-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 3.1
-
About This Guide
-
Using the Command Line Interface
-
aaa accounting through accounting-server-group
-
activation-key through auto-update timeout
-
backup-servers through bridge-group
-
cache-time through clear capture
-
clear configure through clear configure virtual
-
clear console-output through clear xlate
-
client-access-rule through crl-configure
-
crypto ca authenticate through crypto map set trustpoint
-
debug aaa through debug xdmcp
-
default through drop
-
email through ftp-map
-
gateway through http-map
-
icmp through ignore lsa mospf
-
inspect ctiqbe through inspect xdmcp
-
interface through issuer-name
-
join-failover-group through kill
-
ldap-base-dn through log-adj-changes
-
logging asdm through logout
-
mac-address-table aging-time through multicast-routing
-
name through ospf transmit-delay
-
pager through pwd
-
quit through router-id
-
same-security-traffic through show asdm sessions
-
show asp drop through show curpriv
-
show debug through show ipv6 traffic
-
show isakmp sa through show route
-
show running-config through show running-config isakmp
-
show running-config logging through show running-config vpn-sessiondb
-
show service-policy through show xlate
-
shun through sysopt uauth allow-http-cache
-
telnet through tunnel-limit
-
upgrade-mp through write terminal
-
Table Of Contents
telnet through tunnel-limit Commands
tunnel-group general-attributes
tunnel-group-map default-group
telnet through tunnel-limit Commands
telnet
To add Telnet access to the console and set the idle timeout, use the telnet command in global configuration mode. To remove Telnet access from a previously set IP address, use the no form of
this command.telnet {{hostname | IP_address mask interface_name} | {IPv6_address interface_name} | {timeout number}}
no telnet {{hostname | IP_address mask interface_name} | {IPv6_address interface_name} | {timeout number}}
Syntax Description
Defaults
By default, Telnet sessions left idle for five minutes are closed by the FWSM.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
3.1(1)
The variable IPv6_address was added. The no telnet timeout command was added.
Usage Guidelines
The telnet command lets you specify which hosts can access the FWSM console with Telnet. You can enable Telnet to the FWSM on all interfaces. However, the FWSM enforces that all Telnet traffic to the outside interface be protected by IPSec. To enable a Telnet session to the outside interface, configure IPSec on the outside interface to include IP traffic that is generated by the FWSM and enable Telnet on the outside interface.
Use the no telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout command to set the maximum time that a console Telnet session can be idle before being logged off by the FWSM. You cannot use the no telnet command with the telnet timeout command.
If you enter an IP address, you must also enter a netmask. There is no default netmask. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address. To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255.
If IPSec is operating, you can specify an unsecure interface name, which is typically, the outside interface. At a minimum, you might configure the crypto map command to specify an interface name with the telnet command.
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the FWSM console. Use the kill command to terminate an active Telnet console session.
If you use the aaa command with the console keyword, Telnet console access must be authenticated with an authentication server.
Note
Examples
This example shows how to permit hosts 192.168.1.3 and 192.168.1.4 to access the FWSM console through Telnet. In addition, all the hosts on the 192.168.2.0 network are given access.
hostname(config)# telnet 192.168.1.3 255.255.255.255 insidehostname(config)# telnet 192.168.1.4 255.255.255.255 insidehostname(config)# telnet 192.168.2.0 255.255.255.0 insidehostname(config)# show running-config telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideThis example shows how to change the maximum session idle duration:
hostname(config)# telnet timeout 10hostname(config)# show running-config telnet timeouttelnet timeout 10 minutesThis example shows a Telnet console login session (the password does not display when entered):
hostname# passwd: ciscoWelcome to the XXX...Type help or `?' for a list of available commands.hostname>You can remove individual entries with the no telnet command or all telnet command statements with the clear configure telnet command:
hostname(config)# no telnet 192.168.1.3 255.255.255.255 insidehostname(config)# show running-config telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insidehostname(config)# clear configure telnetRelated Commandsshow telnet
terminal
To allow system log messages to show in the current Telnet session, use the terminal monitor command in privileged EXEC mode. To disable system log messages, use the terminal no monitor command.
terminal {monitor | no monitor}
Syntax Description
monitor
Enables the display of system log messages on the current Telnet session.
no monitor
Disables the display of system log messages on the current Telnet session.
Defaults
System log messages are disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
This example shows how to enable logging and then disable logging only in the current session:
hostname# terminal monitorhostname# terminal no monitorRelated Commands
terminal pager
To set the number of lines on a page before the "---more---" prompt appears for Telnet sessions, use the terminal pager command in privileged EXEC mode.
terminal pager [lines] lines
Syntax Description
Defaults
The default is 24 lines.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
3.1(1)
This command was changed from the pager command; the pager command is now a global configuration mode command.
Usage Guidelines
This command changes the pager line setting only for the current Telnet session. To save a new default pager setting to the configuration, use the pager command.
