-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 2.3
-
About This Guide
-
Chapter 1 Using Firewall Services Module Commands
-
A through B Commands
-
C Commands
-
D through F Commands
-
G through L Commands
-
M through R Commands
-
S Commands
-
T through Z Commands
-
Appendix A: Acronyms
-
Appendix B Port and Protocol Values
-
Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module Command Reference Guide Release 2.3
-
Feedback
Table Of Contents
telnet
To add Telnet access to the FWSM console and set the idle timeout, use the telnet command. To remove Telnet access from a previously set IP address, use the no form of this command.
[no] telnet local_ip mask interface_name
telnet timeout number
Syntax Description
Defaults
number is 5 minutes.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The telnet command allows you to specify which hosts can access the FWSM console with Telnet. You can enable Telnet to the FWSM on all interfaces. However, the FWSM enforces that all Telnet traffic to the lowest security interface is protected by IPSec. To enable a Telnet session to the lowest interface, configure IPSec on the lowest security interface to include IP traffic that is generated by the FWSM and enable Telnet on the interface.
Up to 16 hosts or networks are allowed access to the FWSM console with Telnet, and up to 5 hosts are allowed access to the FWSM simultaneously. Use the no telnet or clear telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout command to set the maximum time that a console Telnet session can be idle before being logged off by the FWSM. The clear telnet command does not affect the telnet timeout command duration. You cannot use the no telnet command with the telnet timeout command.
To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255. You must specify netmask as 255.255.255.255 regardless of the class of local_ip. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address in ip_address.
If IPSec is operating, you can specify an unsecure interface name, which is typically, the outside interface. At a minimum, you might configure the crypto map command to specify an interface name with the telnet command.
You must specify an interface namee. The FWSM automatically verifies the IP address against the IP addresses that are specified by the ip address commands to ensure that the address that you specify is on an internal interface. If an interface name is specified, the FWSM checks only the host against the interface that you specify.
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the FWSM console. Use the kill command to terminate an active Telnet console session.
If you use the aaa command with the console keyword, Telnet console access must be authenticated with an authentication server.
Note
If you have configured the aaa command to require authentication for FWSM Telnet console access and the console login request times out, you can gain access to the FWSM from the serial console by entering the fwsm username and the password that was set with the enable password command.
Examples
This example shows how to permit hosts 192.168.1.3 and 192.168.1.4 to access the FWSM console through Telnet. In addition, all the hosts on the 192.168.2.0 network are given access.
fwsm/context_name(config)# telnet 192.168.1.3 255.255.255.255 insidefwsm/context_name(config)# telnet 192.168.1.4 255.255.255.255 insidefwsm/context_name(config)# telnet 192.168.2.0 255.255.255.0 insidefwsm/context_name(config)# show telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideThis example shows how to remove individual entries with the no telnet command or all telnet commands with the clear telnet command:
fwsm/context_name(config)# no telnet 192.168.1.3 255.255.255.255 insidefwsm/context_name(config)# show telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insidefwsm/context_name(config)# clear telnetfwsm/context_name(config)# show telnetThis example shows how to change the maximum session idle duration:
fwsm/context_name(config)# telnet timeout 10fwsm/context_name(config)# show telnet timeouttelnet timeout 10 minutesThis example shows a Telnet console login session (the password does not display when entered):
fwsm# passwd: ciscoWelcome to the FWSM...Type help or `?' for a list of available commands.fwsm>Related Commands
aaa accounting
kill
password/passwd
ssh
whoterminal
To set the terminal line parameter settings, use the terminal command.
terminal width columns
terminal monitor
terminal [no] monitor
Syntax Description
Defaults
Width is 80 columns. No monitoring is the default.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode and configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The terminal monitor command allows you to enable or disable the display of syslog messages in the current session for either Telnet or serial access to the FWSM console. Use the logging monitor command to enable or disable various levels of syslog messages to the console; use the terminal no monitor command to disable the messages on a per-session basis. Use the terminal monitor command to restart the syslog messages for the current session.
