Table Of Contents
G through L Commands
global
Create or delete entries from a pool of global addresses.
[no] global [(if_name)] nat_id {global_ip [-global_ip] [netmask global_mask]} | interface
clear global
show global
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The global command defines a pool of global addresses. The global addresses in the pool provide an IP address for each outbound connection, and for those inbound connections resulting from outbound connections. Ensure that associated nat and global command statements have the same nat_id.
When used on a PPPoE interface, the global command should explicitly include a netmask. Otherwise, the 255.255.255.255 netmask, assigned to the interface by PPPoE, is used as the broadcast mask. In that case, all addresses in the global pool may become broadcast addresses and will become unusable for address translation.
Use caution with names that contain a "-" (dash) character because the global command interprets the last (or only) "-" character in the name as a range specifier instead of as part of the name. For example, the global command treats the name "host-net2" as a range from "host" to "net2". If the name is "host-net2-section3" then it is interpreted as a range from "host-net2" to "section3".
The following command form is used for Port Address Translation (PAT) only:
global [(if_name)] nat_id {{global_ip} [netmask global_mask] | interface}After changing or removing a global command statement, use the clear xlate command.
Use the no global command to remove access to a nat_id, or to a Port Address Translation (PAT) address, or address range within a nat_id.
The show global command displays the global command statements in the configuration.
PAT
You can enable the Port Address Translation (PAT) feature by entering a single IP address with the global command. PAT lets multiple outbound sessions appear to originate from a single IP address. With PAT enabled, the PIX Firewall chooses a unique port number from the PAT IP address for each outbound xlate (translation slot). This feature is valuable when an Internet service provider cannot allocate enough unique IP addresses for your outbound connections. An IP address you specify for a PAT cannot be used in another global address pool.
When a PAT augments a pool of global addresses, first the addresses from the global pool are used, then the next connection is taken from the PAT address. If a global pool address is available, the next connection takes that address. The global pool addresses always come first, before a PAT address is used. Augment a pool of global addresses with a PAT by using the same nat_id in the global command statements that create the global pools and the PAT.
For example:
global (outside) 1 209.165.201.1-209.165.201.10 netmask 255.255.255.224global (outside) 1 209.165.201.22 netmask 255.255.255.224PAT does not work with H.323 applications and caching nameservers. Do not use a PAT when multimedia applications need to be run through the PIX Firewall. Multimedia applications can conflict with port mappings provided by PAT.
The firewall does not PAT all ICMP message types; it only PATs ICMP echo and echo-reply packets (types 8 and 0). Specifically, only ICMP echo or echo-reply packets create a PAT xlate. So, when the other ICMP messages types are dropped, syslog message 305006 (on the PIX Firewall) is generated.
PAT does not work with the established command. PAT works with DNS, FTP and passive FTP, HTTP, email, RPC, rshell, Telnet, URL filtering, and outbound traceroute.
However, for use with passive FTP, use the fixup protocol ftp strict command statement with an access-list command statement to permit outbound FTP traffic, as shown in the following example:
fixup protocol ftp strict ftpaccess-list acl_in permit tcp any any eq ftpaccess-group acl_in in interface insidenat (inside) 1 0 0global (outside) 1 209.165.201.5 netmask 255.255.255.224To specify PAT using the IP address of an interface, specify the interface keyword in the global [(int_name)] nat_id address | interface command.
The following example enables PAT using the IP address at the outside interface in global configuration mode:
ip address outside 192.150.49.1nat (inside) 1 0 0global (outside) 1 interfaceThe interface IP address used for PAT is the address associated with the interface when the xlate (translation slot) is created. This is important for configuring DHCP, allowing for the DHCP retrieved address to be used for PAT.
When PAT is enabled on an interface, there should be no loss of TCP, UDP, and ICMP services. These services allow for termination at the PIX Firewall unit's outside interface.
