The ASA runs in a combination of the following modes:

• Transparent firewall or routed firewall mode

  The firewall mode determines if the ASA runs as a Layer 2 or Layer 3 firewall.

• Multiple context or single context mode

  The security context mode determines if the ASA runs as a single device or as multiple security contexts, which act like virtual devices.

Some commands are only available in certain modes.

The ASA CLI includes command modes. Some commands can only be entered in certain modes. For example, to enter commands that show sensitive information, you need to enter a password and enter a more privileged mode. Then, to ensure that configuration changes are not entered accidentally, you have to enter a configuration mode. All lower commands can be entered in higher modes, for example, you can enter a privileged EXEC command in global configuration mode.

Note	The various types of prompts are all default prompts and when configured, they can be different.

• When you are in the system configuration or in single context mode, the prompt begins with the hostname:

  
  ciscoasa
  
  

• When printing the prompt string, the prompt configuration is parsed and the configured keyword values are printed in the order in which you have set the prompt command. The keyword arguments can be any of the following and in any order: hostname, domain, context, priority, state.

  prompt hostname context priority state

• When you are within a context, the prompt begins with the hostname followed by the context name:

  
  ciscoasa/context
  
  

The prompt changes depending on the access mode:

• User EXEC mode

  User EXEC mode lets you see minimum ASA settings. The user EXEC mode prompt appears as follows when you first access the ASA:

  
  ciscoasa>
  
  ciscoasa/context>
  
  

• Privileged EXEC mode

  Privileged EXEC mode lets you see all current settings up to your privilege level. Any user EXEC mode command will work in privileged EXEC mode. Enter the enable command in user EXEC mode, which requires a password, to start privileged EXEC mode. The prompt includes the number sign (#):

  
  ciscoasa#
  
  ciscoasa/context#
  
  

• Global configuration mode

  Global configuration mode lets you change the ASA configuration. All user EXEC, privileged EXEC, and global configuration commands are available in this mode. Enter the configure terminal command in privileged EXEC mode to start global configuration mode. The prompt changes to the following:

  
  ciscoasa(config)#
  
  ciscoasa/context(config)#
  
  

• Command-specific configuration modes

  From global configuration mode, some commands enter a command-specific configuration mode. All user EXEC, privileged EXEC, global configuration, and command-specific configuration commands are available in this mode. For example, the interface command enters interface configuration mode. The prompt changes to the following:

  
  ciscoasa(config-if)#
  
  ciscoasa/context(config-if)#
  
  

Command syntax descriptions use the conventions listed in the following table.

You can abbreviate most commands down to the fewest unique characters for a command; for example, you can enter wr t to view the configuration instead of entering the full command write terminal , or you can enter en to start privileged mode and conf t to start configuration mode. In addition, you can enter 0 to represent 0.0.0.0 .

The ASA uses the same command-line editing conventions as Cisco IOS software. You can view all previously entered commands with the show history command or individually with the up arrow or ^p command. Once you have examined a previously entered command, you can move forward in the list with the down arrow or ^n command. When you reach a command you wish to reuse, you can edit it or press the Enter key to start it. You can also delete the word to the left of the cursor with ^w , or erase the line with ^u .

The ASA permits up to 512 characters in a command; additional characters are ignored.

To complete a command or keyword after entering a partial string, press the Tab key. The ASA only completes the command or keyword if the partial string matches only one command or keyword. For example, if you enter s and press the Tab key, the ASA does not complete the command because it matches more than one command. However, if you enter dis, the Tab key completes the disable command.

Help information is available from the command line by entering the following commands:

• help command_name

  Shows help for the specific command.

• command_name ?

  Shows a list of arguments available.

• string? (no space)

  Lists the possible commands that start with the string.

• ? and +?

  Lists all commands available. If you enter ?, the ASA shows only commands available for the current mode. To show all commands available, including those for lower modes, enter +?.

Note	If you want to include a question mark (?) in a command string, you must press Ctrl-V before typing the question mark so that you do not inadvertently invoke CLI help.

To view the running configuration, use one of the following commands:

• show running-config [all] [command]

  If you specify all , then all default settings are shown as well. If you specify a command , then the output only includes related commands.

