Usage Guidelines

Use the acknowledge fault command to acknowledge the existence of a fault.

Usage Guidelines

Use the acknowledge server command to verify the existence of a server in your network. For example, you can acknowledge a server that was recently commissioned to ensure that it exists.

In chassis mode, you can use only the id variable to identify the server to be acknowledged.

Usage Guidelines

Use the acknowledge slot command to verify the existence of a slot that was recently commissioned to ensure that it exists.

In chassis and fabric-interconnect mode, you can use only the id variable to identify the slot to be acknowledged.

In EXEC mode, you can use only the chassis and blade identification (chassis/ blade_id ) numbers to identify the slot to be acknowledged.

Usage Guidelines

As part of the activation process, all CLI sessions will be terminated.

Usage Guidelines

Use this command to back up the system event log (SEL) for a server.

In the command mode of a specific server (/chassis/server), you can run this command without any options.

Usage Guidelines

If you have already generated the authorization code, you must install it.

Usage Guidelines

If any user (including admin users) exceeds the specified maximum number of login attempts, the user is locked out of the system and must wait the specified amount of time before being allowed to log in, unless you clear the user’s locked-out status.

Usage Guidelines

When you enter this command, the text in the pre-login banner is cleared; the pre-login banner object itself is not deleted.

Usage Guidelines

You must be a user with admin or AAA privileges to use this command.

Usage Guidelines

Use this command to clear the system event log (SEL) for a server.

In the command mode for a specific server (/chassis/server), you can run this command without specifying a server.

Usage Guidelines

Use this command to execute or verify all pending configuration changes. While any configuration changes are pending, an asterisk (*) appears before the command prompt. When you enter the commit-buffer command, the pending commands are committed and the asterisk disappears.

Usage Guidelines

Refer to connect adapter: Command List for additional information.

Note	When you connect to an adapter command shell, the command-line prompt changes from your default prompt, which is the name you assigned to the appliance, to adapter n/n/n, where n/n/n is the adapterʼs chassis/server/ID combination you entered to connect.

To exit the adapter mode, type exit .

Usage Guidelines

See the ASA documentation for commands available from the CLI.

To exit the ASA console, enter Ctrl-a, d

Return to the supervisor level of the FXOS CLI:

Exit the console:

Enter ~, then quit to exit the Telnet application.

Example:

asa> Ctrl-a, d
Firepower-module1> ~
telnet> quit
firepower#

Exit the Telnet session:

Enter Ctrl-], .

Example:

asa> Ctrl-a, d
Firepower-module1> Ctrl-], .
firepower#

Usage Guidelines

Enter help to list available CIMC firmware debug utility commands; enter help command to view information about an individual command.

Note	When you connect to the CIMC command shell, the command-line prompt changes from your default prompt, which is the name you assigned to the appliance, to [ xxx ], where xxx is the last command you entered; see the following example.

Type exit to terminate the utility.

Do not use this utility unless instructed to do so by Cisco TAC. Refer to connect cimc: Command List for additional information.

Usage Guidelines

See the threat defense documentation for commands available from the CLI.

To exit the threat defense console, enter exit. For pre-2.4(1) versions, enter Ctrl-a, d

Return to the supervisor level of the FXOS CLI:

Exit the console:

Enter ~, then quit to exit the Telnet application.

Example:

> exit
Firepower-module1> ~
telnet> quit
firepower#

Exit the Telnet session:

Enter Ctrl-], .

Example:

> exit
Firepower-module1> Ctrl-], .
firepower#

Usage Guidelines

Type ? to list available FXOS shell commands; enter command ? to view information about an individual command.

Note	When you connect to the FXOS command shell, the command-line prompt changes from your default prompt, which is the name you assigned to the appliance, to the default prompt with (fxos) appended; see the following example.

To exit the FXOS shell, type exit .

Usage Guidelines

Type ? to list available local-management shell commands; enter command ? to view information about an individual command.

Refer to connect local-mgmt: Command List for additional information.

Note	When you connect to the local-management command shell, the command-line prompt changes from your default prompt, which is the name you assigned to the appliance, to the default prompt with (local-mgmt) appended; see the following example.

To exit the local-management mode, type exit .

Usage Guidelines

From the module CLI, you can connect to the application CLI using the connect application command.

