Commands

C H A P T E R
Command Reference
This chapter provides detailed descriptions on each PIX Firewall command. Before using this chapter, read the following chapters:

Chapter 1, Introduction, for important information about command line guidelines including ports and protocols. Chapter 2, Configuring the PIX Firewall, for information about configuring PIX Firewall for initial access, server access, authentication, and troubleshooting. Chapter 4, Configuring IPSec, for background information about IPSec and its components, and how to implement these IPSec features in the PIX Firewall to create a Virtual Private Network (VPN). View your configuration at any time with the write terminal command. Save your configuration frequently with the write memory command. Always check the syntax before entering a command. Enter a command and press the Enter key to view a quick summary, or precede a command with help, as in, help aaa. View syslog messages as you work on the PIX Firewall. Start accumulating messages with the logging buffered debugging command, view messages with the show logging command, and clear the message buffer with the clear logging command. Syslog messages are described in the System Log Messages for the Cisco Secure PIX Firewall Version 5.1. PIX Firewall documentation is available online at the following site: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix Abbreviate commands, such as, using the con t command statement to start configuration mode, the wr t command statement to list the configuration, and wr m to write to Flash memory. Start logging with the lo b 7 command statement and show logging messages with the sh lo command statement. After changing or removing the alias, access-list, conduit, global, nat, outbound, and static commands, use the clear xlate command to make the IP addresses available for access. You can view possible port and protocol numbers at the following IANA web sites: http://www.isi.edu/in-notes/iana/assignments/port-numbers http://www.isi.edu/in-notes/iana/assignments/protocol-numbers
The following notes can help you as you configure the PIX Firewall:

Create your configuration on a text editor and then cut and paste it into the configuration. PIX Firewall lets you paste in a line at a time or the whole configuration. Always check your configuration after pasting large blocks of text to be sure everything copied.
Configuration Guide for the Cisco Secure PIX Firewall Version 5.1 78-10392-02
6-1
Chapter 6 aaa
Command Reference
aaa
Enable, disable, or view TACACS+ or RADIUS user authentication, authorization, and accounting for the server previously designated with the aaa-server command. (Configuration mode.) aaa accounting include | exclude acctg_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask group_tag no aaa accounting include | exclude authen_service inbound | outbound | if_name group_tag aaa authentication include | exclude authen_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask group_tag no aaa authentication [include | exclude authen_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask group_tag] aaa authentication [serial | enable | telnet] console group_tag no aaa authentication [[serial | enable | telnet] console group_tag] aaa authorization include | exclude author_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask no aaa authorization [include | exclude author_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask] clear aaa [accounting include | exclude authen_service inbound | outbound | if_name group_tag] clear aaa [authentication include | exclude authen_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask group_tag] clear aaa [authorization [include | exclude author_service inbound | outbound | if_name local_ip local_mask foreign_ip foreign_mask]] show aaa
Syntax Description
accounting
Enable or disable accounting services with authentication server. Use of this command requires that you previously used the aaa-server command to designate an authentication server. Create a new rule with the specified service to include. Create an exception to a previously stated rule by excluding the specified service from authentication, authorization, or accounting to the specified host. The exclude parameter improves the former except option by allowing the user to specify a port to exclude to a specific host or hosts.
include exclude
Configuration Guide for the Cisco Secure PIX Firewall Version 5.1
6-2
78-10392-02
Chapter 6
Command Reference aaa
acctg_service
The accounting service. Accounting is provided for all services or you can limit it to one or more services. Possible values are any, ftp, http, telnet, or protocol/port. Use any to provide accounting for all TCP services. To provide accounting for UDP services, use the protocol/port form. For protocol/port, the TCP protocol appears as 6, the UDP protocol appears as 17, and so on, and port is the TCP or UDP destination port. A port value of 0 (zero) means all ports. For protocols other than TCP and UDP, the port is not applicable and should not be used.
authentication
Enable or disable user authentication, prompt user for username and password, and verify information with authentication server. When used with the console option, enables or disables authentication service for access to the PIX Firewall console over Telnet or from the Console connector on the PIX Firewall unit. Use of the aaa authentication command requires that you previously used the aaa-server command to designate an authentication server.
authen_service
The application with which a user is accessing a network. Use any, ftp, http, or telnet. The any value enables accounting or authentication for all TCP services. To have users prompted for authentication credentials, they must use FTP, HTTP, or Telnet. (HTTP is the Web and only applies to web browsers that can prompt for a username and password.) If the authentication or authorization server is authenticating services other than FTP, HTTP, or Telnet, using any will not permit those services to authenticate in the firewall. The firewall only knows how to communicate with FTP, HTTP, and Telnet for authentication and authorization. Only set this parameter to a service other than any if the authentication or authorization server is set the same way. Unless you want to temporarily restrict access to a specific service, setting a service in this command can increase system administration work and may cause all connections to fail if the authentication or authorization server is authenticating one service and you set this command to another.
authorization
Enable or disable TACACS+ user authorization for services (PIX Firewall does not support RADIUS authorization). The authentication server determines what services the user is authorized to access.
6-3
Chapter 6 aaa
Command Reference
author_service
The services which require authorization. Use any, ftp, http, telnet, or protocol/port. Services not specified are authorized implicitly. Services specified in the aaa authentication command do not affect the services which require authorization. For protocol/port:

protocolthe protocol (6 for TCP, 17 for UDP, 1 for ICMP, and so on). portthe TCP or UDP destination port, or port range. The port can also be the ICMP type; that is, 8 for ICMP echo or ping. A port value of 0 (zero) means all ports. Port ranges only applies to the TCP and UDP protocols, not to ICMP. For protocols other than TCP, UDP, and ICMP the port is not applicable and should not be used. An example port specification follows:
aaa authorization include udp/53-1024 inside 0 0 0 0
This example enables authorization for DNS lookups to the inside interface for all clients, and authorizes access to any other services that have ports in the range of 53 to 1024.
Note
Specifying a port range may produce unexpected results at the authorization server. PIX Firewall sends the port range to the server as a string with the expectation that the server will parse it out into specific ports. Not all servers do this. In addition, you may want users to be authorized on specific services, which will not occur if a range is accepted.
inbound
Authenticate or authorize inbound connections. Inbound means the connection originates on the outside interface and is being directed to the inside interface. Authenticate or authorize outbound connections. Outbound means the connection originates on the inside and is being directed to the outside interface. Interface name from which users require authentication. Use if_name in combination with the local_ip address and the foreign_ip address to determine where access is sought and from whom. The local_ip address is always on the highest security level interface and foreign_ip is always on the lowest. See the Examples section for how the if_name affects the use of this command. The IP address of the host or network of hosts that you want to be authenticated or authorized. You can set this address to 0 to mean all hosts and to let the authentication server decide which hosts are authenticated. Network mask of local_ip. Always specify a specific mask value. Use 0 if the IP address is 0. Use 255.255.255.255 for a host. The IP address of the hosts you want to access the local_ip address. Use 0 to mean all hosts. Network mask of foreign_ip. Always specify a specific mask value. Use 0 if the IP address is 0. Use 255.255.255.255 for a host.
outbound
if_name
local_ip
local_mask
foreign_ip
foreign_mask
6-4
78-10392-02
Chapter 6
console
Specify that access to the PIX Firewall console require authentication and optionally, log configuration changes to a syslog server. The aaa authentication serial console command lets you require authentication verification to access the PIX Firewall units serial console. The serial console options also logs to a syslog server changes made to the configuration from the serial console. Authenticated access to the PIX Firewall console has different types of prompts depending on the option you choose with the aaa authentication [serial | enable | telnet] console command. While the enable option allows three tries before stopping with an access denied message, both the serial and telnet options cause the user to be prompted continually until successfully logging in. The serial option requests a username and password before the first command line prompt on the serial console connection. The telnet option forces you to specify a username and password before the first command line prompt of a Telnet console connection. The enable option requests a username and password before accessing privileged mode for serial or Telnet connections. Telnet access to the PIX Firewall console is available from any internal interface (not the outside interface) and requires previous use of the telnet command. Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis. If the console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the enable password. The maximum password length for accessing the console is 16 characters.
group_tag
Usage Guidelines
The group tag set with the aaa-server command.
The aaa command enables or disables the following AAA (Authentication, Authorization, and Accounting) features:
User authentication services. A user starting a connection via FTP, Telnet, or over the World Wide Web is prompted for their username and password. An authentication server, designated previously with the aaa-server command, verifies whether the username and password are correct. If the username and password are correct, PIX Firewall lets further traffic between the authentication server and the connection interact independently through the PIX Firewall units Cut-Through Proxy feature. Authentication access to the PIX Firewall units console via Telnet or the serial console. (Telnet access requires previous use of the telnet command.) User authorization services for TACACS+ connections that let the authentication server determine which services the user can access. Accounting services so that administrators can track which hosts accessed the PIX Firewall. AAA accounting can also track FTP/Telnet/HTTP connections initiated with IPSec.
Note
PIX Firewall does not support RADIUS authorization.
6-5
Chapter 6 aaa
Command Reference
Note
PIX Firewall listens for RADIUS on ports 1645 and 1646. If your RADIUS server uses ports 1812 and 1813, you will need to reconfigure it to use ports 1645 and 1646.
Note
If the AAA console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the enable password.
Usage Notes
1. 2.
The maximum username prompt for HTTP authentication is 30 characters. The maximum password length is 15 characters. The aaa command is not intended to mandate your security policy. The authentication and authorization servers determine whether a user can or cannot access the system, what services can be accessed, and what IP addresses the user can access. The PIX Firewall interacts with FTP, HTTP (Web access), and Telnet to display the credentials prompts for logging in to the network or logging in to exit the network. You can specify that only a single service be authenticated, but this must agree with the authentication server to ensure that both the firewall and server agree. Accounting information is only sent to the active server in a server group. The new include and exclude options are not backward compatible with previous PIX Firewall versions. If you downgrade to an earlier version, the aaa command statements will be removed from your configuration. The prompts users see requesting AAA credentials differ between the three services that can access the PIX Firewall for authentication: Telnet, FTP, and HTTP (Web):
a. Telnet users see a prompt generated by the PIX Firewall that you can change with the
3. 4.
5.
auth-prompt command. The PIX Firewall permits a user up to four chances to log in and then if the username or password still fails, the PIX Firewall drops the connection.
b. FTP users receive a prompt from the FTP program. If a user enters an incorrect password, the
connection is dropped immediately. If the username or password on the authentication database differs from the username or password on the remote host to which you are using FTP to access, enter the username and password in these formats:
authentication_user_name@remote_system_user_name authentication_password@remote_system_password
If you daisy-chain PIX Firewall units, Telnet authentication works in the same way as a single unit, but FTP and HTTP authentication have additional complexity for users because they have to enter each password and username with an additional at (@) character and password or username for each daisy-chained system. Users can exceed the 63-character password limit depending on how many units are daisy-chained and password length. Some FTP graphical user interfaces (GUIs) do not display challenge values.
c. HTTP users see a pop-up window generated by the browser itself. If a user enters an incorrect
password, the user is reprompted. When the web server and the authentication server are on different hosts, use the virtual command to get the correct authentication behavior.
6.
Use of the aaa authorization command requires previous use of the aaa authentication command; however, use of the aaa authentication command does not require use of an aaa authorization command.
6-6
78-10392-02
Chapter 6
7.
If you want to allow connections to come from any host, code the local IP address and netmask as 0.0.0.0 0.0.0.0, or 0 0. The same convention applies to the foreign host IP address and netmask; 0.0.0.0 0.0.0.0 means any foreign host. Authenticated access to the PIX Firewall console has different types of prompts depending on the option you choose with the aaa authentication console command:
a. enable optionAllows three tries before stopping with Access denied. The enable option
8.
requests a username and password before accessing privileged mode for serial or Telnet connections.
b. serial optionCauses the user to be prompted continually until successfully logging in. The
serial option requests a username and password before the first command line prompt on the serial console connection.
c. telnet optionCauses the user to be prompted continually until successfully logging in.
The telnet option forces you to specify a username and password before the first command line prompt of a Telnet console connection.
9.
You can specify an interface name with aaa authentication. In previous versions, if you specified aaa authentication include any outbound 0 0 server, PIX Firewall only authenticated outbound connections and not those to the perimeter interface. PIX Firewall now authenticates any outbound connection to the outside as well as to hosts on the perimeter interface. To preserve the behavior of previous versions, use these commands to enable authentication and to disable authentication from the inside to the perimeter interface:
aaa authentication include any outbound 0 0 server aaa authentication exclude outbound perim_net perim_mask
server
10. When using HTTP authentication to a site running Microsoft IIS that has Basic text
authentication or NT Challenge enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: Authorization: Basic=Uuhjksdkfhk== to the HTTP GET commands. This string contains the PIX Firewall authentication credentials. Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied. To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested. Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set. This is because the browser caches the Authorization: Basic=Uuhjksdkfhk== string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts. Flushing the cache is of no use. As long as the user repeatedly browses the Internet, the browser resends the Authorization: Basic=Uuhjksdkfhk== string to transparently reauthenticate the user.
11. Multimedia applications such as CU-SeeMe, InternetPhone, MeetingPoint, and MS Netmeeting
silently start the HTTP service before an H.323 session is established from the inside to the outside. To avoid interfering with these applications, do not enter blanket outgoing AAA command statements for all challenged ports such as using the any option. Be selective with which ports and addresses you use to challenge HTTP, and when to set user authentication timeouts to a higher timeout value. If interfered with, the multimedia programs may fail on the PC and may even crash the PC after establishing outgoing sessions from the inside.
6-7
Chapter 6 aaa
Command Reference
12. For outbound connections, first use the nat command to determine which IP addresses can access
the firewall. For inbound connections, first use the static and access-list command statements to determine which inside IP addresses can be accessed through the firewall from the outside network.
13. When a host is configured for authentication, all users on the host have to use a web browser or
Telnet first before performing any other networking activity, such as accessing mail or a news reader. The reason for this is that users must first establish their authentication credentials and programs such as mail agents and newsreaders do not have authentication challenge prompts.
14. The PIX Firewall only accepts 7-bit characters during authentication. After authentication, the
client and server can negotiate for 8-bits if required. During authentication, the PIX Firewall only negotiates Go-Ahead, Echo, and NVT (network virtual terminal).
15. Up to 256 TACACS+ or RADIUS servers are permitted (up to 16 servers in each of the up to 16
server groupsset with the aaa-server command). When a user logs in, the servers are accessed one at a time starting with the first server you specify in the configuration, until a server responds.
16. For each IP address, one aaa authentication command is permitted for inbound connections and
one for outbound connections. Also, for an IP address, one aaa authorization command is permitted. If you want to authorize more than one service with aaa authorization, use the any parameter for the service type.
17. The PIX Firewall permits only one authentication type per network. For example, if one network
connects through the PIX Firewall using TACACS+ for authentication, another network connecting through the PIX Firewall can authenticate with RADIUS, but one network cannot authenticate with both TACACS+ and RADIUS.
18. For the TACACS+ server, if you do not specify a key to the aaa-server command, no encryption
occurs.
19. Network browsers such as Netscape Navigator do not present a challenge value during
authentication; therefore, only password authentication can be used from a network browser.
20. PIX Firewall supports authentication usernames up to 127 characters and passwords of up to
63 characters. A password or username may not contain an at (@) character as part of the password or username string, except as shown in Note 5..
21. In version 5.1, the PIX Firewall displays the same timeout message for both RADIUS and
TACACS+. The message aaa server host machine not responding displays when either of the following occurs:
a. The AAA server system is down. b. The AAA server system is up, but the service is not running.
Previously, TACACS+ differentiated the two states above and provided two different timeout messages, while RADIUS did not differentiate the two states and provided one timeout message.
22. If the first attempt at authorization fails and a second attempt causes a timeout, use the
service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet follows:
Unable to connect to remote host: Connection timed out
See also: aaa-server, auth-prompt, service, telnet, virtual.
6-8
78-10392-02
Chapter 6
Examples
1.
The following example lists the new include and exclude options:
aaa authentication include any outbound 172.31.0.0 255.255.0.0 0.0.0.0 0.0.0.0 tacacs+ aaa authentication exclude telnet outbound 172.31.38.0 255.255.255.0 0.0.0.0 0.0.0.0 tacacs+
2.
The following examples demonstrate ways to use the if_name parameter. The PIX Firewall has an inside network of 192.168.1.0, an outside network of 209.165.201.0 (subnet mask 255.255.255.224), and a perimeter network of 209.165.202.128 (subnet mask 255.255.255.224). This example enables authentication for connections originated from the inside network to the outside network:
aaa authentication include any outbound 192.168.1.0 255.255.255.0 209.165.201.0 255.255.255.224 tacacs+
This example enables authentication for connections originated from the inside network to the perimeter network:
aaa authentication include any outbound 192.168.1.0 255.255.255.0 209.165.202.128 255.255.255.224 tacacs+
This example enables authentication for connections originated from the outside network to the inside network:
aaa authentication include any inbound 192.168.1.0 255.255.255.0 209.165.201.0 255.255.255.224 tacacs+
This example enables authentication for connections originated from the outside network to the perimeter network:
aaa authentication include any inbound 209.165.201.0 255.255.255.224 209.165.202.128 255.255.255.224 tacacs+
This example enables authentication for connections originated from the perimeter network to the outside network:
aaa authentication include any perimeter 209.165.202.128 255.255.255.224 209.165.201.0 255.255.255.224 tacacs+
3.
This example specifies that IP addresses 10.0.0.1 through 10.0.0.254 can originate outbound connections and then enables user authentication so that those addresses must enter user credentials to exit the firewall. In this example, the first aaa authentication command permits authentication on FTP, HTTP, or Telnet depending on what the authentication server handles. The second aaa authentication command lets host 10.0.0.42 start outbound connections without being authenticated. This example uses the default authentication group tacacs+:
nat (inside) 1 10.0.0.0 255.255.255.0 aaa authentication include any outbound 0 0 tacacs+ aaa authentication exclude outbound 10.0.0.42 255.255.255.255 tacacs+ any
6-9
Chapter 6 aaa
Command Reference
4.
This example permits inbound access to any IP address in the range of 209.165.201.1 through 209.165.201.30 indicated by the 209.165.201.0 network address (subnet mask 255.255.255.224). All services are permitted by the access-list command, and the aaa authentication command permits authentication on FTP, HTTP, or Telnet depending on what the authentication server handles. The authentication server is at IP address 10.16.1.20 on the inside interface:
aaa-server AuthIn protocol tacacs+ aaa-server AuthIn (inside) host 10.16.1.20 thisisakey timeout 20 static (inside,outside) 209.165.201.0 10.16.1.0 netmask 255.255.255.224 access-list acl_out permit tcp 10.16.1.0 255.255.255.0 209.165.201.0 255.255.255.224 access-group acl_out in interface outside aaa authentication include any inbound 0 0 AuthIn
5.
This example enables authorization for DNS lookups from the outside interface:
aaa authorization include udp/53 inbound 0.0.0.0 0.0.0.0
6.
This example enables authorization of ICMP echo-reply packets arriving at the inside interface from inside hosts:
aaa authorization include 1/0 outbound 0.0.0.0 0.0.0.0
This means that users will not be able to ping external hosts if they have not been authenticated using Telnet, HTTP, or FTP.
7.
This example enables authorization for ICMP echoes (pings) only that arrive at the inside interface from an inside host:
aaa authorization include 1/8 outbound 0.0.0.0 0.0.0.0
6-10
78-10392-02
Chapter 6
Command Reference aaa-server
aaa-server
Specify an AAA server. (Configuration mode.) aaa-server group_tag (if_name) host server_ip key timeout seconds no aaa-server group_tag (if_name) host server_ip key timeout seconds aaa-server group_tag protocol auth_protocol clear aaa-server [group_tag] show aaa-server
Syntax Description
group_tag
An alphanumeric string which is the name of the server group. Use the group_tag in the aaa command to associate aaa authentication and aaa accounting command statements to an AAA server. The interface name on which the server resides. The IP address of the TACACS+ or RADIUS server. A case-sensitive, alphanumeric keyword of up to 127 characters that is the same value as the key on the TACACS+ server. Any characters entered past 127 are ignored. The key is used between the client and server for encrypting data between them. The key must be the same on both the client and server systems. Spaces are not permitted in the key, but other special characters are. A retransmit timer that specifies the duration that the PIX Firewall retries access four times to the AAA server before choosing the next AAA server. The default is 5 seconds. The maximum time is 30 seconds. For example, if the timeout value is 10 seconds, PIX Firewall retransmits for 10 seconds and if no acknowledgment is received, tries three times more for a total of 40 seconds to retransmit data before the next AAA server is selected.
if_name host server_ip key
timeout seconds
protocol auth_protocol The type of AAA server, either tacacs+ or radius.

Usage Guidelines
The aaa-server command lets you specify an AAA server group. PIX Firewall lets you define separate groups of TACACS+ or RADIUS servers for specifying different types of traffic; such as, a TACACS+ server for inbound traffic and another for outbound traffic. Another use is where all outbound HTTP traffic will be authenticated by a TACACS+ server, and all inbound traffic will use RADIUS. AAA server group are defined by a tag name that directs different types of traffic to each authentication server. If the first authentication server in the list fails, the AAA subsystem fails over to the next server in the tag group. You can have up to 16 tag groups and each group can have up to 16 AAA servers for a total of up to 256 AAA servers. The aaa command references the tag group.
6-11
Chapter 6 aaa-server
Command Reference
Note
The previous server type option at the end of the aaa authentication and aaa accounting commands has been replaced with the aaa-server group tag. Backward compatibility with previous versions is maintained by the inclusion of two default protocols for TACACS+ and RADIUS. If accounting is in effect, the accounting information goes only to the active server. The default configuration provides these two aaa-server protocols:
aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius
Note
If you are upgrading from a previous version of PIX Firewall and have aaa command statements in your configuration, using the default server groups lets you maintain backward compatibility with the aaa command statements in your configuration.
Examples
1.
This example uses the default protocol tacacs+ with the aaa commands:
aaa-server TACACS+ (inside) host 10.1.1.10 thekey timeout 20 aaa authentication include any outbound 0 0 0 0 TACACS+ aaa authorization include any outbound 0 0 0 0 aaa accounting include any outbound 0 0 0 0 TACACS+ aaa authentication serial console TACACS+
This example specifies that the authentication server with the IP address 10.1.1.10 resides on the inside interface and is in the default TACACS+ server group. The next three command statements specify that any users starting outbound connections to any foreign host will be authenticated using TACACS+, that the users who are successfully authenticated are authorized to use any service, and that all outbound connection information will be logged in the accounting database. The last command statement specifies that access to the PIX Firewall units serial console requires authentication from the TACACS+ server.
2.
This example creates the AuthOut and AuthIn server groups for RADIUS authentication and specifies that servers 10.0.1.40, 10.0.1.41, and 10.1.1.2 on the inside interface provide authentication. The servers in the AuthIn group authenticate inbound connections, the AuthOut group authenticates outbound connections:
aaa-server AuthIn protocol radius aaa-server AuthIn (inside) host 10.0.1.40 ab timeout 20 aaa-server AuthIn (inside) host 10.0.1.41 abc timeout 4 aaa-server AuthOut protocol radius aaa-server AuthOut (inside) host 10.1.1.2 abc123 timeout 15 aaa authentication include any inbound 0 0 0 0 AuthIn aaa authentication include any outbound 0 0 0 0 AuthOut
6-12
78-10392-02
Chapter 6
Command Reference aaa-server
3.
This example lists the commands that can be used to establish an Xauth crypto map:
ip address inside 10.0.0.1 255.255.255.0 ip address outside 168.20.1.5 255.255.255.0 ip local pool dealer 10.1.2.1-10.1.2.254 nat (inside) 0 access-list 80 aaa-server TACACS+ host 10.0.0.2 secret123 crypto ipsec transform-set pc esp-des esp-md5-hmac crypto dynamic-map cisco 4 set transform-set pc crypto map partner-map 20 ipsec-isakmp dynamic cisco crypto map partner-map client configuration address initiate crypto map partner-map client authentication TACACS+ crypto map partner-map interface outside isakmp key cisco1234 address 0.0.0.0 netmask 0.0.0.0 isakmp client configuration address-pool local dealer outside isakmp policy 8 authentication pre-share isakmp policy 8 encryption des isakmp policy 8 hash md5 isakmp policy 8 group 1 isakmp policy 8 lifetime 86400
The aaa-server command is used with the crypto map command to establish an authentication association so that VPN Clients are authenticated when they access the PIX Firewall. See crypto map for more information.
6-13
Chapter 6 access-group
Command Reference
access-group
Binds the access list to an interface. (Configuration mode.) access-group acl_name in interface interface-name clear access-group no access-group acl_name in interface interface-name show access-group acl_name in interface interface-name
Syntax Description
acl_name in interface interface-name

Usage Guidelines
The name associated with a given access list. Filters on inbound packets at the given interface. The name of the network interface.
The access-group command binds an access list to an interface. The access list is applied to traffic inbound to an interface. If you enter the permit option in an access-list command statement, the PIX Firewall continues to process the packet. If you enter the deny option in an access-list command statement, PIX Firewall discards the packet and generates the following syslog message:
%PIX-4-106019: IP packet from src_addr to dest_addr, protocol protocol received from interface int_name deny by access-group list_name
Always use the access-list command with the access-group command.
Note
The use of access-group command overrides the conduit and outbound command statements for the specified interface-name. The no access-group command unbinds the acl_name from the interface interface-name. The show access-group command displays the current access-list bound to the interface(s). The clear access-group command removes all entries from an access-list indexed by list-name. If list-name is not specified, all access-list command statements are removed from the configuration. Examples The following example shows use of the access-group command:
static (inside,outside) 209.165.201.3 10.1.1.3 access-list acl_out permit tcp any host 209.165.201.3 eq 80 access-group acl_out in interface outside
The static command statement provides a global address of 209.165.201.3 for the web server at 10.1.1.3. The access-list command statement lets any host access the global address using port 80. The access-group command specifies that the access-list command statement applies to traffic entering the outside interface.
6-14
78-10392-02
Chapter 6
Command Reference access-list
access-list
Create an access list. (Configuration mode.) access-list acl_name [deny | permit] protocol src_addr src_mask operator port dest_addr dest_mask operator port access-list acl_name [deny | permit] icmp src_addr src_mask operator port dest_addr dest_mask operator port icmp_type no access-list acl_name [[deny | permit] protocol src_addr src_mask operator port dest_addr dest_mask operator port] clear access-list [acl_name [deny | permit] icmp src_addr src_mask operator port dest_addr dest_mask operator port icmp_type] show access-list
Syntax Description
acl_name deny
Name of an access list. You can use either a name or number. When used with the access-group command, the deny option does not allow a packet to traverse the PIX Firewall. By default, PIX Firewall denies all inbound packets unless you specifically permit access. When used with a crypto map command statement, deny does not select a packet for IPSec protection. The deny option prevents traffic from being protected by IPSec in the context of that particular crypto map entry. In other words, it does not allow the policy as specified in the crypto map command statements to be applied to this traffic.
permit
When used with the access-group command, the permit option selects a packet to traverse the PIX Firewall. When used with a crypto map command statement, permit selects a packet for IPSec protection. The permit option causes all IP traffic that matches the specified conditions to be protected by IPSec using the policy described by the corresponding crypto map command statements.
protocol
Name or number of an IP protocol. It can be one of the keywords icmp, ip, tcp, or udp, or an integer in the range 1 to 254 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip. Address of the network or host from which the packet is being sent. Specify the source address as follows:

src_addr
Use a 32-bit quantity in four-part, dotted-decimal format. Use the keyword any as an abbreviation for a source and source-netmask of 0.0.0.0 0.0.0.0. This keyword is normally not recommended for use with IPSec. Use host src_addr as an abbreviation for a src_mask of 255.255.255.255. Use host for any host address, even subnetted addresses.
6-15
Chapter 6 access-list
Command Reference
src_mask
Netmask bits (mask) to be applied to src_addr (source address), if the source address is for a network mask. Do not specify a mask if the source address is for a host; if the source address is for a host, use the host parameter before the address; for example:
access-list acl_grp permit tcp host 192.168.1.1 any
If the source address is a network address, specify the mask as a 32-bit quantity in four-part, dotted-decimal format. Place zeros in the bit positions you want to ignore. Remember that you specify a network mask differently than with the Cisco IOS access-list command. With PIX Firewall, use 255.0.0.0 for a Class A address, 255.255.0.0 for a Class B address, and 255.255.255.0 for a Class C address. If you are using a subnetted network address, use the mask; for example:
access-list acl_grp permit tcp 192.168.1.0 255.255.255.224 any
dest_addr
IP address of the network or host to which the packet is being sent. There are three ways to specify the destination:

Use a 32-bit quantity in four-part, dotted-decimal format. Use the keyword any as an abbreviation for the destination and netmask of 0.0.0.0 0.0.0.0. This keyword is not recommended for access lists used for IPSec via the crypto map command. Use host dest_addr as an abbreviation for a dest_mask of 255.255.255.255.
dest_mask
Netmask bits (mask) to be applied to dest_addr (destination address), if the destination address is a network mask. Do not specify a dest_mask if the destination address is for a host; if the destination address is for a host, use the host parameter before the address; for example:
access-list acl_grp permit tcp any host 192.168.1.1
If the destination address is a network address, specify the mask as a 32-bit quantity in four-part, dotted-decimal format. Place zeros in the bit positions you want to ignore. Remember that you specify a network mask differently than with the Cisco IOS software access-list command. With PIX Firewall, use 255.0.0.0 for a Class A address, 255.255.0.0 for a Class B address, and 255.255.255.0 for a Class C address. If you are using a subnetted network address, use the mask; for example:
access-list acl_grp permit tcp any 209.165.201.0 255.255.255.224
operator
A comparison operand that lets you specify a port or a port range. Use without an operator and port to indicate all ports; for example:
access-list acl_out permit tcp any host 209.165.201.1
Use eq and a port to permit or deny access to just that port. For example, use eq ftp to permit or deny access only to FTP:
access-list acl_out deny tcp any host 209.165.201.1 eq ftp
Use lt and a port to permit or deny access to all ports less than the port you specify. For example, use lt 2025 to permit or deny access to the well known ports (1 to 1024):
access-list acl_dmz1 permit tcp any host 192.168.1.1 lt 1025
6-16
78-10392-02
Chapter 6
Use gt and a port to permit or deny access to all ports greater than the port you specify. For example, use gt 42 to permit or deny ports 43 to 65535:
access-list acl_dmz1 deny udp any host 192.168.1.2 gt 42
Use neq and a port to permit or deny access to every port except the ports that you specify. For example, use neq 10 to permit or deny ports 1-9 and 11 to 65535:
access-list acl_dmz1 deny tcp any host 192.168.1.3 neq 10
Use range and a port range to permit or deny access to only those ports named in the range. For example, use range 10 1024 to permit or deny access only to ports 10 through 1024. All other ports are unaffected. The use of port ranges can dramatically increase the number of IPSec tunnels. For example, if a port range of 5000 to 65535 is specified for a highly dynamic protocol, up to 60,535 tunnels can be created.
access-list acl_dmz1 deny tcp any host 192.168.1.4 range ftp telnet
port
Service(s) you permit to be used while accessing src_addr or dest_addr. Specify services by the port that handles it, such as smtp for port 25, www for port 80, and so on. You can specify ports by either a literal name or a number in the range of 0 to 65535. You can view valid port numbers online at the following site: http://www.isi.edu/in-notes/iana/assignments/port-numbers See Ports in Chapter 1, Introduction, for a list of valid port literal names in port ranges; for example, ftp h323. You can also specify numbers.
icmp_type
[Non-IPSec use only]Permit or deny access to ICMP message types. Refer to Table 6-1 for a list of message types. Omit this option to mean all ICMP types. In version 5.1, ICMP message types are not supported for use with IPSec; that is when the access-list command is used in conjunction with the crypto map command, the icmp_type is ignored.
Usage Guidelines
The access-list command allows you to create an access list. In this document, one or more access-list command statements with the same access list name are referred to as an access list. Access lists associated with IPSec are known as crypto access lists. After you have defined an access list, bind it to an interface using the access-group command. For IPSec use, bind it with a crypto map command statement. The show access-list command lists the access-list command statements in the configuration. The show access-list command also lists a hit count that indicates the number of times an element has been matched during an access-list command search. The clear access-list command removes all access-list command statements from the configuration. The no access-list command removes an access-list command from the configuration. If you remove all the access-list command statements in an access list group, the no access-list command also removes the corresponding access-group command from the configuration.
6-17
Command Reference
Usage Notes
1.
The clear access-list command automatically unbinds an access list from a crypto map command or interface. The unbinding of an access list from a crypto map command can lead to a condition that discards all packets because the crypto map command statements referencing the access list are incomplete. To correct the condition, either define other access-list command statements to complete the crypto map command statements or remove the crypto map command statements that pertain to the access-list command statement. The access-list command operates on a first match basis. For access from a higher security level interface to a lower security interface; that is, outbound connections, port access is permitted by default. Always permit access first and then deny access afterward. You can view security levels for interfaces with the show nameif command. Because outbound connections are permitted by default, for single or specific denies, you only need add deny statements. If the host entries match, then add deny statements, otherwise use the default (permit) statements. You only need to specify additional permit statements if you need to permit specific hosts and deny everyone else. For access from a lower security level interface to a higher security level interface; that is, inbound connections, port access is denied by default. Always deny access first and permit access afterward. Because inbound connections are denied by default, for single or specific permits, you only need to add permit statements. If the host entries match, then use a permit statement, otherwise use a default (deny) statement. You only need to specify additional deny statements if you need to deny specific hosts and permit everyone else.
2.
3. 4. 5.
The ICMP message type (icmp_type) option is ignored in IPSec applications because the message type cannot be negotiated with ISAKMP. Only one access list can be bound to an interface using the access-group command. If you specify the permit option in the access list, the PIX Firewall continues to process the packet. If you specify the deny option in the access list, PIX Firewall discards the packet and generates the following syslog message:
%PIX-4-106019: IP packet from src_addr to dest_addr, protocol protocol received from interface int_name deny by access-group list_name
6.
The access-list command uses the same syntax as the Cisco IOS software access-list command except that the subnet mask in the PIX Firewall access-list command is reversed from the Cisco IOS software version of this command. For example, in the Cisco IOS software access-list command, a subnet mask of 0.0.0.255 would be specified as 255.0.0.0 in the PIX Firewall access-list command. Cisco recommends that you do not use the access-list command with the conduit and outbound commands. While using these commands together will work, the way in which these commands operate may cause debugging issues because the conduit and outbound commands operate from one interface to another whereas the access-list command used with the access-group command applies only to a single interface. If these commands must be used together, PIX Firewall evaluates the access-list command before checking the conduit and outbound commands. Refer to Step 13 - Add Inbound Server Access and Step 14 - Add Outbound Access Lists in Chapter 2, Configuring the PIX Firewall, for a detailed description about using the access-list command to provide server access and to restrict outbound user access.
7.
8.
6-18
78-10392-02
Chapter 6
ICMP Message Types
[Non-IPSec use only]If you prefer more selective ICMP access, you can specify a single ICMP message type as the last option in this command. Table 6-1 lists possible ICMP types values.
Table 6-1 ICMP Type Literals
ICMP Type 0 3 4 5 6 8 9 10 11 12 13 14 15 16 17 18 31 32
Literal echo-reply unreachable source-quench redirect alternate-address echo router-advertisement router-solicitation time-exceeded parameter-problem timestamp-reply timestamp-request information-request information-reply mask-request mask-reply conversion-error mobile-redirect
If you specify an ICMP message type for use with IPSec, PIX Firewall ignores it. For example:
access-list 10 permit icmp any any echo-reply
And IPSec is enabled such that a crypto map command references the acl_name for this access-list command, then the echo-reply ICMP message type is ignored.
Using the access-list Command with IPSec
If an access list is bound to an interface with the access-group command, the access list selects which traffic can traverse the PIX Firewall. When bound to a crypto map command statement, the access list selects which IP traffic IPSec protects and which traffic IPSec does not protect. For example, access lists can be created to protect all IP traffic between Subnet X and Subnet Y or traffic between Host A and Host B. The access lists themselves are not specific to IPSec. It is the crypto map command statement referencing the specific access list that defines whether IPSec processing is applied to the traffic matching a permit in the access list.
6-19
Command Reference
Crypto access lists associated with the IPSec crypto map command statement have these primary functions:

Select outbound traffic to be protected by IPSec (permit = protect). Indicate the data flow to be protected by the new security associations (specified by a single permit entry) when initiating negotiations for IPSec security associations. Process inbound traffic to filter out and discard traffic that IPSec protects. Determine whether or not to accept requests for IPSec security associations on behalf of the requested data flows when processing IKE negotiation from the IPSec peer. (Negotiation is only done for crypto map command statements with the ipsec-isakmp option.) For a peers initiated IPSec negotiation to be accepted, it must specify a data flow that is permitted by a crypto access list associated with an ipsec-isakmp crypto map entry.
You can associate a crypto access list with an interface by defining the corresponding crypto map command statement and applying the crypto map set to an interface. Different access lists must be used in different entries of the same crypto map set. However, both inbound and outbound traffic will be evaluated against the same outbound IPSec access list. Therefore, the access lists criteria are applied in the forward direction to traffic exiting your PIX Firewall and the reverse direction to traffic entering your PIX Firewall. If you want certain traffic to receive one combination of IPSec protection (for example, authentication only) and other traffic to receive a different combination of IPSec protection (for example, both authentication and encryption), you need to create two different crypto access lists to define the two different types of traffic. These different access lists are then used in different crypto map entries that specify different IPSec policies. Cisco recommends that you configure mirror image crypto access lists for use by IPSec and that you avoid using the any keyword. See the sections Mirror Image Crypto Access Lists at each IPSec Peer and IKE-Established Security Associations in Chapter 4, Configuring IPSec. If you configure multiple statements for a given crypto access list, in general, the first permit statement matched, will be the statement used to determine the scope of the IPSec security association. That is, the IPSec security association will be set up to protect traffic that meets the criteria of the matched statement only. Later, if traffic matches a different permit statement of the crypto access list, a new, separate IPSec security association will be negotiated to protect traffic matching the newly matched access list statement. Some services such as FTP require two access-list command statements, one for port 10 and another for port 21, to properly encrypt FTP traffic.
Examples
The following example creates a numbered access list that specifies a Class C subnet for the source and a Class C subnet for the destination of IP packets. Because the access-list command is referenced in the crypto map command statement, PIX Firewall encrypts all IP traffic that is exchanged between the source and destination subnets.
access-list 101 permit ip 172.21.3.0 255.255.0.0 172.22.2.0 255.255.0.0 access-group 101 in interface outside crypto map mymap 10 match address 101 [other crypto map commands]
The next example only lets an ICMP message type of echo-reply be permitted into the outside interface:
access-list acl_out permit icmp any any echo-reply access-group acl_out interface outside
6-20
78-10392-02
Chapter 6
Command Reference alias
alias
Administer overlapping addresses with dual NAT. (Configuration mode.) alias [(if_name)] dnat_ip foreign_ip [netmask] no alias [[(if_name)] dnat_ip foreign_ip [netmask]] show alias clear alias
Syntax Description
if_name dnat_ip
The internal network interface name in which the foreign_ip overlaps. An IP address on the internal network that provides an alternate IP address for the external address that is the same as an address on the internal network. IP address on the external network that has the same address as a host on the internal network. Network mask applied to both IP addresses. Use 255.255.255.255 for host masks.
foreign_ip
netmask
Usage Guidelines
The alias command translates one address into another. Use this command to prevent conflicts when you have IP addresses on a network that are the same as those on the Internet or another intranet. You can also use this command to do address translation on a destination address. For example, if a host sends a packet to 209.165.201.1, you can use the alias command to redirect traffic to another address, such as, 209.165.201.30.
Note
You can use the sysopt nodnsalias command to disable inbound embedded DNS A record fixups according to aliases that apply to the A record address and outbound replies.
Note
If the alias command is used with the sysopt ipsec pl-compatible command, a static route command statement must be added for each IP address specified in the alias command statement. After changing or removing an alias command statement, use the clear xlate command. There must be an A (address) record in the DNS zone file for the dnat address in the alias command. The alias command has two uses which can be summarized in the following ways of reading an alias command statement:

If the PIX Firewall gets a packet destined for the dnat_IP_address, send it to the foreign_IP_address. If the PIX Firewall gets a DNS packet returned to the PIX Firewall destined for foreign_network_address, alter the DNS packet to change the foreign network address to dnat_network_address.
6-21
Chapter 6 alias
Command Reference
The no alias command disables a previously set alias command statement. The show alias command displays alias command statements in the configuration. The clear alias command removed all alias commands from the configuration. The alias command automatically interacts with DNS servers on your network to ensure that domain name access to the aliased IP address is handled transparently. You can specify a net alias by using network addresses for the foreign_ip and dnat_ip IP addresses. For example, alias 192.168.201.0 209.165.201.0 255.255.255.224 creates aliases for each IP address between 209.165.201.1 and 209.165.201.30.
Note
ActiveX blocking does not occur when users access an IP address referenced by the alias command. ActiveX blocking is set with the filter activex command.
Usage Notes
To access an alias dnat_ip address with static and access-list command statements, specify the dnat_ip address in the access-list command statement as the address from which traffic is permitted from. The following example illustrates this note:
alias (inside) 192.168.201.1 209.165.201.1 255.255.255.255 static (inside,outside) 209.165.201.1 192.168.201.1 netmask 255.255.255.255 access-list acl_out permit tcp host 192.168.201.1 host 209.165.201.1 eq ftp-data access-group acl_out in interface outside
An alias is specified with the inside address 192.168.201.1 mapping to the foreign address 209.165.201.1.
Examples
1.
In this example, the inside network contains the IP address 209.165.201.29, which on the Internet belongs to cisco.com. When inside clients try to access cisco.com, the packets do not go to the firewall because the client thinks 209.165.201.29 is on the local inside network. To correct this, a net alias is created as follows with the alias command:
alias (inside) 192.168.201.0 209.165.201.0 255.255.255.224 show alias alias 192.168.201.0 205.165.201.0 255.255.255.224
When the inside network client 209.165.201.2 connects to cisco.com, the DNS response from an external DNS server to the internal clients query would be altered by the PIX Firewall to be 209.165.201.29. If the PIX Firewall uses 209.165.200.225 through 209.165.200.254 as the global pool IP addresses, the packet goes to the PIX Firewall with SRC=209.165.201.2 and DST=209.165.201.29. The PIX Firewall translates the address to SRC=209.165.200.254 and DST=209.165.201.29 on the outside.
2.
In the next example, a web server is on the inside at 10.1.1.11 and a static for it at 209.165.201.11. The source host is on the outside with address 209.165.201.7. A DNS server on the outside has a record for www.cisco.com as follows: IN A 209.165.201.11
www.cisco.com.
The period at the end of the www.cisco.com. domain name must be included.
6-22
78-10392-02
Chapter 6
Command Reference alias
The alias command follows:

alias 10.1.1.11 209.165.201.11 255.255.255.255
PIX Firewall doctors the nameserver replies to 10.1.1.11 for inside clients to directly connect to the web server. The static command statement is as follows:
static (inside,outside) 209.165.201.11 10.1.1.11
The access-list command statement you would expect to use follows:

access-list acl_grp permit tcp host 209.165.201.7 host 209.165.201.11 eq telnet
But with the alias command, use this command:

access-list acl_grp permit tcp host 209.165.201.11 eq telnet host 209.165.201.7
You can test the DNS entry for the host with the following UNIX nslookup command:
nslookup -type=any www.cisco.com
6-23
Chapter 6 arp
Command Reference
arp
Change or view the ARP cache, and set the timeout value. (Configuration mode.) arp if_name ip_address mac_address [alias] clear arp no arp if_name ip_address show arp [if_name] [ip_address mac_address alias] arp timeout seconds no arp timeout show arp timeout
Syntax Description
if_name ip_address
The internal or external interface name specified by the nameif command. Host IP address for the ARP table entry.
mac_address Hardware MAC address for the ARP table entry; for example, 00e0.1e4e.3d8b. alias Make this entry permanent. Alias entries do not time out and are automatically stored in the configuration when you use the write command to store the configuration. Duration that an ARP entry can exist in the ARP table before being cleared.
seconds
Usage Guidelines
The arp command adds an entry to the PIX Firewall ARP cache. ARP is a low-level TCP/IP protocol that resolves a nodes physical address from its IP address through an ARP request asking the node with a particular IP address to send back its physical address. The presence of entries in the ARP cache indicates that the PIX Firewall has network connectivity. The clear arp command clears the ARP table but not the alias (permanent) entries. Use the no arp command to remove these entries. The show arp command lists the entries in the ARP table.
Note
You can use the sysopt noproxyarp command to disable proxy-arps on an interface. Use the arp command to add an entry for new hosts you add on your network or when you swap an existing host for another. Alternatively, you can wait for the duration specified with the arp timeout command to expire and the ARP table rebuilds itself automatically with the new host information. The arp timeout command sets the duration that an ARP entry can stay in the PIX Firewall ARP table before expiring. The timer is known as the ARP persistence timer. The default value is 14,400 seconds (4 hours). The no arp timeout command sets the timer to its default value. The show arp timeout command displays its current value.
6-24
78-10392-02
Chapter 6
Command Reference arp
Examples
The following examples illustrate use of the arp and arp timeout commands:
arp inside 192.168.0.42 00e0.1e4e.2a7c arp outside 192.168.0.43 00e0.1e4e.3d8b alias show arp outside 192.168.0.43 00e0.1e4e.3d8b alias inside 192.168.0.42 00e0.1e4e.2a7c clear arp inside 192.168.0.42 arp timeout 42 show arp timeout arp timeout 42 seconds no arp timeout show arp timeout arp timeout 14400 seconds
6-25
Chapter 6 auth-prompt
Command Reference
auth-prompt
Change the AAA challenge text. (Configuration mode.) auth-prompt [accept | reject | prompt] string no auth-prompt [accept | reject | prompt] string clear auth-prompt show auth-prompt
Syntax Description
accept reject prompt
If a user authentication via Telnet is accepted, display the prompt string. If a user authentication via Telnet is rejected, display the prompt string. The AAA challenge prompt string follows this keyword. This keyword is optional for backward compatibility. A string of up to 235 alphanumeric characters. Special characters should not be used; however, spaces and punctuation characters are permitted. Entering a question mark or pressing the Enter key ends the string. (The question mark appears in the string.)
string
Usage Guidelines
The auth-prompt command lets you change the AAA challenge text for HTTP, FTP, and Telnet access. This text displays above the username and password prompts that users view when logging in. If you do not use this command, FTP users view FTP authentication, HTTP users view HTTP Authentication, and challenge text does not appear for Telnet access. If the user authentication occurs from Telnet, you can use the accept and reject options to display different authentication prompts if the authentication attempt is accepted or rejected by the authentication server.
Note
Microsoft Internet Explorer only displays up to 37 characters in an authentication prompt. Netscape Navigator displays up to 120 characters, and Telnet and FTP display up to 235 characters in an authentication prompt.
Examples
The following example shows how to set the authentication prompt and how users view the prompt:
auth-prompt XYZ Company Firewall Access
After this string is added to the configuration, users view:

XYZ Company Firewall Access User Name: Password:
The prompt keyword can be included or omitted. For example:

auth-prompt prompt Hello There!
This command statement is the same as the following:

auth-prompt Hello There!
6-26
78-10392-02
Chapter 6
Command Reference ca
ca
Configure the PIX Firewall to interoperate with a Certification Authority (CA). (Configuration mode.) ca authenticate ca_nickname [fingerprint]
ca configure ca_nickname ca | ra retry_period retry_count [crloptional] no ca configure ca_nickname show ca configure
ca crl request ca_nickname
ca enroll ca_nickname challenge_password [serial] [ipaddress] no ca enroll ca_nickname
ca generate rsa key | specialkey key_modulus_size
ca identity ca_nickname ca_ipaddress[:ca_script_location] [ldap_ip address] no ca identity ca_nickname show ca identity
ca save all no ca save all
show ca certificate ca zeroize rsa show ca mypubkey rsa
6-27
Chapter 6 ca
Command Reference
Syntax Description
ca_nickname
The name of the Certification Authority (CA). Enter any string that you desire. (If you previously declared the CA and just want to update its characteristics, specify the name you previously created.) The CA might require a particular name, such as its domain name. Currently the PIX Firewall supports only one CA at a time.
fingerprint
A key consisting of alphanumeric characters the PIX Firewall uses to authenticate CAs certificate. Indicates whether to contact the CA or Registration Authority (RA) when using the ca configure command. Some CA systems provide a RA, which the PIX Firewall contacts instead of the CA.
ca | ra
retry_period
Specify the number of minutes the PIX Firewall waits before resending a certificate request to the CA when it does not receive a response from the CA to its previous request. Specify from 1 to 60 minutes. By default, the firewall retries every 1 minute. Specify how many times the PIX Firewall will resend a certificate request when it does not receive a certificate from the CA from the previous request. Specify from 1 to 100. The default is 0, which indicates that there is no limit to the number of times the PIX Firewall should contact the CA to obtain a pending certificate. Allows other peers certificates be accepted by your PIX Firewall even if the appropriate Certificate Revocation List (CRL) is not accessible to your PIX Firewall. The default is without crloptional. A required password that gives the CA administrator some authentication when a user calls to ask for a certificate to be revoked. It can be up to 80 characters in length. Return the PIX Firewall units serial number in the certificate. Return the PIX Firewall units IP address in the certificate. This specifies that one general-purpose RSA key pair will be generated. This specifies that two special-purpose RSA key pairs will be generated instead of one general-purpose key. The size of the key modulus, which is between 512 and 2048 bits. Choosing a size greater than 1024 bits may cause key generation to take a few minutes. The CAs IP address.
retry_count
crloptional
challenge_password
serial ipaddress key specialkey
key_modulus_size
ca_ipaddress
6-28
78-10392-02
Chapter 6
:ca_script_location
The default location and script on the CA server is /cgi-bin/pkiclient.exe. If the CA administrator has not put the CGI script in the above location, provide the location and the name of the script in the ca identity command. A PIX Firewall uses a subset of the HTTP protocol to contact the CA, and so it must identify a particular cgi-bin script to handle CA requests.
ldap_ipaddress
The IP address of the Lightweight Directory Access Protocol (LDAP) server. By default, querying of a certificate or a CRL is done via Ciscos PKI protocol. If the CA supports LDAP, query functions may also use LDAP.
Usage Guidelines
The sections that follow describe each ca command.
Note
See the section About CA in Chapter 4, Configuring IPSec, for more information about this IPSec feature.
Note
The PIX Firewall currently only supports the Entrust and VeriSign CAs. The PIX Firewall only supports Entrust VPN Connector, version 4.1 (build 4.1.0.337) and later. VeriSign support is provided through the VeriSign Private Certificate Services (PCS) and the OnSite service, which lets you establish a CA system for issuing digital certificates.
Note
If you are using the VeriSign CA, you must use the crloptional parameter with the ca configure command.
Note
The lifetime of a certificate and the Certificate Revocation List (CRL) is checked in GMT time. Set the PIX Firewall clock to GMT time to ensure that CRL checking works correctly. Use the clock command to set the PIX Firewall clock.
ca authenticate
The ca authenticate command allows the PIX Firewall to authenticate its Certification Authority (CA) by obtaining the CAs self-signed certificate, which contains the CAs public key. In order to authenticate a peers certificate(s), a PIX Firewall must obtain the CA certificate containing the CA public key. Because the CA certificate is a self-signed certificate, the key should be authenticated manually by contacting the CA administrator. You are given the choice of authenticating the public key in that certificate by including within the ca authenticate command the keys fingerprint, which is retrieved in some out-of-band process. The PIX Firewall will discard the received CA certificate and generate an error message, if the fingerprint you specified is different from the received one. You can also simply compare the two fingerprints without having to enter the key within the command. If you are using RA mode (within the ca configure command), when you issue the ca authenticate command, the RA signing and encryption certificates will be returned from the CA, as well as the CA certificate.
6-29
Chapter 6 ca
Command Reference
The ca authenticate command is not saved to the PIX Firewall configuration. However, the public keys embedded in the received CA (and RA) certificates are saved in the configuration as part of the RSA public key record (called the RSA public key chain). To save the public keys permanently to Flash memory, use the ca save all command. To view the CAs certificate, use the show ca certificate command.
Note
If the CA does not respond by a timeout period after this command is issued, the terminal control will be returned so it will not be tied up. If this happens, you must re-enter the command.
Examples
In this example, a request for the CAs certificate was sent to the CA. The fingerprint was not included in the command. The CA sends its certificate and the PIX Firewall prompts for verification of the CAs certificate by checking the CA certificates fingerprint. Using the fingerprint associated with the CAs certificate retrieved in some out-of-band process from a CA administrator, compare the two fingerprints. If both fingerprints match, then the certificate is considered valid.
ca authenticate myca Certificate has the following attributes: Fingerprint: 0123 4567 89AB CDEF 0123
The following example shows the error message. This time, the fingerprint is included in the command. The two fingerprints do not match, and therefore the certificate is not valid.
ca authenticate myca 0123456789ABCDEF0123 Certificate has the following attributes: Fingerprint: 0123 4567 89AB CDEF 5432 %Error in verifying the received fingerprint. Type help or ? for a list of available commands.
ca configure
The ca configure command is used to specify the communication parameters between the PIX Firewall and the CA. Use the no ca configure command to reset each of the communication parameters to the default value. If you want to show the current settings stored in RAM, use the show ca configure command.
Note
When using VeriSign as your CA, always use the crloptional option with the ca configure command. Without the crloptional option, an error occurs when the PIX Firewall validates the certificate during main mode, which causes the peer PIX Firewall to fail. This problem occurs because the PIX Firewall is not able to poll the CRL from the VeriSign CA.
Examples
The following example indicates myca is the name of the CA and the CA will be contacted rather than the RA. It also indicates the PIX Firewall will wait 5 minutes before sending another certificate request, if it does not receive a response, and will resend a total of 15 times before dropping its request. If the CRL is not accessible, crloptional tells the PIX Firewall to accept other peers certificates.
ca configure myca ca 5 15 crloptional
6-30
78-10392-02
Chapter 6
ca crl request
The ca crl request command allows the PIX Firewall to obtain an updated CRL from the CA at any time. A PIX Firewall automatically requests a CRL from the CA at various times, depending on whether the CA is in the RA mode or not. If the CA is not in the RA mode, a CRL is requested whenever the system reboots and finds that it does not already contain a valid (un-expired) CRL. If the CA is in the RA mode, no CRL can be obtained until a peers certificate is sent via an ISAKMP exchange. This is because the certificate itself contains the location where the PIX Firewall must query to get the appropriate CRL. When a CRL expires, the PIX Firewall automatically requests an updated one. Until a new valid CRL is obtained, the PIX Firewall will not accept peers certificates. Use the ca crl request command only if your CA does not support a RA. A CRL lists all the network's devices' certificates that have been revoked. The PIX Firewall will not accept revoked certificates; therefore, any peer with a revoked certificate cannot exchange IPSec traffic with your firewall. The first time your PIX Firewall receives a certificate from a peer, it will download a CRL from the CA. Your PIX Firewall then checks the CRL to make sure the peer's certificate has not been revoked. (If the certificate appears on the CRL, it will not accept the certificate and will not authenticate the peer.) A CRL can be reused with subsequent certificates until the CRL expires. If your PIX Firewall receives a peer's certificate after the applicable CRL has expired, it will download the new CRL. If your PIX Firewall has a CRL which has not yet expired, but you suspect that the CRL's contents are out of date, use the ca crl request command to request that the latest CRL be immediately downloaded to replace the old CRL. The ca crl request command is not saved with the PIX Firewall configuration between reloads.
Examples
The following example indicates the PIX Firewall will obtain an updated CRL from the CA with the name myca:
ca crl request myca
ca enroll
The ca enroll command is used to send an enrollment request to the CA requesting a certificate for all of your PIX firewall units key pairs. This is also known as enrolling with the CA. (Technically, enrolling and obtaining certificates are two separate events, but they both occur when this command is issued.) Your PIX Firewall needs a signed certificate from the CA for each of its RSA key pairs; if you previously generated general purpose keys, the ca enroll command will obtain one certificate corresponding to the one general purpose RSA key pair. If you previously generated special usage keys, this command will obtain two certificates corresponding to each of the special usage RSA key pairs. If you already have a certificate for your keys, you will be unable to complete this command; instead, you will be prompted to remove the existing certificate first. The ca enroll command is not saved with the PIX Firewall configuration between reloads. To verify if the enrollment process succeeded and to display the PIX Firewall units certificate, use the show ca certificate command. If you want to cancel the current enrollment request, use the no ca enroll command. The required challenge password is necessary in the event that you need to revoke your PIX Firewall unit's certificate(s). When you ask the CA administrator to revoke your certificate, you must supply this challenge password as a protection against fraudulent or mistaken revocation requests.
6-31
Chapter 6 ca
Command Reference
Note
This password is not stored anywhere, so you need to remember this password. If you lose the password, the CA administrator may still be able to revoke the PIX Firewall's certificate but will require further manual authentication of the PIX Firewall administrator identity. The PIX Firewall unit's serial number is optional. If you provide the serial option, the serial number will be included in the obtained certificate. The serial number is not used by IPSec or IKE but may be used by the CA to either authenticate certificates or to later associate a certificate with a particular device. Ask your CA administrator if serial numbers should be included in the certificate. If you are in doubt, specify the serial option. The PIX Firewall unit's IP address is optional. If you provide the ipaddress option, the IP address will be included in the obtained certificate. Normally, you would not include the ipaddress option because the IP address binds the certificate more tightly to a specific entity. Also, if the PIX Firewall is moved, you would need to issue a new certificate.
Note
When configuring ISAKMP for certificate-based authentication, it is important to match the ISAKMP identity type with the certificate type. The ca enroll command used to acquire certificates will, by default, get a certificate with the identity based on hostname. The default identity type for the isakmp identity command is based on address instead of hostname. You can reconcile this disparity of identity types by using the isakmp identity address command. See the isakmp command page for information about the isakmp identity address command.
Examples
The following example indicates that the PIX Firewall will send an enrollment request to the CA myca.example.com. The password 1234567890 is specified, as well as a request for the PIX Firewall units serial number to be embedded in the certificate.
ca enroll myca.example.com 1234567890 serial
ca generate rsa
The ca generate rsa command generates RSA key pairs for your PIX Firewall. RSA keys are generated in pairsone public RSA key and one private RSA key. If your PIX Firewall already has RSA keys when you issue this command, you will be warned and prompted to replace the existing keys with new keys.
Note
Before issuing this command, make sure your PIX Firewall has a host name and domain name configured (using the hostname and domain-name commands). You will be unable to complete the ca generate rsa command without a host name and domain name. The ca generate rsa command is not saved in the PIX Firewall configuration. However, the keys generated by this command are saved in the persistent data file in Flash memory, which is never displayed to the user or backed up to another device. Examples In this example, one general purpose RSA key pair is to be generated. The selected size of the key modulus is 2048.
ca generate rsa key 2048
6-32
78-10392-02
Chapter 6
Note
You cannot generate both special usage and general purpose keys; you can only generate one or the other.
ca identity
The ca identity command declares the CA that your PIX Firewall will use. Currently, PIX Firewall supports one CA at one time. The no ca identity command removes the ca identity from the configuration and deletes all certificates issued by the specified CA. The show ca identity command shows the current settings stored in RAM. The PIX Firewall uses a subset of the HTTP protocol to contact the CA, and so must identify a particular cgi-bin script to handle CA requests. The default location and script on the CA server is /cgi-bin/pkiclient.exe. If the CA administrator has not put the CGI script in the above location, include the location and the name of the script within the ca identity command statement. By default, querying of a certificate or a CRL is done via Ciscos PKI protocol. If the CA supports Lightweight Directory Access Protocol (LDAP), query functions may use LDAP as well. The IP address of the LDAP server must be included within the ca identity command statement.
Examples
The following example indicates that the CA myca.example.com is declared as the PIX Firewall units supported CA. The CAs IP address of 205.139.94.231 is provided.
ca identity myca.example.com 205.139.94.231
ca save all
The ca save all commands allows you to save the PIX Firewall units RSA key pairs, the CA, RA and PIX Firewall units certificates, and the CAs CRLs in the persistent data file in Flash memory between reloads. The no ca save command removes the saved data from PIX Firewall units Flash memory. The ca save command itself is not saved with the PIX Firewall configuration between reloads. To view the current status of requested certificates, and relevant information of received certificates, such as CA and RA certificates, use the show ca certificate command. Because the certificates contain no sensitive data, any user is allowed to issue this show command.
ca zeroize rsa
The ca zeroize rsa command deletes all RSA keys that were previously generated by your PIX Firewall. If you issue this command, you must also perform two additional task. Perform these tasks in the following order:

Use the no ca identity command to manually remove the PIX Firewall units certificates from the configuration. This will delete all the certificates issued by the CA. Ask the CA administrator to revoke your PIX Firewall units certificates at the CA. Supply the challenge password you created when you originally obtained the PIX Firewall units certificates using the crypto ca enroll command.
6-33
Chapter 6 ca
Command Reference
show ca mypubkey rsa
The show ca mypubkey rsa command displays the PIX Firewall units public keys in a DER/BER encoded PKCS#1 representation.
Examples
The following is sample output of the show ca mypubkey rsa command. Special usage RSA keys were previously generated for this PIX Firewall using the ca generate rsa command:
show ca mypubkey rsa % Key pair was generated at: 15:34:55 Aug 05 1999 Key name: pixfirewall.example.com Usage: Signature Key Key Data: 305c300d 06092a86 4886f70d 01010105 6e7ed9a2 32883ca9 319a4b30 e7470888 6e2fd12c 5b3ffa98 8c5adc59 1ec84d78 % Key pair was generated at: 15:34:55
00034b00 30480241 00c31f4a ad32f60d 87732e83 c909fb17 fb5cae70 3de738cf 90bdb53f 2218cfe7 3f020301 0001 Aug 05 1999
Key name: pixfirewall.example.com Usage: Encryption Key Key Data: 305c300d 06092a86 4886f70d 01010105 00034b00 30480241 00d8a6ac cc64e57a 48dfb2c1 234661c7 76380bd5 72ae62f7 1706bdab 0eedd0b5 2e5feef0 76319d98 908f50b4 85a291de 247b6711 59b30026 453bfa3c 45234991 5d020301 0001
6-34
78-10392-02
Chapter 6
Command Reference clear Commands
clear Commands
Remove commands from the configuration or reset command values (All modes.) Table 6-2, Table 6-3, and Table 6-4 list each mode in which the clear commands first appear. Each clear command listed in one mode can be also accessed in each subsequent more secure mode going from unprivileged to configuration mode, but not from less secure modes.
Table 6-2
Unprivileged Mode Clear Commands
Clear Command clear pager
Description Resets the number of displayed lines to 24.
Described on Command Page pager
Table 6-3
Privileged Mode Clear Commands
Clear Command clear arp clear auth-prompt clear blocks clear configure clear flashfs clear local-host clear passwd clear traffic clear uauth
Description Clears the ARP table. Removes an auth-prompt command statement from the configuration.
Described on Command Page arp auth-prompt
Resets the show blocks command statement counters. show blocks / clear blocks Resets command parameters in the configuration to their default values. Clears Flash memory prior to downgrading the PIX Firewall software version. Resets the information displayed for the show local-host command. Resets the Telnet password back to cisco. Resets the counters for the show traffic command. configure flashfs local-host (clear and show) passwd show traffic/clear traffic
Deletes one users or all users AAA authorization uauth (clear and caches, which forces the user or users to reauthenticate show) the next time they create a connection. Clears the contents of the translation slots. xlate (clear and show)
clear xlate
6-35
Chapter 6 clear Commands
Command Reference
Table 6-4
Conguration Mode Clear Commands
Clear Command clear aaa clear access-list
Description Remove aaa command statements from the configuration Remove access-list command statements from the configuration. This command also stops all traffic through the PIX Firewall on the affected access-list command statements.
Described on Command Page aaa access-list
clear access-group clear alias clear apply clear conduit clear [crypto] dynamic-map
Removes access-group command statements from the access-group configuration. Removes alias command statements from the configuration. Removes apply command statements from the configuration. Removes conduit command statements from the configuration alias outbound / apply conduit
Removes crypto dynamic-map command statements crypto from the configuration.The keyword crypto is dynamic-map and optional. dynamic-map crypto ipsec
clear [crypto] ipsec sa Deletes the active IPSec security associations. The keyword crypto is optional.
clear [crypto] ipsec sa Clears the traffic counters maintained for each security crypto ipsec counters association. The keyword crypto is optional. clear [crypto] ipsec sa Deletes the active IPSec security association with the entry specified address, protocol, and SPI. The keyword destination-address crypto is optional. protocol spi clear [crypto] ipsec sa Deletes the active IPSec security associations for the map map-name named crypto map set. The keyword crypto is optional. clear [crypto] ipsec sa Deletes the active IPSec security associations for the peer specified peer. The keyword crypto is optional. clear [crypto] isakmp Deletes the active IKE security associations. The sa keyword crypto is optional. clear established clear filter Removes established command statements from the configuration. Removes filter command statements from the configuration. crypto ipsec
crypto ipsec
crypto ipsec
isakmp
established filter
6-36
78-10392-02
Chapter 6
Command Reference clear Commands
Table 6-4
Conguration Mode Clear Commands (continued)
Clear Command clear fixup clear global clear ipsec clear isakmp clear ip clear interface clear logging clear names clear nameif clear nat clear outbound clear rip clear route
Description Resets fixup protocol command statements to their default values. Removes global command statements from the configuration. Removes ipsec command statements from the configuration. Removes isakmp command statements from the configuration. Sets all PIX Firewall interface IP addresses to 127.0.0.1 and stops all traffic. Clear counters for the show interface command. Clear syslog message queue accumulated by the logging buffered command. Removes name command statements from the configuration. Reverts nameif command statements to default interface names and security levels. Removes nat command statements from the configuration. Removes outbound command statements from the configuration. Removes rip command statements from the configuration. Removes route command statements from the configuration that do not contain the CONNECT keyword.
Described on Command Page fixup protocol global ipsec isakmp ip address interface logging name / names nameif nat outbound / apply rip route
clear snmp-server clear static clear sysopt clear telnet clear tftp-server clear timeout clear url-cache
Removes snmp-server command statements from the snmp-server configuration. Removes static command statements from the configuration. Removes sysopt command statements from the configuration. Removes telnet command statements from the configuration. Removes tftp-server command statements from the configuration. Resets timeout command durations to their default values. Removes url-cache command statements from the configuration. static sysopt telnet tftp-server timeout url-cache
6-37
Chapter 6 clear Commands
Command Reference
Table 6-4
Conguration Mode Clear Commands (continued)
Clear Command clear url-server clear virtual clear vpdn
Description Removes url-server command statements from the configuration. Removes virtual command statements from the configuration. Removes vpdn command statements from the configuration.
Described on Command Page url-server virtual vpdn
6-38
78-10392-02
Chapter 6
Command Reference clock
clock
Set the PIX Firewall clock for use with the PIX Firewall Syslog Server and the Public Key Infrastructure (PKI) protocol. (Configuration mode.) clock clock set hh:mm:ss month day year clock set hh:mm:ss day month year show clock
Syntax Description
hh:mm:ss
The current hour:minutes:seconds expressed in 24-hour time; for example, 20:54:00 for 8:54 pm. Zeros can be entered as a single digit; for example, 21:0:0. The current month expressed as the first three characters of the month; for example, apr for April. The current day of the month; for example, 1. The current year expressed as four digits; for example, 2000.
month
day year
Usage Guidelines
The clock command lets you specify the current time, month, day, and year for use time stamped syslog messages, which you can enable with the logging timestamp command. You can view the current time with the clock or the show clock command.
Note
The lifetime of a certificate and the Certificate Revocation List (CRL) is checked in GMT time. If you are using IPSec with certificates, set the PIX Firewall clock to GMT time to ensure that CRL checking works correctly. You can interchange the settings for the day and the month; for example, clock set 21:0:0 1 apr 2000. A time prior to January 1, 1998 or after December 31, 2097 will not be accepted (the maximum date that the clock command can work to). While the PIX Firewall clock is year 2000 compliant, it does not adjust itself for daylight savings time changes; however, it does know about leap years. The PIX Firewall clock setting is retained in memory when the power is off by a battery on the PIX Firewall units motherboard. Should this battery fail, contact Ciscos customer support for a replacement PIX Firewall unit. Ciscos PKI (Public Key Infrastructure) protocol uses the clock to make sure that a Certificate Revocation List (CRL) is not expired. Otherwise, the CA may reject or allow certificates based on an incorrect timestamp.
6-39
Chapter 6 clock
Command Reference
Examples
To enable PFSS time-stamp logging for the first time, use these commands:
clock set 21:0:0 apr 1 2000 show clock 21:00:05 Apr 01 2000 logging host 209.165.201.3 logging timestamp logging trap 5
In this example, the clock command sets the clock to 9 pm on April 1, 2000. The logging host command specifies that a syslog server is at IP address 209.165.201.3. The PIX Firewall automatically determines that the server is a PFSS and sends syslog messages to it via TCP and UDP. The logging timestamp command enables sending time stamped syslog messages. The logging trap 5 command in this example specifies that messages at syslog level 0 through 5 be sent to the syslog server. The value 5 is used to capture severe and normal messages, but also those of the aaa authentication enable command.
6-40
78-10392-02
Chapter 6
Command Reference conduit
conduit
Add, delete, or show conduits through the PIX Firewall for incoming connections. (Configuration mode.) conduit permit | deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]] no conduit permit | deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]] conduit permit | deny icmp global_ip global_mask foreign_ip foreign_mask [icmp_type] clear conduit show conduit
Syntax Description
permit deny protocol
Permit access if the conditions are matched. Deny access if the conditions are matched. Specify the transport protocol for the connection. Possible literal values are icmp, tcp, udp, or an integer in the range 0 through 255 representing an IP protocol number. Use ip to specify all transport protocols. You can view valid protocol numbers online at the following site: http://www.isi.edu/in-notes/iana/assignments/protocol-numbers If you specify the icmp protocol, you can permit or deny ICMP access to one or more global IP addresses. Specify the ICMP type in the icmp_type variable, or omit to specify all ICMP types. See the Usage Guidelines for a complete list of the ICMP types.
global_ip
A global IP address previously defined by a global or static command. You can use any if the global_ip and global_mask are 0.0.0.0 0.0.0.0. The any option applies the permit or deny parameters to the global addresses. If global_ip is a host, you can omit global_mask by specifying the host command before global_ip. For example:
conduit permit tcp host 209.165.201.1 eq ftp any
This example lets any foreign host access global address 209.165.201.1 for FTP. global_mask Network mask of global_ip. The global_mask is a 32-bit, four-part dotted decimal; such as, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for global_ip, use 0 for the global_mask; otherwise, enter the global_mask appropriate to global_ip.
6-41
Chapter 6 conduit
Command Reference
foreign_ip
An external IP address (host or network) that can access the global_ip. You can specify 0.0.0.0 or 0 for any host. If both the foreign_ip and foreign_mask are 0.0.0.0 0.0.0.0, you can use the shorthand any option. If foreign_ip is a host, you can omit foreign_mask by specifying the host command before foreign_ip. For example:
conduit permit tcp any eq ftp host 209.165.201.2
This example lets foreign host 209.165.201.2 access any global address for FTP. foreign_mask Network mask of foreign_ip. The foreign_mask is a 32-bit, four-part dotted decimal; such as, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for foreign_ip, use 0 for the foreign_mask; otherwise, enter the foreign_mask appropriate to foreign_ip. You can also specify a mask for subnetting, for example, 255.255.255.192. operator A comparison operand that lets you specify a port or a port range. Use without an operator and port to indicate all ports; for example:
conduit permit tcp any any
Use eq and a port to permit or deny access to just that port. For example use eq ftp to permit or deny access only to FTP:
conduit deny tcp host 192.168.1.1 eq ftp 209.165.201.1
Use lt and a port to permit or deny access to all ports less than the port you specify. For example, use lt 2025 to permit or deny access to the well known ports (1 to 1024):
conduit permit tcp host 192.168.1.1 lt 1025 any
Use gt and a port to permit or deny access to all ports greater than the port you specify. For example, use gt 42 to permit or deny ports 43 to 65535:
conduit deny udp host 192.168.1.1 gt 42 host 209.165.201.2
Use neq and a port to permit or deny access to every port except the ports that you specify. For example, use neq 10 to permit or deny ports 1-9 and 11 to 65535:
conduit deny tcp host 192.168.1.1 neq 10 host 209.165.201.2 neq 42
Use range and a port range to permit or deny access to only those ports named in the range. For example, use range 10 1024 to permit or deny access only to ports 10 through 1024. All other ports are unaffected.
conduit deny tcp any range ftp telnet any
Note By default, all ports are denied until explicitly permitted.
6-42
78-10392-02
Chapter 6
port
Service(s) you permit to be used while accessing global_ip or foreign_ip. Specify services by the port that handles it, such as smtp for port 25, www for port 80, and so on. You can specify ports by either a literal name or a number in the range of 0 to 65535. You can specify all ports by not specifying a port value; for example:
conduit deny tcp any any
This command is the default condition for the conduit command in that all ports are denied until explicitly permitted. You can view valid port numbers online at the following site: http://www.isi.edu/in-notes/iana/assignments/port-numbers See Ports in Chapter 1, Introduction, for a list of valid port literal names in port ranges; for example, ftp h323. You can also specify numbers. icmp_type The type of ICMP message. Table 6-5 lists the ICMP type literals that you can use in this command. Omit this option to mean all ICMP types. An example of this command that permits all ICMP types is conduit permit icmp any any. This command lets ICMP pass inbound and outbound.
Usage Guidelines
A conduit command statement creates an exception to the PIX Firewall Adaptive Security mechanism by permitting connections from one firewall network interface to access hosts on another. The clear conduit command removes all conduit command statements from your configuration. The conduit command can permit or deny access to either the global or static commands; however, neither is required for the conduit command. You can associate a conduit command statement with a global or static command statement through the global address, either specifically to a single global address, a range of global addresses, or to all global addresses.
Note
The conduit command has been superseded by the access-list command. We recommend that you migrate your configuration away from the conduit command to maintain future compatibility. When used with a static command statement, a conduit command statement permits users on a lower security interface to access a higher security interface. When not used with a static command statement, a conduit command statement permits both inbound and outbound access.
Converting conduit Commands to access-list Commands
Follow these steps to convert conduit command statements to access-list commands:

Step 1
View the static command format. This command normally precedes both the conduit and access-list commands. The static command syntax is as follows: static (high_interface,low_interface) global_ip local_ip netmask mask For example:
static (inside,outside) 209.165.201.5 192.168.1.5 netmask 255.255.255.255
6-43
Chapter 6 conduit
Command Reference
This command maps the global IP address 209.165.201.5 on the outside interface to the web server 192.168.1.5 on the inside interface. The 255.255.255.255 is used for host addresses.
Step 2
View the conduit command format. The conduit command is similar to the access-list command in that it restricts access to the mapping provided by the static command. The conduit command syntax is as follows: conduit action protocol global_ip global_mask global_operator global_port [global_port] foreign_ip foreign_mask foreign_operator foreign_port [foreign_port] For example:
conduit permit tcp host 209.165.201.5 eq www any
This command permits TCP for the global IP address 209.165.201.5 that was specified in the static command statement and permits access over port 80 (www). The any option lets any host on the outside interface access the global IP address. The static command identifies the interface that the conduit command restricts access to.
Step 3
Create the access-list command from the conduit command options. The acl_name in the access-list command is a name or number you create to associate access-list command statements with an access-group or crypto map command statement. Normally the access-list command format is as follows: access-list acl_name [deny | permit] protocol src_addr src_mask operator port dest_addr dest_mask operator port However, using the syntax from the conduit command in the access-list command, you can see how the foreign_ip in the conduit command is the same as the src_addr in the access-list command and how the global_ip option in the conduit command is the same as the dest_addr in the access-list command. The access-list command syntax overlaid with the conduit command options is as follows: access-list acl_name action protocol foreign_ip foreign_mask foreign_operator foreign_port [foreign_port] global_ip global_mask global_operator global_port [global_port] For example:
access-list acl_out permit tcp any host 209.165.201.5 eq www
This command identifies the access-list command statement group with the acl_out identifier. You can use any name or number for your own identifier. (In this example the identifier, acl is from ACL, which means Access Control List and out is an abbreviation for the outside interface.) It makes your configuration clearer if you use an identifier name that indicates the interface to which you are associating the access-list command statements. The example access-list command, like the conduit command, permits TCP connections from any system on the outside interface. The access-list command is associated with the outside interface with the access-group command.
Step 4
Create the access-group command using the acl_name from the access-list command and the low_interface option from the static command. The format for the access-group command is as follows: access-group acl_name in interface low_interface For example:
access-group acl_out in interface outside
6-44
78-10392-02
Chapter 6
This command associates with the acl_out group of access-list command statements and states that the access-list command statement restricts access to the outside interface.
More on the conduit Command
If you associate a conduit command statement with a static command statement, only the interfaces specified on the static command statement have access to the conduit command statement. For example, if a static command statement lets users on the dmz interface access a server on the inside interface, only users on the dmz interface can access the server via the static command statement. Users on the outside do not have access.
Note
The conduit command statements are processed in the order entered into the configuration. The permit and deny options for the conduit command are processed in the order listed in the PIX Firewall configuration. In the following example, host 209.165.202.129 is not denied access through the PIX Firewall because the permit option precedes the deny option:
conduit permit tcp host 209.165.201.4 eq 80 any conduit deny tcp host 209.165.201.4 host 209.165.202.129 eq 80 any
Note
If you want internal users to be able to ping external hosts, use the conduit permit icmp any any command. After changing or removing a conduit command statement, use the clear xlate command. You can remove a conduit command statement with the no conduit command. Use the show conduit command to view the conduit command statements in the configuration and the number of times (hit count) an element has been matched during a conduit command search. If you prefer more selective ICMP access, you can specify a single ICMP message type as the last option in this command. Table 6-5 lists possible ICMP types values.
Table 6-5
ICMP Type Literals
ICMP Type 0 3 4 5 6 8 9 10 11 12 13 14
Literal echo-reply unreachable source-quench redirect alternate-address echo router-advertisement router-solicitation time-exceeded parameter-problem timestamp-reply timestamp-request
6-45
Chapter 6 conduit
Command Reference
Table 6-5
ICMP Type Literals
ICMP Type 15 16 17 18 31 32
Usage Notes
1. 2. 3.
Literal information-request information-reply mask-request mask-reply conversion-error mobile-redirect
By default, all ports are denied until explicitly permitted. The conduit command statements are processed in the order entered in the configuration. If you remove a command, it affects the order of all subsequent conduit command statements. To remove all conduit command statements, cut and paste your configuration onto your console computer, edit the configuration on the computer, use the write erase command to clear the current configuration, and then paste the configuration back into the PIX Firewall. You can have as many conduit command statements as needed as long as the total size of your configuration does not exceed the maximum allowable size of a configuration. See Configuration Size in Chapter 1, Introduction. If you use PAT (Port Address Translation), you cannot use a conduit command statement using the PAT address to either permit or deny access to ports. Two conduit command statements are required for establishing access to the following services: discard, dns, echo, ident, pptp, rpc, sunrpc, syslog, tacacs-ds, talk, and time. Each service, except for pptp, requires one conduit for TCP and one for UDP. For DNS, if you are only receiving zone updates, you only need a single conduit command statement for TCP. The two conduit command statements for the PPTP transport protocol, which is a subset of the GRE protocol, are as shown in this example:
static (dmz2,outside) 209.165.201.5 192.168.1.5 netmask 255.255.255.255 conduit permit tcp host 209.165.201.5 eq 1723 any conduit permit gre host 209.165.201.5 any
4.
5. 6.
In this example, PPTP is being used to handle access to host 192.168.1.5 on the dmz2 interface from users on the outside. Outside users access the dmz2 host using global address 209.165.201.5. The first conduit command statement opens access for the PPTP protocol and gives access to any outside users. The second conduit command statement permits access to GRE. If PPTP was not involved and GRE was, you could omit the first conduit command statement.
7.
The RPC conduit command support fixes up UDP portmapper and rpcbind exchanges. TCP exchanges are not supported. This lets simple RPC-based programs work; however, remote procedure calls, arguments, or responses that contain addresses or ports will not be fixed up. For MSRPC, two conduit command statements are required, one for port 135 and another for access to the high ports (1024-65535). For Sun RPC, a single conduit command statement is required for UDP port 111.
6-46
78-10392-02
Chapter 6
Once you create a conduit command statement for RPC, you can use the following command to test its activity from a UNIX host:
rpcinfo -u unix_host_ip_address 150001
Replace unix_host_ip_address with the IP address of the UNIX host.

8.
You can overlay host statics on top of a net static range to further refine what an individual host can access:
static (inside, outside) 209.165.201.0 10.1.1.0 netmask 255.255.255.0 conduit permit tcp 209.165.201.0 255.255.255.0 eq ftp any static (inside, outside) 203.31.17.3 10.1.1.3 netmask 255.255.255.0 conduit permit udp host 209.165.201.3 eq h323 host 209.165.202.3
In this case, the host at 209.165.202.3 has InternetPhone access in addition to its blanket FTP access.
Examples
1.
The following commands permit access between an outside UNIX gateway host at 209.165.201.2, to an inside SMTP server with Mail Guard at 192.168.1.49. Mail Guard is enabled in the default configuration for PIX Firewall with the fixup protocol smtp 25 command. The global address on the PIX Firewall is 209.165.201.1:
static (inside,outside) 209.165.201.1 192.168.1.49 netmask 255.255.255.255 0 0 conduit permit tcp host 209.165.201.1 eq smtp host 209.165.201.2
To disable Mail Guard, enter the following command:

no fixup protocol smtp 25
2.
You can set up an inside host to receive H.323 InternetPhone calls and allow the outside network to connect inbound via the IDENT protocol (TCP port 113). In this example, the inside network is at 192.168.1.0, the global addresses on the outside network are referenced via the 209.165.201.0 network address with a 255.255.255.224 mask:
static (inside,outside) 209.165.201.0 192.168.1.0 netmask 255.255.255.224 0 0 conduit permit tcp 209.165.201.0 255.255.255.224 eq h323 any conduit permit tcp 209.165.201.0 255.255.255.224 eq 113 any
3.
You can create a web server on the perimeter interface that can be accessed by any outside host as follows:
static (perimeter,outside) 209.165.201.4 192.168.1.4 netmask 255.255.255.255 0 0 conduit permit tcp host 209.165.201.4 eq 80 any
In this example, the static command statement maps the perimeter host, 192.168.1.4. to the global address, 209.165.201.4. The conduit command statement specifies that the global host can be accessed on port 80 (web server) by any outside host.
6-47
Chapter 6 configure
Command Reference
configure
Clear or merge current configuration with that on floppy or Flash memory, start configuration mode, or view current configuration. (Privileged mode.) clear configure primary | secondary | all configure net [[server_ip]:[filename]] configure floppy configure memory configure terminal show configure
Syntax Description
clear
Clears aspects of the current configuration in RAM. Use the write erase command to clear the complete configuration. Sets the interface, ip, mtu, nameif, and route commands to their default values. In addition, interface names are removed from all commands in the configuration.
primary
secondary Removes the aaa-server, alias, access-list, apply, conduit, global, outbound, static, telnet, and url-server command statements from your configuration. net all floppy memory terminal Loads the configuration from a TFTP server and the path you specify. Combines the primary and secondary options. Merges the current configuration with that on diskette. Merges the current configuration with that in Flash memory. Starts configuration mode to enter configuration commands from a terminal. Exit configuration mode by entering the quit command. Merges the current configuration with that available across the network at another location, which is defined with the tftp-server command. A filename you specify to qualify the location of the configuration file on the TFTP server named in server_ip. If you set a filename with the tftp-server command, do not specify it in the configure command; instead just use a colon ( : ) without a filename.
server_ip
filename
Usage Guidelines
The clear configure command resets a configuration to its default values. Use this command to create a template configuration or when you want to clear all values. The clear configure primary command resets the default values for the interface, ip, mtu, nameif, and route commands. This command also deletes interface names in the configuration.
6-48
78-10392-02
Chapter 6
Command Reference configure
The clear configure secondary command removes the aaa-server, alias, access-list, apply, conduit, global, outbound, static, telnet, and url-server command statements from the configuration. However, the clear configure secondary command does not remove tftp-server command statements.
Note
Save your configuration before using the clear configure command. The clear configure secondary command does not prompt you before deleting lines from your configuration. The configure net command merges the current running configuration with a TFTP configuration stored at the IP address you specify and from the file you name. If you specify both the IP address and path name in the tftp-server command, you can specify :filename as simply a colon ( : ). For example:
configure net :
Use the write net command to store the configuration in the file. If you have an existing PIX Firewall configuration on a TFTP server and store a shorter configuration with the same file name on the TFTP server, some TFTP servers will leave some of the original configuration after the first :end mark. This does not affect the PIX Firewall because the configure net command stops reading when it reaches the first :end mark. However, this may cause confusion if you view the configuration and see extra text at the end of the configuration. This does not occur if you are using Cisco TFTP Server version 1.1 for Windows NT.
Note
Many TFTP servers require the configuration file to be world-readable to be accessible. The configure floppy command merges the current running configuration with the configuration stored on diskette. This command assumes that the diskette was previously created by the write floppy command. The configure memory command merges the configuration in Flash memory into the current configuration in RAM. The configure terminal command starts configuration mode. Exit configuration mode with the quit command. After exiting configuration mode, use write memory to store your changes in Flash memory or write floppy to store the configuration on diskette. Use the write terminal command to display the current configuration. The show configure command lists the contents of the configuration in Flash memory. Each command statement from diskette (with configure floppy), Flash memory (with configure memory), or TFTP transfer (with configure net) is read into the current configuration and evaluated in the same way as commands entered from a keyboard with these rules:

If the command on diskette or Flash memory is identical to an existing command in the current configuration, it is ignored. If the command on diskette or Flash memory is an additional instance of an existing command, such as if you already have one telnet command for IP address 10.2.3.4 and the diskette configuration has a telnet command for 10.7.8.9, then both commands appear in the current configuration. If the command redefines an existing command, the command on diskette or Flash memory overwrites the command in the current configuration in RAM. For example, if you have hostname ram in the current configuration and hostname floppy on diskette, the command in the configuration becomes hostname floppy and the command line prompt changes to match the new host name when that command is read from diskette.
6-49
Chapter 6 configure
Command Reference
Examples
The following example shows how to configure the PIX Firewall using a configuration retrieved with TFTP:
configure net 10.1.1.1:/tftp/config/pixconfig
The pixconfig file is stored on the TFTP server at 10.1.1.1 in the tftp/config folder. The following example shows how to configure the PIX Firewall from a diskette:
configure floppy
The following example shows how to configure the PIX Firewall from the configuration stored in Flash memory:
configure memory
The following example shows the commands you enter to access configuration mode, view the configuration, and save it in Flash memory. Access privileged mode with the enable command and configuration mode with the configure terminal command. View the current configuration with the write terminal command and save your configuration to Flash memory using the write memory command.
pixfirewall> enable password: pixfirewall# configure terminal pixfirewall(config)# write terminal : Saved
config commands
: End write memory
6-50
78-10392-02
Chapter 6
Command Reference copy tftp flash
copy tftp flash

Change software images without requiring access to the TFTP monitor mode. (Configuration mode.) copy tftp[:[[//location][/pathname]]] flash
Syntax Description
copy tftp flash
Download flash software images via tftp without using monitor mode. An image you download is made available to the PIX Firewall on the next reload (reboot). This either an IP address or a name that resolves to an IP address via the PIX Firewall naming resolution mechanism (currently static mappings via the name and names commands). PIX Firewall must know how to reach this location via its routing table information. This information is determined by the ip address command, the route command, or also RIP, depending upon your configuration. The pathname can include any directory names besides the actual last component of the path to the file on the server.
location
pathname
Usage Guidelines
The copy tftp flash command lets you download a software image via TFTP. You can use the copy tftp flash command with any PIX Firewall model running version 5.1(1) or later. The image you download is made available to the PIX Firewall on the next reload (reboot). The command syntax is as follows: copy tftp[:[[//location][/pathname]]] flash If the command is used without the location or pathname optional parameters, then the location and filename are obtained from the user interactively via a series of questions similar to those presented by Cisco IOS software. If you only enter a colon (:), parameters are taken from the tftp-server command settings. If other optional parameters are supplied, then these values would be used in place of the corresponding tftp-server command setting. Supplying any of the optional parameters, such as a colon and anything after it, causes the command to run without prompting for user input. The location is either an IP address or a name that resolves to an IP address via the PIX Firewall naming resolution mechanism (currently static mappings via the name and names commands). PIX Firewall must know how to reach this location via its routing table information. This information is determined by the ip address command, the route command, or also RIP, depending upon your configuration. The pathname can include any directory names besides the actual last component of the path to the file on the server. The pathname cannot contain spaces. If a directory name has spaces, set the directory in the TFTP server instead of in the copy tftp flash command. If your TFTP server has been configured to point to a directory on the system from which you are downloading the image, you need only use the IP address of the system and the image filename.
6-51
Chapter 6 copy tftp flash
Command Reference
For example, if you want to download the pix512.bin file from the D: partition on a Windows system (IP address 10.1.1.5), you would access the Cisco TFTP Server View>Options menu and enter the filename path in the TFTP server root directory edit box; for example, D:\pix_images. To copy the file to the PIX Firewall, use the following copy tftp command:
copy tftp://10.1.1.5/pix512.bin flash
The TFTP server receives the command and determines the actual file location from its root directory information. The server then downloads the TFTP image to the PIX Firewall.
Note
Images prior to version 5.1 cannot be retrieved using this mechanism.

Examples
The following example causes the PIX Firewall to prompt you for the filename and location before you start the TFTP download:
copy tftp flash Address or name of remote host [127.0.0.1]? 10.1.1.5 Source file name [cdisk]? pix512.bin copying tftp://10.1.1.5/pix512.bin to flash [yes|no|again]? yes !!!!!!!!!!!!!!!!!!!!!!! Received 1695744 bytes. Erasing current image. Writing 1597496 bytes of image. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Image installed.
The next example takes the information from the tftp-server command. In this case, the TFTP server is in an intranet and resides on the outside interface. The example sets the filename and location from the tftp-server command, saves memory, and then downloads the image to Flash memory:
tftp-server outside 10.1.1.5 pix512.bin Warning: 'outside' interface has a low security level (0). write memory Building configuration... Cryptochecksum: 017c452b d54be501 8620ba48 490f7e99 [OK] copy tftp: flash copying tftp://10.1.1.5/pix512.bin to flash !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
The next examples override the information in the tftp-server command to let you specify alternate information about the filename and location. If you have not set the tftp-server command, you can also use the copy tftp flash command to specify all information as shown in the second example that follows:
copy tftp:/pix512.bin flash copy tftp://10.0.0.1/pix512.bin flash
The next examples map an IP address to the tftp-host name with the name command and use the tftp-host name in the copy commands:
name 10.1.1.6 tftp-host copy tftp://tftp-host/pix512.bin flash copy tftp://tftp-host/tftpboot/pix512.bin flash
6-52
78-10392-02
Chapter 6
Command Reference crypto dynamic-map
crypto dynamic-map
Create, view, or delete a dynamic crypto map entry. (Configuration mode.) crypto dynamic-map dynamic-map-name dynamic-seq-num no crypto dynamic-map dynamic-map-name [dynamic-seq-num]
crypto dynamic-map dynamic-map-name dynamic-seq-num match address acl_name no crypto dynamic-map dynamic-map-name dynamic-seq-num match address acl_name
crypto dynamic-map dynamic-map-name dynamic-seq-num set peer hostname | ip-address no crypto dynamic-map dynamic-map-name dynamic-seq-num set peer hostname | ip-address
crypto dynamic-map dynamic-map-name dynamic-seq-num set pfs [group1 | group2] no crypto dynamic-map dynamic-map-name dynamic-seq-num set pfs
crypto dynamic-map dynamic-map-name dynamic-seq-num set security-association lifetime seconds seconds | kilobytes kilobytes no crypto dynamic-map dynamic-map-name dynamic-seq-num set security-association lifetime seconds | kilobytes crypto dynamic-map dynamic-map-name dynamic-seq-num set transform-set transform-set-name1 [ transform-set-name9] no crypto dynamic-map dynamic-map-name dynamic-seq-num set transform-set transform-set-name1 [ transform-set-name9] clear [crypto] dynamic-map [dynamic-map-name] [dynamic-seq-num] show crypto dynamic-map [tag dynamic-map-name]
Syntax Description
dynamic-map-name dynamic-seq-num
Specifies the name of the dynamic crypto map set. Specifies the sequence number that corresponds to the dynamic crypto map entry. Various subcommands (match address, set transform-set, and so on). (Optional) Shows the crypto dynamic map set with the specified map-name.
subcommand tag map-name
6-53
Chapter 6 crypto dynamic-map
Command Reference
Note
The crypto dynamic-map subcommands, such as match address, set peer, set pfs are described in the crypto map command page. See this command page for the descriptions of these commands, including syntax descriptions.
Usage Guidelines
The sections that follow describe each crypto dynamic-map command.
Note
See the section Dynamic Crypto Maps in Chapter 4, Configuring IPSec for more information about dynamic crypto maps.
crypto dynamic-map
The crypto dynamic-map command allows you to create a dynamic crypto map entry. The no crypto dynamic-map command deletes a dynamic crypto map set or entry. The clear [crypto] dynamic-map removes all of the dynamic crypto map command statements. Specifying the name of a given crypto dynamic map removes the associated crypto dynamic map command statement(s). You can also specify the dynamic crypto maps sequence number to remove all of the associated dynamic crypto map command statements. The show crypto dynamic-map command allows you to view a dynamic crypto map set. Dynamic crypto maps are policy templates used when processing negotiation requests for new security associations from a remote IPSec peer, even if you do not know all of the crypto map parameters required to communicate with the peer (such as the peers IP address). For example, if you do not know about all the remote IPSec peers in your network, a dynamic crypto map allows you to accept requests for new security associations from previously unknown peers. (However, these requests are not processed until the IKE authentication has completed successfully.) When a PIX Firewall receives a negotiation request via IKE from another peer, the request is examined to see if it matches a crypto map entry. If the negotiation does not match any explicit crypto map entry, it will be rejected unless the crypto map set includes a reference to a dynamic crypto map. The dynamic crypto map accepts wildcard parameters for any parameters not explicitly stated in the dynamic crypto map entry. This allows you to set up IPSec security associations with a previously unknown peer. (The peer still must specify matching values for the wildcard IPSec security association negotiation parameters.) If the PIX Firewall accepts the peers request, at the point that it installs the new IPSec security associations it also installs a temporary crypto map entry. This entry is filled in with the results of the negotiation. At this point, the PIX Firewall performs normal processing, using this temporary crypto map entry as a normal entry, even requesting new security associations if the current ones are expiring (based upon the policy specified in the temporary crypto map entry). Once the flow expires (that is, all of the corresponding security associations expire), the temporary crypto map entry is removed. Dynamic crypto maps are used for determining whether or not traffic should be protected.
Note
The only parameter required in a dynamic crypto map is the set transform-set. All other parameters are optional.
6-54
78-10392-02
Chapter 6
Command Reference crypto dynamic-map
Examples
The following example configures an IPSec crypto map set. Crypto map entry mymap 30 references the dynamic crypto map set mydynamicmap, which can be used to process inbound security association negotiation requests that do not match mymap entries 10 or 20. In this case, if the peer specifies a transform set that matches one of the transform sets specified in mydynamicmap, for a flow permitted by the access list 103, IPSec will accept the request and set up security associations with the remote peer without previously knowing about the peer. If accepted, the resulting security associations (and temporary crypto map entry) are established according to the settings specified by the remote peer. The access list associated with mydynamicmap 10 is also used as a filter. Inbound packets that match a permit statement in this list are dropped for not being IPSec protected. (The same is true for access lists associated with static crypto maps entries.) Outbound packets that match a permit statement without an existing corresponding IPSec security association are also dropped.
crypto crypto crypto crypto crypto crypto crypto crypto crypto map mymap 10 ipsec-isakmp map mymap 10 match address 101 map mymap 10 set transform-set my_t_set1 map mymap 10 set peer 10.0.0.1 10.0.0.2 map mymap 20 ipsec-isakmp map mymap 20 match address 102 map mymap 20 set transform-set my_t_set1 my_t_set2 map mymap 20 set peer 10.0.0.3 dynamic-map mydynamicmap 10 match address 103
crypto dynamic-map mydynamicmap 10 set transform-set my_t_set1 my_t_set2 my_t_set3 crypto map mymap 30 ipsec-isakmp dynamic mydynamicmap
The following is sample output for the show crypto dynamic-map command:
show crypto dynamic-map Crypto Map Template "dyn1" 10 access-list 152 permit ip host 172.21.114.67 any Current peer: 0.0.0.0 Security association lifetime: 4608000 kilobytes/120 seconds PFS (Y/N): N Transform sets={ tauth, t1, }
The following partial configuration was in effect when the above show crypto dynamic-map command was issued:
crypto ipsec security-association lifetime seconds 120 crypto ipsec transform-set t1 esp-des esp-md5-hmac crypto ipsec transform-set tauth ah-sha-hmac crypto dynamic-map dyn1 10 crypto dynamic-map dyn1 set transform-set tauth t1 crypto dynamic-map dyn1 match address 152 crypto map to-firewall local-address Ethernet0 crypto map to-firewall 10 ipsec-isakmp crypto map to-firewall 10 set peer 172.21.114.123 crypto map to-firewall 10 set transform-set tauth t1 crypto map to-firewall 10 match address 150 crypto map to-firewall 20 ipsec-isakmp dynamic dyn1 access-list 150 permit ip host 172.21.114.67 host 172.21.114.123 access-list 150 permit ip host 15.15.15.1 host 172.21.114.123 access-list 150 permit ip host 15.15.15.1 host 8.8.8.1 access-list 152 permit ip host 172.21.114.67 any
6-55
Chapter 6 crypto dynamic-map
Command Reference
crypto dynamic-map match address
See the crypto map match address command within the crypto map command page for information about this command.
crypto dynamic-map set peer
See the crypto map set peer command within the crypto map command page for information about this command.
crypto dynamic-map set pfs
See the crypto map set pfs command within the crypto map command page for information about this command.
crypto dynamic-map set security-association lifetime
See the crypto map set security-association lifetime command within the crypto map command page for information about this command.
crypto dynamic-map set transform-set
See the crypto map set transform-set command within the crypto map command page for information about this command.
Note
This command is required for dynamic crypto map entries.
6-56
78-10392-02
Chapter 6
Command Reference crypto ipsec
crypto ipsec
Create, view, or delete IPSec security associations, security association global lifetime values, and global transform sets. (Configuration mode.) crypto ipsec security-association lifetime seconds seconds | kilobytes kilobytes no crypto ipsec security-association lifetime seconds | kilobytes show crypto ipsec security-association lifetime
crypto ipsec transform-set transform-set-name transform1 [transform2 [transform3]] no crypto ipsec transform-set transform-set-name show crypto ipsec transform-set [tag transform-set-name]
clear [crypto] ipsec sa clear [crypto] ipsec sa counters clear [crypto] ipsec sa entry destination-address protocol spi clear [crypto] ipsec sa map map-name clear [crypto] ipsec sa peer show crypto ipsec sa [map map-name | address | identity] [detail]
Syntax Description
address
(Optional) Shows the all existing security associations, sorted by the destination address (either the local address or the address of the remote IPSec peer) and then by protocol (AH or ESP). Specify the IP address of your peer or the remote peer. (Optional) Shows detailed error counters. (The default is the high level send/receive error counters.) (Optional) Shows only the flow information. It does not show the security association information. Specify the identifying interface (outside or external) to be used by the PIX Firewall to identify itself to remote peers. If IKE is enabled, and you are using a Certification Authority (CA) to obtain certificates, this should be the interface with the address specified in the CA certificates.
destination-address detail
identity
interface-name
6-57
Chapter 6 crypto ipsec
Command Reference
ip-address ipsec-isakmp
Specify a remote peers IP address. Indicates that IKE will be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry. Indicates that IKE will not be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry. Specifies the volume of traffic (in kilobytes) that can pass between IPSec peers using a given security association before that security association expires. The default is 4,608,000 kilobytes (10 megabytes per second for one hour). The name of the crypto map set. Specify a remote peers name as the fully qualified domain name. For example, remotepeer.example.com. Specify either the AH or ESP protocol. Specify the number of seconds a security association will live before it expires. The default is 28,800 seconds (eight hours). The number you assign to the crypto map entry. Specifies the security parameter index (SPI), a number that is used to uniquely identify a security association. The SPI is an arbitrary number you assign in the range of 256 to 4,294,967,295 (FFFF FFFF). (Optional) Shows only the transform sets with the specified transform-set-name. Specify up to three transforms. Transforms define the IPSec security protocol(s) and algorithm(s). Each transform represents an IPSec security protocol (ESP, AH, or both) plus the algorithm you want to use. Specify the name of the transform set to create or modify.
ipsec-manual
kilobytes kilobytes
map map-name peer-name
protocol seconds seconds
seq-num spi
tag transform-set-name transform1 transform2 transform3 transform-set-name

Usage Guidelines
The sections that follow describe each crypto ipsec command.
Note
See the section About IPSec in Chapter 4, Configuring IPSec for more information about this IPSec feature.
crypto ipsec security-association lifetime
The crypto ipsec security-association lifetime command is used to change global lifetime values used when negotiating IPSec security associations. To reset a lifetime to the default value, use the no crypto ipsec security-association lifetime command. The show crypto ipsec security-association lifetime command allows you to view the security-association lifetime value configured for a particular crypto map entry.
6-58
78-10392-02
Chapter 6
IPSec security associations use shared secret keys. These keys and their security associations time out together. Assuming that the particular crypto map entry does not have lifetime values configured, when the PIX Firewall requests new security associations during security association negotiation, it will specify its global lifetime value in the request to the peer; it will use this value as the lifetime of the new security associations. When the PIX Firewall receives a negotiation request from the peer, it will use the smaller of the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations. There are two lifetimes: a timed lifetime and a traffic-volume lifetime. The security association expires after the first of these lifetimes is reached. If you change a global lifetime, the change is only applied when the crypto map entry does not have a lifetime value specified. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear [crypto] ipsec sa command. See the clear [crypto] ipsec sa command for more information. To change the global timed lifetime, use the crypto ipsec security-association lifetime seconds command. The timed lifetime causes the security association to time out after the specified number of seconds have passed. To change the global traffic-volume lifetime, use the crypto ipsec security-association lifetime kilobytes command. The traffic-volume lifetime causes the security association to time out after the specified amount of traffic (in kilobytes) has been protected by the security associations' key. Shorter lifetimes can make it harder to mount a successful key recovery attack, since the attacker has less data encrypted under the same key to work with. However, shorter lifetimes require more CPU processing time for establishing new security associations. The lifetime values are ignored for manually established security associations (security associations installed using an ipsec-manual crypto map command entry). The security association (and corresponding keys) will expire according to whichever occurs sooner, either after the number of seconds has passed (specified by the seconds keyword) or after the amount of traffic in kilobytes has passed (specified by the kilobytes keyword). A new security association is negotiated before the lifetime threshold of the existing security association is reached, to ensure that a new security association is ready for use when the old one expires. The new security association is negotiated either 30 seconds before the seconds lifetime expires or when the volume of traffic through the tunnel reaches 256 kilobytes less than the kilobytes lifetime (whichever occurs first). If no traffic has passed through the tunnel during the entire life of the security association, a new security association is not negotiated when the lifetime expires. Instead, a new security association will be negotiated only when IPSec sees another packet that should be protected.
Examples
This example shortens both lifetimes, because the administrator feels there is a higher risk that the keys could be compromised. The timed lifetime is shortened to 2,700 seconds (45 minutes), and the traffic-volume lifetime is shortened to 2,304,000 kilobytes (10 megabytes per second for one half hour).
crypto ipsec security-association lifetime seconds 2700 crypto ipsec security-association lifetime kilobytes 2304000
The following is sample output for the show crypto ipsec security-association lifetime command:
show crypto ipsec security-association lifetime Security-association lifetime: 4608000 kilobytes/120 seconds
6-59
Command Reference
The following configuration was in effect when the above show crypto ipsec security-association lifetime command was issued:
crypto ipsec security-association lifetime seconds 120
crypto ipsec transform-set
The crypto ipsec transform-set command defines a transform set. To delete a transform set, use the no crypto ipsec transform-set command. To view the configured transform sets, use the show crypto ipsec transform-set command. A transform set specifies one or two IPSec security protocols (either ESP or AH or both) and specifies which algorithms to use with the selected security protocol. During the IPSec security association negotiation, the peers agree to use a particular transform set when protecting a particular data flow. You can configure multiple transform sets, and then specify one or more of these transform sets in a crypto map entry. The transform set defined in the crypto map entry is used in the IPSec security association negotiation to protect the data flows specified by that crypto map entrys access list. During the negotiation, the peers search for a transform set that is the same at both peers. When such a transform set is found, it is selected and is applied to the protected traffic as part of both peers IPSec security associations. When security associations are established manually, a single transform set must be used. The transform set is not negotiated. Before a transform set can be included in a crypto map entry, it must be defined using the crypto ipsec transform-set command. To define a transform set, you specify one to three transformseach transform represents an IPSec security protocol (ESP or AH) plus the algorithm you want to use. When the particular transform set is used during negotiations for IPSec security associations, the entire transform set (the combination of protocols, algorithms, and other settings) must match a transform set at the remote peer. In a transform set you could specify the AH protocol, the ESP protocol, or both. If you specify an ESP protocol in a transform set, you can specify just an ESP encryption transform or both an ESP encryption transform and an ESP authentication transform. Examples of acceptable transform combinations are as follows:

ah-md5-hmac esp-des esp-des and esp-md5-hmac ah-sha-hmac and esp-des and esp-sha-hmac
If one or more transforms are specified in the crypto ipsec transform-set command for an existing transform set, the specified transforms will replace the existing transforms for that transform set. If you change a transform set definition, the change is only applied to crypto map entries that reference the transform set. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear [crypto] ipsec sa command. For more information about transform sets, see Transform Sets in Chapter 4, Configuring IPSec.
6-60
78-10392-02
Chapter 6
Examples
This example defines one transform set (named standard), which will be used with an IPSec peer that supports the ESP protocol. Both an ESP encryption transform and an ESP authentication transform is specified in this example:
crypto ipsec transform-set standard esp-des esp-md5-hmac
The following is sample output for the show crypto ipsec transform-set command:
show crypto ipsec transform-set Transform set combined-des-sha: { esp-des esp-sha-hmac will negotiate = { Tunnel, }, Transform set combined-des-md5: { esp-des esp-md5-hmac will negotiate = { Tunnel, }, Transform set t1: { esp-des esp-md5-hmac will negotiate = { Tunnel, }, Transform set t100: { will negotiate = { ah-sha-hmac Tunnel, }, } } }
Transform set t2: { ah-sha-hmac } will negotiate = { Tunnel, }, { esp-des } will negotiate = { Tunnel, },
The following configuration was in effect when the above show crypto ipsec transform-set command was issued:
crypto crypto crypto crypto crypto ipsec ipsec ipsec ipsec ipsec transform-set transform-set transform-set transform-set transform-set combined-des-sha esp-des esp-sha-hmac combined-des-md5 esp-des esp-md5-hmac t1 esp-des esp-md5-hmac t100 ah-sha-hmac t2 ah-sha-hmac esp-des
clear [crypto] ipsec sa
The clear [crypto] ipsec sa command allows you to delete IPSec security associations. The keyword crypto is optional. If the security associations were established via IKE, they are deleted and future IPSec traffic will require new security associations to be negotiated. When IKE is used, the IPSec security associations are established only when needed. If the security associations are manually established, the security associations are deleted. If the peer, map, entry, or counters keywords are not used, all IPSec security associations will be deleted. This command clears (deletes) IPSec security associations. If the security associations were established via IKE, they are deleted and future IPSec traffic will require new security associations to be negotiated. (When IKE is used, the IPSec security associations are established only when needed.) If the security associations are manually established, the security associations are deleted and reinstalled. (When IKE is not used, the IPSec security associations are created as soon as the configuration is completed.) If the peer, map, entry, or counters keywords are not used, all IPSec security associations will be deleted. The peer keyword deletes any IPSec security associations for the specified peer. The map keyword deletes any IPSec security associations for the named crypto map set.
6-61
Command Reference
The entry keyword deletes the IPSec security association with the specified address, protocol, and SPI. If any of the previous commands cause a particular security association to be deleted, all the sibling security associationsthat were established during the same IKE negotiationare deleted as well. The counters keyword simply clears the traffic counters maintained for each security association; it does not clear the security associations themselves. If you make configuration changes that affect security associations, these changes will not apply to existing security associations but to negotiations for subsequent security associations. You can use the clear [crypto] ipsec sa command to restart all security associations so they will use the most current configuration settings. In the case of manually established security associations, if you make changes that affect security associations you must use the clear [crypto] ipsec sa command before the changes take effect.
Note
If you make significant changes to IPSec configuration such as access-list or peers, clear [crypto] ipsec sa will not be enough to activate the new configuration. In such case, rebind the crypto map to the interface with the crypto map interface command. If the PIX Firewall is processing active IPSec traffic, Cisco recommends that you only clear the portion of the security association database that is affected by the changes to avoid causing active IPSec traffic to temporarily fail.
Note
The clear [crypto] ipsec sa command only clears IPSec security associations; to clear IKE security associations, use the clear [crypto] isakmp sa command.
Examples
The following example clears (and reinitializes if appropriate) all IPSec security associations at the PIX Firewall:
clear crypto ipsec sa
The following example clears (and reinitializes if appropriate) the inbound and outbound IPSec security associations established along with the security association established for address 10.0.0.1 using the AH protocol with the SPI of 256:
clear crypto ipsec sa entry 10.0.0.1 AH 256
show crypto ipsec sa
The show crypto ipsec sa command allows you to view the settings used by current security associations. If no keyword is used, all security associations are displayed. They are sorted first by interface, and then by traffic flow (for example, source/destination address, mask, protocol, port). Within a flow, the security associations are listed by protocol (ESP/AH) and direction (inbound/outbound).
Note
While entering the show crypto ipsec sa command, if the screen display is stopped with the More prompt and the security association lifetime expires while the screen display is stopped, then the subsequent display information may refer to a stale security association. Assume that the security association lifetime values that display are invalid.
6-62
78-10392-02
Chapter 6
Note
Output of the show crypto ipsec sa command lists the PCP protocol. This is a compression protocol that came with the Cisco IOS software code on which the PIX Firewall IPSec implementation is based; however, the PIX Firewall does not support the PCP protocol.
Examples
The following is a sample output for the show crypto ipsec sa command:
show crypto ipsec sa interface: outside Crypto map tag: firewall-alice, local addr. 172.21.114.123 local ident (addr/mask/prot/port): (172.21.114.123/255.255.255.255/0/0) remote ident (addr/mask/prot/port): (172.21.114.67/255.255.255.255/0/0) current_peer: 172.21.114.67 PERMIT, flags={origin_is_acl,} #pkts encaps: 10, #pkts encrypt: 10, #pkts digest 10 #pkts decaps: 10, #pkts decrypt: 10, #pkts verify 10 #send errors 10, #recv errors 0 local crypto endpt.: 172.21.114.123, remote crypto endpt.: 172.21.114.67 path mtu 1500, media mtu 1500 current outbound spi: 20890A6F inbound esp sas: spi: 0x257A1039(628756537) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 26, crypto map: sa timing: remaining key lifetime IV size: 8 bytes replay detection support: Y inbound ah sas: outbound esp sas: spi: 0x20890A6F(545852015) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 27, crypto map: sa timing: remaining key lifetime IV size: 8 bytes replay detection support: Y outbound ah sas: interface: inside Crypto map tag: firewall-alice, local
firewall-alice (k/sec): (4607999/90)
firewall-alice (k/sec): (4607999/90)
addr. 172.21.114.123
local ident (addr/mask/prot/port): (172.21.114.123/255.255.255.255/0/0) remote ident (addr/mask/prot/port): (172.21.114.67/255.255.255.255/0/0) current_peer: 172.21.114.67 PERMIT, flags={origin_is_acl,} #pkts encaps: 10, #pkts encrypt: 10, #pkts digest 10 #pkts decaps: 10, #pkts decrypt: 10, #pkts verify 10 #send errors 10, #recv errors 0 local crypto endpt.: 172.21.114.123, remote crypto endpt.: 172.21.114.67 path mtu 1500, media mtu 1500 current outbound spi: 20890A6F
6-63
Command Reference
inbound esp sas: spi: 0x257A1039(628756537) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 26, crypto map: firewall-alice sa timing: remaining key lifetime (k/sec): (4607999/90) IV size: 8 bytes replay detection support: Y inbound ah sas: outbound esp sas: spi: 0x20890A6F(545852015) transform: esp-des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 27, crypto map: firewall-alice sa timing: remaining key lifetime (k/sec): (4607999/90) IV size: 8 bytes replay detection support: Y outbound ah sas:
6-64
78-10392-02
Chapter 6
Command Reference crypto map
crypto map
To create, modify, view or delete a crypto map entry. Also used to delete a crypto map set. (Configuration mode.) crypto map map-name client authentication aaa-server-name no crypto map map-name client authentication aaa-server-name crypto map map-name client configuration address initiate | respond no crypto map map-name client configuration address initiate | respond crypto map map-name interface interface-name no crypto map map-name interface interface-name show crypto map [interface interface-name | tag map-name]
crypto map map-name seq-num ipsec-isakmp | ipsec-manual [dynamic dynamic-map-name] no crypto map map-name seq-num
crypto map map-name seq-num match address acl_name no crypto map map-name seq-num match address acl_name
crypto map map-name seq-num set peer hostname | ip-address no crypto map map-name seq-num set peer hostname | ip-address
crypto map map-name seq-num set pfs [group1 | group2] no crypto map map-name seq-num set pfs
crypto map map-name seq-num set security-association lifetime seconds seconds | kilobytes kilobytes no crypto map map-name seq-num set security-association lifetime seconds seconds | kilobytes kilobytes
crypto map map-name set session-key inbound | outbound ah spi hex-key-string no crypto map map-name seq-num set session-key inbound | outbound ah
6-65
Chapter 6 crypto map
Command Reference
crypto map map-name set session-key inbound | outbound esp spi cipher hex-key-string [authenticator hex-key-string] no crypto map map-name seq-num set session-key inbound | outbound esp
crypto map map-name seq-num set transform-set transform-set-name1 [ transform-set-name6] no crypto map map-name seq-num set transform-set transform-set-name1 [ transform-set-name6]
Syntax Description
map map-name aaa-server-name
The name of the crypto map set. The name of the AAA server that will authenticate the user during IKE authentication. The two AAA server options available are TACACS+ and RADIUS. Indicates the PIX Firewall will attempt to set IP addresses for each peer. Indicates the PIX Firewall will accept requests for IP addresses from any requesting peer. Specify the identifying interface to be used by the PIX Firewall to identify itself to peers. If IKE is enabled, and you are using a Certification Authority (CA) to obtain certificates, this should be the interface with the address specified in the CA certificates.
initiate respond
interface interface-name
tag map-name seq-num ipsec-isakmp
(Optional) Shows the crypto map set with the specified map-name. The number you assign to the crypto map entry. Indicates that IKE will be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry. Indicates that IKE will not be used to establish the IPSec security associations for protecting the traffic specified by this crypto map entry. (Optional) Specifies that this crypto map entry is to reference a pre-existing dynamic crypto map. (Optional) Specifies the name of the dynamic crypto map set to be used as the policy template. Identifies the named encryption access list. This name should match the name argument of the named encryption access list being matched.
ipsec-manual
dynamic
dynamic-map-name
acl_name
6-66
78-10392-02
Chapter 6
match address set peer hostname
Specify an access list for a crypto map entry. Specify an IPSec peer in a crypto map entry. Specify a peer by its host name. This is the peers host name concatenated with its domain name. For example, myhost.example.com. Specify a peer by its IP address. Specify that IPSec should ask for perfect forward secrecy (PFS). With PFS, every time a new security association is negotiated, a new Diffie-Hellman exchange occurs. (This exchange requires additional processing time.)
ip-address set pfs
group1
Specifies that IPSec should use the 768-bit Diffie-Hellman prime modulus group when performing the new Diffie-Hellman exchange. Specifies that IPSec should use the 1024-bit Diffie-Hellman prime modulus group when performing the new Diffie-Hellman exchange. Specify the number of seconds a security association will live before it expires. The default is 28,800 seconds (eight hours). Specifies the volume of traffic (in kilobytes) that can pass between peers using a given security association before that security association expires. The default is 4,608,000 kilobytes. Manually specify the IPSec session keys within a crypto map entry. Sets the inbound IPSec session key. (You must set both inbound and outbound keys.)
group2
seconds seconds
kilobytes kilobytes
set session-key inbound
outbound
Sets the outbound IPSec session key. (You must set both inbound and outbound keys.)
ah
Sets the IPSec session key for the AH protocol. Specify ah when the crypto map entrys transform set includes an AH transform. AH protocol provides authentication via MD5-HMAC and SHA-HMAC.
spi
Specifies the security parameter index (SPI), a number that is used to uniquely identify a security association. The SPI is an arbitrary number you assign in the range of 256 to 4,294,967,295 (FFFF FFFF). You can assign the same SPI to both directions and both protocols. However, not all peers have the same flexibility in SPI assignment. For a given destination address/protocol combination, unique SPI values must be used. The destination address is that of the firewall if inbound, the peer if outbound.
6-67
Command Reference
hex-key-string
Specifies the session key; enter in hexadecimal format. This is an arbitrary hexadecimal string of 16, 32, or 40 digits. If the crypto map's transform set includes:

DES algorithm, specify at least 16 hexadecimal digits per key. MD5 algorithm, specify at least 32 hexadecimal digits per key. SHA algorithm, specify 40 hexadecimal digits per key.
Longer key sizes are simply hashed to the appropriate length. esp Sets the IPSec session key for the ESP protocol. Specify esp when the crypto map entrys transform set includes an ESP transform. ESP protocol provides both authentication and/or confidentiality. Authentication is done via MD5-HMAC, SHA-HMAC and NULL. Confidentiality is done via DES, 3DES, and NULL. cipher authenticator Indicates the key string to use with the ESP encryption transform. (Optional) Indicates that the key string is to be used with the ESP authentication transform. This argument is required only when the crypto map entrys transform set includes an ESP authentication transform. Specify which transform sets can be used with the crypto map entry. The name of the transform set. For an ipsec-manual crypto map entry, you can specify only one transform set. For an ipsec-isakmp or dynamic crypto map entry, you can specify up to six transform sets. transform1 transform2 transform3
Usage Guidelines
set transform-set transform-set-name
Specify up to three transforms. Transforms define the IPSec security protocol(s) and algorithm(s). Each transform represents an IPSec security protocol (ESP, AH, or both) plus the algorithm you want to use.
The sections that follow describe each crypto map command.
Note
See the section Crypto Map Entries in Chapter 4, Configuring IPSec, for more information about crypto maps.
crypto map client authentication
The crypto map client authentication command enables the extended authentication (Xauth) feature, which allows you to prompt for a TACAC+/RADIUS username and password during IKE authentication. You must first have your basic AAA Server set up to be able to use this feature. This command tells the PIX Firewall during phase 1 of IKE to use the Xauth (RADIUS/TACACS+) challenge to authenticate IKE. If the Xauth fails, the IPSec security association will not be established, and the IKE security association will be deleted. Use the no crypto map client authentication command to restore the default value. The extended Xauth feature is not enabled by default.
6-68
78-10392-02
Chapter 6
Note
Be sure to specify the same AAA server name within the crypto map client authentication command statement as was specified in the aaa-server command statement.
Note
The remote user must be running the Cisco Secure VPN Client, version 1.1.
Examples
The following example shows how the crypto map client authentication command is used. This example sets up the IPSec rules for VPN encryption IPSec. The ip, nat, aaa-server command statements establish the context for the IPSec-related commands.
ip address inside 10.0.0.1 255.255.255.0 ip address outside 168.20.1.5 255.255.255.0 ip local pool dealer 10.1.2.1-10.1.2.254 nat (inside) 0 access-list 80 aaa-server TACACS+ (inside) host 10.0.0.2 secret123 crypto ipsec transform-set pc esp-des esp-md5-hmac crypto dynamic-map cisco 4 set transform-set pc crypto map partner-map 20 ipsec-isakmp dynamic cisco crypto map partner-map client configuration address initiate crypto map partner-map client authentication TACACS+ crypto map partner-map interface outside isakmp key cisco1234 address 0.0.0.0 netmask 0.0.0.0 isakmp client configuration address-pool local dealer outside isakmp policy 8 authentication pre-share isakmp policy 8 encryption des isakmp policy 8 hash md5 isakmp policy 8 group 1 isakmp policy 8 lifetime 86400
crypto map client configuration address
Use the crypto map client configuration address command to configure IKE Mode Configuration on your PIX Firewall. The IKE Mode Configuration allows the PIX Firewall to download an IP address to the remote peer (client) as part of an IKE negotiation. With crypto map client configuration address command, you define the crypto map(s) that should attempt to configure the peer. Use the no crypto map client configuration address command to restore the default value. The IKE Mode Configuration is not enabled by default. The keyword initiate indicates the PIX Firewall will attempt to set IP addresses for each peer. The respond keyword indicates the PIX Firewall will accept requests for IP addresses from any requesting peer.
Note
If you use IKE Mode Configuration on the PIX Firewall, the routers handling the IPSec traffic must also support IKE Mode Configuration. Cisco IOS Release 12.0.6T and later, supports the IKE Mode Configuration. See the section About IKE Mode Config (Dynamic IP Address Assignment for VPN Client) in Chapter 4, Configuring IPSec, for more information about the IKE Mode Configuration.
6-69
Command Reference
Examples
The following examples configure IKE Mode Configuration on your PIX Firewall:
crypto map mymap client configuration address initiate crypto map mymap client configuration address respond
crypto map interface
The crypto map interface command applies a previously defined crypto map set to an interface. Use the no crypto map interface command to remove the crypto map set from the interface. Use the show crypto map [interface | tag] to view the crypto map configuration. Use this command to assign a crypto map set to any active PIX Firewall interface. The PIX Firewall supports IPSec termination on any and all active interfaces. You must assign a crypto map set to an interface before that interface can provide IPSec services. Only one crypto map set can be assigned to an interface. If multiple crypto map entries have the same map-name but a different seq-num, they are considered to be part of the same set and will all be applied to the interface. The crypto map entry with the lowest seq-num is considered the highest priority and will be evaluated first. A single crypto map set can contain a combination of ipsec-isakmp and ipsec-manual crypto map entries.
Note
The use of the crypto map interface command re-initializes the security association database causing any currently established security associations to be deleted.
Examples
The following example assigns crypto map set mymap to the outside interface. When traffic passes through the outside interface, the traffic will be evaluated against all the crypto map entries in the mymap set. When outbound traffic matches an access list in one of the mymap crypto map entries, a security association (if IPSec) will be established per that crypto map entrys configuration (if no security association or connection already exists).
crypto map
mymap interface outside
The following is sample output for the show crypto map command:
show crypto map Crypto Map: "firewall-alice" pif: outside local address: 172.21.114.123 Crypto Map "firewall-alice" 10 ipsec-isakmp Peer = 172.21.114.67 access-list 141 permit ip host 172.21.114.123 host 172.21.114.67 Current peer: 172.21.114.67 Security-association lifetime: 4608000 kilobytes/120 seconds PFS (Y/N): N Transform sets={ t1, }
The following configuration was in effect when the above show crypto map command was issued:
crypto crypto crypto crypto map map map map firewall-alice firewall-alice firewall-alice firewall-alice 10 10 10 10 ipsec-isakmp set peer 172.21.114.67 set transform-set t1 match address 141
6-70
78-10392-02
Chapter 6
The following is sample output for the show crypto map command when manually established security associations are used:
show crypto map Crypto Map "multi-peer" 20 ipsec-manual Peer = 172.21.114.67 access-list 120 permit ip host 1.1.1.1 host 1.1.1.2 Current peer: 172.21.114.67 Transform sets={ t2, } Inbound esp spi: 0, cipher key: , auth_key: , Inbound ah spi: 256, key: 010203040506070809010203040506070809010203040506070809, Outbound esp spi: 0 cipher key: , auth key: , Outbound ah spi: 256, key: 010203040506070809010203040506070809010203040506070809,
The following configuration was in effect when the above show crypto map command was issued:
crypto map multi-peer 20 ipsec-manual crypto map multi-peer 20 set peer 172.21.114.67 crypto map multi-peer 20 set session-key inbound ah 256 010203040506070809010203040506070809010203040506070809 crypto map multi-peer 20 set session-key outbound ah 256 010203040506070809010203040506070809010203040506070809 crypto map multi-peer 20 set transform-set t2 crypto map multi-peer 20 match address 120
crypto map ipsec-manual | ipsec-isakmp
To create or modify a crypto map entry, use the crypto map ipsec-manual | ipsec-isakmp command. To create or modify an ipsec-manual crypto map entry, use the ipsec-manual option of the command. To create or modify an ipsec-isakmp crypto map entry, use the ipsec-isakmp option of the command. Use the no crypto map command to delete a crypto map entry or set.
Note
The crypto map command without a keyword creates an ipsec-isakmp entry by default. After you define crypto map entries, you can use the crypto map interface command to assign the crypto map set to interfaces. Crypto maps provide two functions: filtering/classifying traffic to be protected, and defining the policy to be applied to that traffic. The first use affects the flow of traffic on an interface; the second affects the negotiation performed (via IKE) on behalf of that traffic. IPSec crypto maps link together definitions of the following:

What traffic should be protected Which IPSec peer(s) the protected traffic can be forwarded tothese are the peers with which a security association can be established Which transform sets are acceptable for use with the protected traffic How keys and security associations should be used/managed (or what the keys are, if IKE is not used)
6-71
Command Reference
A crypto map set is a collection of crypto map entries each with a different seq-num but the same map-name. Therefore, for a given interface, you could have certain traffic forwarded to one peer with specified security applied to that traffic, and other traffic forwarded to the same or a different peer with different IPSec security applied. To accomplish this you would create two crypto map entries, each with the same map-name, but each with a different seq-num. The number you assign to the seq-num argument should not be arbitrary. This number is used to rank multiple crypto map entries within a crypto map set. Within a crypto map set, a crypto map entry with a lower seq-num is evaluated before a map entry with a higher seq-num; that is, the map entry with the lower number has a higher priority.
Examples
The following example shows the minimum required crypto map configuration when IKE will be used to establish the security associations:
crypto crypto crypto crypto map map map map mymap mymap mymap mymap 10 ipsec-isakmp 10 match address 101 set transform-set my_t_set1 set peer 10.0.0.1
The following example shows the minimum required crypto map configuration when the security associations are manually established.
crypto crypto crypto crypto crypto crypto crypto crypto crypto transform-set someset ah-md5-hmac esp-des map mymap 10 ipsec-manual map mymap 10 match address 102 map mymap 10 set transform-set someset map mymap 10 set peer 10.0.0.5 map mymap 10 set session-key inbound ah 256 98765432109876549876543210987654 map mymap 10 set session-key outbound ah 256 fedcbafedcbafedcfedcbafedcbafedc map mymap 10 set session-key inbound esp 256 cipher 0123456789012345 map mymap 10 set session-key outbound esp 256 cipher abcdefabcdefabcd
crypto map ipsec-isakmp dynamic
To specify that a given crypto map entry is to reference a pre-existing dynamic crypto map, use the crypto map ipsec-isakmp dynamic command. Use the crypto dynamic-map command to create dynamic crypto map entries. After you create a dynamic crypto map set, use the crypto map ipsec-isakmp dynamic command to add the dynamic crypto map set to a static crypto map. Give crypto map entries which reference dynamic map sets the lowest priority map entries so that inbound security association negotiation requests will try to match the static maps first. Only after the request does not match any of the static maps do you want it to be evaluated against the dynamic map set. To make a crypto map entry that references a dynamic crypto map to be set to the lowest priority map entry, give the map entry the highest seq-num of all the map entries in a crypto map set. For more information about dynamic maps, see the section Dynamic Crypto Maps in Chapter 4, Configuring IPSec.
Examples
The following example configures an IPSec crypto map set that includes a reference to a dynamic crypto map set. Crypto map mymap 10 allows security associations to be established between the PIX Firewall and either (or both) of two remote IPSec peers for traffic matching access list 101. Crypto map mymap 20 allows either of two transform sets to be negotiated with the peer for traffic matching access list 102.
6-72
78-10392-02
Chapter 6
Crypto map entry mymap 30 references the dynamic crypto map set mydynamicmap, which can be used to process inbound security association negotiation requests that do not match mymap entries 10 or 20. In this case, if the peer specifies a transform set that matches one of the transform sets specified in mydynamicmap for a flow permitted by the access list 103, IPSec will accept the request and set up security associations with the peer without previously knowing about the peer. If accepted, the resulting security associations (and temporary crypto map entry) are established according to the settings specified by the peer. The access list associated with mydynamicmap 10 is also used as a filter. Inbound packets that match a permit statement in this list are dropped for not being IPSec protected. (The same is true for access lists associated with static crypto maps entries.) Outbound packets that match a permit statement without an existing corresponding IPSec security association are also dropped.
crypto crypto crypto crypto crypto crypto crypto crypto crypto crypto crypto crypto crypto map map map map map map map map map mymap mymap mymap mymap mymap mymap mymap mymap mymap 10 10 10 10 10 20 10 10 10 ipsec-isakmp match address 101 set transform-set my_t_set1 set peer 10.0.0.1 set peer 10.0.0.2 ipsec-isakmp match address 102 set transform-set my_t_set1 my_t_set2 set peer 10.0.0.3
dynamic-map mydynamicmap 10 dynamic-map mydynamicmap 10 match address 103 dynamic-map mydynamicmap 10 set transform-set my_t_set1 my_t_set2 my_t_set3 map mymap 30 ipsec-isakmp dynamic mydynamicmap
crypto map match address
To assign an access list to a crypto map entry, use the crypto map match address command. Use the no crypto map match address command to remove the access list from a crypto map entry. This command is required for all static crypto map entries. If you are defining a dynamic crypto map entry (with the crypto dynamic-map command), this command is not required but is strongly recommended. Use the access-list command to define this access list. The access list specified with this command will be used by IPSec to determine which traffic should be protected by IPSec crypto and which traffic does not need protection. (Traffic that is permitted by the access list will be protected. Traffic that is denied by the access list will not be protected in the context of the corresponding crypto map entry.)
Note
The crypto access list is not used to determine whether to permit or deny traffic through the interface. An access list applied directly to the interface with the access-group command makes that determination. The crypto access list specified by this command is used when evaluating both inbound and outbound traffic. Outbound traffic is evaluated against the crypto access lists specified by the interfaces crypto map entries to determine if it should be protected by crypto, and if so (if traffic matches a permit entry), which crypto policy applies. (If necessary, in the case of static IPSec crypto maps, new security associations are established using the data flow identity as specified in the permit entry; in the case of dynamic crypto map entries, if no security association exists, the packet is dropped.) Inbound traffic is evaluated against the crypto access lists specified by the entries of the interfaces crypto map set to determine if it should be protected by crypto and, if so, which crypto policy applies. (In the case of IPSec, unprotected traffic is discarded because it should have been protected by IPSec.)
6-73
Command Reference
The access list is also used to identify the flow for which the IPSec security associations are established. In the outbound case, the permit entry is used as the data flow identity (in general), while in the inbound case the data flow identity specified by the peer must be permitted by the crypto access list.
Examples
The following example shows the minimum required crypto map configuration when IKE will be used to establish the security associations. (This example is for a static crypto map.)
crypto crypto crypto crypto map map map map mymap mymap mymap mymap 10 10 10 10 ipsec-isakmp match address 101 set transform-set my_t_set1 set peer 10.0.0.1
crypto map set peer
Use the crypto map set peer command to specify an IPSec peer in a crypto map entry. Use the no crypto map set peer command to remove an IPSec peer from a crypto map entry. This command is required for all static crypto maps. If you are defining a dynamic crypto map (with the crypto dynamic-map command), this command is not required, and in most cases is not used because, in general, the peer is unknown. For ipsec-isakmp crypto map entries, you can specify multiple peers by repeating this command. The peer that packets are actually sent to is determined by the last peer that the PIX Firewall received either traffic or a negotiation request from for a given data flow. If the attempt fails with the first peer, IKE tries the next peer on the crypto map list. For ipsec-manual crypto entries, you can specify only one peer per crypto map. If you want to change the peer, you must first delete the old peer and then specify the new peer.
Examples
The following example shows a crypto map configuration when IKE will be used to establish the security associations. In this example, a security association could be set up to either the peer at 10.0.0.1 or the peer at 10.0.0.2.
crypto crypto crypto crypto map map map map mymap mymap mymap mymap 10 10 10 10 ipsec-isakmp match address 101 set transform-set my_t_set1 set peer 10.0.0.1 10.0.0.2
crypto map set pfs
The crypto map set pfs command sets IPSec to ask for perfect forward secrecy (PFS) when requesting new security associations for this crypto map entry, or that IPSec requires PFS when receiving requests for new security associations. To specify that IPSec should not request PFS, use the no crypto map set pfs command. This command is only available for ipsec-isakmp crypto map entries and dynamic crypto map entries. By default, PFS is not requested. With PFS, every time a new security association is negotiated, a new Diffie-Hellman exchange occurs, which requires additional processing time. PFS adds another level of security because if one key is ever cracked by an attacker, only the data sent with that key will be compromised. During negotiation, this command causes IPSec to request PFS when requesting new security associations for the crypto map entry. The default (group1) is sent if the set pfs statement does not specify a group.
6-74
78-10392-02
Chapter 6
If the peer initiates the negotiation and the local configuration specifies PFS, the peer must perform a PFS exchange or the negotiation will fail. If the local configuration does not specify a group, a default of group1 will be assumed, and an offer of either group1 or group2 will be accepted. If the local configuration specifies group2, that group must be part of the peers offer or the negotiation will fail. If the local configuration does not specify PFS, it will accept any offer of PFS from the peer. The 1024-bit Diffie-Hellman prime modulus group, group2, provides more security than group1, but requires more processing time than group1.
Note
IKE negotiations with a remote peer may hang when a PIX Firewall has numerous tunnels that originate from the PIX Firewall and terminate on a single remote peer. This problem occurs when PFS is not enabled, and the local peer requests many simultaneous rekey requests. If this problem occurs, the IKE security association will not recover until it has timed out or until you manually clear it with the clear [crypto] isakmp sa command. PIX Firewall units configured with many tunnels to many peers or many clients sharing the same tunnel are not affected by this problem. If your configuration is affected, enable PFS with the crypto map mapname seqnum set pfs command.
Examples
This example specifies that PFS should be used whenever a new security association is negotiated for the crypto map mymap 10:
crypto map mymap 10 ipsec-isakmp crypto map mymap 10 set pfs group2
crypto map set security-association lifetime
To override (for a particular crypto map entry) the global lifetime value, which is used when negotiating IPSec security associations, use the crypto map set security-association lifetime command. To reset a crypto map entry's lifetime value to the global value, use the no crypto map set security-association lifetime command. The crypto map's security associations are negotiated according to the global lifetimes. This command is only available for ipsec-isakmp crypto map entries and dynamic crypto map entries. IPSec security associations use shared secret keys. These keys and their security associations time out together. Assuming that the particular crypto map entry has lifetime values configured, when the PIX Firewall requests new security associations during security association negotiation, it will specify its crypto map lifetime value in the request to the peer; it will use this value as the lifetime of the new security associations. When the PIX Firewall receives a negotiation request from the peer, it will use the smaller of the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations. There are two lifetimes: a timed lifetime and a traffic-volume lifetime. The session keys/security association expires after the first of these lifetimes is reached. If you change a lifetime, the change will not be applied to existing security associations, but will be used in subsequent negotiations to establish security associations for data flows supported by this crypto map entry. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear [crypto] ipsec sa command. See the clear [crypto] ipsec sa command for more details. To change the timed lifetime, use the crypto map set security-association lifetime seconds command. The timed lifetime causes the keys and security association to time out after the specified number of seconds have passed.
6-75
Command Reference
To change the traffic-volume lifetime, use the crypto map set security-association lifetime kilobytes command. The traffic-volume lifetime causes the key and security association to time out after the specified amount of traffic (in kilobytes) has been protected by the security association's key. Shorter lifetimes can make it harder to mount a successful key recovery attack, because the attacker has less data encrypted under the same key to work with. However, shorter lifetimes require more CPU processing time. The lifetime values are ignored for manually established security associations (security associations installed via an ipsec-manual crypto map entry). To for more information about how these lifetimes, see How These Lifetimes Work in Chapter 4, Configuring IPSec.
Examples
This example shortens the timed lifetime for a particular crypto map entry, because there is a higher risk that the keys could be compromised for security associations belonging to the crypto map entry. The traffic-volume lifetime is not changed because there is not a high volume of traffic anticipated for these security associations. The timed lifetime is shortened to 2,700 seconds (45 minutes).
crypto map mymap 10 ipsec-isakmp set security-association lifetime seconds 2700
crypto map set session-key
To manually specify the IPSec session keys within a crypto map entry, use the crypto map set session-key command. Use the no crypto map set session-key command to remove IPSec session keys from a crypto map entry. This command is only available for ipsec-manual crypto map entries. If the crypto maps transform set includes:

an AH protocol, you must define IPSec keys for AH for both inbound and outbound traffic. an ESP encryption protocol, you must define IPSec keys for ESP encryption for both inbound and outbound traffic. an ESP authentication protocol, you must define IPSec keys for ESP authentication for inbound and outbound traffic.
When you define multiple IPSec session keys within a single crypto map, you can assign the same security parameter index (SPI) number to all the keys. The SPI is used to identify the security association used with the crypto map. However, not all peers have the same flexibility in SPI assignment. You may have to coordinate SPI assignment with the peers network administrator, making certain that the same SPI is not used more than once for the same destination address/protocol combination. Security associations established using this command do not expire (unlike security associations established using IKE). The PIX Firewall units session keys must match its peers session keys. If you change a session key, the security association using the key will be deleted and reinitialized.
6-76
78-10392-02
Chapter 6
Examples
The following example shows a crypto map entry for manually established security associations. The transform set t_set includes only an AH protocol.
crypto ipsec transform-set t_set ah-sha-hmac crypto map mymap 20 ipsec-manual crypto map mymap 20 match address 102 crypto map mymap 20 set transform-set t_set crypto map mymap 20 set peer 10.0.0.21 crypto map mymap 20 set session-key inbound ah 300 1111111111111111111111111111111111111111 crypto map mymap 20 set session-key outbound ah 300 2222222222222222222222222222222222222222
The following example shows a crypto map entry for manually established security associations. The transform set someset includes both an AH and an ESP protocol, so session keys are configured for both AH and ESP for both inbound and outbound traffic. The transform set includes both encryption and authentication ESP transforms, so session keys are created for both using the cipher and authenticator keywords.
crypto ipsec transform-set someset ah-sha-hmac esp-des esp-sha-hmac crypto map mymap 10 ipsec-manual crypto map mymap 10 match address 101 crypto map mymap 10 set transform-set someset crypto map mymap 10 set peer 10.0.0.1 crypto map mymap 10 set session-key inbound ah 300 9876543210987654321098765432109876543210 crypto map mymap 10 set session-key outbound ah 300 fedcbafedcbafedcbafedcbafedcbafedcbafedc crypto map mymap 10 set session-key inbound esp 300 cipher 0123456789012345 authenticator 0000111122223333444455556666777788889999 crypto map mymap 10 set session-key outbound esp 300 cipher abcdefabcdefabcd authenticator 9999888877776666555544443333222211110000
crypto map set transform-set
To specify which transform sets can be used with the crypto map entry, use the crypto map set transform-set command. Use the no crypto map set transform-set command to remove all transform sets from a crypto map entry. This command is required for all static and dynamic crypto map entries. For an ipsec-isakmp crypto map entry, you can list up to six transform sets with this command. List the higher priority transform sets first. If the local PIX Firewall initiates the negotiation, the transform sets are presented to the peer in the order specified in the crypto map command statement. If the peer initiates the negotiation, the local PIX Firewall accepts the first transform set that matches one of the transform sets specified in the crypto map entry. The first matching transform set that is found at both peers is used for the security association. If no match is found, IPSec will not establish a security association. The traffic will be dropped because there is no security association to protect the traffic. For an ipsec-manual crypto map command statement, you can specify only one transform set. If the transform set does not match the transform set at the remote peers crypto map, the two peers will fail to correctly communicate because the peers are using different rules to process the traffic. If you want to change the list of transform sets, respecify the new list of transform sets to replace the old list. This change is only applied to crypto map command statements that reference this transform set. The change will not be applied to existing security associations, but will be used in subsequent
6-77
Command Reference
negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear [crypto] ipsec sa command. Any transform sets included in a crypto map command statement must previously have been defined using the crypto ipsec transform-set command.
Examples
The following example defines two transform sets and specifies that they can both be used within a crypto map entry. (This example applies only when IKE is used to establish security associations. With crypto maps used for manually established security associations, only one transform set can be included in a given crypto map command statement.)
crypto crypto crypto crypto crypto crypto ipsec transform-set my_t_set1 esp-des esp-sha-hmac ipsec transform-set my_t_set2 ah-sha-hmac esp-des esp-sha-hmac map mymap 10 ipsec-isakmp map mymap 10 match address 101 map mymap 10 set transform-set my_t_set1 my_t_set2 map mymap set peer 10.0.0.1 10.0.0.2
In this example, when traffic matches access list 101 the security association can use either transform set my_t_set1 (first priority) or my_t_set2 (second priority) depending on which transform set matches the remote peer's transform sets.
6-78
78-10392-02
Chapter 6
Command Reference debug
debug
Debug packets or ICMP tracings through the PIX Firewall. (Configuration mode.) debug crypto ca [level] no debug crypto ca [level] debug crypto ipsec [level] no debug crypto ipsec [level] debug crypto isakmp [level] no debug crypto isakmp [level]
debug icmp trace no debug icmp trace
debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]] [[proto icmp] | [proto tcp [sport src_port] [dport dest_port]] | [proto udp [sport src_port] [dport dest_port]] [rx | tx | both] no debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]] [[proto icmp] | [proto tcp [sport src_port] [dport dest_port]] | [proto udp [sport src_port] [dport dest_port]] [rx | tx | both]
debug ppp [error | io | uauth] no debug ppp [error | io | uauth]
debug sqlnet no debug sqlnet
debug vpdn [event | error | packet] no debug vpdn [event | error | packet]
show debug
6-79
Chapter 6 debug
Command Reference
Syntax Description
crypto ca level
Display information about CA (Certification Authority) traffic. The level of debugging feedback. The higher the level number, the more information is displayed. The default level is 1. The levels correspond to these events:

Level 1: Interesting events Level 2: Normative and interesting events Level 3: Diminutive, normative, and interesting events
Refer to the Examples section at the end of this command page for an example of how the debugging level appears with the show debug command. crypto ipsec crypto isakmp icmp packet if_name Display information about IPSec traffic. Display information about IKE traffic. Display information about ICMP traffic. Display packet information. Interface name from which the packets are arriving; for example, to monitor packets coming into the PIX Firewall from the outside, set if_name to outside. Source IP address. Network mask. Destination IP address. Display ICMP packets only. Display TCP packets only. Source port. See the Ports section in Chapter 1, Introduction for a list of valid port literal names. Destination port. Display UDP packets only. Display only packets received at the PIX Firewall. Display only packets that were transmitted from the PIX Firewall. Display both received and transmitted packets. Debug SQL*Net traffic. Debug PPTP traffic, which is configured with the vpdn command.
src source_ip netmask mask dst dest_ip proto icmp proto tcp sport src_port
dport dest_port proto udp rx tx both sqlnet ppp
6-80
78-10392-02
Chapter 6
ppp error ppp io ppp uauth
Display PPTP PPP virtual interface error messages. Display the packet information for the PPTP PPP virtual interface. Display the PPTP PPP virtual interface AAA user authentication debugging messages. Display PPTP tunnel event change information. Display PPTP protocol error messages. Display PPTP packet information about PPTP traffic.
vpdn event vpdn error vpdn packet

