Table Of Contents

email through functions Commands

email

enable

enable (webvpn)

enable gprs

enable password

encryption

endpoint

endpoint-mapper

enforcenextupdate

enrollment retry count

enrollment retry period

enrollment terminal

enrollment url

eou allow

eou clientless

eou initialize

eou max-retry

eou port

eou revalidate

eou timeout

erase

esp

established

exceed-mss

exit

expiry-time

failover

failover active

failover group

failover interface ip

failover interface-policy

failover key

failover lan enable

failover lan interface

failover lan unit

failover link

failover mac address

failover polltime

failover polltime interface

failover reload-standby

failover replication http

failover reset

failover timeout

file-bookmarks

file-encoding

filter

filter activex

filter ftp

filter https

filter java

filter url

fips enable

fips self-test poweron

firewall transparent

format

forward interface

fqdn

fragment

frequency

fsck

ftp mode passive

functions

email through functions Commands

---

email

To include the indicated email address in the Subject Alternative Name extension of the certificate during enrollment, use the email command in crypto ca trustpoint configuration mode. To restore the default setting, use the no form of the command.

email address

no email

Syntax Description

address

Specifies the email address. The maximum length of address is 64 characters.

Defaults

The default setting is not set.

Command Modes

The following table shows the modes in which you can enter the

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Crypto ca trustpoint configuration	•	•	•

command:

Command History

Release	Modification
7.0(1)	This command was introduced.

Examples

The following example enters crypto ca trustpoint configuration mode for trustpoint central, and includes the email address jjh@nhf.net in the enrollment request for trustpoint central:

hostname(config)# crypto ca trustpoint central

hostname(ca-trustpoint)# email jjh@nhf.net

hostname(ca-trustpoint)# 

Related Commands

Command	Description
crypto ca trustpoint	Enters trustpoint configuration mode.

enable

To enter privileged EXEC mode, use the enable command in user EXEC mode.

enable [level]

Syntax Description

level

(Optional) The privilege level between 0 and 15.

Defaults

Enters privilege level 15 unless you are using command authorization, in which case the default level depends on the level configured for your username.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
User EXEC	•	•	•	•	•

Command History

Release	Modification
Preexisting	This command was preexisting.

Usage Guidelines

The default enable password is blank. See the enable password command to set the password.

To use privilege levels other than the default of 15, configure local command authorization (see the aaa authorization command command and specify the LOCAL keyword), and set the commands to different privilege levels using the privilege command. If you do not configure local command authorization, the enable levels are ignored, and you have access to level 15 regardless of the level you set. See the show curpriv command to view your current privilege level.

Levels 2 and above enter privileged EXEC mode. Levels 0 and 1 enter user EXEC mode.

Enter the disable command to exit privileged EXEC mode.

Examples

The following example enters privileged EXEC mode:

hostname> enable

Password: Pa$$w0rd

hostname#

The following example enters privileged EXEC mode for level 10:

hostname> enable 10

Password: Pa$$w0rd10

hostname#

Related Commands

Command	Description
enable password	Sets the enable password.
disable	Exits privileged EXEC mode.
aaa authorization command	Configures command authorization.
privilege	Sets the command privilege levels for local command authorization.
show curpriv	Shows the currently logged in username and the user privilege level.

enable (webvpn)

To enable WebVPN or e-mail proxy access on a previously configured interface, use the enable command. For WebVPN, use this command in webvpn mode. For e-mail proxies (IMAP4S. POP3S, SMTPS), use this command in the applicable e-mail proxy mode. To disable WebVPN on an interface, use the no version of the command.

enable ifname

no enable

Syntax Description

ifname

Identifies the previously configured inteface. Use the nameif command to configure interfaces.

Defaults

WebVPN is disabled by default.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Webvpn	•	—	•	—	—
Imap4s	•	—	•	—	—
Pop3s	•	—	•	—	—
SMTPS	•	—	•	—	—

Command History

Release	Modification
7.0(1)(1)	This command was introduced.

Examples

The following example shows how to enable WebVPN on the interface named Outside:

hostname(config)# webvpn

hostname(config-webvpn)# enable Outside

The following example shows how to configure POP3S e-mail proxy on the interface named Outside:

hostname(config)# pop3s

hostname(config-pop3s)# enable Outside

enable gprs

To enable GPRS with RADIUS accounting, use the enable gprs command in radius-accounting parameter configuration mode, which is accessed by using the inspect radius-accounting command. The security appliance will check for the 3GPP VSA 26-10415 in the Accounting-Request Stop messages in order to properly handle secondary PDP contexts.

This option is disabled by default. A GTP license is required to enable this feature.

enable gprs

no enable gprs

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
radius-accounting parameter configuration	•	•	•	•	—

Command History

Release	Modification
7.2(1)	This command was introduced.