  Note	Many passwords are shown as *****. To view the passwords in plain text, or in encrypted form if you have a master passphrase enabled, use the more command.

• more system:running-config

The syntax for using filtering options with the show command is as follows:

show command | {include| exclude | begin | grep [-v]} regexp

or

more system:running-config| {include| exclude | begin | grep [-v]} regexp

Note	Entering the more command allows you to view the contents of any file, not just the running configuration; see the command reference for more information.

In this command string, the first vertical bar (|) is the operator and must be included in the command. This operator directs the output of the show command to the filter. In the syntax diagram, the other vertical bars (|) indicate alternative options and are not part of the command.

The include option includes all output lines that match the regular expression. The grep option without -v has the same effect. The exclude option excludes all output lines that match the regular expression. The grep option with-v has the same effect. The begin option shows all the output lines starting with the line that matches the regular expression.

Replace regexp with any Cisco IOS regular expression. The regular expression is not enclosed in quotes or double-quotes, so be careful with trailing white spaces, which will be taken as part of the regular expression.

When creating regular expressions, you can use any letter or number that you want to match. In addition, certain keyboard characters called metacharacters have special meaning when used in regular expressions.

Use Ctrl+V to escape all of the special characters in the CLI, such as a question mark (?) or a tab. For example, type d[Ctrl+V]?g to enter d?g in the configuration.

Instead of displaying the output of a show command on the screen, you can redirect it to a file on the device or in a remote location. When redirecting to a file on the device, you can also append the command output to the file.

show command | {append | redirect} url

• append url adds the output to an existing file. Specify the file using one of the following:

  • disk0:/[[path/]filename] or flash:/[[path/]filename] —Both flash and disk0 indicates the internal Flash memory. You can use either option.

  • disk1:/[[path/]filename] —Indicates external memory.

• redirect url creates the specified file, or overwrites it if the file already exists.

  • disk0:/[[path/]filename] or flash:/[[path/]filename] —Both flash and disk0 indicates the internal Flash memory. You can use either option.

  • disk1:/[[path/]filename] —Indicates external memory.

  • smb:/[[path/]filename] —Indicates Server Message Block, a UNIX server local file system.

  • ftp://[[user[:password]@] server[:port]/[path/] filename[;type=xx]] —Indicates an SCP server. The type can be one of these keywords: ap (ASCII passive mode), an (ASCII normal mode), ip (Default—Binary passive mode), in (Binary normal mode).

  • scp://[[user[:password]@] server[/path]/filename[;int=interface_name]] —The ;int=interface option bypasses the route lookup and always uses the specified interface to reach the Secure Copy (SCP) server.

  • tftp://[[user[:password]@] server[ :port] /[path/]filename[;int=interface_name]] —Indicates a TFTP server. The pathname cannot contain spaces. The ;int=interface option bypasses the route lookup and always uses the specified interface to reach the TFTP server.

For commands such as help or ? , show , show xlate , or other commands that provide long listings, you can determine if the information displays a screen and pauses, or lets the command run to completion. The pager command lets you choose the number of lines to display before the More prompt appears.

When paging is enabled, the following prompt appears:

<--- More --->

The More prompt uses syntax similar to the UNIX more command:

• Press the Space bar to view another screen.

• Press the Enter key to view the next line.

• Press the q key to return to the command line.

You can precede a line with a colon ( : ) to create a comment. However, the comment only appears in the command history buffer and not in the configuration. Therefore, you can view the comment with the show history command or by pressing an arrow key to retrieve a previous command, but because the comment is not in the configuration, the write terminal command does not display it.

This section describes how to format a text configuration file that you can download to the ASA.

The ASA CLI currently supports UTF-8 encoding only. UTF-8 is the particular encoding scheme for Unicode symbols, and has been designed to be compatible with an ASCII subset of symbols. ASCII characters are represented in UTF-8 as one-byte characters. All other characters are represented in UTF-8 as multibyte symbols.

The ASCII printable characters (0x20 to 0x7e) are fully supported. The printable ASCII characters are the same as ISO 8859-1. UTF-8 is a superset of ISO 8859-1, so the first 256 characters (0-255) are the same as ISO 8859-1. The ASA CLI supports up to 255 characters (multibyte characters) of ISO 8859-1.