例

次に、framework1 および framework2 という名前の NAC ポリシーのデータの例を示します。

ciscoasa(config)# show nac-policy
nac-policy framework1 nac-framework
  applied session count = 0
  applied group-policy count = 2
  group-policy list:    GroupPolicy2    GroupPolicy1
nac-policy framework2 nac-framework is not in use.

各 NAC ポリシーの 1 行めは、名前とタイプ（nac-framework）を示します。ポリシーがどのグループ ポリシーにも割り当てられていない場合は、CLI のポリシー タイプの隣に「is not in use」というテキストが表示されます。それ以外は、そのグループ ポリシーの使用状況データが CLI に表示されます。表 10-1 に、show nac-policy コマンドのフィールドの説明を示します。

例

次に、 show nameif コマンドの出力例を示します。

ciscoasa# show nameif
Interface                Name                     Security
GigabitEthernet0/0       outside                  0
GigabitEthernet0/1       inside                   100
GigabitEthernet0/2       test2                    50

show nameif zone コマンドについては、次の出力を参照してください。

ciscoasa# show nameif zone
Interface                Name                   zone-name			   Security
GigabitEthernet0/0       inside-1               inside-zone   		100
GigabitEthernet0/1.21    inside                 inside-zone		   100
GigabitEthernet0/1.31    4                                    				0
GigabitEthernet0/2       outside                outside-zone  	0
Management0/0            lan                                  				0

例

次に、 show nat コマンドの出力例を示します。

ciscoasa# show nat
   Manual NAT Policies (Section 1)
   1 (any) to (any) source dynamic S S' destination static D' D
       translate_hits = 0, untranslate_hits = 0
   
   Auto NAT Policies (Section 2)
   1 (inside) to (outside) source dynamic A 2.2.2.2
       translate_hits = 0, untranslate_hits = 0
   
   Manual NAT Policies (Section 3)
   1 (any) to (any) source dynamic C C' destination static B' B service R R'
       translate_hits = 0, untranslate_hits = 0
ciscoasa# show nat detail
   Manual NAT Policies (Section 1)
   1 (any) to (any) source dynamic S S' destination static D' D
       translate_hits = 0, untranslate_hits = 0
       Source - Real: 1.1.1.2/32, Mapped: 2.2.2.3/32
       Destination - Real: 10.10.10.0/24, Mapped: 20.20.20.0/24
   
   Auto NAT Policies (Section 2)
   1 (inside) to (outside) source dynamic A 2.2.2.2
       translate_hits = 0, untranslate_hits = 0
       Source - Real: 1.1.1.1/32, Mapped: 2.2.2.2/32
   
   Manual NAT Policies (Section 3)
	1 (any) to (any) source dynamic C C' destination static B' B service R R'
       translate_hits = 0, untranslate_hits = 0
       Source - Real: 11.11.11.10-11.11.11.11, Mapped: 192.168.10.10/32
       Destination - Real: 192.168.1.0/24, Mapped: 10.75.1.0/24
       Service - Real: tcp source eq 10 destination eq ftp-data , Mapped: tcp source eq 
       100 destination eq 200

IPv6 と IPv4 の間での show nat detail コマンドの出力例を示します。

ciscoasa# show nat detail
1 (in) to (outside) source dynamic inside_nw outside_map destination static inside_map any
translate_hits = 0, untranslate_hits = 0
Source - Origin: 2001::/96, Translated: 192.168.102.200-192.168.102.210
Destination - Origin: 2001::/96, Translated: 0.0.0.0/0

バージョン 9.16 以降では、セクション 0 に、システムが正しく機能するために必要なシステム定義の NAT ルールが示されます。これらには、nlp_int_tap などの内部インターフェイスのルールが示されます。これらのルールは、他のすべてのルールよりも優先されます。セクション 0 のルールを追加または変更することはできません。

ciscoasa(config)# show nat detail
Manual NAT Policies Implicit (Section 0)
1 (nlp_int_tap) to (inside) source dynamic nlp_client_0_0.0.0.0_17proto53_intf3 interface  destination static nlp_client_0_ipv4_2 nlp_client_0_ipv4_2 service nlp_client_0_17svc53_1 nlp_client_0_17svc53_1
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 169.254.1.2/32, Translated: 10.99.11.7/24
    Destination - Origin: 0.0.0.0/0, Translated: 0.0.0.0/0
    Service - Origin: udp destination eq domain , Translated: udp destination eq domain
2 (nlp_int_tap) to (inside) source dynamic nlp_client_0_intf3 interface
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: 169.254.1.2/32, Translated: 10.99.11.7/24
3 (nlp_int_tap) to (inside) source dynamic nlp_client_0_ipv6_::_17proto53_intf3 interface ipv6  destination static nlp_client_0_ipv6_4 nlp_client_0_ipv6_4 service nlp_client_0_17svc53_3 nlp_client_0_17svc53_3
    translate_hits = 0, untranslate_hits = 0
    Source - Origin: fd00:0:0:1::2/128, Translated:
    Destination - Origin: ::/0, Translated: ::/0
    Service - Origin: udp destination eq domain , Translated: udp destination eq domain