To track usage among different subnets, you can specify multiple PATs using the following supported configurations:
The following example maps hosts on the internal network 10.1.0.0/24 to global address 192.168.1.1 and hosts on the internal network 10.1.1.1/24 to global address 209.165.200.225 in global configuration mode.
nat (inside) 1 10.1.0.0 255.255.255.0nat (inside) 2 10.1.1.0 255.255.255.0global (outside) 1 192.168.1.1 netmask 255.255.255.0global (outside) 2 209.165.200.225 netmask 255.255.255.224The following example configures two port addresses for setting up PAT on hosts from the internal network 10.1.0.0/16 in global configuration mode.
nat (inside) 1 10.1.0.0 255.255.0.0global (outside) 1 209.165.200.225 netmask 255.255.255.224global (outside) 1 192.168.1.1 netmask 255.255.255.0With this configuration, address 192.168.1.1 will only be used when the port pool from address 209.165.200.225 is at maximum capacity.
PAT and DNS
IP addresses in the pool of global addresses specified with the global command require reverse DNS entries to ensure that all external network addresses are accessible through the PIX Firewall. To create reverse DNS mappings, use a DNS PTR record in the address-to-name mapping file for each global address. For more information on DNS, refer to DNS and BIND, by Paul Albitz and Cricket Liu, O'Reilly & Associates, Inc., ISBN 1-56592-010-4. Without the PTR entries, sites can experience slow or intermittent Internet connectivity and FTP requests that consistently fail. For example, if a global IP address is 209.165.201.1 and the domain for the PIX Firewall is pix.example.com, the PTR record would be as follows.
1.201.165.209.in-addr.arpa. IN PTR pix.example.comA DNS server on a higher level security interface needing to get updates from a root name server on the outside interface cannot use PAT. Instead, a static command statement must be added to map the DNS server to a global address on the outside interface.
For example, PAT is enabled with these commands:
nat (inside) 1 192.168.1.0 255.255.255.0global (inside) 1 209.165.202.128 netmask 255.255.255.224However, a DNS server on the inside at IP address 192.168.1.5 cannot correctly reach the root name server on the outside at IP address 209.165.202.130.
To ensure that the inside DNS server can access the root name server, insert the following static command statement:
static (inside,outside) 209.165.202.129 192.168.1.5The global address 209.165.202.129 provides a translated address for the inside server at IP address 192.168.1.5.
Examples
The following example declares two global pool ranges and a PAT address. Then the nat command permits all inside users to start connections to the outside network:
global (outside) 1 209.165.201.1-209.165.201.10 netmask 255.255.255.224global (outside) 1 209.165.201.12 netmask 255.255.255.224Global 209.165.201.12 will be Port Address Translatednat (inside) 1 0 0clear xlateThe next example creates a global pool from two contiguous pieces of a Class C address and gives the perimeter hosts access to this pool of addresses to start connections on the outside interface:
global (outside) 1000 209.165.201.1-209.165.201.14 netmask 255.255.255.240global (outside) 1000 209.165.201.17-209.165.201.30 netmask 255.255.255.240nat (perimeter) 1000 0 0help
Display help information.
help command
?
Syntax Description
Command Modes
Unprivileged, privileged, and configuration modes.
Usage Guidelines
The help or ? command displays help information about all commands. You can view help for an individual command by entering the command name followed by a "?"(question mark).
If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:
<--- More --->The More prompt uses syntax similar to the UNIX more command:
•
To view another screenful, press the Space bar.
•
•
Examples
The following example shows how you can display help information by following the command name with a question mark:
enable ?usage: enable password <pw> [encrypted]Help information is available on the core commands (not the show, no, or clear commands) by entering ? at the command prompt:
?aaa Enable, disable, or view TACACS+ or RADIUS user authentication, authorization and accounting...hostname
Change the host name in the PIX Firewall command-line prompt.
hostname newname
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The hostname command changes the host name label on prompts. The default host name is pixfirewall.
