Home | Skip to Content | Skip to Search | Skip to Navigation | Skip to Footer |
Worldwide [change] |Register |About Cisco
Guest

Hierarchical Navigation

Support

Command Reference

Downloads

Table Of Contents

Command Reference

aaa

aaa-server

access-group

access-list

alias

arp

auth-prompt

ca

clock

conduit

configure

crypto dynamic-map

crypto ipsec

crypto map

debug

disable

domain-name

enable

enable password

established

exit

failover

filter

fixup protocol

flashfs

floodguard

global

help

hostname

interface

ip

ipsec

isakmp

kill

logging

mtu

name / names

nameif

nat

outbound / apply

pager

passwd

perfmon

ping

quit

reload

rip

route

service

session

show

show blocks / clear blocks

show checksum

show conn

show history

show interface

show memory

show processes

show tech-support

show traffic

show uauth

show version

show xlate

snmp-server

static

syslog

sysopt

telnet

terminal

tftp-server

timeout

uauth (clear and show)

url-cache

url-server

virtual

who

write

xlate (clear and show)


Command Reference

This chapter provides detailed descriptions on each PIX Firewall command.

Before using this chapter, read:

•"," for important information about command line guidelines including ports and protocols.

•"," for information about configuring PIX Firewall for initial access, server access, authentication, and troubleshooting.

•"," for background information about IPSec and its components, and how to implement these IPSec features in the PIX Firewall to create a Virtual Private Network (VPN).

The following notes can help you as you configure the PIX Firewall:

•View your configuration at any time with the write terminal command.

•Save your configuration frequently with the write memory command.

•Always check the syntax before entering a command. Enter a command and press the Enter key to view a quick summary, or precede a command with help, as in, help aaa.

•View syslog messages as you work on the PIX Firewall. Start accumulating messages with the logging buffered 7 command, view messages with the show logging command, and clear the message buffer with the clear logging command. Syslog messages are described in the System Log Messages for the Cisco Secure PIX Firewall Version 5.0.

•PIX Firewall documentation is available online at:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix

•Abbreviate commands, such as, using the co t command statement to start configuration mode, the wr t command statement to list the configuration, and wr m to write to Flash memory. Start logging with the lo b 7 command statement and show logging messages with the sh lo command statement.

•After changing or removing the alias, conduit, global, nat, outbound, and static commands, use the clear xlate command to make the IP addresses available for access.

•You can view possible port and protocol numbers at the following IANA web sites:

http://www.isi.edu/in-notes/iana/assignments/port-numbers

http://www.isi.edu/in-notes/iana/assignments/protocol-numbers

•Create your configuration on a text editor and then cut and paste it into the configuration. PIX Firewall lets you paste in a line at a time or the whole configuration. Always check your configuration after pasting large blocks of text to be sure everything copied.

aaa

Enable, disable, or view TACACS+ or RADIUS user authentication, authorization, and accounting for the server previously designated with the aaa-server command. (Configuration mode.)

aaa accounting acctg_service |except inbound|outbound| if_name local_ip local_mask
foreign_ip foreign_mask group_tag

no aaa accounting authen_service |except inbound | outbound | if_name group_tag

aaa authentication authen_service |except inbound|outbound| if_name local_ip local_mask
foreign_ip foreign_mask group_tag

no aaa authentication [authen_service |except inbound|outbound | if_name local_ip local_mask foreign_ip foreign_mask group_tag

aaa authentication [serial |enable |telnet] console group_tag

no aaa authentication [serial|enable|telnet] console group_tag

aaa authorization  author_service |except inbound| outbound| if_name
local_ip local_mask foreign_ip foreign_mask

no aaa authorization [author_service |except inbound | outbound | if_name
local_ip local_mask foreign_ip foreign_mask]

show aaa

Syntax Description

accounting

Enable or disable accounting services with authentication server. Use of this command requires that you previously used the aaa-server command to designate an authentication server.

acctg_service

The accounting service. Accounting is provided for all services or you can limit it to one or more services. Possible values are any, ftp, http, telnet, or protocol/port. Use any to provide accounting for all TCP services. To provide accounting for UDP services, use the protocol/port form.
For protocol/port, the TCP protocol appears as 6, the UDP protocol appears as 17, and so on, and port is the TCP or UDP destination port. A port value of 0 (zero) means all ports. For protocols other than TCP and UDP, the port is not applicable and should not be used.

authentication

Enable or disable user authentication, prompt user for username and password, and verify information with authentication server.

When used with the console option, enables or disables authentication service for access to the PIX Firewall console over Telnet or from the Console connector on the PIX Firewall unit.

Use of the aaa authentication command requires that you previously used the aaa-server command to designate an authentication server.

authen_service

The application with which a user is accessing a network. Use any, ftp, http, or telnet. The any value enables accounting or authentication for all TCP services. To have users prompted for authentication credentials, they must use FTP, HTTP, or Telnet. (HTTP is the Web and only applies to web browsers that can prompt for a username and password.)

If the authentication or authorization server is authenticating services other than FTP, HTTP, or Telnet, using any will not permit those services to authenticate in the firewall. The firewall only knows how to communicate with FTP, HTTP, and Telnet for authentication and authorization.

Only set this parameter to a service other than any if the authentication or authorization server is set the same way. Unless you want to temporarily restrict access to a specific service, setting a service in this command can increase system administration work and may cause all connections to fail if the authentication or authorization server is authenticating one service and you set this command to another.

authorization

Enable or disable TACACS+ user authorization for services (PIX Firewall does not support RADIUS authorization). The authentication server determines what services the user is authorized to access.

author_service

The services which require authorization. Use any, ftp, http, telnet, or protocol/port. Services not specified are authorized implicitly. Services specified in the aaa authentication command do not affect the services which require authorization.

