Feedback
Table Of Contents
Command Reference
This appendix describes the Firewall Services Module commands that are unique to this module and the commands that have been changed from the PIX command implementation for use with the Firewall Services Module.
For detailed information about the PIX software commands, refer to the PIX documentation located at these URLs:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_60/
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/
access-list
To configure access rules, use the access-list command. Use the no form of this command to remove access rules from the configuration.
Note
The configuration options for the access-lists in module are the same as those supported in PIX 6.0. module also supports access rules configuration using the object group command as supported in PIX 6.2.
Note
access-list acl_ID deny | permit { protocol | object-group protocol_obj_grp_id }
{host source_addr | local_addr | source_addr | local_addr source_mask | local_mask | object-group network_obj_grp_id } { [ operator port [ port ] | object-group service_obj_grp_id ] } {host destination_addr | remote_addr | destination_addr | remote _addr destination_mask | remote_mask | object-group network_obj_grp_id { [ operator port [ port ] | object-group service_obj_grp_id ] }no access-list acl_ID deny | permit { protocol | object-group protocol_obj_grp_id }
{host source_addr | local_addr | source_addr | local_addr source_mask | local_mask | object-group network_obj_grp_id } { [ operator port [ port ] | object-group service_obj_grp_id ] } {host destination_addr | remote_addr | destination_addr | remote _addr destination_mask | remote_mask | object-group network_obj_grp_id { [ operator port [ port ] | object-group service_obj_grp_id ] }access-list acl_ID deny | permit icmp { host source_addr | local_addr | source_addr | local_addr source_mask | local_mask | object-group network_obj_grp_id }{ host destination_addr | remote_addr | destination_addr | remote_addr destination_mask | remote_mask | object-group network_obj_grp_id }{ [ icmp_type | object-group icmp_type_obj_grp_id] }
no access-list acl_ID deny | permit icmp { host source_addr | local_addr | source_addr | local_addr source_mask | local_mask | object-group network_obj_grp_id }{ host destination_addr | remote_addr | destination_addr | remote_addr destination_mask | remote_mask | object-group network_obj_grp_id }{ [ icmp_type | object-group icmp_type_obj_grp_id] }
clear access-list [acl_ID]
show access-list [acl_ID]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Usage Guidelines
The access list behavior on the module differs from that on PIX 6.0 as follows:
•
•
•
After the compilation begins, it may take some time for the new rule set to be downloaded to the hardware. In the interim, the old access rule set is applied to the incoming traffic. After successfully download the new set is used to determine access permissions.
•
•
Examples
This example shows how to define an access list allowing any host to access server 121.23.65.12 using Telnet:
FWSM(config)# access-list in_acl permit tcp any host 121.23.65.12 eq 23For further examples, refer to the Configuration Guide for the Cisco Secure PIX Firewall Version 6.
For examples on using access-lists with the object group command, refer to the Cisco PIX Firewall and VPN Configuration Guide Version 6.2.
Related Commands
access-list (PIX 6.0)
object-groupaccess-list (ospf)
To configure access rules, use the access list (ospf) command. Use the no form of this command to remove access rules from the configuration.
access-list id deny | permit {any | ip mask}
[no] access-list id deny | permit {any | ip mask}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Usage Guidelines
This access list syntax is used only in the context of OSPF. Access lists created with this syntax are then used for defining route maps to be applied to redistributed routes. An access list containing any access elements defined using the command syntax cannot be applied to an interface using the access-list command.
Examples
This example shows how to create an access list:
FWSM(config)# access-list ospf1 permit 10.2.0.0 255.255.255.0.0FWSM(config)# show access-listaccess-list ospf1; 1 elementsaccess-list ospf1 permit 10.2.0.0 255.255.255.0 (hitcnt=0)Related Commands
area
To specify an area name in the router configuration submode, use the area command.
area area id authentication
area area id authentication message-digest
area area id default-cost cost
area area id filter-list prefix name [in | out]
area area id nssa [no-redistribution] [default-information-originate]
area area id range prefix mask [advertise | not-advertise]
area area id stub [no-summary]
area area id virtual-link router id [authentication [message-digest | null]] [hello-interval seconds] [retransmit-interval seconds] [transmit-delay seconds] [dead-interval seconds [[authentication-key key]| [message-digest-key key id md5 key]]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Router configuration submode.