Note
Examples
The following example shows how to change a host name:
pixfirewall(config)# hostname spinnerspinner(config)# hostname pixfirewallpixfirewall(config)#http
Enables the PIX Firewall HTTP server and specifies the clients that are permitted to access it. Additionally, for access, the Cisco PIX Device Manager (PDM) requires that the PIX Firewall have an enabled HTTP server.
[no] http ip_address [netmask] [if_name]
[no] http server enable
clear http
show http
Syntax Description
Defaults
If you do not specify a netmask, the default is 255.255.255.255 regardless of the class of IP address. The default if_name is inside.
Command Modes
Configuration mode.
Usage Guidelines
Access from any host will be allowed if 0.0.0.0 0.0.0.0 (or 0 0) is specified for ip_address and netmask.
The show http command displays the allowed hosts and whether or not the HTTP server is enabled.
Examples
The following http command example is used for one host:
http 16.152.1.11 255.255.255.255 outsideThe following http command example is used for any host:
http 0.0.0.0 0.0.0.0 insideicmp
Configure access rules for Internet Control Message Protocol (ICMP) traffic that terminates at an interface.
[no] icmp {permit | deny} ip_address net_mask [icmp_type] if_name
clear icmp
show icmp
Syntax Description
deny
Deny access if the conditions are matched.
icmp_type
ICMP message type as described in Table 6-1.
if_name
The interface name.
ip_address
The IP address of the host sending ICMP messages to the interface.
net_mask
The mask to be applied to ip_address.
permit
Permit access if the conditions are matched.
Command Modes
Configuration mode.
Usage Guidelines
By default, the PIX Firewall denies all inbound traffic through the outside interface. Based on your network security policy, you should consider configuring the PIX Firewall to deny all ICMP traffic at the outside interface, or any other interface you deem necessary, by using the icmp command.
The icmp command controls ICMP traffic that received by the firewall. If no ICMP control list is configured, then the PIX Firewall accepts all ICMP traffic that terminates at any interface (including the outside interface), except that the PIX Firewall does not respond to ICMP echo requests directed to a broadcast address.
The icmp deny command disables pinging to an interface, and the icmp permit command enables pinging to an interface. With pinging disabled, the PIX Firewall cannot be detected on the network. This is also referred to as configurable proxy pinging.
For traffic that is routed through the PIX Firewall only, you can use the access-list or access-group commands to control the ICMP traffic routed through the PIX Firewall.
We recommend that you grant permission for ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPSec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery.
If an ICMP control list is configured, then the PIX Firewall uses a first match to the ICMP traffic followed by an implicit deny all. That is, if the first matched entry is a permit entry, the ICMP packet continues to be processed. If the first matched entry is a deny entry or an entry is not matched, PIX Firewall discards the ICMP packet and generates the %PIX-3-313001 syslog message. An exception is when an ICMP control list is not configured; in that case, a permit is assumed.
The syslog message is as follows:
%PIX-3-313001: Denied ICMP type=type, code=code from source_address on interface interface_numberIf this message appears, contact the peer's administrator.
ICMP Message Types
Table 6-1 lists possible ICMP type values.
Examples
1.
icmp permit any unreachable outsideThe default behavior of the PIX Firewall is to deny ICMP messages to the outside interface.
2.
icmp permit host 172.16.2.15 echo-reply outsideicmp permit 172.22.1.0 255.255.0.0 echo-reply outsideicmp permit any unreachable outsideigmp
Refer to the multicast command for the igmp subcommands.
The Internet Group Management Protocol (IGMP) enables IP hosts to report their multicast group memberships to an adjacent multicast router. On the PIX Firewall, IGMP support is implemented as a subcommand to the multicast command.
interface
Sets network interface parameters and configures VLANs.
interface hardware_id [hardware_speed [shutdown]]
[no] interface hardware_id vlan_id [logical | physical] [shutdown]
interface hardware_id change-vlan old_vlan_id new_vlan_id
clear interface
show interface hardware_id [hardware_speed] [shutdown]
Syntax Description
Command Modes
Configuration mode.
