-
Cisco Security Appliance Command Reference, Version 8.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show ddns -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config ldap -- show running-config webvpn auto-signon
-
show service-policy -- show xlate
-
shun -- sysopt radius ignore-secret
-
- T through Z Commands
-
Table Of Contents
client through crl configure Commands
client-types (crypto ca trustpoint)
client through crl configure Commands
client-access-rule
To configure rules that limit the remote access client types and versions that can connect via IPSec through the security appliance, use the client-access-rule command in group-policy configuration mode. To delete a rule, use the no form of this command.
To delete all rules, use the no client-access-rule command with only the priority argument. This deletes all configured rules, including a null rule created by issuing the client-access-rule none command.
When there are no client access rules, users inherit any rules that exist in the default group policy. To prevent users from inheriting client access rules, use the client-access-rule none command. The result of doing so is that all client types and versions can connect.
client-access-rule priority {permit | deny} type type version version | none
no client-access-rule priority [{permit | deny} type type version version]
Syntax Description
Defaults
By default, there are no access rules.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy configuration
•
—
•
—
—
Command History
Usage Guidelines
Construct rules according to these caveats:
•
•
•
•
•
•
•
Examples
The following example shows how to create client access rules for the group policy named FirstGroup. These rules permit VPN Clients running software version 4.1, while denying all VPN 3002 hardware clients:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# client-access-rule 1 d t VPN3002 v *hostname(config-group-policy)# client-access-rule 2 p * v 4.1client (ctl-provider)
To specify clients allowed to connect to the Certificate Trust List provider, or to specify a username and password for client authentication, use the client command in CTL provider configuration mode. To remove the configuration, use the no form of this command.
client [[interface if_name] ipv4_addr] | [username user_name password password [encrypted]]
no client [[interface if_name] ipv4_addr] | [username user_name password password [encrypted]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
CTL provider configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the client command in CTL provider configuration mode to specify the clients allowed to connect to the CTL provider, and to set the username and password for client authentication. More than one command may be issued to define multiple clients. The username and password must match the CCM Administrator's username and password for the CallManager cluster.
Examples
The following example shows how to create a CTL provider instance:
hostname(config)# ctl-provider my_ctlhostname(config-ctl-provider)# client interface inside 172.23.45.1hostname(config-ctl-provider)# client username CCMAdministrator password XXXXXX encryptedhostname(config-ctl-provider)# export certificate ccm_proxyhostname(config-ctl-provider)# ctl installRelated Commands
client (tls-proxy)
To configure trustpoints, keypairs, and cipher suites, use the client command in TLS proxy configuration mode. To remove the configuration, use the no form of this command.
client [cipher-suite cipher_suite] | [ldc [issuer ca_tp_name | key-pair key_label]]
no client [cipher-suite cipher_suite] | [ldc [issuer ca_tp_name | key-pair key_label]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
TLS proxy configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the client command in TLS proxy configuration mode to control the TLS handshake parameters for the security appliance as the TLS client role in TLS proxy. This includes cipher suite configuration, or to set the local dynamic certificate issuer or keypair. The local CA to issue client dynamic certificates is defined by the crypto ca trustpoint command and the trustpoint must have proxy-ldc-issuer configured, or the default local CA server (LOCAL-CA-SERVER).
The keypair value must have been generated with the crypto key generate command.
For client proxy (the proxy acts as a TLS client to the server), the user-defined cipher suite replaces the default cipher suite, or the one defined by the ssl encryption command. You can use this command to achieve difference ciphers between the two TLS sessions. You should use AES ciphers with the CallManager server.
Examples
The following example shows how to create a TLS proxy instance:
hostname(config)# tls-proxy my_proxyhostname(config-tlsp)# server trust-point ccm_proxyhostname(config-tlsp)# client ldc issuer ldc_serverhostname(config-tlsp)# client ldc keypair phone_commonRelated Commands
client-firewall
To set personal firewall policies that the security appliance pushes to the VPN client during IKE tunnel negotiation, use the client-firewall command in group-policy configuration mode. To delete a firewall policy, use the no form of this command.
To delete all firewall policies, use the no client-firewall command without arguments. This deletes all configured firewall policies, including a null policy created by issuing the client-firewall none command.
When there are no firewall policies, users inherit any that exist in the default or other group policy. To prevent users from inheriting such firewall policies, use the client-firewall none command.
client-firewall none
client-firewall {opt | req} custom vendor-id num product-id num policy {AYT | CPP acl-in acl acl-out acl} [description string]
client-firewall {opt | req} zonelabs-integrity
Note
client-firewall {opt | req} zonelabs-zonealarm policy {AYT | CPP acl-in acl acl-out acl }
client-firewall {opt | req} zonelabs-zonealarmorpro policy {AYT | CPP acl-in acl acl-out acl }
client-firewall {opt | req} zonelabs-zonealarmpro policy {AYT | CPP acl-in acl acl-out acl }
client-firewall {opt | req} cisco-integrated acl-in acl acl-out acl}
client-firewall {opt | req} sygate-personal
client-firewall {opt | req} sygate-personal-pro
client-firewall {opt | req} sygate-personal-agent
client-firewall {opt | req} networkice-blackice
client-firewall {opt | req} cisco-security-agent
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy configuration
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
7.2(1)
The zonelabs-integrity firewall type was added.
