Feedback
Table Of Contents
set connection advanced-options
show crypto accelerator statistics
show crypto ipsec fragmentation
show crypto protocol statistics
show memory delayed-free-poisoner
show priority-queue statistics
show running-config aaa-server
show running-config aaa-server host
show running-config access-group
show running-config access-list
show running-config arp timeout
show running-config arp-inspection
show running-config auth-prompt
show running-config command-alias
show running-config console timeout
show running-config crypto dynamic-map
show running-config crypto ipsec
show running-config crypto isakmp
show running-config crypto map
show running-config domain-name
show running-config established
show running-config group-delimiter
show running-config group-policy
show running-config ip address
show running-config ip audit attack
show running-config ip audit info
show running-config ip audit interface
show running-config ip audit name
show running-config ip audit signature
show running-config ip local pool
show running-config ip verify reverse-path
show running-config mac-address-table
show running-config management-access
show running-config multicast-routing
show running-config nat-control
show running-config object-group
show running-config policy-map
show running-config port-forward
show running-config prefix-list
show running-config priority-queue
show running-config same-security-traffic
show running-config service-policy
show running-configuration smtps
show running-config snmp-server
show running-config sunrpc-server
show running-config tftp-server
show running-config tunnel-group
show running-configuration url-list
show running-config url-server
show running-config vpn load-balancing
show running-configuration vpn-sessiondb
show running-configuration webvpn
show service-policy inspect gtp
snmp-server enable trap remote-access
subject-name (crypto ca certificate map)
subject-name (crypto ca trustpoint)
sysopt connection permit-ipsec
S Commands
same-security-traffic
To permit communication between interfaces with equal security levels, use the same-security-traffic command in global configuration mode. To disable the same-security interfaces, use the no forms of this command.
same-security-traffic permit {inter-interface | intra-interface}
no same-security-traffic permit {inter-interface | intra-interface}
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Allowing communication between same security interfaces provides the following benefits:
•
•
You can also redirect incoming client VPN traffic back out through the same interface unencrypted as well as encrypted. If you send VPN traffic back out through the same interface unencrypted, you must enable NAT for the interface so that publically routable addresses replace your private ip addresses (unless you already use public ip addresses in your local ip address pool). The following example commands apply an interface PAT rule to traffic sourced from the client ip pool:
hostname(config)# ip local pool clientpool 192.168.0.10-192.168.0.100
hostname(config)# global (outside) 1 interface
hostname config)# nat (outside) 1 192.168.0.0 255.255.255.0
When the security appliance sends encrypted VPN traffic back out this same interface, however, NAT is optional. To apply NAT to all outgoing traffic, implement only the commands above. To exempt the VPN-to-VPN traffic from NAT, add commands (to the example above) that implement NAT exemption for VPN-to-VPN traffic, such as:hostname(config)# access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0 hostname(config)# nat (outside) 0 access-list nonatSee the nat command for more information.
Examples
The following example shows how to enable the same-security interface communication:
hostname(config)# same-security-traffic permit inter-interfaceRelated Commands
show running-config same-security-traffic
Displays the same-security-traffic configuration.
sdi-pre-5-slave
To specify the IP address or name of an optional SDI AAA "slave" server to use for this host connection that uses a version of SDI prior to SDI version 5, use the sdi-pre-5-slave command in AAA-server host configuration mode. To remove this specification, use the no form of this command:
sdi-pre-5-slave host
no sdi-pre-5-slave
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server Host
•
•
•
•
—
Command History
Usage Guidelines
This command is available for any host in an SDI AAA servergroup, but it is relevant only if the SDI version for the host is set to sdi-pre-5 in the sdi-version command. Prior to using this command, you must have configured the AAA server to use the SDI protocol.
The sdi-pre-5-slave command lets you identify an optional secondary server that is to be used if the primary server fails. The address specified by this command must be that of a server that is configured as a "slave" to the primary SDI server. In this situation, if you are using a pre-5 version, you must configure the sdi-pre-5-slave command so that the security appliance can access the appropriate SDI configuration record that is downloaded from the server. This is not an issue with version 5 and later versions.
Examples
The following example configures the AAA SDI server group "svrgrp1" that uses an SDI version prior to SDI version 5.
hostname(config)# aaa-server svrgrp1 protocol sdihostname(config-aaa-server-group)# aaa-server svrgrp1 host 192.168.10.10hostname(config-aaa-server-host)# sdi-version sdi-pre-5hostname(config-aaa-server-host)# sdi-pre-5-slave 209.165.201.31hostname(config-aaa-server-host)# exithostname(config)#Related Commands
sdi-version
To specify the version of SDI to use for this host connection, use the sdi-version command in AAA-server host configuration mode. To remove this specification, use the no form of this command:
sdi-version version
no sdi-version
Syntax Description
version
Specify the version of SDI to use.Valid values are:
sdi-5 - SDI version 5.0 (default)
sdi-pre-5 - SDI versions prior to 5.0
Defaults
The default version is sdi-5.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server host
•
•
•
•
—
Command History
Usage Guidelines
This command is valid only for SDI AAA servers. If you configure a secondary (failover) SDI AAA server, and if the SDI version for that server is earlier than version 5, you must also specify the sdi-pre-5-slave command
Examples
hostname(config)# aaa-server svrgrp1 protocol sdihostname(config-aaa-server-group)# aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)# timeout 6hostname(config-aaa-server-host)# retry-interval 7hostname(config-aaa-server-host)# sdi-version sdi-5hostname(config-aaa-server)# exithostname(config)#Related Commands
secondary
To give the secondary unit higher priority in a failover group, use the secondary command in failover group configuration mode. To restore the default, use the no form of this command.
secondary
no secondary
Syntax Description
This command has no arguments or keywords.
Defaults
If primary or secondary is not specified for a failover group, the failover group defaults to primary.
Command Modes
The following table shows the modes in which you can enter the command:
Failover group configuration
•
•
—
—
•
Command History
Usage Guidelines
Assigning a primary or secondary priority to a failover group specifies which unit the failover group becomes active on when both units boot simulataneously (within a unit polltime). If one unit boots before the other, then both failover groups become active on that unit. When the other unit comes online, any failover groups that have the second unit as a priority do not become active on the second unit unless the failover group is configured with the preempt command or is manually forced to the other unit with the no failover active command.
Examples
The following example configures failover group 1 with the primary unit as the higher priority and failover group 2 with the secondary unit as the higher priority. Both failover groups are configured with the preempt command, so the groups will automatically become active on their preferred unit as the units become available.
hostname(config)# failover group 1hostname(config-fover-group)# primaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# exithostname(config)# failover group 2hostname(config-fover-group)# secondaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# mac-address e1 0000.a000.a011 0000.a000.a012hostname(config-fover-group)# exithostname(config)#Related Commands
secondary-color
To set a secondary color for the WebVPN login, home page, and file access page, use the secondary-color command in webvpn mode. To remove a color from the configuration and reset the default, use the no form of this command.
secondary-color [color]
no secondary-color
Syntax Description
Defaults
The default secondary color is HTML #CCCCFF, a lavender shade.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
•
—
—
•
Command History
Usage Guidelines
The number of RGB values recommended for use is 216, many fewer than the mathematical possibilities. Many displays can handle only 256 colors, and 40 of those look differently on MACs and PCs. For best results, check published RGB tables. To find RGB tables online, enter RGB in a search engine.
Examples
The following example shows how to set an HTML color value of #5F9EAO, which is a teal shade:
hostname(config)# webvpnhostname(config-webvpn)# secondary-color #5F9EAORelated Commands
title-color
Sets a color for the WebVPN title bar on the login, home page, and file access page
secondary-color
To set a secondary color for the WebVPN login, home page, and file access page, use the secondary-color command in webvpn mode. To remove a color from the configuration and reset the default, use the no form of this command.
secondary-color [color]
no secondary-color
Syntax Description
Defaults
The default secondary color is HTML #CCCCFF, a lavender shade.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
•
—
—
•
Command History
Usage Guidelines
The number of RGB values recommended for use is 216, many fewer than the mathematical possibilities. Many displays can handle only 256 colors, and 40 of those look differently on MACs and PCs. For best results, check published RGB tables. To find RGB tables online, enter RGB in a search engine.
Examples
The following example shows how to set an HTML color value of #5F9EAO, which is a teal shade:
hostname(config)# webvpnhostname(config-webvpn)# secondary-color #5F9EAORelated Commands
title-color
Sets a color for the WebVPN title bar on the login, home page, and file access page
secure-unit-authentication
To enable secure unit authentication, use the secure-unit-authentication enable command in group-policy configuration mode. To disable secure unit authentication, use the secure-unit-authentication disable command. To remove the secure unit authentication attribute from the running configuration, use the no form of this command. This option allows inheritance of a value for secure unit authentication from another group policy.
Secure unit authentication provides additional security by requiring VPN hardware clients to authenticate with a username and password each time the client initiates a tunnel. With this feature enabled, the hardware client does not have a saved username and password.
Note
secure-unit-authentication {enable | disable}
no secure-unit-authentication
Syntax Description
Defaults
Secure unit authentication is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group policy
•
—
•
—
—
Command History
Usage Guidelines
Secure unit authentication requires that you have an authentication server group configured for the tunnel group the hardware client(s) use.
If you require secure unit authentication on the primary security appliance, be sure to configure it on any backup servers as well.
Examples
The following example shows how to enable secure unit authentication for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# secure-unit-authentication enableRelated Commands
security-level
To set the security level of an interface, use the security-level command in interface configuration mode. To set the security level to the default, use the no form of this command. The security level protects higher security networks from lower security networks by imposing additional protection between the two.
security-level number
no security-level
Syntax Description
Defaults
By default, the security level is 0.
If you name an interface "inside" and you do not set the security level explicitly, then the security appliance sets the security level to 100 (see the nameif command). You can change this level if desired.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
—
Command History
7.0
This command was moved from a keyword of the nameif command to an interface configuration mode command.
Usage Guidelines
The level controls the following behavior:
•
For same security interfaces, there is an implicit permit for interfaces to access other interfaces on the same security level or lower.
•
–
–
•
For same security interfaces, you can filter traffic in either direction.
•
Without NAT control, or for same security interfaces, you can choose to use NAT between any interface, or you can choose not to use NAT. Keep in mind that configuring NAT for an outside interface might require a special keyword.
•
For same security interfaces, you can configure established commands for both directions.
Normally, interfaces on the same security level cannot communicate. If you want interfaces on the same security level to communicate, see the same-security-traffic command. You might want to assign two interfaces to the same level and allow them to communicate if you want to create more than 101 communicating interfaces, or you want protection features to be applied equally for traffic between two interfaces; for example, you have two departments that are equally secure.
If you change the security level of an interface, and you do not want to wait for existing connections to time out before the new security information is used, you can clear the connections using the clear local-host command.
Examples
The following example configures the security levels for two interfaces to be 100 and 0:
hostname(config)# interface gigabitethernet0/0hostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownhostname(config-if)# interface gigabitethernet0/1hostname(config-if)# nameif outsidehostname(config-if)# security-level 0hostname(config-if)# ip address 10.1.2.1 255.255.255.0hostname(config-if)# no shutdownRelated Commands
serial-number
To include the security appliance serial number in the certificate during enrollment, use the serial-number command in crypto ca trustpoint configuration mode. To restore the default setting, use the no form of the command.
serial-number
no serial-number
Syntax Description
Defaults
The default setting is to not include the serial number.
Command Modes
The following table shows the modes in which you can enter the command
Crypto ca trustpoint configuration
•
•
•
•
•
:
Command History
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and includes the security appliance serial number in the enrollment request for trustpoint central:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# serial-numberhostname(ca-trustpoint)#Related Commands
server
To specify a default e-mail proxy server, use the server command in the applicable e-mail proxy mode. To remove the attribute from the configuration, use the no version of this command. The security appliance sends requests to the default e-mail server when the user connects to the e-mail proxy without specifying a server. If you do not configure a default server, and a user does not specify a server, the security appliance returns an error.
server {ipaddr or hostname}
no server
Syntax Description
hostname
The DNS name of the default e-mail proxy server.
ipaddr
The IP address of the default e-mail proxy server.
Defaults
There is no default e-mail proxy server by default.
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
•
—
—
•
Imap4s
•
•
—
—
•
Smtps
•
•
—
—
•
Command History
Examples
The following example shows how to set a default POP3S e-mail server with an IP address. of 10.1.1.7:
hostname(config)# pop3shostname(config-pop3s)# server 10.1.1.7
server-port
To configure a AAA server port for a host, use the server-port command in AAA-server host mode. To remove the designated server port, use the no form of this command:
server-port port-number
no server-port
Syntax Description
Defaults
The default server ports are as follows:
•
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server group
•
•
•
•
—
Command History
Examples
The following example configures an SDI AAA server named "srvgrp1" to use server port number 8888:
hostname(config)# aaa-server srvgrp1 protocol sdihostname(config-aaa-server-group)# aaa-server srvgrp1 host 192.168.10.10hostname(config-aaa-server-host)# server-port 8888hostname(config-aaa-server-host)# exithostname(config)#Related Commands
server-separator
To specify a character as a delimiter between the e-mail and VPN server names, use server-separator command in the applicable e-mail proxy mode. To revert to the default, ":", use the no form of this command.
server-separator {symbol}
no server-separator
Syntax Description
symbol
The character that separates the e-mail and VPN server names. Choices are "@," (at) "|" (pipe), ":"(colon), "#" (hash), "," (comma), and ";" (semi-colon).
Defaults
The default is "@" (at).
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
—
•
—
—
Imap4s
•
—
•
—
—
Smtps
•
—
•
—
—
Command History
Usage Guidelines
The server separator must be different from the name separator.
Examples
The following example shows how to set a pipe (|) as the server separator for IMAP4S:
hostname(config)# imap4shostname(config-imap4s)# server-separator |Related Commands
service
To enable system services, use the service command in global configuration mode. To disable system services, use the no form of this command.
service {resetinbound | resetoutbound} [interface intf]
no service {resetinbound | resetoutbound}[interface intf]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Preexisting
This command was preexisting.
7.0(5)
This command was modified to include the interface keyword.
Usage Guidelines
The service command works with all inbound TCP connections to static interfaces whose access lists or uauth (user authorization) do not allow inbound connections. One use is for resetting identity request (IDENT) connections. If an inbound TCP connection is attempted and denied, you can use the service resetinbound command to return an RST (reset flag in the TCP header) to the source. Without the keyword, the security appliance drops the packet without returning an RST.
By default a RST is always sent to the inside host when outbound TCP traffic is denied. The keyword resetoutbound is used to change this default. For example, if traffic is outbound through the security appliance, and the no service resetoutbound command is configured globally or on that interface, we do not send RST.
With the optional interface keyword, the TCP reset is sent only when outbound packets are denied on that interface.
The security appliance sends a TCP RST to the host connecting inbound and stops the incoming IDENT process so that outbound e-mail can be transmitted without having to wait for IDENT to time out. The security appliance sends a syslog message stating that the incoming connection was denied. Without entering the service resetinbound command, the security appliance drops packets that are denied and generates a syslog message stating that the SYN was denied. However, outside hosts keep retransmitting the SYN until the IDENT times out.