The terminal width command allows you to set the width for displaying command output. The terminal width is controlled by the terminal width nn command, where nn is the width in characters. If you enter a line break, you cannot use the backspace key to return to the previous line.
Examples
This example shows how to enable logging and then disable logging only in the current session:
fwsm/context_name(config)# terminal monitorfwsm/context_name(config)# terminal no monitorRelated Commands
clear terminal
logging
show terminaltftp-server
To specify the default TFTP server address and directory, use the tftp-server command. To disable access to the server, use the no form of this command.
[no] tftp-server interface_name ip_address directory
Syntax Description
interface_name
Interface name designated by the nameif command.
ip
IP address of the TFTP server.
directory
Directory of the configuration file.
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The tftp-server command allows you to specify the IP address of the server that you use to propagate the FWSM configuration files to the FWSM. Use the tftp-server command with the configure net command to read from the configuration or with the write net command to store the configuration in the file that you specify. The FWSM supports only one TFTP server.
The path name that you specify in the tftp-server is appended to the end of the IP address that you specify in the configure net and write net commands. Because the path name is appended to the IP address that you specify with the tftp-server command, you will not need to specify the file and pathname with the configure net and write net commands. If you specify the full path and filename in the tftp-server command, the IP address in the configure net and write net commands can be represented with a colon ( : ).
This is the interface by which the TFTP server IP is accessible.
The interface_name argument specifies the interface name designated by the nameif command. If you specify the outside interface, a warning message informs you that the outside interface is unsecure.
Caution
The format for path differs by the type of operating system of the server that you are using to contain the configuration files for the FWSM. The contents of a path are passed directly to the server without interpretation or checking. The configuration file must exist on the TFTP server. Many TFTP servers require the configuration file to be world-writable to write to it and world-readable to read from it.
Note
Examples
This example shows how to specify a TFTP server and then read the configuration from /FWSM/config/test_config directory:
fwsm/context_name(config)# tftp-server inside 10.1.1.42 /fwsm/config/test_configfwsm/context_name(config)# configure net :Related Commands
clear tftp-server
show tftp-servertimeout
To set the maximum idle time duration, use the timeout command.
timeout [xlate | conn | udp | icmp | rpc | h323 | h225 | mgcp | sip | sip_media | uauth hh:mm:ss]
Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
•
•
•
•
•
•
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The timeout command allows you to set the idle time for connection, translation UDP, and RPC slots. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence.
This command is used with the show and clear uauth commands.
Note
The connection timer takes precedence over the translation timer; the translation timer works only after all connections have timed out.
When setting the conn hh:mm:ss, use 0:0:0 to never time out a connection.
When setting the half-closed hh:mm:ss, use 0:0:0 to never time out a half-closed connection.
When setting the h255 hh:mm:ss, h225 00:00:00 means to never tear down H.225 signaling. A timeout value of h225 00:00:01 disables the timer and closes the TCP connection immediately after all calls are cleared.
The uauth hh:mm:ss duration must be shorter than the xlate keyword. Set to 0 to disable caching. Do not set to zero if passive FTP is used on the connections.
To disable the absolute keyword, set the uauth timer to 0 (zero).
Caution
Examples
This example shows how to configure the maximum idle time durations:
fwsm/context_name(config)# timeout uauth 0:5:00 absolute uauth 0:4:00 inactivityfwsm/context_name(config)# show timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolute uauth 0:04:00 inactivityRelated Commands
arp
clear timeout
show timeout
show xlate
show uauth
timers
To configure the OSPF process delay timers, use the timers command. To return to the default settings, use the no form of this command.
timers {spf spf_delay spf_holdtime | lsa-group-pacing seconds}
no timers {spf | lsa-group-pacing}
Syntax Description
Defaults
The defaults are as follows:
•
•
•
Command Modes
Security Context Mode: single context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: Routed
Command History
Usage Guidelines
To configure the delay time between when the OSPF protocol receives a topology change and when it starts a calculation, and the hold time between two consecutive SPF calculations, use the timers spf spf_delay spf_holdtime subcommand. To return to the default timer values, use the no timers spf subcommand.
