seconds

Absolute session timeout for Web, SSH, and Telnet sessions; value can be 0 to 3600 seconds. To disable this timeout, set the value to 0.

active

Specifies that the local user account is active.

inactive

Specifies that the local user account is disabled.

address

The email address or URL of the Smart Call Home or Smart Licensing destination.

disabled

Sets the policy administrative state to disabled.

enabled

Sets the policy administrative state to enabled.

admin

The name of the authentication server group.

on

(Optional) Auto-Negotiation is turned on.

off

(Optional) Auto-Negotiation is turned off.

cert_chain

(Optional) The certificate chain obtained from a Certificate Authority.

If this variable is omitted, you are prompted to enter the certificate information manually.

country

(Optional) Specify a two-letter country code for the request; letters must be capitalized.

dns

(Optional) Specify the domain name assigned to the network; common to all host names. This is an alternative to subject-name .

e-mail

(Optional) Specify the email address associated with the request.

fi-a-ip

Not used.

fi-a-ipv6

Not used.

fi-b-ip

Not used; there is no fabric interconnect B.

fi-b-ipv6

Not used; there is no fabric interconnect B.

ip

(Optional) Specify the IPv4 address of the device domain.

ipv6

(Optional) Specify the IPv6 address of the device domain.

locality

(Optional) Specify the city or town in which the company requesting the certificate is headquartered.

Enter up to 64 characters. You can use any letters, numbers, or spaces, as well as the following special characters: , (comma), . (period), @ (at sign), ^ (carat), ( (open parenthesis), ) (close parenthesis), - (dash), _ (underscore), + (plus sign), : (colon), / (forward slash).

org-name

(Optional) Specify the name of the organization requesting the certificate.

Enter up to 64 characters. You can use any letters, numbers, or spaces, as well as the following special characters: , (comma), . (period), @ (at sign), ^ (carat), ( (open parenthesis), ) (close parenthesis), - (dash), _ (underscore), + (plus sign), : (colon), / (forward slash).

org-unit-name

(Optional) Specify the name of the unit within the organization.

Enter up to 64 characters. You can use any letters, numbers, or spaces, as well as the following special characters: , (comma), . (period), @ (at sign), ^ (carat), ( (open parenthesis), ) (close parenthesis), - (dash), _ (underscore), + (plus sign), : (colon), / (forward slash).

password

(Optional) You are asked to enter and then confirm a password for the request.

state

(Optional) Specify the state or province in which the company requesting the certificate is headquartered.

Enter up to 64 characters. You can use any letters, numbers, or spaces, as well as the following special characters: , (comma), . (period), @ (at sign), ^ (carat), ( (open parenthesis), ) (close parenthesis), - (dash), _ (underscore), + (plus sign), : (colon), / (forward slash).

subject-name

(Optional) Specify the fully qualified domain name of the local fabric interconnect.

adminstate { disable| enable

Enables or disables policy administration. When disabled, configuration back-ups are not exported according to the policy schedule.

descr description

(Optional) You can add a description to the configuration object; the description can be between one and 256 characters. Most alphanumeric characters are allowed, as are dashes and underscores; the string can end with punctuation such as semi-colon, period (full stop), and exclamation point, but you cannot embed those characters in the description.

hostname host_ID

(Optional) Specify the IP address or host name of the remote server to which the configuration back-up is exported. This host can be a server, storage array, local drive, or any read/write media that is accessible on the network.

password

(Optional) Specify the password used to connect to the remote server; you are asked to enter and then confirm the password.

port { number| default}

(Optional) You can change the port on which communications with the remote server take place; if this option is not specified, the protocolʼs default port is used.

The options are a port-ID number between zero and 4294967295, or default for the current protocolʼs default port.

protocol name

(Optional) Specify the file-transfer protocol to use. Available options are:

• ftp

• scp

• sftp

• tftp

remote-file name

(Optional) Specify the full path, including a file name, for the exported configuration; can be between one and 128 characters.

schedule { bi-weekly| daily| weekly}

(Optional) Specify how frequently the configuration is automatically exported:

• bi-weekly – Export occurs every two weeks.

• daily – Export occurs every day.

• weekly – Export occurs once a week.

user name

(Optional) Specify the user-account name employed to connect to the remote host; can be between zero and 510 characters.

adminstate { disable| enable

Enable or disable the export reminder. When disabled, configuration back-up reminder faults are not generated.

frequency number_of_days

Specify the number of days that can pass without a configuration back-up occuring. After this period, the system will generate a reminder fault. This value can be between one and 365 days.

suppress-field-spillover { off| on}

Use off to wrap output lines in the terminal window.