Type help to list available module shell commands; enter help command to view information about an individual command. You also can use ? in place of help to view help information.

Note	When you connect to a module command shell, the command-line prompt changes from your default prompt, which is the name you assigned to the appliance, to Firepower-modulen, where n is the number of the module to which you connected; see the following example.

Refer to connect module: Command List for additional information.

Usage Guidelines

See the vDP documentation for commands available from the CLI.

To exit the vDP console, enter Ctrl-], .

Return to the supervisor level of the FXOS CLI:

Exit the console:

Enter ~, then quit to exit the Telnet application.

Example:

> Ctrl-], .
Firepower-module1> ~
telnet> quit
firepower#

Exit the Telnet session:

Enter Ctrl-], .

Example:

> Ctrl-], .
Firepower-module1> Ctrl-], .
firepower#

Usage Guidelines

You can set many parameters for this application instance, including the the image version, deployment type, resource profile and mode. You can also enable, disable and restart the application.

Usage Guidelines

Bootstrap settings are meant for initial deployment only, or for disaster recovery. For normal operation, you can change most values in the application CLI configuration.

Usage Guidelines

Bootstrap settings are meant for initial deployment only, or for disaster recovery. For normal operation, you can change most values in the application CLI configuration.

Usage Guidelines

Expert Mode provides FTD shell access for advanced troubleshooting. By default for container instances, Expert Mode is only available to users who access the FTD CLI from the FXOS CLI. This limitation is only applied to container instances to increase isolation between instances. Use Expert Mode only if a documented procedure tells you it is required, or if the Cisco Technical Assistance Center asks you to use it. To enter this mode, use the expert command in the FTD CLI.

Usage Guidelines

Bootstrap settings are meant for initial deployment only, or for disaster recovery. For normal operation, you can change most values in the application CLI configuration.

Usage Guidelines

The pre-configured ASA admin user and enable password is useful for password recovery; if you have FXOS access, you can reset the admin user password if you forget it.

Usage Guidelines

You can choose any passphrase for this registration key between 1 and 37 characters; you will enter the same key on the FMC when you add the FTD. Bootstrap settings are meant for initial deployment only, or for disaster recovery. For normal operation, you can change most values in the application CLI configuration.

Usage Guidelines

The FTD uses DNS if you specify a hostname for the FMC.

Usage Guidelines

Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication: the FMC specifies the device IP address, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. You can specify any text string as the NAT ID, from 1 to 37 characters. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration.

Usage Guidelines

In conjunction with the use of a breakout cable, you can use this command to “break out” a 40-Gigabit Ethernet port, creating up to four unconfigured 10-Gigabit ports.

Hardware bypass-capable interfaces cannot be configured as breakout ports.

Note	Because configuring breakout on a port causes a system reboot, we recommend you break out all required ports before committing the changes.

Usage Guidelines

When you create a new keyring certificate request, you are automatically entered into certificate request mode (security/keyring/certreq) with an asterisk indicating the new certificate request is not yet defined and committed. You also can scope into certificate request mode for an existing keyring.

Use the set command in certificate request mode to specify certificate request parameters.

Note	Before you create or commit a new certificate request, you must set the RSA key modulus (SSL key length) using set modulus.

Usage Guidelines

Use classes to place thresholds on specific sets of statistics. For example, you might want to define a threshold on a port that raises a fault if the average number of packets dropped exceeds a certain amount. For this class, you would create threshold properties for Ethernet error statistics.

You can configure multiple classes for a statistics threshold policy.

Use the set collection-interval command to define how frequently statistics are collected, and use the set reporting-interval command to define how frequently the statistics are reported. These intervals define a statistics collection policy.

Note

There is one default statistics threshold policy each for Ethernet server ports or Ethernet uplink ports. You cannot create additional statistics collection policies and you cannot delete the existing default policies for these components—you can only modify the default policies. However, you can create and delete statistics threshold policies in organization mode (scope org/).

Usage Guidelines

When you create a new IPSec connection, you are automatically entered into security/ipsec/connection mode with an asterisk indicating the new connection is not yet committed. You can configure the connection before committing it.

After you create a connection, the name cannot be changed. You must delete the connection and create a new one.