When an IDENT connection times out, the connections slow down. Perform a trace to determine that IDENT is causing the delay and then enter the service command.
Use the service resetinbound command to handle an IDENT connection through the security appliance. These methods for handling IDENT connections are ranked from most secure to the least secure:
1.
2.
3.
When using the aaa command, if the first attempt at authorization fails and a second attempt causes a timeout, use the service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is as follows:
Unable to connect to remote host: Connection timed outThe following is the expected behavior of traffic on the security appliance in regards to the reset flag.
1.
2.
3.
If you use the resetoutside command, the security appliance actively resets denied TCP packets that terminate at the security appliances least-secure interface. By default, these packets are silently discarded. We recommend that you use the resetoutside keyword with dynamic or static interface Port Address Translation (PAT). The static interface PAT is available with security appliance version 6.0 and higher. This keyword allows the security appliance to terminate the IDENT from an external SMTP or FTP server. Actively resetting these connections avoids the 30-second timeout delay.
Examples
The following example shows how to enable system services:
hostname/context_name(config)# service resetinboundThis example shows how to enable system services on an interface called dmz1:
hostname/context_name(config)# service resetinbound interface dmz1Related Commands
service password-recovery
To enable password recovery, use the service password-recovery command in global configuration mode. To disable password recovery, use the no form of this command. Password recovery is enabled by default, but you might want to disable it to ensure that unauthorized users cannot use the password recovery mechanism to compromise the security appliance.
service password-recovery
no service password-recovery
Syntax Description
This command has no arguments or keywords.
Defaults
Password recovery is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
•
Command History
Usage Guidelines
On the ASA 5500 series adaptive security appliance, if you forget the passwords, you can boot the security appliance into ROMMON by pressing the Escape key on the terminal keyboard when prompted during startup. Then set the security appliance to ignore the startup configuration by changing the configuration register (see the config-register command). For example if your configuration register is the default 0x1, then change the value to 0x41 by entering the confreg 0x41 command. After reloading the security appliance, it loads a default configuration, and you can enter privileged EXEC mode using the default passwords. Then load the startup configuration by copying it to the running configuration and reset the passwords. Finally, set the security appliance to boot as before by setting the configuration register to the original setting. For example, enter the config-register 0x1 command in global configuration mode.
On the PIX 500 series security appliance, boot the security appliance into monitor mode by pressing the Escape key on the terminal keyboard when prompted during startup. Then download the PIX password tool to the security appliance, which erases all passwords and aaa authentication commands.
On the ASA 5500 series adaptive security appliance, the no service password-recovery command prevents a user from entering ROMMON with the configuration intact. When a user enters ROMMON, the security appliance prompts the user to erase all Flash file systems. The user cannot enter ROMMON without first performing this erasure. If a user chooses not to erase the Flash file system, the security appliance reloads. Because password recovery depends on using ROMMON and maintaining the existing configuration, this erasure prevents you from recovering a password. However, disabling password recovery prevents unauthorized users from viewing the configuration or inserting different passwords. In this case, to recover the system to an operating state, load a new image and a backup configuration file, if available. The service password-recovery command appears in the configuration file for informational purposes only; when you enter the command at the CLI prompt, the setting is saved in NVRAM. The only way to change the setting is to enter the command at the CLI prompt. Loading a new configuration with a different version of the command does not change the setting. If you disable password recovery when the security appliance is configured to ignore the startup configuration at startup (in preparation for password recovery), then the security appliance changes the setting to boot the startup configuration as usual. If you use failover, and the standby unit is configured to ignore the startup configuration, then the same change is made to the configuration register when the no service password recovery command replicates to the standby unit.
On the PIX 500 series security appliance, the no service password-recovery command forces the PIX password tool to prompt the user to erase all Flash file systems. The user cannot use the PIX password tool without first performing this erasure. If a user chooses not to erase the Flash file system, the security appliance reloads. Because password recovery depends on maintaining the existing configuration, this erasure prevents you from recovering a password. However, disabling password recovery prevents unauthorized users from viewing the configuration or inserting different passwords. In this case, to recover the system to an operating state, load a new image and a backup configuration file, if available.
Examples
The following example disables password recovery for the ASA 5500 series adaptive security appliance:
hostname(config)# no service password-recoveryWARNING: Executing "no service password-recovery" has disabled the password recovery mechanism and disabled access to ROMMON. The only means of recovering from lost or forgotten passwords will be for ROMMON to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the ROMMON command line.The following example disables password recovery for the PIX 500 series security appliance:
hostname(config)# no service password-recoveryWARNING: Saving "no service password-recovery" in the startup-config will disable password recovery via the npdisk application. The only means of recovering from lost or forgotten passwords will be for npdisk to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the Monitor Mode command line.The following example for the ASA 5500 series adaptive security appliance shows when to enter ROMMON at startup and how to complete a password recovery operation.
Use BREAK or ESC to interrupt boot.Use SPACE to begin boot immediately.Boot interrupted.Use ? for help.rommon #0> confregCurrent Configuration Register: 0x00000001Configuration Summary:boot default image from FlashDo you wish to change this configuration? y/n [n]: nrommon #1> confreg 0x41Update Config Register (0x41) in NVRAM...rommon #2> bootLaunching BootLoader...Boot configuration file contains 1 entry.Loading disk0:/ASA_7.0.bin... Booting...###################...Ignoring startup configuration as instructed by configuration register.Type help or '?' for a list of available commands.hostname> enablePassword:hostname# configure terminalhostname(config)# copy startup-config running-configDestination filename [running-config]?Cryptochecksum(unchanged): 7708b94c e0e3f0d5 c94dde05 594fbee9892 bytes copied in 6.300 secs (148 bytes/sec)hostname(config)# enable password NewPasswordhostname(config)# config-register 0x1Related Commands
config-register
Sets the security appliance to ignore the startup configuration when it reloads.
enable password
Sets the enable password.
password
Sets the login password.
service-policy
To activate a policy map globally on all interfaces or on a targeted interface, use the service-policy command in privileged EXEC mode. To disable, use the no form of this command. Use the service-policy command to enable a set of policies on an interface. In general, a service-policy command can be applied to any interface that can be defined by the nameif command.
service-policy policymap_name [ global | interface intf ]
no service-policy policymap_name [ global | interface intf ]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
If an interface name is specified, the policy-map only applies to the interface. The interface name is defined in the nameif command, and an interface policy-map overrides a global policy-map. Only one policy-map is allowed per interface.
Only one global policy is allowed.
Examples
The following example shows the syntax of the service-policy command:
hostname(config)# service-policy outside_security_map outsideRelated Commands
session
To establish a Telnet session to an AIP SSM, use the session command in privileged EXEC mode.
session 1
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
This command is only available when the AIP SSM is in the Up state. See the show module command for state information.
To end a session, enter exit or Ctrl-Shift-6 then the X key.
Examples
The following example sessions to an SSM in slot 1:
hostname# session 1Opening command session with slot 1.Connected to slot 1. Escape character sequence is 'CTRL-^X'.Related Commands
set connection
To specify connection values within a policy-map for a traffic class, use the set connection command in class mode. Use this command to specify the maximum number of simultaneous connections and to specify whether to enable or disable TCP sequence number randomization. To remove these specifications, thereby allowing unlimited connections, use the no form of this command.
set connection {conn-max | embryonic-conn-max} n random-seq# {enable | disable}
no set connection {conn-max | embryonic-conn-max} n random-seq# {enable | disable}
Syntax Description
Defaults
For both the conn-max and embryonic-conn-max parameters, the default value of n is 0, which allows unlimited connections.
Sequence number randomization is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command before issuing this command.
Note
When a traffic class is subject to a connection limit or embryonic connection limit from both the MPC set connection command and the nat/static command, then whichever limit is reached, that limit is applied.
When a TCP traffic class is configured to have sequence number randomization disabled by either the MPC set connection command or the nat/static command, then sequence number randomization is disabled.Examples
The following is an example of the use of the set connection command in class mode to configure the maximum number of simultaneous connections as 256 and to disable TCP sequence number randomization:
hostname(config)# policy-map localpolicy1hostname(config-pmap)# class local_serverhostname(config-pmap-c)# set connection conn-max 256 random-seq# disablehostname(config-pmap-c)# exitRelated Commands
set connection advanced-options
To specify advanced TCP connection options within a policy-map for a traffic class, use the set connection advanced-options command in class mode. To remove advanced TCP connection options for a traffic class within a policy map, use the no form of this command.
set connection advanced-options tcp-mapname
no set connection advanced-options tcp-mapname
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command, as well as the TCP map name, before issuing this command. See the description of the tcp-map command for detailed information.
Examples
The following example shows the use of the set connection advanced-options command to specify the use of a TCP map named localmap:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1hostname(config)# class-map http-serverhostname(config-cmap)# match access-list http-serverhostname(config-cmap)# exithostname(config)# tcp-map localmaphostname(config)# policy-map global_policy globalhostname(config-pmap)# description This policy map defines a policy concerning connection to http server.hostname(config-pmap)# class http-serverhostname(config-pmap-c)# set connection advanced-options localmapRelated Commands
set connection timeout
To configure the timeout period, after which an idle TCP connection is disconnected, use the set connection timeout command in class mode. To remove the timeout, use the no form of this command.
set connection timeout tcp hh[:mm[:ss]] [reset]
no set connection timeout tcp
set connection timeout embryonic hh[:mm[:ss]]
no set connection timeout embryonic
set connection timeout half-closed hh[:mm[:ss]]
no set connection timeout half-closed
Syntax Description
Defaults
The default embryonic connection timeout value is 30 seconds.
The default half-closed connection timeout value is 10 minutes.
The default tcp connection timeout value is 1 hour.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command before issuing this command.
A TCP connection for which a three-way handshake is not complete is an embryonic connection. For the embryonic connection timeout value, use 0:0:0 to specify that the connection never times out. Otherwise, the timeout duration must be at least 5 seconds.
When the TCP connection is in the closing state, use the half-closed parameter to configure the length of time until the connection is freed. Use 0:0:0 to specify that the connection never times out. The minimum timeout duration is 5 minutes.
The tcp inactive connection timeout configures the period after which an idle TCP connection in the established state is disconnected. Use 0:0:0 to specify that the connection never times out. The minimum timeout duration is 5 minutes.
The reset keyword is used to send a TCP RST packet to both end systems once an idle TCP connection has timed out. Some applications require a TCP RST after a timeout to perform properly.
Examples
The following is an example of a set connection timeout command that specifies an embryonic connection timeout of two minutes:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1hostname(config)# class-map http-serverhostname(config-cmap)# match access-list http-serverhostname(config-cmap)# exithostname(config)# policy-map global_policy globalhostname(config-pmap)# description This policy map defines a policy concerning connection to http server.hostname(config-pmap)# class http-serverhostname(config-pmap-c)# set connection timeout embryonic 00:2:00Related Commands
set metric
To set the metric value for a routing protocol, use the set metric command in route-map configuration mode. To return to the default metric value, use the no form of this command.
set metric value
no set metric value
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
—
—
Command History
Usage Guidelines
The no set metric value command allows you to return to the default metric value. In this context, the value is an integer from 0 to 4294967295.
Examples
The following example shows how to configure a route map for OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# show route-maproute-map maptag1 permit 8set metric 5match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
set metric-type
To specify the type of OSPF metric routes, use the set metric-type command in route-map configuration mode. To return to the default setting, use the no form of this command.
set metric-type {type-1 | type-2}
no set metric-type
Syntax Description
type-1
Specifies the type of OSPF metric routes that are external to a specified autonomous system.
type-2
Specifies the type of OSPF metric routes that are external to a specified autonomous system.
Defaults
The default is type-2.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
—
—
Command History
Examples
The following example shows how to configure a route map for OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# set metric-type type-2hostname(config-route-map)# show route-maproute-map maptag1 permit 8set metric 5set metric-type type-2match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
setup
To configure a minimal configuration for the security appliance using interactive prompts, enter the setup command in global configuration mode. This configuration provides connectivity to use ASDM. See also the configure factory-default command to restore the default configuration.
setup
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The setup dialog automatically appears at boot time if there is no startup configuration in Flash memory.
Before you can use the setup command, you must have an inside interface already configured. The PIX 500 series default configuration includes an inside interface (Ethernet 1), but the ASA 550 series default configuration does not. Before using the setup command, enter the interface command for the interface you want to make inside, and then the nameif inside command.
In multiple context mode, you can use the setup command in the system execution space and for each context.
When you enter the setup command, you are asked for the information in Table 7-1. The system setup command includes a subset of these prompts. If there is already a configuration for the prompted parameter, it appears in barckets so you can either accept it as the default or override it by entering something new.
Examples
This example shows how to complete the setup command prompts:
hostname(config)# setupPre-configure Firewall now through interactive prompts [yes]? yesFirewall Mode [Routed]: routedEnable password [<use current password>]: writerAllow password recovery [yes]? yesClock (UTC):Year: 2005Month: NovDay: 15Time: 10:0:0Inside IP address: 192.168.1.1Inside network mask: 255.255.255.0Host name: tech_pubsDomain name: your_company.comIP address of host running Device Manager: 10.1.1.1The following configuration will be used:Enable password: writerAllow password recovery: yesClock (UTC): 20:54:44 Sep 17 2005Firewall Mode: RoutedInside IP address: 192.168.1.1Inside network mask: 255.255.255.0Host name: tech_pubsDomain name: your_company.comIP address of host running Device Manager: 10.1.1.1Use this configuration and write to flash? yesRelated Commands
show aaa local user
To show the list of usernames that are currently locked, or to show details about the username, use the show aaa local user command in global configuration mode.
show aaa local user [locked]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you omit the optional keyword locked, the security appliance displays the failed-attempts and lockout status details for all AAA local users.
You can specify a single user by using the username option or all users with the all option.
This command affects only the status of users that are locked out.
The administrator cannot be locked out of the device.