Usage Guidelines
Only one instance of this command can be configured.
Examples
The following example shows how to set a client firewall policy that requires Cisco Intrusion Prevention Security Agent for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# client-firewall req cisco-security-agentclient trust-point
To specify the proxy trustpoint certificate to be presented during TLS handshake when configuring the TLS Proxy for Cisco Unified Presence Server (CUPS), use the client trust-point command in tls-proxy configuration mode. To remove the proxy trustpoint certificate, use the no form of this command.
client trust-point proxy_trustpoint
no client trust-point [proxy_trustpoint]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
TLS proxy configuration
•
•
•
•
—
Command History
Usage Guidelines
The client trust-point command specifies the trustpoint and associated certificate that the security appliance uses in the TLS handshake when the security appliance assumes the role of the TLS client. The certificate must be owned by the security appliance (identity certificate).
The certificate can be self-signed, enrolled with a certificate authority, or from an imported credential. The client trust-point command has precedence over the global ssl trust-point command.
Examples
The following example shows the use of the client trust-point command to specify the use of trustpoint "ent_y_proxy" in the TLS handshake with the TLS server. The handshake is likely to be originated from entity Y to entity X where the TLS server resides. The ASA functions as the TLS proxy for entity Y.
hostname(config-tlsp)# client trust-point ent_y_proxyRelated Commands
client-types (crypto ca trustpoint)
To specify the client connection types for which this trustpoint can be used to validate the certificates associated with a user connection, use the client-types command in crypto ca trustpoint configuration mode. To specify that the trustpoint cannot be used for the named connection, use the no form of the command.
[no] client-types {ssl | ipsec}
Syntax Description
Defaults
No default value or behavior.
Command Modes
The following table shows the modes in which you can enter the command:
Command History
Crypto ca trustpoint configuration
•
•
•
•
—
Usage Guidelines
When there are multiple trustpoints associated with the same CA certificate, only one of the trustpoints can be configured for a specific client type. However, one of the trustpoints can be configured for one client type and the other trustpoint with another client-type.
If there is a trustpoint associated with the same CA certificate that is already configured with a client type, the new trustpoint is not allowed to be configured with the same client-type setting. The no form of the command clears the setting so that trustpoint cannot be used for any client validation.
Remote-access VPNs can use Secure Sockets Layer (SSL) VPN, IP Security (IPSec), or both, depending on deployment requirements, to permit access to virtually any network application or resource.
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint, central, and designates it an SSL trustpoint:
hostname(config)# crypto ca trustpoint centralhostname(config-ca-trustpoint)# client-types sslhostname(config-ca-trustpoint)#The following example enters crypto ca trustpoint configuration mode for trustpoint, checkin1,anddesignated it as an IPsec trustpoint.
hostname(config)# crypto ca trustpoint checkin1hostname(config-ca-trustpoint)# client-types ipsechostname(config-ca-trustpoint)#Related Commands
client-update
To issue a client-update for all active remote VPN software and hardware clients and security appliances configured as Auto Update clients, on all tunnel-groups or for a particular tunnel group, use the client-update command in privileged EXEC mode.
To configure and change client-update parameters at the global level, including VPN software and hardware clients and security appliances configured as Auto Update clients, use the client-update command in global configuration mode.
To configure and change client-update tunnel-group IPSec-attributes parameters for VPN software and hardware clients, use the client-update command in tunnel-group ipsec-attributes configuration mode.
If the client is already running a software version on the list of revision numbers, it does not need to update its software. If the client is not running a software version on the list, it should update.
To disable a client update, use the no form of this command.
Global configuration mode command:
client-update {enable | component {asdm | image} | device-id dev_string |
family family_name | type type} url url-string rev-nums rev-nums}no client-update {enable | component {asdm | image} | device-id dev_string |
family family_name | type type} url url-string rev-nums rev-nums}Tunnel-group ipsec-attributes mode command:
client-update type type url url-string rev-nums rev-nums
no client-update type type url url-string rev-nums rev-nums
Privileged EXEC mode command:
client-update {all | tunnel-group}
no client-update tunnel-group
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Command History
Usage Guidelines
In tunnel-group ipsec-attributes configuration mode, you can apply this attribute only to the IPSec remote-access tunnel-group type.