To change the interval at which the OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing seconds subcommand. To return to the default timer values, use the no timers lsa-group-pacing subcommand.
Examples
This example shows how to configure OSPF process delay timers:
fwsm/context_name(config)# timers lsa-group-pacing 40Related Commands
router ospf
show ip ospf
show timersupgrade-mp
To upgrade the maintenance partition, use the upgrade-mp command.
upgrade-mp tftp://location/pathname
upgrade-mp http[s]://[user:password@]location [:port]/pathname
upgrade-mp tftp[:[[//location][/pathname]]]
Syntax Description
location
(Optional) Location of the upgrade software image.
pathname
(Optional) Pathname to the upgrade software image.
user
(Optional) Username.
password
(Optional) User's password.
port
HTTP port.
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode
Access Location: system command line
Command Mode: privileged mode and configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Examples
This example show how to upgrade a maintenance partition using TFTP:
fwsm(config)# upgrade-mp tftp://10.192.1.1/c6svc-mp.2-1-1.bin.gzuptime
To display the FWSM version and the time that the module has been running, use the uptime command.
uptime
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
1.1(1)
Support for this command was introduced on the FWSM.
2.3(1)
This command is not supported in this release. The show uptime command is supported.
Examples
This example shows how to display FWSM version and runtime information:
FWSM# show uptimeFWSM Firewall Version 2.3(1)11FWSM Device Manager Version 4.0(1)Compiled on <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" />Fri 04-Feb-05 00:12 by daleckiFWSM up 6 hours 21 minsHardware: WS-SVC-FWM-1, 1024 MB RAM, CPU Pentium III 1000 MHzFlash V1.01 SMART ATA FLASH DISK @ 0xc321, 20MB0: gb-ethernet0: irq 51: gb-ethernet1: irq 72: ethernet0: irq 11Licensed Features:Failover: EnabledVPN-DES: EnabledVPN-3DES: EnabledMaximum Interfaces: 256Cut-through Proxy: EnabledGuards: EnabledURL-filtering: EnabledThroughput: UnlimitedISAKMP peers: UnlimitedRelated Commands
url-block
To enable long URL support and HTTP response buffering for URL filtering services, use the url-block command. To disable long URL support and HTTP response buffering for URL filtering services, use the no form of this command.
[no] url-block {block block_buffer_limit} | {url-mempool memory_pool_size} | {url-size long_url_size}
Syntax Description
Defaults
block_buffer_limit is 1 KB.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The url-block url-size long_url_size command is supported on Websense servers only.
The url-block command requires that a valid Websense URL filtering configuration is running on the FWSM. After a valid Websense URL filter is in place, you can use this command to pass the URLs that are longer than 1159 bytes, up to a maximum of 4096 bytes, to the Websense server. The url-block command stores the URLs that are longer than 1159 bytes in a buffer and then passes the URL to the Websense server (through a TCP packet stream) so that the Websense server can grant or deny access to that URL.
Examples
This example shows how to enable long URL support and HTTP response buffering for URL filtering services:
FWSM(config)# url-block block 128FWSM(config)# url-block url-mempool 1500FWSM(config)# url-block url-size 4Related Commands
url-cache
To cache web server responses that are pending a permit or deny response from an N2H2 server or Websense server, use the url-cache command. To disable caching, use the no form of this command.
[no] url-cache {dst | src_dst} size kbytes
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The url-cache command provides a configuration option to buffer the response from a web server if its response is faster than that from the N2H2 or Websense filtering service server. This command prevents the web server's response from being loaded twice.
When you access a site, the filtering server can allow the FWSM to cache the server address for a certain amount of time, as long as every site hosted at the address is in a category that is permitted at all times. When you access the server again, or if another user accesses the server, the FWSM does not need to consult the filtering server.
Use the url-cache command to enable URL caching, set the size of the cache, and display the cache statistics.
Caching stores URL access privileges in memory on the FWSM. When a host requests a connection, the FWSM first looks in the URL cache for matching access privileges instead of forwarding the request to the N2H2 or Websense server. You can disable caching with the no url-cache command.
