Table Of Contents

shun through sysopt uauth allow-http-cache Commands

shun

shutdown

sip-map

smtp-server

snmp-map

snmp-server community

snmp-server contact

snmp-server enable

snmp-server enable traps

snmp-server host

snmp-server listen-port

snmp-server location

split-dns

split-tunnel-network-list

split-tunnel-policy

ssh

ssh disconnect

ssh scopy enable

ssh timeout

ssh version

ssl server-version

static

strict-http

strip-group

strip-realm

subject-name (crypto ca certificate map)

subject-name (crypto ca trustpoint)

summary-address

sunrpc-server

support-user-cert-validation

sysopt connection tcpmss

sysopt nodnsalias

sysopt noproxyarp

sysopt radius ignore-secret

sysopt uauth allow-http-cache

shun through sysopt uauth allow-http-cache Commands

---

shun

To block connections from an attacking host, use the shun command in privileged EXEC mode. To disable a shun, use the no form of this command.

shun src_ip [dst_ip src_port dest_port [protocol]] [vlan vlan_id]

no shun src_ip [vlan vlan_id]

Syntax Description

dest_port	(Optional) Specifies the destination port of the connection causing the shun.
dst_ip	(Optional) Specifies the address of the target host.
protocol	(Optional) Specifies the IP protocol, such as UDP or TCP. By default, the protocol is 0 (any protocol).
src_ip	Specifies the address of the attacking host.
src_port	(Optional) Specifies the source port of the connection causing the shun.
vlan_id	(Optional) Specifies the VLAN ID.

Defaults

The default protocol is 0 (any protocol).

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Privileged EXEC	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Usage Guidelines

The shun command lets you block connections from an attacking host. Packets matching the values in the command are dropped and logged until the blocking function is removed manually or by the Cisco IPS sensor. The blocking function of the shun command is applied whether or not a connection with the specified host address is currently active.

If you specify the destination address, source and destination ports, and the protocol, then you narrow the shun to connections that match those parameters.

You can only have one shun command per source IP address.

Because the shun command is used to block attacks dynamically, it is not displayed in the FWSM configuration.

Whenever an interface is removed, all shuns that are attached to that interface are also removed. If you add a new interface or replace the same interface (using the same name), then you must add that interface to the IPS sensor if you want the IPS sensor to monitor that interface.

Examples

The following example shows that the offending host (10.1.1.27) makes a connection with the victim (10.2.2.89) with TCP. The connection in the FWSM connection table reads as follows:

10.1.1.27, 555-> 10.2.2.89, 666 PROT TCP

Apply the shun command using the following options:

hostname# shun 10.1.1.27 10.2.2.89 555 666 tcp

The command deletes the connection from the FWSM connection table and also prevents packets from 10.1.1.27:555 to 10.2.2.89:666 (TCP) from going through the FWSM.

Related Commands

Command	Description
clear shun	Disables all the shuns that are currently enabled and clears the shun statistics.
show conn	Shows all active connections.
show shun	Displays the shun information.

shutdown

To disable an interface, use the shutdown command in interface configuration mode. To enable an interface, use the no form of this command.

shutdown

no shutdown

Syntax Description

This command has no arguments or keywords.

Defaults

All physical interfaces are shut down by default. Allocated interfaces in security contexts are not shut down in the configuration.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Interface configuration	•	•	•	•	•

Command History

Release	Modification
2.2(1)	This command was introduced.

Usage Guidelines

By default, all physical interfaces are shut down. You must enable the physical interface before any traffic can pass through an enabled subinterface. For multiple context mode, if you allocate a physical interface or subinterface to a context, the interfaces are enabled by default in the context. However, before traffic can pass through the context interface, you must also enable the interface in the system configuration. If you shut down an interface in the system execution space, then that interface is down in all contexts that share it.

Examples

The following example enables a subinterface:

hostname(config)# interface gigabitethernet2.1

hostname(config-subif)# vlan 101

hostname(config-subif)# nameif dmz1

hostname(config-subif)# security-level 50

hostname(config-subif)# ip address 10.1.2.1 255.255.255.0

hostname(config-subif)# no shutdown

The following example shuts down the subinterface:

hostname(config)# interface gigabitethernet2.1

hostname(config-subif)# vlan 101

hostname(config-subif)# nameif dmz1

hostname(config-subif)# security-level 50

hostname(config-subif)# ip address 10.1.2.1 255.255.255.0

hostname(config-subif)# shutdown

Related Commands

Command	Description
clear xlate	Resets all translations for existing connections, causing the connections to be reset.
interface	Configures an interface and enters interface configuration mode.

sip-map

To identify a SIP application inspection map, which is required to enable the IP Address Privacy feature, use the sip-map command in global configuration mode. To remove the map, use the no form of this command.

sip-map map_name

no sip-map map_name

Syntax Description

map_name

The name of the SIP map.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
FWSM 3.1	This command was introduced.

