-
Cisco Security Appliance Command Reference, Version 8.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show ddns -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config ldap -- show running-config webvpn auto-signon
-
show service-policy -- show xlate
-
shun -- sysopt radius ignore-secret
-
- T through Z Commands
-
Table Of Contents
undebug through zonelabs integrity ssl-client-authentication Commands
url-list (group-policy webvpn)
user-authentication-idle-timeout
validation-policy (crypto ca trustpoint)
vpn-sessiondb max-session-limit
vpn-sessiondb max-webvpn-session-limit
webvpn (group-policy and username modes)
zonelabs-integrity fail-timeout
zonelabs-integrity server-address
zonelabs-integrity ssl-certificate-port
zonelabs-integrity ssl-client-authentication
undebug through zonelabs integrity ssl-client-authentication Commands
urgent-flag
To allow or clear the URG pointer through the TCP normalizer, use the urgent-flag command in tcp-map configuration mode. To remove this specification, use the no form of this command.
urgent-flag {allow | clear}
no urgent-flag {allow | clear}
Syntax Description
allow
Allows the URG pointer through the TCP normalizer.
clear
Clears the URG pointer through the TCP normalizer.
Defaults
The urgent flag and urgent offset are clear by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the newTCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the urgent-flag command in tcp-map configuration mode to allow the urgent flag.
The URG flag is used to indicate that the packet contains information that is of higher priority than other data within the stream. The TCP RFC is vague about the exact interpretation of the URG flag, therefore, end systems handle urgent offsets in different ways, which may make the end system vulnerable to attacks. The default behavior is to clear the URG flag and offset.
Examples
The following example shows how to allow the urgent flag:
hostname(config)# tcp-map tmaphostname(config-tcp-map)# urgent-flag allowhostname(config)# class-map cmaphostname(config-cmap)# match port tcp eq 513hostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
undebug
To disable the display of debug information in the current session, use the undebug command in privileged EXEC mode.
undebug {command | all}
Syntax Description
command
Disables debug for the specified command. See the Usage Guidelines for information about the supported commands.
all
Disables all debug output.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The following commands can be used with the undebug command. For more information about debugging a specific command, or for the associated arguments and keywords for a specific debug command, see the entry for debug command.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.
Examples
The example disabled all debug output:
hostname(config)# undebug allRelated Commands
unix-auth-gid
To set the UNIX group ID, use the unix-auth-gid command in group-policy webvpn configuration mode. To remove this command from the configuration, use the no version of this command.
unix-auth-gid <identifier>
no storage-objects
Syntax Description
Defaults
The default is 65534.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
The string specifies a network file system (NetFS) location. Only SMB and FTP protocols are supported; for example, smb://(NetFS location) or ftp://(NetFS location). You use the name of this location in the storage-objects command.
Examples
The following example sets the UNIX group ID to 4567:
hostname(config)# group-policy test attributeshostname(config-group-policy)# webvpnhostname(config-group-webvpn)# unix-auth-gid 4567Related Commands
unix-auth-uid
To set the UNIX user ID, use the unix-auth-uid command in group-policy webvpn configuration mode. To remove this command from the configuration, use the no version of this command.
unix-auth-gid <identifier>
no storage-objects
Syntax Description
Defaults
The default is 65534.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
The string specifies a network file system (NetFS) location. Only SMB and FTP protocols are supported; for example, smb://(NetFS location) or ftp://(NetFS location). You use the name of this location in the storage-objects command.
Examples
The following example sets the UNIX user ID to 333:
hostname(config)# group-policy test attributeshostname(config-group-policy)# webvpnhostname(config-group-webvpn)# unix-auth-gid 333Related Commands
upload-max-size
To specify the maximum size allowed for an object to upload, use the upload-max-size command in group-policy webvpn configuration mode. To remove this object from the configuration, use the no version of this command.
upload-max-size <size>
no upload-max-size
Syntax Description
Defaults
The default size is 2147483647.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy webvpn configuration mode
•
—
•
—
—
Command History
Usage Guidelines
Setting the size to 0 effectively disallows object uploading.
Examples
The following example sets the maximum size for a uploaded object to 1500 bytes:
hostname(config)# group-policy test attributeshostname(config-group-policy)# webvpnhostname(config-group-webvpn)# upload-max-size 1500Related Commands
uri-non-sip
To identify the non-SIP URIs present in the Alert-Info and Call-Info header fields, use the uri-non-sip command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
uri-non-sip action {mask | log} [log}
no uri-non-sip action {mask | log} [log}
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
The following example shows how to identify the non-SIP URIs present in the Alert-Info and Call-Info header fields in a SIP inspection policy map:
hostname(config)# policy-map type inspect sip sip_maphostname(config-pmap)# parametershostname(config-pmap-p)# uri-non-sip action logRelated Commands
url
To maintain the list of static URLs for retrieving CRLs, use the url command in crl configure configuration mode. The crl configure configuration mode is accessible from the crypto ca trustpoint configuration mode. To delete an existing URL, use the no form of this command.
url index url
no url index url
Syntax Description
index
Specifies a value from 1 to 5 that determines the rank of each URL in the list. The security appliance tries the URL at index 1 first.
url
Specifies the URL from which to retrieve the CRL.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
CRL configure configuration
•
—
•
—
—
Command History
Usage Guidelines
You cannot overwrite existing URLs. To replace an existing URL, first delete it using the no form of this command.