Using the URL cache does not update the Websense accounting logs for Websense protocol version 1. If you are using Websense protocol version 1, you should allow Websense to accumulate logs so that you can view the Websense accounting information. After you get a usage profile that meets your security needs, you can enable url-cache to increase throughput. Accounting logs are updated for Websense protocol version 4 and for N2H2 URL filtering while using the url-cache command.
Note
Select dst mode if all users share the same URL filtering policy on the N2H2 or Websense server.
Select src_dst mode if the users do not share the same URL filtering policy on the N2H2 or Websense server.
Examples
This example shows how to cache all outbound HTTP connections that are based on the source and destination addresses:
fwsm/context_name(config)# url-cache src_dst 128Related Commands
clear url-cache
show url-cache staturl-server
To designate a server running either N2H2 server or Websense servers for use with the filter command, use the url-server command. To remove the server, use the no form of this command.
N2H2 Commands
url-server {interface_name} vendor n2h2 host local_ip [port number] [timeout seconds] [protocol {TCP | UDP}]
no url-server {interface_name} vendor n2h2 host local_ip [port number] [timeout seconds] [protocol {TCP | UDP}]
Websense Commands
url-server {interface_name} vendor websense host local_ip [timeout seconds] [protocol {TCP | UDP} version]
no url-server {interface_name} vendor websense host local_ip [timeout seconds] [protocol {TCP | UDP} version]
Syntax Description
N2H2
Websense
Defaults
The default settings for the N2H2 filtering application are as follows:
•
•
•
•
The default settings for Websense are as follows:
•
•
•
•
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The url-server command allows you to designate the server running the N2H2 server or Websense server URL. The FWSM supports four URL servers per context in multiple mode; 16 URL servers can be assigned in single mode. However, you can use only one application at a time, either the N2H2 server or the Websense server. Changing the configuration on the FWSM does not update the configuration on the application server. Changing the configuration must be done separately and according to the individual vendor's instructions.
Note
http://www.n2h2.com.
For information on Websense filtering services, refer to this URL:
http://www.websense.com/You must configure the url-server command before using the filter command for HTTPS and FTP. If you remove all URL servers from the server list, then all filter commands that are related to URL filtering are also removed.
You cannot run both URL filtering services simultaneously.
For Websense, you can configure TCP using version 1 or version 4. You can configure UDP using version 4 only.
Examples
This example shows how to filter all outbound HTTP connections except those from the 10.0.2.54 host when using N2H2:
fwsm/context_name(config)# url-server (perimeter) vendor n2h2 host 10.0.1.1fwsm/context_name(config)# filter url http 0 0 0 0fwsm/context_name(config)# filter url except 10.0.2.54 255.255.255.255 0 0This example shows how to filter all outbound HTTP connections except those from the 10.0.2.54 host when using Websense:
fwsm/context_name(config)# url-server (perimeter) vendor websense host 10.0.1.1fwsm/context_name(config)# filter url http 0 0 0 0fwsm/context_name(config)# filter url except 10.0.2.54 255.255.255.255 0 0Related Commands
aaa authorization
clear url-server
filter ftp
show url-server
username
To set the username for the specified privilege level, use the username command. To remove the username and privilege level, use the no form of this command.
username username {[{nopassword | password password} [encrypted]] [privilege level]}
no username username
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The local FWSM user authentication database consists of the users entered with the username command. The FWSM login command uses this database for authentication.
Examples
This example shows how to set the username for the specified privilege level:
fwsm/context_name(config)# username larry nopassword privilege 4Related Commands
clear username
login
privilege
show usernamevirtual
To access the FWSM virtual server, use the virtual command.
virtual http ip_address [warn]
virtual telnet ip_address
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The virtual http command allows web browsers to work correctly with the FWSM aaa command. The aaa command assumes that the AAA server database is shared with a web server. The FWSM automatically provides the AAA server and web server with the same information. The virtual http command works with the aaa command to authenticate the user, separate the AAA server information from the web client's URL request, and direct the web client to the web server. Use the show virtual http command to list the commands in the configuration. Use the no virtual http command to disable its use.
