Table Of Contents
T through Z Commands
telnet
Specify the host for PIX Firewall console access via Telnet.
telnet ip_address [netmask] [if_name]
clear telnet [ip_address [netmask] [if_name]]
no telnet [ip_address [netmask] [if_name]]
telnet timeout minutes
show telnet
show telnet timeout
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The telnet command lets you specify which hosts can access the PIX Firewall console with Telnet. You can enable Telnet to the PIX Firewall on all interfaces. However, the PIX Firewall enforces that all Telnet traffic to the outside interface be IPSec protected. Therefore, to enable Telnet session to the outside interface, configure IPSec on the outside interface to include IP traffic generated by the PIX Firewall and enable Telnet on the outside interface.
A maximum of five (5) active Telnet management sessions to the PIX Firewall are allowed at the same time. The show telnet command displays the current list of IP addresses authorized to Telnet to the PIX Firewall. Use the no telnet or clear telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout feature to set the maximum time a console Telnet session can be idle before being logged off by PIX Firewall. The clear telnet command does not affect the telnet timeout command duration. The no telnet command cannot be used with the telnet timeout command.
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the PIX Firewall console. Use the kill command to terminate an active Telnet management session.
If the aaa command is used with the console option, Telnet management access must be authenticated with an authentication server.
Note
If you have configured the aaa command to require authentication for PIX Firewall Telnet management access and the console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the password that was set with the enable password command.
Usage Notes
1.
When you use the show telnet command, this assumption may not seem to make sense. For example, if you enter the following command without a netmask or interface name.
telnet 192.168.1.1If you then use the show telnet command, you see that not just one command statement is specified, but all internal interfaces are represented with a command statement:
show telnet192.168.1.1 255.255.255.255 inside192.168.1.1 255.255.255.255 intf2192.168.1.1 255.255.255.255 intf3The purpose of the show telnet command is that, were it possible, the 192.168.1.1 host could access the Telnet management session from any of these internal interfaces. An additional facet of this behavior is that you must delete each of these command statements individually with the following commands.
no telnet 192.168.1.1 255.255.255.255 insideno telnet 192.168.1.1 255.255.255.255 intf2no telnet 192.168.1.1 255.255.255.255 intf32.
telnet 192.168.1.1 255.255.255.255 int23.
4.
5.
6.
7.
If you have IPSec configured, you can access the PIX Firewall console with Telnet from outside the PIX Firewall. Once an IPSec tunnel is created from an outside host to the PIX Firewall, you can access the console from the outside host.
8.
Examples
The following examples permit hosts 192.168.1.3 and 192.168.1.4 to access the PIX Firewall console via Telnet. In addition, all the hosts on the 192.168.2.0 network are given access:
telnet 192.168.1.3 255.255.255.255 insidetelnet 192.168.1.4 255.255.255.255 insidetelnet 192.168.2.0 255.255.255.0 insideshow telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideYou can remove individual entries with the no telnet command or all telnet command statements with the clear telnet command:
no telnet 192.168.1.3 255.255.255.255 insideshow telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideclear telnetshow telnetYou can change the maximum session idle duration as follows:
telnet timeout 10show telnet timeouttelnet timeout 10 minutesAn example Telnet login session appears as follows (the password does not display when entered):
PIX passwd: ciscoWelcome to the PIX Firewall...Type help or `?' for a list of available commands.pixfirewall>Related Commands
•
•
terminal
Change console terminal settings.
terminal monitor
terminal no monitor
terminal width characters
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The terminal monitor command lets you enable or disable the display of syslog messages in the current session for Telnet access to the PIXFirewall console. Use the logging monitor command to enable or disable various levels of syslog messages to the Telnet console; use the terminal no monitor command to disable the messages on a per session basis. Use the terminal monitor command to restart the syslog messages for the current session.
The terminal width command sets the width for displaying command output. The terminal width is controlled by the command: terminal width nn, where nn is the width in characters. If you enter a line break, it is not possible to backspace to the previous line.
Examples
The following example shows enabling logging and then disabling logging only in the current session with the terminal no monitor command:
logging monitor...terminal no monitortftp-server
Specify the IP address of the TFTP configuration server.
[no] tftp-server [if_name] ip_address path
clear tftp-server [[if_name] ip_address path]
show tftp-server
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The tftp-server command lets you specify the IP address of the server that you use to propagate PIX Firewall configuration files to your firewalls. Use the tftp-server command with the configure net command to read from the configuration or with the write net command to store the configuration in the file you specify. The clear tftp-server command removes the tftp-server command from your configuration.
PIX Firewall supports only one TFTP server.