Usage Guidelines

Use the sip-map command to identify a SIP application inspection map, which is required to enable the IP Address Privacy feature. When you enter this command, the system enters the SIP map configuration mode, which lets you enter the ip-address-privacy command. After defining the SIP map, you use the inspect sip command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.

Examples

The following example shows how to identify SIP traffic, define a SIP map, define a policy, and apply the policy to the outside interface.

hostname(config)# access-list sip-acl permit tcp any any eq 5060 

hostname(config)# class-map sip-port 

hostname(config-cmap)# match access-list sip-acl

hostname(config-cmap)# sip-map inbound_sip

hostname(config-sip-map)# ip-address-privacy

hostname(config-sip-map)# policy-map S1_policy 

hostname(config-pmap)# class sip-port

hostname(config-pmap-c)# inspect sip s1_policy 

hostname(config)#

Related Commands

Commands	Description
class-map	Defines the traffic class to which to apply security actions.
ip-address-privacy	Enables the IP Address Privacy feature for SIP application inspection.
inspect sip	Enables SIP application inspection.
policy-map	Associates a class map with specific security actions.

smtp-server

To configure an SMTP server, use the smtp-server command in global configuration mode. To remove the attribute from the configuration, use the no version of this command.

The FWSM includes an internal SMTP client that the Events system can use to notify external entities that a certain event has occurred. You can configure SMTP servers to receive these event notices, and then forward them to specified e-mail addresses. The SMTP facility is active only when you enable E-mail events an the FWSM.

smtp-server {primary_server} [backup_server]

no smtp-server

Syntax Description

primary_server	Identifies the primary SMTP server. Use either an IP address or DNS name
backup_server	Identifies a backup SMTP server to relay event messages in the event the primary SMTP server is unavailable. Use either an IP address or DNS name.

Defaults

No SMTP server is configured by default.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	—	—	•

Command History

Release	Modification
3.1(1)	Support for this command was introduced.

Usage Guidelines

Examples

The following example shows how to set an SMTP server with an IP address of 10.1.1.24, and a backup SMTP server with an IP address of 10.1.1.34:

hostname(config)# smtp-server 10.1.1.24 10.1.1.34

snmp-map

To identify a specific map for defining the parameters for SNMP inspection, use the snmp-map command in global configuration mode. To remove the map, use the no form of this command.

snmp-map map_name

no snmp-map map_name

Syntax Description

map_name

The name of the SNMP map.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
3.1(1)	This command was introduced.

Usage Guidelines

Use the snmp-map command to identify a specific map to use for defining the parameters for SNMP inspection. When you enter this command, the system enters the SNMP map configuration mode, which lets you enter the different commands used for defining the specific map. After defining the SNMP map, you use the inspect snmp command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.

Examples

The following example shows how to identify SNMP traffic, define a SNMP map, define a policy, and apply the policy to the outside interface.

hostname(config)# access-list snmp-acl permit tcp any any eq 161 

hostname(config)# access-list snmp-acl permit tcp any any eq 162

hostname(config)# class-map snmp-port 

hostname(config-cmap)# match access-list snmp-acl

hostname(config-cmap)# exit

hostname(config)# snmp-map inbound_snmp

hostname(config-snmp-map)# deny version 1

hostname(config-snmp-map)# exit

hostname(config)# policy-map inbound_policy 

hostname(config-pmap)# class snmp-port

hostname(config-pmap-c)# inspect snmp inbound_snmp 

hostname(config-pmap-c)# exit

Related Commands

Commands	Description
class-map	Defines the traffic class to which to apply security actions.
deny version	Disallows traffic using a specific version of SNMP.
inspect snmp	Enable SNMP application inspection.
policy-map	Associates a class map with specific security actions.

snmp-server community

To set the SNMP community string, use the snmp-server community command in global configuration mode. To remove the community string, use the no form of this command.

snmp-server community text

no snmp-server community [text]

Syntax Description

text	Sets the community string.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Usage Guidelines

The SNMP community string is a shared secret among the SNMP management station and the network nodes being managed. The FWSM uses the key to determine if the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the routers, FWSM, and the management station with this same string. The FWSM uses this string and does not respond to requests with an invalid community string.