For protocol/port:

•protocol—the protocol (6 for TCP, 17 for UDP, 1 for ICMP, and so on).

•port—the TCP or UDP destination port, or port range. The port can also be the ICMP type; that is, 8 for ICMP echo or ping. A port value of 0 (zero) means all ports. Port ranges only applies to the TCP and UDP protocols, not to ICMP. For protocols other than TCP, UDP, and ICMP the port is not applicable and should not be used. An example port specification is: 

 aaa authorization udp/53-1024 inside 0 0 0 0

This example enables authorization for DNS lookups to the inside interface for all clients, and authorizes access to any other services that have ports in the range of 53 to 1024.

Note   Specifying a port range may produce unexpected results at the authorization server. PIX Firewall sends the port range to the server as a string with the expectation that the server will parse it out into specific ports. Not all servers do this. In addition, you may want users to be authorized on specific services, which will not occur if a range is accepted.

except

Create an exception to a previously specified set of services.

inbound

Authenticate or authorize inbound connections. Inbound means the connection originates on the outside interface and is being directed to the inside or perimeter.

outbound

Authenticate or authorize outbound connections. Outbound means the connection originates on the inside and is being directed to the outside or perimeter.

if_name

Interface name from which users require authentication. Use if_name in combination with the local_ip address and the foreign_ip address to determine where access is sought and from whom. The local_ip address is always on the highest security level interface and foreign_ip is always on the lowest. See the Examples section for how the if_name affects the use of this command.

local_ip

The IP address of the highest security level interface from which or to which access is sought. You can set this address to 0 to let the authentication server decide which hosts are authenticated.

local_mask

Network mask of local_ip. Always specify a specific mask value. Use 0 if the IP address is 0.

foreign_ip

The IP address of the lowest security level interface from which or to which access is sought.

foreign_mask

Network mask of foreign_ip. Always specify a specific mask value. Use 0 if the IP address is 0.

console

Specify that access to the PIX Firewall console require authentication and optionally, log configuration changes to a syslog server.

The aaa authentication serial console command lets you require authentication verification to access the PIX Firewall's serial console. The serial console options also logs to a syslog server changes made to the configuration from the serial console.

Authenticated access to the PIX Firewall console has different types of prompts depending on the option you choose with the aaa authentication [serial|enable|telnet] console command. While the enable option allows three tries before stopping with an access denied message, both the serial and telnet options cause the user to be prompted continually until successfully logging in. The serial option requests a username and password before the first command line prompt on the serial console connection. The telnet option forces you to specify a username and password before the first command line prompt of a Telnet console connection. The enable option requests a username and password before accessing privileged mode for serial or Telnet connections.

Telnet access to the PIX Firewall console is available from any internal interface (not the outside interface) and requires previous use of the telnet command.

Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis. If the console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the enable password.

The maximum password length for accessing the console is 16 characters.

group_tag

The group tag set with the aaa-server command.


Usage Guidelines

The aaa command enables or disables the following AAA (Authentication, Authorization, and Accounting) features:

•User authentication services. A user starting a connection via FTP, Telnet, or over the World Wide Web is prompted for their username and password. An authentication server, designated previously with the aaa-server command, verifies whether the username and password are correct. If the username and password are correct, PIX Firewall lets further traffic between the authentication server and the connection interact independently through the PIX Firewall unit's "Cut-Through Proxy" feature.

•Authentication access to the PIX Firewall unit's console via Telnet or the serial console. (Telnet access requires previous use of the telnet command.)

•User authorization services for TACACS+ connections that let the authentication server determine which services the user can access.

•Accounting services so that administrators can track which hosts accessed the PIX Firewall.

Note   PIX Firewall does not support RADIUS authorization.

Note   If the AAA console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the enable password.

Usage Notes

1 The aaa command is not intended to mandate your security policy. The authentication and authorization servers determine whether a user can or cannot access the system, what services can be accessed, and what IP addresses the user can access.The PIX Firewall interacts with FTP, HTTP (Web access), and Telnet to display the credentials prompts for logging in to the network or logging in to exit the network. You can specify that only a single service be authenticated, but this must agree with the authentication server to ensure that both the firewall and server agree.

2 Accounting information is only sent to the active server in a server group.

3 The prompts users see requesting AAA credentials differ between the three services that can access the PIX Firewall for authentication: Telnet, FTP, and HTTP (Web):

(a) Telnet users see a prompt generated by the PIX Firewall that you can change with the auth-prompt command. The PIX Firewall permits a user up to four chances to log in and then if the username or password still fails, the PIX Firewall drops the connection.

(b) FTP users receive a prompt from the FTP program. If a user enters an incorrect password, the connection is dropped immediately. If the username or password on the authentication database differs from the username or password on the remote host to which you are using FTP to access, enter the username and password in these formats: 

authentication_user_name@remote_system_user_name

authentication_password@remote_system_password

If you daisy-chain PIX Firewall units, Telnet authentication works in the same way as a single unit, but FTP and HTTP authentication have additional complexity for users because they have to enter each password and username with an additional at (@) character and password or username for each daisy-chained system. Users can exceed the 63-character password limit depending on how many units are daisy-chained and password length.

Some FTP graphical user interfaces (GUIs) do not display challenge values.

(c) HTTP users see a pop-up window generated by the browser itself. If a user enters an incorrect password, the user is reprompted. When the web server and the authentication server are on different hosts, use the virtual command to get the correct authentication behavior.