Examples

The following example shows how to enable GPRS with RADIUS accounting:

hostname(config)# policy-map type inspect radius-accounting ra

hostname(config-pmap)# parameters

hostname(config-pmap-p)# enable gprs

Related Commands

Commands	Description
inspect radius-accounting	Sets inspection for RADIUS accounting.
parameters	Sets parameters for an inspection policy map.

enable password

To set the enable password for privileged EXEC mode, use the enable password command in global configuration mode. To remove the password for a level other than 15, use the no form of this command. You cannot remove the level 15 password.

enable password password [level level] [encrypted]

no enable password level level

Syntax Description

encrypted	(Optional) Specifies that the password is in encrypted form. The password is saved in the configuration in encrypted form, so you cannot view the original password after you enter it. If for some reason you need to copy the password to another security appliance but do not know the original password, you can enter the enable password command with the encrypted password and this keyword. Normally, you only see this keyword when you enter the show running-config enable command.
level level	(Optional) Sets a password for a privilege level between 0 and 15.
password	Sets the password as a case-sensitive string of up to 16 alphanumeric and special characters. You can use any character in the password except a question mark or a space.

Defaults

The default password is blank. The default level is 15.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	•

Command History

Release	Modification
Preexisting	This command was preexisting.

Usage Guidelines

The default password for enable level 15 (the default level) is blank. To reset the password to be blank, do not enter any text for the password.

For multiple context mode, you can create an enable password for the system configuration as well as for each context.

To use privilege levels other than the default of 15, configure local command authorization (see the aaa authorization command command and specify the LOCAL keyword), and set the commands to different privilege levels using the privilege command. If you do not configure local command authorization, the enable levels are ignored, and you have access to level 15 regardless of the level you set. See the show curpriv command to view your current privilege level.

Levels 2 and above enter privileged EXEC mode. Levels 0 and 1 enter user EXEC mode.

Examples

The following example sets the enable password to Pa$$w0rd:

hostname(config)# enable password Pa$$w0rd

The following example sets the enable password to Pa$$w0rd10 for level 10:

hostname(config)# enable password Pa$$w0rd10 level 10

The following example sets the enable password to an encrypted password that you copied from another security appliance:

hostname(config)# enable password jMorNbK0514fadBh encrypted

Related Commands

Command	Description
aaa authorization command	Configures command authorization.
enable	Enters privileged EXEC mode.
privilege	Sets the command privilege levels for local command authorization.
show curpriv	Shows the currently logged in username and the user privilege level.
show running-config enable	Shows the enable passwords in encrypted form.

encryption

To specify the encryption algorithm to use within an IKE policy, use the encryption command in crypto isakmp policy configuration mode. To reset the encryption algorithm to the default value, which is des, use the no form of this command.

encryption {aes | aes-192| aes-256 | des | 3des}

no encryption {aes | aes-192| aes-256 | des | 3des}

Syntax Description

3des	Specifies that the Triple DES encryption algorithm be used in the IKE policy.
aes	Specifies that the encryption algorithm to use in the IKE policy is AES with a 128-bit key.
aes-192	Specifies that the encryption algorithm to use in the IKE policy is AES with a 192-bit key.
aes-256	Specifies that the encryption algorithm to use in the IKE policy is AES with a 256-bit key.
des	Specifies that the encryption algorithm to use in the IKE policy is 56-bit DES-CBC.
priority	Uniquely identifies the Internet Key Exchange (IKE) policy and assigns a priority to the policy. Use an integer from 1 to 65,534, with 1 being the highest priority and 65,534 the lowest.

Defaults

The default ISAKMP policy encryption is 3des.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Crypto isakmp policy configuration	•	—	•	—	—

Command History

Release	Modification
7.0(1)(1)	The isakmp policy encryption command was preexisting.
7.2.(1)	The encryption command replaces the isakmp policy encryption command.

Examples

The following example, entered in global configuration mode, shows use of the encryption command; it sets 128-bit key AES encryption as the algorithm to be used within the IKE policy with the priority number of 25.

hostname(config)# crypto isakmp policy 25 

hostname(config-isakmp-policy)# encryption aes

The following example, entered in global configuration mode, sets the 3DES algorithm to be used within the IKE policy with the priority number of 40.

hostname(config)# crypto isakmp policy 40 

hostname(config-isakmp-policy)# encryption 3des

Related Commands

Command	Description
clear configure crypto isakmp	Clears all the ISAKMP configuration.
clear configure crypto isakmp policy	Clears all ISAKMP policy configuration.
clear crypto isakmp sa	Clears the IKE runtime SA database.
show running-config crypto isakmp	Displays all the active configuration.

endpoint

To add an endpoint to an HSI group for H.323 protocol inspection, use the endpoint command in hsi group configuration mode. To disable this feature, use the no form of this command.

endpoint ip_address if_name

no endpoint ip_address if_name

Syntax Description

ip_address	IP address of the endpoint to add. A maximum of ten endpoints per HSI group is allowed.
if_name	The interface through which the endpoint is connected to the security appliance.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
HSI group configuration	•	•	•	•	—

Command History

Release	Modification
7.2(1)	This command was introduced.