The virtual http command allows you to redirect the web browser's initial connection to the ip_address, which resides in the FWSM, authenticating the user, and then redirecting the browser to the URL that the user originally requested. The virtual http command accesses the virtual server for use with HTTP. This command is useful for FWSM interoperability with Microsoft IIS and for other authentication servers.
When using HTTP authentication to a site running Microsoft IIS that has "Basic text authentication" or "NT Challenge" enabled, users may be denied access from the Microsoft IIS server because the browser appends the string: "Authorization: Basic=Uuhjksdkfhk==" to the HTTP GET commands. This string contains the FWSM authentication credentials.
For outbound use, the ip_address must be entered as an address routed to the FWSM.
For inbound use, the ip_address must be entered as an unused global address.
Caution
The virtual telnet command allows the Virtual Telnet server to provide a way to preauthenticate users who require connections through the FWSM using services or protocols that do not support authentication.
You can use the virtual telnet command both to log in and log out of the FWSM. When an unauthenticated user connects through Telnet to the virtual IP address, that user is challenged for a username and password, and then authenticated with the TACACS+ or RADIUS server. Once authenticated, the user sees the message "Authentication Successful" and the authentication credentials are cached in the FWSM for the duration of the uauth timeout.
The Virtual Telnet server provides a way to preauthenticate users who require connections through the FWSM using services or protocols that do not support authentication. Users first connect to the Virtual Telnet server IP address, where the user is prompted for a username and password.
The warn keyword is applicable only for text-based browsers where the redirect cannot happen automatically.
Examples
This example shows how to make an inbound connection:
fwsm/context_name(config)# static (inside, outside) 209.165.201.1 209.165.201.1 netmask 255.255.255.255fwsm/context_name(config)# access-list acl_out permit tcp any host 209.165.201.1 eq 80fwsm/context_name(config)# access-group acl_out in interface outsidefwsm/context_name(config)# aaa authentication include any inbound 209.165.201.1 255.255.255.255 0 0 tacacs+fwsm/context_name(config)# virtual http 209.165.201.1This example displays the show virtual command output:
fwsm(config)# show virtual httpvirtual http 209.165.201.1After adding the virtual telnet command to the configuration and writing the configuration to the Flash partition, the users wanting to start Point-to-Point Tunneling (PPTP) sessions through the FWSM use Telnet to access the ip_address.
This example shows how to make a connection to the FWSM:
fwsm/context_name(config)# virtual telnet 209.165.201.25fwsm/context_name(config)# aaa authentication include any outside 209.165.201.1 255.255.255.0 0 tacacs+fwsm/context_name(config)# static (inside, outside) 209.165.201.25 209.165.201.25 netmask 255.255.255.255fwsm/context_name(config)# access-list acl_out permit tcp any host 209.165.201.25 eq telnetfwsm/context_name(config)# access-group acl_out in interface outsidefwsm/context_name(config)# write memoryThis example shows how to make a connection to an inside host:
fwsm(config)# /unix/host%telnet 209.165.201.30Trying 209.165.201.25...Connected to 209.165.201.25.Escape character is `^]'.fwsm(config)# username: usernamefwsm(config)# TACACS+ Password: passwordAuthentication SuccessfulConnection closed by foreign host./unix/host%The username and password are for the user on the TACACS+ server.
Related Commands
vpngroup
To configure the Cisco VPN client version 3.x (Cisco unified VPN client framework), use the vpngroup command.
vpngroup group_name {address-pool pool_name} | {default-domain domain_name} | {dns-server dns_ip_prim [dns_ip_sec]} | {idle-time idle_seconds} | {max-time max_seconds} | {password preshared_key} | {split-tunnel access_list} | {wins-server wins_ip_prim [wins_ip_sec]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: configuration mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
Make sure that you configure the Internet Key Exchange (IKE) mode configuration before you configure support for the Cisco VPN Client. Specify that the FWSM initiates the IKE mode configuration.
For additional information about configuring interoperability with the Cisco VPN Client using the vpngroup commands, refer to the Cisco VPN Configuration Guide. The Cisco VPN Client supports Windows 2000.