4 Use of the aaa authorization command requires previous use of the aaa authentication command; however, use of the aaa authentication command does not require use of an aaa authorization command.

5 If you want to allow connections to come from any host, code the local IP address and netmask as 0.0.0.0 0.0.0.0, or 0 0. The same convention applies to the foreign host IP address and netmask; 0.0.0.0 0.0.0.0 means any foreign host.

6 Authenticated access to the PIX Firewall console has different types of prompts depending on the option you choose with the aaa authentication ... console command:

(a) enable option—Allows three tries before stopping with "Access denied." The enable option requests a username and password before accessing privileged mode for serial or Telnet connections.

(b) serial option—Causes the user to be prompted continually until successfully logging in. The serial option requests a username and password before the first command line prompt on the serial console connection.

(c) telnet option—Causes the user to be prompted continually until successfully logging in. The telnet option forces you to specify a username and password before the first command line prompt of a Telnet console connection.

7 You can specify an interface name with aaa authentication. In previous versions, if you specified aaa authentication any outbound 0 0 server, PIX Firewall only authenticated outbound connections and not those to the perimeter interface. PIX Firewall now authenticates any outbound connection to the outside as well as to hosts on the perimeter interface. To preserve the behavior of previous versions, use these commands to enable authentication and to disable authentication from the inside to the perimeter interface: 

aaa authentication any outbound 0 0 server

aaa authentication except outbound perim_net perim_mask server

8 When using HTTP authentication to a site running Microsoft IIS that has "Basic text authentication" or "NT Challenge" enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: "Authorization: Basic=Uuhjksdkfhk==" to the HTTP GET commands. This string contains the PIX Firewall authentication credentials.

Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server.  Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied.

To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested.

Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set.  This is because the browser caches the "Authorization: Basic=Uuhjksdkfhk==" string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts.  Flushing the cache is of no use.

As long as the user repeatedly browses the Internet, the browser resends the "Authorization: Basic=Uuhjksdkfhk==" string to transparently reauthenticate the user.

9 Multimedia applications such as CU-SeeMe, InternetPhone, MeetingPoint, and MS Netmeeting silently start the HTTP service before an H.323 session is established from the inside to the outside. To avoid interfering with these applications, do not enter blanket outgoing AAA command statements for all challenged ports such as using the any option. Be selective with which ports and addresses you use to challenge HTTP, and when to set user authentication timeouts to a higher timeout value. If interfered with, the multimedia programs may fail on the PC and may even crash the PC after establishing outgoing sessions from the inside.

10 For outbound connections, first use the nat command to determine which IP addresses can access the firewall. For inbound connections, first use the static and conduit commands to determine which inside IP addresses can be accessed through the firewall from the outside network.

11 When a host is configured for authentication, all users on the host have to use a web browser or Telnet first before performing any other networking activity, such as accessing mail or a news reader. The reason for this is that users must first establish their authentication credentials and programs such as mail agents and newsreaders do not have authentication challenge prompts.

12 The PIX Firewall only accepts 7-bit characters during authentication. After authentication, the client and server can negotiate for 8-bits if required. During authentication, the PIX Firewall only negotiates Go-Ahead, Echo, and NVT (network virtual terminal).

13 Up to 256 TACACS+ or RADIUS servers are permitted (up to 16 servers in each of the up to 16 server groups—set with the aaa-server command). When a user logs in, the servers are accessed one at a time starting with the first server you specify in the configuration, until a server responds.

14 For each IP address, one aaa authentication command is permitted for inbound connections and one for outbound connections. Also, for an IP address, one aaa authorization command is permitted. If you want to authorize more than one service with aaa authorization, use the any parameter for the service type.

15 The PIX Firewall permits only one authentication type per network. For example, if one network connects through the PIX Firewall using TACACS+ for authentication, another network connecting through the PIX Firewall can authenticate with RADIUS, but one network cannot authenticate with both TACACS+ and RADIUS.

16 For the TACACS+ server, if you do not specify a key to the aaa-server command, no encryption occurs.

17 Network browsers such as Netscape Navigator do not present a challenge value during authentication; therefore, only password authentication can be used from a network browser.

18 PIX Firewall supports authentication usernames up to 127 characters and passwords of up to 63 characters. A password or username may not contain an at (@) character as part of the password or username string, except as shown in Note 3.

19 If the first attempt at authorization fails and a second attempt causes a timeout, use the
service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is: 

Unable to connect to remote host: Connection timed out

See also: aaa-server, auth-prompt, service, telnet, virtual.

Examples

1 The following examples demonstrate ways to use the if_name parameter. The PIX Firewall has an inside network of 192.168.1.0, an outside network of 192.150.50.0, and a perimeter network of 192.150.50.0.

This example enables authentication for connections originated from the inside network to the outside network: 

aaa authentication any outbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 
tacacs+

This example enables authentication for connections originated from the inside network to the perimeter network: 

aaa authentication any outbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 
tacacs+

This example enables authentication for connections originated from the outside network to the inside network: 

aaa authentication any inbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 
tacacs+

This example enables authentication for connections originated from the outside network to the perimeter network: 

aaa authentication any inbound 192.150.50.0 255.255.255.0 192.150.50.0 255.255.255.0 
tacacs+

This example enables authentication for connections originated from the perimeter network to the outside network: 

aaa authentication any perimeter 192.150.50.0 255.255.255.0 192.150.50.0 255.255.255.0 
tacacs+