Command History
Examples
The following example mandates authentication for areas 0 and 36.0.0.0 of OSPF routing process 201. Authentication keys are also provided.
Router(config)# interface ethernet 0ip address 131.119.251.201 255.255.255.0ip ospf authentication-key adcdefgh!Router(config)# interface ethernet 1ip address 36.56.0.201 255.255.0.0ip ospf authentication-key ijklmnop!Router(config)# router ospf 201network 36.0.0.0 0.255.255.255 area 36.0.0.0network 131.119.0.0 0.0.255.255 area 0area 36.0.0.0 authenticationarea 0 authenticationThe following example assigns a default cost of 20 to stub network 36.0.0.0:
Router(config)# interface ethernet 0ip address 36.56.0.201 255.255.0.0!Router(config)# router ospf 201network 36.0.0.0 0.255.255.255 area 36.0.0.0area 36.0.0.0 stubarea 36.0.0.0 default-cost 20The following example filters prefixes that are sent from all other areas to area 1:
Router(config)# area 1 filter-list prefix-list AREA_1 inThe following example specifies one summary route to be advertised by the ABR to other areas for all subnets on network 36.0.0.0 and for all hosts on network 192.42.110.0:
Router(config)# interface ethernet 0ip address 192.42.110.201 255.255.255.0!Router(config)# interface ethernet 1ip address 192.42.120.201 255.255.255.0!Router(config)# router ospf 201network 192.42.110.0 0.0.0.255 area 0area 36.0.0.0 range 36.0.0.0 255.0.0.0area 0 range 192.42.110.0 255.255.0.0The following example establishes a virtual link with default values for all optional parameters:
Router(config)# router ospf 201network 36.0.0.0 0.255.255.255 area 36.0.0.0area 36.0.0.0 virtual-link 36.3.4.5The following example establishes a virtual link with MD5 authentication:
Router(config)# router ospf 201network 36.0.0.0 0.255.255.255 area 36.0.0.0area 36.0.0.0 virtual-link 36.3.4.5 message-digest-key 3 md5 sa5721bk47For further examples refer to the Cisco IOS Configuration Guides and Command References.
clear console-output
To clear the contents of the message buffer, use the clear console-output command.
clear console-output
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to clear the message buffer.
Router(config)# clear console-outputRelated Commands
clear logging rate-limit
To clear the log rate, use the clear logging rate-limit command.
clear logging rate-limit
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to clear the logging rate.
Router(config)# clear logging rate-limitRelated Commands
logging rate-limit
show logging rate-limitdefault-information originate
To control the redistribution of a default route, use the default-information originate command.
default-information originate [always] [metric value | metric-type {1 | 2} | [route-map map]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Router configuration submode.
Command History
Examples
This example shows how to control the redistribution of a default route:
Router(config)# default-information originatedistance
To define OSPF administrative distances based on route type, use the distance command. To restore the default value, use the no form of this command.
distance [intra-area dist1] [inter-area dist2] [external dist3]
no distance
Syntax Description
Defaults
dist1, dist2, and dist3 values are 110.
Command Modes
Router configuration submode.
Command History
Examples
The following example changes the external distance to 200, making it less reliable:
Router A Configuration
Router(config)# router ospf 1Router(config)# redistribute ospf 2 subnetRouter(config)# distance external 200Router B Configuration
Router(config)# router ospf 2Router(config)# redistribute ospf 1 subnetRouter(config)# distance external 200Related Commands
firewall module
To attach a group of controlled VLANs to a module, use the firewall module command.
firewall module module_number vlan-group firewall_group
Syntax Description
module_number
Specifies the module to attach the VLAN group.
vlan-group
Specifies a VLAN group
firewall_group
Names the VLAN group.
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to attach a VLAN group to a module:
Router(config)# firewall 6 vlan-group 20Related Commands
firewall vlan-group
To configure a group of controlled VLANs, use the firewall vlan-group command.
firewall vlan-group firewall_group vlan_range
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to configure a group of controlled VLANs:
Router(config)# firewall vlan-group 20 8, 10-15Related Commands
interface
To enter the interface configuration submode to enter OSPF commands or the shutdown command, use the interface command.
interface interface-name
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to enter the interface configuration submode:
Router(config)# interface swedenRelated Commands
ip prefix-list
To configure a prefix list, use the ip prefix-list command.