If you Telnet to the admin context or session to the system execution space, then the pager line setting follows your session when you change to other contexts, even if the pager command in a given context has a different setting. To change the current pager setting, enter the terminal pager command with a new setting, or you can enter the pager command in the current context. In addition to saving a new pager setting to the context configuration, the pager command applies the new setting to the current Telnet session.
Examples
The following example changes the number of lines displayed to 20:
hostname# terminal pager 20Related Commands
terminal width
To set the width for displaying information during console sessions, use the terminal width command in global configuration mode. To disable, use the no form of this command.
terminal width columns
no terminal width columns
Syntax Description
Defaults
The default display width is 80 columns.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Examples
This example shows how to terminal display width to 100 columns:
hostname# terminal width 100Related Commands
test aaa-server
To check whether the FWSM can authenticate or authorize users with a particular AAA server, use the test aaa-server command in privileged EXEC mode. Failure to reach the AAA server may be due to incorrect configuration on the FWSM, or the AAA server may be unreachable for other reasons, such as restrictive network configurations or server downtime.
test aaa-server {authentication server_tag [host ip_address] [username username] [password password] | authorization server_tag [host ip_address] [username username]}
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The test aaa-server command lets you verify that the FWSM can authenticate users with a particular AAA server, and for legacy VPN authorization, if you can authorize a user. This command lets you test the AAA server without having an actual user who attempts to authenticate or authorize. It also helps you isolate whether AAA failures are due to misconfiguration of AAA server parameters, a connection problem to the AAA server, or other configuration errors on the FWSM.
Examples
The following example configures a RADIUS AAA server named srvgrp1 on host 192.168.3.4, sets a timeout of 9 seconds, sets a retry-interval of 7 seconds, and configures authentication port 1650. The test aaa-server command following the setup of the AAA server parameters indicates that the authentication test failed to reach the server.
hostname(config)# aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)# aaa-server svrgrp1 host 192.168.3.4hostname(config-aaa-server-host)# timeout 9hostname(config-aaa-server-host)# retry-interval 7hostname(config-aaa-server-host)# authentication-port 1650hostname(config-aaa-server-host)# exithostname(config)# test aaa-server authentication svrgrp1Server IP Address or name: 192.168.3.4Username: bogusPassword: mypasswordINFO: Attempting Authentication test to IP address <192.168.3.4> (timeout: 10 seconds)ERROR: Authentication Rejected: UnspecifiedThe following is sample output from the test aaa-server command with a successful outcome:
hostname# test aaa-server authentication svrgrp1 host 192.168.3.4 username bogus password mypasswordINFO: Attempting Authentication test to IP address <10.77.152.85> (timeout: 12 seconds)INFO: Authentication SuccessfulRelated Commands
tftp-server
To specify the default TFTP server and path and filename for use with configure net or write net commands, use the tftp-server command in global configuration mode. To remove the server configuration, use the no form of this command. This command supports IPv4 and IPv6 addresses.
tftp-server interface_name server filename
no tftp-server [interface_name server filename]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The tftp-server command simplifies entering the configure net and write net commands. When you enter the configure net or write net commands, you can either inherit the TFTP server specified by the tftp-server command, or provide your own value. You can also inherit the path in the tftp-server command as is, add a path and filename to the end of the tftp-server command value, or override the tftp-server command value.
The FWSM supports only one tftp-server command.
Examples
This example shows how to specify a TFTP server and then read the configuration from the /temp/config/test_config directory:
hostname(config)# tftp-server inside 10.1.1.42 /temp/config/test_confighostname(config)# configure netRelated Commands
timeout
To set the maximum idle time duration, use the timeout command in global configuration mode.
timeout {xlate | conn | half-closed | udp | icmp | h225 | h323 | mgcp | mgcp-pat | sip | sip_media | non_tcp_udp | sunrpc | uauth} hh:mm:ss
Syntax Description
Defaults
The defaults are as follows:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
1.1(1)
This command was introduced.
3.1(1)
The keyword mgcp-pat was added. The rpc keyword was changed to sunrpc.
Usage Guidelines
The timeout command lets you set the idle time for many processes. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence.
Note
The connection timer takes precedence over the translation timer; the translation timer works only after all connections have timed out.
When setting the conn hh:mm:ss, use 0:0:0 to never time out a connection.
When setting the half-closed hh:mm:ss, use 0:0:0 to never time out a half-closed connection.
When setting the h255 hh:mm:ss, h225 00:00:00 means to never tear down an H.225 signaling connection. A timeout value of h225 00:00:01 disables the timer and closes the TCP connection immediately after all calls are cleared.
The uauth hh:mm:ss duration must be shorter than the xlate keyword. Set to 0 to disable caching. Do not set to zero if passive FTP is used on the connections.
To disable the absolute keyword, set the uauth timer to 0 (zero).