2 This example specifies that IP addresses 10.0.0.1 through 10.0.0.254 can originate outbound connections and then enables user authentication so that those addresses must enter user credentials to exit the firewall. In this example, the first aaa authentication command permits authentication on FTP, HTTP, or Telnet depending on what the authentication server handles. The second aaa authentication command lets host 10.0.0.42 start outbound connections without being authenticated. This example uses the default authentication group tacacs+: 

nat (inside) 1 10.0.0.0 255.255.255.0

aaa authentication any outbound 0 0 tacacs+

aaa authentication except outb 10.0.0.42 255.255.255.255 tacacs+

3 This example permits inbound access to any IP address in the range of 192.150.50.1 through 192.150.50.254. All services are permitted by the conduit command, and the aaa authentication command permits authentication on FTP, HTTP, or Telnet depending on what the authentication server handles. The authentication server is at IP address 10.16.1.20 on the inside interface: 

aaa-server AuthIn protocol tacacs+

aaa-server AuthIn (inside) host 10.16.1.20 thisisakey timeout 20

static (inside, outside) 192.150.50.0 10.16.1.0 netmask 255.255.255.0 10 60

conduit permit tcp 192.150.50.0 255.255.255.0 10.16.1.0 255.255.255.0

aaa authentication any inbound 0 0 AuthIn

4 This example enables authorization for DNS lookups from the outside interface: 

aaa authorization udp/53 inbound 0.0.0.0 0.0.0.0

5 This example enables authorization of ICMP echo-reply packets arriving at the inside interface from inside hosts: 

 aaa authorization 1/0 outbound 0.0.0.0 0.0.0.0

This means that users will not be able to ping external hosts if they have not been authenticated using Telnet, HTTP, or FTP.

6 This example enables authorization for ICMP echoes (pings) only that arrive at the inside interface from an inside host: 

aaa authorization 1/8 outbound 0.0.0.0 0.0.0.0

aaa-server

Specify an AAA server. (Configuration mode.)

aaa-server group_tag (if_name) host server_ip key timeout seconds

no aaa-server group_tag (if_name) host server_ip key timeout seconds

aaa-server group_tag protocol auth_protocol

clear aaa-server [group_tag]

Syntax Description

group_tag

An alphanumeric string which is the name of the server group. Use the group_tag in the aaa command to associate aaa authentication and aaa accounting command statements to an AAA server.

if_name

The interface name on which the server resides.

host server_ip

The IP address of the TACACS+ or RADIUS server.

key

A case-sensitive, alphanumeric keyword of up to 127 characters that is the same value as the key on the TACACS+ server. Any characters entered past 127 are ignored. The key is used between the client and server for encrypting data between them. The key must be the same on both the client and server systems. Spaces are not permitted in the key, but other special characters are.

timeout seconds

The maximum idle time permitted before PIX Firewall switches to the next AAA server you specified. The default is 5 seconds. The maximum time is 30 seconds.

protocol auth_protocol

The type of AAA server, either tacacs+ or radius.


Usage Guidelines

The aaa-server command lets you specify an AAA server group. PIX Firewall lets you define separate groups of TACACS+ or RADIUS servers for specifying different types of traffic; such as, a TACACS+ server for inbound traffic and another for outbound traffic. Another use is where all outbound HTTP traffic will be authenticated by a TACACS+ server, and all inbound traffic will use RADIUS.

AAA server group are defined by a tag name that directs different types of traffic to each authentication server. If the first authentication server in the list fails, the AAA subsystem fails over to the next server in the tag group. You can have up to 16 tag groups and each group can have up to 16 AAA servers for a total of up to 256 AAA servers.

The aaa command references the tag group.

The aaa-server command replaces the radius-server and tacacs-server commands.

Note   The previous server type option at the end of the aaa authentication and aaa accounting commands has been replaced with the aaa-server group tag. Backward compatibility with previous versions is maintained by the inclusion of two default protocols for TACACS+ and RADIUS.

If accounting is in effect, the accounting information goes only to the active server.

The default configuration provides these two aaa-server protocols: 

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

Note   If you are upgrading from a previous version of PIX Firewall and have aaa command statements in your configuration, using the default server groups lets you maintain backward compatibility with the aaa command statements in your configuration.

Examples

1 This example uses the default protocol tacacs+ with the aaa commands: 

aaa-server TACACS+ (inside) host 10.1.1.10 thekey timeout 20

aaa authentication any outbound 0 0 0 0 TACACS+

aaa authorization any outbound 0 0 0 0

aaa accounting any outbound 0 0 0 0 TACACS+

aaa authentication any serial console TACACS+

This example specifies that the authentication server with the IP address 10.1.1.10 resides on the inside interface and is in the default TACACS+ server group. The next three command statements specify that any users starting outbound connections to any foreign host will be authenticated using TACACS+, that the users who are successfully authenticated are authorized to use any service, and that all outbound connection information will be logged in the accounting database. The last command statement specifies that access to the PIX Firewall's serial console requires authentication from the TACACS+ server.

2 This example creates the AuthOut and AuthIn server groups for RADIUS authentication and specifies that servers 10.0.1.40, 10.0.1.41, and 10.1.1.2 on the inside interface provide authentication. The servers in the AuthIn group authenticate inbound connections, the AuthOut group authenticates outbound connections: 

aaa-server AuthIn protocol radius

aaa-server AuthIn (inside) host 10.0.1.40 ab timeout 20

aaa-server AuthIn (inside) host 10.0.1.41 abc timeout 4

aaa-server AuthOut protocol radius

aaa-server AuthOut (inside) host 10.1.1.2 abc123 timeout 15

aaa authenticate any inbound 0 0 0 0 AuthIn

aaa authentication any outbound 0 0 0 0 AuthOut

access-group

Binds the access list name to the interface interface-name to permit or deny IP packets incoming into the interface. (Configuration mode.)

access-group access-list-name in interface interface-name

clear access-group access-list-name in interface interface-name

no access-group access-list-name in interface interface-name

show access-group access-list-name in interface interface-name

Syntax Description

access-list-name

The name associated with a given access list.

in interface

Filters on inbound packets at the given interface.

interface-name

The name of the network interface.