Examples
The following example enters ca-crl configuration mode, and sets up an index 3 for creating and maintaining a list of URLs for CRL retrieval and configures the URL https://foobin.com from which to retrieve CRLs:
hostname(configure)# crypto ca trustpoint centralhostname(ca-trustpoint)# crl configurehostname(ca-crl)# url 3 https://foobin.comhostname(ca-crl)#Related Commands
crl configure
Enters ca-crl configuration mode.
crypto ca trustpoint
Enters trustpoint configuration mode.
policy
Specifies the source for retrieving CRLs.
url-block
To manage the URL buffers used for web server responses while waiting for a filtering decision from the filtering server, use the url-block command. To remove the configuration, use the no form of this command.
url-block block block_buffer
no url-block block block_buffer
url-block mempool-size memory_pool_size
no url-block mempool-size memory_pool_size
url-block url-size long_url_size
no url-block url-size long_url_size
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
For Websense filtering servers, the url-block url-size command allows filtering of long URLs, up to 4 KB. For Secure Computing, the url-block url-size command allows filtering of long URLs, up to 3 KB. For both Websense and N2H2 filtering servers, the url-block block command causes the security appliance to buffer packets received from a web server in response to a web client request while waiting for a response from the URL filtering server. This improves performance for the web client compared to the default security appliance behavior, which is to drop the packets and to require the web server to retransmit the packets if the connection is permitted.
If you use the url-block block command and the filtering server permits the connection, the security appliance sends the blocks to the web client from the HTTP response buffer and removes the blocks from the buffer. If the filtering server denies the connection, the security appliance sends a deny message to the web client and removes the blocks from the HTTP response buffer.
Use the url-block block command to specify the number of blocks to use for buffering web server responses while waiting for a filtering decision from the filtering server.
Use the url-block url-size command with the url-block mempool-size command to specify the maximum length of a URL to be filtered and the maximum memory to assign to the URL buffer. Use these commands to pass URLs longer than 1159 bytes, up to a maximum of 4096 bytes, to the Websense or Secure-Computing server. The url-block url-size command stores URLs longer than 1159 bytes in a buffer and then passes the URL to the Websense or Secure-Computing server (through a TCP packet stream) so that the Websense or Secure-Computing server can grant or deny access to that URL.
Examples
The following example assigns 56 1550-byte blocks for buffering responses from the URL filtering server:
hostname#(config)# url-block block 56Related Commands
url-cache
To enable URL caching for URL responses received from a Websense server and to set the size of the cache, use the url-cache command in global configuration mode. To remove the configuration, use the no form of this command.
url-cache { dst | src_dst } kbytes [ kb ]
no url-cache { dst | src_dst } kbytes [ kb ]
Syntax Description
Defaults
This command is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
Note
The url-cache command provides a configuration option to cache responses from the URL server.
Use the url-cache command to enable URL caching, set the size of the cache, and display cache statistics.
Caching stores URL access privileges in memory on the security appliance. When a host requests a connection, the security appliance first looks in the URL cache for matching access privileges instead of forwarding the request to the Websense server. Disable caching with the no url-cache command.
Note
Using the URL cache does not update the Websense accounting logs for Websense protocol Version 1. If you are using Websense protocol Version 1, let Websense run to accumulate logs so you can view the Websense accounting information. After you get a usage profile that meets your security needs, enable url-cache to increase throughput. Accounting logs are updated for Websense protocol Version 4 URL filtering while using the url-cache command.
Examples
The following example caches all outbound HTTP connections based on the source and destination addresses:
hostname(config)# url-cache src_dst 128Related Commands
url-entry
To enable or disable the ability to enter any HTTP/HTTPS URL on the portal page, use the url-entry command in dap webvpn configuration mode.
url-entry enable | disable
Defaults
No default value or behaviors.
Command Modes
The following table shows the modes in which you can enter the command:
Dap webvpn configuration
•
•
•
—
—
Command History
Usage Guidelines
Examples
The following example shows how to enable URL entryfor the DAP record called Finance:
hostname (config) config-dynamic-access-policy-record Financehostname(config-dynamic-access-policy-record)# webvpnhostname(config-dynamic-access-policy-record)# url-entry enableRelated Commands
dynamic-access-policy-record
Creates a DAP record.
file-entry
Enables or disables the ability to enter file server names to access.
url-length-limit
To configure the maximum length of the URL allowed in the RTSP message, use the url-length-limit command in parameters configuration mode. Parameters configuration mode is accessible from policy map configuration mode. To disable this feature, use the no form of this command.
url-length-limit length
no url-length-limit length
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Parameters configuration
•
•
•
•
—
Command History
Examples
