-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 4.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show debug -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config logging -- show running-config vpn-sessiondb
-
show service-policy -- show xlate
-
shun -- sysopt uauth allow-http-cache
-
- T through Z Commands
-
Table Of Contents
show service-policy through show xlate Commands
show service-policy inspect gtp
show service-policy through show xlate Commands
show service-policy
To display the configured service policies, use the show service-policy command in global configuration mode.
show service-policy [global | interface intf] [inspect application_type [option] | set connection | flow protocol {host src_host | src_ip src_mask} [eq src_port] {host dest_host | dest_ip dest_mask} [eq dest_port] [icmp_number | icmp_control_message]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The flow keyword lets you determine, for any flow that you can describe, the policies that the FWSM would apply to that flow. You can use this to check that your service policy configuration will provide the services you want for specific connections. The arguments and keywords following the flow keyword specifies the flow in ip-5-tuple format with no object grouping.
Because the flow is described in ip-5-tuple format, not all match criteria are supported. Following are the list of match criteria that are supported for flow match:
•
•
•
The number of embryonic connections displayed in the show service-policy command output indicates the current number of embryonic connections to an interface for traffic matching that defined by the class-map command.
Note
hostname# show service-policyGlobal policy:Service-policy: 2Class-map: 2Set connection policy: conn-rate-limit 10current conn rate 0, drop 0This is because of a limitation in the network processor.
Examples
The following is sample output from the show service-policy global command:
hostname# show service-policy globalGlobal policy:Service-policy: global_policyClass-map: inspection_defaultInspect: dns maximum-length 512, packet 0, drop 0, reset-drop 0Inspect: ftp, packet 0, drop 0, reset-drop 0Inspect: h323 h225, packet 0, drop 0, reset-drop 0Inspect: h323 ras, packet 0, drop 0, reset-drop 0Inspect: netbios, packet 0, drop 0, reset-drop 0Inspect: rsh, packet 0, drop 0, reset-drop 0Inspect: skinny, packet 0, drop 0, reset-drop 0Inspect: sqlnet, packet 0, drop 0, reset-drop 0Inspect: sunrpc, packet 0, drop 0, reset-drop 0Inspect: tftp, packet 0, drop 0, reset-drop 0Inspect: sip, packet 0, drop 0, reset-drop 0Inspect: xdmcp, packet 0, drop 0, reset-drop 0The following is sample output from the show service-policy flow command:
hostname# show service-policy flow udp host 209.165.200.229 host 209.165.202.158 eq 5060Global policy:Service-policy: global_policyClass-map: inspection_defaultMatch: default-inspection-trafficAction:Input flow: inspect sipInterface outside:Service-policy: testClass-map: testMatch: access-list testAccess rule: permit ip 209.165.200.229 255.255.255.224 209.165.202.158 255.255.255.224Action:Input flow: set connection conn-max 10The following is sample output from the show service-policy inspect http command. This example shows the statistics of each match command in a match-any class map.
hostname# show service-policy inspect httpGlobal policy:Service-policy: global_policyClass-map: inspection_defaultInspect: http http, packet 1916, drop 0, reset-drop 0protocol violationspacket 0class http_any (match-any)Match: request method get, 638 packetsMatch: request method put, 10 packetsMatch: request method post, 0 packetsMatch: request method connect, 0 packetslog, packet 648Related Commands
show service-policy inspect gtp
To display the GTP configuration, use the show service-policy inspect gtp command in privileged EXEC mode.
show service-policy [interface int] inspect gtp {pdp-context [apn ap_name | detail | imsi IMSI_value | ms-addr IP_address | tid tunnel_ID | version version_num ] | pdpmcb | requests | statistics [gsn IP_address] }
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You can use the vertical bar | to filter the display. Type | for more display filtering options.
The show pdp-context command displays PDP context-related information.
The Packet Data Protocol context is identified by the tunnel ID, which is a combination of IMSI and NSAPI. A GTP tunnel is defined by two associated PDP Contexts in different GSN nodes and is identified with a Tunnel ID. A GTP tunnel is necessary to forward packets between an external packet data network and a mobile station user.
The show gtp requests command displays current requests in the request queue.Examples
The following is sample output from the show gtp requests command:
hostname# show gtp requests0 in use, 0 most used, 200 maximum allowedYou can use the vertical bar | to filter the display, as in the following example:
hostname# show service-policy gtp statistics | grep gsnThis example shows the GTP statistics with the word gsn in the output.