Usage Guidelines

The access-group command binds the name of a given access list to an interface. Access lists are applied to traffic inbound to interface. If the access list permits the address, the PIX Firewall continues to process the packet. If the access list rejects the address, the firewall discards the packet and generates a syslog message.

If no access list is bound to an interface, the conduit list or outbound list is checked.

Note   The use of access-group command overrides the conduit and outbound lists for the specified interface-name.

Note   The PIX Firewall currently only supports IPSec on the outside interface. Although the PIX Firewall currently can simulate the Private Link inside termination with the use of the sysopt ipsec pl-compatible command, the termination on the inside interface is not a true termination. For more information on the sysopt ipsec pl-compatible command, see the sysopt command page.

The no access-group command unbinds the "access-list-name" from the interface interface-name.

The show access-group command displays the current access-list bound to the interface(s).

The clear access-group command removes all entries from access-list indexed by "list-name." If "list-name" is not specified, all access-lists are destroyed.

Examples

The following example shows use of the access-group command. The example indicates that access list 101 will be bound to the outside interface. 

access-group 101 in interface outside

access-list

Create an access list. (Configuration mode.)

access-list access-list-name [deny | permit] protocol source source-netmask destination destination-netmask

no access-list access-list-name [deny | permit] protocol source source-netmask destination destination-netmask

clear access-list

show access-list

Syntax Description

access-list-name

Name of an access list.

deny

In relation to an interface, deny does not allow a packet to traverse the PIX Firewall.

In relation to a crypto map entry, deny does not select a packet for IPsec protection. Using the deny keyword prevents traffic from being protected by crypto in the context of that particular crypto map entry. In other words, it does not allow the policy as specified in this crypto map entry to be applied to this traffic.

destination

Address of the network or host to which the packet is being sent. There are three other ways to specify the destination:

•Use a 32-bit quantity in four-part, dotted-decimal format.

•Use the keyword any as an abbreviation for the destination and netmask of 0.0.0.0 0.0.0.0. This keyword is not recommended for access lists used for IPSec via crypto map.

•Use host destination as an abbreviation for a destination and netmask of destination 255.255.255.255.

destination-netmask

Netmask bits to be applied to the destination. There are three other ways to specify the destination netmask:

•Use a 32-bit quantity in four-part, dotted-decimal format. Place zeroes in the bit positions you want to ignore.

•Use the keyword any as an abbreviation for a destination and destination-netmask of 0.0.0.0 0.0.0.0. This keyword is normally not recommended for access lists used for IPSec.

•Use host destination as an abbreviation for a destination and destination-netmask of destination 255.255.255.255.

protocol

Name or number of an IP protocol. It can be one of the keywords icmp, ip, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip.

For IPSec, the protocol must be IP.

permit

In relation to an interface, permit enables a session to be established across the PIX Firewall.

In relation to a crypto map entry, permit selects a packet for IPsec protection. Using the permit keyword causes all IP traffic that matches the specified conditions to be protected by crypto, using the policy described by the corresponding crypto map entry.

source

Address of the network or host from which the packet is being sent. There are three other ways to specify the source:

•Use a 32-bit quantity in four-part, dotted-decimal format.

•Use the keyword any as an abbreviation for a source and source-netmask of 0.0.0.0 0.0.0.0. This keyword is normally not recommended for use with IPSec.

•Use host source as an abbreviation for a source and source-netmask of source 255.255.255.255.

source-netmask

Netmask bits (mask) to be applied to source. There are three other ways to specify the source netmask:

•Use a 32-bit quantity in four-part, dotted-decimal format. Place zeroes in the bit positions you want to ignore.

•Use the keyword any as an abbreviation for a source and source-netmask of 0.0.0.0 0.0.0.0. This keyword is not recommended.

•Use host source as an abbreviation for a source and source-netmask of source 255.255.255.255.


Usage Guidelines

The access-list command allows you to create an access list. After you have defined an access list, bind it to an interface using the access-group command or bind it to a crypto map entry using the crypto map command. The show access-list command lists the access-list command statements in the configuration. The clear access-list command removes all access-list command statements from the configuration.

Note   The clear access-list command stops all traffic through the PIX Firewall.

Note   Do not use the access-list command in conjunction with the conduit and outbound commands.

Note   The access-list command uses the same syntax as the Cisco IOS command of the same name with one very important difference. The subnet mask in the PIX Firewall access-list command is specified the same as all other PIX Firewall commands, which is very different than the Cisco IOS version of this command.

If the access list is bound to an interface, the access list selects which traffic will be able to traverse the PIX Firewall. When bound to a crypto map entry, the access list selects which IP traffic will be protected by IPSec and which traffic will not be protected. For example, access lists can be created to protect all IP traffic between Subnet A and Subnet Y or traffic between Host  A and Host B.

The access lists themselves are not specific to IPSec. It is the crypto map entry referencing the specific access list that defines whether IPSec processing is applied to the traffic matching a permit in the access list.

Crypto access lists associated with IPSec crypto map entries have four primary functions:

•Select outbound traffic to be protected by IPSec (permit = protect).

•Indicate the data flow to be protected by the new security associations (specified by a single permit entry) when initiating negotiations for IPSec security associations.

•Process inbound traffic in order to filter out and discard traffic that should have been protected by IPSec.