Use on to truncate output lines at the end of the terminal window.

suppress-headers { off| on}

Use off to display table headers.

Use on to not display table headers.

table-field-delimiter { comma| none}

Use comma to separate fields in command output tables with commas.

Use none to separate fields in command output tables with spaces.

set clock

Use set clock to manually set the clock in FXOS.

interval

Length of time defining the statistics collection interval; available values are:

• 1minute – one-minute intervals

• 2minutes – two-minute intervals

• 30seconds – 30-second intervals

• 5minutes – five-minute intervals

seconds

Serial console absolute session timeout; value can be 0 to 3600 seconds. To disable this timeout, set the value to 0.

seconds

Serial console idle session timeout; value can be 0 to 3600 seconds. To disable this timeout, set the value to 0.

cores

Sets the number of cores for the profile, between 6 and the maximum, depending on your chassis, as an even number. You cannot specify 8 cores.

container

Sets the application instance to the container type.

native

Sets the application instance to the native type.

description

(Optional) Description. Enter up to 256 characters.

fullduplex

(Optional) Specifies the duplex mode as full.

halfduplex

(Optional) Specifies the duplex mode as half.

email_address

An email address for the user account. Specify the email address in the format: user_name@domain_name.

no

Disables strong password enforcement.

yes

Enables strong password enforcement.

{ apr| aug| dec| feb| jan| jul| jun| mar| may| nov| oct| sep}

The three-letter month abbreviation.

day

Numeric day of the month; valid values are 1 through 31.

year

Numeric year for expiration; maximum value is 2037.

descr description

(Optional) You can add a description to the configuration object; can be between one and 256 characters. Most alphanumeric characters are allowed, as are dashes and underscores; the string can end with punctuation such as semi-colon, period (full stop), and exclamation point, but you cannot embed those characters in the description.

password

(Optional) You can change the password used to connect to the remote server; you are asked to enter and then confirm the password.

port { number| default}

(Optional) You can change the port on which communications with the remote server take place. The options are a port-ID number between zero and 4294967295, or default for the current protocolʼs default port.

protocol name

(Optional) You can change the file-transfer protocol used to transmit the configuration back-up to the remote server. Available options are:

• ftp

• scp

• sftp

• tftp

remote-file name

(Optional) You can change the name of the back-up configuration file; can be between one and 128 characters.

user name

(Optional) You can change the user-account name employed to connect to the remote host; can be between zero and 510 characters.

name

The user’s first name; can be zero to 32 characters.

name

The name of the flow control policy; maximum of 16 characters.

prio { auto| on

Sets the flow-control priority option:

• auto – This device and the network will negotiate whether Point-to-Point Protocol (PPP) is used on this fabric.

• on – PPP is enabled on this fabric.

receive off

Specifies that pause requests from the network are ignored and traffic flow continues normally.

send off| on

Sets the flow-control send parameter:

• off – Traffic flows normally regardless of packet load.

• on – This device sends a pause request to the network if the incoming packet buffer becomes full. The pause remains in effect for a few milliseconds while traffic returns to normal levels.

days

Config Export Reminder (Days).

off

Disables the Smart Call Home HTTP/HTTPS proxy.

on

Enables the Smart Call Home HTTP/HTTPS proxy.

port_number

The port for the HTTP or HTTPS proxy server; range is 1 to 65535.

url

The HTTP or HTTPS address of the proxy server; can be a maximum of 2083 characters.

auth-type { cert-auth| cred-auth}

(Optional) Specifies the type of authentication to use for HTTPS access:

• cert-auth—Sets your system to use a client certificate in conjunction with LDAP to authenticate users for HTTPS access.

• cred-auth —Sets the system to use credential-based user authentication for HTTPS access.

cipher-suite cipher_string

(Optional) Specifies the definition string for the cipher suite to be used with the custom cipher-suite-mode .

The specification string can contain up to 256 characters and must conform to the OpenSSL Cipher Suite specifications. You cannot use any spaces or special characters, except ! (exclamation point), + (plus sign), - (hyphen), and : (colon). See http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite for additional information.

cipher-suite-mode { custom| high-strength| low-strength

(Optional) Sets the level of Cipher Suite security used:

• custom —Lets you define a custom Cipher Suite security specification string using the cipher-suite option.