Examples

The following example sets the community string to wallawallabingbang:

hostname(config)# snmp-server community wallawallabingbang

Related Commands

Command	Description
snmp-server contact	Sets the SNMP contact name.
snmp-server enable	Enables SNMP on the FWSM.
snmp-server enable traps	Enables SNMP traps.
snmp-server host	Sets the SNMP host address.
snmp-server location	Sets the SNMP server location string.

snmp-server contact

To set the SNMP contact name, use the snmp-server contact command in global configuration mode. To remove the contact name, use the no form of this command.

snmp-server contact text

no snmp-server contact [text]

Syntax Description

text	Specifies the name of the contact person or the FWSM system administrator. The name is case sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Examples

The following example sets the contact as Pat Johnson:

hostname(config)# snmp-server contact Pat Johnson

Related Commands

Command	Description
snmp-server community	Sets the SNMP community string.
snmp-server enable	Enables SNMP on the FWSM.
snmp-server enable traps	Enables SNMP traps.
snmp-server host	Sets the SNMP host address.
snmp-server location	Sets the SNMP server location string.

snmp-server enable

To enable the SNMP server on the FWSM, use the snmp-server enable command in global configuration mode. To disable SNMP, use the no form of this command.

snmp-server enable

no snmp-server enable

Syntax Description

This command has no arguments or keywords.

Defaults

By default, the SNMP server is enabled.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
3.1(1)	This command was introduced.

Usage Guidelines

This command lets you enable and disable SNMP easily, without having to configure and reconfigure the SNMP traps or other configuration.

Examples

The following example enables SNMP, configures the SNMP host and traps, and then sends traps as system messages.

hostname(config)# snmp-server enable

hostname(config)# snmp-server community wallawallabingbang

hostname(config)# snmp-server location Building 42, Sector 54

hostname(config)# snmp-server contact Sherlock Holmes

hostname(config)# snmp-server host perimeter 10.1.2.42

hostname(config)# snmp-server enable traps all

hostname(config)# logging history 7

hostname(config)# logging enable

Related Commands

Command	Description
snmp-server community	Sets the SNMP community string.
snmp-server contact	Sets the SNMP contact name.
snmp-server enable traps	Enables SNMP traps.
snmp-server host	Sets the SNMP host address.
snmp-server location	Sets the SNMP server location string.

snmp-server enable traps

To enable the FWSM to send traps to the NMS, use the snmp-server enable traps command in global configuration mode. To disable traps, use the no form of this command.

snmp-server enable traps [all | syslog | snmp [trap] [...] | entity [trap] [...] | ipsec [trap] [...] | remote-access [trap]]

no snmp-server enable traps [all | syslog | snmp [trap] [...] | entity [trap] [...] | ipsec [trap] [...] | remote-access [trap]]

Syntax Description

all	Enables all traps.
entity [trap]	Enables entity traps. Traps for entity include: •config-change •fru-insert •fru-remove
ipsec [trap]	Enables IPSec traps. Traps for ipsec include: •start •stop
remote-access [trap]	Enables remote access traps. Traps for remote-access include: •session-threshold-exceeded
snmp [trap]	Enables SNMP traps. By default, all SNMP traps are enabled. Traps for snmp include: •authentication •linkup •linkdown •coldstart
syslog	Enables syslog traps.

Defaults

The default configuration has all snmp traps enabled (snmp-server enable traps snmp authentication linkup linkdown coldstart). You can disable these traps using the no form of this command with the snmp keyword. However, the clear configure snmp-server command restores the default enabling of SNMP traps.

If you enter this command and do not specify a trap type, then the default is syslog. (The default snmp traps continue to be enabled along with the syslog trap.)

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Usage Guidelines

Enter this command for each feature type to enable individual traps or sets of traps, or enter the all keyword to enable all traps.

To send traps to the NMS, enter the logging history command, and enable logging using the logging enable command.

Examples

The following example enables SNMP, configures the SNMP host and traps, and then sends traps as system messages.

hostname(config)# snmp-server enable

hostname(config)# snmp-server community wallawallabingbang

hostname(config)# snmp-server location Building 42, Sector 54

hostname(config)# snmp-server contact Sherlock Holmes

hostname(config)# snmp-server host perimeter 10.1.2.42

hostname(config)# snmp-server enable traps all

hostname(config)# logging history 7

hostname(config)# logging enable

Related Commands

Command	Description
snmp-server community	Sets the SNMP community string.
snmp-server contact	Sets the SNMP contact name.
snmp-server enable	Enables SNMP on the FWSM.
snmp-server host	Sets the SNMP host address.
snmp-server location	Sets the SNMP server location string.

snmp-server host

To specify the NMS that can use SNMP on the FWSM, use the snmp-server host command in global configuration mode. To disable the NSM, use the no form of this command.

snmp-server host interface_name ip_address [trap | poll] [community text] [version {1 | 2c}] [udp-port port]

no snmp-server host interface_name ip_address [trap | poll] [community text] [version {1 | 2c}] [udp-port port]