ip prefix-list list-name [seq seq-value] {deny | permit network/length} [ge ge-value] [le le-value
no ip prefix-list list-name [seq seq-value] {deny | permit network/length} [ge ge-value] [le le-value]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to deny the default route 0.0.0.0/0:
Router(config)# ip prefix-list abc deny 0.0.0.0/0This example shows how to permit the prefix 35.0.0.0/8:
Router(config)# ip prefix-list abc permit 35.0.0.0/8For further examples refer to the Cisco IOS Configuration Guides and Command References.
logging rate-limit
To rate limit the number of syslogs generated from the module, use the logging rate-limit command. To remove access lists from the configuration, use the no form of this command.
logging rate-limit num [interval] message syslog_id
no logging rate-limit num [interval] message syslog_id
logging rate-limit num [interval] level syslog_level
no logging rate-limit num [interval] level syslog_level
show logging rate-limit
clear logging rate-limit
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
These examples show how to set up logging rate limits:
•
logging rate-limit 10 1 message 106023Because the [interval] is optional and defaults to 1 second, you can specify:
logging rate-limit 10 message 106023•
logging rate-limit 5 level 3•
–
logging rate-limit 10 message 106023logging rate-limit 5 level 1All syslogs other than 106023 in level 1 will be generated at the maximum 5 times per second. 106023 will be generated up to 10 times per second.
–
logging rate-limit 10 message 106023logging rate-limit 5 level 1no logging rate-limit 10 message 106023The configuration will be equivalent to only the following:
logging rate-limit 5 level 1If you set up a configuration in this order:
logging rate-limit 10 message 106023logging rate-limit 5 level 1no logging rate-limit 5 level 1This configuration is equivalent to the following:
logging rate-limit 10 message 106023–
logging rate-limit 5 level 1logging rate-limit 6 level 3logging rate-limit 5 2 level 4The last 1 in the configuration limits the rate of all syslogs in level 4 to 5 in 2 second intervals.
match
To define route matching criteria for a route map, use the no form of this command. To disable matching, use the no form of this command.
match [interface | route-type | metric | ip address | ip next-hop | ip route-source]
[no] match [interface | route-type | metric | ip address | ip next-hop | ip route-source]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Route-map configuration submode.
Command History
Examples
This example shows how create a route map that can be used to redistribute internal routes:
Router(config-route-map)# route-map nameRouter(config-route-map)# match route-type internalRelated Commands
set
route-mapnameif
To assign a name to an interface, use the nameif command. To remove the interface name, use the no form of this command.
nameif vlan_number if_name security_level
no nameif vlan_number [if_name] [security_level]
Syntax Description
vlan_number
Specifies a VLAN.
if_name
Specifies the perimeter interface name.
security_level
Indicates the security level for the perimeter interface. Range is from 1 to 99.
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Usage Guidelines
Specifies the perimeter interface VLAN, name, and security level on an interface.
Examples
This example shows how to assign a name to an interface:
Router(config)# nameif vlan 10 inside security 100network
To define the interfaces on which OSPF runs and to define the area ID for those interfaces, use the network area router command. To disable OSPF routing for interfaces defined with the address wildcard-mask pair, use the no form of this command.
network ip-address wildcard-mask area area id
no network ip-address wildcard-mask area area id
Syntax Description
Defaults
This command has no default settings.
Command Modes
Router configuration submode.
Command History
Examples
This example shows how to initialize the OSPF routing process 109, and defines four OSPF areas: 10.9.50.0, 2, 3, and 0. Areas 10.9.50.0, 2, and 3 mask specific address ranges, while area 0 enables OSPF for all other networks.
Router(config)# interface ethernet 0Router(config)# ip address 131.108.20.1 255.255.255.0Router(config)# router ospf 109Router(config-router)# network 131.108.20.0 0.0.0.255 area 10.9.50.0Router(config-router)# network 131.108.0.0 0.0.255.255 area 2Router(config-router)# network 131.109.10.0 0.0.0.255 area 3Router(config-router)# network 0.0.0.0 255.255.255.255 area 0:ospf
To configure OSPF use the ospf commands.
ospf authentication-key key
ospf authentication [message-digest | null]
ospf cost cost
ospf dead-interval seconds
ospf hello-interval seconds
ospf message-digest-key keyed md5 key
ospf priority number
ospf retransmit-interval seconds
ospf transmit-delay seconds
Syntax Description
Defaults
This command has no default settings.
Command Modes
Interface configuration submode.