例

次に、show nat divert-table コマンドの出力例を示します。

ciscoasa# show nat divert-table
Divert Table
id=0xad1521b8, domain=twice-nat section=1 ignore=no
        type=none, hits=0, flags=0x9, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0-0
        dst ip/id=10.86.119.255, mask=255.255.255.255, port=0-0
        input_ifc=outside, output_ifc=NP Identity Ifc
id=0xad1523a8, domain=twice-nat section=1 ignore=no
        type=none, hits=0, flags=0x9, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0-0
        dst ip/id=10.86.116.0, mask=255.255.255.255, port=0-0
        input_ifc=outside, output_ifc=NP Identity Ifc
id=0xad1865c0, domain=twice-nat section=1 ignore=no
        type=none, hits=0, flags=0x9, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0-0
        dst ip/id=192.168.255.255, mask=255.255.255.255, port=0-0
        input_ifc=amallio-wizard, output_ifc=NP Identity Ifc
id=0xad1867b0, domain=twice-nat section=1 ignore=no
        type=none, hits=0, flags=0x9, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0-0
        dst ip/id=192.168.0.0, mask=255.255.255.255, port=0-0
        input_ifc=amallio-wizard, output_ifc=NP Identity Ifc
id=0xad257bf8, domain=twice-nat section=1 ignore=no
        type=none, hits=0, flags=0x9, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0-0
        dst ip/id=172.27.48.255, mask=255.255.255.255, port=0-0
        input_ifc=folink, output_ifc=NP Identity Ifc
id=0xad257db8, domain=twice-nat section=1 ignore=no
        type=none, hits=0, flags=0x9, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0-0
        dst ip/id=172.27.48.0, mask=255.255.255.255, port=0-0
        input_ifc=folink, output_ifc=NP Identity Ifc

次に、show nat divert ipv6 コマンドの出力例を示します。

ciscoasa# show nat divert ipv6
Divert Table
id=0xcb9ea518, domain=divert-route
type=static, hits=0, flags=0x21, protocol=0
src ip/id=2001::/ffff:ffff:ffff:ffff:ffff:ffff::, port=0-0
dst ip/id=2001::/ffff:ffff:ffff:ffff:ffff:ffff::, port=0-0
input_ifc=in, output_ifc=outside
id=0xcf24d4b8, domain=divert-route
type=static, hits=0, flags=0x20, protocol=0
src ip/id=::/::, port=0-0
dst ip/id=2222::/ffff:ffff:ffff:ffff:ffff:ffff::, port=0-0
input_ifc=in, output_ifc=mgmt

次の例は、self-addressed テーブルを示しています。

ciscoasa# show nat divert-table self-addressed

Self-Addressed Divert
192.168.1.33    255.255.255.255                            management to identity
1002::10        ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff    outside to identity
102.1.1.10      255.255.255.255                            outside to identity
1001::10        ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff    inside to identity
101.1.1.10      255.255.255.255                            inside to identity

例

次に、 show running-config object network コマンドによって表示される、ダイナミック PAT ルールによって作成された NAT プールの出力例を示します。

ciscoasa(config)# show running-config object network
object network myhost
 host 10.10.10.10
 nat (pppoe2,inside) dynamic 10.76.11.25
ciscoasa# show nat pool
TCP inside, address 10.76.11.25, range 1-511, allocated 0
TCP inside, address 10.76.11.25, range 512-1023, allocated 0
TCP inside, address 10.76.11.25, range 1024-65535, allocated 1

（9.15 未満）次に、PAT プールに flat オプションを使用した場合の show nat pool コマンドの出力例を示します。 include-reserve キーワードを指定しないと、2 つの範囲が示されます。低い方の範囲は、1024 未満の送信元ポートが同じポートにマッピングされているときに使用されます。

ciscoasa# show nat pool
ICMP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2
TCP PAT pool dynamic-pat, address 172.16.2.200, range 1-1024, allocated 0
TCP PAT pool dynamic-pat, address 172.16.2.200, range 1024-65535, allocated 2
UDP PAT pool dynamic-pat, address 172.16.2.200, range 1-1024, allocated 0
UDP PAT pool dynamic-pat, address 172.16.2.200, range 1024-65535, allocated 2

（9.15 未満）次に、PAT プールに flat include-reserve オプションを使用した場合の show nat pool コマンドの出力例を示します。

ciscoasa# show nat pool
ICMP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2
TCP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2
UDP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2

（9.15 未満）次に、PAT プールに extended flat include-reserve オプションを使用した場合の show nat pool コマンドの出力例を示します。重要な項目はカッコで囲まれたアドレスです。これらは拡張 PAT に使用される宛先アドレスです。

