Table Of Contents
D through F Commands
debug
You can debug packets or ICMP tracings through the PIX Firewall. The debug command provides information that helps troubleshoot protocols operating with and through the PIX Firewall.
[no] debug aaa [authentication | authorization| accounting | internal]
[no] debug access-list all | standard | turbo
[no] debug arp
[no] debug crypto ca [level]
[no] debug ctiqbe
[no] debug crypto ipsec [level]
[no] debug crypto isakmp [level]
[no] debug crypto vpnclient
[no] debug dhcpc detail | error | packet
[no] debug dhcpd event | packet
[no] debug dhcprelay event | packet | error
[no] debug dns {resolver | all}
[no] debug fixup {udp | tcp}
[no] debug fover option
[no] debug h323 h225 [asn | event]
[no] debug h323 h245 [asn | event]
[no] debug h323 ras [asn | event]
[no] debug icmp trace
[no] debug ils
[no] debug ospf [adj | database-timer | events |f lood | lsa-generation | packet | tree | retransmission | spf [external | internal |intra]]
[no] debug mgcp [messages | parser | sessions]
[no] debug ntp [adjust | authentication | events | loopfilter | packets | params | select | sync | validity]
[no] debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]] [[proto icmp] | [proto tcp [sport src_port] [dport dest_port]] | [proto udp [sport src_port] [dport dest_port]] [rx | tx | both]
[no] debug pdm history
[no] debug ppp error | io | uauth | upap | chap | negotiation
[no] debug pppoe event | error | packet
[no] deubg pptp
[no] debug radius [session | all | user username]
[no] debug rip
[no] debug route
[no] debug rtsp
[no] debug sip
[no] debug skinny
[no] debug sqlnet
[no] debug ssh
[no] debug ssl [cypher | device]
[no] debug vpdn event | error | packet
[no] debug xdmcp
no debug all
undebug all
show debug
Syntax Description
aaa
Displays authentication, authorization, and accounting information.
access-list
Displays access list configuration information.
adjust
Displays NTP clock adjustments.
all
Displays both standard and TurboACL access list information.
authentication
Displays NTP clock authentication.
both
Displays both received and transmitted packets.
chap
Displays CHAP/MS-CHAP authentication.
crypto ca
Displays information about certification authority (CA) traffic.
crypto ipsec
Displays information about IPSec traffic.
crypto isakmp
Displays information about IKE traffic.
crypto vpnclient
Displays information about the firewall EasyVPN client.
ctiqbe
Displays information about CTI Quick Buffer Encoding (CTIQBE), which is used with Cisco TAPI/JTAPI applications.
cypher
Display information about the cipher negotiation between the HTTP server and the client.
device
Displays information about the SSL device including session initiation and ongoing status.
dhcpc detail
Displays detailed information about the DHCP client packets.
dhcpc error
Displays error messages associated with the DHCP client.
dhcpc packet
Displays packet information associated with the DHCP client.
dhcpd event
Displays event information associated with the DHCP server.
dhcpd packet
Displays packet information associated with the DHCP server.
dhcprelay
Displays DHCP Relay Agent information.
dns {resolver | all}
Displays DNS debugging information. The resolver option collects DNS resolution information, and the all option collects all DNS information.
dport dest_port
Destination port.
dst dest_ip
Destination IP address.
events
Displays NTP event information.
fixup {udp | tcp}
Displays fixup information, using either UDP or TCP.
fover option
Displays failover information. Refer to Table 5-1 for the options.
h225 asn
Displays the output of the decoded PDUs.
h225 events
Displays the events of the H.225 signaling, or turn both traces on.
h245 asn
Displays the output of the decoded PDUs.
h245 events
Displays the events of the H.245 signaling, or turn both traces on.
h323
Displays information about the packet-based multimedia communications systems standard.
icmp
Displays information about ICMP traffic.
if_name
Interface name from which the packets are arriving; for example, to monitor packets coming into the PIX Firewall from the outside, set if_name to outside.