Usage Guidelines
The debug command lets you view debug information. The show debug command displays the current state of tracing. You can debug the contents of network layer protocol packets with debug packet. The debug crypto ipsec, debug crypto isakmp, and debug crypto ca commands let you debug IPSec connections. Use the no form of the command to disable debugging. The debug icmp trace command shows ICMP packet information, the source IP address, and the destination address of packets arriving, departing, and traversing the PIX Firewall including pings to the PIX Firewall units own interfaces. The debug sqlnet command reports on traffic between Oracle SQL*Net clients and servers through the PIX Firewall. The debug ppp and debug vpdn commands provide information about PPTP traffic. PPTP is configured with the vpdn command. Use of the debug commands can slow down busy networks.
Trace Channel Feature
The debug icmp trace, debug sqlnet and debug crypto commands now send their output to the Trace Channel. The location of the Trace Channel depends on whether you have a simultaneous Telnet console session running at the same time as the console session, or if you are using only the PIX Firewall serial console:

If you are only using the PIX Firewall serial console, all debug commands display on the serial console. If you have both a serial console session and a Telnet console session accessing the console, then no matter where you enter the debug icmp trace or the debug sqlnet commands, the output displays on the Telnet console session. If you have two or more Telnet console sessions, the first session is the Trace Channel. If that session closes, the serial console session becomes the Trace Channel. The next Telnet console session that accesses the console will then become the Trace Channel. The debug packet command only displays on the serial console. However, you can enable or disable this command from either the serial console or a Telnet console sessions.
The debug commands are shared between all Telnet and serial console sessions.
6-81
Chapter 6 debug
Command Reference
Note
The downside of the Trace Channel feature is that if one administrator is using the serial console and another administrator starts a Telnet console session, the serial console debug icmp trace and debug sqlnet output will suddenly stop without warning. In addition, the administrator on the Telnet console session will suddenly be viewing debug output, which may be unexpected. If you are using the serial console and debug output is not appearing, use the who command to see if a Telnet console session is running.
Additional debug Command Information
Note
When creating your digital certificates, use the debug crypto ca command to ensure that the certificate is created correctly. Important error messages only display when the debug crypto ca command is enabled. For example, if you enter an Entrust fingerprint value incorrectly, the only warning message that indicates the value is incorrect appears in the debug crypto ca command output.
Note
Output from the debug crypto ipsec and debug crypto isakmp commands does not display in a Telnet console session.
Note
Use of the debug packet command on a PIX Firewall experiencing a heavy load may result in the output displaying so fast that it may be impossible to stop the output by entering the no debug packet command from the console. You can enter the no debug packet command from a Telnet session.
Note
To let users ping through the PIX Firewall, add the access-list acl_grp permit icmp any any command statement to the configuration and bind it to each interface you want to test with the access-group command. This lets pings go outbound and inbound. To stop a debug packet trace command, enter:
no debug packet if_name
Replace if_name with the name of the interface; for example, inside, outside, or a perimeter interface name. To stop a debug icmp trace command, enter:
no debug icmp trace
Examples
The following example turns on this command:

debug icmp trace
6-82
78-10392-02
Chapter 6
When you ping a host through the PIX Firewall from any interface, trace output displays on the console. The following example shows a successful ping from an external host (209.165.201.2) to the PIX Firewall units outside interface (209.165.201.1):
Inbound ICMP echo reply (len 32 Outbound ICMP echo request (len Inbound ICMP echo reply (len 32 Outbound ICMP echo request (len Inbound ICMP echo reply (len 32 Outbound ICMP echo request (len Inbound ICMP echo reply (len 32 NO DEBUG ICMP TRACE ICMP trace off id 32 id 32 id 32 id 1 seq 256) 209.165.201.1 > 209.165.201.2 id 1 seq 512) 209.165.201.2 > 209.165.201.1 1 seq 512) 209.165.201.1 > 209.165.201.2 id 1 seq 768) 209.165.201.2 > 209.165.201.1 1 seq 768) 209.165.201.1 > 209.165.201.2 id 1 seq 1024) 209.165.201.2 > 209.165.201.1 1 seq 1024) 209.165.201.1 > 209.165.201.2
This example shows that the ICMP packet length is 32 bytes, that the ICMP packet identifier is 1, and the ICMP sequence number. The ICMP sequence number starts at 0 and is incremented each time a request is sent. The following is sample output from the show debug command output:
show debug debug ppp error debug vpdn event debug crypto ipsec 1 debug crypto isakmp 1 debug crypto ca 1 debug icmp trace debug packet outside both debug sqlnet
The trailing 1 at the end of the debug crypto commands is the debugging level, which is described in the Syntax Description section at the start of this command page. You can debug the contents of packets with the debug packet command:
debug packet inside --------- PACKET ---------- IP -4.3.2.1 ==> 255.3.2.1 ver = 0x4 hlen = 0x5 tos = 0x0 tlen = 0x60 id = 0x3902 flags = 0x0 frag off=0x0 ttl = 0x20 proto=0x11 chksum = 0x5885 -- UDP -source port = 0x89 dest port = 0x89 len = 0x4c checksum = 0xa6a0 -- DATA -00000014: 00 01 .... 00000024: 00 00 00 01 20 45 49 45 50 45 47 45 47 45 .. EIEPEGEGEFF 00000034: 43 43 4e 46 41 45 44 43 41 43 41 43 41 43 NFAEDCACACACAC 00000044: 41 43 41 41 41 00 00 20 00 01 c0 0c 00 20 AAA.. ..... .. 00000054: 00 04 93 e0 00 06 60 00 01 02 03 04 00 ....`...... --------- END OF PACKET ---------
00 00 | 46 46 | .. 41 43 | CC 00 01 | AC | ..
This display lists the information as it appears in a packet. The following is sample output from the show debug command:
show debug debug icmp trace off debug packet off debug sqlnet off
6-83
Chapter 6 disable
Command Reference
disable
Exit privileged mode and return to unprivileged mode. (Privileged mode.) disable
Usage Guidelines
The disable command exits privileged mode and returns you to unprivileged mode. Use the enable command to return to privileged mode.
Examples
The following example shows how to exit privileged mode:

pixfirewall# disable pixfirewall>
6-84
78-10392-02
Chapter 6
Command Reference domain-name
domain-name
Change the IPSec domain name. (Configuration mode.) domain-name name
Syntax Description
name
A domain name.
Usage Guidelines
The domain-name command lets you change the IPSec domain name.
Note
The change of the domain name causes the change of the fully qualified domain name. Once the fully qualified domain name is changed, delete the RSA key pairs using the ca zeroize rsa command and delete related certificates using the no ca identity ca_nickname command.
6-85
Chapter 6 dynamic-map
Command Reference
dynamic-map
Create, view, or delete a dynamic crypto map entry. (Configuration mode.) clear dynamic-map show dynamic-map
Usage Guidelines
The clear dynamic-map command removes dynamic-map commands from the configuration. The show dynamic-map command lists the dynamic-map commands in the configuration.
Note
The dynamic-map command is the same as the crypto dynamic-map command. Refer to the crypto dynamic-map command page for more information and for other command options.
6-86
78-10392-02
Chapter 6
Command Reference enable
enable
Start privileged mode. (Unprivileged mode.) enable
Usage Guidelines
The enable command starts privileged mode. The PIX Firewall prompts you for your privileged mode password. By default, a password is not requiredpress the Enter key at the Password prompt to start privileged mode. Use disable to exit privileged mode. Use enable password to change the password.
Examples
The following example shows how to start privileged mode with the enable command and then configuration mode with the configure terminal command.
pixfirewall> enable Password: pixfirewall# configure terminal pixfirewall(config)#
6-87
Chapter 6 enable password
Command Reference
enable password
Set the privileged mode password. (Privileged mode.) enable password password [encrypted] show enable password
Syntax Description
password encrypted
A case-sensitive password of up to 16 alphanumeric characters. Specifies that the password you entered is already encrypted. The password must be 16 characters in length.
Usage Guidelines
The enable password command changes the privileged mode password, for which you are prompted after you enter the enable command. When the PIX Firewall starts and you enter privileged mode, the password prompt appears. There is not a default password (press the Enter key at the Password prompt). The show enable password command lists the encrypted form of the password. You can return the enable password to its original value (press the Enter key at prompt) by entering:
pixfirewall# enable password pixfirewall#
Note
If you change the password, write it down and store it in a manner consistent with your sites security policy. Once you change this password, you cannot view it again. Also, ensure that all who access the PIX Firewall console are given this password. Use the passwd command to set the password for PIX Firewall Manager and Telnet access to the PIX Firewall console. The default passwd value is cisco. See also: passwd.
Examples
The following examples show how to start privileged mode with the enable command, change the enable password with the enable password command, enter configuration mode with the configure terminal command, and display the contents of the current configuration with the write terminal command:
pixfirewall> enable Password: pixfirewall# enable password w0ttal1fe pixfirewall# configure terminal pixfirewall(config)# write terminal Building configuration... ... enable password 2oifudsaoid.9ff encrypted ...
6-88
78-10392-02
Chapter 6
Command Reference enable password
The following example shows the use of the encrypted option:

enable password 1234567890123456 encrypted show enable password enable password 1234567890123456 encrypted enable password 1234567890123456 show enable password enable password feCkwUGktTCAgIbD encrypted
6-89
Chapter 6 established
Command Reference
established
Permit return connections on ports other than those used for the originating connection based on an established connection. (Configuration mode.) established protocol src_port [dest_port] [permitto protocol dport[-dport]] [permitfrom protocol sport[-sport]] no established protocol src_port [dest_port] [permitto protocol dport[-dport]] [permitfrom protocol sport[-sport]] clear established show established
Syntax Description
src_port
The source port used for the established connection lookup. This is the originating traffic's source port and may be specified as 0 if the protocol does not specify which source port(s) will be used. Use wildcard ports (0) only when necessary. The destination port used for the established connection lookup. This is the originating traffic's destination port and may be specified as 0 if the protocol does not specify which destination port(s) will be used. Use wildcard ports (0) only when necessary. Used to specify the return traffic's protocol and to which destination port(s) the traffic will be permitted. Used to specify the return traffic's protocol and from which source port(s) the traffic will be permitted. The source port(s) from which the return traffic is permitted. The destination port(s) to which the return traffic is permitted.
dest_port
permitto
permitfrom
sport dport
Usage Guidelines
The established command allows outbound connections return access through the PIX Firewall. This command works with two connections, an original connection outbound from a network protected by the PIX Firewall and a return connection inbound between the same two devices on an external host. The first protocol, destination port and optional source port specified is for the initial outbound connection. The permitto and permitfrom options refine the return inbound connection.
Note
Cisco recommends that you always specify the established command with the permitto and permitfrom options. Without these options, the use of the established command opens a security hole that can be exploited for attack of your internal systems. See the Security Problem section that follows for more information. The permitto option lets you specify a new protocol or port for the return connection at the PIX Firewall. The permitfrom option lets you specify a new protocol or port at the remote server.
6-90
78-10392-02
Chapter 6
Command Reference established
The no established command disables the established feature. The show established command shows the established commands in the configuration. The clear established command removes all establish command statements from your configuration.
Note
For the established command to work properly, the client must listen on the port specified with the permitto option. You can use the established command with the nat 0 command statement (where there are no global command statements).
Note
The established command cannot be used with PAT (Port Address Translation). The established command works as shown in the following format:
established A B permitto C D permitfrom E F
This command works as though it were written If there exists a connection between two hosts using protocol A on ports B and C, permitting return connections through the PIX Firewall via protocol D, if the destination port(s) correspond to E (protocols D and F must match, but can be different than A), and the source port(s) correspond to G. For example:
established tcp 6060 0 permitto tcp 6061 permitfrom tcp 6059
In this case, if a connection is started by an internal host to an external host using TCP source port 6060 and any destination port, the PIX Firewall permits return traffic between the hosts via TCP destination port 6061 and TCP source port 6059. For example:
established udp 0 6060 permitto tcp 6061 permitfrom tcp 1024-65535
In this case, if a connection is started by an internal host to an external host using UDP destination port 6060 and any source port, the PIX Firewall permits return traffic between the hosts via TCP destination port 6061 and TCP source port 1024-65535.
Security Problem
The established command has been enhanced to optionally specify the destination port used for connection lookups. Only the source port could be specified previously with the destination port being 0 (a wildcard). This addition allows more control over the command and provides support for protocols where the destination port is known, but the source port is not. The established command can potentially open a large security hole in the PIX Firewall if not used with discretion. Whenever you use this command, if possible, also use the permitto and permitfrom options to indicate ports to which and from which access is permitted. Without these options, external systems to which connections are made could make unrestricted connections to the internal host involved in the connection. The following are examples of potentially serious security violations that could be allowed when using the established command. Example:
established tcp 0 4000
With this example, if an internal system makes a TCP connection to an external host on port 4000, then the external host could come back in on any port using any protocol.
6-91
Chapter 6 established
Command Reference
Example:
established tcp 0 0 (same as previous releases established tcp 0)
With this example, if something like the following exists:

static (inside,outside) 200.0.0.2 10.0.0.2 access-list acl_grp permit tcp host 200.0.0.2 eq www any
an attacker only need make a web connection to 200.0.0.2 and then they can make unrestricted connections using any protocol or ports.
Examples
The following example occurs when a local host 10.1.1.1 starts a TCP connection on port 9999 to a foreign host 209.165.201.1. The example allows packets from the foreign host 209.165.201.1 on port 4242 back to local host 10.1.1.1 on port 5454:
established tcp 9999 permitto tcp 5454 permitfrom tcp 4242
The next example allows packets from foreign host 209.165.201.1 on any port back to local host 10.1.1.1 on port 5454:
established tcp 9999 permitto tcp 5454
XDMCP Support
PIX Firewall now provides support for XDMCP (X Display Manager Control Protocol) with assistance from the established command.
Note
XDMCP is on by default, but will not complete the session unless the established command is used. Example:
established tcp 0 6000 to tcp 6000 from tcp 1024-65535
Will allow internal XDMCP equipped (UNIX or ReflectionX) hosts to access external XDMCP equipped XWindows servers. UDP/177 based XDMCP negotiates a TCP based XWindows session and subsequent TCP back connections will be permitted. Because the source port(s) of the return traffic is unknown, the src_port field should be specified as 0 (wildcard). The destination port, dest_port, will typically be 6000; the well-known XServer port. The dest_port should be 6000 + n; where n represents the local display number. Use the following UNIX command to change this value:
setenv DISPLAY hostname:displaynumber.screennumber
The established command is needed because many TCP connections are generated (based on user interaction) and the source port for these connection is unknown. Only the destination port will be static. The PIX Firewall does XDMCP fixups transparently. No configuration is required, but the established command is necessary to accommodate the TCP session. Be advised that using applications like this through the PIX Firewall may open up security holes. The XWindows system has been exploited in the past and newly introduced exploits are likely to be discovered.
6-92
78-10392-02
Chapter 6
Command Reference exit
exit
Exit an access mode. (All modes.) exit
Usage Guidelines
Use the exit command to exit from an access mode. This command is the same as quit.
Examples
The following example shows how to exit configuration mode and then privileged mode:
pixfirewall(config)# exit pixfirewall# exit pixfirewall>
6-93
Chapter 6 failover
Command Reference
failover
Change or view access to the optional failover feature. (Configuration mode.) failover [active] failover ip address if_name ip_address failover link [stateful_if_name] failover reset no failover active show failover
Syntax Description
active
Make a PIX Firewall the Active unit. Use this command when you need to force control of the connection back to the unit you are accessing, such as when you want to switch control back from a unit after you have fixed a problem and want to restore service to the Primary unit. Either enter no failover active on the secondary unit to switch service to the primary or failover active on the Primary unit. Interface on which the Standby unit resides. The IP address used by the Standby unit to communicate with the Active unit. Use this IP address with the ping command to check the status of the Standby unit. This address must be on the same network as the system IP address. For example, if the system IP address is 192.159.1.3, set the failover IP address to 192.159.1.4. Specify the interface where a fast LAN link is available for Stateful Failover. In addition to the failover cable, a dedicated fast LAN link is required to support Stateful Failover. Do not use FDDI because of its blocksize or Token Ring because Token Ring requires additional time to insert into the ring. The default interface is the highest LAN port with failover configured. Force both units back to an unfailed state. Use this command once the fault has been corrected. The failover reset command can be entered from either unit, but it is best to always enter commands at the Active unit. Entering the failover reset command at the Active unit will unfail the Standby unit.
if_name ip_address
link stateful_if_name
reset
Usage Guidelines
Use the failover command without an argument after you connect the optional failover cable between your primary firewall and a secondary firewall. The default configuration has failover enabled. Enter no failover in the configuration file for the PIX Firewall if you will not be using the failover feature. Use the show failover command to verify the status of the connection and to determine which unit is active.
6-94
78-10392-02
Chapter 6
Command Reference failover
Note
For Failover, PIX Firewall requires any unused interfaces be given IP addresses and connected to the Standby unit for use in receiving Failover checkup messages. Use the failover active command to initiate a failover switch from the Standby unit, or the no failover active command from the Active unit to initiate a failover switch. You can use this feature to return a failed unit to service, or to force an Active unit offline for maintenance. Because the Standby unit does not keep state information on each connection, all active connections will be dropped and must be re-established by the clients. Use the failover link command to enable Stateful Failover. Version 5.1 supports Token Ring interfaces with a high speed Ethernet Stateful Failover interface connection. Version 5.1 also supports FDDI interfaces with non-Stateful Failover. If a failover IP address has not been entered, show failover will display 0.0.0.0 for the IP address, and monitoring of the interfaces will remain in waiting state. A failover IP address must be set for failover to work. New in version 5.1, when a failover cable connects two PIX Firewall units, the no failover command now disables failover until you enter the failover command to explicitly enable failover. Previously, when the failover cable connected two PIX Firewall units and you entered the no failover command, failover would automatically re-enable after 15 seconds. If you reboot the PIX Firewall without entering the write memory command and the failover cable in connected, failover mode automatically enables. You can also view the information from the show failover command using SNMP. Refer to Using the Firewall and Memory Pool MIBs in Chapter 3, Advanced Configurations, for more information. A failover configuration example is provided in Failover Configuration in Chapter 5, Configuration Examples.
Configuring Failover
Follow these steps to configure failover:

Step 1
If you have a PIX 515, obtain a PIX-515-UR feature license key that lets you add the failover option. Then purchase the failover option, which includes the Secondary unit. If you have a PIX 520 or older model, purchase a second unit with the same connection license as the Primary unit. Install the Secondary unit as described in the Installation Guide for the Cisco Secure PIX Firewall Version 5.1 available in your accessory kit. If you are using Stateful Failover, install 100 Mbps full-duplex LAN interfaces in both units for passing check-up messages. Connect the failover cable as described in the Installation Guide for the Cisco Secure PIX Firewall Version 5.1. You can view this document online at the following site: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v51/install/failover.htm Only configure the Primary unit. When you enter the write memory command to save the configuration to Flash memory, the Primary unit updates the Secondary unit. Configure an IP address for each interface of the Active unit using the ip address command. From the Active unit, configure a failover IP address for each interface of the Standby unit using the failover ip address command.
Step 2
Step 3
Step 4 Step 5
See Failover in Chapter 3, Advanced Configurations, for additional configuration information.
6-95
Chapter 6 failover
Command Reference
Examples
The following output shows that failover is enabled, and that the Primary unit state is active:
show failover Failover On Cable status: Normal Reconnect time-out 0:00:00 This host: Primary - Active Active time: 3456 (sec) Interface 4th (172.16.1.112): Normal Interface intf3 (192.168.3.2): Normal Interface intf2 (192.168.2.2): Normal Interface outside (192.168.1.8): Normal Interface inside (10.1.1.6): Normal Other host: Secondary - Standby Active time: 0 (sec) Interface 4th (172.16.1.111): Normal Interface intf3 (192.168.3.1): Normal Interface intf2 (192.168.2.1): Normal Interface outside (192.168.1.7): Normal Interface inside (10.1.1.2): Normal Standby Logical Update Statistics Link : intf2 Stateful Obj xmit xerr General 53 0 sys cmd 53 0 up time 0 0 xlate 0 0 tcp conn 0 0 udp conn 0 0 ARP tbl 0 0 RIF Tbl 0 0
rcv 0 0 0 0 0 0 0 0
rerr 0 0 0 0 0 0 0 0
The Cable status has these values:

NormalIndicates that the Active unit is working and that the Standby unit is ready. WaitingIndicates that monitoring of the other units network interfaces has not yet started. FailedIndicates that the PIX Firewall has failed.
You can view the IP addresses of the Standby unit with the show ip address command:
show ip address System IP Addresses: ip address outside 209.165.201.2 255.255.255.224 ip address inside 192.168.2.1 255.255.255.0 ip address perimeter 192.168.70.3 255.255.255.0 Current IP Addresses: ip address outside 209.165.201.2 255.255.255.224 ip address inside 192.168.2.1 255.255.255.0 ip address perimeter 192.168.70.3 255.255.255.0
The Current IP Addresses are the same as the System IP Addresses on the failover Active unit. When the Primary unit fails, the Current IP Addresses become those of the Standby unit. The Standby Logical Update Statistics output that displays when you use the show failover command only describes Stateful Failover. The xerrs value does not indicate an error in failover and can be ignored.
6-96
78-10392-02
Chapter 6
Command Reference filter
filter
Enable or disable outbound URL or HTML object filtering. (Configuration mode.) filter activex port local_ip mask foreign_ip mask no filter activex port local_ip mask foreign_ip mask
filter java port[-port] local_ip mask foreign_ip mask no filter java port[-port] local_ip mask foreign_ip mask
filter url http|except local_ip local_mask foreign_ip foreign_mask [allow] no filter url http | except [local_ip local_mask foreign_ip foreign_mask] clear filter show filter
Syntax Description
activex
Block outbound ActiveX, Java applets, and other HTML <object> tags from outbound packets. Block Java applets returning to the PIX Firewall as a result of an outbound connection. Filter URLs (Universal Resource Locators) from data moving through the PIX Firewall. filter url only: Filter HTTP (World Wide Web) URLs. filter url only: Create an exception to a previous filter condition. filter activex only: The port at which Web traffic is received on the PIX Firewall. filter java only: One or more ports on which Java applets may be received. The IP address of the highest security level interface from which access is sought. You can set this address to 0.0.0.0 (or in shortened form, 0) to specify all hosts. Network mask of local_ip. You can use 0.0.0.0 (or in shortened form, 0) to specify all hosts. The IP address of the lowest security level interface to which access is sought. You can use 0.0.0.0 (or in shortened form, 0) to specify all hosts.
java
url
http except port port[-port] local_ip
local_mask
foreign_ip
6-97
Chapter 6 filter
Command Reference
foreign_mask
Network mask of foreign_ip. Always specify a specific mask value. You can use 0.0.0.0 (or in shortened form, 0) to specify all hosts. filter url only: When the server is unavailable, let outbound connections pass through PIX Firewall without filtering. If you omit this option, and if the Websense server goes offline, PIX Firewall stops outbound port 80 (Web) traffic until the Websense server is back online.
allow
Usage Guidelines
The sections that follow describe each type of filter. The clear filter command removes all filter commands from the configuration. The show filter command lists all filter commands in the configuration.
filter activex
The filter activex command filters out ActiveX, Java applets, and other HTML <object> usages from outbound packets. ActiveX controls, formerly known as OLE or OCX controls, are components you can insert in a web page or other application. These controls include custom forms, calendars, or any of the extensive third-party forms for gathering or displaying information. As a technology, it creates many potential problems for the network clients including causing workstations to fail, introducing network security problems, or be used to attack servers. This feature blocks the HTML <object> tag and comments it out within the HTML web page.
Note
The <object> tag is also used for Java applets, image files, and multimedia objects, which will also be blocked by the filter activex command. If the <object> or </object> HTML tags split across network packets or if the code in the tags is longer than the number of bytes in the MTU, PIX Firewall cannot block the tag.
Note
ActiveX blocking does not occur when users access an IP address referenced by the alias command.
Examples
To specify that all outbound connections have ActiveX blocking, use the following command:
filter activex 80 0 0 0 0
This command specifies that the ActiveX blocking applies to Web traffic on port 80 from any local host and for connections to any foreign host.
filter java
The filter java command filters out Java applets that return to the PIX Firewall from an outbound connection. The user still receives the HTML page, but the web page source for the applet is commented out so that the applet cannot execute. Use 0 for the local_ip or foreign_ip IP addresses to mean all hosts.
Note
If Java applets are known to be in <object> tags, use the filter activex command to remove them.
6-98
78-10392-02
Chapter 6
Command Reference filter
Examples
To specify that all outbound connections have Java applet blocking, use the following command:
filter java 80 0 0 0 0
This command specifies that the Java applet blocking applies to Web traffic on port 80 from any local host and for connections to any foreign host.
filter url
The filter url command lets you prevent outbound users from accessing World Wide Web URLs that you designate using the Websense filtering application. The allow option to the filter command determines how the PIX Firewall behaves in the event that the Websense server goes offline. If you use the allow option with the filter command and the Websense server goes offline, port 80 traffic passes through the PIX Firewall without filtering. Used without the allow option and with the server offline, PIX Firewall stops outbound port 80 (Web) traffic until the server is back online, or if another URL server is available, passes control to the next URL server.
Note
With the allow option set, PIX Firewall now passes control to an alternate server if the Websense server goes offline. Follow these steps to filter URLs:
Step 1 Step 2 Step 3
Designate a Websense server with the url-server command. Enable filtering with the filter command. If needed, improve throughput with the url-cache command. However, this command does not update Websense logs, which may affect Websense accounting reports. Accumulate Websense run logs before using the url-cache command. Use the show url-cache stats and the show perfmon commands to view run information.
Step 4
Information on Websense is available at the following site: http://www.websense.com/products/websense/

Examples
The following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
url-server (perimeter) host 10.0.1.1 filter url http 0 0 0 0 filter url except 10.0.2.54 255.255.255.255 0 0
6-99
Chapter 6 fixup protocol
Command Reference
fixup protocol
Change, enable, disable, or list a PIX Firewall application protocol feature. (Configuration mode.) fixup protocol ftp [strict] [port] fixup protocol http [port[-port] fixup protocol h323 [port[-port]] fixup protocol rsh [514] fixup protocol rtsp [port] fixup protocol smtp [port[-port]] fixup protocol sqlnet [port[-port]] no fixup protocol protocol [port[-port]] clear fixup show fixup [protocol protocol]
Syntax Description
protocol port
Specify the protocol to fix up: ftp, http, h323, rsh, rtsp, smtp, sqlnet. Specify the port number or range for the application protocol. The default ports are: TCP 21 for ftp, TCP 80 for http, TCP 1720 for h323, TCP 514 for rsh, TCP 554 for rtsp, TCP 25 for smtp, and TCP 1521 for sqlnet. The default port value for rsh cannot be changed, but additional port statements can be added. See the Ports section in Chapter 1, Introduction for a list of valid port literal names. Prevent web browsers from sending embedded commands in FTP requests. Each FTP command must be acknowledged before a new command is allowed. Connections sending embedded commands are dropped.
strict
Usage Guidelines
The fixup protocol commands let you view, change, enable, or disable the use of a service or protocol through the PIX Firewall. The ports you specify are those that the PIX Firewall listens at for each respective service. You can change the port value for each service except rsh. The fixup protocol commands are always present in the configuration and are enabled by default. The fixup protocol command performs the Adaptive Security Algorithm based on different port numbers other than the defaults. This command is global and changes things for both inbound and outbound connections, and cannot be restricted to any static command statements. The FTP port can be changed; however if you change the default of port 21, to something like 2021, all FTP control connections must happen on port 2021. FTP control connections on port 21 will no longer work. If you disable FTP fixups with the no fixup protocol ftp command, outbound users can start connections only in passive mode, and all inbound FTP is disabled.
6-100
78-10392-02
Chapter 6
Command Reference fixup protocol
The fixup protocol ftp strict command prevents web browsers from sending embedded commands in FTP requests. Each FTP command must be acknowledged before a new command is allowed. Connections sending embedded commands are dropped.
Note
PIX Firewall uses port 1521 for SQL*Net. This is the default port used by Oracle for SQL*Net; however, this value does not agree with IANA port assignments.
Note
If there is a no fixup protocol http command statement in the configuration, the filter url command does not work. You can add multiple port settings for each protocol with separate commands; for example:
fixup protocol ftp 21 fixup protocol ftp 4254 fixup protocol ftp 9090
These commands cause PIX Firewall to listen to the standard FTP port of 21 but also to listen for FTP traffic at ports 4254 and 9090. The clear fixup command removes fixup commands from the configuration that you added. It does not remove the default fixup protocol commands. The show fixup command lists all values or the show fixup protocol protocol command lists an individual protocol. You can disable the fixup of a protocol by removing all fixups of the protocol from the configuration using the no fixup command. After you remove all fixups for a protocol, the no fixup form of the command or the default port is stored in the configuration. The fixup rtsp command lets PIX Firewall pass RTSP (Real Time Streaming Protocol) packets. RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. PIX Firewall does not support multicast RTSP. If you are using Cisco IP/TV, use RTSP TCP port 554 and TCP 8554:
fixup protocol rtsp 554 fixup protocol rtsp 8554
The following restrictions apply to the fixup protocol rtsp command:

1. 2. 3. 4. 5.
This PIX Firewall will not fix RTSP messages passing through UDP ports. PIX Firewall does not support the RealNetwork's multicast mode (x-real-rdt/mcast). PAT is not supported with the fixup protocol rtsp command. PIX Firewall does not have the ability to recognize HTTP cloaking where RTSP messages are hidden in the HTTP messages. PIX Firewall cannot perform NAT on RTSP messages because the embedded IP addresses are contained in the SDP files as part of HTTP or RTSP messages. Packets could be fragmented and PIX Firewall cannot perform NAT on fragmented packets. With Cisco IP/TV, the number of NATs the PIX Firewall performs on the SDP part of the message is proportional to the number of program listings in the Content Manager (each program listing can have at least six embedded IP addresses). You can configure NAT for Apple QuickTime 4 or RealPlayer; however, Cisco IP/TV will not work if both the Content Manager and the Server are inside relative to the PIX Firewall.
6.
7.
6-101
Chapter 6 fixup protocol
Command Reference
8.
When using RealPlayer, it is important to properly configure transport mode. For the PIX Firewall, add an access-list command statement from the server to the client or vice versa. For RealPlayer, change transport mode by clicking Options>Preferences>Transport>RTSP Settings. If using TCP mode on the RealPlayer, select the check boxes for Use TCP to Connect to Server and Attempt to use TCP for all content. On the PIX Firewall, there is no need to configure the fixup. If using UDP mode on the RealPlayer, select the check boxes for Use TCP to Connect to Server and Attempt to use UDP for static content, and for live content not available via Multicast. On the PIX Firewall, add a fixup protocol rtsp port command statement
Other fixup protocol commands
The fixup protocol smtp command enables the Mail Guard feature, which only lets mail servers receive the RFC 821, section 4.5.1 commands of HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT. All other commands are rejected with the 500 command unrecognized reply code. The fixup protocol h323 command provides support for Intel InternetPhone, CU-SeeMe, CU-SeeMe Pro, MeetingPoint, and MS NetMeeting. The following lists the default fixup protocol values (those enabled when a PIX Firewall is first installed). You can view the fixup protocol settings with the show fixup command as follows:
show fixup fixup protocol fixup protocol fixup protocol fixup protocol fixup protocol fixup protocol ftp 21 http 80 smtp 25 h323 1720 rsh 514 sqlnet 1521
Examples
The following example enables access to an inside server running Mail Guard:
static (inside,outside) 209.165.201.1 192.168.42.1 netmask 255.255.255.255 access-list acl_out permit tcp host 209.165.201.1 eq smtp any access-group acl_out in interface outside fixup protocol smtp 25
The following example shows the commands to disable Mail Guard:

static (dmz1,outside) 209.165.201.1 10.1.1.1 netmask 255.255.255.255 access-list acl_out permit tcp host 209.165.201.1 eq smtp any access-group acl_out in interface outside no fixup protocol smtp 25
In this example, the static command sets up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. (The MX record for DNS needs to point to the 209.165.201.1 address so that mail is sent to this address.) The access-list command lets any outside users access the global address through the SMTP port (25). The no fixup protocol command disables the Mail Guard feature.
6-102
78-10392-02
Chapter 6
Command Reference flashfs
flashfs
Clear Flash memory or display Flash memory sector sizes. (Configuration mode.) clear flashfs show flashfs
Usage Guidelines
Note
Only use the clear flashfs command before downgrading the PIX Firewall software to an older version. The clear flashfs command clears Flash memory. The show flashfs command displays the size in bytes of each Flash memory sector. The data in each sector is as follows:

file 0PIX Firewall binary image, where the .bin file is stored. file 1PIX Firewall configuration data that you can view with the show config command. file 2PIX Firewall datafile that stores IPSec key and certificate information file 3flashfs information for the show flashfs command.
Examples
Use the following command to clear Flash memory:

clear flashfs
The following commands display the Flash memory sector sizes:

show flashfs flash file system: file 0: origin: file 1: origin: file 2: origin: file 3: origin: clear flashfs show flashfs flash file system: file 0: origin: file 1: origin: file 2: origin: file 3: origin: version:1 magic:0x12345679 0 length:1794104 2095104 length:1496 0 length:0 2096640 length:140
version:0 magic:0x0 0 length:0 0 length:0 0 length:0 0 length:0
The origin values are integer multiples of the underlying Flash memory sector size.
6-103
Chapter 6 floodguard
Command Reference
floodguard
Enable or disable Flood Defender to protect against flood attacks. (Configuration mode.) floodguard enable | disable show floodguard
Syntax Description
enable disable
Enable Flood Defender. Disable Flood Defender.
Usage Guidelines
The floodguard command lets you reclaim PIX Firewall resources if the user authentication (uauth) subsystem runs out of resources. If an inbound or outbound uauth connection is being attacked or overused, the PIX Firewall will actively reclaim TCP user resources. When the resources deplete, the PIX Firewall lists messages about it being out of resources or out of tcpusers. If the PIX Firewall uauth subsystem is depleted, TCP user resources in different states are reclaimed depending on urgency in the following order:
1. 2. 3. 4.
Timewait FinWait Embryonic Idle
The floodguard command is enabled by default.