Syntax Description

community text	Sets the community string for this NMS.
host	Specifies an IP address of the NMS to which traps should be sent or from which SNMP requests come.
interface_name	Specifies the interface name through which the NMS communicates with the FWSM.
ip_address	Specifies the IP address of an NMS to which SNMP traps should be sent or from which the SNMP requests come.
trap	(Optional) Specifies that only traps are sent, and that this host is not allowed to browse (poll).
poll	(Optional) Specifies that this host is allowed to browse (poll), but no traps are sent.
udp-port udp_port	(Optional) Sets the UDP port to which notifications are sent. SNMP traps are sent on UDP port 162 by default.
version {1 | 2c}	(Optional) Sets the SNMP notification version to version 1 or 2c.

Defaults

The default UDP port is 162.

The default version is 1.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Usage Guidelines

You can specify up to 32 NMSs.

Examples

The following example sets the host to 10.1.2.42 attached to the perimeter interface:

hostname(config)# snmp-server host perimeter 10.1.2.42

Related Commands

Command	Description
snmp-server community	Sets the SNMP community string.
snmp-server contact	Sets the SNMP contact name.
snmp-server enable	Enables SNMP on the FWSM.
snmp-server enable traps	Enables SNMP traps.
snmp-server location	Sets the SNMP server location string.

snmp-server listen-port

To set the listen port for SNMP requests, use the snmp-server listen-port command in global configuration mode. To restore the default port, use the no form of the command.

snmp-server listen-port lport

no snmp-server listen-port lport

Syntax Description

lport

The port on which incoming requests will be accepted. The default port is 161.

Defaults

The default port is 161.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Privileged EXEC	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Examples

The following example sets the listen port to 192:

hostname(config)# snmp-server listen-port 192

Related Commands

Command	Description
snmp-server community	Sets the SNMP community string.
snmp-server contact	Sets the SNMP contact name.
snmp-server enable	Enables SNMP on the FWSM.
snmp-server enable traps	Enables SNMP traps.
snmp-server location	Sets the SNMP server location string.

snmp-server location

To set the FWSM location for SNMP, use the snmp-server location command in global configuration mode. To remove the location, use the no form of this command.

snmp-server location text

no snmp-server location [text]

Syntax Description

location text

Specifies the security appliance location. The location text is case sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.

Defaults

No default behavior or values.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Global configuration	•	•	•	•	—

Command History

Release	Modification
1.1(1)	This command was introduced.

Examples

The following example sets the location as Building 42, Sector 54:

hostname(config)# snmp-server location Building 42, Sector 54

Related Commands

Command	Description
snmp-server community	Sets the SNMP community string.
snmp-server contact	Sets the SNMP contact name.
snmp-server enable	Enables SNMP on the FWSM.
snmp-server enable traps	Enables SNMP traps.
snmp-server host	Sets the SNMP host address.

split-dns

To enter a list of domains to be resolved through the split tunnel, use the split-dns command in group-policy configuration mode. To delete a list, use the no form of this command.

split-dns {value domain-name1 domain-name2 domain-nameN | none}

no split-dns [domain-name domain-name2 domain-nameN]

Syntax Description

value domain-name	Provides a domain name that the FWSM resolves through the split tunnel.
none	Indicates that there is no split DNS list. Sets a split DNS list with a null value, thereby disallowing a split DNS list. Prevents inheriting a split DNS list from a default or specified group policy.

Defaults

Split DNS is disabled.

Command Modes

The following table shows the modes in which you can enter the command:

Command Mode	Firewall Mode		Security Context
	Routed	Transparent	Single	Multiple
				Context	System
Group policy	•	—	•	—	—

Command History

Release	Modification
3.1(1)	This command was introduced.

Usage Guidelines

Use a single space to separate each entry in the list of domains. There is no limit on the number of entries, but the entire string can be no longer than 255 characters. You can use only alphanumeric characters, hyphens (-), and periods (.).

To delete all split tunneling domain lists, use the no split-dns command without arguments. This deletes all configured split tunneling domain lists, including a null list created by issuing the split-dns none command.

When there are no split tunneling domain lists, users inherit any that exist in the default group policy. To prevent users from inheriting such split tunneling domain lists, use the split-dns none command.

Examples

The following example shows how to configure the domains Domain1, Domain2, Domain3 and Domain4 to be resolved through split tunneling for the group policy named FirstGroup:

hostname(config)# group-policy FirstGroup attributes

hostname(config-group-policy)# split-dns value Domain1 Domain2 Domain3 Domain4

Related Commands

Command	Description
default-domain	Specifies a default domain name that he IPSec client uses the for DNS queries that omit the domain field.
spli