Examples
The following example shows use of the show aaa local user command to display the lockout status of all usernames:
This example shows the use of the show aaa local user command to display the number of failed authentication attempts and lockout status details for all AAA local users, after the limit has been set to 5:
hostname(config)# aaa local authentication attempts max-fail 5hostname(config)# show aaa local userLock-time Failed-attempts Locked User- 6 Y test- 2 N mona- 1 N cisco- 4 N newuserhostname(config)#This example shows the use of the show aaa local user command with the lockout keyword to display the number of failed authentication attempts and lockout status details only for any locked-out AAA local users, after the limit has been set to 5:
hostname(config)# aaa local authentication attempts max-fail 5hostname(config)# show aaa local userLock-time Failed-attempts Locked User- 6 Y testhostname(config)#Related Commands
show aaa-server
To display AAA server statistics for AAA servers, use the show aaa-server command in privileged EXEC mode:
show aaa-server [LOCAL | groupname [host hostname] | protocol protocol]
Syntax Description
Defaults
By default, all AAA server statistics display.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
This example shows the use of the show aaa-server command to display statistics for a particular host in server group group1:
hostname(config)# show aaa-server group1 host 192.68.125.60Server Group: group1Server Protocol: RADIUSServer Address: 192.68.125.60Server port: 1645Server status: ACTIVE/FAILED. Last transaction (success) at 11:10:08 UTC Fri Aug 22Number of pending requests 20Average round trip time 4msNumber of authentication requests 20Number of authorization requests 0Number of accounting requests 0Number of retransmissions 1Number of accepts 16Number of rejects 4Number of challenges 5Number of malformed responses 0Number of bad authenticators 0Number of pending requests 0Number of timeouts 0Number of unrecognized responses 0hostname(config)#This example shows the use of the show aaa-server command to show the statistics for all servers in a small, inactive system:
hostname(config)# show aaa-serverServer Group: LOCALServer Protocol: Local databaseServer Address: NoneServer port: NoneServer status: ACTIVE, Last transaction at unknownNumber of pending requests 0Average round trip time 0msNumber of authentication requests 0Number of authorization requests 0Number of accounting requests 0Number of retransmissions 0Number of accepts 0Number of rejects 0Number of challenges 0Number of malformed responses 0Number of bad authenticators 0Number of timeouts 0Number of unrecognized responses 0hostname(config)#Related Commands
show running-config aaa-server
Display statistics for all servers in the indicated server group or for a particular server.
clear aaa-server statistics
Clear the AAA server statistics.
show access-list
To display the counters for an access list, use the show access-list command in privileged EXEC mode.
show access-list id
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show access-list command:
hostname# show access-list acaccess-list ac; 2 elementsaccess-list ac line 1 permit ip any any (hitcnt=0)access-list ac line 2 permit tcp any any (hitcnt=0)Related Commands
show activation-key
To display the commands in the configuration for features that are enabled by your activation key, including the number of contexts allowed, use the show activation-key command in privileged EXEC mode.
show activation-key
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
PIX Version 7.0
Support for this command was introduced on the security appliance.
Usage Guidelines
The show activation-key command output indicates the status of the activation key as follows:
•
The flash activation key is the SAME as the running key.•
The flash activation key is DIFFERENT from the running key.The flash activation key takes effect after the next reload.•
•
•
Examples
This example shows how to display the commands in the configuration for features that are enabled by your activation key:
hostname(config)# show activation-keySerial Number: P3000000134 Running Activation Key: 0xyadayada 0xyadayada 0xyadayada 0xyadayada 0xyadayadaLicense Features for this Platform:Maximum Physical Interfaces : UnlimitedMaximum VLANs : 50Inside Hosts : UnlimitedFailover : EnabledVPN-DES : EnabledVPN-3DES-AES : DisabledCut-through Proxy : EnabledGuards : EnabledURL-filtering : EnabledSecurity Contexts : 20GTP/GPRS : DisabledVPN Peers : 5000The flash activation key is the SAME as the running key.hostname(config)#Related Commands
show admin-context
To display the context name currently assigned as the admin context, use the show admin-context command in privileged EXEC mode.
show admin-context
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following is sample output from the show admin-context command. The following example shows the admin context called "admin" and stored in the root directory of flash:
hostname# show admin-contextAdmin: admin flash:/admin.cfgRelated Commands
show arp
To view the ARP table, use the show arp command in privileged EXEC mode.
show arp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The display output shows dynamic, static, and proxy ARP entries. Dynamic ARP entries include the age of the ARP entry in seconds. Static ARP entries include a dash (-) instead of the age, and proxy ARP entries state "alias."
Examples
The following is sample output from the show arp command. The first entry is a dynamic entry aged 2 seconds. The second entry is a static entry, and the third entry is from proxy ARP.
hostname# show arpoutside 10.86.194.61 0011.2094.1d2b 2outside 10.86.194.1 001a.300c.8000 -outside 10.86.195.2 00d0.02a8.440a aliasRelated Commands
show arp-inspection
To view the ARP inspection setting for each interface, use the show arp-inspection command in privileged EXEC mode.
show arp-inspection
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show arp-inspection command:
hostname# show arp-inspectioninterface arp-inspection miss----------------------------------------------------inside1 enabled floodoutside disabled -The miss column shows the default action to take for non-matching packets when ARP inspection is enabled, either "flood" or "no-flood."
Related Commands
show arp statistics
To view ARP statistics, use the show arp statistics command in privileged EXEC mode.
show arp statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show arp statistics command:
hostname# show arp statisticsNumber of ARP entries:ASA : 6Dropped blocks in ARP: 6Maximum Queued blocks: 3Queued blocks: 1Interface collision ARPs Received: 5ARP-defense Gratuitous ARPS sent: 4Total ARP retries: 15Unresolved hosts: 1Maximum Unresolved hosts: 2Table 2 shows each field description.
Related Commands
show asdm history
To display the contents of the ASDM history buffer, use the show asdm history command in privileged EXEC mode.
show asdm history [view timeframe] [snapshot] [feature feature] [asdmclient]
Syntax Description
Defaults
If no arguments or keywords are specified, all history information for all features is displayed.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0
This command was changed from the show pdm history command to the show asdm history command.
Usage Guidelines
The show asdm history command displays the contents of the ASDM history buffer. Before you can view ASDM history information, you must enable ASDM history tracking using the asdm history enable command.
Examples
The following is sample output from the show asdm history command. It limits the output to data for the outside interface collected during the last 10 minutes.
hostname# show asdm history view 10m feature interface outsideInput KByte Count:[ 10s:12:46:41 Mar 1 2005 ] 62640 62636 62633 62628 62622 62616 62609Output KByte Count:[ 10s:12:46:41 Mar 1 2005 ] 25178 25169 25165 25161 25157 25151 25147Input KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 752 752 751 751 751 751 751Output KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 55 55 55 55 55 55 55Input Bit Rate:[ 10s:12:46:41 Mar 1 2005 ] 3397 2843 3764 4515 4932 5728 4186Output Bit Rate:[ 10s:12:46:41 Mar 1 2005 ] 7316 3292 3349 3298 5212 3349 3301Input Packet Rate:[ 10s:12:46:41 Mar 1 2005 ] 5 4 6 7 6 8 6Output Packet Rate:[ 10s:12:46:41 Mar 1 2005 ] 1 0 0 0 0 0 0Input Error Packet Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0No Buffer:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Received Broadcasts:[ 10s:12:46:41 Mar 1 2005 ] 375974 375954 375935 375902 375863 375833 375794Runts:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Giants:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0CRC:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Frames:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Overruns:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Underruns:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Output Error Packet Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Collisions:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0LCOLL:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Reset:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Deferred:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Lost Carrier:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Hardware Input Queue:[ 10s:12:46:41 Mar 1 2005 ] 128 128 128 128 128 128 128Software Input Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Hardware Output Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Software Output Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Drop KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0hostname#The following is sample output from the show asdm history command. Like the previous example, it limits the output to data for the outside interface collected during the last 10 minutes. However, in this example the output is formatted for the ASDM client.
hostname# show asdm history view 10m feature interface outside asdmclientMH|IBC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|62439|62445|62453|62457|62464|6 2469|62474|62486|62489|62496|62501|62506|62511|62518|62522|62530|62534|62539|62542|62547|6 2553|62556|62562|62568|62574|62581|62585|62593|62598|62604|62609|62616|62622|62628|62633|6 2636|62640|62653|62657|62665|62672|62678|62681|62686|62691|62695|62700|62704|62711|62718|6 2723|62728|62733|62738|62742|62747|62751|62761|62770|62775|MH|OBC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|25023|25023|25025|25025|25025|2 5026|25026|25032|25038|25044|25052|25056|25060|25064|25070|25076|25083|25087|25091|25096|2 5102|25106|25110|25114|25118|25122|25128|25133|25137|25143|25147|25151|25157|25161|25165|2 5169|25178|25321|25327|25332|25336|25341|25345|25349|25355|25359|25363|25367|25371|25375|2 5381|25386|25390|25395|25399|25403|25410|25414|25418|25422|MH|IPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|749|749|749|749|749|750|750|750 |750|750|750|750|750|750|750|750|750|750|750|750|751|751|751|751|751|751|751|751|751|751|7 51|751|751|751|751|752|752|752|752|752|752|752|752|752|752|752|752|752|752|753|753|753|753 |753|753|753|753|753|753|753|MH|OPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|55|55|55|55|55|55|55|55|55|55|5 5|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|5 5|55|55|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|MH|IBR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|7127|5155|6202|3545|5408|3979|4 381|9492|3033|4962|4571|4226|3760|5923|3265|6494|3441|3542|3162|4076|4744|2726|4847|4292|5 401|5166|3735|6659|3837|5260|4186|5728|4932|4515|3764|2843|3397|10768|3080|6309|5969|4472| 2780|4492|3540|3664|3800|3002|6258|5567|4044|4059|4548|3713|3265|4159|3630|8235|6934|4298|MH|OBR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|82791|57|1410|588|57|639|0|4698 |5068|4992|6495|3292|3292|3352|5061|4808|5205|3931|3298|3349|5064|3439|3356|3292|3343|3349 |5067|3883|3356|4500|3301|3349|5212|3298|3349|3292|7316|116896|5072|3881|3356|3931|3298|33 49|5064|3292|3349|3292|3292|3349|5061|3883|3356|3931|3452|3356|5064|3292|3349|3292|MH|IPR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|12|8|6|5|7|5|6|14|5|7|7|5|6|9|5 |8|6|5|5|7|6|5|6|5|6|7|6|8|6|6|6|8|6|7|6|4|5|19|5|8|7|6|4|7|5|6|6|5|7|8|6|6|7|5|5|7|6|9|7| 6|MH|OPR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|12|0|1|0|0|0|0|4|0|2|2|0|0|0|0| 1|1|0|0|0|0|0|0|0|0|0|0|0|0|1|0|0|0|0|0|0|1|28|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |MH|IERR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|NB|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|RB|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|374874|374911|374943|374967|3750 10|375038|375073|375113|375140|375160|375181|375211|375243|375289|375316|375350|375373|375 395|375422|375446|375481|375498|375535|375561|375591|375622|375654|375701|375738|375761|37 5794|375833|375863|375902|375935|375954|375974|375999|376027|376075|376115|376147|376168|3 76200|376224|376253|376289|376315|376365|376400|376436|376463|376508|376530|376553|376583| 376614|376668|376714|376749|MH|RNT|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|GNT|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|CRC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|FRM|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|OR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|UR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|OERR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|COLL|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|LCOLL|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |MH|RST|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|DEF|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|LCR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|HIQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|128|128|128|128|128|128|128|128 |128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|1 28|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128 |128|128|128|128|128|128|128|MH|SIQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|HOQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|SOQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|DPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|hostname#The following is sample output from the show asdm history command using the snapshot keyword:
hostname# show asdm history view 10m snapshotAvailable 4 byte Blocks: [ 10s] : 100Used 4 byte Blocks: [ 10s] : 0Available 80 byte Blocks: [ 10s] : 100Used 80 byte Blocks: [ 10s] : 0Available 256 byte Blocks: [ 10s] : 2100Used 256 byte Blocks: [ 10s] : 0Available 1550 byte Blocks: [ 10s] : 7425Used 1550 byte Blocks: [ 10s] : 1279Available 2560 byte Blocks: [ 10s] : 40Used 2560 byte Blocks: [ 10s] : 0Available 4096 byte Blocks: [ 10s] : 30Used 4096 byte Blocks: [ 10s] : 0Available 8192 byte Blocks: [ 10s] : 60Used 8192 byte Blocks: [ 10s] : 0Available 16384 byte Blocks: [ 10s] : 100Used 16384 byte Blocks: [ 10s] : 0Available 65536 byte Blocks: [ 10s] : 10Used 65536 byte Blocks: [ 10s] : 0CPU Utilization: [ 10s] : 31Input KByte Count: [ 10s] : 62930Output KByte Count: [ 10s] : 26620Input KPacket Count: [ 10s] : 755Output KPacket Count: [ 10s] : 58Input Bit Rate: [ 10s] : 24561Output Bit Rate: [ 10s] : 518897Input Packet Rate: [ 10s] : 48Output Packet Rate: [ 10s] : 114Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 377331Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 3672Output KByte Count: [ 10s] : 4051Input KPacket Count: [ 10s] : 19Output KPacket Count: [ 10s] : 20Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 1458Runts: [ 10s] : 1Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 63LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 15Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 0Output KByte Count: [ 10s] : 0Input KPacket Count: [ 10s] : 0Output KPacket Count: [ 10s] : 0Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 0Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 0Output KByte Count: [ 10s] : 0Input KPacket Count: [ 10s] : 0Output KPacket Count: [ 10s] : 0Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 0Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Available Memory: [ 10s] : 205149944Used Memory: [ 10s] : 63285512Xlate Count: [ 10s] : 0Connection Count: [ 10s] : 0TCP Connection Count: [ 10s] : 0UDP Connection Count: [ 10s] : 0URL Filtering Count: [ 10s] : 0URL Server Filtering Count: [ 10s] : 0TCP Fixup Count: [ 10s] : 0TCP Intercept Count: [ 10s] : 0HTTP Fixup Count: [ 10s] : 0FTP Fixup Count: [ 10s] : 0AAA Authentication Count: [ 10s] : 0AAA Authorzation Count: [ 10s] : 0AAA Accounting Count: [ 10s] : 0Current Xlates: [ 10s] : 0Max Xlates: [ 10s] : 0ISAKMP SAs: [ 10s] : 0IPSec SAs: [ 10s] : 0L2TP Sessions: [ 10s] : 0L2TP Tunnels: [ 10s] : 0hostname#Related Commands
show asdm image
To the current ASDM software image file, use the show asdm image command in privileged EXEC mode.
show asdm image
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
7.0
This command was changed from the show pdm image command to the show asdm image command.
Examples
The following is sample output from the show asdm image command:
hostname# show asdm imageDevice Manager image file, flash:/ASDMRelated Commands
show asdm log_sessions
To display a list of active ASDM logging sessions and their associated session IDs, use the show asdm log_sessions command in privileged EXEC mode.
show asdm log_sessions
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Each active ASDM session has one or more associated ASDM logging sessions. ASDM uses the logging session to retrieve syslog messages from the security appliance. Each ASDM logging session is assigned a unique session ID. You can use this session ID with the asdm disconnect log_session command to terminate the specified session.
Note
Examples
The following is sample output from the show asdm log_sessions command:
hostname# show asdm log_sessions0 192.168.1.11 192.168.1.2Related Commands
show asdm sessions
To display a list of active ASDM sessions and their associated session IDs, use the show asdm sessions command in privileged EXEC mode.
show asdm sessions
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
7.0
This command was changed from the show pdm sessions command to the show asdm sessions command.
Usage Guidelines
Each active ASDM session is assigned a unique session ID. You can use this session ID with the asdm disconnect command to terminate the specified session.
Examples
The following is sample output from the show asdm sessions command:
hostname# show asdm sessions0 192.168.1.11 192.168.1.2Related Commands
show asp drop
To debug the accelerated security path dropped packets or connections, use the show asp drop command in privileged EXEC mode.
show asp drop [flow [flow_drop_reason] | frame [frame_drop_reason]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp drop command shows the packets or connections dropped by the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. This information is used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Table 7-3 lists valid values for the flow_drop_reason argument for dropped flows. Table 7-4 lists valid values for the frame_drop_reason argument for dropped frames.