Examples
The following example enables the floodguard command and lists the floodguard command statement in the configuration:
floodguard enable show floodguard floodguard enable
6-104
78-10392-02
Chapter 6
Command Reference global
global
Create or delete entries from a pool of global addresses. (Configuration mode.) global [(if_name)] nat_id global_ip[-global_ip] [netmask global_mask] no global [(if_name)] nat_id [global_ip[-global_ip] [netmask global_mask]] show global
Syntax Description
if_name nat_id
The external network where you use these global addresses. A positive number shared with the nat command that groups the nat and global command statements together. The valid ID numbers can be any positive number up to 2,147,483,647. One or more global IP addresses that the PIX Firewall shares among its connections. If the external network is connected to the Internet, each global IP address must be registered with the Network Information Center (NIC). You can specify a range of IP addresses by separating the addresses with a dash (-). You can create a Port Address Translation (PAT) global command statement by specifying a single IP address. You can have one PAT global command statement per interface. A PAT can support up to 65,535 xlate objects.
global_ip
netmask
Reserved word that prefaces the network global_mask variable.
global_mask The network mask for global_ip. If subnetting is in effect, use the subnet mask; for example, 255.255.255.128. If you specify an address range that overlaps subnets, global will not use the broadcast or network addresses in the pool of global addresses. For example, if you use 255.255.255.224 and an address range of 209.165.201.1-209.165.201.30, the 209.165.201.31 broadcast address and the 209.165.201.0 network address will not be included in the pool of global addresses.
Usage Guidelines
The global command defines a pool of global addresses. The global addresses in the pool provide an IP address for each outbound connection, and for those inbound connections resulting from outbound connections. Ensure that associated nat and global command statements have the same nat_id. After changing or removing a global command statement, use the clear xlate command. Use the no global command to remove access to a nat_id, or to a Port Address Translation (PAT) address, or address range within a nat_id. Use the show global command to view the global command statements in the configuration.
6-105
Chapter 6 global
Command Reference
Usage Notes
1.
You can enable the PAT (Port Address Translation) feature by entering a single IP address with the global command. You can have one PAT per interface. PAT lets multiple outbound sessions appear to originate from a single IP address. With PAT enabled, the firewall chooses a unique port number from the PAT IP address for each outbound xlate (translation slot). This feature is valuable when an Internet service provider cannot allocate enough unique IP addresses for your outbound connections. An IP address you specify for a PAT cannot be used in another global address pool. When a PAT augments a pool of global addresses, first the addresses from the global pool are used, then the next connection is taken from the PAT address. If a global pool address frees, the next connection takes that address. The global pool addresses always come first, before a PAT address is used. Augment a pool of global addresses with a PAT by using the same nat_id in the global command statements that create the global pools and the PAT. For example:
global (outside) 1 209.165.201.1-209.165.201.10 netmask 255.255.255.224 global (outside) 1 209.165.201.22 netmask 255.255.255.224
2.
3.
PAT does not work with H.323 applications and caching nameservers. Do not use a PAT when multimedia applications need to be run through the firewall. Multimedia applications can conflict with port mappings provided by PAT. PAT does not work with the established command. PAT works with DNS, FTP and passive FTP, HTTP, email, RPC, rshell, Telnet, URL filtering, and outbound traceroute. However for use with passive FTP, use the fixup protocol ftp strict command statement with an access-list command statement to permit outbound FTP traffic, as shown in the following example:
fixup protocol ftp strict ftp access-list acl_in permit tcp any any eq ftp access-group acl_in in interface inside nat (inside) 1 0 0 global (outside) 1 209.165.201.5 netmask 255.255.255.224
4. 5.
6.
IP addresses in the pool of global addresses specified with the global command require reverse DNS entries to ensure that all external network addresses are accessible through the PIX Firewall. To create reverse DNS mappings, use a DNS PTR record in the address-to-name mapping file for each global address. For more information on DNS, refer to DNS and BIND, by Paul Albitz and Cricket Liu, OReilly & Associates, Inc., ISBN 1-56592-010-4. Without the PTR entries, sites can experience slow or intermittent Internet connectivity and FTP requests that consistently fail. For example, if a global IP address is 209.165.201.1 and the domain for the PIX Firewall is pix.cisco.com, the PTR record would be:
1.201.165.209.in-addr.arpa. IN PTR pix.cisco.com.
7.
A DNS server on a higher level security interface needing to get updates from a root name server on the outside interface cannot use PAT (Port Address Translation). Instead, a static command statement must be added to map the DNS server to a global address on the outside interface. For example, PAT is enabled with these commands:
nat (inside) 1 192.168.1.0 255.255.255.0 global (inside) 1 209.165.202.128 netmask 255.255.255.224
However, a DNS server on the inside at IP address 192.168.1.5 cannot correctly reach the root name server on the outside at IP address 209.165.202.130.
6-106
78-10392-02
Chapter 6
Command Reference global
To ensure that the inside DNS server can access the root name server, insert the following static command statement:
static (inside,outside) 209.165.202.129 192.168.1.5
The global address 209.165.202.129 provides a translated address for the inside server at IP address 192.168.1.5.
Examples
The following example declares two global pool ranges and a PAT address. Then the nat command permits all inside users to start connections to the outside network:
global (outside) 1 209.165.201.1-209.165.201.10 netmask 255.255.255.224 global (outside) 1 209.165.201.12 netmask 255.255.255.224 Global 209.165.201.12 will be Port Address Translated nat (inside) 1 0 0 clear xlate
The next example creates a global pool from two contiguous pieces of a Class C address and gives the perimeter hosts access to this pool of addresses to start connections on the outside interface:
global (outside) 1000 209.165.201.1-209.165.201.14 netmask 255.255.255.240 global (outside) 1000 209.165.201.17-209.165.201.30 netmask 255.255.255.240 nat (perimeter) 1000 0 0
6-107
Chapter 6 help
Command Reference
help
Display help information. (Unprivileged mode.) help ?
Usage Guidelines
The help or ? command displays help information about all commands. You can view help for an individual command by entering the command name followed by a question mark or just the command name and pressing the Enter key. If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:
<--- More --->
The More prompt uses syntax similar to the UNIX more command:

To view another screenful, press the Space bar. To view the next line, press the Enter key. To return to the command line, press the q key.
Examples
The following example shows how you can display help information by following the command name with a question mark:
enable ? usage: enable password <pw> [encrypted]
Help information is available on the core commands (not the show, no, or clear commands) by entering ? at the command prompt:
? aaa Enable, disable, or view TACACS+ or RADIUS user authentication, authorization and accounting
6-108
78-10392-02
Chapter 6
Command Reference hostname
hostname
Change the host name in the PIX Firewall command line prompt. (Configuration mode.) hostname newname
Syntax Description
newname
New host name for the PIX Firewall prompt. This name can be up to 16 alphanumeric characters and mixed case.
Usage Guidelines
The hostname command changes the host name label on prompts. The default host name is pixfirewall.
Note
The change of the host name causes the change of the fully qualified domain name. Once the fully qualified domain name is changed, delete the RSA key pairs with the ca zeroize rsa command and delete related certificates with the no ca identity ca_nickname command.
Examples
The following example shows how to change a host name:

pixfirewall(config)# hostname spinner spinner(config)# hostname pixfirewall pixfirewall(config)#
6-109
Chapter 6 interface
Command Reference
interface
Identify network interface speed and duplex. (Configuration mode.) interface hardware_id [hardware_speed] [shutdown] clear interface show interface
Syntax Description
hardware_id
Identifies the network interface type. Possible values are ethernet0, ethernet1 to ethernetn, gb-ethernetn, fddi0 or fddi1, token-ring0, token-ring1, to token-ringn, depending on how many network interfaces are in the firewall.
hardware_speed Network interface speed (optional). Do not specify a hardware_speed for a FDDI interface. Possible Ethernet values are: 10basetSet for 10 Mbps Ethernet half duplex communication. 10fullSet for 10 Mbps Ethernet full duplex communication. 100basetxSet for 100 Mbps Ethernet half duplex communication. 100fullSet for 100 Mbps Ethernet full duplex communication. 1000sxfullSet for 1000 Mbps Gigabit Ethernet full duplex operation. 1000basesxSet for 1000 Mbps Gigabit Ethernet half duplex operation. 1000autoSet for 1000 Mbps Gigabit Ethernet to auto-negotiate full or half duplex. auiSet 10 for Mbps Ethernet half duplex communication with an AUI cable interface. autoSet Ethernet speed automatically. The auto keyword can only be used with the Intel 10/100 automatic speed sensing network interface card, which shipped with the PIX Firewall units manufactured after November 1996. bncSet for 10 Mbps Ethernet half duplex communication with a BNC cable interface. Possible Token Ring values are: 4mbps4 Mbps data transfer speed. You can specify this as 4. 16mbps(default) 16 Mbps data transfer speed. You can specify this as 16. shutdown Disable an interface.
6-110
78-10392-02
Chapter 6
Command Reference interface
Usage Guidelines
The interface command identifies the speed and duplex settings of the network interface boards. Use show interface to view information about the interface. In version 5.1(2), the show interface command displays the packet drop count of Unicast RPF for each interface. This value appears as the unicast rpf drops counter. The clear interface command clears all interface statistics except the number of input bytes. This command no longer shuts down all system interfaces. The clear interface command works with all interface types except gigabit Ethernet. In version 5.1(2), the clear interface command also clears the packet drop count of Unicast RPF for all interfaces. The shutdown option lets you disable an interface. When you first install PIX Firewall version 5.1, all interfaces are shut down by default. You must explicitly enable an interface by entering the command without the shutdown option. If the shutdown option does not exist in the command, packets are passed by the driver to and from the card. If the shutdown option does exist, packets are dropped in either direction. Inserting a new card defaults to the default interface command containing the shutdown option. (That is, if you add a new card and then enter the write memory command, the shutdown option is saved into Flash memory for the interface.) When upgrading from a previous version to the current version, interfaces are enabled. The configuration of the interface affects buffer allocation (the PIX Firewall will allocate more buffers for higher line speeds). Buffer allocation can be checked with the show blocks command.
Note
The show interface command reports line protocol down for BNC cable connections and for 3Com cards.
Note
Even though the default is to set automatic speed sensing for the interfaces with the interface hardware_id auto command, it is safest to specify the speed of the network interfaces; for example, 10baset or 100basetx. This lets PIX Firewall operate in network environments that may include switches or other devices that do not handle auto sensing correctly.
Usage Notes
1. 2.
When you use the interface token-ring command, also use the mtu command to set the block size depending on the interface speed. After changing an interface command, use the clear xlate command.
show interface Notes
The show interface command lets you view network interface information for both Ethernet and Token Ring, depending on which is installed in your PIX Firewall. This is one of the first commands you should use when establishing network connectivity after installing a PIX Firewall. The information in the show interface display is as follows:
The ethernet, fddi, or token-ring interface strings indicate that you have used the interface command to configure the interface. The statement indicates either outside or inside and whether the interface is available (up) or not available (down). line protocol up means a working cable is plugged into the network interface. If the message is line protocol down, either the cable is incorrect or not plugged into the interface connector. Network interface type.
6-111
Chapter 6 interface
Command Reference
Interrupt vector. It is acceptable for interface cards to have the same interrupts because PIX Firewall uses interrupts to get Token Ring information, but polls Ethernet cards. MAC address. Intel cards start with i and 3Com cards with 3c. MTU (maximum transmission unit): the size in bytes that data can best be sent over the network. nn packets input indicates that packets are being received in the firewall. nn packets output indicates that packets are being sent from the firewall. Line duplex status: half duplex indicates that the network interface switches back and forth between sending and receiving information; full duplex indicates that the network interface can send or receive information simultaneously. Line speed: 10baset is listed as 10,000 Kbit; 100basetx is listed as 100,000 Kbit. Interface problems:
no buffer, the PIX Firewall is out of memory or slowed down due to heavy traffic and cannot
keep up with the received data.

runts are packets with less information than expected. giants are packets with more information than expected. input errors. CRC (cyclic redundancy check) are packets that contain corrupted data (checksum error). frame errors are framing errors. overruns occur when the network interface card is overwhelmed and cannot buffer received
information before more needs to be sent.

ignored and aborted errors are provided for future use, but are not currently checked; the PIX
Firewall does not ignore or abort frames.

underruns occur when the PIX Firewall is overwhelmed and cannot get data fast enough to the
network interface card.

unicast rpf dropswhen packets sent to a single network destination using reverse path
forwarding are dropped.

output errors(maximum collisions). The number of frames not transmitted because the
configured maximum number of collisions was exceeded. This counter should only increment during heavy network traffic.
collisions(single and multiple collisions). The number of messages retransmitted due to an
Ethernet collision. This usually occurs on an overextended LAN (Ethernet or transceiver cable too long, more than two repeaters between stations, or too many cascaded multiport transceivers). A packet that collides is counted only once by the output packets.
interface resetsthe number of times an interface has been reset. If an interface is unable to
transmit for three seconds, PIX Firewall resets the interface to restart transmission. During this interval, connection state is maintained. An interface reset can also happen when an interface is looped back or shut down.
babblesunused. (babble means that the transmitter has been on the interface longer than
the time taken to transmit the largest frame.)

late collisionsthe number of frames that were not transmitted because a collision occurred
outside the normal collision window. A late collision is a collision that is detected late in the transmission of the packet. Normally, these should never happen. When two Ethernet hosts try to talk at once, they should collide early in the packet and both back off, or the second host should see that the first one is talking and wait.
6-112
78-10392-02
Chapter 6
Command Reference interface
If you get a late collision, a device is jumping in and trying to send on the Ethernet while the PIX Firewall is partly finished sending the packet. The PIX Firewall does not resend the packet, because it may have freed the buffers that held the first part of the packet. This is not a real problem because networking protocols are designed to cope with collisions by resending packets. However, late collisions indicate a problem exists in your network. Common problems are large repeated networks and Ethernet networks running beyond the specification.
deferredthe number of frames that were deferred before transmission due to activity on the
link.
lost carrierthe number of times the carrier signal was lost during transmission. no carrierunused.
Gigabit interface cards do not provide information for the extended show interface command counters introduced in version 5.0(3). The show interface command has been enhanced to include eight additional status counters. The new counters are only valid for Ethernet interfaces. The following example shows the new output:
show interface interface ethernet0 "outside" is up, line protocol is up Hardware is i82559 ethernet, address is 00aa.0000.003b IP address 209.165.201.7, subnet mask 255.255.255.224 MTU 1500 bytes, BW 100000 Kbit half duplex 1184342 packets input, 1222298001 bytes, 0 no buffer Received 26 broadcasts, 27 runts, 0 giants 4 input errors, 0 CRC, 4 frame, 0 overrun, 0 ignored, 0 abort 1310091 packets output, 547097270 bytes, 0 underruns, 0 unicast rpf drops 0 output errors, 28075 collisions, 0 interface resets 0 babbles, 0 late collisions, 117573 deferred 0 lost carrier, 0 no carrier
The counters in the last three lines are as follows:

output errors(maximum collisions). The number of frames not transmitted because the
configured maximum number of collisions was exceeded. This counter should only increment during heavy network traffic.
collisions(single and multiple collisions). The number of messages retransmitted due to an
Ethernet collision. This usually occurs on an overextended LAN (Ethernet or transceiver cable too long, more than two repeaters between stations, or too many cascaded multiport transceivers). A packet that collides is counted only once by the output packets.
interface resetsthe number of times an interface has been reset. If an interface is unable to
transmit for three seconds, PIX Firewall resets the interface to restart transmission. During this interval, connection state is maintained. An interface reset can also happen when an interface is looped back or shut down.
babblesunused. (babble means that the transmitter has been on the interface longer than
the time taken to transmit the largest frame.)

late collisionsthe number of frames that were not transmitted because a collision occurred
outside the normal collision window. A late collision is a collision that is detected late in the transmission of the packet. Normally, these should never happen. When two Ethernet hosts try to talk at once, they should collide early in the packet and both back off, or the second host should see that the first one is talking and wait.
6-113
Chapter 6 interface
Command Reference
If you get a late collision, a device is jumping in and trying to send the packet on the Ethernet
while the PIX Firewall is partly finished sending the packet. The PIX Firewall does not resend the packet, because it may have freed the buffers that held the first part of the packet. This is not a real problem because networking protocols are designed to cope with collisions by resending packets. However, late collisions indicate a problem exists in your network. Common problems are large repeated networks and Ethernet networks running beyond the specification.
deferredthe number of frames that were deferred before transmission due to activity on the
link.
lost carrierthe number of times the carrier signal was lost during transmission. no carrierunused.
Examples
The following example assigns names to each interface, enables auto detection for the interface parameters, and then shows interface activity:
nameif ethernet0 outside security0 nameif token-ring0 inside security100 nameif ethernet1 DMZ security50 interface ethernet0 auto interface token-ring0 16mbps interface ethernet1 auto show interface interface ethernet0 outside is up, line protocol is up Hardware is i82557 ethernet, irq 10, address is 0060.7380.2f16 IP address 209.165.201.1, subnet mask 255.255.255.224 MTU 1500 bytes, BW 100000 Kbit half duplex 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 1 packets output, 0 bytes, 0 underruns, 0 unicast rpf drops 0 output errors, 28075 collisions, 0 interface resets 0 babbles, 0 late collisions, 117573 deferred 0 lost carrier, 0 no carrier interface token-ring0 inside is up, line protocol is up Hardware is o3137 token-ring, irq 9, address is 0000.8326.72c6 IP address 10.0.0.1, subnet mask 255.0.0.0 MTU 8192 bytes, BW 16000 Kbit, Ring-speed: 16Mbps 116 packets input, 27099 bytes, 0 no buffer Received 116 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 116 frame, 0 overrun, 0 ignored, 0 abort 3 packets output, 150 bytes, 0 underruns, 0 unicast rpf drops 0 output errors, 28075 collisions, 0 interface resets 0 babbles, 0 late collisions, 117573 deferred 0 lost carrier, 0 no carrier interface ethernet1 DMZ is up, line protocol is up Hardware is i82557 ethernet, irq 9, address is 00a0.c95d.0282 IP address 127.0.0.1, subnet mask 255.255.255.0 MTU 1500 bytes, BW 10000 Kbit half duplex 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns, 0 unicast rpf drops 0 output errors, 28075 collisions, 0 interface resets 0 babbles, 0 late collisions, 117573 deferred 0 lost carrier, 0 no carrier
6-114
78-10392-02
Chapter 6
Command Reference ip address
ip address
Identify addresses for network interfaces. (Configuration mode.) ip address if_name ip_address [netmask] show ip clear ip
Syntax Description
if_name ip_address netmask

Usage Guidelines
The internal or external interface name designated by the nameif command. PIX Firewall units network interface IP address. Network mask of ip_address.
The ip address command lets you assign an IP address to each interface. Use the show ip command to view which addresses are assigned to the network interfaces. If you make a mistake while entering this command, re-enter the command with the correct information. The clear ip command resets all interface IP addresses to 127.0.0.1. The clear ip command does not affect the ip local pool or ip verify reverse-route commands.
Note
The clear ip command stops all traffic through the PIX Firewall unit. After changing an ip address command, use the clear xlate command.
Note
Always specify a network mask with the ip address command. If you let PIX Firewall assign a network mask based on the IP address, you may not be permitted to enter subsequent IP addresses if another interfaces address is in the same range as the first address. For example, if you specify an inside interface address of 10.1.1.1 without specifying a network mask and then try to specify 10.1.2.2 for a perimeter interface mask, PIX Firewall displays the error message, Sorry, not allowed to enter IP address on same network as interface n. To fix this problem, reenter the first command specifying the correct network mask.
Note
Do not set the netmask to all 255s, such as 255.255.255.255. This stops access on the interface. Instead, use a network address of 255.255.255.0 for Class C addresses, 255.255.0.0 for Class B addresses, or 255.0.0.0 for Class A addresses. The default address for an interface is 127.0.0.1.
6-115
Chapter 6 ip address
Command Reference
PIX Firewall configurations using failover require a separate IP address for each network interface on the Standby unit. The system IP address is the address of the Active unit. When the show ip command is executed on the Active unit, the current IP address is the same as the system IP address. When the show ip command is executed on the Standby unit, the system IP address is the failover IP address configured for the Standby unit.
Examples
The following is the sample output for the show ip command:

show ip System IP Addresses: ip address outside 209.165.201.2 255.255.255.224 ip address inside 192.168.2.1 255.255.255.0 ip address perimeter 192.168.70.3 255.255.255.0 Current IP Addresses: ip address outside 209.165.201.2 255.255.255.224 ip address inside 192.168.2.1 255.255.255.0 ip address perimeter 192.168.70.3 255.255.255.0
The Current IP Addresses are the same as the System IP Addresses on the failover Active unit. When the Primary unit fails, the Current IP Addresses become those of the Standby unit.
6-116
78-10392-02
Chapter 6
Command Reference ip local pool
ip local pool
Identify addresses for a local pool. (Configuration mode) ip local pool pool_name pool_start-address[-pool_end-address] no ip local pool pool_name pool_start-address[-pool_end-address] show ip local pool pool_name ip_address[-ip_address]
Syntax Description
pool_name
Local pool name.
pool_start_address Local pool IP address range. pool_end_address

Usage Guidelines
The ip local pool command lets you create a pool of local addresses to be used for assigning dynamic ip addresses to remote VPN clients. The address range of this pool of local addresses must not overlap with any command statement that lets you specify an IP address. To delete an address pool, use the no ip local pool command. Use the show ip local pool command to view usage information about the pool of local addresses. To reference this pool of local addresses, use the isakmp client configuration address-pool command. See the isakmp command page for more information.
Examples
The following example creates a pool of IP addresses and then displays the pool contents:
ip local pool mypool 10.0.0.10-10.0.0.20 show ip local pool mypool Pool mypool Begin 10.0.0.10 End 10.0.0.20 Free 11 In use 0
Available Addresses: 10.0.0.10 10.0.0.11 10.0.0.12 10.0.0.13 10.0.0.14 10.0.0.15 10.0.0.16 10.0.0.17 10.0.0.18 10.0.0.19 10.0.0.20
6-117
Chapter 6 ip verify reverse-path
Command Reference
ip verify reverse-path
Implement unicast RPF IP spoofing protection. (Configuration mode.) ip verify reverse-path interface int_name no ip verify reverse-path interface int_name show ip verify [reverse-path [interface int_name]] clear ip verify [reverse-path [interface int_name]]
Syntax Description
int_name
Usage Guidelines
Name of an interface you want to protect from a DoS attack.
The ip verify reverse-path command lets you specify which interfaces to protect from an IP spoofing attack using network ingress and egress filtering, which is described in RFC 2267. This command is disabled by default and provides unicast RPF (Reverse Path Forwarding) functionality for the PIX Firewall. The show ip verify command lists the ip verify commands in the configuration. The clear ip verify command removes ip verify commands from the configuration. Unicast RPF is a unidirectional input function that screens inbound packets arriving on an interface. Outbound packets are not screened. Due to the danger of IP spoofing in the IP protocol, measures need to be taken to reduce this risk when possible. Unicast RPF (Reverse Path Forwarding), or reverse route lookups, prevents such manipulation under certain circumstances. The ip verify reverse-path command provides both ingress and egress filtering. Ingress filtering checks inbound packets for IP source address integrity, and is limited to addresses for networks in the enforcing entity's local routing table. If the incoming packet does not have a source address represented by a route, then it is impossible to know whether the packet has arrived on the best possible path back to its origin. This is often the case when routing entities cannot maintain routes for every network. Egress filtering verifies that packets destined for hosts outside the managed domain have IP source addresses verifiable by routes in the enforcing entity's local routing table. If an exiting packet does not arrive on the best return path back to the originator, then the packet is dropped and the activity logged. Egress filtering prevents internal users from launching attacks using IP source addresses outside of the local domain because most attacks use IP spoofing to hide the identity of the attacking host. Egress filtering makes the task of tracing the origin of an attack much easier. When employed, egress filtering enforces what IP source addresses are obtained from a valid pool of network addresses. Addresses are kept local to the enforcing entity and are therefore easily traceable. Unicast RPF is implemented as follows:

ICMP packets have no session so each packet is checked. UDP and TCP have sessions, so the initial packet requires a reverse route lookup. Subsequent packets arriving during the session are checked using an existing state maintained as part of the session. Non-initial packets are checked to ensure they arrived on the same interface used by the initial packet.
6-118
78-10392-02
Chapter 6
Command Reference ip verify reverse-path
Note
Before using this command, add static route command statements for every network that can be accessed on the interfaces you wish to protect. Only enable this command if routing is fully specified. Otherwise, PIX Firewall will stop traffic on the interface you specify if routing is not in place. Use the show interface command to view the number dropped packets, which appears in the unicast rpf drops counter.
Examples
The following example protects traffic between the inside and outside interfaces and provides route command statements for two networks 10.1.2.0 and 10.1.3.0 that connect to the inside interface via a hub:
ip address inside 10.1.1.1 255.255.0.0 route inside 10.1.2.0 255.255.0.0 10.1.1.1 1 route inside 10.1.3.0 255.255.0.0 10.1.1.1 1 ip verify reverse-path interface outside ip verify reverse-path interface inside
The ip verify reverse-path interface outside command statement protects the outside interface from network ingress attacks from the Internet, whereas the ip verify reverse-path interface inside command statement protects the inside interface from network egress attacks from users on the internal network.
6-119
Chapter 6 ipsec
Command Reference
ipsec
The ipsec command is a shortened form of the crypto ipsec command. (Configuration mode.) clear ipsec show ipsec
Usage Guidelines
The clear ipsec command removes all ipsec commands from the configuration. The show ipsec command lists all the ipsec commands in the configuration.
Note
See the crypto ipsec command page for information on all other command options and examples.
6-120
78-10392-02
Chapter 6
Command Reference isakmp
isakmp
Negotiates IPSec security associations and enables IPSec secure communications. (Configuration mode.) isakmp client configuration address-pool local pool-name [interface-name] no isakmp client configuration address-pool local pool-name isakmp enable interface-name no isakmp enable interface-name isakmp identity address | hostname no isakmp identity address | hostname isakmp key keystring address peer-address [netmask mask] [no-xauth] [no-config-mode] no isakmp key keystring address peer-address [netmask mask][no-xauth] [no-config-mode] isakmp peer fqdn fqdn no-xauth no-config-mode no isakmp peer fqdn fqdn no-xauth no-config-mode isakmp policy priority authentication pre-share | rsa-sig no isakmp policy priority authentication pre-share | rsa-sig isakmp policy priority encryption des | 3des no isakmp policy priority encryption des | 3des isakmp policy priority group 1 | 2 no isakmp policy priority group 1 | 2 isakmp policy priority hash md5 | sha no isakmp policy priority hash md5 | sha isakmp policy priority lifetime seconds no isakmp policy priority lifetime seconds show isakmp policy show isakmp sa clear [crypto] isakmp sa clear isakmp
6-121
Chapter 6 isakmp
Command Reference
Syntax Description
pool-name interface-name peer-address peer-hostname key keystring
Specifies the name of a local address pool to allocate the dynamic client ip. The name of the interface on which to enable ISAKMP negotiation. Specify the IP address of the IPSec peer. Specify the hostname of the IPSec peer. Specify the authentication pre-shared key. Use any combination of alphanumeric characters up to 128 bytes. This pre-shared key must be identical at both peers. Specify the IPSec peers IP address for the pre-shared key.
address peer-address netmask mask
(Optional) The netmask of 0.0.0.0. can be entered as a wildcard indicating the key could be used for any peer that does not have a key associated with its specific IP address. This is only to be used if you enabled the Xauth feature, and you have an IPSec peer that is a gateway. This option associates a given pre-shared key with a gateway and allows an exception to the Xauth feature enabled by the crypto map client authentication command. This is only to be used if you enabled the IKE Mode Configuration feature, and you have an IPSec peer that is a gateway. This option associates a given pre-shared key with a gateway and allows an exception to the IKE Mode Configuration feature enabled by the crypto map client configuration address command. The fully qualified domain name of the peer. This is used to identify a peer that is a security gateway. Uniquely identifies the IKE policy and assigns a priority to the policy. Use an integer from 1 to 65,534, with 1 being the highest priority and 65,534 the lowest. Specifies pre-shared keys as the authentication method.
no-xauth
no-config-mode
fqdn fqdn
policy priority
authentication pre-share authentication rsa-sig
Specifies RSA signatures as the authentication method. RSA signatures provide non-repudiation for the IKE negotiation. This basically means you can prove to a third party whether you had an IKE negotiation with the peer. Specifies 56-bit DES-CBC as the encryption algorithm is to be used in the IKE policy. Specifies the Triple DES encryption algorithm is to be used in the IKE policy. Specifies the 768-bit Diffie-Hellman group is to be used in the IKE policy. This is the default value.
encryption des
encryption 3des group 1
6-122
78-10392-02
Chapter 6
group 2 hash md5
Specifies the 1024-bit Diffie-Hellman group is to be used in the IKE policy. Specifies MD5 (HMAC variant) as the hash algorithm to be used in the IKE policy. Specifies SHA-1 (HMAC variant) as the hash algorithm to be used in the IKE policy. This is the default hash algorithm. Specifies how many seconds each security association should exist before expiring. Use an integer from 60 to 86,400 seconds (one day).
hash sha
lifetime seconds
Usage Guidelines
The sections that follow describe each isakmp command.
Note
See About IKE in Chapter 4, Configuring IPSec, for more information about this IPSec feature.
isakmp client configuration address-pool local
The isakmp client configuration address-pool local command is used to configure the IP address local pool to reference IKE. Use the no crypto isakmp client configuration address-pool local command to restore to the default value. Before using this command, use the ip local pool command to define a pool of local addresses to be assigned to a remote IPSec peer.
Examples
The following example references IP address local pools to IKE with mypool as the pool-name:
isakmp client configuration address-pool local mypool outside
isakmp enable
The isakmp enable command is used to enable ISAKMP negotiation on the interface on which the IPSec peer will communicate with the PIX Firewall. ISAKMP is enabled by default. Use the no isakmp enable command to disable IKE.
Examples
The following example shows how to disable IKE on the inside interface:
no isakmp enable inside
isakmp identity address | hostname
To define the ISAKMP identity the PIX Firewall uses when participating in the IKE protocol, use the isakmp identity address | hostname command. Use no isakmp identity address | hostname command to reset the ISAKMP identity to the default value of IP address. When two peers use IKE to establish IPSec security associations, each peer sends its ISAKMP identity to the remote peer. It will send either its IP address or host name depending on how each has its ISAKMP identity set. By default, the PIX Firewall units ISAKMP identity is set to the IP address. As a general rule, set the PIX Firewall and its peers identities in the same way to avoid an IKE negotiation failure. This failure could be due to either the PIX Firewall or its peer not recognizing its peers identity.
6-123
Chapter 6 isakmp
Command Reference
Note
If you are using RSA signatures as your authentication method in your IKE policies, Cisco recommends you set each participating peers identity to hostname. Otherwise, the ISAKMP security association to be established during phase 1 of IKE may fail. The following example uses pre-shared keys between the two PIX Firewall units (PIX Firewall 1 and PIX Firewall 2) that are peers and sets both their ISAKMP identities to hostname. At the PIX Firewall 1, the ISAKMP identity is set to hostname:
isakmp identity hostname
At the PIX Firewall 2, the ISAKMP identity is set to hostname:

isakmp identity hostname
isakmp key address
To configure a pre-shared authentication key and associate the key with an IPSec peer address or hostname, use the isakmp key address command. Use the no isakmp key address command to delete a pre-shared authentication key and its associated IPSec peer address. You would configure the pre-shared key at both peers whenever you specify pre-shared key in an IKE policy. Otherwise the policy cannot be used because it will not be submitted for matching by the IKE process. A netmask of 0.0.0.0. can be entered as a wildcard indicating that any IPSec peer with a given valid pre-shared key is a valid peer.
Note
The PIX Firewall or any IPSec peer can use the same authentication key with multiple peers, but this is not as secure as using a unique authentication key between each pair of peers.
Note
Configure a pre-shared key associated with a given security gateway to be distinct from a wildcard, pre-shared key (pre-shared key plus a netmask of 0.0.0.0) used to identify and authenticate the remote VPN clients. The no-xauth or no-config-mode command options are to be used only if the following criteria are met:

You are using the pre-shared key authentication method within your IKE policy. The security gateway and VPN client peers terminate on the same interface. The Xauth or IKE Mode Configuration feature is enabled for VPN client peers.
The isakmp key keystring address ip-address [no-xauth] [no-config-mode] command allows you to configure a pre-shared authentication key, associate the key with a given security gateways address, and make an exception to the enabled Xauth feature, IKE Mode Configuration feature, or both (the most common case) for this peer. Both the Xauth and IKE Mode Configuration features are specifically designed for remote VPN clients. The Xauth feature allows the PIX Firewall to challenge the peer for a username and password during IKE negotiation. The IKE Mode Configuration enables the PIX Firewall to download an IP address to the peer for dynamic IP address assignment. Most security gateways do not support the Xauth and IKE Mode Configuration features.
6-124
78-10392-02
Chapter 6
If you have the no-xauth command option configured, the PIX Firewall will not challenge the peer for a username and password. Similarly, if you have the no-config-mode command option configured, the PIX Firewall will not attempt to download an IP address to the peer for dynamic IP address assignment. Use the no key keystring address ip-address [no-xauth] [no-config-mode] command to disable the key keystring address ip-address [no-xauth] [no-config-mode] command that you previously enabled. See the crypto map client authentication command within the crypto map command page in this chapter for more information about the Xauth feature. See the crypto map client configuration address command within the crypto map command page in this chapter for more information about the IKE Mode Config feature.
Examples
The following example shows sharedkeystring as the authentication key to share between the PIX Firewall and its peer specified by an IP address of 10.1.0.0.
isakmp key sharedkeystring address 10.1.0.0
The following example shows use of a wildcard, pre-shared key. The sharedkeystring is the authentication key to share between the PIX Firewall and its peer (in this case a VPN client) specified by an IP address of 0.0.0.0. and a netmask of 0.0.0.0.
isakmp key sharedkeystring address 0.0.0.0 netmask 0.0.0.0
The following example shows use of the command options no-xauth and no-config-mode in relation to three PIX Firewall peers that are security gateways. These security gateways terminate IPSec on the same interface as the VPN clients. Both the Xauth and IKE Mode Config features are enabled. This means there is a need to make an exception to these two features for each security gateway. The example shows each security gateway peer has a unique pre-shared key to share with the PIX Firewall. The peers IP addresses are 10.1.1.1, 10.1.1.2, 10.1.1.3, and the netmask of 255.255.255.255 is specified.
isakmp key secretkey1234 address 10.1.1.1 netmask 255.255.255.255 no-xauth no-config-mode isakmp key secretkey4567 address 10.1.1.2 netmask 255.255.255.255 no-xauth no-config-mode isakmp key secretkey7890 address 10.1.1.3 netmask 255.255.255.255 no-xauth no-config-mode
isakmp peer fqdn no-xauth | no-config-mode
The isakmp peer fqdn fqdn no-xauth | no-config-mode command is to be used only if the following criteria are met:

You are using the RSA signatures authentication method within your IKE policy. The security gateway and VPN client peers terminate on the same interface. The Xauth or IKE Mode Configuration feature is enabled for VPN client peers.
The isakmp peer fqdn fqdn no-xauth | no-config-mode command allows you identify a peer that is a security gateway and make an exception to the enabled Xauth feature, IKE Mode Configuration feature, or both (the most common case) for this peer. Both the Xauth and IKE Mode Configuration features are specifically designed for remote VPN clients. The Xauth feature allows the PIX Firewall to challenge the peer for a username and password during IKE negotiation. The IKE Mode Configuration enables the PIX Firewall to download an IP address to the peer for dynamic IP address assignment. Most security gateways do not support the Xauth and IKE Mode Configuration features. If you have the no-xauth command option configured, the PIX Firewall will not challenge the peer for a username and password. Similarly, if you have the no-config-mode command option configured, the PIX Firewall will not attempt to download an IP address to the peer for dynamic IP address assignment.
6-125
Chapter 6 isakmp
Command Reference
Note
If you are using RSA signatures as your authentication method in your IKE policies, Cisco recommends you set each participating peers identity to hostname using the isakmp identity hostname command. Otherwise, the ISAKMP security association to be established during phase 1 of IKE may fail. Use the no isakmp peer fqdn fqdn no-xauth | no-config-mode command to disable the isakmp peer fqdn fqdn no-xauth | no-config-mode command that you previously enabled. See the crypto map client authentication within the crypto map command page in this chapter for more information about the Xauth feature. See the crypto map client configuration address command within the crypto map command page in this chapter for more information about the IKE Mode Config feature.
Examples
The following example shows use of the command options no-xauth and no-config-mode in relation to three PIX Firewall peers that are security gateways. These security gateways terminate IPSec on the same interface as the VPN clients. Both the Xauth and IKE Mode Config features are enabled. This means there is a need to make an exception to these two features for each security gateway. Each security gateway peers fully qualified domain name is specified.
isakmp peer fqdn hostname1.example.com no-xauth no-config-mode isakmp peer fqdn hostname2.example.com no-xauth no-config-mode isakmp peer fqdn hostname3.example.com no-xauth no-config-mode
isakmp policy authentication
The isakmp policy authentication command allows you to specify the authentication method within an IKE policy. IKE policies define a set of parameters to be used during IKE negotiation. If you specify RSA signatures, you must configure the PIX Firewall and its peer to obtain certificates from a CA. If you specify pre-shared keys, you must separately configure these pre-shared keys within the PIX Firewall and its peer. Use the no isakmp policy authentication command to reset the authentication method to the default value of RSA signatures.
Examples
The following example shows use of the isakmp policy authentication command. This example sets the authentication method of rsa-signatures to be used within the IKE policy with the priority number of 40.
isakmp policy 40 authentication rsa-sig
isakmp policy encryption
To specify the encryption algorithm within an IKE policy, use the isakmp policy encryption command. IKE policies define a set of parameters to be used during IKE negotiation. DES and 3DES are the two encryption algorithm options available. Use the no isakmp policy encryption command to reset the encryption algorithm to the default value, which is des.
6-126
78-10392-02
Chapter 6
Examples
The following example shows use of the isakmp policy encryption command. This example sets the Triple DES algorithm to be used within the IKE policy with the priority number of 40.
isakmp policy 40 encryption 3des
isakmp policy group
Use the isakmp policy group command to specify the Diffie-Hellman group to be used in an IKE policy. IKE policies define a set of parameters to be used during IKE negotiation. There are two group options: 768-bit or 1024-bit. The 1024-bit Diffie Hellman provides stronger security, but it requires more CPU time to execute. Use the no isakmp policy group command to reset the Diffie-Hellman group identifier to the default value of group 1, 768-bit Diffie Hellman.
Examples
The following example shows use of the isakmp policy group command. This example sets group 2, the 1024-bit Diffie Hellman, to be used within the IKE policy with the priority number of 40.
isakmp policy 40 group 2
isakmp policy hash
Use the isakmp policy hash command to specify the hash algorithm to be used in an IKE policy. IKE policies define a set of parameters to be used during IKE negotiation. There are two hash algorithm options: SHA-1 and MD5. MD5 has a smaller digest and is considered to be slightly faster than SHA-1. To reset the hash algorithm to the default value of SHA-1, use the no isakmp policy hash command.
Examples
The following example shows use of the isakmp policy hash command. This example sets the MD5 hash algorithm to be used within the IKE policy with the priority number of 40.
isakmp policy 40 hash md5
isakmp policy lifetime
To specify the lifetime of an IKE security association before it expires, use the isakmp policy lifetime command. Use the no isakmp policy lifetime command to reset the security association lifetime to the default value of 86,400 seconds (one day). When IKE begins negotiations, it looks to agree upon the security parameters for its own session. The agreed-upon parameters are then referenced by a security association at each peer. The security association is retained by each peer until the security associations lifetime expires. Before a security association expires, it can be reused by subsequent IKE negotiations, which can save time when setting up new IPSec security associations. New security associations are negotiated before current security associations expire. To save setup time for IPSec, configure a longer IKE security association lifetime. However, the shorter the lifetime (up to a point), the more secure the IKE negotiation is likely to be.
Note
When PIX Firewall initiates an IKE negotiation between itself and an IPSec peer, an IKE policy can be selected only if the lifetime of the peers policy is shorter than or equal to the lifetime of its policy. Then, if the lifetimes are not equal, the shorter lifetime will be selected.
6-127
Chapter 6 isakmp
Command Reference
Examples
The following example shows use of the isakmp policy lifetime command. This example sets the lifetime of the IKE security association to 50,400 seconds (14 hours) within the IKE policy with the priority number of 40.
isakmp policy 40 lifetime 50400
show isakmp policy
To view the parameters for each IKE policy including the default parameters, use the show isakmp policy command.
Examples
The following is sample output from the show isakmp policy command after two IKE policies were configured (with priorities 70 and 90 respectively):
show isakmp policy Protection suite priority 70 encryption algorithm: DES - Data Encryption Standard (56 bit keys) hash algorithm: Message Digest 5 authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #2 (1024 bit) lifetime: 5000 seconds, no volume limit Protection suite priority 90 encryption algorithm: DES - Data Encryption Standard (56 bit keys) hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #1 (768 bit) lifetime: 10000 seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys) hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit
Note
Although the output shows no volume limit for the lifetimes, you can currently only configure a time lifetime (such as 86,400 seconds); volume limit lifetimes are not currently configurable.
show isakmp sa
To view all current IKE security associations between the PIX Firewall and its peer, use the show isakmp sa command.
Examples
The following is sample output from the show isakmp sa command after IKE negotiations were successfully completed between the PIX Firewall and its peer:
show isakmp sa dst 16.132.40.2 src 16.132.30.2 state QM_IDLE pending 0 created 1
6-128
78-10392-02
Chapter 6
clear isakmp
The clear isakmp command removes all isakmp command statements from the configuration.
clear [crypto] isakmp sa
The clear [crypto] isakmp sa command deletes active IKE security associations. The keyword crypto is optional.
6-129
Chapter 6 kill
Command Reference
kill
Terminate a Telnet session. (Privileged mode.) kill telnet_id
Syntax Description
telnet_id
Telnet session ID.
Usage Guidelines
The kill command terminates a Telnet session. Use the who command to view the Telnet session ID value. When you kill a Telnet session, the PIX Firewall lets any active commands terminate and then drops the connection without warning the user. The kill command does not affect PIX Firewall Manager sessions. See also: show who, telnet.
Examples
The following is sample output from the show who command, which is used to list the active Telnet sessions, and the use of the kill command to end Telnet session 2:
show who 2: From 10.10.54.0 kill 2
6-130
78-10392-02
Chapter 6
Command Reference local-host (clear and show)
local-host (clear and show)

View local host network states. (Privileged mode (show), configuration mode (clear).) clear local-host [ip_address] show local-host [ip_address]
Syntax Description
ip_address
Local host IP address.
Usage Guidelines
The show local-host command lets you view the network states of local hosts. Local hosts are any hosts on the same subnet as an internal PIX Firewall interface (not the outside interface). Hosts beyond the next hop routers are not affected by this command. This command lets you show the translation and connection slots for the local hosts, or stop all traffic on these hosts. This command provides information for hosts configured with the nat 0 command when normal translation and connection states may not apply. Use the ip_address option to limit the display to a single host. The clear local-host command clears the information displayed for the local host.
Note
Clearing the network state of a local host stops all connections and xlates associated with the local hosts.
Examples
The following is sample output from the show local-host command:

show local-host 10.1.1.15 local host: <10.1.1.15>, conn(s)/limit = 2/0, embryonic(s)/limit = 0/0 Xlate(s): PAT Global 172.16.3.200(1024) Local 10.1.1.15(55812) PAT Global 172.16.3.200(1025) Local 10.1.1.15(56836) PAT Global 172.16.3.200(1026) Local 10.1.1.15(57092) PAT Global 172.16.3.200(1027) Local 10.1.1.15(56324) PAT Global 172.16.3.200(1028) Local 10.1.1.15(7104) Conn(s): TCP out 192.150.49.10:23 in 10.1.1.15:1246 idle 0:00:20 Bytes 449 flags UIO TCP out 192.150.49.10:21 in 10.1.1.15:1247 idle 0:00:10 Bytes 359 flags UIO
The xlate describes the translation slot information and the Conn is the connection state information. The next example shows how the clear local-host command clears the local host information:
clear local-host 10.1.1.15 show local-host 10.1.1.15
Once the information is cleared, nothing more displays until the hosts reestablish their connections, which were stopped by the clear local-host command, and more data is produced.
6-131
Chapter 6 logging
Command Reference
logging
Enable or disable syslog and SNMP logging. (Configuration mode.) logging on no logging on
logging buffered level no logging buffered
logging console level no logging console
logging facility facility no logging facility facility
logging history level no logging history level
logging host [in_if_name] ip_address [protocol /port] no logging host [in_if_name] ip_address
logging message syslog_id no logging message syslog_id
clear logging disabled show logging disabled
logging monitor level no logging monitor level
6-132
78-10392-02
Chapter 6
Command Reference logging
logging queue messages no logging queue messages show logging queue
logging timestamp no logging timestamp
logging trap level no logging trap level
show logging clear logging

Syntax Description
on
Start sending syslog messages to all output locations. Stop all logging with the no logging on command. Send syslog messages to an internal buffer that can be viewed with the show logging command. Use the clear logging command to clear the message buffer. New messages append to the end of the buffer. Specify the syslog message level as a number or string. The level you specify means that you want that level and those less than the level. For example, if level is 3, syslog displays 0, 1, 2, and 3 messages. Possible number and string level values are:

buffered
level
0emergenciesSystem unusable messages 1alertsTake immediate action 2criticalCritical condition 3errorsError message 4warningsWarning message 5notificationsNormal but significant condition 6informationalInformation message 7debuggingDebug messages and log FTP commands and WWW URLs
console
Specify that syslog messages appear on the PIX Firewall console as each message occurs. You can limit the types of messages that appear on the console with level. Cisco recommends that you do not use this command in production mode because its use degrades PIX Firewall performance.
6-133
Chapter 6 logging
Command Reference
facility facility
Specify the syslog facility. The default is 20. Eight facilities LOCAL0(16) through LOCAL7(23); the default is LOCAL4(20). Hosts file the messages based on the facility number in the message. Set the SNMP message level for sending syslog traps. This command is new in version 5.1. Specify a syslog server that will receive the messages sent from the PIX Firewall. You can use multiple logging host commands to specify additional servers that would all receive the syslog messages. However a server can only be specified to receive either UDP or TCP, not both. PIX Firewall only sends TCP syslog messages to the PIX Firewall Syslog Server. Interface on which the syslog server resides. Syslog servers IP address. The protocol over which the syslog message is sent; either tcp or udp. PIX Firewall only sends TCP syslog messages to the PIX Firewall Syslog Server. You can only view the port and protocol values you previously entered by using the write terminal command and finding the command in the listingthe TCP protocol is listed as 6 and the UDP protocol is listed as 17. The port from which the PIX Firewall sends either UDP or TCP syslog messages. This must be same port at which the syslog server. For the UDP port, the default is 514 and the allowable range for changing the value is 1025 through 65535. For the TCP port, the default is 1470, and the allowable range is 1025 through 65535. Specify a message to be allowed. Use with the no command to suppress a message. Use the clear logging disabled command to reset the disallowed messages to the original set. Use the show message disabled command to list the suppressed messages you specified with the no logging message command. All syslog messages are permitted unless explicitly disallowed. The PIX Startup begin message cannot be blocked and neither can more than one message per command statement. Specify a message number to disallow or allow. If a message is listed in syslog as %PIX-1-101001, use 101001 as the syslog_id. Refer to the System Log Messages for the Cisco Secure PIX Firewall Version 5.1 guide for message numbers. PIX Firewall documentation is available online at: www.cisco.com/univercd/cc/td/doc/product/iaabu/pix
history
host
in_if_name ip_address protocol
port
message
syslog_id
disabled
Clear or display suppressed messages. You can suppress messages with the no logging message syslog_id command. Specify that syslog messages appear on Telnet sessions to the PIX Firewall console.
monitor
6-134
78-10392-02
Chapter 6
queue messages
Specify the number of syslog messages permitted to be queued before being processed. The messages parameter defaults to 512, 0 (zero) indicates unlimited, and the minimum is one message. The maximum number of messages is limited by available memory. Use the show logging queue command to determine the number of messages in the queue. Specify that syslog messages sent to the syslog server should have a time stamp value on each message. Set logging level only for syslog messages. Clear the buffer for use with the logging buffered command. List which logging options are enabled. If the logging buffered command is in use, the show logging command lists the current message buffer.
timestamp
trap clear show
Usage Guidelines
The logging command lets you enable or disable sending informational messages to the console, to a syslog server, or to an SNMP management station. New in version 5.1, set the SNMP message level with the logging history command, and set the syslog message level with the logging trap command. Also new in version 5.1 is the logging queue and show logging queue commands. The logging queue command lets you specify the size of the syslog message queue, the messages waiting to be processed. When traffic is heavy, messages may be discarded. The show logging queue command lists the number of messages in the queue, the most number that have been in the queue, and the number of messages discarded because block memory was not available to process them. Refer to the Examples section on this command page for an example of these commands. You can also use this guide to get the message numbers that can be individually suppressed with the logging message command.
Important Notes
1.
Do not use the logging console command when the PIX Firewall is in production mode because it degrades system performance. By default, this command is disabled. Instead, use the logging buffered command to start logging, the show logging command to view the messages, and the clear logging command to clear the buffer to make viewing the most current messages easier. PIX Firewall provides more information in messages sent to a syslog server than at the console, but the console provides enough information to permit effective troubleshooting. The logging timestamp command requires that the clock command be set. The no logging message command cannot block the %PIX-6-199002: PIX startup completed. Beginning operation. syslog message. The aaa authentication enable console command causes syslog messages to be sent (at syslog level 4) each time the configuration is changed from the serial console.
2. 3. 4. 5.
See also: ca, telnet, terminal
6-135
Chapter 6 logging
Command Reference
Viewing Syslog Messages from the Console
Follow these steps to view syslog messages from the PIX Firewall console:
Step 1
Store syslog messages for display at the PIX Firewall console with the following command:
logging buffered 7
The value 7 causes all syslog message levels to be stored in the buffer. If preferred, set the value to a lower number to view fewer messages. Refer to Appendix A of the System Log Messages for the Cisco Secure PIX Firewall Version 5.1 guide for a list of messages that appear at each severity level.
Step 2
View the messages with:

show logging
Step 3 Step 4
Use the clear logging command to clear the buffer so that viewing new messages is easier. To disable storing messages, use the no logging buffered command. New messages appear at the end of the logging listing.
Viewing Syslog Messages from a Telnet Console Session
Follow these steps to view syslog messages from a Telnet console session:
Step 1
If you have not done so already, configure the PIX Firewall to let a host on an internal interface access the PIX Firewall with the telnet command. If you have IPSec enabled, you can access the Telnet console from the outside interface. For example, if a host on the inside interface has the IP address 192.168.1.2, the command would be:
telnet 192.168.1.2 255.255.255.255 inside
You can also set the duration that a Telnet session can be idle before PIX Firewall disconnects the session to a value greater than the default of 5 minutes. A good value is at least 15 minutes, which you can set as follows:
telnet timeout 15
Step 2
Start Telnet from the host and specify the inside interface of the PIX Firewall. For example, if the inside interface of the PIX Firewall is 192.168.1.1, the command to start Telnet on a Windows system would be:
telnet 192.168.1.1
Step 3 Step 4 Step 5 Step 6 Step 7
When Telnet connects, the PIX Firewall prompts you with the PIX password, which is cisco by default. Start message logging with the logging monitor command.
passwd:
prompt. Enter the Telnet
Use the enable command followed by the configure terminal command to get to configuration mode. Display messages directly to the Telnet session by entering the terminal monitor command. You can disable directly displaying messages by entering the terminal no monitor command. Trigger some events by pinging a host or starting a web browser. The syslog messages then appear in the Telnet session window.
6-136
78-10392-02
Chapter 6
Step 8
When done, disable this feature with these commands:

terminal no monitor no logging monitor
Sending Syslog Messages to a Syslog Server
PIX Firewall can send syslog messages to any syslog server. In the event that all syslog servers are offline, PIX Firewall stores up to 100 messages in its memory. Subsequent messages that arrive overwrite the buffer starting from the first line. Follow these steps to send messages to a syslog server:
Step 1
Designate a host to receive the messages with the logging host command as shown in the following example:
logging host interface address [protocol/port]
Replace interface with the interface on which the server exists and address with the IP address of the host. An example logging host command is as follows:
logging host outside 209.165.201.5
If the syslog server is receiving messages on a non-standard port, you can replace protocol with udp and port with the new port value. The default protocol is UDP with a default port of 514. You can also specify TCP with a default of 1468. To date, there is only one TCP syslog server, the Cisco PIX Firewall Syslog Server (PFSS). See PIX Firewall Syslog Server (PFSS) for more information. Only one logging host UDP or TCP command statement is permitted for a specific syslog server. A subsequent command statement overrides the previous one. Use the write terminal command to view the logging host command statement in the configurationthe UDP option is shown as 17 and the TCP option as 6.
Step 2
Set the logging level with the logging trap command; for example:
logging trap debugging
Cisco recommends that you use the debugging level during initial setup and during testing. Thereafter, set the level from debugging to errors for production use.
Step 3
If needed, set the logging facility command to a value other than its default of 20. Most UNIX systems expect the messages to arrive at facility 20, which receives the messages in the local4 receiving mechanism. Start sending messages with the logging on command. To disable sending messages, use the no logging on command. If you want to send time stamped messages to a syslog server, use the clock set command to set the PIX Firewall system clock and the logging timestamp command to enable time stamping. For example:
clock set 14:25:00 apr 1 1999 logging timestamp
Step 4 Step 5
In this example, the clock is set to the current time of 2:25 pm on April 1, 1999, and time stamping is enabled. To disable timestamp logging, use the no logging timestamp command.
6-137
Chapter 6 logging
Command Reference
Receiving SNMP Requests
Follow these steps for the PIX Firewall to receive requests from an SNMP management station:
Step 1 Step 2
Identify the IP address of the SNMP management station with the snmp-server host command. Set the snmp-server options for location, contact, and the community password as required.
Sending SNMP Traps to an SNMP Management Station
Refer to Chapter 3, Advanced Configurations, for information on SNMP traps. Follow these steps to send traps to an SNMP management station:
Step 1
If not performed already, configure both steps described in Receiving Requests. If you only want to send the cold start, link up, and link down generic traps, no further configuration is required.
Step 2 Step 3
Add an snmp-server enable traps command statement. Set the logging level with the logging history command for the level of syslog traps you wish to send; for example:
logging history debugging
Cisco recommends that you use the debugging level during initial set up and during testing. Thereafter, set the level from debugging to a lower value for production use.
Step 4 Step 5
Start sending syslog traps to the management station with the logging on command. To disable sending syslog traps, use the no logging on command or the no snmp-server enable traps command.
Suppressing Syslog Messages
Follow these steps to suppress syslog messages:

Step 1
Determine which syslog message needs to be suppressed by either observing a message whose frequency is overwhelming a message facility or by viewing the System Log Messages for the Cisco Secure PIX Firewall Version 5.1. Use the no logging message command to suppress the message; for example:
no logging message 103012
Step 2
Step 3 Step 4
To view all messages that are disabled, use the show logging disabled command. You can also view an individually disabled message with the show logging message syslog_id command. To send all messages, use the clear logging disabled command. Or you can return individual messages back to use with the logging message command.
6-138
78-10392-02
Chapter 6
For example, to suppress the following message:

%PIX-6-305002: Translation built for gaddr IP_addr to IP_addr
Use the following command to stop this message from being sent to the syslog server:
no logging message 305002
You can view all disabled messages or just one with the following commands:
show logging disabled no logging message 305002 show logging message 305002 syslog 305002 disabled
If you want to let the message resume being sent, use the following command:
logging message 305002
Additional logging Command Information
The PIX Firewall generates syslog messages for system events, such as security alerts and resource depletion. Using a UNIX syslog facility, you can specify which types of syslog messages create email alerts, are stored in log files, or display on the console of a designated inside network host. Use the logging monitor command to determine what messages display in a Telnet session to the PIX Firewall console. To disable messages for a specific session, use the terminal no monitor command. Because the PIX Firewall shares the eight facilities with other UNIX network devices, the logging facility command lets you choose the facility that the PIX Firewall marks on each message it sends to the syslog host. Messages are sent to the syslog host over UDP. Use the show logging command to view the current syslog hosts and previously sent messages.
PIX Firewall Syslog Server (PFSS)
The PIX Firewall Syslog Server (PFSS) provides a syslog server that runs from a Windows NT system and receives TCP and UDP syslog messages from up to 10 PIX Firewalls. This server is provided at no charge from Cisco Connection Online (CCO). Use of the PFSS gives you the additional benefit of reliability through receiving TCP event messages and being able to monitor whether the server is up or down from the PIX Firewall. Installation instructions for the PFSS are provided in the Installation Guide for the Cisco Secure PIX Firewall Version 5.1.
Note
The Windows NT filesystem where you install PFSS must be an NTFS partition and not FAT. The Windows NT system must run version 4.0 with Service Pack 3 installed. You can configure the PIX Firewall to send syslog messages via UDP or TCP. If syslog messages are sent using TCP, and if the Windows NT partition in which the log files are stored runs out of disk space, the PIX Firewall stops all traffic until the disk space is freed. When this occurs, and you want to restart use of the PIX Firewall, you can need to stop logging to the Windows NT system by entering a no logging host command statement, then start logging to another PFSS server. If you configure the PIX Firewall to send syslog messages using UDP, the PIX Firewall operates normally regardless of the ability of the PFSS to receive messages. Windows NT installation and configuration instructions for the PIX Firewall Syslog Server (PFSS) are described in the Installation Guide for the Cisco Secure PIX Firewall Version 5.1.
6-139
Chapter 6 logging
Command Reference
Note
PFSS and the PIX Firewall Manager cannot be used together even if installed on separate Windows NT systems. PFSS creates seven rotating syslog files monday.log, tuesday.log, wednesday.log, thursday.log, friday.log, saturday.log, and sunday.log. If a week has passed since the last log file was created, it will rename the old log file to day.mmddyy where day is the current day, mm is the month, dd is the day, and yy is the year. PFSS also creates the pfss.log file where all values are stored. If the Windows NT file system is full, the PIX Firewall Syslog Server disables all TCP connections from the PIX Firewall by closing its TCP listen socket. The PIX Firewall tries to re-connect to the PIX Firewall Syslog Server five times, and during the retry, it stops all new connections through the PIX Firewall. If the TCP connection cannot be re-established, the status of the host log is set to disable after the fifth attempt.
Changing Windows NT PFSS Parameters
Follow these steps to change Windows NT PFSS parameters:

Step 1
You can view previously set PFSS timer values by listing the pfss.log file with a program such as Notepad. This file is stored in the same directory that you specified for the log files when you installed PFSS. On the Windows NT system, click the PIX Firewall Syslog Server entry from the Start>Settings>Control Panel>Services menu. You can add commands to the Startup Parameters edit box. After you enter a command, click Start. If you press the Enter key, the menu closes without information being accepted. Change the values by entering one of these commands:
-d %_disk_fullThe
Step 2
Step 3
maximum percentage of how full the Windows NT disk can be before the Windows NT system sends a message to the PIX Firewall telling it to stop transmissions. This is an integer value in the range of 1 to 100. The default is 90.
-t tcp_portthe -u udp_portthe
port used by the Windows NT system to listen for TCP syslog messages, the default is 1468. If you specify another port, it must be in the range of 1024 to 65535. port used by the Windows NT system to listen for UDP syslog messages, the default is 514. If you specify another port, it must be in the range of 1024 to 65535.
-e disk_empty_watch_timerthe -f disk_full_watch_timerthe
duration in seconds that PFSS waits between checks to see if the disk partition is still empty. The default is 5 seconds, the range is any number greater than zero. duration in seconds that PFSS waits between checks to see if the disk partition is still full. The default is 3 seconds, the range is any number greater than zero.
Note
Whatever TCP and UDP port values you set at the Windows NT system with the -t and -u commands must also be set at the PIX Firewall in the logging host command statements.
6-140
78-10392-02
Chapter 6
Recovering After the Windows NT Disk is Full
Follow these steps to recover from a disk full situation:

Step 1 Step 2
On the Windows NT system, move the old logs to a new file system (or back up and remove them). Make sure this creates enough free disk space for more log messages. On the PIX Firewall enter configuration mode and check that the PFSS host is correctly disabled from the PIX Firewall by entering the show logging command and look for host interface ip_address protocol/port disable. The disable keyword means that no new connections are allowed through the PIX Firewall. Disable logging to the PFSS host by entering the no logging host interface ip_address command for the disabled host. Re-enable logging by entering the logging host interface ip_address protocol/port commands for the disabled host. Check that the PFSS host is now enabled by reentering the show logging command. The disable keyword should now be gone. Use the show conn command to determine if new connections have started. If none have, start a Telnet or FTP session through the PIX Firewall to start new connections.
Step 3 Step 4 Step 5 Step 6
Examples
The following example shows how to start console logging and view the results:
logging buffered debugging show logging Syslog logging: enabled Timestamp logging: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 37 messages logged Trap logging: disabled 305001: Portmapped translation built for gaddr 209.165.201.5/0 laddr 192.168.1.2/256 ...
The line of output starting with 305001 shows a translation to a PAT global through global address 209.165.201.5 from a host at 192.168.1.2. The 305001 identifies a syslog message for creating a translation through a PAT global. Refer to System Log Messages for the Cisco Secure PIX Firewall Version 5.1 for more information on syslog messages. You can view this document online at the following site: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v51/syslog/index.htm The next example lists the output of the logging queue and show logging queue commands:
logging queue 0 show logging queue Logging Queue length limit : Unlimited Current 5 msg on queue, 3513 msgs most on queue, 1 msg discard.
In this example, the logging queue command is set to 0, which means you want an unlimited number of messages; in other words, all syslog messages, to be processed. The show logging queue command shows that 5 messages are queued, 3513 messages was the greatest number of messages in the queue at one time since the PIX Firewall was last booted, and that 1 message was discarded. Even though set for unlimited, should the amount of block memory be exhausted, messages can still be discarded.
6-141
Chapter 6 mtu
Command Reference
mtu
Specify the MTU (maximum transmission unit) for an interface. (Configuration mode.) mtu if_name bytes no mtu [if_name bytes] show mtu
Syntax Description
if_name bytes
The internal or external network interface name. The number of bytes in the MTU, in the range of 64 to 65,535 bytes. The value specified depends on the type of network connected to the interface.
Usage Guidelines
The mtu command sets the size of data sent on a connection. Data larger than the MTU value is fragmented before being sent. The minimum value for bytes is 64 and the maximum is 65,535 bytes. PIX Firewall supports the IP Path MTU Discovery mechanism, as defined in RFC 1191. IP Path MTU Discovery allows a host to dynamically discover and cope with differences in the maximum allowable maximum transmission unit (MTU) size of the various links along the path. Sometimes a PIX Firewall is unable to forward a datagram because it requires fragmentation (the packet is larger than the MTU you set for the interface), but the don't fragment (DF) bit is set. The network software sends a message to the sending host, alerting it to the problem. The host will have to fragment packets for the destination so that they fit the smallest packet size of all the links along the path. For Ethernet interfaces, the default MTU is 1,500 bytes in a block, which is also the maximum. This value is sufficient for most applications, but you can pick a lower number if network conditions warrant it. For Token Ring and FDDI, the default is 8,192 bytes. The no mtu command resets the MTU block size to 1,500 for Ethernet interfaces and 8,192 for Token Ring. The show mtu command displays the current block size. The show interface command also shows the MTU value.
Examples
The following example shows use of the mtu command for use with Token Ring and Ethernet:
interface token-ring0 16mbps interface ethernet0 auto mtu inside 8192 show mtu mtu outside 1500 mtu inside 8192
6-142
78-10392-02
Chapter 6
Command Reference name/names
name/names
Associate a name with an IP address. (Configuration mode.) name ip_address name no name [ip_address name] names no names clear names show names
Syntax Description
ip_address name
The IP address of the host being named. The name assigned to the IP address. Allowable characters are a to z, A to Z, 0 to 9, a dash, and an underscore. The name cannot start with a number. If the name is over 16 characters long, the name command fails.
Usage Guidelines
Use the name command to identify a host by a text name. The names you define become like a host table local to the PIX Firewall. Because there is no connection to DNS or /etc/hosts on UNIX servers, use of this command is a mixed blessingit makes configurations much more readable but introduces another level of abstraction to administer; not only do you have to add and delete IP addresses to your configuration as you do now, but with this command, you need to ensure that the host names either match existing names or you have a map to list the differences. The names command enables use of the name command to map text strings to IP addresses. The clear names and no names commands are the same and disable use of the name text strings. The show names command lists the name command statements in the configuration.
Notes
1. 2. 3. 4. 5.
You must first use the names command before using the name command. Use the name command immediately after the names command and before you use the write memory command. To disable displaying name values, use no names. Only one name can be associated with an IP address. Both name and names command statements are saved in the configuration. While the name command will let you assign a name to a network mask, no other PIX Firewall command requiring a mask will let you use the name as a mask value. For example, the following command is accepted:
name 255.255.255.0 class-C-mask
But, none of the commands in which a mask is required can process the class-C-mask as a accepted network mask.
6-143
Chapter 6 name/names
Command Reference
Examples
In the example that follows, the names command enables use of the name command. The name command substitutes pix_inside for references to 192.168.42.3, and pix_outside for 209.165.201.3. The ip address commands use these names while assigning IP addresses to the network interfaces. The no names command disables the name values from displaying. Subsequent use of the names command restores their display:
names name 192.168.42.3 pix_inside name 209.165.201.3 pix_outside ip address inside pix_inside 255.255.255.0 ip address outside pix_outside 255.255.255.224 show ip address inside ip address pix_inside mask 255.255.255.0 outside ip address pix_outside mask 255.255.255.224 no names show ip address inside ip address 192.168.42.3 mask 255.255.255.0 outside ip address 209.165.201.3 mask 255.255.255.224 names show ip address inside ip address pix_inside mask 255.255.255.0 outside ip address pix_outside mask 255.255.255.224
6-144
78-10392-02
Chapter 6
Command Reference nameif
nameif
Name interfaces and assign security level. (Configuration mode.) nameif hardware_id if_name security_level show nameif
Syntax Description
hardware_id
The hardware name for the network interface that specifies the interfaces slot location on the PIX Firewall motherboard. Interface boards are numbered from the leftmost slot nearest the power supply as slot 0. The internal network interface must be in slot 1. The lowest security_level external interface board is in slot 0 and the next lowest security_level external interface board is in slot 2. Possible choices are ethernetn for Ethernet or token-ringn for Token Ring. The internal interface is ethernet1. These names can be abbreviated with any leading characters in the name; for example, ether1, e2, token0, or t0.
if_name
A name for the internal or external network interface of up to 48 characters in length. This name can be uppercase or lowercase. By default, PIX Firewall names the inside interface inside, the outside interface outside, and any perimeter interface intfn where n is 2 through 5. Either 0 for the outside network or 100 for the inside network. Perimeter interfaces can use any number between 1 and 99. By default, PIX Firewall sets the security level for the inside interface to security100 and the outside interface to security0. The first perimeter interface is initially set to security10, the second to security15, the third to security20, and the fourth perimeter interface to security25 (a total of 6 interfaces are permitted, with a total of 4 perimeter interfaces permitted). For access from a higher security to a lower security level, nat and global commands or static commands must be present. For access from a lower security level to a higher security level, static and access-list commands must be present. Interfaces with the same security level cannot communicate with each other. We recommend that every interface have a unique security level.
security_level
Usage Guidelines
The nameif command lets you assign a name to an interface. You can use this command to assign interface names if you have more than two network interface circuit boards in your PIX Firewall. The first two interfaces have the default names inside and outside. The inside interface has default security level 100, the outside interface has default security level 0.
Usage Notes
1. 2. 3.
After changing a nameif command, use the clear xlate command. The inside interface cannot be renamed or given a different security level. The outside interface can be renamed, but not given a different security level. An interface is always external with respect to another interface that has a higher security level.
6-145
Chapter 6 nameif
Command Reference
4.
Up to 6 Ethernet interfaces are supported; up to 2 FDDI interfaces are supported. Refer to the Installation Guide for the Cisco Secure PIX Firewall Version 5.1 for additional caveats.
See also: interface.

Examples
The following example shows use of the nameif command:

nameif ethernet2 perimeter1 sec50 nameif ethernet3 perimeter2 sec20
6-146
78-10392-02
Chapter 6
Command Reference nat
nat
Associate a network with a pool of global IP addresses. (Configuration mode.) nat [(if_name)] nat_id local_ip [netmask [max_conns [em_limit]]] [norandomseq] nat [(if_name)] 0 access-list acl_name nat [(if_name)] 0 local_ip [netmask [max_conns [em_limit]]] [norandomseq] no nat [[(if_name)] nat_id local_ip [netmask [max_conns [em_limit]]]] [norandomseq] no nat [(if_name)] 0 access-list acl_name show nat
Syntax Description
if_name
The internal network interface name. If the interface is to to associated with an access list, then the if_name is the higher security level interface name.
nat_id
All nat command statements with the same nat_id are in the same nat group. Use the nat_id in the global command statement; for example:
nat (perimeter) 1 0 0 global (outside) 1 209.165.201.1-209.165.201.30 netmask 255.255.255.224
This example associates the nat command with the global command via the nat_id. The nat_id is an arbitrary positive number between 0 and two billion. This number can be the same as the ID used with the outbound and apply commands. Specify 0 with IP addresses and netmasks to identify internal networks that desire only outbound identity address translation. Specify 0 with the access-list option to specify traffic that should be exempted from NAT. access-list local_ip Associate an access-list command statements to the nat 0 command. Internal network IP address to be translated. You can use 0.0.0.0 to allow all hosts to start outbound connections. The 0.0.0.0 local_ip can be abbreviated as 0. Network mask for local_ip. You can use 0.0.0.0 to allow all outbound connections to translate with IP addresses from the global pool. The maximum TCP connections permitted from the interface you specify. The embryonic connection limit. The default is 0, which means unlimited connections. Set it lower for slower systems, higher for faster systems. Do not randomize the TCP packets sequence number. Only use this option if another inline firewall is also randomizing sequence numbers and the result is scrambling the data. Use of this option opens a security hole in the PIX Firewall.
netmask
max_conns em_limit
norandomseq
6-147
Chapter 6 nat
Command Reference
Usage Guidelines
The nat command lets you enable or disable address translation for one or more internal addresses. Address translation means that when a host starts an outbound connection, the IP addresses in the internal network are translated into global addresses. Network Address Translation (NAT) lets your network have any IP addressing scheme and the firewall protects these addresses from visibility on the external network. The nat (if_name) 0 access-list acl_name command lets you exempt traffic that is matched by the access-list command statements from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command. The extent to which the inside hosts are accessible from the outside depends on the access-list command statements that permit inbound access. The if_name is the higher security level interface name. The acl_name is the name you use to identify the access-list command statement.
Note
The new access-list option changes the behavior of the nat 0 command. (Without the access-list option, the command is backward compatible with previous versions.) Previously, nat 0 implemented the identity feature; this new version of the command disables NAT. Specifically, the new behavior disables proxy ARPing for the IP addresses in the nat 0 command statement.
Note
The access list you specify with the nat 0 access-list command will not work with an access-list command statement that contains a port specification. The following sample command statements will not work:
access-list no-nat permit tcp host xx.xx.xx.xx host yy.yy.yy.yy nat (inside) 0 access-list no-nat
After changing or removing a nat command statement, use the clear xlate command. The connection limit lets you set the maximum number of outbound connections that can be started with the IP address criteria you specify. The embryonic connection limit lets you prevent a type of attack where processes are started without being completed. An embryonic connection is a connection that someone attempted but has not completed and has not yet seen data. Every connection is embryonic until it sets up. You can use the no nat command to remove a nat command statement and you can use the show nat command to view nat command statements in the current configuration. Table 6-6 helps you decide when to use the nat or static commands for access between the various interfaces in the PIX Firewall. For this table, assume that the security levels are 40 for dmz1 and 60 for dmz2.
Table 6-6 Interface Access Commands by Interface
From This Interface inside inside inside dmz1
To This Interface outside dmz1 dmz2 outside
Use This Command nat nat nat nat
From This Interface dmz2 dmz2 dmz2 outside
To This Interface outside dmz1 inside dmz1
Use This Command nat nat static static
6-148
78-10392-02
Chapter 6
Command Reference nat
Table 6-6
Interface Access Commands by Interface (continued)
From This Interface dmz1 dmz1
To This Interface dmz2 inside
Use This Command static static
From This Interface outside outside
To This Interface dmz2 inside
Use This Command static static
The rule of thumb is that for access from a higher security level interface to a lower security level interface, use the nat command. From lower security level interface to a higher security level interface, use the static command.
Usage Notes
1.
You can enable identity address translation with the nat 0 command. Use this command when you have IP addresses that are the same as those used on more than one interface. Adaptive Security remains in effect with the nat 0 command. The extent to which the inside hosts are accessible from the outside depends on the access-list command statements that permit inbound access. Addresses on each interface must be on a different subnet. See Appendix D, Subnet Masking and Addressing, for more information on subnetting. The nat 0 10.2.3.0 command means let those IP addresses in the 10.2.3.0 net appear on the outside without translation. All other hosts are translated depending on how their nat command statements appear in the configuration.
2.
The nat 1 0 0 command means that all outbound connections can pass through the PIX Firewall with address translation. If you use the nat (inside) 1 0 0 command, users can start connections on any interface with a lower security level, on the both perimeter interfaces and the outside interface. With NAT in effect, you must also use the global command statement to provide a pool of addresses through which translated connections pass. In effect, you use the nat command statement to specify from which interface connections can originate and you use the global command statement to determine at which interface connections can occur. The NAT ID must be the same on the nat and global command statements. The nat 1 10.2.3.0 command means that only outbound connections originating from the inside host 10.2.3.0 can pass through the firewall to go to their destinations with address translation.
3.
See also: global, outbound, apply.