• high-strength —ALL:!EDH-RSA-DES-CBC3-SHA: !EDH-DSS-DES-CBC3-SHA: !DES-CBC3-SHA:!ADH:!3DES: !EXPORT40:!EXPORT56:!LOW:!MEDIUM:!eNULL:!RC4:!MD5: !IDEA:+HIGH:+EXP

• low-strength —ALL:!EDH-RSA-DES-CBC3-SHA: !EDH-DSS-DES-CBC3-SHA: !DES-CBC3-SHA:!ADH:!3DES: !EXPORT40:!EXPORT56:RC4+RSA: !IDEA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL

• medium-strength —ALL:!EDH-RSA-DES-CBC3-SHA: !EDH-DSS-DES-CBC3-SHA: !DES-CBC3-SHA:!ADH:!3DES:!EXPORT40:!EXPORT56: !LOW:!RC4:!MD5:!IDEA:+HIGH:+MEDIUM:+EXP:+eNULL

Generally, cipher strength is roughly based on the bits of security (or symmetric key size), with ‟low” meaning less than 128 bits of security, ‟medium” meaning equal to 128 bits, and ‟high” meaning greater than 128 bits of security.

crl-mode { relaxed| strict}

(Optional) Defines the level of certificate revocation list (CRL) checking for HTTPS connections:

• relaxed —Certificates found on a CRL may be used to allow HTTPS authentication, depending on the reason for the certificateʼs listing; a warning message is logged whenever this occurs. Essentially disables CRL checking.

• strict —Connection authentication fails for any certificate on a CRL; a warning message is logged whenever this occurs. Also, the CRL must be up to date.

keyring keyring_name

(Optional) Specifies the name of the RSA keyring to be used for HTTPS connections.

port port_number

(Optional) Specifies the port to be used for HTTPS connections; can be 1 to 65535. Default is 443.

admin-duplex { fullduplex| halfduplex}

Defines the duplex mode for the interface:

• fullduplex – Specifies simultaneous two-way communications.

• halfduplex – Specifies one-way-at-a-time communications.

admin-speed { 100gbps| 100mbps| 10gbps| 10mbps| 1gbps| 40gbps}

Specify the interface data-transfer speed:

• 100gbps – One hundred Gigabits per second.

• 100mbps – One hundred Megabits per second.

• 10gbps – Ten Gigabits per second.

• 10mbps – Ten Megabits per second.

• 1gbps – One Gigabit per second.

• 40gbps – Forty Gigabits per second.

auto-negotiation { no| yes}

Enables or disables auto-negotiation of common transmission parameters such as speed, duplex and flow control.

• no – Disables auto-negotiation.

• yes – Enables auto-negotiation.

descr description

You can add a description to the interface; the description can be between zero and 256 characters. Most alphanumeric characters are allowed, as are dashes and underscores; spaces are not allowed. The string can end with punctuation such as semi-colon, period (full stop), and exclamation point, but you cannot embed those characters in the description.

eth-link-profile name

You can assign an Ethernet Link Profile to the interface, automatically configuring the interface according to the profile parameters. Provide the name of the profile; can be up to 16 alphanumeric characters.

flow-control-policy name

You can assign a flow-control policy to the interface; provide the policy name, which can be up to 16 alphanumeric characters.

nw-ctrl-policy name

You can assign a network-control policy to the interface; provide the policy name, which can be up to 16 alphanumeric characters.

port-type { cluster| data| data-sharing| firepower-eventing| mgmt}

Specify the interface type or function:

• cluster – Specify cluster only if you want to use this interface as the cluster control link.

• data – Use for regular data transmission. This is the default type.

• data-sharing – Use for regular data; only supported with container instances.

• firepower-eventing – Use this interface as a secondary management interface for threat defense devices. The firepower-eventing interface is used to carry all event traffic (such as Web events).

• mgmt – Use to manage application instances. You can only assign one management interface per logical device.

See set port-type for more information about this command.

user-label label

You can apply a descriptive label to this interface. can be beween zero and 16 alphanumeric characters.

enable/disable

Enables or disables IPv6 support on the firepower device.

auto eui64

Generates the ipv6 address based on the hardware identifiers.

auto stablesec

Generates the ipv6 address based on the stable secret seed values.

ipv6-addr <address>

Input IPv6 adress

ipv6-readyconfig eui64

eui64 method to generate the ipv6 address based on the input address

ipv6-readyconfig stablesec

stablesec method to generate the ipv6 address based on the input address

ipv6-readyprefix <prefix>

IPv6 prefix

name

The name of a keyring to be assigned to the IPSec connection; maximum of 16 characters.

name

The user’s surname; can be 0 to 32 characters.

ip_address

Provide an IPv4 or IPv6 local gateway address for the IPSec connection; maximum of 510 characters.