Table 7-4 lists valid values for the frame_drop_reason argument for dropped frames.
Examples
The following is sample output from the show asp drop command, with the timestamp indicating when the last time the counters were cleared:
hostname# show asp dropFrame drop:Flow is denied by configured rule (acl-drop) 3Dst MAC L2 Lookup Failed (dst-l2_lookup-fail) 4110L2 Src/Dst same LAN port (l2_same-lan-port) 760Expired flow (flow-expired) 1Last clearing: NeverFlow drop:Flow is denied by access rule (acl-drop) 24NAT failed (nat-failed) 28739NAT reverse path failed (nat-rpf-failed) 22266Inspection failure (inspect-fail) 19433Last clearing: 17:02:12 UTC Jan 17 2008 by enable_15Related Commands
clear asp drop
Clears drop statistics for the accelerated security path.
show conn
Shows information about connections.
show asp table arp
To debug the accelerated security path ARP tables, use the show asp table arp command in privileged EXEC mode.
show asp table arp [interface interface_name] [address ip_address [netmask mask]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show arp command shows the contents of the control plane, while the show asp table arp command shows the contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table arp command:
hostname# show asp table arpContext: single_vf, Interface: inside10.86.194.50 Active 000f.66ce.5d46 hits 010.86.194.1 Active 00b0.64ea.91a2 hits 63810.86.194.172 Active 0001.03cf.9e79 hits 010.86.194.204 Active 000f.66ce.5d3c hits 010.86.194.188 Active 000f.904b.80d7 hits 0Context: single_vf, Interface: identity:: Active 0000.0000.0000 hits 00.0.0.0 Active 0000.0000.0000 hits 50208Related Commands
show asp table classify
To debug the accelerated security path classifier tables, use the show asp table classify command in privileged EXEC mode. The classifier examines properties of incoming packets, such as protocol, and source and destination address, to match each packet to an appropriate classification rule. Each rule is labeled with a classification domain that determines what types of actions are performed, such as dropping a packet or allowing it through.
show asp table classify [hit | crypto | domain domain_name | interface interface_name]
Syntax Description
crypto
(Optional) Shows the encrypt, decrypt, and ipsec tunnel flow domains only.
domain domain_name
(Optional) Shows entries for a specific classifier domain. See "Usage Guidelines" for a list of domains.
hits
(Optional) Shows classifier entries which have non-zero hits values
interface interface_name
(Optional) Identifies a specific interface for which you want to view the classifier table.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0
This command was introduced.
7.2(4)
Added the hits option, and the timestamp indicating when the last time the asp table counters were cleared.
Usage Guidelines
The show asp table classifier command shows the classifier contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Classifier domains include the following:
aaa-acctaaa-authaaa-useraccountingarpcapturecaptureconn-nailedconn-setctcpdecryptencryptestablishedfilter-activexfilter-ftpfilter-httpsfilter-javafilter-urlhostidsinspectinspect-ctiqbeinspect-dnsinspect-dns-idsinspect-ftpinspect-ftp-datainspect-gtpinspect-h323inspect-httpinspect-icmpinspect-icmp-errorinspect-ilsinspect-mgcpinspect-netbiosinspect-pptpinspect-rshinspect-rtspinspect-sipinspect-skinnyinspect-smtpinspect-snmpinspect-sqlnetinspect-sqlnet-plusinspect-sunrpcinspect-tftpinspect-xdmcpipsec-nattipsec-tunnel-flowipsec-userlimitslumac-permitmgmt-lockdownmgmt-tcp-interceptmulticastnatnat-exemptnat-exempt-reversenat-reversenullpermitpermit-ip-optionpermit-logpimppppriority-qpuntpunt-l2punt-rootqosqos-per-classqos-per-destqos-per-flowqos-per-sourceshuntcp-interceptExamples
The following is sample output from the show asp table classify command:
hostname# show asp table classifyInterface test:in id=0x36f3800, priority=10, domain=punt, deny=falsehits=0, user_data=0x0, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=10.86.194.60, mask=255.255.255.255, port=0in id=0x33d3508, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=0.0.0.0, mask=0.0.0.0, port=0in id=0x33d3978, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=53dst ip=0.0.0.0, mask=0.0.0.0, port=0...The following is sample output from the show asp table classify hits command with a record of the last clearing hits counters:
Interface mgmt:in id=0x494cd88, priority=210, domain=permit, deny=truehits=54, user_data=0x1, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=255.255.255.255, mask=255.255.255.255, port=0, dscp=0x0in id=0x494d1b8, priority=112, domain=permit, deny=falsehits=1, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=1 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0Interface inside:in id=0x48f1580, priority=210, domain=permit, deny=truehits=54, user_data=0x1, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=255.255.255.255, mask=255.255.255.255, port=0, dscp=0x0in id=0x48f09e0, priority=1, domain=permit, deny=falsehits=101, user_data=0x0, cs_id=0x0, l3_type=0x608 src mac=0000.0000.0000, mask=0000.0000.0000 dst mac=0000.0000.0000, mask=0000.0000.0000Interface outside:in id=0x48c0970, priority=210, domain=permit, deny=truehits=54, user_data=0x1, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=255.255.255.255, mask=255.255.255.255, port=0, dscp=0x0Related Commands
show asp table interfaces
To debug the accelerated security path interface tables, use the show asp table interfaces command in privileged EXEC mode.
show asp table interfaces
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table interfaces command shows the interface table contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table interfaces command:
hostname# show asp table interfaces** Flags: 0x0001-DHCP, 0x0002-VMAC, 0x0010-Ident Ifc, 0x0020-HDB Initd,0x0040-RPF EnabledSoft-np interface 'dmz' is upcontext single_vf, nicnum 0, mtu 1500vlan 300, Not shared, seclvl 500 packets input, 1 packets outputflags 0x20Soft-np interface 'foo' is downcontext single_vf, nicnum 2, mtu 1500vlan <None>, Not shared, seclvl 00 packets input, 0 packets outputflags 0x20Soft-np interface 'outside' is downcontext single_vf, nicnum 1, mtu 1500vlan <None>, Not shared, seclvl 500 packets input, 0 packets outputflags 0x20Soft-np interface 'inside' is upcontext single_vf, nicnum 0, mtu 1500vlan <None>, Not shared, seclvl 100680277 packets input, 92501 packets outputflags 0x20...Related Commands
interface
Configures an interface and enters interface configuration mode.
show interface
Displays the runtime status and statistics of interfaces.
show asp table routing
To debug the accelerated security path routing tables, use the show asp table routing command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show asp table routing [input | output] [address ip_address [netmask mask] | interface interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table routing command shows the routing table contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table routing command:
hostname# show asp table routingin 255.255.255.255 255.255.255.255 identityin 224.0.0.9 255.255.255.255 identityin 10.86.194.60 255.255.255.255 identityin 10.86.195.255 255.255.255.255 identityin 10.86.194.0 255.255.255.255 identityin 209.165.202.159 255.255.255.255 identityin 209.165.202.255 255.255.255.255 identityin 209.165.201.30 255.255.255.255 identityin 209.165.201.0 255.255.255.255 identityin 10.86.194.0 255.255.254.0 insidein 224.0.0.0 240.0.0.0 identityin 0.0.0.0 0.0.0.0 insideout 255.255.255.255 255.255.255.255 fooout 224.0.0.0 240.0.0.0 fooout 255.255.255.255 255.255.255.255 testout 224.0.0.0 240.0.0.0 testout 255.255.255.255 255.255.255.255 insideout 10.86.194.0 255.255.254.0 insideout 224.0.0.0 240.0.0.0 insideout 0.0.0.0 0.0.0.0 via 10.86.194.1, insideout 0.0.0.0 0.0.0.0 via 0.0.0.0, identityout :: :: via 0.0.0.0, identityRelated Commands
show asp table vpn-context
To debug the accelerated security path VPN context tables, use the show asp table vpn-context command in privileged EXEC mode.
show asp table vpn-context [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table vpn-context command shows the VPN context contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table vpn-context command:
hostname# show asp table vpn-contextVPN ID=0058070576, DECR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058193920, ENCR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058168568, DECR+ESP, UP, pk=0000299627, rk=0000000061, gc=2VPN ID=0058161168, ENCR+ESP, UP, pk=0000305043, rk=0000000061, gc=1VPN ID=0058153728, DECR+ESP, UP, pk=0000271432, rk=0000000061, gc=2VPN ID=0058150440, ENCR+ESP, UP, pk=0000285328, rk=0000000061, gc=1VPN ID=0058102088, DECR+ESP, UP, pk=0000268550, rk=0000000061, gc=2VPN ID=0058134088, ENCR+ESP, UP, pk=0000274673, rk=0000000061, gc=1VPN ID=0058103216, DECR+ESP, UP, pk=0000252854, rk=0000000061, gc=2...The following is sample output from the show asp table vpn-context detail command:
hostname# show asp table vpn-context detailVPN Ctx = 0058070576 [0x03761630]State = UPFlags = DECR+ESPSA = 0x037928F0SPI = 0xEA0F21F0Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0VPN Ctx = 0058193920 [0x0377F800]State = UPFlags = ENCR+ESPSA = 0x037B4B70SPI = 0x900FDC32Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0...Related Commands
show blocks
To show the packet buffer utilization, use the show blocks command in privileged EXEC mode.
show blocks [{address hex | all | assigned | free | old | pool size [summary]} [diagnostics | dump | header | packet] | queue history [detail]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show blocks command helps you determine if the security appliance is overloaded. This command lists preallocated system buffer utilization. A full memory condition is not a problem as long as traffic is moving through the security appliance. You can use the show conn command to see if traffic is moving. If traffic is not moving and the memory is full, there may be a problem.
You can also view this information using SNMP.
The information shown in a security context includes the system-wide information as well as context-specific information about the blocks in use and the high water mark for block usage.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show blocks command in single mode:
hostname# show blocksSIZE MAX LOW CNT4 1600 1598 159980 400 398 399256 3600 3540 35421550 4716 3177 318416384 10 10 102048 1000 1000 1000Table 7-5 shows each field description.
The following is sample output from the show blocks all command:
hostname# show blocks allClass 0, size 4Block allocd_by freed_by data size alloccnt dup_cnt oper location0x01799940 0x00000000 0x00101603 0 0 0 alloc not_specified0x01798e80 0x00000000 0x00101603 0 0 0 alloc not_specified0x017983c0 0x00000000 0x00101603 0 0 0 alloc not_specified...Found 1000 of 1000 blocksDisplaying 1000 of 1000 blocksTable 7-6 shows each field description.
The following is sample output from the show blocks command in a context:
hostname/contexta# show blocksSIZE MAX LOW CNT INUSE HIGH4 1600 1599 1599 0 080 400 400 400 0 0256 3600 3538 3540 0 11550 4616 3077 3085 0 0The following is sample output from the show blocks queue history command:
hostname# show blocks queue historyEach Summary for User and Queue_type is followed its top 5 individual queuesBlock Size: 4Summary for User "http", Queue "tcp_unp_c_in", Blocks 1595, Queues 1396Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcSummary for User "aaa", Queue "tcp_unp_c_in", Blocks 220, Queues 200Blk_cnt Q_cnt Last_Op Queue_Type User Context21 1 put contexta1 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcBlk_cnt Q_cnt Last_Op Queue_Type User Context200 1 alloc ip_rx tcp contexta108 1 get ip_rx udp contexta85 1 free fixup h323_ras contextb42 1 put fixup skinny contextbBlock Size: 1550Summary for User "http", Queue "tcp_unp_c_in", Blocks 1595, Queues 1000Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextc...The following is sample output from the show blocks queue history detail command:
hostname# show blocks queue history detailHistory buffer memory usage: 2136 bytes (default)Each Summary for User and Queue type is followed its top 5 individual queuesBlock Size: 4Summary for User "http", Queue_Type "tcp_unp_c_in", Blocks 1595, Queues 1396Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcFirst Block information for Block at 0x.....dup_count 0, flags 0x8000000, alloc_pc 0x43ea2a,start_addr 0xefb1074, read_addr 0xefb118c, write_addr 0xefb1193urgent_addr 0xefb118c, end_addr 0xefb17b20efb1150: 00 00 00 03 47 c5 61 c5 00 05 9a 38 76 80 a3 00 | ....G.a....8v...0efb1160: 00 0a 08 00 45 00 05 dc 9b c9 00 00 ff 06 f8 f3 | ....E...........0efb1170: 0a 07 0d 01 0a 07 00 50 00 17 cb 3d c7 e5 60 62 | .......P...=..`b0efb1180: 7e 73 55 82 50 18 10 00 45 ca 00 00 2d 2d 20 49 | ~sU.P...E...-- I0efb1190: 50 20 2d 2d 0d 0a 31 30 2e 37 2e 31 33 2e 31 09 | P --..10.7.13.1.0efb11a0: 3d 3d 3e 09 31 30 2e 37 2e 30 2e 38 30 0d 0a 0d | ==>.10.7.0.80...Summary for User "aaa", Queue "tcp_unp_c_in", Blocks 220, Queues 200Blk_cnt Q_cnt Last_Op Queue_Type User Context21 1 put contexta1 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcFirst Block information for Block at 0x.....dup_count 0, flags 0x8000000, alloc_pc 0x43ea2a,start_addr 0xefb1074, read_addr 0xefb118c, write_addr 0xefb1193urgent_addr 0xefb118c, end_addr 0xefb17b20efb1150: 00 00 00 03 47 c5 61 c5 00 05 9a 38 76 80 a3 00 | ....G.a....8v...0efb1160: 00 0a 08 00 45 00 05 dc 9b c9 00 00 ff 06 f8 f3 | ....E...........0efb1170: 0a 07 0d 01 0a 07 00 50 00 17 cb 3d c7 e5 60 62 | .......P...=..`b0efb1180: 7e 73 55 82 50 18 10 00 45 ca 00 00 2d 2d 20 49 | ~sU.P...E...-- I0efb1190: 50 20 2d 2d 0d 0a 31 30 2e 37 2e 31 33 2e 31 09 | P --..10.7.13.1.0efb11a0: 3d 3d 3e 09 31 30 2e 37 2e 30 2e 38 30 0d 0a 0d | ==>.10.7.0.80......total_count: total buffers in this classThe following is sample output from the show blocks pool summary command:
hostname# show blocks pool 1550 summaryClass 3, size 1550=================================================total_count=1531 miss_count=0Alloc_pc valid_cnt invalid_cnt0x3b0a18 00000256 000000000x01ad0760 0x01acfe00 0x01acf4a0 0x01aceb40 00000000 0x000000000x3a8f6b 00001275 000000120x05006aa0 0x05006140 0x050057e0 0x05004520 000000000x00000000=================================================total_count=9716 miss_count=0Freed_pc valid_cnt invalid_cnt0x9a81f3 00000104 000000070x05006140 0x05000380 0x04fffa20 0x04ffde00 00000000 0x000000000x9a0326 00000053 000000330x05006aa0 0x050057e0 0x05004e80 0x05003260 00000000 0x000000000x4605a2 00000005 000000000x04ff5ac0 0x01e8e2e0 0x01e2eac0 0x01e17d20 00000000 0x00000000...=================================================total_count=1531 miss_count=0Queue valid_cnt invalid_cnt0x3b0a18 00000256 00000000 Invalid Bad qtype0x01ad0760 0x01acfe00 0x01acf4a0 0x01aceb40 00000000 0x000000000x3a8f6b 00001275 00000000 Invalid Bad qtype0x05006aa0 0x05006140 0x050057e0 0x05004520 000000000x00000000=================================================free_cnt=8185 fails=0 actual_free=8185 hash_miss=003a8d3e0 03a8b7c0 03a7fc40 03a6ff20 03a6f5c0 03a6ec60 kao-f1#Table 7-7 shows each field description.