The vpngroup command set allows you to configure Cisco VPN Client policy attributes to be associated with a VPN group name and are downloaded to the Cisco VPN Client(s) that are part of the given group. The same VPN group name specified here is configured in the Cisco VPN Client to ensure the matching of VPN client.
Configure a VPN group name of "default" to create a VPN group policy that matches any group name. The FWSM selects the VPN group name "default," if there is no other policy match. The VPN group_name is an ASCII string to denote a VPN group. You can make up the name. The maximum name has 63 characters.
The vpngroup address-pool command allows you to define a pool of local addresses to be assigned to a VPN group.
Note
Use the vpngroup group_name user-idle-timeout user_idle_seconds command to set the IUA idle timeout.
Use the vpngroup dns-server command to enable the FWSM to download an IP address of a DNS server to a Cisco VPN Client as part of an IKE negotiation.
The vpngroup wins-server command allows the FWSM to download an IP address of a WINS server to a Cisco VPN Client as part of an IKE negotiation.
To enable the FWSM to download a default domain name to a Cisco VPN Client as part of IKE negotiation, use the vpngroup default-domain command.
Use the vpngroup split-tunnel command to enable split tunneling on the FWSM. Split tunneling allows a remote VPN client simultaneous encrypted access to the corporate network and clear access to the Internet. When you use the vpngroup split-tunnel command, specify the access list name to which you are associating split tunneling of traffic. With split tunneling enabled, the FWSM downloads its local network IP address and netmask specified within the associated access list to the VPN client or as part of the policy push to the client. The VPN client sends the traffic that is destined to the specified local FWSM network through an IPSec tunnel and all other traffic in the clear. The FWSM receives the IPSec-protected packet on its outside interface, decrypts it, and then sends it to its specified local network.
The networks defined in the access-list deny commands are not pushed to VPN clients.
The vpngroup idle-time command allows you to set the inactivity timeout for a Cisco VPN Client. When the inactivity timeout for all IPSec SAs have expired for a given VPN client, the tunnel is terminated.
The vpngroup max-time command allows you to set the maximum connection time for a Cisco VPN Client. When the maximum connection time is reached for a given VPN client, the tunnel is terminated. The connection between the Cisco VPN Client and the FWSM has to be reestablished. The default maximum connection time is set to an unlimited amount of time.
Note
Configure the VPN group's preshared key employing the vpngroup password command to be used during IKE authentication. This preshared key is equivalent to the password that you enter within the Group Password box of the Cisco VPN Client while configuring your group access information for a connection entry.
The FWSM-configured password displays in asterisks within the file configuration.
Note
Examples
This example shows that the VPN client(s) within the VPN group named as "myVpnGroup" is dynamically assigned with one of the IP addresses from the pool of addresses ranging from 10.140.40.0 to 10.140.40.7. The policy attributes for the group "myVpnGroup" are downloaded to the given VPN client during the policy push to the client. Split tunnelling is enabled. All traffic that is destined for the 10.130.38.0 255.255.255.0 FWSM network from the VPN client is protected by IPSec.
fwsm/context_name(config)# access-list 90 permit ip 10.130.38.0 255.255.255.0 10.140.40.0 255.255.255.248fwsm/context_name(config)# ip local pool vpnpool 10.140.40.1-10.140.40.7fwsm/context_name(config)# crypto ipsec transform-set esp-sha esp-null esp-sha-hmacfwsm/context_name(config)# crypto dynamic-map dynmap 50 set transform-set esp-shafwsm/context_name(config)# crypto map mapName 10 ipsec-isakmp dynamic dynmapfwsm/context_name(config)# crypto map mapName client configuration address initiatefwsm/context_name(config)# crypto map mapName interface outsidefwsm/context_name(config)# isakmp enable outsidefwsm/context_name(config)# isakmp identity hostnamefwsm/context_name(config)# isakmp policy 7 authentication pre-sharefwsm/context_name(config)# isakmp policy 7 encryption 3desfwsm/context_name(config)# isakmp policy 7 hash md5fwsm/context_name(config)# isakmp policy 7 group 1fwsm/context_name(config)# vpngroup myVpnGroup address-pool vpnpoolfwsm/context_name(config)# vpngroup myVpnGroup dns-server 10.131.31.11fwsm/context_name(config)# vpngroup myVpnGroup wins-server 10.131.31.11fwsm/context_name(config)# vpngroup myVpnGroup default-domain example.comfwsm/context_name(config)# vpngroup myVpnGroup split-tunnel 90fwsm/context_name(config)# vpngroup myVpnGroup idle-time 1800fwsm/context_name(config)# vpngroup myVpnGroup max-time 86400fwsm/context_name(config)# vpngroup myVpnGroup password ********Related Commands
who
To display active Telnet administration sessions on the FWSM, use the who command.