Examples
The following example shows how to configure the maximum idle time durations:
hostname(config)# timeout uauth 0:5:00 absolute uauth 0:4:00 inactivityhostname(config)# show running-config timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolute uauth 0:04:00 inactivityRelated Commands
show running-config timeout
Displays the timeout value of the designated protocol.
timeout (aaa-server host)
To configure the host-specific maximum response time, in seconds, allowed before giving up on establishing a connection with the AAA server, use the timeout command in aaa-server host mode. To remove the timeout value and reset the timeout to the default value of 10 seconds, use the no form of this command.
timeout seconds
no timeout
Syntax Description
Defaults
The default timeout value is 10 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
Aaa-server host configuration
•
•
•
•
—
Command History
Usage Guidelines
This command is valid for all AAA server protocol types.
Use the timeout command to specify the length of time during which the FWSM attempts to make a connection to a AAA server. Use the retry-interval command to specify the amount of time the FWSM waits between connection attempts.
The timeout is the total amount of time that the FWSM spends trying to complete a transaction with a server. The retry interval determines how often the communication is retried during the timeout period. Thus, if the retry interval is greater than or equal to the timeout value, you will see no retries. If you want to see retries, the retry interval musts be less than thte timeout value.
Examples
The following example configures a RADIUS AAA server named "svrgrp1" on host 1.2.3.4 to use a timeout value of 30 seconds, with a retry interval of 10 seconds. Thus, the FWSM tries the communication attempt three times before giving up after 30 seconds.
hostname(config)# aaa-server svrgrp1 protocol radiushostname(config-aaa-server-group)# aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)# timeout 30hostname(config-aaa-server-host)# retry-interval 10hostname(config-aaa-server-host)# exithostname(config)#Related Commands
timeout (gtp-map)
To change the inactivity timers for a GTP session, use the timeout command in GTP map configuration mode, which is accessed by using the gtp-map command. Use the no form of this command to set these intervals to their default values.
timeout {gsn | pdp-context | request | signaling | tunnel } hh:mm:ss
no timeout {gsn | pdp-context | request | signaling | tunnel } hh:mm:ss
Syntax Description
Defaults
The default is 30 minutes for gsn, pdp-context, and signaling.
The default for request is 1 minute.
The default for tunnel is 1 minute (in the case where a Delete PDP Context Request is not received).
Command Modes
The following table shows the modes in which you can enter the command:
GTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
The PDP context is identified by the TID, which is a combination of IMSI and NSAPI. Each MS can have up to 15 NSAPIs, allowing it to create multiple PDP contexts each with a different NSAPI, based on application requirements for varied QoS levels.
A GTP tunnel is defined by two associated PDP Contexts in different GSN nodes and is identified with a Tunnel ID. A GTP tunnel is necessary to forward packets between an external packet data network and a mobile station user.
Examples
The following example sets a timeout value for the request queue of 2 minutes:
hostname(config)# gtp-map gtp-policyhostname(config-gtpmap)# timeout request 00:02:00Related Commands
time-range
To enter time-range configuration mode and define a time range that you can attach to traffic rules, or an action, use the time-range command in global configuration mode. To disable, use the no form of this command.
time-range name
no time-range name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Creating a time range does not restrict access to the device. The time-range command defines the time range only. After a time range is defined, you can attach it to traffic rules or an action.
To implement a time-based ACL, use the time-range command to define specific times of the day and week. Then use the with the access-list extended time-range command to bind the time range to an ACL.
The time range relies on the system clock of the FWSM; however, the feature works best with NTP synchronization.
Examples
The following example creates a time range named "New_York_Minute" and enters time range configuration mode:
hostname(config)# time-range New_York_Minutehostname(config-time-range)#After you have created a time range and entered time-range configuration mode, you can define time range parameters with the absolute and periodic commands. To restore default settings for the time-range command absolute and periodic keywords, use the default command in time-range configuration mode.
To implement a time-based ACL, use the time-range command to define specific times of the day and week. Then use the with the access-list extended command to bind the time range to an ACL. The following example binds an ACL named "Sales" to a time range named "New_York_Minute":
hostname(config)# access-list Sales line 1 extended deny tcp host 209.165.200.225 host 209.165.201.1 time-range New_York_Minutehostname(config)#See the access-list extended command for more information about ACLs.
Related Commands
timers lsa-group-pacing
To specify the interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged, use the timers lsa-group-pacing command in router configuration mode. To restore the default value, use the no form of this command.
timers lsa-group-pacing seconds
no timers lsa-group-pacing [seconds]
Syntax Description
seconds
The interval at which OSPF link-state advertisements (LSAs) are collected into a group and refreshed, checksummed, or aged. Valid values are from 10 to 1800 seconds.
Defaults
The default interval is 240 seconds.
Command Modes
The following table shows the modes in which you can enter the command:
