-
Cisco Security Appliance Command Reference, Version 7.2
-
About this Guide
-
Using the Command Line Interface
-
aaa accounting command through accounting-server-group Commands
-
acl-netmask-convert through auto-update timeout Commands
-
backup interface through browse networks Commands
-
cache through clear compression Commands
-
clear conn through clear configure vpn-load-balancing Commands
-
clear console-output through clear xlate Commands
-
client-access-rule through crl-configure Commands
-
crypto ca authenticate through customization Commands
-
ddns through debug xdmcp Commands
-
default through duplex Commands
-
email through functions Commands
-
gateway through hw-module module shutdown Commands
-
icmp through imap4s Commands
-
inspect ctiqbe through inspect xdmcp Commands
-
intercept-dhcp through issuer-name Commands
-
java-trustpoint through kill Commands
-
l2tp tunnel hello through log-adj-changes Commands
-
logging asdm through logout message Commands
-
mac-address through multicast-routing Commands
-
name through override-account-disable Commands
-
packet-tracer through pwd Commands
-
queue-limit through router rip Commands
-
same-security-traffic through show asdm sessions Commands
-
show asp drop through show curpriv Commands
-
show ddns through show ipv6 traffic Commands
-
show isakmp sa through show route Commands
-
show running-config through show running-config isakmp Commands
-
show running-config ldap through show running-config webvpn auto-signon Commands
-
show service-policy through show xlate Commands
-
shun through sysopt radius ignore-secret Commands
-
tcp-map through tx-ring-limit Commands
-
urgent-flag through write terminal Commands
-
Table Of Contents
tcp-map through type echo Commands
timeout (dns-server-group configuration mode)
tunnel-group general-attributes
tunnel-group webvpn-attributes
tunnel-group-map default-group
tcp-map through type echo Commands
tcp-map
To define a set of TCP normalization actions, use the tcp-map command in global configuration mode. The TCP normalization feature lets you specify criteria that identify abnormal packets, which the security appliance drops when they are detected. To remove the TCP map, use the no form of this command.
tcp-map map_name
no tcp-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
This feature uses Modular Policy Framework. First define the TCP normalization actions you want to take using the tcp-map command. The tcp-map command enters tcp-map configuration mode, where you can enter one or more commands to define the TCP normalization actions. Then define the traffic to which you want to apply the TCP map using the class-map command. Enter the policy-map command to define the policy, and enter the class command to reference the class map. In class configuration mode, enter the set connection advanced-options command to reference the TCP map. Finally, apply the policy map to an interface using the service-policy command. For more information about how Modular Policy Framework works, see the Cisco Security Appliance Command Line Configuration Guide.
The following commands are available in tcp-map configuration mode:
Examples
For example, to allow urgent flag and urgent offset packets for all traffic sent to the range of TCP ports between the well known FTP data port and the Telnet port, enter the following commands:
hostname(config)# tcp-map tmaphostname(config-tcp-map)# urgent-flag allowhostname(config-tcp-map)# class-map urg-classhostname(config-cmap)# match port tcp range ftp-data telnethostname(config-cmap)# policy-map pmaphostname(config-pmap)# class urg-classhostname(config-pmap-c)# set connection advanced-options tmaphostname(config-pmap-c)# service-policy pmap globalRelated Commands
tcp-options
To allow or clear the TCP options through the security appliance, use the tcp-options command in tcp-map configuration mode. To remove this specification, use the no form of this command.
tcp-options {selective-ack | timestamp | window-scale} {allow | clear}
no tcp-options {selective-ack | timestamp | window-scale} {allow | clear}
tcp-options range lower upper {allow | clear | drop}
no tcp-options range lower upper {allow | clear | drop}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the tcp-options command in tcp-map configuration mode to clear selective-acknowledgement, window-scale, and timestamp TCP options. You can also clear or drop packets with options that are not very well defined.
Examples
The following example shows how to drop all packets with TCP options in the ranges of 6-7 and 9-255:
hostname(config)# access-list TCP extended permit tcp any anyhostname(config)# tcp-map tmaphostname(config-tcp-map)# tcp-options range 6 7 drophostname(config-tcp-map)# tcp-options range 9 255 drophostname(config)# class-map cmaphostname(config-cmap)# match access-list TCPhostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalhostname(config)#Related Commands
telnet
To add Telnet access to the console and set the idle timeout, use the telnet command in global configuration mode. To remove Telnet access from a previously set IP address, use the no form of
this command.telnet {{hostname | IP_address mask interface_name} | {IPv6_address interface_name} | {timeout number}}
no telnet {{hostname | IP_address mask interface_name} | {IPv6_address interface_name} | {timeout number}}
Syntax Description
Defaults
By default, Telnet sessions left idle for five minutes are closed by the security appliance.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
7.0(1)
The variable IPv6_address was added. The no telnet timeout command was added too.