The following command shows the statistics for GTP inspection:
hostname# show service-policy inspect gtp statisticsGPRS GTP Statistics:version_not_support | 0 | msg_too_short | 0unknown_msg | 0 | unexpected_sig_msg | 0unexpected_data_msg | 0 | ie_duplicated | 0mandatory_ie_missing | 0 | mandatory_ie_incorrect | 0optional_ie_incorrect | 0 | ie_unknown | 0ie_out_of_order | 0 | ie_unexpected | 0total_forwarded | 0 | total_dropped | 0signalling_msg_dropped | 0 | data_msg_dropped | 0signalling_msg_forwarded | 0 | data_msg_forwarded | 0total created_pdp | 0 | total deleted_pdp | 0total created_pdpmcb | 0 | total deleted_pdpmcb | 0pdp_non_existent | 0The following command displays information about the PDP contexts:
hostname# show service-policy inspect gtp pdp-context1 in use, 1 most used, timeout 0:00:00Version TID | MS Addr | SGSN Addr | Idle | APNv1 | 1234567890123425 | 1.1.1.1 | 11.0.0.2 0:00:13 gprs.cisco.com| user_name (IMSI): 214365870921435 | MS address: | 1.1.1.1| primary pdp: Y | nsapi: 2| sgsn_addr_signal: | 11.0.0.2 | sgsn_addr_data: | 11.0.0.2| ggsn_addr_signal: | 9.9.9.9 | ggsn_addr_data: | 9.9.9.9| sgsn control teid: | 0x000001d1 | sgsn data teid: | 0x000001d3| ggsn control teid: | 0x6306ffa0 | ggsn data teid: | 0x6305f9fc| seq_tpdu_up: | 0 | seq_tpdu_down: | 0| signal_sequence: | 0| upstream_signal_flow: | 0 | upstream_data_flow: | 0| downstream_signal_flow: | 0 | downstream_data_flow: | 0| RAupdate_flow: | 0Table 30-1 describes each column the output from the show service-policy inspect gtp pdp-context command.
Related Commands
show shun
To display shun information, use the show shun command in privileged EXEC mode.
show shun [src_ip | statistics]
Syntax Description
src_ip
(Optional) Displays the information for that address.
statistics
(Optional) Displays the interface counters only.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show shun command:
hostname# show shunshun (outside) 10.1.1.27 10.2.2.89 555 666 6shun (inside1) 10.1.1.27 10.2.2.89 555 666 6Related Commands
show sip
To display SIP sessions, use the show sip command in privileged EXEC mode.
show sip
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show sip command assists in troubleshooting SIP inspection engine issues and is described with the inspect protocol sip udp 5060 command. The show timeout sip command displays the timeout value of the designated protocol.
The show sip command displays information for SIP sessions established across the FWSM. Along with the debug sip and show local-host commands, this command is used for troubleshooting SIP inspection engine issues.
Note
Examples
The following is sample output from the show sip command:
hostname# show sipTotal: 2call-id c3943000-960ca-2e43-228f@10.130.56.44| state Call init, idle 0:00:01call-id c3943000-860ca-7e1f-11f7@10.130.56.45| state Active, idle 0:00:06This sample shows two active SIP sessions on the FWSM (as shown in the Total field). Each call-id represents a call.
The first session, with the call-id c3943000-960ca-2e43-228f@10.130.56.44, is in the state Call Init, which means the session is still in call setup. Call setup is complete only when the ACK is seen. This session has been idle for 1 second.
The second session is in the state Active, in which call setup is complete and the endpoints are exchanging media. This session has been idle for 6 seconds.
Related Commands
show skinny
To troubleshoot SCCP (Skinny) inspection engine issues, use the show skinny command in privileged EXEC mode.
show skinny [audio | video]
Syntax Description
Defaults
If you do not use the audio or video keywords, output contains information for both audio and video, as applicable.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show skinny command assists in troubleshooting SCCP (Skinny) inspection engine issues.
Examples
The following is sample output from the show skinny command under the following conditions. There are two active Skinny sessions set up across the FWSM. The first session is an audio session established between an internal Cisco IP Phone at local address 10.0.0.11 and an external Cisco CallManager at 172.18.1.33. TCP port 2000 is the CallManager. The second one is a video session established between another internal Cisco IP Phone at local address 10.0.0.22 and the same Cisco CallManager.
hostname# show skinnyLOCAL FOREIGN STATE---------------------------------------------------------------1 10.0.0.11/52238 172.18.1.33/2000 1AUDIO 10.0.0.11/22948 172.18.1.22/207982 10.0.0.22/52232 172.18.1.33/2000 1VIDEO 10.0.0.22/20798 172.18.1.11/22948The output indicates a call has been established between both internal Cisco IP Phones. The RTP listening ports of the first and second phones are UDP 22948 and 20798 respectively.
