-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 3.1
-
About This Guide
-
Using the Command Line Interface
-
aaa accounting through accounting-server-group
-
activation-key through auto-update timeout
-
backup-servers through bridge-group
-
cache-time through clear capture
-
clear configure through clear configure virtual
-
clear console-output through clear xlate
-
client-access-rule through crl-configure
-
crypto ca authenticate through crypto map set trustpoint
-
debug aaa through debug xdmcp
-
default through drop
-
email through ftp-map
-
gateway through http-map
-
icmp through ignore lsa mospf
-
inspect ctiqbe through inspect xdmcp
-
interface through issuer-name
-
join-failover-group through kill
-
ldap-base-dn through log-adj-changes
-
logging asdm through logout
-
mac-address-table aging-time through multicast-routing
-
name through ospf transmit-delay
-
pager through pwd
-
quit through router-id
-
same-security-traffic through show asdm sessions
-
show asp drop through show curpriv
-
show debug through show ipv6 traffic
-
show isakmp sa through show route
-
show running-config through show running-config isakmp
-
show running-config logging through show running-config vpn-sessiondb
-
show service-policy through show xlate
-
shun through sysopt uauth allow-http-cache
-
telnet through tunnel-limit
-
upgrade-mp through write terminal
-
Table Of Contents
show isakmp sa through show route Commands
show memory delayed-free-poisoner
show isakmp sa through show route Commands
show isakmp sa
To display the IKE runtime SA database, use the show isakmp sa command in global configuration mode or privileged EXEC mode.
show isakmp sa [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Usage Guidelines
The output from this command includes the following fields:
Detail not specified.
Table 27-2
IKE Peer
Type
Dir
Rky
State
Encrypt
Hash
Auth
Lifetime
209.165.200.225
L2L
Init
No
MM_Active
3des
md5
preshrd
86400
Detail specified.
Examples
The following example, entered in global configuration mode, displays detailed information about the SA database:
hostname(config)# show isakmp sa detailhostname(config)# sho isakmp sa detailIKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime1 209.165.200.225 User Resp No AM_Active 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime2 209.165.200.226 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime3 209.165.200.227 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime4 209.165.200.228 User Resp No AM_ACTIVE 3des SHA preshrd 86400hostname(config)#Related Commands
show isakmp stats
To display runtime statistics, use the show isakmp stats command in privileged EXEC mode.
show isakmp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp statsGlobal IKE StatisticsActive Tunnels: 132Previous Tunnels: 132In Octets: 195471In Packets: 1854In Drop Packets: 925In Notifys: 0In P2 Exchanges: 132In P2 Exchange Invalids: 0In P2 Exchange Rejects: 0In P2 Sa Delete Requests: 0Out Octets: 119029Out Packets: 796Out Drop Packets: 0Out Notifys: 264Out P2 Exchanges: 0Out P2 Exchange Invalids: 0Out P2 Exchange Rejects: 0Out P2 Sa Delete Requests: 0Initiator Tunnels: 0Initiator Fails: 0Responder Fails: 0System Capacity Fails: 0Auth Fails: 0Decrypt Fails: 0Hash Valid Fails: 0No Sa Fails: 0hostname(config)#Related Commands
show local-host
To display the IP addresses of hosts that initiated current connections through the FWSM, use the show local-host command in privileged EXEC mode. This command also shows the address translation, if present, and the number of TCP, UDP, and embryonic connections per host.
show local-host [ip_address] [detail] [all]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
In most cases, the "local host" is the initiating host. However, if you configure static NAT for an IP address, that host always shows as the local host even if they did not initiate the connection.
If you configure outside NAT (either static NAT or NAT exemption), and an inside host initiates a connection to the outside host, both the inside and outside hosts are listed as local hosts in the show local-host output. This feature lets you track connection limits for both hosts.
If you configure an embryonic connection limit, and the limit is exceeded, the FWSM implements TCP intercept to prevent a SYN attack. After TCP intercept is triggered, additional embryonic connections do not appear in the show local-host output.
The connection limits are set using the nat or static commands, or using the set connection commands.
Examples
The following examples show how to display the network states of local hosts:
hostname# show local-hostlocal host: <10.5.59.30>, tcp conn(s)/limit = 1/0, embryonic(s)/limit =0/0 udp conn(s)/limit = 0/0Xlate(s):Global 10.5.59.30 Local 10.5.59.30Table 27-3 shows each field description.
