information for users that are currently logged in to the VFW application.
Defines a user and its associated password, role, and domain.
context
To create a context, use the context command in configuration mode. To remove a context, use the no form of this command.
context name
no context name
Syntax Description
name
Name that designates a context. Enter an unquoted text string with no spaces and a maximum of 64 characters.
Defaults
No default behavior or values
Command Modes
Configuration
Admin context only
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Use the context command to create a context. The CLI prompt changes to (config-context). A context provides a user view into the VFW application and determines the resources available to a user.
By default, the VFW application allows you to create and use five user-configured contexts plus the default admin context. To use a maximum of 251 contexts (admin context plus 250 user contexts), you must purchase an additional license from Cisco Systems.
Examples
The following example shows how to create a context called C1:
firewall/Admin(config)# context C1firewall/Admin(config-context)#Related Commands
description (context)
To enter a description for a role or context, use the description command in the appropriate configuration mode. To remove the role description from the configuration, use the no form of this command.
description text
no description
Syntax Description
text
Description of the role. Enter a description as an unquoted text string with a maximum of 256 characters.
Defaults
No default behavior or values
Command Modes
Context configuration
Role configurationCommand History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
This command has no usage guidelines.
Examples
The following example shows how to provide additional description about a role:
firewall/C1(config-role)# description DEFINES TECHNICIAN ROLEThe following example shows how to remove the description from the configuration:
firewall/C1(config)# no description DEFINES TECHNICIAN ROLERelated Commands
This command has no related commands.
domain
To create a domain and access domain configuration mode, use the domain command in configuration mode. To remove a domain from the configuration, use the no form of this command.
domain name
no domain name
Syntax Description
name
Unique identifier of a domain in a context. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters.
Defaults
No default behavior or values
Command Modes
Configuration
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
A domain does not restrict the context configuration that you can display using the show running-config command. You can still display the running configuration for the entire context. However, a domain can restrict your access to the configurable objects within a context by adding to the domain only a limited subset of all the objects available to a context.
Examples
The following example shows how to create a domain named D1 and access domain configuration moder:
firewall/Admin(config)# domain D1firewall/Admin(config-domain)#Related Commands
Displays the information about the configured domains in the VFW application.
Displays the running configuration information associated with the current context.
member
To associate a context with a resource class, use the member command in context configuration mode. To remove a context from a resource class, use the no form of this command.
member class
no member class
Syntax Description
class
Name of an existing resource class. Enter the class name as an unquoted text string with a maximum of 64 alphanumeric characters.
Defaults
No default behavior or values
Command Modes
Context configuration
Admin context only
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
You can associate a context with only one resource class. If you do not explicitly associate a context with a resource class, the VFW application associates the context with the default resource class.
Use the resource-class command to create a resource class.
Examples
The following example shows how to disassociate a context from a resource class:
firewall/Admin(config-context)# no member RC1Related Commands
Displays the context configuration information.
Creates a resource class and enters resource configuration mode.
limit-resource
To limit system resources for all members of a resource class, use the limit-resource command in resource-class configuration mode. To restore the default resource settings for all resources or individual resources for all members (contexts) of a resource class, use the no form of this command.
limit-resource {acl-memory | all | buffer {syslog}| conc-connections | mgmt-connections | proxy-connections | rate {bandwidth | connections | inpsect-conn | mgmt-traffic | syslog} | regexp | xlates} {minimum number} {maximum {equal-to-min | unlimited}}
no limit-resource {acl-memory | all | buffer {syslog}| conc-connections | mgmt-connections | proxy-connections | rate {bandwidth | connections | inpsect-conn | mgmt-traffic | syslog} | regexp | xlates} {minimum number} {maximum {equal-to-min | unlimited}}
Syntax Description
Command Modes
Resource configuration
Admin context only
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
You can limit all resources or individual resources for all members (contexts) of a resource class. For example, you can limit only concurrent connections or probes or sticky table entries, to name a few.
If you lower the limits for one context (context A) to increase the limits of another context (context B), you may experience a delay in the configuration change. This is because the VFW application does not lower the limits of context A until the resources are no longer being used by the context.
The limit you set for individual resources using the limit-resource command overrides the limit you set for all resources using the limit-resource all command.