Command History
Examples
The following example sets the interface cost value to 65:
Router(config)# ospf cost 65The following example sets the interval between hello packets to 15 seconds:
Router(config)# ospf hello-interval 15The following example sets a new key 19 with the password 8ry4222:
Router(config)# ospf message-digest-key 19 md5 8ry4222For further examples, refer to the corresponding ip ospf commands in Cisco IOS Configuration Guides and Command References.
Related Commands
redistribute
To enable redistribution of static or connected routes or routes form another OSPF process, use the redistribute command. To remove redistribution from the configuration, use the no form of this command.
redistribute {ospf id | static | connect} [{match {internal | external extern-type} metric metric-value | metric-type metric-type [internal | external] tag tag-value | subnets}] route-map map value
[no] redistribute {ospf id | static | connect} [{match { internal | external extern-type} metric metric-value | metric-type metric-type [internal | external] tag tag-value | subnets}] route-map map value
Syntax Description
Defaults
Metric value is 0 or 20 depending upon the destination protocol.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to specify a network 172.16.0.0 that will appear as an external link-state advertisement (LSA) in OSPF 1 with a cost of 100 (the cost is preserved):
Router(config)# ip address inside 172.16.0.1 255.0.0.0Router(config)# interface insideRouter(config)# ospf cost 100Router(config)# ip address outside 10.0.0.1 255.0.0.0Router(config)# interface outsideRouter(config)# ip address 10.0.0.1 255.0.0.0Router(config)# router ospf 1Router(config-router)# network 10.0.0.0 0.255.255.255 area 0Router(config)# redistribute ospf 2 subnetRouter(config)# router ospf 2Router(config-router)# network 172.16.0.0 0.255.255.255 area 0route
To define a static or default route for an interface, use the route command.
route if_name ip_address netmask gateway_ip [metric]
[no] route [if_name ip_address [mask gateway]]
Syntax Description
Defaults
Netmask value is 255.255.255.0.
Metric value is 1.Command Modes
Privileged mode.
Command History
Examples
This example shows how to configure a route on the interface "inside" for the network 10.2.2.0/24 with next hop 10.2.1.5:
FWSM(config)# route inside 10.2.2.0 255.255.255.0 10.2.1.5FWSM(config)# show routeS 0.0.0.0 0.0.0.0 [0/0] via 10.6.13.1, dmzC 10.2.1.0 255.255.255.0 is directly connected, insideS 10.2.2.0 255.255.255.0 [1/0] via 10.2.1.5, insideC 10.3.1.0 255.255.255.0 is directly connected, outsideC 10.6.13.0 255.255.255.0 is directly connected, dmzC 127.0.0.0 255.255.255.0 is directly connected, eobcRelated Commands
show route
router ospf
To create or configure an OSPF routing process, use the router ospf command. To remove the routing process from the configuration, use the no form of this command.
router ospf autonomous-system id
no router ospf autonomous-system id
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to create and OSPF routing process:
Router(config)# router ospf 12345Related Commands
route-map
To create a route map, use the route-map command. To remove a route map from the configuration, use the no form of this command.
route-map map-tag [permit | deny] [seq-num]]
[no] route-map map-tag [permit | deny] [seq-num]]
Syntax Description
Defaults
Permit is the default.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to create a route map:
FWSM# route-map disco permitFWSM# show route-maproute-map disco permit 10Related Commands
match
setset metric
To define the actions taken on routes that match the criteria defined for a route map, use the set metric command. To disable metric criteria, use the no form of this command.
set metric [+ | -] metric-value
[no] set metric [+ | -] metric-value
Syntax Description
Defaults
This command has no default settings.
Command Modes
Route-map configuration submode.
Command History
Examples
This example shows how to set the metric value for the routing protocol to 100:
Router(config-route-map)# route-map set-metricRouter(config)# set metric 100
Note
Related Commands
set metric-type
To specify a metric type for a route map, use the set metric-type command.
set metric-type type-1 | type-2
[no] set metric-type type-1 | type-2
Syntax Description
type-1
Specifies the open Shortest Path First (OSPF) external Type 1 metric.
type-2
Specifies the OSPF external Type 2 metric
Defaults
This command has no default settings.
Command Modes
Route-map configuration submode.