The path name you specify in the tftp-server is appended to the end of the IP address you specify in the configure net and write net commands. The more you specify of a file and path name with the tftp-server command, the less you need to specify with the configure net and write net commands. If you specify the full path and filename in the tftp-server command, the IP address in the configure net and write net commands can be represented with a colon ( : ).
The no tftp server command disables access to the server. The show tftp-server command lists the tftp-server command statements in the current configuration.
Note
Examples
The following example specifies a TFTP server and then reads the configuration from /pixfirewall/config/test_config:
tftp-server 10.1.1.42 /pixfirewall/config/test_config...configure net :timeout
Set the maximum idle time duration.
timeout [xlate hh[:mm[:ss]]] [conn hh[:mm[:ss]]] [half-closed hh[:mm[:ss]]] [udp hh[:mm[:ss]]] [rpc hh[:mm[:ss]]] [h225 hh[:mm[:ss]]] [h323 hh[:mm[:ss]]] [mgcp hh[:mm[:ss]]] [sip hh[:mm[:ss]]] [sip_media hh[:mm[:ss]]][uauth hh[:mm[:ss]] [absolute | inactivity]]
clear timeout
show timeout
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The timeout command sets the idle time for connection, translation UDP, RPC, and H.323 slots. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence.
The clear timeout command sets the durations to their default values.
This command is used in conjunction with the show and clear uauth commands.
Note
The connection timer takes precedence over the translation timer, such that the translation timer only works after all connections have timed out.
timeout mgcp
The timeout mgcp hh:mm:ss command sets the duration for the MGCP inactivity timer. If this time elapses before new activity occurs, the MGCP media ports close. The default is five minutes. For example, to set the MGCP timeout to five minutes, enter the following:
pixfirewall(config)# timeout mgcp 00:05:00Uauth Inactivity and Absolute Qualifiers
The uauth inactivity and absolute qualifiers cause users to have to reauthenticate after either a period of inactivity or an absolute duration.
If you set the inactivity timer to a duration, but the absolute timer to zero, then users are only reauthenticated after the inactivity timer elapses. If you set both timers to zero, then users have to reauthenticate on every new connection.
The inactivity timer starts after a connection becomes idle. If a user establishes a new connection before the duration of the inactivity timer, the user is not required to reauthenticate. If a user establishes a new connection after the inactivity timer expires, the user must reauthenticate. The default durations are zero for the inactivity timer and 5 minutes for the absolute timer; that is, the default behavior is to cause the user to reauthenticate every 5 minutes.
The absolute timer runs continuously, but waits to reprompt the user when the user starts a new connection, such as clicking a link and the absolute timer has elapsed, then the user is prompted to reauthenticate. The absolute timer must be shorter than the xlate timer; otherwise, a user could be reprompt after their session already ended.
Inactivity timers give users the best Web access because they are not prompted to regularly reauthenticate. Absolute timers provide security and manage the PIX Firewall connections better. By being prompted to reauthenticate regularly, users manage their use of the resources more efficiently. Also by being reprompted, you minimize the risk that someone will attempt to use another user's access after they leave their workstation, such as in a college computer lab. You may want to set an absolute timer during peak hours and an inactivity timer thereafter.
Both an inactivity timer and an absolute timer can operate at the same time, but you should set the absolute timer duration longer than the inactivity timer. If the absolute timer is less than the inactivity timer, the inactivity timer never occurs. For example, if you set the absolute timer to 10 minutes and the inactivity timer to an hour, the absolute timer reprompts the user every 10 minutes; therefore, the inactivity timer will never be started.
Note
Examples
The following is sample output from the show timeout command:
show timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absoluteThe following is sample output from the timeout command in which variables are changed and then displayed with the show timeout command:
timeout uauth 0:5:00 absolute uauth 0:4:00 inactivityshow timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:05:00 absolute uauth 0:04:00 inactivityRelated Commands
url-block
For Websense filtering servers, the url-block url-size command allows filtering of long URLs, up to 4 KB. For both Websense and N2H2 filtering servers, the url-block block command causes the PIX Firewall to buffer packets received from a web server in response to a web client request while waiting for a response from the URL filtering server. This improves performance for the web client compared to the default PIX Firewall behavior, which is to drop the packets and to require the web server to retransmit the packets if the connection is permitted.
If you use the url-block block command and the filtering server permits the connection, the PIX Firewall sends the blocks to the web client from the HTTP response buffer and removes the blocks from the buffer. If the filtering server denies the connection, the PIX Firewall sends a deny message to the web client and removes the blocks from the HTTP response buffer.