•Determine whether or not to accept requests for IPSec security associations on behalf of the requested data flows when processing IKE negotiation from the IPSec peer. (Negotiation is only done for ipsec-isakmp crypto map entries.) In order for a peer's initiated IPSec negotiation to be accepted, it must specify a data flow that is "permitted" by a crypto access list associated with an ipsec-isakmp crypto map entry.

The crypto access list you define will be associated with an interface after you define the corresponding crypto map entry and apply the crypto map set to the interface. Different access lists must be used in different entries of the same crypto map set. However, both inbound and outbound traffic will be evaluated against the same "outbound" IPSec access list. Therefore, the access list's criteria are applied in the forward direction to traffic exiting your PIX Firewall and the reverse direction to traffic entering your PIX Firewall.

If you want certain traffic to receive one combination of IPSec protection (for example, authentication only) and other traffic to receive a different combination of IPSec protection (for example, both authentication and encryption), you need to create two different crypto access lists to define the two different types of traffic. These different access lists are then used in different crypto map entries that specify different IPSec policies.

Cisco recommends that you configure "mirror image" crypto access lists for use by IPSec and that you avoid using the any keyword. See the sections "Mirror Image Crypto Access Lists at each IPSec Peer" and "any Keyword in Crypto Access Lists" in "."

Note   The protocol in access-lists used for IPsec can only be ip.  In other words, the granularity of each IPsec tunnel can only be per-host or greater. 

If you configure multiple statements for a given crypto access list to be used for IPSec, in general the first permit statement that is matched will be the statement used to determine the scope of the IPSec security association. That is, the IPSec security association will be set up to protect traffic that meets the criteria of the matched statement only. Later, if traffic matches a different permit statement of the crypto access list, a new, separate IPSec security association will be negotiated to protect traffic matching the newly matched access list statement.

Examples

The following example creates a numbered crypto access list that specifies a Class C subnet for the source and a Class C subnet for the destination of IP packets. When the PIX Firewall uses this crypto access list, all IP traffic that is exchanged between the source and destination subnets will be encrypted. 

access-list 101 permit ip 172.21.3.0 0.0.0.255 172.22.2.0 0.0.0.255

This crypto access list would be applied to an interface as an outbound crypto access list after you define a crypto map and apply it to the interface.

alias

Administer overlapping addresses with dual NAT. (Configuration mode.)

alias [(if_name)] dnat_ip foreign_ip [netmask]

no alias [[(if_name)] dnat_ip foreign_ip [netmask]]

show alias

Syntax Description

if_name

The internal network interface name in which the foreign_ip overlaps.

dnat_ip

An IP address on the internal network that provides an alternate IP address for the external address that is the same as an address on the internal network.

foreign_ip

IP address on the external network that has the same address as a host on the internal network.

netmask

Network mask applied to both IP addresses. Use 255.255.255.255 for host masks.


Usage Guidelines

The alias command translates one address into another. Use this command to prevent conflicts when you have IP addresses on a network that are the same as those on the Internet or another intranet. You can also use this command to do address translation on a destination address. For example, if a host sends a packet to 192.150.50.1, you can use alias to redirect traffic to another address, such as, 192.150.50.42.

Note   You can use the sysopt nodnsalias command to disable inbound embedded DNS A record fixups according to aliases that apply to the A record address and outbound replies.

After changing or removing an alias command statement, use the clear xlate command.

There must be an A (address) record in the DNS zone file for the "dnat" address in the alias command.

The alias command has two uses which can be summarized in the following ways of reading an alias command statement:

•If the PIX Firewall gets a packet destined for the dnat_IP_address, send it to the foreign_IP_address.

•If the PIX Firewall gets a DNS packet returned to the PIX Firewall destined for foreign_network_address, alter the DNS packet to change the foreign network address to dnat_network_address.

The no alias command disables a previously set alias command statement. The show alias command displays alias command statements in the configuration.

The alias command automatically interacts with DNS servers on your network to ensure that domain name access to the aliased IP address is handled transparently.

You can specify a net alias by using network addresses for the foreign_ip and dnat_ip IP addresses. For example, alias 10.1.1.0 192.150.50.0 255.255.255.0 creates aliases for each IP address between 192.150.50.1 and 192.150.50.254.

Note   ActiveX blocking does not occur when users access an IP address referenced by the alias command. ActiveX blocking is set with the filter activex command.

Usage Notes

1 To access an alias dnat_ip address with static and conduit command statements, specify the dnat_ip address in the conduit command statement as the address from which traffic is permitted from. The following example illustrates this note: 

alias (inside) 192.168.8.14 192.150.50.1 255.255.255.255

static (inside,outside) 192.150.50.1 192.168.8.14 netmask 255.255.255.255

conduit permit tcp host 192.150.50.1 eq ftp-data host 192.168.8.14

An alias is specified with the inside address 192.168.8.14 mapping to the foreign address 192.150.50.1.

Examples

1 In this example, an inside network uses IP address 192.159.1.33, which on the Internet belongs to domain.com. When inside clients try to access domain.com, the packets do not go to the firewall because the client thinks 192.159.1.33 is on the local inside network. To correct this, a net alias is created as follows with the alias command: 

alias (inside) 192.168.1.0 192.159.1.0 255.255.255.0


show alias

alias 192.168.1.0 192.159.1.0 255.255.255.0

When client 192.159.1.123 connects to domain.com, the DNS response from an external DNS server to the internal client's query would be altered by the PIX Firewall to: 192.168.1.33. If the PIX Firewall uses 192.150.50.1 through 192.150.50.254 as the global pool IP addresses, the packet goes to the PIX Firewall with SRC=192.159.1.123 and DST=192.168.1.33. The PIX Firewall translates it to SRC=192.150.50.254 and DST=192.159.1.33 on the outside.

