-
Cisco IOS XR Virtual Firewall Command Reference, Release 3.8
-
Preface
-
Virtual Firewall Commands on Cisco IOS XR Software
-
Class Map Commands
-
Access Control List Commands
-
Policy Map Commands
-
Virtual Firewall Interface Commands
-
Virtualization Commands
-
High Availability Commands
-
TCP/IP Normalization and IP Reassembly Parameters Commands
-
Parameter Map Commands
-
Terminal and Session Commands
-
Authentication and Accounting Commands
-
System and File Management Commands
-
SNMP Commands
-
Logging Commands
-
VASI Commands on Cisco IOS XR Software
-
Index
-
Table Of Contents
Virtual Firewall Commands on Cisco IOS XR Software
service firewall attach location
show services firewall attachments
show services firewall interfaces
Virtual Firewall Commands on Cisco IOS XR Software
The Cisco IOS XR Virtual Firewall (VFW) application runs on the Cisco XR 12000 Multi-Service Blade (MSB). A dual core CPU on the MSB runs the Cisco IOS XR software (standard edge engine code and firewall code) on core 1 and SanOS (Linux) with the Virtual Firewall application code on core 0.
This module describes the Cisco IOS XR software commands used to configure and integrate a VFW. The Cisco IOS XR software configuration sets up the interaction between the firewall and the router. Each VFW (or firewall context) is configured in the VFW application using SanOS on core 0. The VFW application commands are described in subsequent modules.
For detailed information about VFW concepts, configuration tasks, and examples, see Cisco IOS XR Virtual Firewall Configuration Guide. For information regarding the Cisco IOS XR software, see Cisco IOS XR Getting Started Guide.
default-interface-name
To configure the default interface that represents any unprotected interface in the router, use the default-interface-name command in firewall configuration mode. To remove the default interface configuration, use the no form of this command.
default-interface-name vfw-interface-name
no default-interface-name
Syntax Description
vfw-interface-name
Name of the default interface that represents any unprotected interface in the router.
Defaults
No default behavior or values
Command Modes
Firewall configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
To remove the service location from a configuration, you must first remove the default interface name.
The vfw-interface-name argument must match the interface name that is configured on the VFW application. Refer to Cisco Virtual Firewall Configuration Guide for additional information.
Task ID
Examples
The following example shows how to create a firewall named "fw1" in Cisco IOS XR software and specify a default interface named "outside."
RP/0/0/CPU0:router# configureRP/0/0/CPU0:router(config)# firewall fw1RP/0/0/CPU0:router(config-firewall)# service-location preferred-active 0/0/CPU0 preferred-standby 0/1/CPU0 auto-revertRP/0/0/CPU0:router(config-firewall)# default-interface-name outsideRelated Commands
failure-action
To configure the action to take if a failure or misconfiguration occurs, use the failure-action command in firewall configuration mode. To revert to the default failure action, use the no form of this command.
failure-action {drop | pass | shutdown}
no failure-action
Syntax Description
drop
Drops all packets destined for the firewall.
pass
Bypasses the firewall.
shutdown
Shuts down the attached interface.
Defaults
The default is drop.
Command Modes
Firewall configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the failure-action command to override the default failure policy. If there is a problem with the firewall attachment, the default (drop) behavior automatically drops all packets that should be diverted. All IPv4 unicast and broadcast packets are dropped, but multicast or packets that are not IPv4 packets are processed normally.
•
Use the bypass keyword to specify that if a firewall attachment has a problem, all packets are to pass through without firewall protection.
•
Task ID
Examples
The following example shows how to create a firewall named "fw1" in Cisco IOS XR software and configure the failure action to be "shutdown."
RP/0/0/CPU0:router# configureRP/0/0/CPU0:router(config)# firewall fw1RP/0/0/CPU0:router(config-firewall)# service-location preferred-active 0/0/CPU0 preferred-standby 0/1/CPU0 auto-revertRP/0/0/CPU0:router(config-firewall)# failure-action shutdownRelated Commands
firewall
To configure a virtual firewall in Cisco IOS XR software, use the firewall command in global configuration mode. To remove the virtual firewall configuration, use the no form of this command.
firewall context-name
no firewall context-name
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
A virtual firewall is tied to a physical location on the MSB using the service-location command. To remove the service location from a configuration, you must first remove the default interface name. Removing the service location also removes the firewall configuration.
The context-name argument must match the firewall context name that is configured on the VFW application. Refer to the Cisco IOS XR Virtual Firewall Configuration Guide for additional information.
Task ID
Examples
The following example shows how to create a firewall named "fw1" in Cisco IOS XR software:
RP/0/0/CPU0:router# configureRP/0/0/CPU0:router(config)# firewall fw1RP/0/0/CPU0:router(config-firewall)# service-location preferred-active 0/0/CPU0 preferred-standby 0/1/CPU0 auto-revertRP/0/0/CPU0:router(config-firewall)# default-interface-name outsideRP/0/0/CPU0:router(config-firewall)# failure-action shutdownRelated Commands
firewall (interface)
To attach a virtual firewall to one of the router interfaces, use the firewall command in interface configuration mode.
firewall context-name firewall-interface vfw-interface-name
Syntax Description
context-name
Specifies the name of the firewall.
firewall-interface vfw-interface-name
Specifies the name of the firewall interface on the VFW application.