Usage Guidelines

When you create a new Smart Call Home destination, you are automatically entered into callhome/profile mode (monitoring/callhome/profile) with an asterisk indicating the new destination is not yet committed. You can set the destination parameters—transport protocol and an email address—and then commit the new destination information.

Note	An email address is the only allowed destination address in a callhome profile.

After you create a Smart Call Home destination, the destination name cannot be changed. You must delete the destination and create a new one.

Usage Guidelines

By default, this command creates the DNS name server in FXOS.

Usage Guidelines

This command deletes a TLS crypto acceleration configuration for a container instance. If TLS crypto acceleration is enabled on the container instance, the command disables it before deleting the configuration.

Usage Guidelines

Use this command to assign a block of IPv4 addresses to provide access to a specified service (HTTPS, SNMP, or SSH).

When you create a new IP block, you are automatically entered into ip-block mode (system/services/ip-block) with an asterisk indicating the new block assignment is not yet committed.

On FXOS versions 2.3.1 and earlier, up to 25 different blocks can be configured for each service. On FXOS versions 2.4.1 and later, up to 100 different blocks can be configured for each service. An address of 0.0.0.0 and a prefix of 0 allows unrestricted access to a service. Each block of addresses is identified by its starting IPv4 address.

Usage Guidelines

Use this command to assign a block of IPv6 addresses to provide access to a specified service (HTTPS, SNMP, or SSH).

When you create a new IPv6 block, you are automatically entered into ipv6-block mode (system/services/ipv6-block) with an asterisk indicating the new block assignment is not yet committed.

On FXOS versions 2.3.1 and earlier, up to 25 different blocks can be configured for each service. On FXOS versions 2.4.1 and later, up to 100 different blocks can be configured for each service. An address of 0:0:0:0:0:0:0:0 and a prefix of 0 allows unrestricted access to a service. Each block of addresses is identified by its starting IPv6 address.

Usage Guidelines

When you create a new keyring, you are automatically entered into keyring mode (security/keyring) with an asterisk indicating the new keyring is not yet committed. You can create a keyring certificate request, and set keyring parameters such as RSA key modulus and certificate authority trustpoint, and then commit the new keyring information.

Usage Guidelines

You can configure up to 48 local user accounts. Each account must have a unique user name and password.

When you create a new user account, you are automatically entered into local user mode (/security/local-user) with an asterisk indicating the new account is not yet committed. You can specify additional user account information such as password, first and last names, and so on, and then commit the new account information.

After you create the user account, the account name cannot be changed. You must delete the user account and create a new one.

Usage Guidelines

You must create or enter a port-channel before you can use this command.

When you create a new member port, you are automatically entered into member-port mode (eth-uplink/fabric/port-channel/member-port) with an asterisk indicating the new member port is not yet committed.

Usage Guidelines

By default, this command creates the NTP server in FXOS.

Usage Guidelines

When you create a new Smart Call Home policy, you are automatically entered into callhome/policy mode (monitoring/callhome/policy) with an asterisk indicating the new policy is not yet committed. You can set property values and enable/disable services, and then commit the new policy.

After you create a Smart Call Home policy, the policy name cannot be changed. You must delete the policy and create a new one.

Use this command to create an instance of a policy for an existing type of fault or system event. The available keywords for Call Home policy event types are:

• adaptor-mismatch

• arp-targets-config-error

• association-failed

• configuration-failure

• connectivity-problem

• election-failure

• equipment-degraded

• equipment-disabled

• equipment-inaccessible

• equipment-inoperable

• equipment-offline

• equipment-problem

• equipment-removed

• fru-problem

• health-led-amber

• health-led-amber-blinking

• identity-unestablishable

• inventory-failed

• license-graceperiod-expired

• limit-reached

• link-down

• management-services-failure

• management-services-unresponsive

• memory-error

• mgmtif-down

• ndisc-targets-config-error

• near-max-limit

• port-failed

• power-problem

• psu-insufficient

• psu-mixed-mode

• thermal-problem

• version-incompatible

• vif-ids-mismatch

• voltage-problem

Usage Guidelines

Flow-control policies determine whether the uplink Ethernet ports in an appliance domain send and receive IEEE 802.3x pause frames when the receive buffer for a port reaches full capacity. These pause frames request that the transmitting port stop sending data for a few milliseconds until the buffer clears. For flow control to work between devices, you must enable the corresponding send and receive flow-control parameters for both devices.