The client-update command lets you enable the update; specify the types and revision numbers of clients to which the update applies; provide a URL or IP address from which to get the update; and, in the case of Windows clients, optionally notify users that they should update their VPN client version. For Windows clients, you can provide a mechanism for users to accomplish that update. For VPN 3002 Hardware Client users, the update occurs automatically, with no notification. When the client type is another security appliance, this security appliance acts as an Auto Update server.
To configure the client-update mechanism, do the following steps:
Step 1
hostname(config)# client-update enablehostname(config)#Step 2
hostname(config)# client-update type windows url https://support/updates/ rev-nums 4.6.1hostname(config)#See the Examples section for an illustration of configuring a tunnel group for a VPN 3002 hardware client.
Note
Alternatively, for Windows clients and VPN3002 Hardware Clients, you can configure client update just for individual tunnel-groups, rather than for all clients of a particular type. (See Step 3.)
Note
Step 3
hostname(config)# tunnel-group remotegrp type ipsec-rahostname(config)# tunnel-group remotegrp ipsec-attributeshostname(config-tunnel-ipsec)# client-update type windows url https://support/updates/ rev-nums 4.6.1hostname(config-tunnel-ipsec)#See the Examples section for an illustration of configuring a tunnel group for a VPN 3002 hardware client. VPN 3002 clients update without user intervention, and users receive no notification message.
Step 4
hostname# client-update allhostname#If the user's client revision number matches one of the specified revision numbers, there is no need to update the client, and users receive no notification message. VPN 3002 clients update without user intervention and users receive no notification message.
Note
Examples
The following example, entered in global configuration mode, enables client update for all active remote clients on all tunnel groups:
hostname(config)# client-update enablehostname#The following example applies only to Windows (win9x, winnt, or windows). Entered in global configuration mode, it configures client update parameters for all Windows-based clients. It designates the revision number, 4.7 and the URL for retrieving the update, which is https://support/updates.
hostname(config)# client-update type windows url https://support/updates/ rev-nums 4.7hostname(config)#The following example applies only to VPN 3002 Hardware Clients. Entered in tunnel-group ipsec-attributes configuration mode, it configures client update parameters for the IPSec remote-access tunnel-group "salesgrp". It designates the revision number, 4.7 and uses the TFTP protocol for retrieving the updated software from the site with the IP address 192.168.1.1:
hostname(config)# tunnel-group salesgrp type ipsec-rahostname(config)# tunnel-group salesgrp ipsec-attributeshostname(config-tunnel-ipsec)# client-update type vpn3002 url tftp:192.168.1.1 rev-nums 4.7hostname(config-tunnel-ipsec)#The following example shows how to issue a client update for clients that are Cisco 5520 Adaptive Security Appliances configured as Auto Update clients:
hostname(config)# client-update type asa5520 component asdm url http://192.168.1.114/aus/asdm501.bin rev-nums 7.2(1)The following example, entered in privileged EXEC mode, sends a client-update notification to all connected remote clients in the tunnel group named "remotegrp" that need to update their client software. Clients in other groups do not get an update notification:
hostname# client-update remotegrphostname#Related Commands
clock set
To manually set the clock on the security appliance, use the clock set command in privileged EXEC mode.
clock set hh:mm:ss {month day | day month} year
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
If you have not entered any clock configuration commands, the default time zone for the clock set command is UTC. If you change the time zone after you enter the clock set command using the clock timezone command, the time automatically adjusts to the new time zone. However, if you enter the clock set command after you establish the time zone with the clock timezone command, then enter the time appropriate for the new time zone and not for UTC. Similarly, if you enter the clock summer-time command after the clock set command, the time adjusts for daylight saving. If you enter the clock set command after the clock summer-time command, enter the correct time for daylight saving.
This command sets the time in the hardware chip, and does not save the time in the configuration file. This time endures reboots. Unlike the other clock commands, this command is a privileged EXEC command. To reset the clock, you need to set a new time for the clock set command.
Examples
The following example sets the time zone to MST, the daylight saving time to the default period in the U.S., and the current time for MDT to 1:15 p.m. on July 27, 2004:
hostname(config)# clock timezone MST -7hostname(config)# clock summer-time MDT recurringhostname(config)# exithostname# clock set 13:15:0 jul 27 2004hostname# show clock13:15:00.652 MDT Tue Jul 27 2004The following example sets the clock to 8:15 on July 27, 2004 in the UTC time zone, and then sets the time zone to MST and the daylight saving time to the default period in the U.S. The end time (1:15 in MDT) is the same as the previous example.
hostname# clock set 20:15:0 jul 27 2004hostname# configure terminalhostname(config)# clock timezone MST -7hostname(config)# clock summer-time MDT recurringhostname# show clock13:15:00.652 MDT Tue Jul 27 2004Related Commands