Defaults
No default behavior or values
Command Modes
Interface configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The interface firewall configuration is rejected if the interface type does not support firewall attachments, and the following error is returned:
!!% Firewall Attachments not supported on this interface type
The supported interface types are:
•
•
•
•
The context-name argument and the vfw-interface-name argument (attachment ID) pair must be unique on each interface where the attachment configuration is applied. If two or more interfaces have an attachment configuration applied with the same context-name and vfw-interface-name pair, the configuration is accepted but both attachments are forced down and the following error message occurs:
LC/0/2/CPU0:Feb 22 17:34:29.251 : rspp_ma[234]: %RSPP_MA-4-DUP_CREATE : Attachment of service ctx1 of type Firewall to interface POS0/2/0/0 with attachment ID inside1 invalid due to duplicate attachment to interface POS0/2/0/3. Both attachments will be invalidated.The context-name argument and the vfw-interface-name argument must both match the firewall context and interface names that are configured in the VFW application. Refer to Cisco IOS XR Virtual Firewall Configuration Guide for additional information.
Task ID
Examples
The following sample configuration associates interface "inside1" of firewall context "ctx1" with the router physical interface on POS0/2/0/0:
RP/0/0/CPU0:router# configureRP/0/0/CPU0:router(config)# interface POS0/2/0/0RP/0/0/CPU0:router(config-if)# firewall ctx1 firewall-interface inside1Related Commands
interface FirewallManagement
To provide remote access to manage the virtual firewall contexts, use the interface FirewallManagement command in global configuration mode. To remove the firewall management interface (FMI), use the no form of this command.
interface FirewallManagement number firewall context-name follow-active
no interface FirewallManagement number
Syntax Description
number
Number of the FMI. Range is 1 to 65535.
context-name
Particular firewall instance on the MSB core.
follow-active
Attaches the interface to the active instance of the firewall.
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
The interface FirewallManagement command provides a remote management tool for the virtual firewall contexts. The firewall keyword associates the FMI with a particular firewall context on the VFW application. Any additional interface configuration items must follow, such as defining the VRF or the IP address for the interface. The IP connectivity does not work unless the FMI on the VFW application is configured with an IP address on the same network.
The context-name argument must match the firewall context name that is configured in the VFW application. Refer to the Configuring Virtual Firewalls on the Multi-Service Blade module in Cisco IOS XR Virtual Firewall Configuration Guide for additional information.
Task ID
Examples
The following example shows how to configure FirewallManagement1 as an active virtual firewall interface, including its IP address, and to associate it with the active instance of the firewall on the VFW application:
RP/0/0/CPU0:router# configureRP/0/0/CPU0:router(config)# interface FirewallManagement1RP/0/0/CPU0:router(config-if)# ipv4 address 10.1.1.3 255.255.255.0RP/0/0/CPU0:router(config-if)# firewall fw1 follow-activeRelated Commands
service firewall attach location
To attach to the VFW application, use the service firewall attach location command in EXEC mode.
service firewall attach location node-id
Syntax Description
node-id
Specifies the location where you want to attach. The node-id argument is entered in the rack/slot/module notation.
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
You must be attached to the VFW application to configure a firewall context.
The service firewall attach location attaches from the MSB to the VFW application. After you use the command, use admin as the username/password combination to get a prompt in the VFW application. Refer to the Configuring Virtual Firewalls on the Multi-Service Blade module in Cisco IOS XR Virtual Firewall Configuration Guide to see an example of configuring a firewall in the VFW application.
Task ID
Examples
The following example shows how to attach to the VFW application:
RP/0/0/CPU0:router# service firewall attach location 0/3/CPU0firewall login: adminPassword:Cisco Application Control Software (ACSW)TAC support: http://www.cisco.com/tacCopyright (c) 2002-2006, Cisco Systems, Inc. All rights reserved.The copyrights to certain works contained herein are owned byother third parties and are used and distributed under license.Some parts of this software are covered under the GNU PublicLicense. A copy of the license is available athttp://www.gnu.org/licenses/gpl.html.firewall/Admin#Related Commands
show services firewall attachments
To display any firewall attachments that have been made, including attachments that are in the failed state (and the reason for the failure), use the show services firewall attachments command in EXEC mode.
show services firewall attachments [interface interface-name | summary]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the command keywords to modify or limit the information that is displayed for firewall instances. Refer to the notes in the examples within this section.
Task ID
Examples
The following example displays sample output from the show services firewall attachments command:
RP/0/0/CPU0:router# show services firewall attachments3 firewall attachment(s) configured! POS0/2/0/0! Firewall Name: ctx1! Firewall Interface: inside1! State: Pass Through! Info: Duplicate attachment exists! POS0/2/0/1! Firewall Name: ctx1! Firewall Interface: inside1! State: Pass Through! Info: Duplicate attachment existsFirewallManagement1Firewall Name: ctx1Firewall Interface: Follow-activeState: Diverting to 0/3/CPU0
Note
Related Commands
Configures the firewall attachment.