Related Commands
blocks
Increases the memory assigned to block diagnostics
clear blocks
Clears the system buffer statistics.
show conn
Shows active connections.
show bootvar
To show the boot file and configuration properties, use the show boot command in privileged configuration mode.
show bootvar
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged Mode
·
·
·
·
·
Command History
Usage Guidelines
The BOOT variable specifies a list of bootable images on various devices. The CONFIG_FILE variable specifies the configuration file used during system initialization. Set these variables with the boot system command, and boot config command, respectively.
Examples
The following example, the BOOT variable contains disk0:/f1_image, which is the image booted when the system reloads. The current value of BOOT is disk0:/f1_image; disk0:/f1_backupimage. This meansboot variable has been modified with the boot system command, but the running configuration has notbeen saved with the write memory command. When the running config is saved, the BOOT variable and current BOOT variable will both be disk0:/f1_image; disk0:/f1_backupimage. Assuming the running configuration is saved the boot loader will attempt to load the contents of the BOOT variable, starting with disk0:/f1image, but if that is not present or invalid, it will attempt to boot disk0:1/f1_backupimage.
The CONFIG_FILE variable points to the system startup configuration. In this example it is not set, so the startup configuration file is the default specified with the boot config command. The current CONFIG_FILE variable may be modified with the boot config command and saved with the write memory command.
hostname# show bootvarBOOT variable = disk0:/f1_imageCurrent BOOT variable = disk0:/f1_image; disk0:/f1_backupimageCONFIG_FILE variable =Current CONFIG_FILE variable =hostname#Related Commands
show capture
To display the capture configuration when no options are specified, use the show capture command.
show capture [capture_name] [access-list access_list_name] [count number] [decode] [detail] [dump] [packet-number number]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
PIX Version 7.0
Support for this command was introduced on the security appliance.
Usage Guidelines
If you specify the capture_name, then the capture buffer contents for that capture are displayed.
The dump keyword does not display MAC information in the hexadecimal dump.
The decoded output of the packets depend on the protocol of the packet. In Table 7-8, the bracketed output is displayed when you specify the detail keyword.
Examples
This example shows how to display the capture configuration:
hostname(config)# show capturecapture arp ethernet-type arp interface outsidecapture http access-list http packet-length 74 interface insideThis example shows how to display the packets that are captured by an ARP capture:
hostname(config)# show capture arp2 packets captured19:12:23.478429 arp who-has 171.69.38.89 tell 171.69.38.1019:12:26.784294 arp who-has 171.69.38.89 tell 171.69.38.102 packets shownRelated Commands
show chardrop
To display the count of characters dropped from the serial console, use the show chardrop command in privileged EXEC mode.
show chardrop
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show chardrop command:
hostname# show chardropChars dropped pre-TxTimeouts: 0, post-TxTimeouts: 0
Related Commands
show checkheaps
To show the checkheaps statistics, use the show checkheaps command in privileged EXEC mode. Checkheaps is a periodic process that verifies the sanity of the heap memory buffers (dynamic memory is allocated from the system heap memory region) and the integrity of the code region.
show checkheaps
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show checkheaps command:
hostname# show checkheapsCheckheaps stats from buffer validation runs--------------------------------------------Time elapsed since last run : 42 secsDuration of last run : 0 millisecsNumber of buffers created : 8082Number of buffers allocated : 7808Number of buffers free : 274Total memory in use : 43570344 bytesTotal memory in free buffers : 87000 bytesTotal number of runs : 310Related Commands
show checksum
To display the configuration checksum, use the show checksum command in privileged EXEC mode.
show checksum
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Usage Guidelines
The show checksum command allows you to display four groups of hexadecimal numbers that act as a digital summary of the configuration contents. This checksum is calculated only when you store the configuration in Flash memory.
If a dot (".") appears before the checksum in the show config or show checksum command output, the output indicates a normal configuration load or write mode indicator (when loading from or writing to the security appliance Flash partition). The "." shows that the security appliance is preoccupied with the operation but is not "hung up." This message is similar to a "system processing, please wait" message.
Examples
This example shows how to display the configuration or the checksum:
hostname(config)# show checksumCryptochecksum: 1a2833c0 129ac70b 1a88df85 650dbb81
show chunkstat
To display the chunk statistics, use the show chunkstat command in privileged EXEC mode.
show chunkstat
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
This example shows how to display the chunk statistics:
hostname# show chunkstatGlobal chunk statistics: created 181, destroyed 34, siblings created 94, siblings destroyed 34Per-chunk statistics: siblings created 0, siblings trimmed 0Dump of chunk at 01edb4cc, name "Managed Chunk Queue Elements", data start @ 01edbd24, end @ 01eddc54next: 01eddc8c, next_sibling: 00000000, prev_sibling: 00000000flags 00000001maximum chunk elt's: 499, elt size: 16, index first free 498# chunks in use: 1, HWM of total used: 1, alignment: 0Per-chunk statistics: siblings created 0, siblings trimmed 0Dump of chunk at 01eddc8c, name "Registry Function List", data start @ 01eddea4, end @ 01ede348next: 01ede37c, next_sibling: 00000000, prev_sibling: 00000000flags 00000001maximum chunk elt's: 99, elt size: 12, index first free 42# chunks in use: 57, HWM of total used: 57, alignment: 0Related Commands
show counters
Displays the protocol stack counters.
show cpu
Displays the CPU utilization information.
show clock
To view the time on the security appliance, use the show clock command in user EXEC mode.
show clock [detail]
Syntax Description
detail
(Optional) Indicates the clock source (NTP or user configuration) and the current summer-time setting (if any).
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show clock command:
hostname> show clock12:35:45.205 EDT Tue Jul 27 2004The following is sample output from the show clock detail command:
hostname> show clock detail12:35:45.205 EDT Tue Jul 27 2004Time source is user configurationSummer time starts 02:00:00 EST Sun Apr 4 2004Summer time ends 02:00:00 EDT Sun Oct 31 2004Related Commands
show conn
To display the connection state for the designated connection type, use the show conn command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show conn [count | [all] [detail] [long] [state state_type] [protocol {tcp | udp}] [address src_ip[-src_ip] [netmask mask]] [port src_port[-src_port]] [address dest_ip[-dest_ip] [netmask mask]] [port dest_port[-dest_port]]]
Syntax Description
address
(Optional) Displays connections with the specified source or destination IP address.
all
(Optional) Displays connections that are to the device or from the device, in addition to through-traffic connections.
count
(Optional) Displays the number of active connections.
dest_ip
(Optional) Specifies the destination IP address (IPv4 or IPv6). To specify a range, separate the IP addresses with a dash (-), For example:
10.1.1.1-10.1.1.5dest_port
(Optional) Specifies the destination port number. To specify a range, separate the port numbers with a dash (-), For example:
1000-2000detail
(Optional) Displays connections in detail, including translation type and interface information.
long
(Optional) Displays connections in long format.
netmask mask
(Optional) Specifies a subnet mask for use with the given IP address.
port
(Optional) Displays connections with the specified source or destination port.
protocol {tcp | udp}
(Optional) Specifies the connection protocol, tcp or udp.
src_ip
(Optional) Specifies the source IP address (IPv4 or IPv6). To specify a range, separate the IP addresses with a dash (-), For example:
10.1.1.1-10.1.1.5src_port
(Optional) Specifies the source port number. To specify a range, separate the port numbers with a dash (-), For example:
1000-2000state state_type
(Optional) Specifies the connection state type. See Table 7-9 for a list of the keywords available for connection state types.
Defaults
All through connections are shown by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show conn command displays the number of active TCP and UDP connections, and provides information about connections of various types. Use the show conn all command to see the entire table of connections.
Note
The connection types that you can specify using the show conn state command are defined in Table 7-9. When specifying multiple connection types, use commas without spaces to separate the keywords.
When you use the detail option, the system displays information about the translation type and interface information using the connection flags defined in Table 7-10.
Table 7-10 Connection Flags
a
awaiting outside ACK to SYN
A
awaiting inside ACK to SYN
B
initial SYN from outside
C
Computer Telephony Interface Quick Buffer Encoding (CTIQBE) media connection
d
dump
D
DNS
E
outside back connection
f
inside FIN
F
outside FIN
g
Media Gateway Control Protocol (MGCP) connection
G
connection is part of a group1
h
H.225
H
H.323
i
incomplete TCP or UDP connection
I
inbound data
k
Skinny Client Control Protocol (SCCP) media connection
m
SIP media connection
M
SMTP data
O
outbound data
p
replicated (unused)
P
inside back connection
q
SQL*Net data
r
inside acknowledged FIN
R
outside acknowledged FIN for TCP connection
R
UDP RPC2
s
awaiting outside SYN
S
awaiting inside SYN
t
SIP transient connection3
T
SIP connection4
U
up
1 The G flag indicates the connection is part of a group. It is set by the GRE and FTP Strict fixups to designate the control connection and all its associated secondary connections. If the control connection terminates, then all associated secondary connections are also terminated.
2 Because each row of show conn command output represents one connection (TCP or UDP ), there will be only one R flag per row.
3 For UDP connections, the value t indicates that it will timeout after one minute.
4 For UDP connections, the value T indicates that the connection will timeout according to the value specified using the timeout sip command.
Note
A single connection is created for multiple DNS sessions, as long as they are between the same two hosts, and the sessions have the same 5-tuple (source/destination IP address, source/destination port, and protocol). DNS identification is tracked by app_id, and the idle timer for each app_id runs independently.
Because the app_id expires independently, a legitimate DNS response can only pass through the security appliance within a limited period of time and there is no resource build-up. However, when you enter the show conn command, you will see the idle timer of a DNS connection being reset by a new DNS session. This is due to the nature of the shared DNS connection and is by design.
Note
Examples
When specifying multiple connection types, use commas without spaces to separate the keywords. The following example displays information about RPC, H.323, and SIP connections in the Up state:
hostname# show conn state up,rpc,h323,sipThe following is sample output from the show conn count command:
ciscoasa(config)# show conn count22 in use, 27775 most usedThe following is sample output from the show conn command. This example shows a TCP session connection from inside host 10.1.1.15 to the outside Telnet server at 10.2.49.10. Because there is no B flag, the connection is initiated from the inside. The "U", "I", and "O" flags denote that the connection is active and has received inbound and outbound data.
hostname# show conn22 in use, 27775 most usedTCP out 10.2.49.10:23 in 10.1.1.15:1026 idle 0:00:22 bytes 1774 flags UIOUDP out 10.2.49.10:31649 in 10.1.1.15:1028 idle 0:00:14 bytes 0 flags D-TCP out 10.30.2.2:1500 in 10.1.1.7:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:1500 in 10.1.1.14:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:1500 in 10.1.1.1:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:1500 in 10.1.1.3:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:80 in 10.30.1.1:45804 idle 0:01:26 bytes 7918 flags UFRIOTCP out 10.30.2.2:80 in 10.30.1.1:45003 idle 0:02:17 bytes 7918 flags UFRIOThe following is sample output from the show conn detail command. This example shows many connections, including a UDP connection from outside host 192.168.49.10 to inside host 10.1.1.15. The D flag denotes that this is a DNS connection. The number 1028 is the DNS ID over the connection.
hostname# show conn detail22 in use, 27775 most usedFlags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,B - initial SYN from outside, C - CTIQBE media, D - DNS, d - dump,E - outside back connection, F - outside FIN, f - inside FIN,G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,i - incomplete, J - GTP, j - GTP data, K - GTP t3-responsek - Skinny media, M - SMTP data, m - SIP media, O - outbound data,P - inside back connection, q - SQL*Net data, R - outside acknowledged FIN,R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,s - awaiting outside SYN, T - SIP, t - SIP transient, U - upTCP outside:10.30.2.2/1500 inside:10.1.1.7/1000 flags saATCP outside:10.30.2.2/1500 inside:10.1.1.14/1000 flags saATCP outside:10.30.2.2/1500 inside:10.1.1.1/1000 flags saATCP outside:10.30.2.2/1500 inside:10.1.1.3/1000 flags saATCP outside:10.30.2.2/80 inside:10.30.1.1/45804 flags UFRIOTCP outside:10.30.2.2/80 inside:10.30.1.1/45003 flags UFRIOTCP outside:192.168.49.10/23 inside:10.1.1.15/1026 flags UIOUDP outside:192.168.49.10/31649 inside:10.1.1.15/1028 flags dDRelated Commands
show console-output
To display the currently captured console output, use the show console-output command in privileged EXEC mode.
show console-output
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
Examples
The following example shows the message that displays when there is no console output:
hostname# show console-outputSorry, there are no messages to displayRelated Commands
show context
To show context information including allocated interfaces and the configuration file URL, the number of contexts configured, or from the system execution space, a list of all contexts, use the show context command in privileged EXEC mode.
show context [name | detail | count]
Syntax Description
Defaults
In the system execution space, the security appliance displays all contexts if you do not specify a name.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show context command. The following sample display shows three contexts:
hostname# show contextContext Name Interfaces URL*admin GigabitEthernet0/1.100 flash:/admin.cfgGigabitEthernet0/1.101contexta GigabitEthernet0/1.200 flash:/contexta.cfgGigabitEthernet0/1.201contextb GigabitEthernet0/1.300 flash:/contextb.cfgGigabitEthernet0/1.301Total active Security Contexts: 3Table 7-11 shows each field description.
The following is sample output from the show context detail command:
hostname# show context detailContext "admin", has been created, but initial ACL rules not completeConfig URL: flash:/admin.cfgReal Interfaces: Management0/0Mapped Interfaces: Management0/0Flags: 0x00000013, ID: 1Context "ctx", has been created, but initial ACL rules not completeConfig URL: ctx.cfgReal Interfaces: GigabitEthernet0/0.10, GigabitEthernet0/1.20,GigabitEthernet0/2.30Mapped Interfaces: int1, int2, int3Flags: 0x00000011, ID: 2Context "system", is a system resourceConfig URL: startup-configReal Interfaces:Mapped Interfaces: Control0/0, GigabitEthernet0/0,GigabitEthernet0/0.10, GigabitEthernet0/1, GigabitEthernet0/1.10,GigabitEthernet0/1.20, GigabitEthernet0/2, GigabitEthernet0/2.30,GigabitEthernet0/3, Management0/0, Management0/0.1Flags: 0x00000019, ID: 257Context "null", is a system resourceConfig URL: ... null ...Real Interfaces:Mapped Interfaces:Flags: 0x00000009, ID: 258Table 7-12 shows each field description.