[no] url-block block block_buffer_limit
clear url-block block stat
show url-block block stat
Websense only:
[no] url-block url-mempool memory_pool_size
[no] url-block url-size long_url_size
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
Use the url-block block command to specify the number of blocks to use for buffering web server responses while waiting for a filtering decision from the filtering server.
Use the url-block url-size command with the url-block url-mempool command to specify the maximum length of a URL to be filtered by a Websense filtering server and the maximum memory to assign to the URL buffer. Use these commands to pass URLs longer than 1159 bytes, up to a maximum of 4096 bytes, to the Websense server. The url-block url-size command stores URLs longer than 1159 bytes in a buffer and then passes the URL to the Websense server (through a TCP packet stream) so that the Websense server can grant or deny access to that URL.
The clear url-block block stat command clears the block buffer usage counters, except for the Current number of packets held (global) counter.
The show url-block block stat command displays the number of packets held in the url-block buffer and the number (if any) dropped due to exceeding the buffer limit or retransmission.
Examples
The following example illustrates the use of the show url-block block stat and clear url-block block stat commands:
pixfirewall(config)# sh url-block block statURL Pending Packet Buffer Stats with max block 128-----------------------------------------------------Cumulative number of packets held: 896Maximum number of packets held (per URL): 3Current number of packets held (global): 38Packets dropped due toexceeding url-block buffer limit: 7546HTTP server retransmission: 10Number of packets released back to client: 0pixfirewall(config)# sh url-blockurl-block url-mempool 128url-block url-size 4url-block block 128pixfirewall(config)# clear url-block block statpixdocipsec1(config)# show url-block block statURL Pending Packet Buffer Stats with max block 0-----------------------------------------------------Cumulative number of packets held: 0Maximum number of packets held (per URL): 0Current number of packets held (global): 38Packets dropped due toexceeding url-block buffer limit: 0HTTP server retransmission: 0Number of packets released back to client: 0url-cache
Caches URL access privileges that were previously retrieved from a Websense or N2H2 server.
[no] url-cache {dst | src_dst} size kbytes
clear url-cache
show url-cache stats
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The url-cache command provides a configuration option to allow the PIX to cache previously retrieved URL access privileges from a Websense or N2H2 server.
Use the url-cache command to enable URL caching, set the size of the cache, and display cache statistics.
Caching stores URL access privileges in memory on the PIX Firewall. When a host requests a connection, the PIX Firewall first looks in the URL cache for matching access privileges instead of forwarding the request to the N2H2 or Websense server. Disable caching with the no url-cache command.
The clear url-cache command removes url-cache command statements from the configuration.
Using the URL cache does not update the Websense accounting logs for Websense protocol Version 1. If you are using Websense protocol Version 1, let Websense run to accumulate logs so you can view the Websense accounting information. After you get a usage profile that meets your security needs, enable url-cache to increase throughput. Accounting logs are updated for Websense protocol Version 4 and for N2H2 URL filtering while using the url-cache command.
Note
The show url-cache command with the stats option displays the following entries:
•
•
•
•
•
You can view additional information about N2H2 or Websense filtering activity with the show perfmon command.
Examples
The following example caches all outbound HTTP connections based on the source and destination addresses:
url-cache src_dst 128The following is sample output from the show url-cache stat command:
show url-cache statURL Filter Cache Stats----------------------Size : 1KBEntries : 36In Use : 30Lookups : 300Hits : 290url-server
Designate a server running either N2H2 or Websense for use with the filter command; you cannot run both of these URL filtering services simultaneously.
N2H2
[no] url-server [(if_name)] vendor n2h2 host local_ip [port number] [timeout seconds] [protocol {TCP | UDP}]
Websense
[no] url-server [(if_name)] vendor websense host local_ip [timeout seconds] [protocol {TCP | UDP} version]
show url-server
show url-server stats
Syntax Description
N2H2
Websense
Command Modes
Configuration mode.
Usage Guidelines
The url-server command designates the server running the N2H2 or Websense URL filtering application. The limit is 16 URL servers; however, and you can use only one application at a time, either N2H2 or Websense. Additionally, changing your configuration on the PIX Firewall does not update the configuration on the application server; this must be done separately, according to the individual vendor's instructions.
Once you designate the server, enable the URL filtering service with the filter command.
Follow these steps to filter URLs:
Step 1
Step 2
Step 3
Step 4
Step 5
For more information about Filtering by N2H2, visit N2H2's website at:
http://www.n2h2.com
For more information on Websense filtering services, visit the following website:
http://www.websense.com/
The url-server command must be configured before issuing the filter command for HTTPS and FTP. If all URL servers are removed from the server list, then all filter commands related to URL filtering are also removed.
show url-server commands
The show url-server stats command displays the URL server vendor; number of URLs total, allowed, and denied; number of HTTPS connections total, allowed, and denied; number of TCP connections total, allowed, and denied; and the URL server status.