Examples
The following example shows how to allocate 20 percent of all resources (minimum and maximum) to all member contexts of the resource class:
firewall/C1(config)# resource-class RC1firewall/C1(config-resource)# limit-resource all minimum 20% maximum equal-to-minThe following example shows how to restore resource allocation to the default values of 0 percent minimum and 100 percent maximum for all resources to all member contexts:
(config-resource)# no limit-resource allRelated Commands
resource-class
To create a resource class and enter resource configuration mode, use the resource-class command in configuration mode. To remove the resource-class setting, use the no form of this command.
resource-class name
no resource-class name
Syntax Description
name
Name assigned to the resource class. Enter an unquoted text string with no spaces and a maximum of 64 alphanumeric characters. You can also use the resource class called default.
Defaults
No default behavior or values
Command Modes
Configuration
Admin context only
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Use the resource-class command to create a resource class and enter resource configuration mode. The CLI prompt changes to (config-resource). Use a resource class to allocate and limit system resources among contexts in your VFW application. The default resource class allocates 100 percent of all configurable system resources to each context. By creating a resource class, you can prevent oversubscription by limiting the percentage of resources available to each context. After you create and configure a resource class, use the member command in context configuration mode to assign a context to the class.
Examples
The following example shows how to create a resource-class called RC1:
firewall/C1(config)# resource-class RC1firewall/C1(config-resource)Related Commands
role
To assign a user role to a user and enter role configuration mode, use the role command in configuration mode. To remove the user role assignment, use the no form of this command.
role name
no role name
Syntax Description
name
Identifier associated with a user role. Enter an unquoted text string with no spaces and a maximum of 64 characters.
Defaults
No default behavior or values
Command Modes
Configuration
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
To assign a user role to a user and enter role configuration mode, use the role command. User roles determine the privileges a user has, the commands a user can enter, and the actions that a user can perform in a particular context. You can apply the roles you create only in the context in which you create them.
If you do not assign a user role to a new user, the default user role is Network-Monitor. For users that you create in the admin context, the default scope of access is the entire device. For users that you create in other contexts, the default scope of access is the entire context. If you need to restrict a user's access, you must assign a role-domain pair using the username command.
Examples
The following example shows how to create a role:
firewall/C1(config)# role TECHNICIANfirewall/C1(config-role)#Related Commands
rule
To assign privileges on a per-feature basis to a role, use the rule command in role configuration mode. You can limit the features that a user has access to and the commands the user can enter for that feature by configuring rules for roles. To remove the rule from a user role, use the no form of this command.
rule number {permit | deny} {create | debug | modify | monitor} [feature {AAA | access-list | config-copy | connection | fault-tolerant | inspect | interface | nat | syslog}]
no rule number {permit | deny} {create | modify | debug | monitor} [feature {AAA | access-list | config-copy | connection | fault-tolerant | inspect | interface | nat | syslog}]
Syntax Description
Defaults
No default behavior or values
Command Modes
Role configuration
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
Use the rule command to assign privileges on a per-feature basis to a role. You can limit the features that a user has access to and the commands the user can enter for that feature by configuring rules for roles.
Examples
The following example shows how to configure a rule that allows a role to create an interface:
firewall/C1(config)# role TECHNICIANfirewall/C1(config-role)# rule 1 permit create interfaceRelated Commands
show context
To display the context configuration information, use the show context command in EXEC mode.
show context [context_name | Admin]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command has no user role feature restrictions. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
The VFW application displays different information for this command depending on the context you are in when executing the command:
•
•
Examples
The following example shows sample output from the show context command:
firewall/Admin# show contextNumber of Contexts = 3Name: Admin , Id: 0Description:Resource-class: defaultFT Auto-sync running-cfg configured state: enabledFT Auto-sync running-cfg actual state: disabledFT Auto-sync startup-cfg configured state: enabledFT Auto-sync startup-cfg actual state: disabledName: ctx1 , Id: 1Description:Resource-class: defaultName: ctx2 , Id: 2Description:Resource-class: defaultThe following example shows how to display the configuration information for the user context ctx1:
firewall/Ctx1# show context ctx1Related Commands
show domain
To display the information about the configured domains in the VFW application, use the show domain command in EXEC mode.
show domain [name]
Syntax Description
name
(Optional) Name of an existing context domain. Specify a domain name to display the detailed configuration report relating to just the specified domain.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
To display the complete domain configuration report that lists all the configured domains, execute the show domain command without including the name argument.
Examples
The following example shows how to use the show domain command:
firewall/Admin# show domain D1Related Commands
show resource allocation
To display the allocation for each resource across all resource classes and class members, use the show resource allocation command in EXEC mode.
show resource allocation
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
The show resource allocation command shows the resource allocation, but does not show the actual resources being used. To display information about actual resource usage, use the show resource usage command.