The following is sample output from the show context count command:
hostname# show context countTotal active contexts: 2Related Commands
show counters
To display the protocol stack counters, use the show counters command in privileged EXEC mode.
show counters [all | context context-name | summary | top N ] [detail] [protocol protocol_name [:counter_name]] [ threshold N]
Syntax Description
Defaults
show counters summary detail threshold 1
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following example shows how to display all counters:
hostname# show counters allProtocol Counter Value ContextIOS_IPC IN_PKTS 2 single_vfIOS_IPC OUT_PKTS 2 single_vfhostname# show countersProtocol Counter Value ContextNPCP IN_PKTS 7195 SummaryNPCP OUT_PKTS 7603 SummaryIOS_IPC IN_PKTS 869 SummaryIOS_IPC OUT_PKTS 865 SummaryIP IN_PKTS 380 SummaryIP OUT_PKTS 411 SummaryIP TO_ARP 105 SummaryIP TO_UDP 9 SummaryUDP IN_PKTS 9 SummaryUDP DROP_NO_APP 9 SummaryFIXUP IN_PKTS 202 SummaryThe following example shows how to display a summary of counters:
hostname# show counters summaryProtocol Counter Value ContextIOS_IPC IN_PKTS 2 SummaryIOS_IPC OUT_PKTS 2 SummaryThe following example shows how to display counters for a context:
hostname# show counters context single_vfProtocol Counter Value ContextIOS_IPC IN_PKTS 4 single_vfIOS_IPC OUT_PKTS 4 single_vfRelated Commands
show cpu
To display the CPU utilization information, use the show cpu usage command in privileged EXEC mode.
show cpu [usage]
From the system configuration in multiple context mode:
show cpu [usage] [context {all | context_name}]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The cpu usage is computed using an approximation of the load every five seconds, and by further feeding this approximation into two, following moving averages.
You can use the show cpu command to find process related loads (that is, activity on behalf of items listed by the output of the show process command in both single mode and from the system configuration in multiple context mode).
Further, you can request, when in multiple context mode, a breakdown of the process related load to CPU consumed by any configured contexts by changing to each context and entering the show cpu command or by entering the show cpu context variant of this command.
While process related load is rounded to the nearest whole number, context related loads include one additional decimal digit of precision. For example, entering show cpu from the system context produces a different number than from entering the show cpu context system command. The former is an approximate summary of everything in show cpu context all, and the latter is only a portion of that summary.
Examples
The following example shows how to display the CPU utilization:
hostname# show cpu usageCPU utilization for 5 seconds = 18%; 1 minute: 18%; 5 minutes: 18%This example shows how to display the CPU utilization for the system context in multiple mode:
hostname# show cpu context systemCPU utilization for 5 seconds = 9.1%; 1 minute: 9.2%; 5 minutes: 9.1%The following shows how to display the CPU utilization for all contexts:
hostname# show cpu usage context all5 sec 1 min 5 min Context Name9.1% 9.2% 9.1% system0.0% 0.0% 0.0% admin5.0% 5.0% 5.0% one4.2% 4.3% 4.2% twoThis example shows how to display the CPU utilization for a context named "one":
hostname/one# show cpu usageCPU utilization for 5 seconds = 5.0%; 1 minute: 5.0%; 5 minutes: 5.0%Related Commands
show crashinfo
To display the contents of the crash file stored in Flash memory, enter the show crashinfo command in privileged EXEC mode.
show crashinfo [save]
Syntax Description
save
(Optional) Displays if the security appliance is configured to save crash information to Flash memory or not.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
If the crash file is from a test crash (generated from the crashinfo test command), the first string of the crash file is ": Saved_Test_Crash" and the last string is ": End_Test_Crash". If the crash file is from a real crash, the first string of the crash file is ": Saved_Crash" and the last string is ": End_Crash". (This includes crashes from use of the crashinfo force page-fault or crashinfo force watchdog commands).
If there is no crash data saved in flash, or if the crash data has been cleared by entering the clear crashinfo command, the show crashinfo command displays an error message.
Examples
The following example shows how to display the current crash information configuration:
hostname# show crashinfo savecrashinfo save enableThe following example shows the output for a crash file test. (However, this test does not actually crash the security appliance. It provides a simulated example file.)
hostname(config)# crashinfo testhostname(config)# exithostname# show crashinfo: Saved_Test_CrashThread Name: ci/console (Old pc 0x001a6ff5 ebp 0x00e88920)Traceback:0: 003231431: 0032321b2: 0010885c3: 0010763c4: 001078db5: 001035856: 00000000vector 0x000000ff (user defined)edi 0x004f20c4esi 0x00000000ebp 0x00e88c20esp 0x00e88bd8ebx 0x00000001edx 0x00000074ecx 0x00322f8beax 0x00322f8berror code n/aeip 0x0010318ccs 0x00000008eflags 0x00000000CR2 0x00000000Stack dump: base:0x00e8511c size:16384, active:14760x00e89118: 0x004f1bb40x00e89114: 0x001078b40x00e89110-0x00e8910c: 0x000000000x00e89108-0x00e890ec: 0x123456780x00e890e8: 0x004f1bb40x00e890e4: 0x001035850x00e890e0: 0x00e8910c0x00e890dc-0x00e890cc: 0x123456780x00e890c8: 0x000000000x00e890c4-0x00e890bc: 0x123456780x00e890b8: 0x004f1bb40x00e890b4: 0x001078db0x00e890b0: 0x00e890e00x00e890ac-0x00e890a8: 0x123456780x00e890a4: 0x001179b30x00e890a0: 0x00e890b00x00e8909c-0x00e89064: 0x123456780x00e89060: 0x123456000x00e8905c: 0x202329700x00e89058: 0x616d2d650x00e89054: 0x740020230x00e89050: 0x296769660x00e8904c: 0x6e6f63280x00e89048: 0x316365730x00e89044: 0x7069636f0x00e89040: 0x647869700x00e8903c-0x00e88e50: 0x000000000x00e88e4c: 0x000a74730x00e88e48: 0x6574206f0x00e88e44: 0x666e69680x00e88e40: 0x736172630x00e88e3c-0x00e88e38: 0x000000000x00e88e34: 0x123456000x00e88e30-0x00e88dfc: 0x000000000x00e88df8: 0x003167610x00e88df4: 0x747061000x00e88df0: 0x123456000x00e88dec-0x00e88ddc: 0x000000000x00e88dd8: 0x000000700x00e88dd4: 0x616d2d650x00e88dd0: 0x74756f000x00e88dcc: 0x000000000x00e88dc8: 0x00e88e400x00e88dc4: 0x004f20c40x00e88dc0: 0x123456000x00e88dbc: 0x000000000x00e88db8: 0x000000350x00e88db4: 0x315f656c0x00e88db0: 0x62616e650x00e88dac: 0x0030fcf00x00e88da8: 0x3011111f0x00e88da4: 0x004df43c0x00e88da0: 0x0053fef00x00e88d9c: 0x004f1bb40x00e88d98: 0x123456000x00e88d94: 0x000000000x00e88d90: 0x000000350x00e88d8c: 0x315f656c0x00e88d88: 0x62616e650x00e88d84: 0x000000000x00e88d80: 0x004f20c40x00e88d7c: 0x000000010x00e88d78: 0x013456780x00e88d74: 0x00f538540x00e88d70: 0x00f7f7540x00e88d6c: 0x00e88db00x00e88d68: 0x00e88d7b0x00e88d64: 0x00f538740x00e88d60: 0x00e890400x00e88d5c-0x00e88d54: 0x123456780x00e88d50-0x00e88d4c: 0x000000000x00e88d48: 0x004f1bb40x00e88d44: 0x00e88d7c0x00e88d40: 0x00e88e400x00e88d3c: 0x00f538740x00e88d38: 0x004f1bb40x00e88d34: 0x0010763c0x00e88d30: 0x00e890b00x00e88d2c: 0x00e88db00x00e88d28: 0x00e88d880x00e88d24: 0x0010761a0x00e88d20: 0x00e890b00x00e88d1c: 0x00e88e400x00e88d18: 0x00f538740x00e88d14: 0x0010166d0x00e88d10: 0x0000000e0x00e88d0c: 0x00f538740x00e88d08: 0x00f538540x00e88d04: 0x0048b3010x00e88d00: 0x00e88d300x00e88cfc: 0x0000000e0x00e88cf8: 0x00f538540x00e88cf4: 0x0048a4010x00e88cf0: 0x00f538540x00e88cec: 0x00f538740x00e88ce8: 0x0000000e0x00e88ce4: 0x0048a64b0x00e88ce0: 0x0000000e0x00e88cdc: 0x00f538740x00e88cd8: 0x00f7f96c0x00e88cd4: 0x0048b4f80x00e88cd0: 0x00e88d000x00e88ccc: 0x0000000f0x00e88cc8: 0x00f7f96c0x00e88cc4-0x00e88cc0: 0x0000000e0x00e88cbc: 0x00e890400x00e88cb8: 0x000000000x00e88cb4: 0x00f5387e0x00e88cb0: 0x00f538740x00e88cac: 0x000000020x00e88ca8: 0x000000010x00e88ca4: 0x000000090x00e88ca0-0x00e88c9c: 0x000000010x00e88c98: 0x00e88cb00x00e88c94: 0x004f20c40x00e88c90: 0x0000003a0x00e88c8c: 0x000000000x00e88c88: 0x0000000a0x00e88c84: 0x00489f3a0x00e88c80: 0x00e88d880x00e88c7c: 0x00e88e400x00e88c78: 0x00e88d7c0x00e88c74: 0x001087ed0x00e88c70: 0x000000010x00e88c6c: 0x00e88cb00x00e88c68: 0x000000020x00e88c64: 0x0010885c0x00e88c60: 0x00e88d300x00e88c5c: 0x007273340x00e88c58: 0xa0ffffff0x00e88c54: 0x00e88cb00x00e88c50: 0x000000010x00e88c4c: 0x00e88cb00x00e88c48: 0x000000020x00e88c44: 0x0032321b0x00e88c40: 0x00e88c600x00e88c3c: 0x00e88c7f0x00e88c38: 0x00e88c5c0x00e88c34: 0x004b1ad50x00e88c30: 0x00e88c600x00e88c2c: 0x00e88e400x00e88c28: 0xa0ffffff0x00e88c24: 0x003231430x00e88c20: 0x00e88c400x00e88c1c: 0x000000000x00e88c18: 0x000000080x00e88c14: 0x0010318c0x00e88c10-0x00e88c0c: 0x00322f8b0x00e88c08: 0x000000740x00e88c04: 0x000000010x00e88c00: 0x00e88bd80x00e88bfc: 0x00e88c200x00e88bf8: 0x000000000x00e88bf4: 0x004f20c40x00e88bf0: 0x000000ff0x00e88bec: 0x00322f870x00e88be8: 0x00f5387e0x00e88be4: 0x003230210x00e88be0: 0x00e88c100x00e88bdc: 0x004f20c40x00e88bd8: 0x00000000 *0x00e88bd4: 0x004eabb00x00e88bd0: 0x000000010x00e88bcc: 0x00f5387e0x00e88bc8-0x00e88bc4: 0x000000000x00e88bc0: 0x000000080x00e88bbc: 0x0010318c0x00e88bb8-0x00e88bb4: 0x00322f8b0x00e88bb0: 0x000000740x00e88bac: 0x000000010x00e88ba8: 0x00e88bd80x00e88ba4: 0x00e88c200x00e88ba0: 0x000000000x00e88b9c: 0x004f20c40x00e88b98: 0x000000ff0x00e88b94: 0x001031f20x00e88b90: 0x00e88c200x00e88b8c: 0xffffffff0x00e88b88: 0x00e88cb00x00e88b84: 0x003200320x00e88b80: 0x373031330x00e88b7c: 0x312f65740x00e88b78: 0x6972772f0x00e88b74: 0x342f76650x00e88b70: 0x647366660x00e88b6c: 0x000200000x00e88b68: 0x000000100x00e88b64: 0x000000010x00e88b60: 0x123456cd0x00e88b5c: 0x000000000x00e88b58: 0x00000008Cisco XXX Firewall Version X.XCisco XXX Device Manager Version X.XCompiled on Fri 15-Nov-04 14:35 by roothostname up 10 days 0 hoursHardware: XXX-XXX, 64 MB RAM, CPU Pentium 200 MHzFlash i28F640J5 @ 0x300, 16MBBIOS Flash AT29C257 @ 0xfffd8000, 32KB0: ethernet0: address is 0003.e300.73fd, irq 101: ethernet1: address is 0003.e300.73fe, irq 72: ethernet2: address is 00d0.b7c8.139e, irq 9Licensed Features:Failover: DisabledVPN-DES: EnabledVPN-3DES-AES: DisabledMaximum Interfaces: 3Cut-through Proxy: EnabledGuards: EnabledURL-filtering: EnabledInside Hosts: UnlimitedThroughput: UnlimitedIKE peers: UnlimitedThis XXX has a Restricted (R) license.Serial Number: 480430455 (0x1ca2c977)Running Activation Key: 0xc2e94182 0xc21d8206 0x15353200 0x633f6734Configuration last modified by enable_15 at 13:49:42.148 UTC Wed Nov 20 2004------------------ show clock ------------------15:34:28.129 UTC Sun Nov 24 2004------------------ show memory ------------------Free memory: 50444824 bytesUsed memory: 16664040 bytes------------- ----------------Total memory: 67108864 bytes------------------ show conn count ------------------0 in use, 0 most used------------------ show xlate count ------------------0 in use, 0 most used------------------ show blocks ------------------SIZE MAX LOW CNT4 1600 1600 160080 400 400 400256 500 499 5001550 1188 795 927------------------ show interface ------------------interface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 0003.e300.73fdIP address 172.23.59.232, subnet mask 255.255.0.0MTU 1500 bytes, BW 10000 Kbit half duplex6139 packets input, 830375 bytes, 0 no bufferReceived 5990 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort90 packets output, 6160 bytes, 0 underruns0 output errors, 13 collisions, 0 interface resets0 babbles, 0 late collisions, 47 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (5/128) software (0/2)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet1 "inside" is up, line protocol is downHardware is i82559 ethernet, address is 0003.e300.73feIP address 10.1.1.1, subnet mask 255.255.255.0MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1 packets output, 60 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred1 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet2 "intf2" is administratively down, line protocol is downHardware is i82559 ethernet, address is 00d0.b7c8.139eIP address 127.0.0.1, subnet mask 255.255.255.255MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)------------------ show cpu usage ------------------CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%------------------ show process ------------------PC SP STATE Runtime SBASE Stack ProcessHsi 001e3329 00763e7c 0053e5c8 0 00762ef4 3784/4096 arp_timerLsi 001e80e9 00807074 0053e5c8 0 008060fc 3792/4096 FragDBGCLwe 00117e3a 009dc2e4 00541d18 0 009db46c 3704/4096 dbgtraceLwe 003cee95 009de464 00537718 0 009dc51c 8008/8192 LoggerHwe 003d2d18 009e155c 005379c8 0 009df5e4 8008/8192 tcp_fastHwe 003d2c91 009e360c 005379c8 0 009e1694 8008/8192 tcp_slowLsi 002ec97d 00b1a464 0053e5c8 0 00b194dc 3928/4096 xlate cleanLsi 002ec88b 00b1b504 0053e5c8 0 00b1a58c 3888/4096 uxlate cleanMrd 002e3a17 00c8f8d4 0053e600 0 00c8d93c 7908/8192 tcp_intercept_timesLsi 00423dd5 00d3a22c 0053e5c8 0 00d392a4 3900/4096 route_processHsi 002d59fc 00d3b2bc 0053e5c8 0 00d3a354 3780/4096 PIX Garbage CollecrHwe 0020e301 00d5957c 0053e5c8 0 00d55614 16048/16384 isakmp_time_keeprLsi 002d377c 00d7292c 0053e5c8 0 00d719a4 3928/4096 perfmonHwe 0020bd07 00d9c12c 0050bb90 0 00d9b1c4 3944/4096 IPSecMwe 00205e25 00d9e1ec 0053e5c8 0 00d9c274 7860/8192 IPsec timer handlerHwe 003864e3 00db26bc 00557920 0 00db0764 6904/8192 qos_metric_daemonMwe 00255a65 00dc9244 0053e5c8 0 00dc8adc 1436/2048 IP BackgroundLwe 002e450e 00e7bb94 00552c30 0 00e7ad1c 3704/4096 pix/traceLwe 002e471e 00e7cc44 00553368 0 00e7bdcc 3704/4096 