The show url-server command displays the following information:
•
•
Examples
Using N2H2, the following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
url-server (perimeter) vendor n2h2 host 10.0.1.1filter url http 0 0 0 0filter url except 10.0.2.54 255.255.255.255 0 0Using Websense, the following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
url-server (perimeter) vendor websense host 10.0.1.1filter url http 0 0 0 0filter url except 10.0.2.54 255.255.255.255 0 0The following is sample output from the show url-server stats command:
pixfirewall# show url-server statsURL Server Statistics:----------------------Vendor websenseHTTPs total/allowed/denied 0/0/0HTTPSs total/allowed/denied 0/0/0FTPs total/allowed/denied 0/0/0URL Server Status:------------------172.23.58.103 UPURL Packets Send and Recieve Stats:------------------------------------Message Send RecieveSTATUS_REQUEST 200 200LOOKUP_REQUEST 10 10LOG_REQUEST 20 NARelated Commands
•
username
Sets the username for the specified privilege level.
username username {[{nopassword | password password} [encrypted]] [privilege level]}
no username username
clear username
show username username
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
The local PIX Firewall user authentication database consists of the users entered with the username command. The PIX Firewall login command uses this database for authentication.
The show username username command displays users entered in the local PIX Firewall user authentication database.
Related Commands
virtual
Access the PIX Firewall virtual server.
virtual http ip_address [warn]
virtual telnet ip_address
Syntax Description
ip_address
For outbound use, ip_address must be an address routed to the PIX Firewall. Use an RFC 1918 address that is not in use on any interface.
For inbound use, ip_address must be an unused global address. An access-list and static command pair must provide access to ip_address, as well as an aaa accounting authentication command statement. See the "Examples" section for more information.
For example, if an inside client at 192.168.0.100 has a default gateway set to the inside interface of the PIX Firewall at 192.168.0.1, the ip_address can be any IP address not in use on that segment (such as 10.2.3.4). As another example, if the inside client at 192.168.0.100 has a default gateway other than the PIX Firewall (such as a router at 192.168.0.254), then the ip_address would need to be set to a value that would get statically routed to the PIX Firewall. This might be accomplished by using a value of 10.0.0.1 for the ip_address, then on the client, setting the PIX Firewall at 192.168.0.1 as the route to host 10.0.0.1.
warn
Let virtual http command users know that the command was redirected. This option is only applicable for text-based browsers where the redirect cannot happen automatically.
Command Modes
Configuration mode.
Usage Guidelines
The virtual http command lets web browsers work correctly with the PIX Firewall aaa command. The aaa command assumes that the AAA server database is shared with a web server. PIX Firewall automatically provides the AAA server and web server with the same information. The virtual http command works with the aaa command to authenticate the user, separate the AAA server information from the web client's URL request, and direct the web client to the web server. Use the show virtual http command to list commands in the configuration. Use the no virtual http command to disable its use.
The virtual http command works by redirecting the web browser's initial connection to the ip_address, which resides in the PIX Firewall, authenticating the user, then redirecting the browser back to the URL which the user originally requested. This mechanism comprises the PIX Firewall unit's new virtual server feature. The reason this command is named as it is, is because the virtual http command accesses the virtual server for use with HTTP, another name for the Web. This command is especially useful for PIX Firewall interoperability with Microsoft IIS, but is useful for other authentication servers.
When using HTTP authentication to a site running Microsoft IIS that has "Basic text authentication" or "NT Challenge" enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: "Authorization: Basic=Uuhjksdkfhk==" to the HTTP GET commands. This string contains the PIX Firewall authentication credentials.
Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied.
To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested.
Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set. This is because the browser caches the "Authorization: Basic=Uuhjksdkfhk==" string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts. Flushing the cache is of no use.
If you want double authentication through the authentication and web browser, configure the authentication server to not accept anonymous connections.
Note
For both the virtual http and virtual telnet commands, if the connection is started on either an outside or perimeter interface, a static and access-list command pair is required for the fictitious IP address.
The virtual telnet command allows the Virtual Telnet server to provide a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication.
The virtual telnet command can be used both to log in and log out of the PIX Firewall. When an unauthenticated user Telnets to the virtual IP address, they are challenged for their username and password, and then authenticated with the TACACS+ or RADIUS server. Once authenticated, they see the message "Authentication Successful" and their authentication credentials are cached in the PIX Firewall for the duration of the uauth timeout.