ICMP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 0
ICMP PAT pool dynamic-pat, address 172.16.2.200(172.16.2.99), range 1-65535, allocated 2
TCP PAT pool dynamic-pat, address 172.16.2.200(172.16.2.100), range 1-65535, allocated 1
UDP PAT pool dynamic-pat, address 172.16.2.200(172.16.2.100), range 1-65535, allocated 1
TCP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 0
ICMP PAT pool dynamic-pat, address 172.16.2.200(172.16.2.100), range 1-65535, allocated 1
TCP PAT pool dynamic-pat, address 172.16.2.200(172.16.2.99), range 1-65535, allocated 2
UDP PAT pool dynamic-pat, address 172.16.2.200, range 1-65535, allocated 0

（9.15 以降）次の例は、ブロックを所有するユニットとブロックのバックアップユニットを含む、クラスタ内のポートブロックの分布（ポート範囲を示す）とその使用状況を示しています。

ciscoasa# show nat pool cluster
 
IP outside_a:src_map_a 174.0.1.20
               [1536 – 2047], owner A, backup B
               [8192 – 8703], owner A, backup B
               [4089 – 4600], owner B, backup A
               [11243 – 11754], owner B, backup A
IP outside_a:src_map_a 174.0.1.21
               [1536 – 2047], owner A, backup B
               [8192 – 8703], owner A, backup B
               [4089 – 4600], owner B, backup A
               [11243 – 11754], owner B, backup A
IP outside_b:src_map_b 174.0.1.22
               [6656 - 7167], owner A, backup B
               [13312 - 13823], owner A, backup B
               [20480 - 20991], owner B, backup A
               [58368 - 58879], owner B, backup A
IP outside_b:src_map_b 174.0.1.23
               [46592 - 47103], owner A, backup B
               [52224 - 52735], owner A, backup B
               [62976 - 63487], owner B, backup A

（9.15 以降）次の例は、クラスタ内でのプール割り当ての概要を示しています。

ciscoasa# show nat pool cluster summary
 
port-blocks count display order: total, unit-A, unit-B, unit-C, unit-D
IP outside_a:src_map_a, 174.0.1.20 (128 - 32/32/32/32)
IP outside_a:src_map_a, 174.0.1.21 (128 - 36/32/32/28)
IP outside_b:src_map_b, 174.0.1.22 (128 - 31/32/32/33)

（9.16 以降）次の例は、クラスタ内でのプール割り当ての概要を示しています。9.16 以降、この情報には、予約済みポートと再利用されたポートの数が含まれています。

ciscoasa# show nat pool cluster summary

port-blocks count display order: total, unit-A, unit-B
Codes: ^ - reserve, # - reclaimable
IP Outside:Mapped-IPGroup 10.10.10.100 (126 - 63 / 63) ^ 0 # 0
IP Outside:Mapped-IPGroup 10.10.10.101 (126 - 63 / 63) ^ 0 # 0

（9.15 以降）次の例は、クラスタ内のプールに関する PAT プールの詳細な使用状況を示しています。

ciscoasa# show nat pool detail
 
TCP PAT pool outside_a, address 174.0.1.1
                 range 1536-2047, allocated 56
                 range 8192-8703, allocated 16
UDP PAT pool outside_a, address 174.0.1.1
                 range 1536-2047, allocated 12
                 range 8192-8703, allocated 25
 TCP PAT pool outside_b, address 174.0.2.1
                 range 47104-47615, allocated 39
                 range 62464-62975, allocated 9
UDP PAT pool outside_b, address 174.0.2.1
                 range 47104-47615, allocated 35
                 range 62464-62975, allocated 27

（9.15 以降）次の例は、ビューを特定のデバイス上の特定のインターフェイスに限定する方法を示しています。

ciscoasa# show nat pool interface outside_b ip 174.0.2.1
 
TCP PAT pool outside_b, address 174.0.2.1, range 1-511, allocated 0
TCP PAT pool outside_b, address 174.0.2.1, range 512-1023, allocated 12
TCP PAT pool outside_b, address 174.0.2.1, range 1024-65535, allocated 48
UDP PAT pool outside_b, address 174.0.2.1, range 1-511, allocated 6
UDP PAT pool outside_b, address 174.0.2.1, range 512-1023, allocated 8
UDP PAT pool outside_b, address 174.0.2.1, range 1024-65535, allocated 62

例

次に、show nat proxy-arp コマンドの出力例を示します。

ciscoasa# show nat proxy-arp 
Nat Proxy-arp Table
id=0x00007f5558bbbfc0, ip/id=10.10.1.134, mask=255.255.255.255 ifc=test2
	config:(inside) to (test2) source dynamic inside_v6 outside_v4_pat  destination 
static inside_v6_nat any
id=0x00007f5558bbbfc0, ip/id=10.10.1.135, mask=255.255.255.255 ifc=test2
	config:(inside) to (test2) source dynamic inside_v6 outside_v4_pat  destination 
static inside_v6_nat any
id=0x00007f55595ad2c0, ip/id=10.86.118.2, mask=255.255.255.255 ifc=inside
	config:(inside) to (test2) source dynamic inside_v6 interface  dns
id=0x00007f5559424e80, ip/id=10.100.10.1, mask=255.255.255.255 ifc=NP Identity Ifc
	config:(any) to (any) source dynamic src_network pat-pool mapped-pat-pool
id=0x00007f5559424e80, ip/id=10.100.10.2, mask=255.255.255.255 ifc=NP Identity Ifc
	config:(any) to (any) source dynamic src_network pat-pool mapped-pat-pool
id=0x00007f5544785700, ip/id=10.7.17.2, mask=255.255.255.254 ifc=NP Identity Ifc
	config:(any) to (any) source static test2 10.3.3.0 
id=0x00007f554c4ae740, ip/id=10.1.1.1, mask=255.255.255.255 ifc=NP Identity Ifc