The default flow-control policy disables send and receive control, and sets the priority to auto-negotiate.

When you create a new flow-control policy, you are automatically entered into flow-control/policy mode (eth-uplink/flow-control/policy) with an asterisk indicating the new policy is not yet committed. You can set policy property values and then commit the new policy.

After you create a flow-control policy, the policy name cannot be changed. You must delete the policy and create a new one.

Usage Guidelines

When you create a new port-channel, you are automatically entered into port-channel mode (eth-uplink/fabric/port-channel) with an asterisk indicating the new port-channel is not yet committed. You can set the port-channel parameters and then commit the new port-channel.

After creating a new port-channel, enable it and add member ports.

When the Firepower 4100/9300 chassis creates an EtherChannel, the EtherChannel stays in a Suspended state until you assign it to a logical device, even if the physical link is up. The EtherChannel will be brought out of this Suspended state in the following situations:

• The EtherChannel is added as a data or management port for a standalone logical device.

• The EtherChannel is added as a management or CCL port for a logical device that is part of a cluster.

• The EtherChannel is added as a data port for a logical device that is part of a cluster and at least one security module has joined the cluster.

Note that the EtherChannel does not come up until you assign it to a logical device. If the EtherChannel is removed from the logical device or the logical device is deleted, the EtherChannel will revert to a Suspended state.

Note	The Firepower 4100/9300 chassis only supports EtherChannels in Active Link Aggregation Control Protocol (LACP) mode. We suggest setting the connecting switch ports to Active mode for the best compatibility.

Usage Guidelines

When you create a new pre-login banner, it is initially blank and you are automatically entered into pre-login-banner mode (security/banner/pre-login-banner) with an asterisk indicating the banner is not yet specified and committed.

Use the set message command to enter the pre-login banner text. You must enter ENDOFBUF (must be all capital letters) to terminate the banner message.

If a pre-login banner already exists when you enter this command, the command will fail with the message Error: Managed object already exists.

Usage Guidelines

When you create a new Smart Call Home profile, you are automatically entered into callhome/profile mode (monitoring/callhome/profile) with an asterisk indicating the new profile is not yet committed. You can define the profile, and then commit the new profile information.

After you create a Smart Call Home destination profile, the profile name cannot be changed. You must delete the profile and create a new one.

Usage Guidelines

Use classes to place thresholds on specific sets of statistics. Use properties to define particular values and statistics thresholds for a policy class. For example, you might want to define a threshold on a port that raises a fault if the average number of packets dropped exceeds a certain amount. For this class, you would create threshold properties for the Ethernet error statistics class.

You can configure multiple properties for a policy class.

Note

There is one default statistics threshold policy each for Ethernet server ports or Ethernet uplink ports. You cannot create additional statistics collection policies and you cannot delete the existing default policies for these components—you can only modify the default policies. However, you can create and delete statistics threshold policies in organization mode (scope org/).

Usage Guidelines

To specify resource usage per container instance, create one or more resource profiles. When you deploy the logical device/application instance, you specify the resource profile that you want to use. The resource profile sets the number of CPU cores; RAM is dynamically allocated according to the number of cores, and disk space is set to 40 GB per instance.

• The minimum number of cores is 6.

• You cannot specify 8 cores due to internal architecture.

• You can assign cores as an even number (6, 10, 12, 14 etc.) up to the maximum.

• The maximum number of cores available depends on the security module/chassis model.

The chassis includes a default resource profile called "Default-Small," which includes the minimum number of cores. You can change the definition of this profile, and even delete it if it is not in use. Note that this profile is created when the chassis reloads and no other profile exists on the system.

You cannot change the resource profile settings if it is currently in use. You must disable any instances that use it, then change the resource profile, and finally reenable the instance. If you resize instances in an established High Availability pair, then you should make all members the same size as soon as possible.

If you change the resource profile settings after you add the threat defense instance to the management center, update the inventory for each unit on the Devices > Device Management > Device > System > Inventory dialog box.

Usage Guidelines

If you use a host name or FQDN to specify the server id , a DNS server must also be configured.

If SSL is enabled, the server id must exactly match a Common Name (CN) in the LDAP serverʼs security certificate.