pix/tconsoleHwe 001e5368 00e7ed44 00730674 0 00e7ce9c 7228/8192 pix/intf0Hwe 001e5368 00e80e14 007305d4 0 00e7ef6c 7228/8192 pix/intf1Hwe 001e5368 00e82ee4 00730534 2470 00e8103c 4892/8192 pix/intf2H* 001a6ff5 0009ff2c 0053e5b0 4820 00e8511c 12860/16384 ci/consoleCsi 002dd8ab 00e8a124 0053e5c8 0 00e891cc 3396/4096 update_cpu_usageHwe 002cb4d1 00f2bfbc 0051e360 0 00f2a134 7692/8192 uauth_inHwe 003d17d1 00f2e0bc 00828cf0 0 00f2c1e4 7896/8192 uauth_threadHwe 003e71d4 00f2f20c 00537d20 0 00f2e294 3960/4096 udp_timerHsi 001db3ca 00f30fc4 0053e5c8 0 00f3004c 3784/4096 557mcfixCrd 001db37f 00f32084 0053ea40 508286220 00f310fc 3688/4096 557pollLsi 001db435 00f33124 0053e5c8 0 00f321ac 3700/4096 557timerHwe 001e5398 00f441dc 008121e0 0 00f43294 3912/4096 fover_ip0Cwe 001dcdad 00f4523c 00872b48 120 00f44344 3528/4096 ip/0:0Hwe 001e5398 00f4633c 008121bc 10 00f453f4 3532/4096 icmp0Hwe 001e5398 00f47404 00812198 0 00f464cc 3896/4096 udp_thread/0Hwe 001e5398 00f4849c 00812174 0 00f475a4 3456/4096 tcp_thread/0Hwe 001e5398 00f495bc 00812150 0 00f48674 3912/4096 fover_ip1Cwe 001dcdad 00f4a61c 008ea850 0 00f49724 3832/4096 ip/1:1Hwe 001e5398 00f4b71c 0081212c 0 00f4a7d4 3912/4096 icmp1Hwe 001e5398 00f4c7e4 00812108 0 00f4b8ac 3896/4096 udp_thread/1Hwe 001e5398 00f4d87c 008120e4 0 00f4c984 3832/4096 tcp_thread/1Hwe 001e5398 00f4e99c 008120c0 0 00f4da54 3912/4096 fover_ip2Cwe 001e542d 00f4fa6c 00730534 0 00f4eb04 3944/4096 ip/2:2Hwe 001e5398 00f50afc 0081209c 0 00f4fbb4 3912/4096 icmp2Hwe 001e5398 00f51bc4 00812078 0 00f50c8c 3896/4096 udp_thread/2Hwe 001e5398 00f52c5c 00812054 0 00f51d64 3832/4096 tcp_thread/2Hwe 003d1a65 00f78284 008140f8 0 00f77fdc 300/1024 listen/http1Mwe 0035cafa 00f7a63c 0053e5c8 0 00f786c4 7640/8192 Crypto CA------------------ show failover ------------------No license for Failover------------------ show traffic ------------------outside:received (in 865565.090 secs):6139 packets 830375 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):90 packets 6160 bytes0 pkts/sec 0 bytes/secinside:received (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):1 packets 60 bytes0 pkts/sec 0 bytes/secintf2:received (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sec------------------ show perfmon ------------------PERFMON STATS: Current AverageXlates 0/s 0/sConnections 0/s 0/sTCP Conns 0/s 0/sUDP Conns 0/s 0/sURL Access 0/s 0/sURL Server Req 0/s 0/sTCP Fixup 0/s 0/sTCPIntercept 0/s 0/sHTTP Fixup 0/s 0/sFTP Fixup 0/s 0/sAAA Authen 0/s 0/sAAA Author 0/s 0/sAAA Account 0/s 0/s: End_Test_CrashRelated Commands
show crashinfo console
To display the configuration setting of the crashinfo console command, enter the show crashinfo console command in privileged EXEC mode.
show crashinfo console
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Compliance with FIPS 140-2 prohibits the distribution of Critical Secu rity Parameters (keys, passwords, etc.) outside of the crypto boundary (chassis). When the device crashes, due to an assert or checkheaps failure, it is possible that the stack or memory regions dumped to the console contain sensitive data. This output must be suppressed in FIPS-mode.
Examples
sw8-5520(config)# show crashinfo consolecrashinfo console enableRelated Commands
show crypto accelerator statistics
To display the global and accelerator-specific statistics from the hardware crypto accelerator MIB, use the show crypto accelerator statistics command in global configuration or privileged EXEC mode.
show crypto accelerator statistics
Syntax Description
This command has no keywords or variables.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example entered in global configuration mode, displays global crypto accelerator statistics:
hostname # show crypto accelerator statisticsCrypto Accelerator Status-------------------------[Capacity]Supports hardware crypto: TrueSupports modular hardware crypto: FalseMax accelerators: 1Max crypto throughput: 100 MbpsMax crypto connections: 750[Global Statistics]Number of active accelerators: 1Number of non-operational accelerators: 0Input packets: 700Input bytes: 753488Output packets: 700Output error packets: 0Output bytes: 767496[Accelerator 0]Status: ActiveSoftware crypto engineSlot: 0Active time: 167 secondsTotal crypto transforms: 7Total dropped packets: 0[Input statistics]Input packets: 0Input bytes: 0Input hashed packets: 0Input hashed bytes: 0Decrypted packets: 0Decrypted bytes: 0[Output statistics]Output packets: 0Output bad packets: 0Output bytes: 0Output hashed packets: 0Output hashed bytes: 0Encrypted packets: 0Encrypted bytes: 0[Diffie-Hellman statistics]Keys generated: 0Secret keys derived: 0[RSA statistics]Keys generated: 0Signatures: 0Verifications: 0Encrypted packets: 0Encrypted bytes: 0Decrypted packets: 0Decrypted bytes: 0[DSA statistics]Keys generated: 0Signatures: 0Verifications: 0[SSL statistics]Outbound records: 0Inbound records: 0[RNG statistics]Random number requests: 98Random number request failures: 0[Accelerator 1]Status: ActiveEncryption hardware device : Cisco ASA-55x0 on-board accelerator(revision 0x0)Boot microcode : CNlite-MC-Boot-Cisco-1.2SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03IPSec microcode : CNlite-MC-IPSECm-MAIN-2.03Slot: 1Active time: 170 secondsTotal crypto transforms: 1534Total dropped packets: 0[Input statistics]Input packets: 700Input bytes: 753544Input hashed packets: 700Input hashed bytes: 736400Decrypted packets: 700Decrypted bytes: 719944[Output statistics]Output packets: 700Output bad packets: 0Output bytes: 767552Output hashed packets: 700Output hashed bytes: 744800Encrypted packets: 700Encrypted bytes: 728352[Diffie-Hellman statistics]Keys generated: 97Secret keys derived: 1[RSA statistics]Keys generated: 0Signatures: 0Verifications: 0Encrypted packets: 0Encrypted bytes: 0Decrypted packets: 0Decrypted bytes: 0[DSA statistics]Keys generated: 0Signatures: 0Verifications: 0[SSL statistics]Outbound records: 0Inbound records: 0[RNG statistics]Random number requests: 1Random number request failures: 0hostname #Related Commands
show crypto ca certificates
To display the certificates associated with a specific trustpoint or to display all the certificates installed on the system, use the show crypto ca certificates command in global configuration or privileged EXEC mode.
show crypto ca certificates [trustpointname]
Syntax Description
trustpointname
(Optional) The name of a trustpoint. If you do not specify a name, this command displays all certificates installed on the system.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example entered in global configuration mode, displays a CA certificate for a trustpoint named tp1:
hostname(config)# show crypto ca certificates tp1CA CertificateStatus: AvailableCertificate Serial Number 2957A3FF296EF854FD0D6732FE25B45Certificate Usage: SignatureIssuer:CN = ms-root-sha-06-2004OU = rootouO = ciscoL = franklinST - massachusettsC = USEA = a@b.conSubject:CN = ms-root-sha-06-2004OU = rootouO = ciscoL = franklinST = massachusettsC = USEA = a@b.comCRL Distribution Pointldap://w2kadvancedsrv/CertEnroll/ms-root-sha-06-2004.crlValidity Date:start date: 14:11:40 UTC Jun 26 2004end date: 14:01:30 UTC Jun 4 2022Associated Trustpoints: tp2 tp1hostname(config)#Related Commands
show crypto ca crls
To display all cached CRLs or to display all CRLs cached for a specified trustpoint, use the show crypto ca crls command in global configuration or privileged EXEC mode.
show crypto ca crls [trustpointname]
Syntax Description
trustpointname
(Optional) The name of a trustpoint. If you do not specify a name, this command displays all CRLs cached on the system.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
Privileged EXEC
•
•
•
•
Command History
Examples
The following example entered in global configuration mode, displays a CRL for a trustpoint named tp1:
hostname(config)# show crypto ca crls tp1CRL Issuer Name:cn=ms-sub1-ca-5-2004,ou=Franklin DevTest,o=CiscoSystems,l=Franklin,st=MA,c=US,ea=user@cisco.comLastUpdate: 19:45:53 UTC Dec 24 2004NextUpdate: 08:05:53 UTC Jan 1 2005Retrieved from CRL Distribution Point:http://win2k-ad2.frk-ms-pki.cisco.com/CertEnroll/ms-sub1-ca-5-2004.crlAssociated Trustpoints: tp1hostname(config)#Related Commands
show crypto ipsec df-bit
To display the IPSec DF-bit policy for IPSec packets for a specified interface, use the show crypto ipsec df-bit command in global configuration mode and privileged EXEC mode.
show crypto ipsec df-bit interface
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example displays the IPSec DF-bit policy for interface named inside:
hostname(config)# show crypto ipsec df-bit insidedf-bit inside copyhostname(config)#Related Commands
show crypto ipsec fragmentation
To display the fragmentation policy for IPSec packets, use the show crypto ipsec fragmentation command in global configuration or privileged EXEC modes.
show crypto ipsec fragmentation interface
Syntax Description
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example, entered in global configuration mode, displays the IPSec fragmentation policy for an interface named inside:
hostname(config)# show crypto ipsec fragmentation insidefragmentation inside before-encryptionhostname(config)#Related Commands
show crypto key mypubkey
To display key pairs of the indicated type, use the show crypto key mypubkey command in global configuration or privileged EXEC mode.
show crypto key mypubkey {rsa | dsa}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example entered in global configuration mode, displays RSA key pairs:
hostname(config)# show crypto key mypubkey rsa[Display]hostname(config)#Related Commands
crypto key generate dsa
Generates DSA key pairs.
crypto key generate rsa
Generates RSA key pairs.
crypto key zeroize
Removes all key pairs of the indicated type.
show crypto protocol statistics
To display the protocol-specific statistics in the crypto accelerator MIB, use the show crypto protocol statistics command in global configuration or privileged EXEC mode.
show crypto protocol statistics protocol
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following examples entered in global configuration mode, display crypto accelerator statistics for specified protocols:
hostname # show crypto protocol statistics ikev1[IKEv1 statistics]Encrypt packet requests: 39Encapsulate packet requests: 39Decrypt packet requests: 35Decapsulate packet requests: 35HMAC calculation requests: 84SA creation requests: 1SA rekey requests: 3SA deletion requests: 2Next phase key allocation requests: 2Random number generation requests: 0Failed requests: 0hostname # show crypto protocol statistics ipsec[IPsec statistics]Encrypt packet requests: 700Encapsulate packet requests: 700Decrypt packet requests: 700Decapsulate packet requests: 700HMAC calculation requests: 1400SA creation requests: 2SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0hostname # show crypto protocol statistics ssl[SSL statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0hostname # show crypto protocol statistics other[Other statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 99Failed requests: 0hostname # show crypto protocol statistics all[IKEv1 statistics]Encrypt packet requests: 46Encapsulate packet requests: 46Decrypt packet requests: 40Decapsulate packet requests: 40HMAC calculation requests: 91SA creation requests: 1SA rekey requests: 3SA deletion requests: 3Next phase key allocation requests: 2Random number generation requests: 0Failed requests: 0[IKEv2 statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[IPsec statistics]Encrypt packet requests: 700Encapsulate packet requests: 700Decrypt packet requests: 700Decapsulate packet requests: 700HMAC calculation requests: 1400SA creation requests: 2SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[SSL statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[SSH statistics are not supported][SRTP statistics are not supported][Other statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 99Failed requests: 0hostname #Related Commands
show ctiqbe
To display information about CTIQBE sessions established across the security appliance, use the show ctiqbe command in privileged EXEC mode.
show ctiqbe
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show ctiqbe command displays information of CTIQBE sessions established across the security appliance. Along with debug ctiqbe and show local-host, this command is used for troubleshooting CTIQBE inspection engine issues.
Note
Examples
The following is sample output from the show ctiqbe command under the following conditions. There is only one active CTIQBE session setup across the security appliance. It is established between an internal CTI device (for example, a Cisco IP SoftPhone) at local address 10.0.0.99 and an external Cisco Call Manager at 172.29.1.77, where TCP port 2748 is the Cisco CallManager. The heartbeat interval for the session is 120 seconds.
hostname# | show ctiqbeTotal: 1| LOCAL | FOREIGN | STATE | HEARTBEAT---------------------------------------------------------------1 | 10.0.0.99/1117 172.29.1.77/2748 | 1 | 120| RTP/RTCP: PAT xlates: mapped to 172.29.1.99(1028 | 1029)| MEDIA: Device ID 27 | Call ID 0| Foreign 172.29.1.99 | (1028 | 1029)| Local | 172.29.1.88 | (26822 | 26823)| ----------------------------------------------The CTI device has already registered with the CallManager. The device internal address and RTP listening port is PATed to 172.29.1.99 UDP port 1028. Its RTCP listening port is PATed to UDP 1029.