ils
Displays Internet Locator Service (ILS) fixup information (used in LDAP services).
level
The level of debugging feedback. The higher the level number, the more information is displayed. The default level is 1. The levels correspond to the following events:
•
Level 1: Interesting events
•
•
Refer to the "Examples" section at the end of this command page for an example of how the debugging level appears within the show debug command.
loopfilter
Displays NTP loop filter information.
messages
Displays debug information for MGCP messages.
negotiation
Equivalent of the error, uauth, upap and chap debug command options.
netmask mask
Network mask.
packet
Displays packet information.
packets
Displays NTP packet information.
params
Displays NTP clock parameters.
parser
Displays debug information about parsing MGCP messages.
pdm history
Turns on the PDM history metrics debugging information. The no version of this command disables PDM history metrics debugging.
ppp
Debugs L2TP or PPTP traffic, which is configured with the vpdn command.
ppp error
Displays L2TP or PPTP PPP virtual interface error messages.
ppp io
Display the packet information for L2TP or PPTP PPP virtual interface.
ppp uauth
Displays the L2TP or PPTP PPP virtual interface AAA user authentication debugging messages.
pppoe error
Displays PPPoE error messages.
pppoe event
Displays PPPoE event information.
pppoe packet
Displays PPPoE packet information.
pptp
Displays PPTP traffic information.
proto icmp
Displays ICMP packets only.
proto tcp
Displays TCP packets only.
proto udp
Displays UDP packets only.
radius all
Enables all RADIUS debug options.
radius session
Logs RADIUS session information and the attributes of sent and received RADIUS packets.
ras asn
Displays the output of the decoded PDUs.
ras events
Displays the events of the RAS signaling, or turn both traces on.
route
Displays information from the PIX Firewall routing module.
rx
Displays only packets received at the PIX Firewall.
select
Displays NTP clock selections.
sessions
Displays debug information for MGCP sessions.
sip
Debug the fixup Session Initiation Protocol (SIP) module.
skinny
Debugs SCCP protocol activity. (Using this option is system-resources intensive and may impact performance on high traffic network segments.)
sport src_port
Source port. See the "Ports" section in ""Using PIX Firewall Commands" for a list of valid port literal names.
sqlnet
Debugs SQL*Net traffic.
src source_ip
Source IP address.
ssh
Debug information and error messages associated with the ssh command.
ssl
Debug information and error messages associated with the ssl command.
standard
Displays non-TurboACL access list information.
sync
Displays NTP clock synchronization.
turbo
Displays TurboACL access list information.
tx
Displays only packets that were transmitted from the PIX Firewall.
upap
Displays PAP authentication.
user username
Specifies to display information for an individual username only.
validity
Displays NTP peer clock validity.
vpdn error
Display L2TP or PPTP protocol error messages.
vpdn event
Display L2TP or PPTP tunnel event change information.
vpdn packet
Display L2TP or PPTP packet information about PPTP traffic.
xdmcp
Display information about the xdmcp negotiation
Defaults
MGCP debugging is disabled by default.
Command Modes
Configuration mode unless otherwise specified.
The debug mgcp command is available in privileged mode.
Usage Guidelines
The debug command lets you view debug information. The show debug command displays the current state of tracing. You can debug the contents of network layer protocol packets with the debug packet command.
Note
Use of the debug packet command on a PIX Firewall experiencing a heavy load may result in the output displaying so fast that it may be impossible to stop the output by entering the no debug packet command from the console. You can enter the no debug packet command from a Telnet session.
To let users ping through the PIX Firewall, add the access-list acl_grp permit icmp any any command statement to the configuration and bind it to each interface you want to test with the access-group command. This lets pings go outbound and inbound.