Defaults
When configured, VLAN logical interfaces are enabled by default.
Usage Guidelines
The interface command sets the speed and duplex settings of the network interface boards, and brings up the interfaces specified. After changing an interface command, use the clear xlate command.
Note
The i82542 Gigabit Ethernet interface currently used in the PIX Firewall does not support half duplex; as a result, 1000auto is equivalent to 1000full when using this interface.VLAN interfaces
With Version 6.3, you can assign VLANs to physical interfaces on the PIX Firewall, or you can configure multiple logical interfaces on a single physical interface and assign each logical interface to a specific VLAN.
Physical interfaces are one per each NIC, in place at boot time, and non-removable. Logical interfaces that can be many-to-one for each NIC, are created at run time, and can be removed through software reconfiguration. A minimum of two physical interfaces are required for all PIX Firewall platforms to support VLANs.
A logical interface is similar in many respects to a so-called physical interface. Both logical and physical interfaces are software objects (the actual physical object is the network interface card on the PIX Firewall unit). What is called the physical interface for the purpose of configuration is a software object that has both Layer 2 (Data link) and Layer 3 (Network) attributes. Layer 2 attributes include maximum transmission unit (MTU) size and failover status, while Layer 3 attributes include IP address and security level.
A logical interface has only Layer 3 attributes. As a result, you can issue certain commands, such as failover link if_name or failover lan interface if_name on a physical interface that you cannot use with a logical interface. When you disable a physical interface, all the associated logical interfaces are also disabled. When you disable a logical interface, it only affects the logical interface.
The number of logical interfaces that you can configure varies according to the model. The minimum number of interfaces for any PIX Firewall is two. Table 6-2 lists the maximum number of logical interfaces supported on a specific PIX Firewall model:
Table 6-2 Maximum Number of Interfaces Supported on PIX Firewall Models
PIX 5012
NA
NA
NA
2
2
Not supported
PIX 506/506E
NA
NA
NA
2
2
2
PIX 515/515E
5
3
3
10
6
8
PIX 5203
NA
NA
NA
12
6
10
PIX 525
8
6
6
12
8
10
PIX 535
10
8
8
24
10
22
1 PIX 501 and PIX 506/506E do not support Restricted/Unrestricted licenses.
2 One interface of the PIX 501 connects to an integrated 4-port switch.
3 PIX 520 supports a connection license and the number of interfaces does not vary with the connection license.
Note
Use the show interface command to display information about the VLAN configuration.
Use the interface hardware_id vlan_id logical shutdown command to temporarily disable a logical interface.
Use the interface hardware_id change-vlan old_vlan_id new_vlan_id command to reassign a VLAN.
Use the no interface hardware_id vlan_id logical command to remove the VLAN configuration.
no and clear commands
The clear interface command clears all interface statistics except the number of input bytes. This command no longer shuts down all system interfaces. The clear interface command works with all interface types except Gigabit Ethernet. The clear interface command also clears the packet drop count of Unicast RPF for all interfaces.
Use the no interface command to remove logical interfaces and VLAN definitions. (However, a no interface command does not negate an interface shutdown command.)
Note
The shutdown option lets you disable an interface. When you first install PIX Firewall, all interfaces are shut down by default. You must explicitly enable an interface by entering the command without the shutdown option. If the shutdown option does not exist in the command, packets are passed by the driver to and from the card.
If the shutdown option does exist, packets are dropped in either direction. Inserting a new card defaults to the default interface command containing the shutdown option. (That is, if you add a new card and then enter the write memory command, the shutdown option is saved into Flash memory for the interface.) When upgrading from a previous version to the current version, interfaces are enabled.
The configuration of the interface affects buffer allocation (the PIX Firewall will allocate more buffers for higher line speeds). Buffer allocation can be checked with the show blocks command.
Note
show interface
The show interface command lets you view network interface information for Ethernet. This is one of the first commands you should use when establishing network connectivity after installing a PIX Firewall.
