-
Cisco Security Appliance Command Reference, Version 7.2
-
About this Guide
-
Using the Command Line Interface
-
aaa accounting command through accounting-server-group Commands
-
acl-netmask-convert through auto-update timeout Commands
-
backup interface through browse networks Commands
-
cache through clear compression Commands
-
clear conn through clear configure vpn-load-balancing Commands
-
clear console-output through clear xlate Commands
-
client-access-rule through crl-configure Commands
-
crypto ca authenticate through customization Commands
-
ddns through debug xdmcp Commands
-
default through duplex Commands
-
email through functions Commands
-
gateway through hw-module module shutdown Commands
-
icmp through imap4s Commands
-
inspect ctiqbe through inspect xdmcp Commands
-
intercept-dhcp through issuer-name Commands
-
java-trustpoint through kill Commands
-
l2tp tunnel hello through log-adj-changes Commands
-
logging asdm through logout message Commands
-
mac-address through multicast-routing Commands
-
name through override-account-disable Commands
-
packet-tracer through pwd Commands
-
queue-limit through router rip Commands
-
same-security-traffic through show asdm sessions Commands
-
show asp drop through show curpriv Commands
-
show ddns through show ipv6 traffic Commands
-
show isakmp sa through show route Commands
-
show running-config through show running-config isakmp Commands
-
show running-config ldap through show running-config webvpn auto-signon Commands
-
show service-policy through show xlate Commands
-
shun through sysopt radius ignore-secret Commands
-
tcp-map through tx-ring-limit Commands
-
urgent-flag through write terminal Commands
-
Table Of Contents
show isakmp ipsec-over-tcp stats through show route Commands
show isakmp ipsec-over-tcp stats
show memory delayed-free-poisoner
show priority-queue statistics
show isakmp ipsec-over-tcp stats through show route Commands
show isakmp ipsec-over-tcp stats
To display runtime statistics for IPsec over TCP, use the show isakmp ipsec-over tcp stats command in global configuration mode or privileged EXEC mode.
show isakmp ipsec-over-tcp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp ipsec-over-tcp statsGlobal IPSec over TCP Statistics--------------------------------Embryonic connections: 2Active connections: 132Previous connections: 146Inbound packets: 6000Inbound dropped packets: 30Outbound packets: 0Outbound dropped packets: 0RST packets: 260Received ACK heart-beat packets: 10Bad headers: 0Bad trailers: 0Timer failures: 0Checksum errors: 0Internal errors: 0hostname(config)#Related Commands
show isakmp sa
To display the IKE runtime SA database, use the show isakmp sa command in global configuration mode or privileged EXEC mode.
show isakmp sa [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
7.0(1)
The show isakmp sa command was introduced.
7.2(1)
This command was deprecated. The show crypto isakmp sa command replaces it.
Usage Guidelines
The output from this command includes the following fields:
Detail not specified.
Table 27-2
IKE Peer
Type
Dir
Rky
State
Encrypt
Hash
Auth
Lifetime
209.165.200.225
L2L
Init
No
MM_Active
3des
md5
preshrd
86400
Detail specified.
Examples
The following example, entered in global configuration mode, displays detailed information about the SA database:
hostname(config)# show isakmp sa detailhostname(config)# sho isakmp sa detailIKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime1 209.165.200.225 User Resp No AM_Active 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime2 209.165.200.226 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime3 209.165.200.227 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime4 209.165.200.228 User Resp No AM_ACTIVE 3des SHA preshrd 86400hostname(config)#Related Commands
show isakmp stats
To display runtime statistics, use the show isakmp stats command in global configuration mode or privileged EXEC mode.
show isakmp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
7.0(1)
The show isakmp stats command was introduced.
7.2(1)
This command was deprecated. The show crypto isakmp stats command replaces it.
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp statsGlobal IKE StatisticsActive Tunnels: 132Previous Tunnels: 132In Octets: 195471In Packets: 1854In Drop Packets: 925In Notifys: 0In P2 Exchanges: 132In P2 Exchange Invalids: 0In P2 Exchange Rejects: 0In P2 Sa Delete Requests: 0Out Octets: 119029Out Packets: 796Out Drop Packets: 0Out Notifys: 264Out P2 Exchanges: 0Out P2 Exchange Invalids: 0Out P2 Exchange Rejects: 0Out P2 Sa Delete Requests: 0Initiator Tunnels: 0Initiator Fails: 0Responder Fails: 0System Capacity Fails: 0Auth Fails: 0Decrypt Fails: 0Hash Valid Fails: 0No Sa Fails: 0hostname(config)#Related Commands
show local-host
To display the network states of local hosts, use the show local-host command in privileged EXEC mode.
show local-host [ip_address] [detail] [all] [brief] [connection]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show local-host command lets you display the network states of local hosts. A local-host is created for any host that forwards traffic to, or through, the security appliance.