Enter a value between 0 and 4 to specify IPSec log verbosity; default is 1.

0 – Basic auditing information; for example, SA up/down.

1 – General control flow information, with errors.

2 – More detailed control flow information; includes debugging information.

3 – Includes raw data dumps (hexadecimal).

4 – Includes sensitive information in the data dumps; for example, SA keys.

max_attempts

The maximum number of failed login attempts before the user is locked out of the system. The value can range from 0 to 10; the default is 0.

num_chars

The minimum number of characters required for user passwords; value can range from 8 to 80.

transport

Sets the connection mode to transport .

tunnel

Sets the connection mode to tunnel .

RSA key modulus (SSL key length) in bits

Valid options are:

• mod1536 – Modulus is 1536 bits

• mod2048 – Modulus is 2048 bits

• mod2560 – Modulus is 2560 bits

• mod3072 – Modulus is 3072 bits

• mod3584 – Modulus is 3584 bits

• mod4096 – Modulus is 4096 bits

enable

Enables the rdnssd (ipv6 recursive dns server discovery daemon) to run, once it is set to enable.

disable

Disables the rdnssd daemon in the firepower device.

gw gateway_address

ip ip_address

netmask network_mask

Provide an IPv4 gateway address.

Provide an IPv4 address for device management access.

Provide a netmask for the IPv4 address.

ipv6 ipv6_address

ipv6-gw ipv6_gateway

prefix ipv6_prefix

Provide an IPv6 address for device management access.

Provide an IPv6 gateway address.

Provide a prefix length for the IPv6 address.

change-count count

The maximum number of times a user can change his or her password (during the time period specified with set change-interval ); value can be 0 to 10.

change-during-interval { disable| enable}

Enable or disable restrictions on the number of password changes a locally authenticated user can make:

• disable – Disables restrictions on the number of password changes.

• enable – Enables restrictions on the number of password changes.

This option must be enabled before you can specify the maximum number of times a locally authenticated user can change his or her password, and the number of hours over which that number of password changes can be made.

change-interval interval

The interval over which a user’s password changes are tallied to ensure they do not exceed the maximum number specified with the set change-count command; the number of hours can be 1 to 745.

The set change-during-interval option must be enabled before you can specify this interval.

history-count count

The number of unique passwords that a locally authenticated user must create before that user can re-use a previously used password; value can be 0 to 15.

By default, the count value is zero, which disables the password history count, allowing users to re-use previously used passwords at any time.

no-change-interval hours

The length of time in hours during which a user cannot change her or his password again; value can be 1 to 745.

The set change-during-interval option must be disabled before you set this time period, otherwise this value is ignored.

tel_number

A contact telephone number for the user account; maximum of 20 characters.

auto-negotiation { no| yes}

Enables or disables auto-negotiation of common transmission parameters such as speed, duplex and flow control.

• no – Disables auto-negotiation.

• yes – Enables auto-negotiation.

descr description

You can add a description to the port-channel; the description can be between zero and 256 characters. Most alphanumeric characters are allowed, as are dashes and underscores; spaces are not allowed. The string can end with punctuation such as semi-colon, period (full stop), and exclamation point, but you cannot embed those characters in the description.

duplex { fullduplex| halfduplex}

Defines the duplex mode for the port-channel:

• fullduplex – Specifies simultaneous two-way communications.

• halfduplex – Specifies one-way-at-a-time communications.

flow-control-policy name

You can assign a flow-control policy to the port-channel; provide the policy name, which can be up to 16 alphanumeric characters.

lacp-policy-name name

You can assign a LACP policy to the port-channel; provide the policy name, which can be up to 16 alphanumeric characters.

nw-ctrl-policy name

You can assign a network-control policy to the port-channel; provide the policy name, which can be up to 16 alphanumeric characters.

port-channel-mode { active| on}

Define the mode for the port-channelʼs physical data or data-sharing interfaces:

• active – Sends and receives LACP updates. An active port-channel can establish connectivity with either an active or a passive port-channel. You should use the active mode unless you need to minimize the amount of LACP traffic. This is the default.

• on – The port-channel is always on, and LACP is not used. An “on” port-channel can only establish a connection with another “on” port-channel.