Configures the FMI.
Displays information about individual firewall instances.
show services firewall interfaces
To verify if a firewall context exists between the Cisco IOS XR configuration and the VFW application, use the show services firewall interfaces command in EXEC mode.
show services firewall interfaces [context-name] [summary | detail | unoperational] [location node_id]
Syntax Description
Defaults
No default behavior or values
Command Modes
EXEC
Command History
Usage Guidelines
To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
Use the command keywords to modify or limit the information that is displayed for firewall instances. Refer to the notes in the examples within this section.
Task ID
Examples
The following example displays sample output from the show services firewall interfaces command when the summary option is used:
RP/0/0/CPU0:router# show services firewall interfaces summaryStatus codes: > Firewall operating correctly! Interface not configured in MSB core- No attachment configuredd Default interfaceD Default interface (overriding attachment configuration)m Management interfaceFirewall name Location (State)St Interface name Attached to-- ----------------------------- -------------------------bar 0/0/CPU0 (Active)> dmz GigabitEthernet 0/1/0/0! inside POS 0/2/0/3d> outside <default>m> <Management: follow-active> FirewallManagement 3m> <Management: follow-standby> FirewallManagement 4bar 0/3/CPU0 (Standby)> dmz GigabitEthernet 0/1/0/0! inside POS 0/2/0/3d> outside <default>m> <Management: follow-active> FirewallManagement 3m> <Management: follow-standby> FirewallManagement 4fw1 0/0/CPU0 (Dormant)[No interfaces]fw1 0/3/CPU0 (Dormant)[No interfaces]firewall_A 0/3/CPU0 (Active)! dmz POS 0/2/0/1- firewall_interface_Am> <Management: follow-active> FirewallManagement 23firewall_B 0/0/CPU0 (Active)D> outside <default>> customer GigabitEthernet 0/1/0/1m- <Management: follow-active>
Note
The following example displays sample output from the show services firewall interfaces command without the summary option:
RP/0/0/CPU0:router# show services firewall interfacesFirewall name Location State FW ID Mgmet I/F I/Fs------------------------------ -------- ----- ----- --------- ----bar 0/0/CPU0 Active 3 FwMgmt3 50/3/CPU0 Standby 6 FwMgmt4 5fw1 0/0/CPU0 Dormant 4 --- 00/3/CPU0 Dormant 2 --- 0firewall_A 0/3/CPU0 Active 3 FwMgmt23 3firewall_B 0/0/CPU0 Active 5 --- 3
Note
•
•
The following example displays sample output from the show services firewall interfaces command with the detail option:
RP/0/0/CPU0:router# show services firewall interfaces detailFirewall: bar, location 0/0/CPU0 (Active):Firewall ID: 3Interface: dmzInterface ID: 3Attached to: GigabitEthernet 0/1/0/0Attachment is operationalInterface: insideInterface ID: none (not configured in MSB core)Attached to: POS 0/2/0/3Attachment is not operationalInterface: outsideInterface ID: 5Default interfaceInterface: <Management: follow-active>Interface ID: 1Attached to: FirewallManagement 3Attachment is operationalManagement Interface Hardware Identifiers receivedInterface: <Management: follow-standby>Interface ID: 1Attached to: FirewallManagement 4Attachment is operationalManagement Interface Hardware Identifiers receivedFirewall: bar, location 0/3/CPU0 (Standby):Firewall ID: 6Interface: dmzInterface ID: 3Attached to: GigabitEthernet 0/1/0/0Attachment is operationalInterface: insideInterface ID: none (not configured in MSB core)Attached to: POS 0/2/0/3Attachment is not operationalInterface: outsideInterface ID: 5Default interfaceInterface: <Management: follow-active>Interface ID: 1Attached to: FirewallManagement 3Attachment is operationalManagement Interface Hardware Identifiers receivedInterface: <Management: follow-standby>Interface ID: 1Attached to: FirewallManagement 4Attachment is operationalManagement Interface Hardware Identifiers receivedFirewall: fw1, location 0/0/CPU0 (Dormant)Firewall ID: 4[No interfaces]Firewall: fw1, location 0/3/CPU0 (Dormant)Firewall ID: 2[No interfaces]Firewall: firewall_name1, location 0/3/CPU0 (Active):Firewall ID: 3Interface: dmzInterface ID: none (not configured in MSB core)Attached to: POS0/2/0/1Attachment is not operationalInterface: an_interface_with_a_long_nameInterface ID: 6Not attachedInterface: <Management: follow-active>Interface ID: 2Attached to: FirewallManagement23Attachment is operationalManagement Interface Hardware Identifiers receivedFirewall: firewall_name2, location 0/0/CPU0 (Active)Firewall ID: 5Interface: outsideInterface ID: 7Default interface(Attachment to GigabitEthernet0/1/0/3 is not operational)Interface: customerInterface ID: 8Attached to: GigabitEthernet0/1/0/1Attachment is operationalInterface: <Management: follow-active>Interface ID: 9Not attachedManagement Interface Hardware Identifiers received
Note
Related Commands