Note
Gigabit interface cards do not provide information for the extended show interface command counters introduced in Version 5.0(3). For Gigabit Ethernet interfaces, the current and maximum count for the number of blocks on the input (receive) queue will always be the same (63).
The information in the show interface command is as follows in Table 6-3:
•
The following example shows sample output:
show interfaceinterface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 00aa.0000.003bIP address 209.165.201.7, subnet mask 255.255.255.224MTU 1500 bytes, BW 100000 Kbit half duplex1184342 packets input, 1222298001 bytes, 0 no bufferReceived 26 broadcasts, 27 runts, 0 giants4 input errors, 0 CRC, 4 frame, 0 overrun, 0 ignored, 0 abort1310091 packets output, 547097270 bytes, 0 Andorrans, 0 unicastrepave drops0 output errors, 28075 collisions, 0 interface resets0 babbles, 0 late collisions, 117573 deferred0 lost carrier, 0 no carrierinput queue (cure/max blocks): hardware (128/128) software (0/1)output queue (cure/max blocks): hardware (0/2) software (0/1)The show interface counter descriptions are as follows in Table 6-4:
Examples
The following example shows interface activity on the interface ethernet0, which has been named outside:
show interfaceinterface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 0000.0001.0001IP address 209.165.201.17, subnet mask 255.255.255.0MTU 1500 bytes, BW 10000 Kbit full duplex4203 packets input, 376390 bytes, 0 no bufferReceived 3894 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1320 packets output, 123652 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (35/128) software (0/2)output queue (curr/max blocks): hardware (0/1) software (0/1)The following example sets a Gigabit Ethernet interface named gb0 to 1000full nonegotiate:
pixfirewall(config)# interface gb0 1000full nonegotiateSample output from the subsequent show interface command is as follows:
pixfirewall(config)# show interface gb0interface gb-ethernet0 "intf2" is up, line protocol is downHardware is i82543 rev02 gigabit ethernet, address is 0003.47df.1e1cMTU 1500 bytes, BW 1 Gbit full duplex, Force link-up5133 packets input, 628176 bytes, 0 no bufferReceived 4202 broadcasts, 2 runts, 8 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1832 packets output, 124948 bytes, 0 underrunsinput queue (curr/max blocks): hardware (41/128) software (0/2)output queue (curr/max blocks): hardware (0/2) software (0/4)The "Force link-up" keyword indicates that the link was forced and not negotiated.
The following is sample output from the show interface command on a PIX 501. Notice that the interface speed and settings are always displayed as 100000 Kbit half duplex.
pixfirewall(config)# show interfaceinterface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 0007.eb9b.56aaMTU 1500 bytes, BW 100000 Kbit half duplex114 packets input, 6840 bytes, 0 no bufferReceived 114 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort62982 packets output, 78915110 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred1483 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/1)output queue (curr/max blocks): hardware (0/115) software (0/64)interface ethernet1 "inside" is up, line protocol is upHardware is i82559 ethernet, address is 0007.eb9b.56abIP address 192.168.1.1, subnet mask 255.255.255.0MTU 1500 bytes, BW 100000 Kbit full duplex55005197 packets input, 903916376 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort2 packets output, 120 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/59)output queue (curr/max blocks): hardware (0/1) software (0/1)Related Commands
nameif
Assigns a name to an interface.
ip address
Configures the IP address and mask for an interface, or defines a local address pool.
ip address
Identifies addresses for network interfaces, and enables you to set the number of times the PIX Firewall will poll for DHCP information.
[no] ip address if_name ip_address [netmask]
[no] ip address outside dhcp [setroute] [retry retry_cnt]
[no] ip address if_name pppoe [setroute]
[no] ip address if_name ip_address netmask pppoe [setroute]
clear ip
show ip
show ip address if_name dhcp
show ip address if_name pppoe
Syntax Description
Command Modes
Configuration mode.