Usage Guidelines
The telnet command lets you specify which hosts can access the security appliance console with Telnet. You can enable Telnet to the security appliance on all interfaces. However, the security appliance enforces that all Telnet traffic to the outside interface be protected by IPSec. To enable a Telnet session to the outside interface, configure IPSec on the outside interface to include IP traffic that is generated by the security appliance and enable Telnet on the outside interface.
Use the no telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout command to set the maximum time that a console Telnet session can be idle before being logged off by the security appliance. You cannot use the no telnet command with the telnet timeout command.
If you enter an IP address, you must also enter a netmask. There is no default netmask. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address. To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255.
If IPSec is operating, you can specify an unsecure interface name, which is typically, the outside interface. At a minimum, you might configure the crypto map command to specify an interface name with the telnet command.
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the security appliance console. Use the kill command to terminate an active Telnet console session.
If you use the aaa command with the console keyword, Telnet console access must be authenticated with an authentication server.
Note
Examples
This example shows how to permit hosts 192.168.1.3 and 192.168.1.4 to access the security appliance console through Telnet. In addition, all the hosts on the 192.168.2.0 network are given access.
hostname(config)# telnet 192.168.1.3 255.255.255.255 insidehostname(config)# telnet 192.168.1.4 255.255.255.255 insidehostname(config)# telnet 192.168.2.0 255.255.255.0 insidehostname(config)# show running-config telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideThis example shows how to change the maximum session idle duration:
hostname(config)# telnet timeout 10hostname(config)# show running-config telnet timeouttelnet timeout 10 minutesThis example shows a Telnet console login session (the password does not display when entered):
hostname# passwd: ciscoWelcome to the XXX...Type help or `?' for a list of available commands.hostname>You can remove individual entries with the no telnet command or all telnet command statements with the clear configure telnet command:hostname(config)# no telnet 192.168.1.3 255.255.255.255 insidehostname(config)# show running-config telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insidehostname(config)# clear configure telnetRelated Commandsshow telnet
terminal
To allow system log messages to show in the current Telnet session, use the terminal monitor command in privileged EXEC mode. To disable system log messages, use the terminal no monitor command.
terminal {monitor | no monitor}
Syntax Description
monitor
Enables the display of system log messages on the current Telnet session.
no monitor
Disables the display of system log messages on the current Telnet session.
Defaults
System log messages are disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
This example shows how to enable logging and then disable logging only in the current session:
hostname# terminal monitorhostname# terminal no monitorRelated Commands
terminal pager
To set the number of lines on a page before the "---more---" prompt appears for Telnet sessions, use the terminal pager command in privileged EXEC mode.
terminal pager [lines] lines
Syntax Description
Defaults
The default is 24 lines.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command changes the pager line setting only for the current Telnet session. To save a new default pager setting to the configuration, use the pager command.
If you Telnet to the admin context, then the pager line setting follows your session when you change to other contexts, even if the pager command in a given context has a different setting. To change the current pager setting, enter the terminal pager command with a new setting, or you can enter the pager command in the current context. In addition to saving a new pager setting to the context configuration, the pager command applies the new setting to the current Telnet session.
Examples
The following example changes the number of lines displayed to 20:
hostname# terminal pager 20Related Commands
terminal width
To set the width for displaying information during console sessions, use the terminal width command in global configuration mode. To disable, use the no form of this command.
terminal width columns
no terminal width columns
Syntax Description
Defaults
The default display width is 80 columns.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Examples
This example shows how to terminal display width to 100 columns:
hostname# terminal width 100Related Commands
test aaa-server
Use the test aaa-server command to check whether the security appliance can authenticate or authorize users with a particular AAA server. Failure to reach the AAA server may be due to incorrect configuration on the security appliance, or the AAA server may be unreachable for other reasons, such as restrictive network configurations or server downtime.
test aaa-server {authentication | authorization} server-tag [host server-ip] [username username] [password password]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The test aaa-server command enables you to verify that the security appliance can authenticate and authorize users with a particular AAA server. Using this command simplifies verification of the configuration on the security appliance by removing the necessity of testing with a real supplicant. It also helps you isolate whether authentication and authorization failures are due to misconfiguration of AAA server parameters, a connection problem to the AAA server, or other configuration errors on the security appliance.
When you enter the command, you can omit the host and password keyword and argument pairs. The security appliance will prompt you for their values. If you are performing an authentication test, you can also omit the password keyword and argument pair and provide the password when the security appliance prompts you.