The following is the xlate information for these Skinny connections:
hostname# show xlate debug2 in use, 2 most usedFlags: D | DNS, d | dump, I | identity, i | inside, n | no random,| o | outside, r | portmap, s | staticNAT from inside:10.0.0.11 to outside:172.18.1.11 flags si idle 0:00:16 timeout 0:05:00NAT from inside:10.0.0.22 to outside:172.18.1.22 flags si idle 0:00:14 timeout 0:05:00If you use the video keyword, output is limited to information about video sessions, as shown in the following example:
hostname# show skinny videoLOCAL FOREIGN STATE---------------------------------------------------------------1 10.0.0.22/52232 172.18.1.33/2000 1VIDEO 10.0.0.22/20798 172.18.1.11/22948If you use the audio keyword, output is limited to information about audio sessions, as show in the following example:
hostname# show skinny audioLOCAL FOREIGN STATE---------------------------------------------------------------1 10.0.0.11/52238 172.18.1.33/2000 1AUDIO 10.0.0.11/22948 172.18.1.22/20798Related Commands
show snmp-server statistics
To display information about the SNMP server statistics, use the show snmp-server statistics command in privileged EXEC mode.
show snmp-server statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Examples
This example shows how to display the SNMP server statistics:
hostname# show snmp-server statistics0 SNMP packets input0 Bad SNMP version errors0 Unknown community name0 Illegal operation for community name supplied0 Encoding errors0 Number of requested variables0 Number of altered variables0 Get-request PDUs0 Get-next PDUs0 Get-bulk PDUs0 Set-request PDUs (Not supported)0 SNMP packets output0 Too big errors (Maximum packet size 512)0 No such name errors0 Bad values errors0 General errors0 Response PDUs0 Trap PDUsRelated Commands
show ssh sessions
To display information about the active SSH session on the FWSM, use the show ssh sessions command in privileged EXEC mode.
show ssh sessions [ip_address]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The SID is a unique number that identifies the SSH session. The Client IP is the IP address of the system running an SSH client. The Version is the protocol version number that the SSH client supports. If the SSH only supports SSH version 1, then the Version column displays 1.5. If the SSH client supports both SSH version 1 and SSH version 2, then the Version column displays 1.99. If the SSH client only supports SSH version 2, then the Version column displays 2.0. The Encryption column shows the type of encryption that the SSH client is using. The State column shows the progress that the client is making as it interacts with the FWSM. The Username column lists the login username that has been authenticated for the session.
Examples
The following example shows sample output from the show ssh sessions command:
hostname# show ssh sessionsSID Client IP Version Mode Encryption Hmac State Username0 172.69.39.39 1.99 IN aes128-cbc md5 SessionStarted patOUT aes128-cbc md5 SessionStarted pat1 172.23.56.236 1.5 - 3DES - SessionStarted pat2 172.69.39.29 1.99 IN 3des-cbc sha1 SessionStarted patOUT 3des-cbc sha1 SessionStarted patRelated Commands
ssh disconnect
Disconnects an active SSH session.
ssh timeout
Sets the timeout value for idle SSH sessions.
show startup-config
To show the startup configuration or to show any errors when the startup configuration loaded, use the show startup-config command in privileged EXEC mode.
show startup-config [errors]
Syntax Description
errors
(Optional) Shows any errors that were generated when the FWSM loaded the startup configuration.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
1 The errors keyword is only available in single mode and the system execution space,
Command History
Usage Guidelines
In multiple context mode, this command shows the startup configuration for your current execution space: the system configuration or the security context.
To clear the startup errors from memory, use the clear startup-config errors command.
Examples
The following is sample output from the show startup-config command:
hostname# show startup-config: Saved: Written by enable_15 at 01:44:55.598 UTC Thu Apr 17 2003Version 7.0(0)28!interface GigabitEthernet0/0nameif insidesecurity-level 100ip address 10.86.194.60 255.255.254.0webvpn enable!interface GigabitEthernet0/1shutdownnameif testsecurity-level 0ip address 10.10.4.200 255.255.0.0!...!enable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptedhostname firewall1domain-name example.comboot system disk0:/cdisk.binftp mode passivenamesname 10.10.4.200 outsideaccess-list xyz extended permit ip host 192.168.0.4 host 150.150.0.3!ftp-map ftp_map!ftp-map inbound_ftpdeny-request-cmd appe stor stou!...Cryptochecksum:4edf97923899e712ed0da8c338e07e63The following is sample output from the show startup-config errors command:
hostname# show startup-config errorsERROR: 'Mac-addresses': invalid resource name*** Output from config line 18, " limit-resource Mac-add..."INFO: Admin context is required to get the interfaces*** Output from config line 30, "arp timeout 14400"Creating context 'admin'... WARNING: Invoked the stub function ibm_4gs3_context_set_max_mgmt_sessWARNING: Invoked the stub function ibm_4gs3_context_set_max_mgmt_sessDone. (1)*** Output from config line 33, "admin-context admin"WARNING: VLAN *24* is not configured.*** Output from config line 12, context 'admin', " nameif inside".....*** Output from config line 37, " config-url disk:/admin..."Related Commands
clear startup-config errors
Clears the startup errors from memory.
show running-config
Shows the running configuration.
show sunrpc-server active
To display the pinholes open for Sun RPC services, use the show sunrpc-server active command in privileged EXEC mode.
show sunrpc-server active
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