例

次に、show ntp associations コマンドの出力例を示します。

ciscoasa> show ntp associations
     address         ref clock     st  when  poll  reach  delay  offset    disp
 ~172.31.32.2      172.31.32.1       5    29  1024  377     4.2   -8.59     1.6
+~192.168.13.33    192.168.1.111     3    69   128  377     4.1    3.48     2.3
*~192.168.13.57    192.168.1.111     3    32   128  377     7.9   11.18     3.6
* master (synced), # master (unsynced), + selected, - candidate, ~ configured

表 10-2 に、各フィールドの説明を示します。

例

次に、show ntp associations detail コマンドの出力例を示します。

ciscoasa> show ntp associations detail
172.23.56.249 configured, our_master, sane, valid, stratum 4
ref ID 172.23.56.225, time c0212639.2ecfc9e0 (20:19:05.182 UTC Fri Feb 22 2002)
our mode client, peer mode server, our poll intvl 128, peer poll intvl 128
root delay 38.04 msec, root disp 9.55, reach 177, sync dist 156.021
delay 4.47 msec, offset -0.2403 msec, dispersion 125.21
precision 2**19, version 3
org time c02128a9.731f127b (20:29:29.449 UTC Fri Feb 22 2002)
rcv time c02128a9.73c1954b (20:29:29.452 UTC Fri Feb 22 2002)
xmt time c02128a9.6b3f729e (20:29:29.418 UTC Fri Feb 22 2002)
filtdelay =     4.47    4.58    4.97    5.63    4.79    5.52    5.87   0.00
filtoffset =   -0.24   -0.36   -0.37    0.30   -0.17    0.57   -0.74   0.00
filterror =     0.02    0.99    1.71    2.69    3.66    4.64    5.62   16000.0

表 10-3 に、各フィールドの説明を示します。

例

次に、show ntp status コマンドの出力例を示します。

ciscoasa> show ntp status
Clock is synchronized, stratum 5, reference is 172.23.56.249
nominal freq is 99.9984 Hz, actual freq is 100.0266 Hz, precision is 2**6
reference time is c02128a9.73c1954b (20:29:29.452 UTC Fri Feb 22 2002)
clock offset is -0.2403 msec, root delay is 42.51 msec
root dispersion is 135.01 msec, peer dispersion is 125.21 msec

表 10-4 に、各フィールドの説明を示します。

例

show nve 1 コマンドについては、次の出力を参照してください。

ciscoasa(config)# show nve 1
nve 1, source-interface "inside" is up
IP address 15.1.2.1, subnet mask 255.255.255.0
Encapsulation: vxlan
Encapsulated traffic statistics:
6701004 packets input, 3196266002 bytes
6700897 packets output, 3437418084 bytes
1 packets dropped
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 1
Discovered peer VTEPs:
IP address 15.1.2.3
Number of VNIs attached to nve 1: 2
VNIs attached:
vni 2: segment-id 5002, mcast-group 239.1.2.3
vni 1: segment-id 5001, mcast-group 239.1.2.3

次に、ASA 仮想 クラスタに対する show nve 1 コマンドの出力を示します。

ciscoasa(config)# show nve 1
nve 1, source-interface "vtep-ifc" is up (nve-only cluster is ON)
 IP address 10.0.0.1, subnet mask 255.255.255.0
 Encapsulation: vxlan
 Encapsulated traffic statistics:
   14310839 packets input, 2609747129 bytes
   14475972 packets output, 3145279720 bytes
   0 packets dropped
 Number of configured static peer VTEPs: 0
 Configured static peer group: cluster
    Configured static peer group VTEPs:
        IP address 10.0.0.4 MAC address 000c.295e.38ae (learned)
        IP address 10.0.0.3 MAC address 000c.2905.0050 (learned)
        IP address 10.0.0.2 MAC address 000c.2926.8a03 (learned)
 Number of discovered peer VTEPs: 3
    Discovered peer VTEPs:
        IP address 10.0.0.4
        IP address 10.0.0.3
        IP address 10.0.0.2
 Number of VNIs attached to nve 1: 1
 VNIs attached:
        vni 1: segment-id 1, mcast-group none

次に、ASA 仮想 Geneve インターフェイスに対する show nve 1 コマンドの出力を示します。

ciscoasa# show nve 1
   nve 1, source-interface "outside" is up (nve-only cluster is OFF)
            IP address 10.0.1.11, subnet mask 255.255.255.0
            Encapsulation: geneve
            Encapsulated traffic statistics:
               1107 packets input, 84557 bytes
               83 packets output, 39784 bytes
               0 packets dropped
            Number of configured static peer VTEPs: 0
            Configured static peer group: N/A
            Number of discovered peer VTEPs: 0
            Number of VNIs attached to nve 1: 1
            VNIs attached:
               vni 1: segment-id none, aws-proxy on, mcast-group none
            NVE aws-proxy channel is on.