To stop a debug packet trace command, enter the following command:
no debug packet if_nameReplace if_name with the name of the interface; for example, inside, outside, or a perimeter interface name.
no debug all and undebug all
The no debug all and undebug all commands stop any and all debug messages from being displayed.
debug crypto
When creating your digital certificates, use the debug crypto ca command to ensure that the certificate is created correctly. Important error messages only display when the debug crypto ca command is enabled. For example, if you enter an Entrust fingerprint value incorrectly, the only warning message that indicates the value is incorrect appears in the debug crypto ca command output.
Output from the debug crypto ipsec and debug crypto isakmp commands does not display in a Telnet console session.
debug dhcpc
The debug dhcpc detail command displays detailed packet information about the DHCP client. The debug dhcpc error command displays DHCP client error messages. The debug dhcpc packet command displays packet information about the DHCP client. Use the no form of the debug dhcpc command to disable debugging.
The debug dhcpd event command displays event information about the DHCP server. The debug dhcpd packet command displays packet information about the DHCP server. Use the no form of the debug dhcpd commands to disable debugging.
debug h323
The debug h323 command lets you debug H.323 connections. Use the no form of the command to disable debugging. This command works when the fixup protocol h323 command is enabled.
Note
debug icmp
The debug icmp trace command shows ICMP packet information, the source IP address, and the destination address of packets arriving, departing, and traversing the PIX Firewall including pings to the PIX Firewall unit's own interfaces.
To stop a debug icmp trace command, enter the following command:
no debug icmp tracedebug mgcp
The debug mgcp command displays debug information for Media Gateway Control Protocol (MGCP) traffic. Without any options explicitly specified, the debug mgcp command enables all three MGCP debug options. The no debug mgcp command, without any options explicitly specified, disables all MGCP debugging.
debug ospf
The debug ospf command enables all OSPF debugging options, and the no debug ospf command disables all OSPF debugging options.
The debug ospf spf command enables all SPF options, and the no debug ospf spf command disables all SPF options.
debug sqlnet
The debug sqlnet command reports on traffic between Oracle SQL*Net clients and servers through the PIX Firewall.
debug ssh
The debug ssh command reports on information and error messages associated with the ssh command.
debug pptp
The debug pptp and debug vpdn commands provide information about PPTP traffic. PPTP is configured with the vpdn command.
debug fover
Table 5-1 lists the options for the debug fover command.
Trace Channel Feature
The debug packet command sends its output to the Trace Channel. All other debug commands do not. Use of Trace Channel changes the way you can view output on your screen during a PIX Firewall console or Telnet session.
If a debug command does not use Trace Channel, each session operates independently, which means any commands started in the session only appear in the session. By default, a session not using Trace Channel has output disabled by default.
The location of the Trace Channel depends on whether you have a simultaneous Telnet console session running at the same time as the console session, or if you are using only the PIX Firewall serial console:
•
•
•
The debug commands, except the debug crypto commands, are shared between all Telnet and serial console sessions.
Note
Examples
The following is partial sample output from the debug dhcpc packet and the debug dhcpc detail commands. The ip address dhcp setroute command was configured after entering the debug dhcpc commands to obtain debugging information.
debug dhcpc packetdebug dhcpc detailip address outside dhcp setrouteDHCP:allocate requestDHCP:new entry. add to queueDHCP:new ip lease str = 0x80ce8a28DHCP:SDiscover attempt # 1 for entry:Temp IP addr:0.0.0.0 for peer on Interface:outsideTemp sub net mask:0.0.0.0DHCP Lease server:0.0.0.0, state:1 SelectingDHCP transaction id:0x8931Lease:0 secs, Renewal:0 secs, Rebind:0 secsNext timer fires after:2 secondsRetry count:1 Client-ID:cisco-0000.0000.0000-outsideDHCP:SDiscover:sending 265 byte length DHCP packetDHCP:SDiscover 265 bytesDHCP Broadcast to 255.255.255.255 from 0.0.0.0DHCP client msg received, fip=10.3.2.2, fport=67DHCP:Received a BOOTREP pktDHCP:Scan:Message type:DHCP OfferDHCP:Scan:Server ID Option:10.1.1.69 = 450A44ABDHCP:Scan:Server ID Option:10.1.1.69 = 450A44ABDHCP:Scan:Lease Time:259200DHCP:Scan:Subnet Address Option:255.255.254.0DHCP:Scan:DNS Name Server Option:10.1.1.70, 10.1.1.140DHCP:Scan:Domain Name:example.comDHCP:Scan:NBNS Name Server Option:10.1.2.228, 10.1.2.87DHCP:Scan:Router Address Option:10.3.2.1DHCP:rcvd pkt source:10.3.2.2, destination: 255.255.255.255...The following example executes the debug icmp trace command:
debug icmp traceWhen you ping a host through the PIX Firewall from any interface, trace output displays on the console. The following example shows a successful ping from an external host (209.165.201.2) to the PIX Firewall unit's outside interface (209.165.201.1).