2 In this example, a web server is on the inside at 10.1.1.11 and a static for it at 192.150.50.11. The source host is on the outside with address 192.150.50.7. A DNS server on the outside has a record for www.domain.com as follows:

www.domain.com.

 

IN  

 

A

 

192.150.50.11


The period at the end of the www.domain.com. domain name must be included.

The alias command is: 

alias 10.1.1.11 192.150.50.11 255.255.255.255

PIX Firewall doctors the nameserver replies to 10.1.1.11  for inside clients to directly connect to the web server.

The conduit command statement you would expect to use is: 

conduit permit tcp host 192.150.50.11 eq telnet host 192.150.50.7

But with the alias command, use this command: 

conduit permit tcp host 192.150.50.11 eq telnet host 192.159.1.7

You can test the DNS entry for the host with the following nslookup command: 

nslookup -type=any www.domain.com

arp

Change or view the ARP cache, and set the timeout value. (Configuration mode.)

arp if_name ip_address mac_address [alias]

clear arp

no arp if_name ip_address

show arp [if_name] [ip_address mac_address alias]

arp timeout seconds

no arp timeout

show arp timeout

Syntax Description

if_name

The internal or external interface name specified by the nameif command.

ip_address

Host IP address for the ARP table entry.

mac_address

Hardware MAC address for the ARP table entry; for example, 00e0.1e4e.3d8b.

alias

Make this entry permanent. Alias entries do not time out and are automatically stored in the configuration when you use the write command to store the configuration.

seconds

Duration that an ARP entry can exist in the ARP table before being cleared.


Usage Guidelines

The arp command adds an entry to the PIX Firewall ARP cache. ARP is a low-level TCP/IP protocol that resolves a node's physical address from its IP address through an ARP request asking the node with a particular IP address to send back its physical address. The presence of entries in the ARP cache indicates that the PIX Firewall has network connectivity. The clear arp command clears the ARP table but not the alias (permanent) entries. Use the no arp command to remove these entries. The show arp command lists the entries in the ARP table.

Note   You can use the sysopt noproxyarp command to disable proxy-arps on an interface.

Use the arp command to add an entry for new hosts you add on your network or when you swap an existing host for another. Alternatively, you can wait for the duration specified with the arp timeout command to expire and the ARP table rebuilds itself automatically with the new host information.

The arp timeout command sets the duration that an ARP entry can stay in the PIX Firewall ARP table before expiring. The timer is known as the ARP persistence timer. The default value is
14,400 seconds (4 hours).

The no arp timeout command sets the timer to its default value. The show arp timeout command displays its current value.

Examples

The following examples illustrate use of the arp and arp timeout commands: 

arp inside 192.168.0.42 00e0.1e4e.2a7c

arp outside 192.168.0.43 00e0.1e4e.3d8b alias

show arp

                                                        outside 192.168.0.43 00e0.1e4e.3d8b alias

                                                      inside 192.168.0.42 00e0.1e4e.2a7c


clear arp inside 192.168.0.42


arp timeout 42

show arp timeout

arp timeout 42 seconds


no arp timeout

show arp timeout

arp timeout 14400 seconds

auth-prompt

Change the AAA challenge text. (Configuration mode.)

auth-prompt [accept|reject|prompt] string

clear auth-prompt

no auth-prompt [accept|reject|prompt] string

show auth-prompt

Syntax Description

accept

If a user authentication via Telnet is accepted, display the prompt string.

reject

If a user authentication via Telnet is rejected, display the prompt string.

prompt

The AAA challenge prompt string follows this keyword. This keyword is optional for backward compatibility.

string

A string of up to 177 alphanumeric characters. Special characters should not be used; however, spaces and punctuation characters are permitted. Entering a question mark or pressing the Enter key ends the string. (The question mark appears in the string.)


Usage Guidelines

The auth-prompt command lets you change the AAA challenge text for HTTP, FTP, and Telnet access. This text displays above the username and password prompts that users view when logging in. If you do not use this command, FTP users view FTP authentication,  HTTP users view HTTP Authentication, and challenge text does not appear for Telnet access.

If the user authentication occurs from Telnet, you can use the accept and reject options to display different authentication prompts if the authentication attempt is accepted or rejected by the authentication server.

Example

The following example shows how to set the authentication prompt and how users view the prompt: 

auth-prompt XYZ Company Firewall Access

After this string is added to the configuration, users view: 

XYZ Company Firewall Access

User Name:

Password:

The prompt keyword can be included or omitted. For example: 

auth-prompt prompt Hello There!

This command statement is the same as: 

auth-prompt Hello There!

ca

Configure the PIX Firewall to interoperate with a Certification Authority (CA). (Configuration mode.)

ca authenticate ca_nickname [fingerprint]

ca configure ca_nickname ca | ra retry_period retry_count [crloptional]

no ca configure ca_nickname

show ca configure

ca crl request ca_nickname

ca enroll ca_nickname challenge_password [serial] [ipaddress]

no ca enroll ca_nickname

ca generate rsa key|specialkey key_modulus_size

ca identity ca_nickname ca_ipaddress[:ca_script_location] [ldap_ip address]

no ca identity ca_nickname

show ca identity

ca save all

no ca save all

show ca certificate

ca zeroize rsa

show ca mypubkey rsa

Note   See the section "About CA" in "," for more information about this IPSec feature.

Syntax Description

ca_nickname

The CA's name. Enter any string that you desire. (If you previously declared the CA and just want to update its characteristics, specify the name you previously created.) The CA might require a particular name, such as its domain name.