This command lets you show the translation and connection slots for the local hosts. This command provides information for hosts that are configured with the nat 0 access-list command when normal translation and connection states may not apply.
This command also displays the connection limit values. If a connection limit is not set, the value displays as 0 and the limit is not applied.
For models with host limits, In routed mode, hosts on the inside (Work and Home zones) count towards the limit only when they communicate with the outside (Internet zone). Internet hosts are not counted towards the limit. Hosts that initiate traffic between Work and Home are also not counted towards the limit. The interface associated with the default route is considered to be the Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit.
In the event of a SYN attack (with TCP intercept configured), the show local-host command output includes the number of intercepted connections in the usage count. This field typically displays only full open connections.
In the show local-host command output, the TCP embryonic count to host counter is used when a maximum embryonic limit (TCP intercept watermark) is configured for a host using a static connection. This counter shows the total embryonic connections to the host from other hosts. If this total exceeds the maximum configured limit, TCP intercept is applied to new connections to the host.
Examples
The following sample output is displayed by the show local-host command:
hostname# show local-hostInterface inside: 0 active, 0 maximum active, 0 deniedInterface outside: 1 active, 2 maximum active, 0 deniedThe following sample output is displayed by the show local-host command on a security appliance with host limits:
hostname# show local-hostDetected interface 'outside' as the Internet interface. Host limit applies to all other interfaces.Current host count: 3, towards licensed host limit of: 50Interface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 0 active, 0 maximum active, 0 deniedThe following sample output is displayed by the show local-host command on a security appliance with host limits, but without a default route, the host limits apply to all interfaces. The default route interface might not be detected if the default route or the interface that the route uses is down.
hostname# show local-hostUnable to determine Internet interface from default route. Host limit applied to all interfaces.Current host count: 3, towards licensed host limit of: 50Interface c1in: 1 active, 1 maximum active, 0 deniedInterface c1out: 0 active, 0 maximum active, 0 deniedThe following sample output is displayed by the show local-host command on a security appliance with unlimited hosts:
hostname# show local-hostLicensed host limit: UnlimitedInterface c1in: 1 active, 1 maximum active, 0 deniedInterface c1out: 0 active, 0 maximum active, 0 deniedThe following examples show how to display the network states of local hosts:
hostname# show local-host allInterface outside: 1 active, 2 maximum active, 0 deniedlocal host: <11.0.0.4>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464Interface inside: 1 active, 2 maximum active, 0 deniedlocal host: <17.3.8.2>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464Interface NP Identity Ifc: 2 active, 4 maximum active, 0 deniedlocal host: <11.0.0.3>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464local host: <17.3.8.1>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464hostname# show local-host 10.1.1.91Interface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:PAT Global 192.150.49.1(1024) Local 10.1.1.91(4984)Conn:TCP out 192.150.49.10:21 in 10.1.1.91:4984 idle 0:00:07 bytes 75 flags UI Interfaceoutside: 1 active, 1 maximum active, 0 deniedhostname# show local-host 10.1.1.91 detailInterface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:TCP PAT from inside:10.1.1.91/4984 to outside:192.150.49.1/1024 flags riConn:TCP outside:192.150.49.10/21 inside:10.1.1.91/4984 flags UI Interface outside: 1 active, 1 maximum active, 0 deniedThe following examples shows the output when using the brief and connection syntax:
hostname#show local-host briefInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedhostname# show local-host connectionInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedRelated Commands
clear local-host
Releases network connections from local hosts displayed by the show local-host command.
nat
Associates a network with a pool of global IP addresses.
show logging
To show the logs in the buffer or to show other logging settings, use the show logging command.
show logging [message [syslog_id | all] | asdm | queue | setting]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
If the logging buffered command is in use, the show logging command without any keywords shows the current message buffer and the current settings.