Inbound ICMP echo reply (len 32 id 1 seq 256) 209.165.201.1 > 209.165.201.2Outbound ICMP echo request (len 32 id 1 seq 512) 209.165.201.2 > 209.165.201.1Inbound ICMP echo reply (len 32 id 1 seq 512) 209.165.201.1 > 209.165.201.2Outbound ICMP echo request (len 32 id 1 seq 768) 209.165.201.2 > 209.165.201.1Inbound ICMP echo reply (len 32 id 1 seq 768) 209.165.201.1 > 209.165.201.2Outbound ICMP echo request (len 32 id 1 seq 1024) 209.165.201.2 > 209.165.201.1Inbound ICMP echo reply (len 32 id 1 seq 1024) 209.165.201.1 > 209.165.201.2NO DEBUG ICMP TRACEICMP trace offThis example shows that the ICMP packet length is 32 bytes, the ICMP packet identifier is 1, and the ICMP sequence number. The ICMP sequence number starts at 0 and is incremented each time a request is sent.
The following is sample output from the show debug command output:
show debugdebug ppp errordebug vpdn eventdebug crypto ipsec 1debug crypto isakmp 1debug crypto ca 1debug icmp tracedebug packet outside bothdebug sqlnetThe preceding sample output includes the debug crypto commands.
The following example shows debugging messages for Unity client negotiation using Diffie-Hellman group 5:
pixfirewall(config)# debug crypto isakmpcheck_isakmp_proposal:is_auth_policy_configured: auth 1is_auth_policy_configured: auth 4ISAKMP (0): Checking ISAKMP transform 1 against priority 8 policyISAKMP: encryption 3DES-CBCISAKMP: hash SHAISAKMP: default group 5ISAKMP: extended auth RSA sigISAKMP: life type in secondsISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9bISAKMP (0): atts are not acceptable. Next payload is 3ISAKMP (0): Checking ISAKMP transform 2 against priority 8 policyISAKMP: encryption 3DES-CBCISAKMP: hash MD5ISAKMP: default group 5ISAKMP: extended auth RSA sigISAKMP: life type in secondsISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9bISAKMP (0): atts are not acceptable. Next payload is 3ISAKMP (0): Checking ISAKMP transform 3 against priority 8 policyISAKMP: encryption 3DES-CBCISAKMP: hash SHAISAKMP: default group 5ISAKMP: auth RSA sigISAKMP: life type in secondsISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9bISAKMP (0): atts are not acceptable. Next payload is 3ISAKMP (0): Checking ISAKMP transform 4 against priority 8 policyISAKMP: encryption 3DES-CBCISAKMP: hash MD5ISAKMP: default group 5ISAKMP: auth RSA sigISAKMP: life type in secondsISAKMP: life duration (VPI) of 0x0 0x20 0xc4 0x9bISAKMP (0): atts are acceptable. Next payload is 3
The following example shows possible output for the debug mgcp messages command:
17: MGCP: Retransmitted command RSIPGateway IP gate-1Transaction ID 118: MGCP: Expired command RSIPGateway IP gate-1Transaction ID 119: MGCP: New command RSIPGateway IP gate-1Transaction ID 1Endpoint name d001Call IDConnection IDMedia IP 0.0.0.0Media port 0Flags 0x8020: MGCP: Retransmitted command RSIPGateway IP gate-1Transaction ID 1The following example shows possible output for the debug mgcp parser command:
28: MGCP packet:RSIP 1 d001@10.10.10.11 MGCP 1.0RM: restart29: MGCP: command verb - RSIP30: MGCP: transaction ID - 131: MGCP: endpoint name - d00132: MGCP: header parsing succeeded33: MGCP: restart method - restart34: MGCP: payload parsing succeeded35: MGCP packet:RSIP 1 d001@10.10.10.11 MGCP 1.0RM: restart36: MGCP: command verb - RSIP37: MGCP: transaction ID - 138: MGCP: endpoint name - d00139: MGCP: header parsing succeeded40: MGCP: restart method - restart41: MGCP: payload parsing succeededThe following example shows possible output for the debug mgcp sessions command:
91: NAT::requesting UDP conn for generic-pc-2/6166 [209.165.202.128/0]from dmz/ca:generic-pc-2/2427 to outside:generic-pc-1/272792: NAT::reverse route: embedded host at dmz/ca:generic-pc-2/616693: NAT::table route: embedded host at outside:209.165.202.128/094: NAT::pre-allocate connection for outside:209.165.202.128 to dmz/ca:generic-pc-2/616695: NAT::found inside xlate from dmz/ca:generic-pc-2/0 to outside:209.165.201.15/096: NAT::outside NAT not needed97: NAT::created UDP conn dmz/ca:generic-pc-2/6166 <-> outside:209.165.202.128/098: NAT::created RTCP conn dmz/ca:generic-pc-2/6167 <-> outside:209.165.202.128/099: NAT::requesting UDP conn for 209.165.202.128/6058 [generic-pc-2/0]from dmz/ca:genericgeneric-pc-2/2427 to outside:generic-pc-1/2727100: NAT::table route: embedded host at outside:209.165.202.128/6058101: NAT::reverse route: embedded host at dmz/ca:generic-pc-2/0102: NAT::pre-allocate connection for dmz/ca:generic-pc-2 to outside:209.165.202.128/6058103: NAT::found inside xlate from dmz/ca:generic-pc-2/0 to outside:209.165.201.15/0104: NAT::outside NAT not needed105: NAT::created UDP conn dmz/ca:generic-pc-2/0 <-> outside:209.165.202.128/6058106: NAT::created RTCP conn dmz/ca:generic-pc-2/0 <-> outside:209.165.202.128/6059107: MGCP: New sessionGateway IP generic-pc-2Call ID 9876543210abcdefConnection ID 6789af54c9Endpoint name aaln/1Media lcl port 6166Media rmt IP 209.165.202.128Media rmt port 6058108: MGCP: Expired session, active 0:06:05Gateway IP generic-pc-2Call ID 9876543210abcdefConnection ID 6789af54c9Endpoint name aaln/1Media lcl port 6166Media rmt IP 209.165.202.128Media rmt port 6058You can debug the contents of packets with the debug packet command:
debug packet inside--------- PACKET ----------- IP --4.3.2.1 ==> 255.3.2.1ver = 0x4 hlen = 0x5 tos = 0x0 tlen = 0x60id = 0x3902 flags = 0x0 frag off=0x0ttl = 0x20 proto=0x11 chksum = 0x5885-- UDP --source port = 0x89 dest port = 0x89len = 0x4c checksum = 0xa6a0-- DATA --00000014: 00 01 00 00 |....00000024: 00 00 00 01 20 45 49 45 50 45 47 45 47 45 46 46 | .... EIEPEGEGEFF00000034: 43 43 4e 46 41 45 44 43 41 43 41 43 41 43 41 43 | CCNFAEDCACACACAC00000044: 41 43 41 41 41 00 00 20 00 01 c0 0c 00 20 00 01 | ACAAA.. ..... ..00000054: 00 04 93 e0 00 06 60 00 01 02 03 04 00 | ......`......--------- END OF PACKET ---------This display lists the information as it appears in a packet.