show nve 1 summary コマンドについては、次の出力を参照してください。

ciscoasa# show nve 1 summary
nve 1, source-interface "inside" is up
Encapsulation: vxlan
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 1
Default multicast group: 239.1.2.3
Number of VNIs attached to nve 1: 2

例

次に、「Anet」という名前のネットワーク オブジェクト グループについての情報を表示する、 show object-group コマンドの出力例を示します。

ciscoasa# show object-group id Anet
Object-group network Anet (hitcnt=10)  
   Description OBJ SEARCH ALG APPLIED
   network-object 1.1.1.0 255.255.255.0 (hitcnt=4)
   network-object 2.2.2.0 255.255.255.0 (hitcnt=6)

次に、サービスグループに関する情報を表示する、 show object-group コマンドの出力例を示します。

ciscoasa (config)# show object-group service
object-group service B-Serobj
   description its a service group
   service-object tcp eq bgp
   object-group protocol C-grp-proto
   protocol-object ospf

次に、プロトコルに関する情報を表示する、 show object-group コマンドの出力例を示します。

ciscoasa (config)# show object-group protocol
object-group protocol C-grp-proto
   protocol-object ospf

次に、ネットワークサービス オブジェクトとそのヒットカウントを表示する例を示します。ネットワークサービス グループ ID（nsg-id）、アプリケーション ID（app-id）、bid などの各種の識別子は内部のインデックス番号であり、無視してかまいません。

ciscoasa (config)# show object-group network-service FMC_NSG_4294969442
object-group network-service FMC_NSG_4294969442 (nsg-id 512/1)
 network-service-member "Facebook" dynamic
  description Facebook is a social networking service.
  app-id 629
  domain connect.facebook.net (bid=214491) ip (hitcnt=0)
  domain facebook.com (bid=370809) ip (hitcnt=0)
  domain fbcdn.net (bid=490321) ip (hitcnt=0)
  domain fbcdn-photos-a.akamaihd.net (bid=548791) ip (hitcnt=0)
  domain fbcdn-photos-e-a.akamaihd.net (bid=681143) ip (hitcnt=0)
  domain fbcdn-photos-b-a.akamaihd.net (bid=840741) ip (hitcnt=0)
  domain fbstatic-a.akamaihd.net (bid=1014669) ip (hitcnt=0)
  domain fbexternal-a.akamaihd.net (bid=1098051) ip (hitcnt=0)
  domain fbcdn-profile-a.akamaihd.net (bid=1217875) ip (hitcnt=0)
  domain fbcdn-creative-a.akamaihd.net (bid=1379985) ip (hitcnt=0)
  domain channel.facebook.com (bid=1524617) ip (hitcnt=0)
  domain fbcdn-dragon-a.akamaihd.net (bid=1683343) ip (hitcnt=0)
  domain contentcache-a.akamaihd.net (bid=1782703) ip (hitcnt=0)
  domain facebook.net (bid=1868733) ip (hitcnt=0)
 network-service-member "Google+ Videos" dynamic
  description Video sharing among Google+ community.
  app-id 2881
  domain plus.google.com (bid=2068293) ip (hitcnt=0)
 network-service-member "Instagram" dynamic
  description Mobile phone photo sharing.
  app-id 1233
  domain instagram.com (bid=2176667) ip (hitcnt=0)
 network-service-member "LinkedIn" dynamic
  description Career oriented social networking.
  app-id 713
  domain linkedin.com (bid=2317259) ip (hitcnt=0)
> 

次の例はオブジェクトカウントを示したものであり、オブジェクトグループの数、グループに含まれるオブジェクトの数、および ACL や NAT などで使用されているオブジェクトの数を確認できます。この情報はオブジェクトグループ検索機能のパフォーマンスに関連するものです。

ciscoasa(config)# show object-group count
 
Object Group Name                      Group Count Dyn Count V4 CNT     V6 CNT     ACL CNT    NAT CNT    OG in OG  
network    i28Z-route                  68          0           68         0          0          0          0         
network    i28Z-VRF-BGP-PEERS          4           0           4          0          2          0          0         
network    EXCH-BGP-PEERS              4           0           4          0          2          0          0         
network    obgr_SUBNETS_NO_ACL         112         0           112        0          0          0          0         
network    obgr_SUBNETS_ACL_ASAMgmt    1           0           1          0          0          0          0         
network    obgr_CLIENTS_ACL_ASAMgmt    8           0           8          0          1          0          0         
network    obgr_SUBNETS_CGS_vMotion    1           0           1          0          0          0          0         
network    obgr_CLIENTS_CGS_vMotion    9           0           9          0          1          0          0         
network    obgr_SUBNETS_UPMCOD_CGS     17          0           17         0          0          0          0         
network    obgr_CLIENTS_UPMCOD_CGS     90          0           90         0          1          0          0         
network    obgr_CLIENTS_10.68.0.0_16   2           0           2          0          1          0          0         
network    obgr_CLIENTS_10.68.1.198_31 4           0           4          0          1          0          0         
network    obgr_CLIENTS_10.68.73.133   7           0           7          0          1          0          0         
network    asa_zabbix_proxies          4           0           4          0          1          0          0         