Related Commands
show logging
To show system log messages currently in the log buffer or to show other logging settings, use the show logging command in privileged EXEC mode.
show logging [message [syslog_id | all] | asdm | queue | setting]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
If the logging buffered command is in use, the show logging command without any keywords shows the current message buffer and the current settings.
The show logging queue command lets you to display the following:
•
•
•
Examples
The following is sample output from the show logging command:
hostname(config)# show loggingSyslog logging: enabledTimestamp logging: disabledConsole logging: disabledMonitor logging: disabledBuffer logging: level debugging, 37 messages loggedTrap logging: disabled305001: Portmapped translation built for gaddr 209.165.201.5/0 laddr 192.168.1.2/256...The following is sample output from the show logging message all command:
hostname(config)# show logging message allsyslog 111111: default-level alerts (enabled)syslog 101001: default-level alerts (enabled)syslog 101002: default-level alerts (enabled)syslog 101003: default-level alerts (enabled)syslog 101004: default-level alerts (enabled)syslog 101005: default-level alerts (enabled)syslog 102001: default-level alerts (enabled)syslog 103001: default-level alerts (enabled)syslog 103002: default-level alerts (enabled)syslog 103003: default-level alerts (enabled)syslog 103004: default-level alerts (enabled)syslog 103005: default-level alerts (enabled)syslog 103011: default-level alerts (enabled)syslog 103012: default-level informational (enabled)Related Commands
show mac-address-table
To show the MAC address table, use the show mac-address-table command in privileged EXEC mode.
show mac-address-table [interface_name | count | static]
Syntax Description
Defaults
If you do not specify an interface, all interface MAC address entries are shown.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show mac-address-table command:
hostname# show mac-address-tableinterface mac address type Time Left-----------------------------------------------------------------------outside 0009.7cbe.2100 static -inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table command for the inside interface:
hostname# show mac-address-table insideinterface mac address type Time Left-----------------------------------------------------------------------inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table count command:
hostname# show mac-address-table countStatic mac-address bridges (curr/max): 0/65535Dynamic mac-address bridges (curr/max): 103/65535Related Commands
show management-access
To display the name of the internal interface configured for management access, use the show management-access command in privileged EXEC mode.
show management-access
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The management-access command lets you define an internal management interface using the IP address of the firewall interface specified in mgmt_if. (The interface names are defined by the nameif command and displayed in quotes, " ", in the output of the show interface command.)
Examples
The following example shows how to configure a firewall interface named "inside" as the management access interface and display the result:
hostname(config)# management-access insidehostname(config)# show management-accessmanagement-access insideRelated Commands
show memory
To display a summary of the maximum physical memory and current free memory available to the operating system, use the show memory command in privileged EXEC mode.
show memory [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
The show memory command lets you display a summary of the maximum physical memory and current free memory available to the operating system. Memory is allocated as needed.
You can use the show memory detail output with show memory binsize command to debug memory leaks.
You can also display the information from the show memory command using SNMP.
Examples
The following example shows how to display a summary of the maximum physical memory and current free memory available:
hostname# show memoryFree memory: 845044716 bytes (79%)Used memory: 228697108 bytes (21%)------------- ----------------Total memory: 1073741824 bytes (100%)This example shows detailed memory output:
hostname# show memory detail Free memory: 15958088 bytes (24%) Used memory: Allocated memory in use: 29680332 bytes (44%) Reserved memory: 21470444 bytes (32%) ----------------------------- ---------------- Total memory: 67108864 bytes (100%) Least free memory: 4551716 bytes ( 7%) Most used memory: 62557148 bytes (93%) ----- fragmented memory statistics ----- fragment size count total (bytes) (bytes) ---------------- ---------- -------------- 16 8 128 24 4 96 32 2 64 40 5 200 64 3 192 88 1 88 168 1 168 224 1 224 256 1 256 296 2 592 392 1 392 400 1 400 1816 1 1816* 4435968 1 4435968** 11517504 1 11517504 * - top most releasable chunk. ** - contiguous memory on top of heap. ----- allocated memory statistics ----- fragment size count total (bytes) (bytes) ---------------- ---------- -------------- 40 50 2000 48 144 6912 56 24957 1397592 64 101 6464 72 99 7128 80 1032 82560 88 18 1584 96 64 6144 104 57 5928 112 6 672 120 112 13440 128 15 1920 136 87 11832 144 22 3168152 31 4712 160 90 14400 168 65 10920 176 74 13024 184 11 2024 192 8 1536 200 1 200 <output omitted>Related Commands
show memory binsize
To display summary information about the chunks allocated for a specific bin size, use the show memory binsize command in privileged EXEC mode.
show memory binsize size
Syntax Description
size
Displays chunks (memory blocks) of a specific bin size. The bin size is from the "fragment size" column of the show memory detail command output.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command has no usage guidelines.