The following is sample output from the show debug command:
show debugdebug icmp trace offdebug packet offdebug sqlnet offRelated Commands
dhcpd
Configures the DHCP server.
[no] dhcpd address ip1[-ip2] if_name
[no] dhcpd auto_config [outside]
[no] dhcpd dns dns1 [dns2]
[no] dhcpd wins wins1 [wins2]
[no] dhcpd lease lease_length
[no] dhcpd domain domain_name
[no] dhcpd enable if_name
[no] dhcpd option 66 ascii {server_name | server_ip_str}
[no] dhcpd option 150 ip server_ip1 [ server_ip2]
no dhcpd option code
[no] dhcpd ping_timeout timeout
[no] debug dhcpd event
[no] debug dhcpd packet
clear dhcpd [binding|statistics]
show dhcpd [binding|statistics]
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
A DHCP server provides network configuration parameters to a DHCP client. Support for the DHCP server within the PIX Firewall means the PIX Firewall can use DHCP to configure connected clients. This DHCP feature is designed for the remote home or branch office that will establish a connection to an enterprise or corporate network. See the Cisco PIX Firewall and VPN Configuration Guide for information on how to implement the DHCP server feature into the PIX Firewall.
You must specify an interface name, if_name, for all DHCP server commands when using PIX Firewall software Version 6.3. In earlier software versions, only the inside interface could be configured as the DHCP server so there was no need to specify if_name.
Note
The dhcpd address ip1[-ip2] if_name command specifies the DHCP server address pool. The address pool of a PIX Firewall DHCP server must be within the same subnet of the PIX Firewall interface that is enabled and you must specify the associated PIX Firewall interface with the if_name. In other words, the client must be physically connected to the subnet of a PIX Firewall interface. The size of the pool is limited to 32 addresses with a 10-user license and 128 addresses with a 50-user license on the PIX 501. The unlimited user license on the PIX 501 and all other PIX Firewall platforms support 256 addresses.
Note
Use caution with names that contain a "-" (dash) character because the dhcpd address command interprets the last (or only) "-" character in the name as a range specifier instead of as part of the name. For example, the dhcpd address command treats the name "host-net2" as a range from "host" to "net2". If the name is "host-net2-section3" then it is interpreted as a range from "host-net2" to "section3".
The no dhcpd address command removes the DHCP server address pool you configured.
The dhcpd lease command specifies the length of the lease in seconds granted to the DHCP client. This lease indicates how long the DHCP client can use the assigned IP address the DHCP granted. The no dhcpd lease command removes the lease length that you specified from your configuration and replaces this value with the default value of 3600 seconds.
The dhcpd domain command specifies the DNS domain name for the DHCP client. For example, example.com. The no dhcpd domain command removes the DNS domain server from your configuration.
The dhcpd enable if_name command enables the DHCP daemon to begin to listen for the DHCP client requests on the DHCP-enabled interface. The no dhcpd enable command disables the DHCP server feature on the specified interface.
DHCP must be enabled to use this command. Use the dhcpd enable if_name command to turn on DHCP.
Note
The dhcpd option 66 | 150 command retrieves TFTP server address information for Cisco IP Phone connections.
When a dhcpd option command request arrives at the PIX Firewall DHCP server, the PIX Firewall places the value(s) specified by the dhcpd option 66 | 150 in the response.
Use the dhcpd option code command as follows:
•
•
•
The show dhcpd command displays dhcpd commands, binding and statistics information associated with all of the dhcpd commands.
The clear dhcpd command clears all of the dhcpd commands, binding, and statistics information.
The debug dhcpd event command displays event information about the DHCP server. The debug dhcpd packet command displays packet information about the DHCP server. Use the no form of the debug dhcpd commands to disable debugging.
