> Firewall-and-NAT Action Configuration Mode Commands
> The Firewall-and-NAT Action Configuration Mode enables configuring Firewall-and-NAT actions.
> Important: This configuration mode is only available in release 11.0 and later releases. This configuration mode must be used to configure Action-based Stateful Firewall and NAT features.
> Important: The commands or keywords/variables that are available are dependent on platform type, product version, and installed license(s).
> end
> Exits the current configuration mode and returns to the Exec mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> end
> Usage
> Use this command to return to the Exec mode.
> exit
> Exits the current mode and returns to the parent configuration mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> exit
> Usage
> Use this command to return to the parent configuration mode.
> flow check-point
> This command checkpoints all the flows matching the Firewall-and NAT action.
> Product
> NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> flow check-point [ data-usage data_usage [ and | or ] | time-duration duration [ and | or ] ]
> { default | no } flow check-point
> default
> Configures the default Firewall action.
> no
> Deletes the Firewall action configuration.
> data-usage data_usage
> Specifies the data usage in bytes.
> data_usage must be an integer ranging from 1 through 4294967295.
> The maximum limit for data-usage is 4 GB.
> time-duration duration
> Specifies the time duration in seconds.
> duration must be an integer ranging from 1 through 86400.
> The maximum limit for time-duration is 24 hours.
> and | or
> This option allows to configure only data-usage or time-duration, or a combination of data-usage and time-duration.
> Usage
> Use this command to enable/disable the check-pointing of NATed flows and control the type of flows need to be check pointed based on specified criteria. Check pointing is done only for TCP and UDP flows.
> Example
> The following command configures Stateful Firewall to drop packets with data-usage 5000:
> flow check-point data-usage 5000

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883