The show logging queue command allows you to display the following:
•
•
•
Examples
The following is sample output from the show logging command:
hostname(config)# show loggingSyslog logging: enabledTimestamp logging: disabledConsole logging: disabledMonitor logging: disabledBuffer logging: level debugging, 37 messages loggedTrap logging: disabled305001: Portmapped translation built for gaddr 209.165.201.5/0 laddr 192.168.1.2/256...The following is sample output from the show logging message all command:
hostname(config)# show logging message allsyslog 111111: default-level alerts (enabled)syslog 101001: default-level alerts (enabled)syslog 101002: default-level alerts (enabled)syslog 101003: default-level alerts (enabled)syslog 101004: default-level alerts (enabled)syslog 101005: default-level alerts (enabled)syslog 102001: default-level alerts (enabled)syslog 103001: default-level alerts (enabled)syslog 103002: default-level alerts (enabled)syslog 103003: default-level alerts (enabled)syslog 103004: default-level alerts (enabled)syslog 103005: default-level alerts (enabled)syslog 103011: default-level alerts (enabled)syslog 103012: default-level informational (enabled)Related Commands
show logging rate-limit
To display the disallowed messages to the original set, use the show logging rate-limit command.
show logging rate-limit
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
After the information is cleared, nothing more displays until the hosts reestablish their connections.
Examples
This example shows how to display the disallowed messages:
hostname(config)# show logging rate-limitRelated Commands
show mac-address-table
To show the MAC address table, use the show mac-address-table command in privileged EXEC mode.
show mac-address-table [interface_name | count | static]
Syntax Description
Defaults
If you do not specify an interface, all interface MAC address entries are shown.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show mac-address-table command:
hostname# show mac-address-tableinterface mac address type Time Left-----------------------------------------------------------------------outside 0009.7cbe.2100 static -inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table command for the inside interface:
hostname# show mac-address-table insideinterface mac address type Time Left-----------------------------------------------------------------------inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table count command:
hostname# show mac-address-table countStatic mac-address bridges (curr/max): 0/65535Dynamic mac-address bridges (curr/max): 103/65535Related Commands
show management-access
To display the name of the internal interface configured for management access, use the show management-access command in privileged EXEC mode.
show management-access
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The management-access command lets you define an internal management interface using the IP address of the firewall interface specified in mgmt_if. (The interface names are defined by the nameif command and displayed in quotes, " ", in the output of the show interface command.)
Examples
The following example shows how to configure a firewall interface named "inside" as the management access interface and display the result:
hostname(config)# management-access insidehostname(config)# show management-accessmanagement-access insideRelated Commands
show memory
To display a summary of the maximum physical memory and current free memory available to the operating system, use the show memory command in privileged EXEC mode.
show memory [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show memory command lets you display a summary of the maximum physical memory and current free memory available to the operating system. Memory is allocated as needed.
You can use the show memory detail output with show memory binsize command to debug memory leaks.
You can also display the information from the show memory command using SNMP.
Examples
This example shows how to display a summary of the maximum physical memory and current free memory available:
hostname# show memoryFree memory: 845044716 bytes (79%)Used memory: 228697108 bytes (21%)------------- ----------------Total memory: 1073741824 bytes (100%)This example shows detailed memory output:
hostname# show memory detail Free memory: 15958088 bytes (24%) Used memory: Allocated memory in use: 29680332 bytes (44%) Reserved memory: 21470444 bytes (32%) ----------------------------- ---------------- Total memory: 67108864 bytes (100%) Least free memory: 4551716 bytes ( 7%) Most used memory: 62557148 bytes (93%) ----- fragmented memory statistics ----- fragment size count total (bytes) (bytes) ---------------- ---------- -------------- 16 8 128 24 4 96 32 2 64 40 5 200 64 3 192 88 1 88 168 1 168 224 1 224 256 1 256 296 2 592 392 1 392 400 1 400 1816 1 1816* 4435968 1 4435968** 11517504 1 11517504 * - top most releasable chunk. ** - contiguous memory on top of heap. ----- allocated memory statistics ----- fragment size count total (bytes) (bytes) ---------------- ---------- -------------- 40 50 2000 48 144 6912 56 24957 1397592 64 101 6464 72 99 7128 80 1032 82560 88 18 1584 96 64 6144 104 57 5928 112 6 672 120 112 13440 128 15 1920 136 87 11832 144 22 3168152 31 4712 160 90 14400 168 65 10920 176 74 13024 184 11 2024 192 8 1536 200 1 200 <output omitted>Related Commands
show memory binsize
To display summary information about the chunks allocated for a specific bin size, use the show memory binsize command in privileged EXEC mode.
show memory binsize size
Syntax Description
size
Displays chunks (memory blocks) of a specific bin size. The bin size is from the "fragment size" column of the show memory detail command output.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History