who [local_ip]
show who [local_ip]
Syntax Description
local_ip
(Optional) Internal IP address to limit the listing to one IP address or to a network IP address.
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The who command allows you to display the FWSM TTY_ID and IP address of each Telnet client that is currently logged into the FWSM. This command is the same as the show who command.
Examples
This example shows how to display active Telnet administration sessions on the FWSM:
fwsm# who0: From 192.168.1.31: From 192.168.2.2Related Commands
write
To store, view, or erase the current configuration, use the write command.
write net [[tftp_ip]:[filename]]
write {erase | memory | terminal | standby}
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
Note
The standby keyword forces the configuration synchronization from the active to the standby module.
The write net command allows you to store the current configuration into a file on a TFTP server elsewhere in the network. The write net command allows you to use the TFTP server IP address that is specified in the tftp-server command. If you specify both the IP address and pathname in the tftp-server command, you can specify the write net:filename command as a colon ( : ) as follows:
fwsm(config)# write net :If you set a filename with the tftp-server command, do not specify it in the write command; instead, use a colon ( : ) without a filename. Many TFTP servers require the configuration file to be world-writable to write to it.
Use the configure net command to get the configuration from the file.
The write erase command clears the Flash partition configuration.
The write memory command saves the current running configuration to the Flash partition. Use the configure memory command to merge the current configuration with the image that you saved in the Flash partition.
The FWSM allows processing to continue during the write memory command.
If another FWSM console user tries to change the configuration while you are executing the write memory command, the user receives this message:
Another session is busy writing configuration to memoryPlease wait a moment for it to finishAfter the write memory command completes, the FWSM allows the other command to complete.
Note
The write terminal command displays the current configuration in the FWSM's RAM memory. You can also display the configuration that is stored in the Flash partition by using the show configure command.
Defaults
The default on the FWSM is to store all configurations in compressed format.
Examples
This example shows how to specify the TFTP server and create a file named new_config in which to store the configuration:
fwsm(config)# tftp-server 10.1.1.2 /fwsmfirewall/config/new_configwrite net :This example shows how to erase the contents of the Flash partition and reload the FWSM:
fwsm(config)# write eraseErase fwsm configuration in flash partition? [confirm] yfwsm(config)# reloadProceed with reload? [confirm] yThis example shows how to save the current configuration to the Flash partition:
fwsm(config)# write memoryBuilding configuration...[OK]This example shows how to display the configuration:
fwsm(config)# write terminalBuilding configuration...: SavedRelated Commands
write standby
To force the configuration synchronization from the active to the standby module, use the write standby command.
write standby
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
The write standby command allows you to write the configuration that is stored in RAM on the active failover module to the RAM on the standby module. When the primary module boots, it automatically writes the configuration to the secondary module. Enter the write standby command if the primary and secondary module configurations have different information.
Note
You can use this command in these modes:
•
•
•
You can also display the configuration that is stored in the Flash partition by using the show configure command.
Examples
This example shows how to force the configuration synchronization from the active to the standby module:
fwsm(config)# write standbyBuilding configuration...[OK]Related Commands
clear failover
configure
failover
failover interface ip
failover interface-policy
failover lan interface
failover lan unit
failover link
failover polltime
failover replication http
failover reset
monitor-interface
show failover
write standby