Non-data interfaces support only active mode.

port-type { cluster| data| data-sharing| firepower-eventing| mgmt}

Specify the port-channel type or function:

• cluster – Specify cluster only if you want to use this port-channel as the cluster control link.

• data – Use for regular data transmission. This is the default type.

• data-sharing – Use for regular data; only supported with container instances.

• firepower-eventing – Use this port-channel as a secondary management interface for threat defense devices. The firepower-eventing port-channel is used to carry all event traffic (such as Web events).

• mgmt – Use to manage application instances. You can only assign one management interface per logical device.

See set port-type for more information about this command.

speed { 100gbps| 100mbps| 10gbps| 10mbps| 1gbps| 40gbps}

Specify the port data-transfer speed:

• 100gbps – One hundred Gigabits per second.

• 100mbps – One hundred Megabits per second.

• 10gbps – Ten Gigabits per second.

• 10mbps – Ten Megabits per second.

• 1gbps – One Gigabit per second.

• 40gbps – Forty Gigabits per second.

active

Sets the interface in an EtherChannel to be active.

on

Sets the interface in an EtherChannel to be on. Only supported for Data or Data-sharing interfaces.

cluster

Special interface type used for a clustered logical device. This type is automatically assigned to the cluster control link for inter-unit cluster communications. By default, the cluster control link is automatically created on port-channel 48. For multi-instance clustering, you cannot share a Cluster-type interface across devices. You can add VLAN subinterfaces to the Cluster EtherChannel to provide separate cluster control links per cluster. If you add subinterfaces to a Cluster interface, you cannot use that interface for a native cluster. device manager does not support clustering.

data

Data interfaces cannot be shared between logical devices.

data-sharing

Only supported with container instances, these data interfaces can be shared by one or more logical devices/container instances (threat defense-only). Each container instance can communicate over the backplane with all other instances that share this interface. Shared interfaces can affect the number of container instances you can deploy. Shared interfaces are not supported for bridge group member interfaces (in transparent mode or routed mode), inline sets, passive interfaces, clusters,or failover links.

firepower-eventing

This interface is a secondary management interface for threat defense devices. To use this interface, you must configure its IP address and other parameters at the threat defense CLI. For example, you can separate management traffic from events (such as web events). See the “Management Interfaces” section in the System Configuration chapter of the Management Center configuration guide. Firepower-eventing interfaces can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface.

mgmt

Use management interfaces to manage application instances. They can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface. You can only assign one management interface per logical device.

data-sharing

(Optional) Only supported with container instances, these data interfaces can be shared by one or more logical devices/container instances (FTD-only). Each container instance can communicate over the backplane with all other instances that share this interface. Shared interfaces can affect the number of container instances you can deploy. Shared interfaces are not supported for bridge group member interfaces (in transparent mode or routed mode), inline sets, passive interfaces, or failover links.

(Optional) Use management interfaces to manage application instances. They can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface. You can only assign one management interface per logical device.

firepower-eventing

(Optional) This interface is a secondary management interface for FTD devices. To use this interface, you must configure its IP address and other parameters at the FTD CLI. For example, you can separate management traffic from events (such as web events). See the "Management Interfaces" section in the Management Center configuration guide System Configuration chapter. Firepower-eventing interfaces can be shared by one or more logical devices to access external hosts; logical devices cannot communicate over this interface with other logical devices that share the interface.

cluster

(Optional) Special interface type used for a clustered logical device. This type is automatically assigned to the cluster control link for inter-unit cluster communications. By default, the cluster control link is automatically created on Port-channel 48.

prefix

Specifies a decimal value between 1 and 65535. This prefix is converted to a four-digit hexadecimal number, and used as part of the MAC address.

ftp

Specifies the File Transfer Protocol (FTP) for file transfer.

scp

Specifies the Secure Copy Protocol (SCP) for file transfer.

sftp

Specifies the Secure File Transfer Protocol (SFTP) for file transfer.

tfp

Specifies the Trivial File Transfer Protocol (TFTP) for file transfer.

ldap

Specifies LDAP authentication.

local

Specifies local authentication.

none

Allows local users to log on without specifying a password.

radius

Specifies RADIUS authentication.

tacacs

Specifies TACACS+ authentication.

seconds

Number of seconds after which a Web session is considered inactive. Value can be 0 to 3600 seconds; default is 600 seconds.

no

Do not regenerate the keys.

yes

Regenerate the keys.