Examples

The following example shows how to add endpoints to an HSI group in an H.323 inspection policy map:

hostname(config-pmap-p)# hsi-group 10

hostname(config-h225-map-hsi-grp)# endpoint 10.3.6.1 inside

hostname(config-h225-map-hsi-grp)# endpoint 10.10.25.5 outside

Related Commands

Command	Description
class-map	Creates a Layer 3/4 class map.
hsi-group	Creates an HSI group.
hsi	Adds an HSI to the HSI group.
policy-map	Creates a Layer 3/4 policy map.
show running-config policy-map	Display all current policy map configurations.

endpoint-mapper

To configure endpoint mapper options for DCERPC inspection, use the endpoint-mapper command in parameters configuration mode. To disable this feature, use the no form of this command.

endpoint-mapper [epm-service only] [lookup-operation [timeout value]]

no endpoint-mapper [epm-service only] [lookup-operation [timeout value]]

Syntax Description

epm-service only	Specifies to enforce endoint mapper service during binding.
lookup-operation	Specifies to enable lookup operation of the endpoint mapper service.
timeout value	Specifies the timeout for pinholes from the lookup operation. Range is from 0:0:1 to 1193:0:0.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Parameters configuration	•	•	•	•	—

Command History

Release	Modification
7.2(1)	This command was introduced.

Examples

The following example shows how to configure the endpoint mapper in a DCERPC policy map:

hostname(config)# policy-map type inspect dcerpc dcerpc_map

hostname(config-pmap)# parameters

hostname(config-pmap-p)# endpoint-mapper epm-service-only

Related Commands

Command	Description
class	Identifies a class map name in the policy map.
class-map type inspect	Creates an inspection class map to match traffic specific to an application.
policy-map	Creates a Layer 3/4 policy map.
show running-config policy-map	Display all current policy map configurations.

enforcenextupdate

To specify how to handle the NextUpdate CRL field, use the enforcenextupdate command in ca-crl configuration mode. If set, this command requires CRLs to have a NextUpdate field that has not yet lapsed. If not used, the security appliance allows a missing or lapsed NextUpdate field in a CRL.

To permit a lapsed or missing NextUpdate field, use the no form of this command.

enforcenextupdate

no enforcenextupdate

Syntax Description

This command has no arguments or keywords.

Defaults

The default setting is enforced (on).

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
CRL configuration	•	•	•	•	•

Command History

Release	Modification
7.0(1)	This command was introduced.

Examples

The following example enters ca-crl configuration mode, and requires CRLs to have a NextUpdate field that has not expired for trustpoint central:

hostname(config)# crypto ca trustpoint central

hostname(ca-trustpoint)# crl configure

hostname(ca-crl)# enforcenextupdate

hostname(ca-crl)# 

Related Commands

Command	Description
cache-time	Specifies a cache refresh time in minutes.
crl configure	Enters ca-crl configuration mode.
crypto ca trustpoint	Enters trustpoint configuration mode.

enrollment retry count

To specify a retry count, use the enrollment retry count command in Crypto ca trustpoint configuration mode. After requesting a certificate, the security appliance waits to receive a certificate from the CA. If the security appliance does not receive a certificate within the configured retry period, it sends another certificate request. The security appliance repeats the request until either it receives a response or reaches the end of the configured retry period.

To restore the default setting of the retry count, use the no form of the command.

enrollment retry count number

no enrollment retry count

Syntax Description

number

The maximum number of attempts to send an enrollment request. The valid range is 0, 1-100 retries.

Defaults

The default setting for number is 0 (unlimited).

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Crypto ca trustpoint configuration	•	•	•	•	—

Command History

Release	Modification
7.0(1)	This command was introduced.

Usage Guidelines

This command is optional and applies only when automatic enrollment is configured.

Examples

The following example enters crypto ca trustpoint configuration mode for trustpoint central, and configures an enrollment retry count of 20 retries within trustpoint central:

hostname(config)# crypto ca trustpoint central

hostname(ca-trustpoint)# enrollment retry count 20

hostname(ca-trustpoint)# 

Related Commands

Command	Description
crypto ca trustpoint	Enters trustpoint configuration mode.
default enrollment	Returns enrollment parameters to their defaults.
enrollment retry period	Specifies the number of minutes to wait before resending an enrollment request.

enrollment retry period

To specify a retry period, use the enrollment retry period command in crypto ca trustpoint configuration mode. After requesting a certificate, the security appliance waits to receive a certificate from the CA. If the security appliance does not receive a certificate within the specified retry period, it sends another certificate request.