Examples
The following example configures a RADIUS AAA server named srvgrp1 on host 192.168.3.4, sets a timeout of 9 seconds, sets a retry-interval of 7 seconds, and configures authentication port 1650. The test aaa-server command following the setup of the AAA server parameters indicates that the authentication test failed to reach the server.
hostname(config)# aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)# aaa-server svrgrp1 host 192.168.3.4hostname(config-aaa-server-host)# timeout 9hostname(config-aaa-server-host)# retry-interval 7hostname(config-aaa-server-host)# authentication-port 1650hostname(config-aaa-server-host)# exithostname(config)# test aaa-server authentication svrgrp1Server IP Address or name: 192.168.3.4Username: bogusPassword: ******INFO: Attempting Authentication test to IP address <192.168.3.4> (timeout: 10 seconds)ERROR: Authentication Server not responding: No errorRelated Commands
test regex
To test a regular expression, use the test regex command in privileged EXEC mode.
test regex input_text regular_expression
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The test regex command tests a regular expression to make sure it matches what you think it will match.
If the regular expression matches the input text, you see the following message:
INFO: Regular expression match succeeded.If the regular expression does not match the input text, you see the following message:
INFO: Regular expression match failed.Examples
The following example tests input text against a regular expression:
hostname# test regex farscape scapeINFO: Regular expression match succeeded.hostname# test regex farscape scaperINFO: Regular expression match failed.Related Commands
test sso-server
To test an SSO server with a trial authentication request, use the test sso-server command in privileged EXEC mode. This is an SSO with CA SiteMinder command.
test sso-server server-name username user-name
Syntax Description
Syntax DescriptionSyntax Description
server-name
Specifies the name of the SSO server being tested.
user-name
Specifies the name of a user on the SSO server being tested.
Defaults
No default values or behavior.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without reentering a username and password more than once. The test sso-server command tests whether an SSO server is recognized and responding to authentication requests.
If the SSO server specified by the server-name argument is not found, the following error appears:
ERROR: sso-server server-name does not exist
If the SSO server is found but the user specified by the user-name argument is not found, the authentication is rejected.
Examples
The following example, entered in privileged EXEC mode, successfully tests an SSO server named my-sso-server using a username of Anyuser:
hostname# test sso-server my-sso-server username AnyuserINFO: Attempting authentication request to sso-server my-sso-server for user AnyuserINFO: STATUS: Successhostname#The following example shows a test of the same server, but the user Anyuser is not recognized and the authentication fails:
hostname# test sso-server my-sso-server username AnyuserINFO: Attempting authentication request to sso-server my-sso-server for user AnyuserINFO: STATUS: Failedhostname#Related Commands
text-color
To set a color for text in the WebVPN title bar on the login, home page, and file access page, use the text-color command in webvpn mode. To remove a text color from the configuration and reset the default, use the no form of this command.
text-color [black | white | auto]
no text-color
Syntax Description
Defaults
The default text color for the title bars is white.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
—
•
—
—
Command History
Examples
The following example shows how to set the text color for title bars to black:
hostname(config)# webvpnhostname(config-webvpn)# text-color blackRelated Commands
secondary-text-color
Sets the secondary text color for the WebVPN login, home page, and file access page.
tftp-server
To specify the default TFTP server and path and filename for use with configure net or write net commands, use the tftp-server command in global configuration mode. To remove the server configuration, use the no form of this command. This command supports IPv4 and IPv6 addresses.
tftp-server interface_name server filename
no tftp-server [interface_name server filename]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The tftp-server command simplifies entering the configure net and write net commands. When you enter the configure net or write net commands, you can either inherit the TFTP server specified by the tftp-server command, or provide your own value. You can also inherit the path in the tftp-server command as is, add a path and filename to the end of the tftp-server command value, or override the tftp-server command value.
The security appliance supports only one tftp-server command.
Examples
This example shows how to specify a TFTP server and then read the configuration from the /temp/config/test_config directory:
hostname(config)# tftp-server inside 10.1.1.42 /temp/config/test_confighostname(config)# configure netRelated Commands
threshold
To set the threshold value for over threshold events in SLA monitoring operations, use the threshold command in SLA monitor configuration mode. To restore the default value, use the no form of this command.
threshold milliseconds
no threshold
Syntax Description
milliseconds
Specifies the number of milliseconds for a rising threshold to be declared. Valid values are from 0 to 2147483647. This value should not be larger than the value set for the timeout.
Defaults
The default threshold is 5000 milliseconds.
Command Modes
The following table shows the modes in which you can enter the command:
