-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 3.1
-
About This Guide
-
Using the Command Line Interface
-
aaa accounting through accounting-server-group
-
activation-key through auto-update timeout
-
backup-servers through bridge-group
-
cache-time through clear capture
-
clear configure through clear configure virtual
-
clear console-output through clear xlate
-
client-access-rule through crl-configure
-
crypto ca authenticate through crypto map set trustpoint
-
debug aaa through debug xdmcp
-
default through drop
-
email through ftp-map
-
gateway through http-map
-
icmp through ignore lsa mospf
-
inspect ctiqbe through inspect xdmcp
-
interface through issuer-name
-
join-failover-group through kill
-
ldap-base-dn through log-adj-changes
-
logging asdm through logout
-
mac-address-table aging-time through multicast-routing
-
name through ospf transmit-delay
-
pager through pwd
-
quit through router-id
-
same-security-traffic through show asdm sessions
-
show asp drop through show curpriv
-
show debug through show ipv6 traffic
-
show isakmp sa through show route
-
show running-config through show running-config isakmp
-
show running-config logging through show running-config vpn-sessiondb
-
show service-policy through show xlate
-
shun through sysopt uauth allow-http-cache
-
telnet through tunnel-limit
-
upgrade-mp through write terminal
-
Table Of Contents
show asp drop through show curpriv Commands
show asp table mac-address-table
show crypto accelerator statistics
show crypto ipsec fragmentation
show crypto protocol statistics
show asp drop through show curpriv Commands
show asp drop
To debug dropped packets or connections that take place in the control plane path, use the show asp drop command in privileged EXEC mode. This command only shows packet and flow drops for traffic that passes through the control plane path, including most inspected traffic, traffic destined directly to the FWSM, and all IPv6 traffic. Packets and flows that are processed and dropped in the FWSM hardware do not appear in the output.
show asp drop [flow drop_reason | frame drop_reason]
Syntax Description
flow
(Optional) Shows the dropped flows (connections).
frame
(Optional) Shows the dropped packets.
drop_reason
(Optional) Shows the flows or packets dropped by a particular process.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp drop command might help you troubleshoot a problem with the control plane. This information is used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp drop command:
hostname# show asp dropFrame drop:No route to host 600TCP packet SEQ past window 13TCP invalid ACK 2051TCP packet buffer full 15TCP DUP and has been ACKed 4206TCP packet failed PAWS test 32No inspect found 151Invalid connection address in delete indication 1465Flow drop:Related Commands
clear asp drop
Clears drop statistics for the accelerated security path.
show conn
Shows information about connections.
show asp table arp
To debug the accelerated security path ARP tables, use the show asp table arp command in privileged EXEC mode.
show asp table arp [interface interface_name] [address ip_address [netmask mask]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show arp command shows the contents of the control plane, while the show asp table arp command shows the contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table arp command:
hostname# show asp table arpContext: single_vf, Interface: inside10.86.194.50 Active 000f.66ce.5d46 hits 010.86.194.1 Active 00b0.64ea.91a2 hits 63810.86.194.172 Active 0001.03cf.9e79 hits 010.86.194.204 Active 000f.66ce.5d3c hits 010.86.194.188 Active 000f.904b.80d7 hits 0Context: single_vf, Interface: identity:: Active 0000.0000.0000 hits 00.0.0.0 Active 0000.0000.0000 hits 50208Related Commands
show asp table classify
To debug the accelerated security path classifier tables, use the show asp table classify command in privileged EXEC mode. The classifier examines properties of incoming packets, such as protocol, and source and destination address, to match each packet to an appropriate classification rule. Each rule is labeled with a classification domain that determines what types of actions are performed, such as dropping a packet or allowing it through.
show asp table classify [crypto | domain domain_name | interface interface_name]
Syntax Description
domain domain_name
(Optional) Shows entries for a specific classifier domain. See "Usage Guidelines" for a list of domains.
interface interface_name
(Optional) Identifies a specific interface for which you want to view the classifier table.
crypto
(Optional) Shows the encrypt, decrypt, and ipsec tunnel flow domains only.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table classifier command shows the classifier contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Classifier domains include the following:
aaa-acctaaa-authaaa-useraccountingarpcapturecaptureconn-nailedconn-setctcpdecryptencryptestablishedfilter-activexfilter-ftpfilter-httpsfilter-javafilter-urlhostinspectinspect-ctiqbeinspect-dnsinspect-dns-idsinspect-ftpinspect-ftp-datainspect-gtpinspect-h323inspect-httpinspect-icmpinspect-icmp-errorinspect-ilsinspect-mgcpinspect-netbiosinspect-pptpinspect-rshinspect-rtspinspect-sipinspect-skinnyinspect-smtpinspect-snmpinspect-sqlnetinspect-sqlnet-plusinspect-sunrpcinspect-tftpinspect-xdmcpipsec-nattipsec-tunnel-flowipsec-userlimitslumac-permitmgmt-lockdownmgmt-tcp-interceptmulticastnatnat-exemptnat-exempt-reversenat-reversenullpermitpermit-ip-optionpermit-logpimppppuntpunt-l2punt-rootshuntcp-interceptExamples
The following is sample output from the show asp table classify command:
hostname# show asp table classifyInterface test:in id=0x36f3800, priority=10, domain=punt, deny=falsehits=0, user_data=0x0, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=10.86.194.60, mask=255.255.255.255, port=0in id=0x33d3508, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=0.0.0.0, mask=0.0.0.0, port=0in id=0x33d3978, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=53dst ip=0.0.0.0, mask=0.0.0.0, port=0...Related Commands
show asp table interfaces
To debug the accelerated security path interface tables, use the show asp table interfaces command in privileged EXEC mode.
show asp table interfaces
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table interfaces command shows the interface table contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table interfaces command:
hostname# show asp table interfaces** Flags: 0x0001-DHCP, 0x0002-VMAC, 0x0010-Ident Ifc, 0x0020-HDB Initd,0x0040-RPF EnabledSoft-np interface 'dmz' is upcontext single_vf, nicnum 0, mtu 1500vlan 300, Not shared, seclvl 500 packets input, 1 packets outputflags 0x20Soft-np interface 'foo' is downcontext single_vf, nicnum 2, mtu 1500vlan 301, Not shared, seclvl 00 packets input, 0 packets outputflags 0x20Soft-np interface 'outside' is downcontext single_vf, nicnum 1, mtu 1500vlan 302, Not shared, seclvl 500 packets input, 0 packets outputflags 0x20Soft-np interface 'inside' is upcontext single_vf, nicnum 0, mtu 1500vlan 303, Not shared, seclvl 100680277 packets input, 92501 packets outputflags 0x20...Related Commands
interface
Configures an interface and enters interface configuration mode.
show interface
Displays the runtime status and statistics of interfaces.
show asp table mac-address-table
To debug the accelerated security path MAC address tables, use the show asp table mac-address-table command in privileged EXEC mode.
show asp table mac-address-table [interface interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
•
Command History
Usage Guidelines
The show asp table mac-address-table command shows the MAC address table contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table mac-address-table command:
hostname# show asp table mac-address-tableinterface mac address flags--------------------------------------------------------inside1 0009.b74d.3800 Noneinside1 0007.e903.ad6e Noneinside1 0007.e950.2067 Noneinside1 0050.0499.3749 Noneinside1 0012.d96f.e200 Noneinside1 0001.02a7.f4ec Noneinside1 0001.032c.6477 Noneinside1 0004.5a2d.a1c8 Noneinside1 0003.4773.c87b Noneinside1 000d.88ef.5d1c Noneinside1 00c0.b766.adce Noneinside1 0050.5640.450d Noneinside1 0001.03cf.0431 None...Related Commands
show mac-address-table
Shows the MAC address table, including dynamic and static entries.
show asp table routing
To debug the accelerated security path routing tables, use the show asp table routing command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show asp table routing [input | output] [address ip_address [netmask mask] | interface interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table routing command shows the routing table contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table routing command:
hostname# show asp table routingin 255.255.255.255 255.255.255.255 identityin 224.0.0.9 255.255.255.255 identityin 10.86.194.60 255.255.255.255 identityin 10.86.195.255 255.255.255.255 identityin 10.86.194.0 255.255.255.255 identityin 209.165.202.159 255.255.255.255 identityin 209.165.202.255 255.255.255.255 identityin 209.165.201.30 255.255.255.255 identityin 209.165.201.0 255.255.255.255 identityin 10.86.194.0 255.255.254.0 insidein 224.0.0.0 240.0.0.0 identityin 0.0.0.0 0.0.0.0 insideout 255.255.255.255 255.255.255.255 fooout 224.0.0.0 240.0.0.0 fooout 255.255.255.255 255.255.255.255 testout 224.0.0.0 240.0.0.0 testout 255.255.255.255 255.255.255.255 insideout 10.86.194.0 255.255.254.0 insideout 224.0.0.0 240.0.0.0 insideout 0.0.0.0 0.0.0.0 via 10.86.194.1, insideout 0.0.0.0 0.0.0.0 via 0.0.0.0, identityout :: :: via 0.0.0.0, identityRelated Commands
show asp table vpn-context
To debug the accelerated security path VPN context tables, use the show asp table vpn-context command in privileged EXEC mode.
show asp table vpn-context [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table vpn-context command shows the VPN context contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table vpn-context command:
hostname# show asp table vpn-contextVPN ID=0058070576, DECR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058193920, ENCR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058168568, DECR+ESP, UP, pk=0000299627, rk=0000000061, gc=2VPN ID=0058161168, ENCR+ESP, UP, pk=0000305043, rk=0000000061, gc=1VPN ID=0058153728, DECR+ESP, UP, pk=0000271432, rk=0000000061, gc=2VPN ID=0058150440, ENCR+ESP, UP, pk=0000285328, rk=0000000061, gc=1VPN ID=0058102088, DECR+ESP, UP, pk=0000268550, rk=0000000061, gc=2VPN ID=0058134088, ENCR+ESP, UP, pk=0000274673, rk=0000000061, gc=1VPN ID=0058103216, DECR+ESP, UP, pk=0000252854, rk=0000000061, gc=2...The following is sample output from the show asp table vpn-context detail command:
hostname# show asp table vpn-context detailVPN Ctx = 0058070576 [0x03761630]State = UPFlags = DECR+ESPSA = 0x037928F0SPI = 0xEA0F21F0Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0VPN Ctx = 0058193920 [0x0377F800]State = UPFlags = ENCR+ESPSA = 0x037B4B70SPI = 0x900FDC32Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0...Related Commands
show asr
To display the members of ASR groups, use the show asr command in privileged EXEC mode.
show asr {group_id | all}
Syntax Description
group_id
Displays the VLANs that are members of the specified ASR group. Valid values are 1 through 32.
all
Displays the membership for all 32 ASR groups.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
An ASR group can contain up to 8 members. A "0" (zero) in the output indicates an empty slot.
The show asr command provides the same output as the show np asr command.
Examples
The following is sample output from the show asr command. It limits the display to VLANs that are members of ASR group 1.
hostname# sh asr 1ASR Group | Vlan Entries in ASR Group (0 denotes empty slot)----------|----------------------------------------------------1 | 10 20 0 0 0 0 0 0The following is sample output from the show asr command. It displays VLAN membership for all possible ASR groups. In this example, only ASR group 1 has member VLANs.
hostname# sh asr allASR Group | Vlan Entries in ASR Group (0 denotes empty slot)----------|----------------------------------------------------1 | 10 20 0 0 0 0 0 02 | 0 0 0 0 0 0 0 03 | 0 0 0 0 0 0 0 04 | 0 0 0 0 0 0 0 05 | 0 0 0 0 0 0 0 06 | 0 0 0 0 0 0 0 07 | 0 0 0 0 0 0 0 08 | 0 0 0 0 0 0 0 09 | 0 0 0 0 0 0 0 010 | 0 0 0 0 0 0 0 011 | 0 0 0 0 0 0 0 012 | 0 0 0 0 0 0 0 013 | 0 0 0 0 0 0 0 014 | 0 0 0 0 0 0 0 015 | 0 0 0 0 0 0 0 016 | 0 0 0 0 0 0 0 017 | 0 0 0 0 0 0 0 018 | 0 0 0 0 0 0 0 019 | 0 0 0 0 0 0 0 020 | 0 0 0 0 0 0 0 021 | 0 0 0 0 0 0 0 022 | 0 0 0 0 0 0 0 023 | 0 0 0 0 0 0 0 024 | 0 0 0 0 0 0 0 025 | 0 0 0 0 0 0 0 026 | 0 0 0 0 0 0 0 027 | 0 0 0 0 0 0 0 028 | 0 0 0 0 0 0 0 029 | 0 0 0 0 0 0 0 030 | 0 0 0 0 0 0 0 031 | 0 0 0 0 0 0 0 032 | 0 0 0 0 0 0 0 0Related Commands
show auto-update
To view the Auto Update Server configfuration, use the show auto-update command in privileged EXEC mode.
show auto-update
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following is sample output from the show auto-update command:
hostname# show arp-inspectionPoll period: 1 minutes, retry count: 1, retry period: 5 minutesTimeout: noneDevice ID: host name [farscape]Related Commands
show blocks
To show the packet buffer utilization, use the show blocks command in privileged EXEC mode.
show blocks [{address hex | all | assigned | free | old | pool size [summary]} [diagnostics | dump | header | packet] | queue history [detail]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show blocks command helps you determine if the FWSM is overloaded. This command lists preallocated system buffer utilization. A full memory condition is not a problem as long as traffic is moving through the FWSM. You can use the show conn command to see if traffic is moving. If traffic is not moving and the memory is full, there may be a problem.
You can also view this information using SNMP.
The information shown in a security context includes the system-wide information as well as context-specific information about the blocks in use and the high water mark for block usage.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show blocks command in single mode:
hostname# show blocksSIZE MAX LOW CNT4 1600 1598 159980 400 398 399256 3600 3540 35421550 4716 3177 318416384 10 10 102048 1000 1000 1000Table 3 shows each field description.
The following is sample output from the show blocks all command:
hostname# show blocks allClass 0, size 4Block allocd_by freed_by data size alloccnt dup_cnt oper location0x01799940 0x00000000 0x00101603 0 0 0 alloc not_specified0x01798e80 0x00000000 0x00101603 0 0 0 alloc not_specified0x017983c0 0x00000000 0x00101603 0 0 0 alloc not_specified...Found 1000 of 1000 blocksDisplaying 1000 of 1000 blocksTable 4 shows each field description.
The following is sample output from the show blocks command in a context:
hostname/contexta# show blocksSIZE MAX LOW CNT INUSE HIGH