Examples
The following partial configuration example shows how to use the dhcpd address, dhcpd dns, and dhcpd enable if_name commands to configure an address pool for the DHCP clients and a DNS server address for the DHCP client, and how to enable the dmz interface of the PIX Firewall for the DHCP server function.
dhcpd address 10.0.1.100-10.0.1.108 dmzdhcpd dns 209.165.200.226dhcpd enable dmzThe following partial configuration example shows how to define a DHCP pool of 253 addresses and use the auto_config command to configure the DNS, WINS, and DOMAIN parameters. Note that the dmz interface of the firewall is configured as the DHCP server, and the netmask of the dmz interface is 255.255.254.0:
ip address dmz 10.0.1.1 255.255.254.0dhcpd address 10.0.1.2-10.0.1.254 dmzdhcpd auto_config outsidedhcpd enable dmzThe following partial configuration example shows how to use three new features that are associated with each other: DHCP server, DHCP client, and PAT using interface IP to configure a PIX Firewall in a small office, home office (SOHO) environment with the inside interface as the DHCP server:
! use dhcp to configure the outside interface and default routeip address outside dhcp setroute! enable dhcp server daemon on the inside interfaceip address inside 10.0.1.2 255.255.255.0dhcpd address 10.0.1.100-10.0.1.108 insidedhcpd dns 209.165.201.2 209.165.202.129dhcpd wins 209.165.201.5dhcpd lease 3600dhcpd domain example.comdhcpd enable inside! use outside interface IP as PAT global addressnat (inside) 1 0 0global (outside) 1 interfaceThe following is sample output from the show dhcpd command:
pixfirewall(config)# show dhcpddhcpd address 10.0.1.100-10.0.1.108 insidedhcpd lease 3600dhcpd ping_timeout 750dhcpd dns 209.165.201.2 209.165.202.129dhcpd enable insideThe following is sample output from the show dhcpd binding command:
pixfirewall(config)# show dhcpd bindingIP Address Hardware Address Lease Expiration Type10.0.1.100 0100.a0c9.868e.43 84985 seconds automaticThe following is sample output from the show dhcpd statistics command:
show dhcpd statisticsAddress Pools 1Automatic Bindings 1Expired Bindings 1Malformed messages 0Message ReceivedBOOTREQUEST 0DHCPDISCOVER 1DHCPREQUEST 2DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0Message SentBOOTREPLY 0DHCPOFFER 1DHCPACK 1DHCPNAK 1Related Commands
dhcprelay
Configures the DHCP relay agent, which relays requests between the firewall interface of the DCHP server and DHCP clients on a different firewall interface.
[no] dhcprelay enable client_ifc
[no] dhcprelay server dhcp_server_ip server_ifc
[no] dhcprelay setroute client_ifc
[no] dhcprelay timeout seconds
[clear|show] dhcprelay [statistics]
Syntax Description
Defaults
By default, the DHCP relay agent is disabled.
The default DHCP relay timeout value is 60 seconds.
Command Modes
Configuration mode. The show dhcprelay commands are also available in privileged mode.
Usage Guidelines
Use the dhcprelay enable, dhcprelay server, and dhcprelay timeout commands to configure the DHCP relay agent to relay requests between the firewall interface of the DCHP server and DHCP clients on a different firewall interface.
Note
dhcprelay enable
For the firewall to start the DHCP relay agent with the dhcprelay enable client_ifc command, you must have a dhcprelay server command already in your configuration. Otherwise, the firewall displays an error message similar to the following:
DHCPRA:Warning - There are no DHCP servers configured!No relaying can be done without a server!Use the 'dhcprelay server <server_ip> <server_ifc>' commandThe dhcprelay enable client_ifc command starts a DHCP server task on the specified interface. If this dhcprelay enable command is the first dhcprelay enable command to be issued, and there are dhcprelay server commands in the configuration, then the ports for the DHCP servers referenced are opened and the DHCP relay task starts.