Examples
The following example displays summary information about a chunk allocated to a bin size of 500:
hostname# show memory binsize 500pc = 0x00b33657, size = 460 , count = 1Related Commands
show memory delayed-free-poisoner
To display a summary of the memory delayed-free-poisoner queue usage, use the show memory delayed-free-poisoner command in privileged EXEC mode.
show memory delayed-free-poisoner
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Use the clear memory delayed-free-poisoner command to clear the queue and statistics.
Examples
This following is sample output from the show memory delayed-free-poisoner command:
hostname# show memory delayed-free-poisonerdelayed-free-poisoner statistics:3335600: memory held in queue6095: current queue count0: elements dequeued3: frees ignored by size1530: frees ignored by locking27: successful validate runs0: aborted validate runs01:09:36: local time of last validateTable 27-4 describes the significant fields in the show memory delayed-free-poisoner command output.
Related Commands
show memory profile
To display information about the memory usage (profiling) of the FWSM, use the show memory profile command in privileged EXEC mode.
show memory profile [peak] [detail | collated | status]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the show memory profile command to troubleshoot memory usage level and memory leaks. You can still see the profile buffer contents even if profiling has been stopped. Starting profiling clears the buffer automatically.
Note
The following example shows...
hostname# show memory profileRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 0The output of the show memory profile detail command (below) is divided into six data columns and one header column, at the far left. The address of the memory bucket corresponding to the first data column is given at the header column (the hexidecimal number). The data itself is the number of bytes that is held by the text/code that falls in the bucket address. A period (.) in the data column means no memory is held by the text at this bucket. Other columns in the row correspond to the bucket address that is greater than the increment amount from the previous column. For example, the address bucket of the first data column in the first row is 0x001069e0. The address bucket of the second data column in the first row is 0x001069e4 and so on. Normally the header column address is the next bucket address; that is, the address of the last data column of the previous row plus the increment. All rows without any usage are suppressed. More than one such contiguous row can be suppressed, indicated with three periods at the header column (...).
hostname# show memory profile detailRange: start = 0x00100020, end = 0x00e006e0, increment = 00000004 Total = 48941152 ... 0x001069e0 . 24462 . . . . ... 0x00106d88 . 1865870 . . . . ... 0x0010adf0 . 7788 . . . . ... 0x00113640 . . . . 433152 . ... 0x00116790 2480 . . . . . <snip>The following example shows collated output:
hostname# show memory profile collatedRange: start = 0x00100020, end = 0x00e006e0, increment = 00000004 Total = 48941152 24462 0x001069e4 1865870 0x00106d8c 7788 0x0010adf4 433152 0x00113650 2480 0x00116790 <snip>The following example shows the peak capture buffer:
hostname# show memory profile peakRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 102400The following example shows the peak capture buffer and the number of bytes held:
hostname# show memory profile peak detailRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 102400 ... 0x00404c8c . . 102400 . . .The following example shows the current state of memory profiling and the peak capture buffer:
hostname# show memory profile statusInUse profiling: ON Peak profiling: OFF Memory used by profile buffers: 11518860 bytes Profile: 0x00100020-0x00bfc3a8(00000004)Related Commands
show memory-caller address
To display the address ranges configured on the FWSM, use the show memory-caller address command in privileged EXEC mode.
show memory-caller address
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
You must first configure an address ranges with the memory caller-address command before you can display them with the show memory-caller address command.
Examples
The following examples show the address ranges configured with the memory caller-address commands, and the resulting display of the show memory-caller address command:hostname# memory caller-address 0x00109d5c 0x00109e08 hostname# memory caller-address 0x009b0ef0 0x009b0f14 hostname# memory caller-address 0x00cf211c 0x00cf4464<hostname# show memory-caller address