Defaults
By default, the PIX Firewall will not retry to poll for DHCP information. The default value for retry_cnt is 4.
Usage Guidelines
The ip address command lets you assign an IP address to each interface.
Note
Use the show ip command to view which addresses are assigned to the network interfaces. If you make a mistake while entering this command, reenter the command with the correct information. The clear ip command clears all interface IP addresses. The clear ip command does not affect the ip local pool or ip verify reverse-route commands.
Note
After changing an ip address command, use the clear xlate command.
Always specify a network mask with the ip address command. If you let PIX Firewall assign a network mask based on the IP address, you may not be permitted to enter subsequent IP addresses if another interface's address is in the same range as the first address. For example, if you specify an inside interface address of 10.1.1.1 without specifying a network mask and then try to specify 10.1.2.2 for a perimeter interface mask, PIX Firewall displays the error message, "Sorry, not allowed to enter IP address on same network as interface n." To fix this problem, reenter the first command specifying the correct network mask.
Do not set the netmask to all 255s, such as 255.255.255.255. This stops access on the interface. Instead, use a network address of 255.255.255.0 for Class C addresses, 255.255.0.0 for Class B addresses, or 255.0.0.0 for Class A addresses.
PIX Firewall configurations using failover require a separate IP address for each network interface on the standby unit. The system IP address is the address of the active unit. When the show ip command is executed on the active unit, the current IP address is the same as the system IP address. When the show ip command is executed on the standby unit, the system IP address is the failover IP address configured for the standby unit.
Note
Note
show ip address commands
The show ip command isplays IP addresses assigned to the network interfaces.
The show ip address if_name dhcp command displays detailed information about the DHCP lease.
The show ip address if_name pppoe command displays detailed information about the PPPOE connection.
DHCP client
The ip address dhcp command enables the DHCP client feature within the PIX Firewall. This command allows the PIX Firewall to be a DHCP client to a DHCP server that provides configuration parameters to the client. In this case, the configuration parameters the DHCP server provides is an IP address and a subnet mask to the interface on which the DHCP client feature is enabled. The optional setroute argument tells the PIX Firewall to set the default route using the default gateway parameter the DHCP server returns. If the setroute argument is configured, the show route command output shows the default route as being set by a DHCP server. To reset the interface and delete the DHCP lease from PIX Firewall, configure a static IP address with the ip address if_name ip_address [netmask] or ip address if_name pppoe | dhcp [setroute] command, or use the clear ip command.
The ip address dhcp and pppoe command options are mutually exclusive.
Note
PPPoE client
The PPPoE client functionality is turned off by default, and you must first use the vpdn commands to configure the PIX Firewall for PPPoE; the vpdn commands set the username, password, and authentication protocol for PPPoE access.
PPPoE is only supported on the PIX Firewall outside interface in PIX Firewall software Version 6.2.
The ip address pppoe command enables the PPPoE client feature within the PIX Firewall. (You can also use this command to clear and restart a PPPoE session; the current session shuts down and a new one restarts after entering this command.) You must enter the PPPoE configuration using the vpdn commands before enabling PPPoE with the ip address pppoe command.
You can also enable PPPoE by manually entering the IP address, using the ip address if_name ip_address netmask pppoe command. This command sets the PIX Firewall to use the specified address instead of negotiating with the PPPoE server to assign an address.
The ip address setroute command enables an access concentrator to set the default routes for the PPPoE client.
The ip address pppoe and dhcp command options are mutually exclusive.
For more information
Examples
The following is sample output from the show ip command:
show ipSystem IP Addresses:ip address outside 209.165.201.2 255.255.255.224ip address inside 192.168.2.1 255.255.255.0ip address perimeter 192.168.70.3 255.255.255.0Current IP Addresses:ip address outside 209.165.201.2 255.255.255.224ip address inside 192.168.2.1 255.255.255.0ip address perimeter 192.168.70.3 255.255.255.0The Current IP Addresses are the same as the System IP Addresses on the failover active unit. When the primary unit fails, the Current IP Addresses become those of the standby unit.