The line beginning with RTP/RTCP: PAT xlates: appears only if an internal CTI device has registered with an external CallManager and the CTI device address and ports are PATed to that external interface. This line does not appear if the CallManager is located on an internal interface, or if the internal CTI device address and ports are NATed to the same external interface that is used by the CallManager.
The output indicates a call has been established between this CTI device and another phone at 172.29.1.88. The RTP and RTCP listening ports of the other phone are UDP 26822 and 26823. The other phone locates on the same interface as the CallManager because the security appliance does not maintain a CTIQBE session record associated with the second phone and CallManager. The active call leg on the CTI device side can be identified with Device ID 27 and Call ID 0.
The following is the xlate information for these CTIBQE connections:
hostname# show xlate debug3 in use, 3 most usedFlags: D | DNS, d | dump, I | identity, i | inside, n | no random,| o | outside, r | portmap, s | staticTCP PAT from inside:10.0.0.99/1117 to outside:172.29.1.99/1025 flags ri idle 0:00:22 timeout 0:00:30UDP PAT from inside:10.0.0.99/16908 to outside:172.29.1.99/1028 flags ri idle 0:00:00 timeout 0:04:10UDP PAT from inside:10.0.0.99/16909 to outside:172.29.1.99/1029 flags ri idle 0:00:23 timeout 0:04:10Related Commands
show curpriv
To display the current user privileges, use the show curpriv command:
show curpriv
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Privileged EXEC
•
•
—
—
•
Unprivileged
•
•
—
—
•
Command History
Usage Guidelines
The show curpriv command displays the current privilege level. Lower privilege level numbers indicate lower privilege levels.
Examples
These examples show output from the show curpriv command when a user named enable_15 is at different privilege levels. The username indicates the name that the user entered when the user logged in, P_PRIV indicates that the user has entered the enable command, and P_CONF indicates that the user has entered the config terminal command.
hostname(config)# show curprivUsername : enable_15Current privilege level : 15Current Mode/s : P_PRIV P_CONFhostname(config)# exithostname(config)# show curprivUsername : enable_15Current privilege level : 15Current Mode/s : P_PRIVhostname(config)# exithostname(config)# show curprivUsername : enable_1Current privilege level : 1Current Mode/s : P_UNPRhostname(config)#Related Commands
clear configure privilege
Remove privilege command statements from the configuration.
show running-config privilege
Display privilege levels for commands.
show debug
To show the current debugging configuration, use the show debug command.
show debug [command [keywords]]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The valid command values follow. For information about valid syntax after command, see the entry for debug command, as applicable.
Note
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following commands enable debugging for authentication, accounting, and Flash memory. The show debug command is used in three ways to demonstrate how you can use it to view all debugging configuration, debugging configuration for a specific feature, and even debugging configuration for a subset of a feature.
hostname# debug aaa authenticationdebug aaa authentication enabled at level 1hostname# debug aaa accountingdebug aaa accounting enabled at level 1hostname# debug disk filesystemdebug disk filesystem enabled at level 1hostname# show debugdebug aaa authentication enabled at level 1debug aaa accounting enabled at level 1debug disk filesystem enabled at level 1hostname# show debug aaadebug aaa authentication enabled at level 1debug aaa authorization is disabled.debug aaa accounting enabled at level 1debug aaa internal is disabled.debug aaa vpn is disabled.hostname# show debug aaa accountingdebug aaa accounting enabled at level 1hostname#Related Commands
show dhcpd
To view DHCP binding, state, and statistical information, use the show dhcpd command in privileged EXEC or global configuration mode.
show dhcpd {binding [IP_address] | state | statistics}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
If you include the optional IP address in the show dhcpd binding command, only the binding for that IP address is shown.
The show dhcpd binding | state | statistics commands are also available in global configuration mode.
Examples
The following is sample output from the show dhcpd binding command:
hostname# show dhcpd bindingIP Address Hardware Address Lease Expiration Type10.0.1.100 0100.a0c9.868e.43 84985 seconds automaticThe following is sample output from the show dhcpd state command:
hostname# show dhcpd stateContext Not Configured for DHCPInterface outside, Not Configured for DHCPInterface inside, Not Configured for DHCPThe following is sample output from the show dhcpd statistics command:
hostname# show dhcpd statisticsDHCP UDP Unreachable Errors: 0DHCP Other UDP Errors: 0Address pools 1Automatic bindings 1Expired bindings 1Malformed messages 0Message ReceivedBOOTREQUEST 0DHCPDISCOVER 1DHCPREQUEST 2DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0Message SentBOOTREPLY 0DHCPOFFER 1DHCPACK 1DHCPNAK 1Related Commands
show dhcprelay state
To view the state of the DHCP relay agent, use the show dhcprelay state command in privileged EXEC or global configuration mode.
show dhcprelay state
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
This command displays the DHCP relay agent state information for the current context and each interface.
Examples
The following is sample output from the show dhcprelay state command:
hostname# show dhcprelay stateContext Configured as DHCP RelayInterface outside, Not Configured for DHCPInterface infrastructure, Configured for DHCP RELAY SERVERInterface inside, Configured for DHCP RELAYRelated Commands
show dhcprelay statistics
To display the DHCP relay statistics, use the show dhcprelay statistics command in privileged EXEC mode.
show dhcprelay statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The output of the show dhcprelay statistics command increments until you enter the clear dhcprelay statistics command.
Examples
The following shows sample output for the show dhcprelay statistics command:
hostname# show dhcprelay statisticsDHCP UDP Unreachable Errors: 0DHCP Other UDP Errors: 0Packets RelayedBOOTREQUEST 0DHCPDISCOVER 7DHCPREQUEST 3DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0BOOTREPLY 0DHCPOFFER 7DHCPACK 3DHCPNAK 0FeralPix(config)#Related Commands
show disk
To display the contents of the Flash memory, use the show disk command in privileged EXEC mode. To view the Flash memory for a PIX security appliance, see the show flash command.
show disk[0 | 1] [filesys | all]
Syntax Description
Defaults
Shows the internal Flash memory by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show disk command:
hostname# show disk-#- --length-- -----date/time------ path11 1301 Feb 21 2005 18:01:34 test.cfg12 1949 Feb 21 2005 20:13:36 test1.cfg13 2551 Jan 06 2005 10:07:36 test2.cfg14 609223 Jan 21 2005 07:14:18 test3.cfg15 1619 Jul 16 2004 16:06:48 test4.cfg16 3184 Aug 03 2004 07:07:00 old_running.cfg17 4787 Mar 04 2005 12:32:18 test5.cfg20 1792 Jan 21 2005 07:29:24 test6.cfg21 7765184 Mar 07 2005 19:38:30 test7.cfg22 1674 Nov 11 2004 02:47:52 test8.cfg23 1863 Jan 21 2005 07:29:18 test9.cfg24 1197 Jan 19 2005 08:17:48 test10.cfg25 608554 Jan 13 2005 06:20:54 backupconfig.cfg26 5124096 Feb 20 2005 08:49:28 cdisk127 5124096 Mar 01 2005 17:59:56 cdisk228 2074 Jan 13 2005 08:13:26 test11.cfg29 5124096 Mar 07 2005 19:56:58 cdisk330 1276 Jan 28 2005 08:31:58 lead31 7756788 Feb 24 2005 12:59:46 asdmfile.dbg32 7579792 Mar 08 2005 11:06:56 asdmfile1.dbg33 7764344 Mar 04 2005 12:17:46 asdmfile2.dbg34 5124096 Feb 24 2005 11:50:50 cdisk435 15322 Mar 04 2005 12:30:24 hs_err.log10170368 bytes available (52711424 bytes used)The following is sample output from the show disk filesys command:
hostname# show disk filesys******** Flash Card Geometry/Format Info ********COMPACT FLASH CARD GEOMETRYNumber of Heads: 4Number of Cylinders 978Sectors per Cylinder 32Sector Size 512Total Sectors 125184COMPACT FLASH CARD FORMATNumber of FAT Sectors 61Sectors Per Cluster 8Number of Clusters 15352Number of Data Sectors 122976Base Root Sector 123Base FAT Sector 1Base Data Sector 155Related Commands
dir
Displays the directory contents.
show flash
Displays the contents of the internal Flash memory.
show dns-hosts
To show the DNS cache, use the show dns-hosts command in privileged EXEC mode.The DNS cache includes dynamically learned entries from a DNS server as well as manually entered name and IP addresses using the name command.
show dns-hosts
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show dns-hosts command:
hostname# show dns-hostsHost Flags Age Type Address(es)ns2.example.com (temp, OK) 0 IP 10.102.255.44ns1.example.com (temp, OK) 0 IP 192.168.241.185snowmass.example.com (temp, OK) 0 IP 10.94.146.101server.example.com (temp, OK) 0 IP 10.94.146.80Table 7-11 shows each field description.
Related Commands
show failover
To display information about the failover status of the unit, use the show failover command in privileged EXEC mode.
show failover [group num | history | interface | state | statistics]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show failover command displays the dynamic failover information, interface status, and Stateful Failover statistics. The Stateful Failover Logical Update Statistics output appears only when Stateful Failover is enabled. The "xerr" and "rerr" values do not indicate errors in failover, but rather the number of packet transmit or receive errors.
In the show failover command output, the fields have the following values:
•
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
–
–
–
If you do not enter a failover IP address, the show failover command displays 0.0.0.0 for the IP address, and monitoring of the interfaces remain in a "waiting" state. You must set a failover IP address for failover to work.
Table 7-14 describes the interface states for failover.
In multiple configuration mode, only the show failover command is available in a security context; you cannot enter the optional keywords.
Examples
The following is sample output from the show failover command for Active/Standby Failover.
hostname# show failoverFailover OnCable status: N/A - LAN-based failover enabledFailover unit PrimaryFailover LAN Interface: fover Ethernet2 (up)Unit Poll frequency 1 seconds, holdtime 3 secondsInterface Poll frequency 15 secondsInterface Policy 1Monitored Interfaces 2 of 250 maximumfailover replication httpLast Failover at: 22:44:03 UTC Dec 8 2004This host: Primary - ActiveActive time: 13434 (sec)Interface inside (10.130.9.3): NormalInterface outside (10.132.9.3): NormalOther host: Secondary - Standby ReadyActive time: 0 (sec)Interface inside (10.130.9.4): NormalInterface outside (10.132.9.4): NormalStateful Failover Logical Update StatisticsLink : fover Ethernet2 (up)Stateful Obj xmit xerr rcv rerrGeneral 0 0 0 0sys cmd 1733 0 1733 0up time 0 0 0 0RPC services 0 0 0 0TCP conn 6 0 0 0UDP conn 0 0 0 0ARP tbl 106 0 0 0Xlate_Timeout 0 0 0 0VPN IKE upd 15 0 0 0VPN IPSEC upd 90 0 0 0VPN CTCP upd 0 0 0 0VPN SDI upd 0 0 0 0VPN DHCP upd 0 0 0 0Logical Update Queue InformationCur Max TotalRecv Q: 0 2 1733Xmit Q: 0 2 15225The following is sample output from the show failover command for Active/Active Failover.
hostname# show failoverFailover OnFailover unit PrimaryFailover LAN Interface: third GigabitEthernet0/2 (up)Unit Poll frequency 1 seconds, holdtime 15 secondsInterface Poll frequency 4 secondsInterface Policy 1Monitored Interfaces 8 of 250 maximumfailover replication httpGroup 1 last failover at: 13:40:18 UTC Dec 9 2004Group 2 last failover at: 13:40:06 UTC Dec 9 2004This host: PrimaryGroup 1 State: ActiveActive time: 2896 (sec)Group 2 State: Standby ReadyActive time: 0 (sec)slot 0: ASA-5530 hw/sw rev (1.0/7.0(0)79) status (Up Sys)slot 1: SSM-IDS-20 hw/sw rev (1.0/5.0(0.11)S91(0.11)) status (Up)admin Interface outside (10.132.8.5): Normaladmin Interface third (10.132.9.5): Normaladmin Interface inside (10.130.8.5): Normaladmin Interface fourth (10.130.9.5): Normalctx1 Interface outside (10.1.1.1): Normalctx1 Interface inside (10.2.2.1): Normalctx2 Interface outside (10.3.3.2): Normalctx2 Interface inside (10.4.4.2): NormalOther host: SecondaryGroup 1 State: Standby ReadyActive time: 190 (sec)Group 2 State: ActiveActive time: 3322 (sec)slot 0: ASA-5530 hw/sw rev (1.0/7.0(0)79) status (Up Sys)slot 1: SSM-IDS-20 hw/sw rev (1.0/5.0(0.1)S91(0.1)) status (Up)admin Interface outside (10.132.8.6): Normaladmin Interface third (10.132.9.6): Normaladmin Interface inside (10.130.8.6): Normaladmin Interface fourth (10.130.9.6): Normalctx1 Interface outside (10.1.1.2): Normalctx1 Interface inside (10.2.2.2): Normalctx2 Interface outside (10.3.3.1): Normalctx2 Interface inside (10.4.4.1): NormalStateful Failover Logical Update StatisticsLink : third GigabitEthernet0/2 (up)Stateful Obj xmit xerr rcv rerrGeneral 0 0 0 0sys cmd 380 0 380 0up time 0 0 0 0RPC services 0 0 0 0TCP conn 1435 0 1450 0UDP conn 0 0 0 0ARP tbl 124 0 65 0Xlate_Timeout 0 0 0 0VPN IKE upd 15 0 0 0VPN IPSEC upd 90 0 0 0VPN CTCP upd 0 0 0 0VPN SDI upd 0 0 0 0VPN DHCP upd 0 0 0 0Logical Update Queue InformationCur Max TotalRecv Q: 0 1 1895Xmit Q: 0 0 1940The following is sample output from the show failover state command for an active-active setup:
hostname(config)# show failover stateState Last Failure Reason Date/TimeThis host - SecondaryGroup 1 Failed Backplane Failure 03:42:29 UTC Apr 17 2009Group 2 Failed Backplane Failure 03:42:29 UTC Apr 17 2009Other host - PrimaryGroup 1 Active Comm Failure 03:41:12 UTC Apr 17 2009Group 2 Active Comm Failure 03:41:12 UTC Apr 17 2009====Configuration State===Sync Done====Communication State===Mac setThe following is sample output from the show failover state command for an active-standby setup:
hostname(config)# show failover stateState Last Failure Reason Date/TimeThis host - PrimaryNegotiation Backplane Failure 15:44:56 UTC Jun 20 2009Other host - SecondaryNot Detected Comm Failure 15:36:30 UTC Jun 20 2009====Configuration State===Sync Done====Communication State===Mac setTable 7-15 describes the output of the show failover state command.