If a user wishes to log out and clear their entry in the PIX Firewall uauth cache, the user can again Telnet to the virtual address. The user is prompted for their username and password, the PIX Firewall removes the associated credentials from the uauth cache, and the user will receive a "Logout Successful" message.
If inbound users on either the perimeter or outside interfaces need access to the Virtual Telnet server, a static and access-list command pair must accompany use of the virtual telnet command.
The Virtual Telnet server provides a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication. Users first connect to the Virtual Telnet server IP address, where the user is prompted for a username and password.
Examples
•
static (inside, outside) 209.165.201.1 209.165.201.1 netmask 255.255.255.255access-list acl_out permit tcp any host 209.165.201.1 eq 80access-group acl_out in interface outsideaaa authentication include any inbound 209.165.201.1 255.255.255.255 0 0 tacacs+virtual http 209.165.201.1This configuration uses an identity static, where both the global IP address and the local address in the static command is the IP address of the virtual server.
The next example is sample output from the show virtual command:
show virtual httpvirtual http 209.165.201.1•
On the PIX Firewall:
virtual telnet 209.165.201.25static (inside, outside) 209.165.201.25 209.165.201.25 netmask 255.255.255.255access-list acl_out permit tcp any host 209.165.201.25 eq telnetaccess-group acl_out in interface outsidewrite memoryThis configuration uses an identity static, where both the global IP address and the local address in the static command is the IP address of the virtual server.
On an inside host:
/unix/host%telnet 209.165.201.30Trying 209.165.201.25...Connected to 209.165.201.25.Escape character is `^]'.username: usernameTACACS+ Password: passwordAuthentication SuccessfulConnection closed by foreign host./unix/host%The username and password are those for the user on the TACACS+ server.
vpdn
Configure Virtual Private Dial-up Networking using the L2TP, PPTP, or PPPoE.
vpdn group group_name [[accept dialin pptp | l2tp] | request dialout pppoe] | [ ppp authentication pap|chap|mschap] | [ppp encryption mppe 40 | 128| auto [required]] | [ client configuration address local address_pool_name ] | [client configuration dns dns_ip1 [dns_ip2]] | [ client configuration wins wins_ip1 [wins_ip2]] | [client authentication local | aaa auth_aaa_group] | [ client accounting acct_aaa_group] | [pptp echo echo_time] | [ l2tp tunnel hello hello_time]
vpdn username name password passwd [store-local]
vpdn enable if_name
show vpdn tunnel [l2tp|pptp|pppoe] [id tnl_id | packets | state | summary | transport]
show vpdn session [l2tp|pptp|pppoe] [id sess_id | packets | state| window]
show vpdn pppinterface [id dev_id]
show vpdn group [group_name]
show vpdn username [user_name]
clear vpdn [group | interface| tunnel tnl_id | username]
Syntax Description
Command Modes
Configuration mode.
Usage Guidelines
Virtual Private Dial-up Networking (VPDN) is used to provide long distance, point-to-point connections between remote dial-in users and a private network. VDPN uses Layer 2 tunnelling technologies (L2TP, PPTP, and PPPOE) to establish dial-up networking connections from the remote user to the private network across a public network.
Point-to-Point Tunneling Protocol (PPTP) is a Layer 2 protocol that tunnels the IP protocol. (For more details on PPTP, see RFC 2637, which describes the PPTP protocol.)
L2TP supports PPP by managing communications transactions. (There is a one-to-one relationship between a PPP connection and L2TP session.)
PPPOE is the Point-to-Point Protocol (PPP) over Ethernet. PPP is designed to work with network layer protocols such as IP, IPX, and ARA. PPP also has CHAP and PAP as built-in security mechanisms.
The vpdn command implements the L2TP, PPTP, and PPPoE features for the inbound connections. Refer to the Cisco PIX Firewall and VPN Configuration Guide for L2TP, PPTP, and PPPOE configuration examples.
Note
The show vpdn tunnel and show vpdn session commands display tunnel and session information (respectively) for LT2P (l2tp), PPTP (pptp), and PPPOE (pppoe). If you want to display information for only one protocol, use the option for that protocol. For example, the show vpdn session pppoe command displays session information for PPPOE sessions only.
The clear vpdn command removes all vpdn commands from the configuration and stops all the active PPTP, L2TP, and PPPoE tunnels. The clear vpdn all command lets you remove all tunnels, and the clear vpdn id tnl_id command lets you remove tunnels associated with tnl_id. (You can view the tnl_id with the show vpdn command.) The clear vpdn group command removes all the v