When a dhcprelay enable client_ifc command is removed with a no dhcprelay enable client_ifc command, the DHCP server task for that interface stops. When the dhcprelay enable command being removed is the last dhcprelay enable command in the configuration, all of the ports for the servers specified in the dhcprelay server commands are closed and the DHCP relay task stops.
dhcprelay server
Add at least one dhcprelay server command to your firewall configuration before you enter a dhcprelay enable command or the firewall will issue an error message.
The dhcprelay server command opens a UDP port 67 on the specified interface for the specified server and starts the DHCP relay task as soon as a dhcprelay enable command is added to the configuration. If there is no dhcprelay enable command in the configuration, then the sockets are not opened and the DHCP relay task does not start.
When a dhcprelay server dhcp_server_ip [server_ifc] command is removed, the port for that server is closed. If the dhcprelay server command being removed is the last dhcprelay server command in the configuration, then the DHCP relay task stops.
dhcprelay setroute
The dhcprelay setroute client_ifc command enables you to configure the DHCP Relay Agent to change the first default router address (in the packet sent from the DHCP server) to the address of client_ifc. That is, the DHCP Relay Agent substitutes the address of the default router with the address of client_ifc.
If there is no default router option in the packet, the firewall adds one containing the address of client_ifc. This allows the client to set its default route to point to the firewall.
When the dhcprelay setroute client_ifc command is not configured (and there is a default router option in the packet) it passes through the firewall with the router address unaltered.
dhcprelay timeout
The dhcprelay timeout command sets the amount of time, in seconds, allowed for responses from the DHCP server to pass to the DHCP client through the relay binding structure.
no dhcprelay commands
The no dhcprelay enable client_ifc command removes the DHCP relay agent configuration for the interface specified by client_ifc only.
The no dhcprelay server dhcp_server_ip [server_ifc] command removes the DHCP relay agent configuration for the DHCP server and specified by dhcp_server_ip [server_ifc] only.
show dhcprelay
The show dhcprelay command displays the DHCP relay agent configuration, and the show dhcprelay statistics command displays counters for the packets relayed by the DHCP relay agent.
The clear dhcprelay command clears all DHCP relay configurations. The clear dhcprelay statistics command clears the show dhcprelay statistics counters.
Examples
The following example configures the DHCP relay agent for a DHCP server with the IP address of 10.1.1.1 on the outside interface of the firewall and client requests on the inside interface of the firewall, and sets the timeout value to 90 seconds:
pixfirewall(config)# dhcprelay server 10.1.1.1 outsidepixfirewall(config)# show dhcprelaydhcprelay server 10.1.1.1 outsidedhcprelay timeout 50pixfirewall(config)# dhcprelay timeout 60pixfirewall(config)# show dhcprelaydhcprelay server 10.1.1.1 outsidedhcprelay timeout 60pixfirewall(config)# dhcprelay enable insidepixfirewall(config)# show dhcprelaydhcprelay server 10.1.1.1 outsidedhcprelay enable insidedhcprelay timeout 60The following example shows how to disable the DHCP relay agent if there is only one dhcprelay enable command in the configuration:
pixfirewall(config)# no dhcprelay enablepixfirewall(config)# show dhcprelaydhcprelay server 10.1.1.1 outsidedhcprelay timeout 60The following is sample output from the show dhcprelay statistics command:
pixfirewall(config)# show dhcprelay statisticsPackets RelayedBOOTREQUEST 0DHCPDISCOVER 7DHCPREQUEST 3DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0BOOTREPLY 0DHCPOFFER 7DHCPACK 3DHCPNAK 0Related Commands
disable
Exit privileged mode and return to unprivileged mode.
enable
disable
Syntax Description
enable
Enter this at the PIX Firewall command-line interface prompt to enter privileged mode.
disable
Enter this at the PIX Firewall command-line interface prompt to exit privileged mode.
Command Modes
Privileged mode.
Usage Guidelines
Use the enable command to enter privileged mode. The disable command exits privileged mode and returns you to unprivileged mode.
Examples
The following example shows how to enter privileged mode:
pixfirewall> enablepixfirewall#