When you create a new LDAP server, you are automatically entered into security/ldap/server mode with an asterisk indicating the new server is not yet committed. You can configure the server before committing it.

Note	The FXOS supports a maximum of 16 LDAP providers.

Usage Guidelines

You must enable SNMP (enable snmp ), and create an SNMP community (set snmp community ), before you create an SNMP trap.

When you create a new SNMP trap, you are automatically entered into monitoring/snmp-trap mode with an asterisk indicating the new trap is not yet committed.

Note	You can create up to eight SNMP traps.

Usage Guidelines

You must enable SNMP (enable snmp ), and create an SNMP community (set snmp community ), before you create an SNMP user.

When you create a new SNMP user, you are asked to create a password for the user. This password must be at least eight characters long; it is not displayed as you enter it.

When you create a new SNMP user, you are automatically entered into monitoring/snmp-user mode with an asterisk indicating the new user is not yet committed.

Usage Guidelines

Use the create form of this command to generate a new SSH host key.

Use the delete form of this command to destroy an existing SSH host key before generating a new one.

Usage Guidelines

A statistics threshold policy monitors statistics about certain aspects of the system and generates an event if a specified threshold is crossed. You can set both minimum and maximum thresholds. For example, you can configure the policy to raise an alarm if the CPU temperature exceeds a certain value, or if a server is overutilized or underutilized.

You can create, enter and delete additional statistics threshold policies in organization mode only. You cannot create additional statistics threshold policies for Ethernet server ports or Ethernet uplink ports, and you cannot delete the existing default policies for those components—you can only modify the default policies.

Note	Use the set collection-interval command to define how frequently statistics are collected, and use the set reporting-interval command to define how frequently the statistics are reported. These intervals define a statistics collection policy.

Usage Guidelines

You can add up to 500 subinterfaces to your chassis.

For standalone instances, subinterfaces are supported on data or data-sharing type interfaces only. For multi-instance clustering, you can only add subinterfaces to the Cluster-type interface; subinterfaces on data interfaces are not supported.

VLAN IDs per interface must be unique, and within a container instance, VLAN IDs must be unique across all assigned interfaces. You can reuse VLAN IDs on separate interfaces as long as they are assigned to different container instances. However, each subinterface still counts towards the limit even though it uses the same ID.

For native instances, you can create VLAN subinterfaces within the application only. For container instances, you can also create VLAN subinterfaces inside the application on interfaces that do not have FXOS VLAN subinterfaces defined, and these subinterfaces are not subject to the FXOS limit. Choosing in which operating system to create subinterfaces depends on your network deployment and personal preference. For example, to share a subinterface, you must create the subinterface in FXOS. Another scenario that favors FXOS subinterfaces comprises allocating separate subinterface groups on a single interface to multiple instances. For example, you want to use Port-Channel1 with VLAN 2-11 on instance A, VLAN 12-21 on instance B, and VLAN 22-31 on instance C. If you create these subinterfaces within the application, then you would have to share the parent interface in FXOS, which may not be desirable. See the following illustration that shows the three ways you can accomplish this scenario:

You cannot add a subinterface to a physical interface that is currently allocated to a logical device. If other subinterfaces of the parent are allocated, you can add a new subinterface as long as the parent interface itself is not allocated.

Usage Guidelines

Use classes to place thresholds on specific sets of statistics. Use properties to define particular values, including normal values and threshold values, for a policy class. For example, you might want to define a threshold on a port that raises a fault if the average number of packets dropped exceeds a certain amount. For this class, you would create threshold properties for the Ethernet error statistics class.

You can configure multiple properties for a policy class, and you can create multiple threshold values for a property.

Note

There is one default statistics threshold policy each for Ethernet server ports or Ethernet uplink ports. You cannot create additional statistics collection policies and you cannot delete the existing default policies for these components—you can only modify the default policies. However, you can create and delete statistics threshold policies in organization mode (scope org/).

Usage Guidelines

Use this command to identify trustpoints that will be used to validate certificates during Internet Key Exchange (IKE) authentication.

When you create a new trustpoint, you are automatically entered into security/trustpoint mode with an asterisk indicating the new trustpoint is not yet committed. After you create a trustpoint, the name cannot be changed. You must delete the trustpoint and create a new one.