Total Summary
Object-group count                           14          
Object-group object count                    331         
Object-group Dynamic count                   0           
Object-group IPv4 count                      331         
Object-group IPv6 count                      0           
Object-group Used in ACL                     9           
Object-group Used in NAT                     0           
Object-group Unused                          5 
Object-group Internal                        0         
Object-group Dummy                           0            
Redundant object-group in Network            4           
Redundant object-group in IfC                0           

次に、オブジェクトグループ検索を有効にした場合のオブジェクトの 16 進数 ID（id=）の例を示します。

ciscoasa# show object-group 
Object-group network SOG1 (id= 0xf0000004)
	network-object host 1.1.1.1
	network-object host 10.30.241.26
Object-group network SOG2 (id=0xf0000005)
	network-object host 1.1.1.1
Object-group network SOG3 (id= 0xf0000006)
	network-object host 1.1.1.1

例

次に、show ospf コマンドの出力例を示します。ここでは、特定の OSPF ルーティングプロセスに関する一般情報を表示する例を示しています。

ciscoasa# show ospf 5
 Routing Process "ospf 5" with ID 127.0.0.1 and Domain ID 0.0.0.5
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
 Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs
 Number of external LSA 0. Checksum Sum 0x     0
 Number of opaque AS LSA 0. Checksum Sum 0x     0
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 0. 0 normal 0 stub 0 nssa
 External flood list length 0

次に、show ospf コマンドの出力例を示します。ここでは、すべての OSPF ルーティングプロセスに関する一般情報を表示する例を示しています。

ciscoasa# show ospf
 Routing Process "ospf 5" with ID 127.0.0.1 and Domain ID 0.0.0.5
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
 Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs
 Number of external LSA 0. Checksum Sum 0x     0
 Number of opaque AS LSA 0. Checksum Sum 0x     0
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 0. 0 normal 0 stub 0 nssa
 External flood list length 0
 Routing Process "ospf 12" with ID 172.23.59.232 and Domain ID 0.0.0.12
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
 Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs
 Number of external LSA 0. Checksum Sum 0x     0
 Number of opaque AS LSA 0. Checksum Sum 0x     0
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 0. 0 normal 0 stub 0 nssa
 External flood list length 0

例

次に、ospf border-routers コマンドの出力例を示します。

ciscoasa# show ospf border-routers
OSPF Process 109 internal Routing Table
Codes: i - Intra-area route, I - Inter-area route
i 192.168.97.53 [10] via 192.168.1.53, fifth, ABR, Area 0, SPF 20
i 192.168.103.51 [10] via 192.168.96.51, outside, ASBR, Area 192.168.12.0, SPF 14
i 192.168.103.52 [10] via 192.168.96.51, outside, ABR/ASBR, Area 192.168.12.0, SPF 14

例

次に、 show ospf database コマンドの出力例を示します。

ciscoasa# show ospf database
OSPF Router with ID(192.168.1.11) (Process ID 1)
                 Router Link States(Area 0)
Link ID   ADV Router   Age   Seq# Checksum Link count
192.168.1.8 192.168.1.8 1381 0x8000010D    0xEF60 2
192.168.1.11 192.168.1.11 1460 0x800002FE    0xEB3D 4
192.168.1.12 192.168.1.12 2027 0x80000090    0x875D 3
192.168.1.27 192.168.1.27 1323 0x800001D6    0x12CC 3
                 Net Link States(Area 0)
Link ID ADV Router   Age   Seq# Checksum
172.16.1.27 192.168.1.27 1323 0x8000005B    0xA8EE
172.17.1.11 192.168.1.11 1461 0x8000005B    0x7AC
                 Type-10 Opaque Link Area Link States (Area 0)
Link ID ADV Router   Age Seq# Checksum Opaque ID
10.0.0.0 192.168.1.11 1461 0x800002C8    0x8483   0
10.0.0.0 192.168.1.12 2027 0x80000080    0xF858   0
10.0.0.0 192.168.1.27 1323 0x800001BC    0x919B   0
10.0.0.1 192.168.1.11 1461 0x8000005E    0x5B43   1

次に、 show ospf database asbr-summary コマンドの出力例を示します。

ciscoasa# show ospf database asbr-summary
OSPF Router with ID(192.168.239.66) (Process ID 300)
Summary ASB Link States(Area 0.0.0.0)
Routing Bit Set on this LSA
LS age: 1463
Options: (No TOS-capability)
LS Type: Summary Links(AS Boundary Router)
Link State ID: 172.16.245.1 (AS Boundary Router address)
Advertising Router: 172.16.241.5
LS Seq Number: 80000072
Checksum: 0x3548
Length: 28
Network Mask: 0.0.0.0 
TOS: 0 Metric: 1 

次に、 show ospf database router コマンドの出力例を示します。

ciscoasa# show ospf database router
OSPF Router with id(192.168.239.66) (Process ID 300)
Router Link States(Area 0.0.0.0)
Routing Bit Set on this LSA
LS age: 1176
Options: (No TOS-capability)
LS Type: Router Links
Link State ID: 10.187.21.6
Advertising Router: 10.187.21.6
LS Seq Number: 80002CF6
Checksum: 0x73B7
Length: 120
AS Boundary Router
Number of Links: 8
Link connected to: another Router (point-to-point)
(link ID) Neighboring Router ID: 10.187.21.5
(Link Data) Router Interface address: 10.187.21.6
Number of TOS metrics: 0
TOS 0 Metrics: 2 

次に、 show ospf database network コマンドの出力例を示します。

ciscoasa# show ospf database network
OSPF Router with id(192.168.239.66) (Process ID 300)
Displaying Net Link States(Area 0.0.0.0)
LS age: 1367
Options: (No TOS-capability)
LS Type: Network Links
Link State ID: 10.187.1.3 (address of Designated Router)
Advertising Router: 192.168.239.66
LS Seq Number: 800000E7
Checksum: 0x1229
Length: 52
Network Mask: 255.255.255.0
Attached Router: 192.168.239.66
Attached Router: 10.187.241.5
Attached Router: 10.187.1.1
Attached Router: 10.187.54.5
Attached Router: 10.187.1.5

次に、 show ospf database summary コマンドの出力例を示します。

ciscoasa# show ospf database summary
OSPF Router with id(192.168.239.66) (Process ID 300)
Displaying Summary Net Link States(Area 0.0.0.0)
LS age: 1401
Options: (No TOS-capability)
LS Type: Summary Links(Network)
Link State ID: 10.187.240.0 (summary Network Number)
Advertising Router: 10.187.241.5
LS Seq Number: 80000072
Checksum: 0x84FF
Length: 28
Network Mask: 255.255.255.0 TOS: 0 Metric: 1

次に、 show ospf database external コマンドの出力例を示します。

ciscoasa# show ospf database external
OSPF Router with id(192.168.239.66) (Autonomous system 300)
                   Displaying AS External Link States
LS age: 280
Options: (No TOS-capability)
LS Type: AS External Link
Link State ID: 172.16.0.0 (External Network Number)
Advertising Router: 10.187.70.6
LS Seq Number: 80000AFD
Checksum: 0xC3A
Length: 36
Network Mask: 255.255.0.0
      Metric Type: 2 (Larger than any link state path)
TOS: 0
Metric: 1
Forward Address: 0.0.0.0
External Route Tag: 0

例

次に、show ospf events コマンドの出力例を示します。

ciscoasa# show ospf events
            OSPF Router with ID (192.168.77.1) (Process ID 5)
   1 Apr 27 16:33:23.556: RIB Redist, dest 0.0.0.0, mask 0.0.0.0, Up
   2 Apr 27 16:33:23.556: Rescanning RIB:  0x00x0
   3 Apr 27 16:33:23.556: Service Redist scan:  0x00x0

例

次に、show ospf flood-list コマンドの出力例を示します。

ciscoasa# show ospf flood-list outside
  Interface outside, Queue length 20
  Link state flooding due in 12 msec
  
  Type  LS ID          ADV RTR          Seq NO       Age   Checksum
     5  10.2.195.0     192.168.0.163    0x80000009   0     0xFB61
     5  10.1.192.0     192.168.0.163    0x80000009   0     0x2938
     5  10.2.194.0     192.168.0.163    0x80000009   0     0x757
     5  10.1.193.0     192.168.0.163    0x80000009   0     0x1E42
     5  10.2.193.0     192.168.0.163    0x80000009   0     0x124D
     5  10.1.194.0     192.168.0.163    0x80000009   0     0x134C

例

次に、show ospf interface コマンドの出力例を示します。

ciscoasa# show ospf interface outside
out is up, line protocol is up
  Internet Address 10.0.3.4 mask 255.255.255.0, Area 0
  Process ID 2, Router ID 10.0.3.4, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State WAITING, Priority 1
  No designated router on this network
  No backup designated router on this network
  Timer intervals configured, Hello 10 msec, Dead 1, Wait 1, Retransmit 5
    Hello due in 5 msec
    Wait time before Designated router selection 0:00:11
  Index 1/1, flood queue length 0
  Next 0x00000000(0)/0x00000000(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)

例

次に、 show ospf neighbor コマンドの出力例を示します。ここでは、インターフェイスごとの OSPF ネイバー情報を表示する例を示しています。

ciscoasa# show ospf neighbor outside 
Neighbor 192.168.5.2, interface address 10.225.200.28
    In the area 0 via interface outside
    Neighbor priority is 1, State is FULL, 6 state changes
    DR is 10.225.200.28 BDR is 10.225.200.30
    Options is 0x42
    Dead timer due in 00:00:36
    Neighbor is up for 00:09:46
  Index 1/1, retransmission queue length 0, number of retransmission 1
    First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)
    Last retransmission scan length is 1, maximum is 1
    Last retransmission scan time is 0 msec, maximum is 0 msec 