To restore the default setting of the retry period, use the no form of the command.

enrollment retry period minutes

no enrollment retry period

Syntax Description

minutes

The number of minutes between attempts to send an enrollment request. the valid range is 1- 60 minutes.

Defaults

The default setting is 1 minute.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Crypto ca trustpoint configuration	•	•	•	•	•

Command History

Release	Modification
7.0(1)	This command was introduced.

Usage Guidelines

This command is optional and applies only when automatic enrollment is configured.

Examples

The following example enters crypto ca trustpoint configuration mode for trustpoint central, and configures an enrollment retry period of 10 minutes within trustpoint central:

hostname(config)# crypto ca trustpoint central

hostname(ca-trustpoint)# enrollment retry period 10

hostname(ca-trustpoint)# 

Related Commands

Command	Description
crypto ca trustpoint	Enters trustpoint configuration mode.
default enrollment	Returns all enrollment parameters to their system default values.
enrollment retry count	Defines the number of retries to requesting an enrollment.

enrollment terminal

To specify cut and paste enrollment with this trustpoint (also known as manual enrollment), use the enrollment terminal command in crypto ca trustpoint configuration mode. To restore the default setting of the command, use the no form of the command.

enrollment terminal

no enrollment terminal

Syntax Description

This command has no arguments or keywords.

Defaults

The default setting is off.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Crypto ca trustpoint configuration	•	•	•	•	—

Command History

Release	Modification
7.0(1)	This command was introduced.

Examples

The following example enters crypto ca trustpoint configuration mode for trustpoint central, and specifies the cut and paste method of CA enrollment for trustpoint central:

hostname(config)# crypto ca trustpoint central

hostname(ca-trustpoint)# enrollment terminal

hostname(ca-trustpoint)# 

Related Commands

Command	Description
crypto ca trustpoint	Enters trustpoint configuration mode.
default enrollment	Returns enrollment parameters to their defaults.
enrollment retry count	Specifies the number of retries to attempt to send an enrollment request.
enrollment retry period	Specifies the number of minutes to wait before resending an enrollment request.
enrollment url	Specifies automatic enrollment (SCEP) with this trustpoint and configures the URL.

enrollment url

To specify automatic enrollment (SCEP) to enroll with this trustpoint and to configure the enrollment URL, use the enrollment url command in crypto ca trustpoint configuration mode. To restore the default setting of the command, use the no form of the command.

enrollment url url

no enrollment url

Syntax Description

url	Specifies the name of the URL for automatic enrollment. The maximum length is 1K characters (effectively unbounded).

Defaults

The default setting is off.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Crypto ca trustpoint configuration	•	•	•	•	•

Command History

Release	Modification
7.0(1)	This command was introduced.

Examples

The following example enters crypto ca trustpoint configuration mode for trustpoint central, and specifies SCEP enrollment at the URL https://enrollsite for trustpoint central:

hostname(config)# crypto ca trustpoint central

hostname(ca-trustpoint)# enrollment url https://enrollsite

hostname(ca-trustpoint)# 

Related Commands

Command	Description
crypto ca trustpoint	Enters trustpoint configuration mode.
default enrollment	Returns enrollment parameters to their defaults.
enrollment retry count	Specifies the number of retries to attempt to send an enrollment request.
enrollment retry period	Specifies the number of minutes to wait before resending an enrollment request.
enrollment terminal	Specifies cut and paste enrollment with this trustpoint.

eou allow

To enable clientless authentication, use the eou allow command in global configuration mode. To disable clientless authentication, use the no form of this command.

eou allow clientless

no eou allow clientless

Syntax Description

This command has no arguments or keywords.

Defaults

Clientless authentication is enabled by default.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
global configuration	•	—	•	—	—

Command History

Release	Modification
7.2(1)	This command was introduced.

Usage Guidelines

This command applies only to hosts that do not respond to EAPoUDP requests. It is effective only if all of the following are true:

•An Access Control Server is configured on the network to support clientless authentication.

•Network Admission Control is configured on the security appliance.

Examples

The following example enables clientless authentication:

hostname(config)# eou allow clientless

hostname(config)# 

The following example disables clientless authentication:

hostname(config)# no eou allow clientless

hostname(config)# 

Related Commands

Command	Description
debug eap	Enables logging of EAP events to debug NAC messaging.
debug eou	Enables logging of EAP over UDP (EAPoUDP) events to debug NAC messaging.
debug nac	Enables logging of NAC events.
eou clientless	Changes the username and password used for clientless authentication.

eou clientless

To change the username and password to be sent to the Access Control Server for clientless authentication, use the eou clientless command in global configuration mode. To use the default value, use the no form of this command.

eou clientless username username

eou clientless password