Currently the PIX Firewall supports only one CA at a time.

fingerprint

A key consisting of alphanumeric characters the PIX Firewall uses to authenticate CA's certificate.

ca | ra

Indicates whether to contact the CA or Registration Authority (RA) when using the ca configure command.

Some CA systems provide a RA, which the PIX Firewall contacts instead of the CA.

retry_period

Specify the number of minutes the PIX Firewall waits before resending a certificate request to the CA when it does not receive a response from the CA to its previous request. Specify from 1 to 60 minutes. By default, the firewall retries every 1 minute.

retry_count

Specify how many times the PIX Firewall will resend a certificate request when it does not receive a certificate from the CA from the previous request. Specify from 1 to 100. The default is 0, which indicates that there is no limit to the number of times the PIX Firewall should contact the CA to obtain a pending certificate.

crloptional

Allows other peers' certificates be accepted by your PIX Firewall even if the appropriate Certificate Revocation List (CRL) is not accessible to your PIX Firewall. The default is without crloptional.

challenge_password

A required password that gives the CA administrator some authentication when a user calls to ask for a certificate to be revoked. It can be up to 80 characters in length.

serial

Specify the PIX Firewall's serial number.

ipaddress

The PIX Firewall's IP address.

key

This specifies that one general-purpose RSA key pair will be generated.

specialkey

This specifies that two special-purpose RSA key pairs will be generated instead of one general-purpose key.

key_modulus_size

The size of the key modulus, which is between 512 and 2048 bits. Choosing a size greater than 1024 bits may cause key generation to take a few minutes.

ca_ipaddress

The CA's IP address.

:ca_script_location

The default location and script on the CA server is /cgi-bin/pkiclient.exe. If the CA administrator has not put the CGI script in the above location, provide the location and the name of the script in the ca identity command.

A PIX Firewall uses a subset of the HTTP protocol to contact the CA, and so it must identify a particular cgi-bin script to handle CA requests.

ldap_ipaddress

The IP address of the Lightweight Directory Access Protocol (LDAP) server.

By default, querying of a certificate or a CRL is done via Cisco's PKI protocol. If the CA supports LDAP, query functions may also use LDAP.


Usage Guidelines

ca authenticate

The ca authenticate command allows the PIX Firewall to authenticate its CA by obtaining the CA's self-signed certificate, which contains the CA's public key.

In order to authenticate a peer's certificate(s), a PIX Firewall must obtain the CA certificate containing the CA public key. Because the CA certificate is a self-signed certificate, the key should be authenticated manually by contacting the CA administrator. You are given the choice of authenticating the public key in that certificate by including within the ca authenticate command the key's fingerprint, which is retrieved in some out-of-band process. The PIX Firewall will discard the received CA certificate and generate an error message, if the fingerprint you specified is different from the received one. You can also simply compare the two fingerprints without having to enter the key within the command.

If you are using RA mode (within the ca configure command), when you issue the ca authenticate command, the RA signing and encryption certificates will be returned from the CA, as well as the CA certificate.

The ca authenticate command is not saved to the PIX Firewall configuration. However, the public keys embedded in the received CA (and RA) certificates are saved in the configuration as part of the RSA public key record (called the "RSA public key chain"). To save the public keys permanently to Flash memory, use the ca save all command.

To view the CA's certificate, use the show ca certificate command.

Note   If the CA does not respond by a timeout period after this command is issued, the terminal control will be returned so it will not be tied up. If this happens, you must re-enter the command.

Example

In this example, a request for the CA's certificate was sent to the CA. The fingerprint was not included in the command. The CA sends its certificate and the PIX Firewall prompts for verification of the CA's certificate by checking the CA certificate's fingerprint. Using the fingerprint associated with the CA's certificate retrieved in some out-of-band process from a CA administrator, compare the two fingerprints. If both fingerprints match, then the certificate is considered valid. 

ca authenticate myca

Certificate has the following attributes:

Fingerprint: 0123 4567 89AB CDEF 0123

The following example shows the error message. This time, the fingerprint is included in the command. The two fingerprints do not match, and therefore the certificate is not valid. 

ca authenticate myca 0123456789ABCDEF0123


Certificate has the following attributes:

Fingerprint: 0123 4567 89AB CDEF 5432

%Error in verifying the received fingerprint. Type help or `?' for a list of 
available commands.

ca configure

The ca configure command is used to specify the communication parameters between the PIX Firewall and the CA.

Use the no ca configure command to reset each of the communication parameters to the default value. If you want to show the current settings stored in RAM, use the show ca configure command.

Example

The following example indicates myca is the name of the CA and the CA will be contacted rather than the RA. It also indicates the PIX Firewall will wait 5 minutes before sending another certificate request, if it does not receive a response, and will resend a total of 15 times before dropping its request. If the CRL is not accessible, crloptional tells the PIX Firewall to accept other peer's certificates. 

ca configure myca ca 5 15 [crloptional]

ca crl request

The ca crl request command allows the PIX Firewall to obtain an updated CRL from the CA at any time.

A PIX Firewall automatically requests a CRL from the CA at various times, depending on whether the CA is in the RA mode or not. If the CA is not in the RA mode, a CRL is requested whenever the system reboots and finds that it does not already contain a valid (un-expired) CRL. If the CA is in the RA mode, no CRL can be obtained until a peer's certificate is sent via an ISAKMP exchange. This is because the certificate itself contains the location where the PIX Firewall must query to get the appropriate CRL. When a CRL expires, the PIX Firewall automatically requests an updated one. Until a new valid CRL is obtained, the PIX Firewall will not acc