次に、 show ospf neighbor detail コマンドの出力例を示します。指定された OSPF ネイバーの詳細情報を表示する方法を示します。

ciscoasa# show ospf neighbor detail 
Neighbor 25.1.1.60, interface address 15.1.1.60
    In the area 0 via interface inside
    Neighbor priority is 1, State is FULL, 46 state changes
    DR is 15.1.1.62 BDR is 15.1.1.60
    Options is 0x12 in Hello (E-bit, L-bit)
    Options is 0x52 in DBD (E-bit, L-bit, O-bit)
    LLS Options is 0x1 (LR), last OOB-Resync 00:03:07 ago
    Dead timer due in 0:00:24
    Neighbor is up for 01:42:15
    Index 5/5, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)
    Last retransmission scan length is 0, maximum is 0
    Last retransmission scan time is 0 msec, maximum is 0 msec

例

次に、show ospf nsf コマンドの出力例を示します。

ciscoasa# show ospf nsf
Routing Process "ospf 10"
Non-Stop Forwarding enabled
	Clustering is not configured in spanned etherchannel mode
IETF NSF helper support enabled
Cisco NSF helper support enabled
	OSPF restart state is 
	Handle 1, Router ID 25.1.1.60, checkpoint Router ID 0.0.0.0
	Config wait timer interval 10, timer not running
	Dbase wait timer interval 120, timer not running

例

次に、show ospf request-list コマンドの出力例を示します。

ciscoasa# show ospf request-list 192.168.1.12 inside
          OSPF Router with ID (192.168.1.11) (Process ID 1)
          
  Neighbor 192.168.1.12, interface inside address 172.16.1.12
  Type   LS ID          ADV RTR        Seq NO       Age   Checksum
     1   192.168.1.12   192.168.1.12   0x8000020D   8     0x6572

例

次に、show ospf retransmission-list コマンドの例を示します。例では、nbr_router_id 引数は 192.168.1.11 で、if_name 引数は outside です。

ciscoasa# show ospf retransmission-list 192.168.1.11 outside
          OSPF Router with ID (192.168.1.12) (Process ID 1)
  Neighbor 192.168.1.11, interface outside address 172.16.1.11
  Link state retransmission due in 3764 msec, Queue length 2
  
  
  Type   LS ID          ADV RTR        Seq NO       Age   Checksum
     1   192.168.1.12   192.168.1.12   0x80000210   0     0xB196

例

次に、 show ospf statistics コマンドの出力例を示します。

ciscoasa# show ospf 10 statistics detail
Area 10: SPF algorithm executed 6 times
SPF 1 executed 04:36:56 ago, SPF type Full
  SPF calculation time (in msec):
  SPT    Prefix D-Int  Sum    D-Sum  Ext    D-Ext  Total
       0      0      0      0      0      0      0 0
  RIB manipulation time (in msec):
  RIB Update    RIB Delete
               0             0
  LSIDs processed R:1 N:0 Prefix:0 SN:0 SA:0 X7:0
  Change record R L
  LSAs changed 2
  Changed LSAs. Recorded is Advertising Router, LSID and LS type:
  49.100.168.192/0(R) 49.100.168.192/2(L)
SPF 2 executed 04:35:50 ago, SPF type Full
  SPF calculation time (in msec):
  SPT    Prefix D-Int  Sum    D-Sum  Ext    D-Ext  Total
       0      0      0      0      0      0      0 0
  RIB manipulation time (in msec):
  RIB Update    RIB Delete
               0             0
  LSIDs processed R:2 N:1 Prefix:0 SN:0 SA:0 X7:0
  Change record R N L
  LSAs changed 5
  Changed LSAs. Recorded is Advertising Router, LSID and LS type:
  50.100.168.192/0(R) 50.100.168.192/2(L) 49.100.168.192/0(R) 50.100.168.192/0(R)
  50.100.168.192/2(N)

例

次に、show ospf summary-address コマンドの出力例を示します。この例は、ID が 5 である OSPF プロセスに対してサマリー アドレスが設定される前に、すべてのサマリー アドレス再配布情報のリストを表示する方法を示しています。

ciscoasa# show ospf 5 summary-address
OSPF Process 2, Summary-address
10.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 0
10.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 10

例

次に、show ospf traffic コマンドの出力例を示します。

ciscoasa# show ospf traffic
OSPF statistics (Process ID 70):
       Rcvd: 244 total, 0 checksum errors
             234 hello, 4 database desc, 1 link state req
             3 link state updates, 2 link state acks
       Sent: 485 total
             472 hello, 7 database desc, 1 link state req
             3 link state updates, 2 link state acks

例

次に、 show ospf virtual-links コマンドの出力例を示します。

ciscoasa# show ospf virtual-links
Virtual Link to router 192.168.101.2 is up
Transit area 0.0.0.1, via interface Ethernet0, Cost of using 10
Transmit Delay is 1 sec, State POINT_TO_POINT
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 0:00:08
Adjacency State FULL