Examples
The following example shows how to display the allocation for each resource:
firewall/Admin# show resource allocationRelated Commands
show resource usage
To display the resource usage for each context, use the show resource usage command in EXEC mode.
show resource usage [all | context name | summary | top number]
[resource {acl-memory | all | conc-connections | mgmt-connections | proxy-connections | rate {bandwidth | connections | inspect-conn | mac-miss | mgmt-traffic | syslog} | xlates}]
[counter [all | current | denied | peak [count_threshold]]]Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Admin context
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
You must be in the admin context to use the show resource usage command.
Examples
The following example shows how to display the resource usage for context C1:
firewall/Admin# show resource usage context C1 resourceRelated Commands
Displays the allocation for each resource across all resource classes and class members.
show role
To display the configured user roles (predefined and user-configured), use the show role command in EXEC mode.
show role [role_name]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
To configure roles, use the role command in configuration mode.
Examples
The following example shows sample output from the show role command:
firewall/Admin# show roleRole: Admin (System-defined)Description: AdministratorNumber of rules: 4---------------------------------------------Rule Type Permission Feature---------------------------------------------1. Permit Create all2. Permit Create user access3. Permit Create system4. Permit Create changetoRole: Network-Admin (System-defined)Description: Admin for L3 (IP and Routes) and L4 VIPsNumber of rules: 5---------------------------------------------Rule Type Permission Feature---------------------------------------------1. Permit Create interface2. Permit Create connection3. Permit Create nat4. Permit Create config_copy5. Permit Create changetoRole: Security-Admin (System-defined)Description: Administrator for all security featuresNumber of rules: 8---------------------------------------------Rule Type Permission Feature---------------------------------------------1. Permit Create access-list2. Permit Create inspect3. Permit Create connection4. Permit Modify interface5. Permit Create aaa6. Permit Create nat7. Permit Create config_copy8. Permit Create changetoRole: Network-Monitor (System-defined)Description: Monitoring for all featuresNumber of rules: 2---------------------------------------------Rule Type Permission Feature---------------------------------------------1. Permit Monitor all2. Permit Monitor changetoRelated Commands
show user-account
To display user account information, use the show user-account command in EXEC mode.
show user-account [user_name]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the AAA feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
To display the user account information for all users, do not specify a user with the optional user_name argument.
Examples
The following example shows sample output from the show user-account command:
firewall/Admin# show user-accountuser:ciscoSupportthis user account has no expiry dateroles: Network-Monitordomain: default-domainContext: Adminuser:adminthis user account has no expiry dateroles: Admindomain: default-domainContext: Adminuser:wwwthis user account has no expiry dateroles: Admindomain: default-domainContext: AdminRelated Commands
Displays the information for users that are currently logged in to the VFW application.
Defines a user and its associated password, role, and domain.
show users
To display the information for users that are currently logged in to the VFW application, use the show users command in EXEC mode.
show users [user_name]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
This command requires the AAA feature in your user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
To display the information for all users that are currently logged in to the VFW application, do not specify a user with the optional user_name argument.
Examples
The following example shows sample output from the show users command:
firewall/Admin# show usersUser Context Line Login Time (Location) Role Domain(s)*admin Admin pts/0 Feb 26 07:32 Admin default-domainRelated Commands
Clears a user session.
Displays user account information.
Defines a user and its associated password, role, and domain.
username
To define a user and its associated password, role and domain, use the username command in configuration mode. To remove the username from the configuration, use the no form of this command.
username user_name [password [0 | 5] password] [expire date] [role role_name [domain dname1 dname2 . . . name10]]
no username user_name [password [0 | 5] password] [expire date] [role role_name [domain dname1 dname2 . . . name10]]
Syntax Description
Defaults
No default behavior or values
Command Modes
Configuration
Command History
Usage Guidelines
This command requires the admin user role. For details about role-based access control (RBAC) and user roles, see the Configuring Virtualization on the Virtual Firewall module in Cisco IOS XR Virtual Firewall Configuration Guide.
If you do not assign a role to a new user, the default role is Network-Monitor. For users that you create in the admin context, the default scope of access is the entire device. For users that you create in other contexts, the default scope of access is the entire context. If you need to restrict a user's access, you must assign a role-domain pair.
Examples
The following example shows how to define two new users:
firewall/Admin(config)# username USER1 password MYSECRET expire 2005-12-31 role TECHNICIAN domain D1 default-domainfirewall/Admin(config)# username USER2 password HERSECRET expire 2005-12-31 role Admin domain default-domain D2Related Commands