Command History
Examples
This example shows how to set the metric type of the destination protocol to OSPF external Type 1:
Router(config-route-map)# route-map map-typeRouter(config-route-map)# set metric-type type-1:Related Commands
show console-output
To view the contents of the message buffer, use the show console-output command.
show console-output [start_message_number-end_message_number]
Syntax Description
start_message_number
Specifies the starting serial number of the message to be displayed.
end_message_number
Specifies the end serial number of the message to be displayed.
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Usage Guidelines
Messages appearing on the console are redirected to all active Telnet sessions.When no Telnet session is available, the output is saved to a buffer. The buffer output can be subsequently examined when you Telnet to the module application software partition. Individual messages are numbered.
Examples
This example shows how to display the buffer output:
FWSM# show console-outputMessage #1 :Initializing debugger......:Message #2 :Found PCI card in slot:1 bus:2 dev:9 (vendor:0x8086 deviceid:0x1001)Message #3 :Found PCI card in slot:2 bus:2 dev:8 (vendor:0x8086 deviceid:0x1001)Message #4 :Found PCI card in slot:3 bus:1 dev:6 (vendor:0x1014 deviceid:0x1e8)Message #5 :Ignoring PCI card in slot:3 (vendor:0x1014 deviceid:0x1e8)Message #6 :Found PCI card in slot:4 bus:1 dev:5 (vendor:0x1014 deviceid:0x1e8)Message #7 :Ignoring PCI card in slot:4 (vendor:0x1014 deviceid:0x1e8)Message #8 :Found PCI card in slot:5 bus:1 dev:4 (vendor:0x1014 deviceid:0x1e8)Message #9 :Ignoring PCI card in slot:5 (vendor:0x1014 deviceid:0x1e8)Message #10 :Found PCI card in slot:7 bus:0 dev:2 (vendor:0x1011 deviceid:0x22)Related Commands
show crashdump
To display the contents of the crashdump partition, use the show crashdump command.
show crashdump
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to display the contents of the crashdump partition:
Router(config)# show crashdumpshow firewall module
To display the module configuration, use the show firewall module command.
show firewall module
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to display the module configuration:
Router(config)# show firewall moduleshow firewall vlan-group
To display the configured firewall VLAN groups, use the show firewall command.
show firewall vlan-group
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to display the configured firewall VLAN groups:
Router(config)# show firewall 20show interface
To show all of the VLANs configured, use the show interface command.
show interface [interface name] stats
Syntax Description
interface_name
Specifies the perimeter interface name.
stats
Displays the interface state and counters.
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Usage Guidelines
If VLANs are not configured on the MSFC, you will not be able to define any new VLAN interfaces on the Firewall Services Module.
Examples
This example shows how to display the firewall VLANs configured on all interfaces:
Router(config)# show interface dominoRelated Commands
show ip ospf
To show the OSPF configuration, use the show ip ospf command.
show ip ospf border-routers
show ip ospf database [router][network][external]
show ip ospf interface
show ip ospf neighbor
show ip ospf request-list
show ip ospf retransmission-list
show ip ospf summary-address
show ip ospf virtual-link
Syntax Description
Defaults
This command has no default settings.
Command Modes
Privileged mode.
Command History
Examples
This example shows how to show the IP OSPF configuration:
Router(config)# show ip ospf border routersRouting Process "ospf 201" with ID 192.42.110.200 Supports only single TOS(TOS0) route It is an area border and autonomous system boundary router Redistributing External Routes from, igrp 200 with metric mapped to 2, includes subnets in redistributionip with metric mapped to 2igrp 2 with metric mapped to 100igrp 32 with metric mapped to 1Number of areas in this router is 3Area 192.42.110.0Number of interfaces in this area is 1Area has simple password authenticationSPF algorithm executed 6 timesFor further examples, refer to the Cisco IOS Configuration Guides and Command References.
Related Commands
show logging rate-limit
To display the logging rate, use the show logging rate-limit command.
show logging rate-limit
Defaults
This command has no default settings
Command Modes
Privileged mode.
Command History
Examples
This example shows how to display the logging rate:
Router(config)# show logging rate limitRelated Commands
clear logging rate-limit
logging rate-limitshow vlan
To display the list of VLANs assigned to the module through the configuration on the supervisor route process MSFC, use the show vlan command.
show vlan
Defaults
This command has no default settings
Command Modes
Privileged mode.