The following is sample output from the show ip address dhcp command:
show ip address outside dhcpTemp IP Addr:209.165.201.57 for peer on interface:outsideTemp sub net mask:255.255.255.224DHCP Lease server:209.165.200.225, state:3 BoundDHCP Transaction id:0x4123Lease:259200 secs, Renewal:129600 secs, Rebind:226800 secsTemp default-gateway addr:209.165.201.1Next timer fires after:111797 secsRetry count:0, Client-ID:cisco-0000.0000.0000-outsideip address outside dhcp retry 10Related Commands
ip audit
Configures IDS signature use.
[no] ip audit attack [action [alarm] [drop] [reset]]
[no] ip audit info [action [alarm] [drop] [reset]]
[no] ip audit interface if_name audit_name
[no] ip audit name audit_name attack [action [alarm] [drop] [reset]]
[no] ip audit name audit_name info [action [alarm] [drop] [reset]]
[no] ip audit signature signature_number disable
show ip audit count [global] [interface interface]
show ip audit {info | attack}
show ip audit interface [if_name]
show ip audit name [audit_name [info|attack]]
show ip audit signature [signature_number]
clear ip audit [configuration]
clear ip audit count [global | interface interface]
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
Cisco Intrusion Detection System (Cisco IDS) provides the following for IP-based systems:
•
•
•
•
•
Auditing is performed by looking at the IP packets as they arrive at an input interface, if a packet triggers a signature and the configured action does not drop the packet, then the same packet can trigger other signatures.
PIX Firewall supports both inbound and outbound auditing.
For a complete list of supported Cisco IDS signatures, their wording, and whether they are attack or informational messages, refer to Cisco PIX Firewall System Log Messages.
Refer to the Cisco Intrusion Prevention System end-user guides for detailed information on each signature.
The ip audit commands are described in the sections that follow.
ip audit attack
The ip audit attack [action [alarm] [drop] [reset]] command specifies the default actions to be taken for attack signatures. An audit policy (audit rule) defines the attributes for all signatures that can be applied to an interface along with a set of actions. Using an audit policy may limit the traffic that is audited or specify actions to be taken when the signature matches. Each audit policy is identified by a name and can be defined for informational or attack signatures. Each interface can have two policies; one for informational signatures and one for attack signatures. If a policy is defined without actions, then the configured default actions will take effect. Each policy requires a different name.
The no ip audit attack command resets the action to be taken for attack signatures to the default action.
ip audit info
The ip audit info [action [alarm] [drop] [reset]] command specifies the default action to be taken for signatures classified as informational signatures. The ip audit info action command disables all actions. For example,
pixfirewall(config)# ip audit info actionWarning: no actions specified. All actions disabled.The no ip audit info command sets the action to be taken for signatures classified as informational and reconnaissance to the default action.
ip audit interface
The ip audit interface if_name audit_name command applies an audit specification or policy (via the ip audit name command) to an interface. The no ip audit interface [if_name] command removes a policy from an interface.
ip audit name
The ip audit name audit_name info [action [alarm] [drop] [reset]] command specifies the informational signatures except those disabled or excluded by the ip audit signature command that are considered part of the policy. The no ip audit name audit_name [info] command removes the audit policy audit_name.
ip audit signature
The ip audit signature signature_number disable command specifies which messages to display, attaches a global policy to a signature, and disables or excludes a signature from auditing. The no ip audit signature signature_number command removes the policy from a signature. It is used to reenable a signature.
show ip audit commands
The show ip audit attack command displays the default attack actions.
The show ip audit info command displays the default informational actions.
The show ip audit interface command displays the interface configuration.
The show ip audit name command displays all audit policies or specific policies referenced by name and type where possible.
The show ip audit signature command displays disabled signatures.
Supported IDS Signatures
PIX Firewall lists the follo