Command History
Examples
This example shows how to display the VLANs assigned to the module:
Router(config)# show vlan10, 33, 100,summary-address
To create aggregate addresses for external routes, use the summary-address command. To disable aggregate addressing for external routes, use the no form of this command.
summary-address addr mask [not-advertise] [tag tag]
[no] summary-address addr mask [not-advertise] [tag tag]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Router configuration submode.
Command History
Examples
This example shows the summary address 10.1.0.0 includes address 10.1.1.0, 10.1.2.0, 10.1.3.0, and so on. Only the address 10.1.0.0 is advertised in an external link-state advertisement.
Router(config)# summary-address 10.1.0.0 255.255.0.0timers lsa-group-pacing
To change the interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing configuration command. To restore the default value, use the no form of this command.
timers lsa-group-pacing seconds
no timers lsa-group-pacing
Syntax Description
seconds
Specifies the umber of seconds in the interval at which LSAs are grouped and refreshed, checksummed, or aged. The range is from 10 to 1800 seconds.
Defaults
240 seconds
Command Modes
Router configuration submode.
Command History
Usage Guidelines
Examples
This example shows how to change the OSPF pacing between LSA groups to 60 seconds:
Router(config)# router ospf 1Router(config-router)# timers lsa-group-pacing 60timers spf
To configure the delay time between when OSPF receives a topology change and when it starts a shortest path first (SPF) calculation, use the timers spf command. To configure the hold time between two consecutive SPF calculations, use the timers spf router configuration command. To return to the default timer values, use the no form of this command.
timers spf spf-delay spf-holdtime
no timers spf spf-delay spf-holdtime
Syntax Description
Defaults
Delay time is 5 seconds.
Minimum time is 10 seconds.
Command Modes
Router configuration submode.
Command History
Examples
This example shows how to change the delay to 10 seconds and the hold time to 20 seconds:
Router(config)# timers spf 10 20upgrade-mp
To upgrade the maintenance software image, use the upgrade-mp command.
upgrade-mp tftp[:[[//location] [/tftp_pathname]]]
Syntax Description
Usage Guidelines
The upgrade-mp command lets you download a maintenance software image through TFTP. The image is downloaded, installed to the compact Flash and available on the next module reload (reboot).
If the command is used without the location or pathname optional parameters, then the location and filename are obtained from the user interactively through a series of questions similar to those presented by Cisco IOS software. If you only enter a colon (:), parameters are taken from the tftp-server command settings. If other optional parameters are supplied, then these values would be used in place of the corresponding tftp-server command setting. Supplying any of the optional parameters, such as a colon and anything after it, causes the command to run without prompting for user input.
The location is an IP address that the firewall can reach. The pathname can include any directory names besides the actual last component of the path to the file on the server. The pathname cannot contain spaces. If a directory name has spaces, set the directory in the TFTP server instead of in the upgrade-mp command.
If your TFTP server has been configured to point to a directory on the system from which you are downloading the image, you need only use the IP address of the system and the image filename.
For example, the command causes the TFTP server to receive the command and determine the actual file location from its root directory information:
Router(config)# upgrade-mp tftp://10.1.1.5/mp.1-1-0-3.bin.gzThe server then downloads the TFTP image to the module.
Examples
This example causes the module to prompt you for the filename and location before you start the TFTP download:
Router(config)# upgrade-mpAddress or name of remote host [127.0.0.1]? 10.1.1.5Source file name [cdisk]? mp.1-1-0-3.bin.gzcopying tftp://10.1.1.5/mp.1-1-0-3.bin.gz to flash[yes|no|again]? yes!!!!!!!!!!!!!!!!!!!!!!!Received 1695744 bytes.Maintenance partition upgraded.To set the filename and location specified in the tftp-server command, save memory, and then download the image to Flash memory, use these commands:
Router(config)# tftp-server outside 10.1.1.5 mp.1-1-0-3.bin.gzWarning: 'outside' interface has a low security level (0).write memoryBuilding configuration...Cryptochecksum: 017c452b d54be501 8620ba48 490f7e99[OK]Router(config)# upgrade-mp tftp:copying tftp://10.1.1.5/mp.1-1-0-3.bin.gz to flash!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!To override the information in the tftp-server command and specify alternate information about the filename and location, use this command:
Router(config)# upgrade-mp tftp://10.0.0.1/mp.1-1-0-3.bin.gzTo specify all information, if you have not set the tftp-server command, use this command:
Router(config)# upgrade-mp tftp://10.0.0.1/mp.1-1-0-3.bin.gz