Examples
The following example specifies with nat command statements that all the hosts on the 10.0.0.0 and 3.3.3.0 inside networks can start outbound connections. The global command statements create a pool of global addresses:
nat (inside) 1 10.0.0.0 255.0.0.0 global (outside) 1 209.165.201.25-209.165.201.27 netmask 255.255.255.224 global (outside) 1 209.165.201.30 nat (inside) 3 10.3.3.0 255.255.255.0 global (outside) 3 209.165.201.10-209.165.201.25 netmask 255.255.255.224
6-149
Chapter 6 nat
Command Reference
When using the nat 0 command, if you want the addresses to be visible from the outside network, use static and access-list command statements:
nat (inside) 0 209.165.201.0 255.255.255.224 static (inside, outside) 209.165.201.0 209.165.201.0 netmask 255.255.255.224 access-list acl_out permit host 10.0.0.1 209.165.201.0 255.255.255.224 eq ftp access-group acl_out in interface outside nat (inside) 0 209.165.202.128 255.255.255.224 static (inside, outside) 209.165.202.128 209.165.202.128 netmask 255.255.255.224 access-list acl_out permit tcp host 10.0.0.1 209.165.202.128 255.255.255.224 eq ftp access-group acl_out in interface outside
The following example shows use of the nat 0 access-list command to permit internal host 10.1.1.15, accessible through inside interface, inside, to bypass NAT when connecting to outside host 10.2.1.3.
access-list no-nat permit ip host 10.1.1.15 host 10.2.1.3 nat (inside) 0 access-list no-nat
The following will disable all NAT on a PIX Firewall with three interfaces:
access-list all-ip-packet permit ip 0 0 0 0 nat (dmz) 0 access-list all-ip-packet nat (inside) 0 access-list all-ip-packet
6-150
78-10392-02
Chapter 6
Command Reference outbound/apply
outbound/apply
Create an access list for controlling Internet use. (Configuration mode.) outbound list_ID permit | deny ip_address [netmask [java | port[-port]]] [protocol] outbound list_ID except ip_address [netmask [java | port[-port]]] [protocol] clear outbound no outbound [list_ID permit | deny ip_address [netmask [java | port[-port]]] [protocol]] no outbound [list_ID except ip_address [netmask [java | port[-port]]] [protocol]] show outbound apply [(if_name)] list_ID outgoing_src | outgoing_dest clear apply no apply [[(if_name)] list_ID outgoing_src | outgoing_dest] show apply [(if_name)] [list_ID outgoing_src | outgoing_dest]
Syntax Description
list_ID
A tag number for the access list. The access list number you use must be the same for the apply and outbound commands. This value must be a positive number. This number can be the same as what you use with nat and global. This number is just an arbitrary number that groups outbound command statements to an apply command statement. Allow the access list to access the specified IP address and port. Deny the access list access to the specified IP address and port. Create an exception to a previous outbound command. An except command statement applies to permit or deny command statements only with the same access list ID. When used with apply outgoing_src, the IP address of an except command statement applies to the destination address. When used with apply outgoing_dest, the IP address of an except command statement applies to the source address. See Outbound List Rules for more information.
permit deny except
ip_address
The IP address for this access list entry. Do not specify a range of addresses. The 0.0.0.0 ip_address can be abbreviated as 0. The network mask for comparing with the IP address; 255.255.255.0 causes the access list to apply to an entire Class C address. 0.0.0.0 indicates all access. The 0.0.0.0 netmask can be abbreviated as 0.
netmask
6-151
Chapter 6 outbound/apply
Command Reference
port
A port or range of ports that the access list is permitted or denied access to. See the Ports section in Chapter 1, Introduction for a list of valid port literal names. The java keyword indicates port 80 and when used with the deny option, means that the firewall blocks Java applets from being downloaded from ip_address (depending on use of the apply command). Java applets are permitted by default and do not have to be explicitly permitted. Limit outbound access to udp, tcp, or icmp protocols. If a protocol is not specified, the default is tcp. The network interface originating the connection. Deny or permit an internal IP address the ability to start outbound connections using the service(s) specified in the outbound command. Deny or permit access to an external IP address using the service(s) specified in the outbound command.
java
protocol
if_name outgoing_src
outgoing_dest
Usage Guidelines
The outbound command creates an access list that lets you specify the following:

Whether inside users can create outbound connections Whether inside users can access specific outside servers What services inside users can use for outbound connections and for accessing outside servers Whether outbound connections can execute Java applets on the inside network
Outbound lists are filters on outgoing packets from the PIX Firewall. The filter can be based on the source IP address, the destination IP address, and the destination port/protocol as specified by the rules. The use of an outbound command requires use of the apply command. The apply command lets you specify whether the access control list applies to inside users ability to start outbound connections with apply commands outgoing_src option, or whether the access list applies to inside users ability to access servers on the outside network with the apply commands outgoing_dest option.
Note
The outbound command has been superseded by the access-list command. We recommend that you migrate your outbound command statements to access-list command statements to maintain future compatibility.
Note
The outbound java command has been superseded by the filter java command. We recommend that you migrate your outbound java command statements to filter java command statements to maintain future compatibility. After adding, removing, or changing outbound command statements, use the clear xlate command. Use the no outbound command to remove a single outbound command statement from the configuration. Use the clear outbound command to remove all outbound command statements from the configuration. The show outbound command displays the outbound command statements in the configuration.
6-152
78-10392-02
Chapter 6
Use the no apply command to remove a single apply command statement from the configuration. Use the clear apply command statement to remove all the apply command statements from the configuration. The show apply command displays the apply command statements in the configuration.
Outbound List Rules
Rules, written as outbound list_ID command statements are global to the PIX Firewall, they are activated by apply list_ID outgoing_src | outgoing_dest command statements. When applied to outgoing_src, the source IP address, the destination port, and protocol are filtered. When applied to outgoing_dest, the destination IP address, port, and protocol are filtered. The outgoing_src and outgoing_dest outbound lists are filtered independently. If any one of the filters contain deny, the outbound packet is denied. When multiple rules are used to filter the same packet, the best matched rule takes effect. The best match is based on the IP address mask and the port range check. More strict IP address masks and smaller port ranges are considered a better match. If there is a tie, a permit overrides a deny. Rules are grouped by a list_ID. Within each list_ID, except rules (that is, outbound n except ) can be set. The except option reverses the best matched rule of deny or permit. In addition, PIX Firewall filters the specified IP address and mask in the rule for the destination IP address of the outbound packet if the list is applied to the outbound_src. Alternatively, PIX Firewall filters the source IP address if the list is applied to the outgoing_dest. Furthermore, the except rules only apply to rules with the same list_ID. A single except rule within a list_ID without another permit or deny rule has no effect. If multiple except rules are set, the best match is checked for which except to apply. The outbound command rules are now sorted by the best match checking. Use the show outbound command to see how the best match is judged by the PIX Firewall.
Usage Notes
1. 2. 3.
If outbound commands are not specified, the default behavior is to permit all outbound traffic and services from inside hosts. After adding, changing, or removing an outbound and apply command statement group, use the clear xlate command to make the IP addresses available in the translation table. The outbound commands are processed linearly within a list_ID. In addition, list_IDs are processed sequentially in descending order. For example, the first command statement you specify in an outbound list is processed first, then the next outbound command statement in that list, and so on. Similarly, list_ID 10 is processed before list_ID 20, and so on. When using outbound commands, it is often helpful to deny or permit access to the many before you deny or permit access to the specific. Start with an interface-wide specification such as the following that denies all hosts from starting connections:
outbound 1 deny 0 0 0 apply (inside) 1 outgoing_src
4.
Then add command statements that permit or deny hosts access to specific ports, for example:
outbound 1 deny 0 0 0 outbound 1 permit 10.1.1.1 255.255.255.255 23 tcp outbound 1 permit 10.1.1.1 255.255.255.255 80 tcp apply (inside) 1 outgoing_src
6-153
Command Reference
If you used the except option, you could state this same example as follows:
outbound 1 deny 0 0 0 outbound 1 except 209.165.201.11 255.255.255.255 23 tcp outbound 1 except 209.165.201.11 255.255.255.255 80 tcp apply (inside) 1 outgoing_src
In the preceding outbound except command statement, IP address 209.165.201.11 is the destination IP address, not the source address. This means that everyone is denied outbound access, except those users going to 209.165.201.11 via Telnet (port 23) or HTTP (port 80).
5.
The Java applet blocking feature removes applets that come into the HTTP port. The PIX Firewall removes applets containing a Java signature anywhere in the packet, but does not remove applets encapsulated in some archive files. Legitimate, non-Java files with Java signatures are also blocked. If you permit access to port 80 (http), this also permits Java applets to be downloaded. You must have a specific deny command statement to block Java applets. The maximum number of outbound list entries in a configuration is 2000. Outbound lists have no effect on access-list command statement groups. The use of the access-group command statement overrides the conduit and outbound command statements for the specified interface name.
6. 7. 8. 9.
Examples
The first outbound group sets inside hosts so that they can only see and Telnet to perimeter hosts, and do DNS lookups. In this example, the perimeter network address is 209.165.201.0 and the network mask is 255.255.255.224:
outbound 9 deny 0.0.0.0 0.0.0.0 0 0 outbound 9 except 209.165.201.0 255.255.255.224 23 tcp outbound 9 except 0.0.0.0 0.0.0.0 53 udp
The next outbound group in this same example lets hosts 10.1.1.11 and 10.1.1.12 go anywhere:
outbound outbound outbound outbound outbound 11 11 11 11 11 deny 0.0.0.0 0.0.0.0 0 0 permit 10.1.1.11 255.255.255.255 0 0 permit 10.1.1.12 255.255.255.255 0 0 permit 0.0.0.0 0.0.0.0 21 tcp permit 10.3.3.3 255.255.255.255 143 tcp
This last outbound group in this same example lets hosts on the perimeter only access TCP ports 389 and 30303 and UDP port 53 (DNS). Finally, the apply command statements set the outbound groups so that the permit and deny rules affect access to all external addresses.
outbound outbound outbound outbound 13 deny 0.0.0.0 0.0.0.0 0 0 13 permit 0.0.0.0 0.0.0.0 389 tcp 13 permit 0.0.0.0 0.0.0.0 30303 tcp 13 permit 0.0.0.0 0.0.0.0 53 udp
apply (inside) 9 outgoing_src apply (inside) 11 outgoing_src apply (perim) 13 outgoing_src
6-154
78-10392-02
Chapter 6
Controlling Outbound Connections
The following example prevents all inside hosts from starting outbound connections:
outbound 1 deny 0 0 0 apply (inside) 1 outgoing_src
The 0 0 0 at the end of the command means all IP addresses (0 is the same as 0.0.0.0), with a 0.0.0.0 subnet mask and for all services (port value is zero). Conversely, the following example permits all inside hosts to start connections to the outside (this is the default if an access list is not created):
outbound 1 permit 0 0 0 apply (inside) 1 outgoing_src
Controlling Inside Hosts Access to Outbound Services
The following example prevents inside host 192.168.1.49 from accessing the World Wide Web (port 80):
outbound 11 deny 192.168.1.49 255.255.255.255 80 tcp apply (inside) 11 outgoing_src
Controlling Inside Hosts Access to Outside Servers
If your employees are spending too much time examining GIF images on a particular site with two web servers, you can use the following example to restrict this access:
outbound 12 deny 192.168.146.201 255.255.255.255 80 tcp outbound 12 deny 192.168.146.202 255.255.255.255 80 tcp apply (inside) 12 outgoing_dest
Preventing Use of Java Applets
The following example prevents all inside users from executing Java applets on the inside network:
outbound 1 deny 0 0 java apply (inside) 1 outgoing_src
Using except Command Statements
An except command statement only provides exception to items with the same list_ID. Consider the following example:
outbound outbound outbound outbound outbound outbound outbound outbound outbound outbound outbound outbound 9 deny 0.0.0.0 0.0.0.0 0 0 9 except 10.100.0.0 255.255.0.0 23 tcp 9 except 0.0.0.0 0.0.0.0 53 udp 11 deny 0.0.0.0 0.0.0.0 0 0 11 permit 10.1.1.11 255.255.255.255 0 0 11 permit 10.1.1.12 255.255.255.255 0 0 11 permit 0.0.0.0 0.0.0.0 21 tcp 11 permit 10.3.3.3 255.255.255.255 143 tcp 13 deny 0.0.0.0 0.0.0.0 0 0 13 permit 0.0.0.0 0.0.0.0 389 tcp 13 permit 0.0.0.0 0.0.0.0 30303 tcp 13 permit 0.0.0.0 0.0.0.0 53 udp
In the preceding examples, the following two command statements work against other command statements in list 9 but not in lists 11 and 13:
outbound 9 except 10.100.0.0 255.255.0.0 23 tcp outbound 9 except 0.0.0.0 0.0.0.0 53 udp
6-155
Command Reference
In the following example, the set of deny, permit, and except option command statements denies everybody from connecting to external hosts except for DNS queries and Telnet connections to hosts on 10.100.0.0. The host with IP address 10.1.1.11 is permitted outbound access, and has access to everywhere except to 10.100.0.0 via Telnet and anywhere to use DNS:
outbound 1 deny 0.0.0.0 0.0.0.0 0 tcp outbound 1 permit 10.1.1.11 255.255.255.255 0 tcp outbound 1 except 10.100.0.0 255.255.0.0 23 tcp outbound 1 except 0.0.0.0 0.0.0.0 53 udp apply (inside) outgoing_src
6-156
78-10392-02
Chapter 6
Command Reference pager
pager
Enable or disable screen paging. (Privileged mode.) pager [lines number] clear pager no pager show pager
Syntax Definition
number
The number of lines before the More prompt appears. The minimum is 1. Use 0 to disable paging.
Usage Guidelines
The pager lines command lets you specify the number of lines in a page before the More prompt appears. The pager command enables display paging, and no pager disables paging and lets output display completely without interruption. If you set pager lines to some value and want to revert back to the default, enter the pager command without options. The clear pager command resets the number of lines in a page to 24. Use pager 0 to disable paging. The show pager command displays pager status. When paging is enabled, the following prompt appears:
<--- More --->

To view another screenful, press the Space bar. To view the next line, press the Enter key.
To return to the command line, press the q key.

Examples
The following example shows use of the pager command:

pixfirewall# pager lines 2 pixfirewall# ping inside 10.0.0.42 10.0.0.42 NO response received -- 1010ms 10.0.0.42 NO response received -- 1000ms <--- More --->
6-157
Chapter 6 passwd
Command Reference
passwd
Set password for Telnet and PIX Firewall Manager access to the firewall console. (Privileged mode.) passwd password [encrypted] clear passwd show passwd
Syntax Description
password
A case-sensitive password of up to 16 alphanumeric and special characters. Any character can be used in the password except a question mark and a space. Specifies that the password you entered is already encrypted. The password you specify with the encrypted option must be 16 characters in length.
encrypted
Usage Guidelines
The passwd command sets a password for Telnet and PIX Firewall Manager access to the firewall console. An empty password is also changed into an encrypted string. However, any use of a write command displays or writes the passwords in encrypted form. Once passwords are encrypted, they are not reversible back to plain text. The clear passwd command resets the password to cisco.
Note
Write down the new password and store it in a manner consistent with your sites security policy. Once you change this password, you cannot view it again. See also: enable password.
Examples
The following example shows use of the passwd command:

passwd watag00s1am show passwd passwd jMorNbK0514fadBh encrypted
6-158
78-10392-02
Chapter 6
Command Reference perfmon
perfmon
View performance information. (Privileged mode.) perfmon interval seconds perfmon quiet | verbose show perfmon
Syntax Description
interval seconds
Specify the number of seconds between when the performance displays appear on the console. The default is 120 seconds. Disable performance monitor displays. Enable displaying performance monitor information at the PIX Firewall console.
quiet verbose
Usage Guidelines
The perfmon command lets you monitor the PIX Firewall units performance. Use the show perfmon command to view the information immediately. Use the perfmon verbose command to display the information every two minutes continuously. Use the perfmon interval seconds command with the perfmon verbose command to display the information continuously every number of seconds you specify.
Note
The show perfmon command does not display in a Telnet console session. Use the perfmon quiet command to disable the display. An example of the performance information follows: PERFMON STATS: Xlates Connections TCP Conns WebSns Req TCP Fixup HTTP Fixup FTP Fixup AAA Authen Current 33/s 110/s 50/s 4/s 20/s 5/s 7/s 10/s Average 20/s 10/s 42/s 2/s 15/s 5/s 4/s 5/s
6-159
Chapter 6 perfmon
Command Reference
AAA Author AAA Account
9/s 3/s
5/s 3/s
This information lists the number of translations, connections, Websense requests, address translations (called fixups), and AAA transactions that occur each second.
Examples
The following commands display the performance monitor statistics every 30 seconds on the PIX Firewall console:
perfmon interval 30 perfmon verbose
6-160
78-10392-02
Chapter 6
Command Reference ping
ping
Determine if other IP addresses are visible from the PIX Firewall. (Privileged mode.) ping if_name ip_address
Syntax Description
if_name
The internal or external network interface name. The address of the specified interface is used as the source address of the ping. The IP address of a host on the inside or outside networks.
ip_address
Usage Guidelines
The ping command determines if the PIX Firewall has connectivity or if a host is available on the network. The command output shows if the response was received; that is, that a host is participating on the network. If a host is not responding, ping displays NO response received. Use the show interface command to ensure that the PIX Firewall is connected to the network and is passing traffic. If you want internal hosts to be able to ping external hosts, you must create an ICMP access-list command statement for echo reply; for example, to give ping access to all hosts, use the access-list acl_grp permit icmp any any command and bind the access-list command statement to the interface you want to test using an access-group command statement. Refer to Step 8 - Permit Ping Access in Chapter 2, Configuring the PIX Firewall, for more information on these commands. If you are pinging through PIX Firewall between hosts or routers, but the pings are not successful, use the debug icmp trace command to monitor the success of the ping. If pings are both inbound and outbound, they are successful.
Examples
The ping command makes three attempts to reach an IP address:

ping inside 192.168.42.54 192.168.42.54 response received -- 0Ms 192.168.42.54 response received -- 0Ms 192.168.42.54 response received -- 0Ms
6-161
Chapter 6 quit
Command Reference
quit
Exit configuration or privileged mode. (All modes.) quit
Usage Guidelines
Use the quit command to exit configuration or privileged mode.

Examples
The following example shows use of the quit command:

pixfirewall(config)# quit pixfirewall# quit pixfirewall>
6-162
78-10392-02
Chapter 6
Command Reference reload
reload
Reboot and reload the configuration. (Privileged mode.) reload
Usage Guidelines
The reload command reboots the PIX Firewall and reloads the configuration from a bootable floppy disk or, if a diskette is not present, from Flash memory.
Note
You are prompted for confirmation before starting with Proceed with reload?. Any response other than n causes the reboot to occur.
Note
Configuration changes not written to Flash memory are lost after reload. Before rebooting, store the current configuration in Flash memory with the write memory command.
Examples
The following example shows use of the reload command:

reload Proceed with reload? Rebooting... PIX Bios V2.7 ... [confirm] y
6-163
Chapter 6 rip
Command Reference
rip
Change RIP settings. (Configuration mode.) rip if_name default | passive [version [1 | 2]] [authentication [text | md5 key (key_id)]] no rip if_name default | passive [version [1 | 2]] [authentication [text | md5 key (key_id)]] show rip [if_name] clear rip
Syntax Description
if_name default passive
The internal or external network interface name. Broadcast a default route on the interface. Enable passive RIP on the interface. The PIX Firewall listens for RIP routing broadcasts and uses that information to populate its routing tables. RIP version. Use version 2 for RIP update encryption. Use version 1 to provide backward compatibility with the older version. Enable RIP version 2 authentication. Send RIP updates as clear text (not recommended). Send RIP updates using MD5 encryption. Key to encrypt RIP updates. This value must be the same on the routers and any other device that provides RIP version 2 updates. The key is a text string of up to 16 characters in length. Key identification value. The key_id can be a number from 1 to 255. Use the same key_id in use on the routers and any other device that provides RIP version 2 updates.
version
authentication text md5 key
key_id
Usage Guidelines
The rip command enables IP routing table updates from received RIP (Routing Information Protocol) broadcasts. Version 5.1 supports RIP version 2 features. Use the show rip command to display the current RIP settings. Use the no rip command to disable the PIX Firewall IP routing table updates. The default is to enable IP routing table updates. If you specify RIP version 2, you can encrypt RIP updates using MD5 encryption. The clear rip command removes all the rip commands from the configuration.
Note
Ensure that the key and key_id values are the same as in use on any other device in your network that makes RIP version 2 updates.
6-164
78-10392-02
Chapter 6
Command Reference rip
Note
The PIX Firewall cannot pass RIP updates between interfaces.

Examples
The following is sample output from the version 1 show rip and rip inside default commands:
show rip rip outside passive no rip outside default rip inside passive no rip inside default rip inside default show rip rip outside passive no rip outside default rip inside passive rip inside default
The next example combines version 1 and version 2 commands and shows listing the information with the show rip command after entering the rip commands that:

rip rip rip rip
Enable version 2 passive RIP using MD5 authentication on the outside interface to encrypt the key used by the PIX Firewall and other RIP peers, such as routers. Enable version 1 passive RIP listening on the inside interface of the PIX Firewall. Enable version 2 passive RIP listening on the dmz interface of the PIX Firewall.
outside passive version 2 authentication md5 thisisakey 2 outside default version 2 authentication md5 thisisakey 2 inside passive dmz passive version 2
show rip rip outside passive version 2 authentication md5 thisisakey 2 rip outside default version 2 authentication md5 thisisakey 2 rip inside passive version 1 rip dmz passive version 2
The next example shows how use of the clear rip command clears all the previous rip commands from the current configuration:
clear rip show rip
This example shows use of the version 2 feature that passes the encryption key in text form:
rip out default version 2 authentication text thisisakey 3 show rip rip outside default version 2 authentication text thisisakey 3
6-165
Chapter 6 route
Command Reference
route
Enter a static or default route for the specified interface. (Configuration mode.) route if_name ip_address netmask gateway_ip [metric] clear route [if_name ip_address [netmask gateway_ip]] no route [if_name ip_address [netmask gateway_ip]] show route
Syntax Description
if_name ip_address
The internal or external network interface name. The internal or external network IP address. Use 0.0.0.0 to specify a default route. The 0.0.0.0 IP address can be abbreviated as 0. Specify a network mask to apply to ip_address. Use 0.0.0.0 to specify a default route. The 0.0.0.0 netmask can be abbreviated as 0. Specify the IP address of the gateway router (the next hop address for this route). Specify the number of hops to gateway_ip. If you are not sure, enter 1. Your network administrator can supply this information or you can use a traceroute command to obtain the number of hops. The default is 1 if a metric is not specified.
netmask
gateway_ip metric
Usage Guidelines
Use the route command to enter a default or static route for an interface. To enter a default route, set ip_address and netmask to 0.0.0.0, or the shortened form of 0. All routes entered using the route command are stored in the configuration when it is saved. The clear route command removes route command statements from the configuration that do not contain the CONNECT keyword. Create static routes to access networks connected outside a router on any interface. The effect of a static route is like stating to send a packet to the specified network, give it to this router. For example, PIX Firewall sends all packets destined to the 192.168.42.0 network through the 192.168.1.5 router with this static route command statement:
route dmz 192.168.42.0 255.255.255.0 192.168.1.5 1
In version 5.1 the routing table has been improved to automatically specify the IP address of a PIX Firewall interface in the route command. Once you enter the IP address for each interface, PIX Firewall creates a route statement entry that is not deleted when you use the clear route command. If the route command statement uses the IP address from one of the PIX Firewall units interfaces as the gateway IP address, PIX Firewall will ARP for the destination IP address in the packet instead of ARPing for the gateway IP address.
6-166
78-10392-02
Chapter 6
Command Reference route
The following steps show how this feature is handled:

PIX Firewall receives a packet from the inside interface destined to IP address X. Because a default route is set to itself, PIX Firewall sends out an ARP for address X. Any Cisco router on the outside interface LAN which has a route to address X (Cisco IOS software has proxy ARP enabled by default) replies back to the PIX Firewall with its own MAC address as the next hop. PIX Firewall sends the packet to router (just like a default gateway). PIX Firewall adds the entry to its ARP cache for IP address X with the MAC address being that of the router.
Step 4 Step 5
The CONNECT route entry is supported. (This identifier appears when you use the show route command.) The CONNECT identifier is assigned to an interfaces local network and the interface IP address, which is in the IP local subnet. PIX Firewall will ARP for the destination address. The CONNECT identifier cannot be removed, but changes when you change the IP address on the interface. If you enter duplicate routes with different metrics for the same gateway, PIX Firewall changes the metric for that route and updates the metric for the route. For example, the following command statement is in a configuration:
route inside 10.0.0.0 255.0.0.0 10.0.0.2 2 OTHER
If you enter the following statement:

route inside 10.0.0.0 255.0.0.0 10.0.0.2 3
PIX Firewall converts the command statement to the following:

route inside 10.0.0.0 255.0.0.0 10.0.0.2 3 OTHER
Examples
Specify one default route command statement for the outside interface, which in this example, is for the router on the outside interface that has an IP address of 209.165.201.1:
route outside 0 0 209.165.201.1 1
For static routes, if two networks, 10.1.2.0 and 10.1.3.0 connect via a hub to the dmz1 interface router at 10.1.1.4, add these static route command statements to provide access to the networks:
route dmz1 10.1.2.0 255.0.0.0 10.1.1.4 1 route dmz1 10.1.3.0 255.0.0.0 10.1.1.4 1
6-167
Chapter 6 service
Command Reference
service
Reset inbound connections. (Configuration mode.) service resetinbound show service
Syntax Description
resetinbound
Usage Guidelines
Reset inbound connections.
The service command works with all inbound TCP connections to statics whose access lists or uauth (user authorization) do not allow inbound. One use is for resetting IDENT connections. If an inbound TCP connection is attempted and denied, you can use the service resetinbound command to return an RST (reset flag in the TCP header) to the source. Without the option, the PIX Firewall drops the packet without returning an RST. For use with IDENT, the PIX Firewall sends a TCP RST to the host connecting inbound and stops the incoming IDENT process so that email outbound can be transmitted without having to wait for IDENT to time out. In this case, the PIX Firewall sends a syslog message stating that the incoming connection was a denied connection. Without service resetinbound, the PIX Firewall drops packets that are denied and generates a syslog message stating that the SYN was a denied connection. However, outside hosts keep retransmitting the SYN until the IDENT times out. When an IDENT connection is timing out, you will notice that connections slow down. Perform a trace to determine that IDENT is causing the delay and then invoke the service command. The service resetinbound command provides a safer way to handle an IDENT connection through the PIX Firewall. Ranked in order of security from most secure to less secure are these methods for handling IDENT connections:
1. 2. 3.
Use the service resetinbound command. Use the established command with the permitto tcp 113 options. Enter static and access-list command statements to open TCP port 113.
When using the aaa command, if the first attempt at authorization fails and a second attempt causes a timeout, use the service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet follows:
Unable to connect to remote host: Connection timed out
Examples
The following example shows use of the service resetinbound command:

service resetinbound show service service resetinbound
6-168
78-10392-02
Chapter 6
Command Reference session
session
Access an embedded AccessPro router console. (Privileged mode.) session enable no session show session
Note
Only use this command if you have an AccessPro router installed in your PIX Firewall.
Syntax Description
enable
Usage Guidelines
Enable the session command for communications with the AccessPro router.
The session command lets you specify Cisco IOS software commands on an AccessPro router console when the router is installed in your PIX Firewall. Use COM port 4 on the AccessPro router to communicate with the PIX Firewall. Exit the router console session by entering tilde-dot (~.). Press the tilde key and when you hear a bell sound from your terminal, press the dot key. While a router console session is occurring, the PIX Firewall disables failover because they both require the same interrupts.
Examples
This example enables an AccessPro session, starts the session, and then disables it:
session enable Session has been enabled. session Warning: FAILOVER has been disabled!!! Attempting session with embedded router, use ~. to quit! acpro> ~. no session Session has been disabled session Session is not enabled
6-169
Chapter 6 show
Command Reference
show
View command information. (Differs by mode.) show ?
Usage Guidelines
The show command without arguments or the show ? command lets you view the names of the show commands and their descriptions. Explanations for each show command are provided on the respective command page for the command itself where appropriate; for example, show arp is described on the arp command page.
Note
The show commands that do not have a command equivalent shown in this section are described on their respective command pages; for example, the show interface command is described on the interface command page. If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:
<--- More --->

To view another screenful, press the Space bar. To view the next line, press the Enter key. To return to the command line, press the q key.
Examples
The following is sample output for the show ? command:

show ? ? help
6-170
78-10392-02
Chapter 6
Command Reference show blocks/clear blocks
show blocks/clear blocks

Show system buffer utilization. (Privileged mode.) clear blocks show blocks
Usage Guidelines
The show blocks command lists preallocated system buffer utilization. In the show blocks listing, the SIZE column displays the block type. The MAX column is the maximum number of allocated blocks. The LOW column is the fewest blocks available since last reboot. The CNT column is the current number of available blocks. A zero in the LOW column indicates a previous event where memory exhausted. A zero in the CNT column means memory is exhausted now. Exhausted memory is not a problem as long as traffic is moving through the PIX Firewall. You can use the show conn command to see if traffic is moving. If traffic is not moving and the memory is exhausted, a problem may be indicated. The clear blocks command keeps the maximum count to whatever number is allocated in the system and equates the low count to the current count. You can also view the information from the show blocks command using SNMP. Refer to Using the Firewall and Memory Pool MIBs in Chapter 3, Advanced Configurations, for more information.
Examples
The following is sample output for the show blocks command:

show blocks SIZE MAX 4 1600 80 100 256 80 1550 788 65536 8 LOW 1600 97 79 402 8 CNT 1600 97 79 404 8
6-171
Chapter 6 show checksum
Command Reference
show checksum
Display the configuration checksum. (Unprivileged mode.) show checksum
Usage Guidelines
The show checksum command displays four groups of hexadecimal numbers that act as a digital summary of the contents of the configuration. This same information stores with the configuration when you store it in Flash memory. By using the show config command and viewing the checksum at the end of the configuration listing and using the show checksum command, you can compare the numbers to see if the configuration has changed. The PIX Firewall tests the checksum to determine if a configuration has not been corrupted.
Examples
The following is sample output for the show checksum command:

show checksum Cryptochecksum: 1a2833c0 129ac70b 1a88df85 650dbb81
show conn
Display all active connections. (Privileged mode.) show conn [count] [foreign | local ip[-ip2] [netmask mask]] [protocol tcp | udp | protocol] [fport | lport port1[-port2]] [state up[,finin][,finout] [,http_get] [,smtp_data] [,smtp_banner] [,smtp_incomplete][,nojava] [,data_in] [,data_out] [,sqlnet_fixup_data] [,conn_inbound] [,rpc] [,h323] [,dump]
Syntax Description
count
Display only the number of used connections. This feature is no longer supported and returns unreliable information. Display active connections by the foreign IP address or by local IP address. Qualify foreign or local active connections by network mask. Display active connections by protocol type. protocol is a protocol specified by number. See Protocols in Chapter 1, Introduction, for a list of valid protocol literal names.
foreign | local ip[-ip2] netmask mask protocol tcp | udp | protocol
6-172
78-10392-02
Chapter 6
Command Reference show history
fport | lport port1[-port2] Display foreign or local active connections by port. See Ports in Chapter 1, Introduction, for a list of valid port literal names. state Display active connections by their current state: up (up), FIN inbound (finin), FIN outbound (finout), HTTP get (http_get), SMTP mail data (smtp_data), SMTP mail banner (smtp_banner), incomplete SMTP mail connection (smtp_incomplete), an outbound command denying access to Java applets (nojava), inbound data (data_in), outbound data (data_out), SQL*Net data fix up (sqlnet_fixup_data), inbound connection (conn_inbound), RPC connection (rpc), H.323 connection (h323), dump clean up connection (dump).
Usage Guidelines
The show conn command displays the number and information about the active TCP connections. You can also view the connection count information from the show conn command using SNMP. Refer to Using the Firewall and Memory Pool MIBs in Chapter 3, Advanced Configurations, for more information.
Examples
The following is sample output for the show conn command:

show conn 6 in use, TCP out TCP out TCP out TCP out TCP out TCP out UDP out UDP out UDP out 6 most used 209.165.201.1:80 209.165.201.1:80 209.165.201.1:80 209.165.201.1:80 209.165.201.1:80 209.165.201.1:80 209.165.201.7:24 209.165.201.7:23 209.165.201.7:22
in in in in in in in in in
10.3.3.4:1404 10.3.3.4:1405 10.3.3.4:1406 10.3.3.4:1407 10.3.3.4:1403 10.3.3.4:1408 10.3.3.4:1402 10.3.3.4:1397 10.3.3.4:1395
idle idle idle idle idle idle idle idle idle
0:00:00 0:00:00 0:00:01 0:00:01 0:00:00 0:00:00 0:01:30 0:01:30 0:01:30
Bytes Bytes Bytes Bytes Bytes Bytes
11391 3709 2685 2683 15199 2688
In this example, host 10.3.3.4 on the inside has accessed a web site at 209.165.201.1. The global address on the outside interface is 209.165.201.7.
show history
Display previously entered lines. (Privileged mode.) show history
Usage Guidelines
The show history command displays previously entered commands. You can examine commands individually with the up and down arrows or by entering ^p to view previously entered lines or ^n to view the next line.
6-173
Chapter 6 show interface
Command Reference
Examples
The following is sample output for the show history command:

show history enable ...
show interface
See the interface command page for a description of the show interface command.
show memory
Show system memory utilization. (Privileged mode.) show memory
Usage Guidelines
The show memory command displays a summary of the maximum physical memory and current free memory available to the PIX Firewall operating system. Memory in the PIX Firewall is allocated as needed. You can also view the information from the show memory command using SNMP. Refer to Using the Firewall and Memory Pool MIBs in Chapter 3, Advanced Configurations, for more information.
Examples
The following is sample output for the show memory command:

show memory nnnnnnnn bytes total, nnnnnnn bytes free
show processes
Display processes. (Privileged mode.) show processes
Usage Guidelines
The show processes command displays a listing of running processes. Processes are lightweight threads requiring only a few instructions. In the listing, PC is the program counter, SP is the stack pointer, STATE is the address of a thread queue, Runtime is the number of milliseconds that the thread has been running, SBASE is the stack base address, Stack is the current number of bytes used and the total size of the stack, and Process lists the threads function.
Examples
The following is sample output for the show processes command:

show processes PC SP STATE Lsi 800125de 803603d0 80075ba0 ... Runtime SBASE Stack Process 0 8035f410 4004/4096 arp_timer
6-174
78-10392-02
Chapter 6
Command Reference show tech-support
show tech-support
View information to help a support analyst. (Privileged mode.) show tech-support
Usage Guidelines
The show tech-support command lists information technical support analysts need to help you diagnose PIX Firewall problems. This command combines the output from the show commands that provide the most information to a technical support analyst.
Examples
The following is sample output for the show tech-support command:

show tech-support PIX Version 5.1(n)nnn Compiled on Fri 28-May-99 04:08 by pixbuild PIX Bios V2.7
pixfirewall up 100 days 6 hours 17 mins ...
show traffic/clear traffic

Shows interface transmit and receive activity. (Privileged mode.) clear traffic show traffic
Usage Guidelines
The show traffic command lists the number of packets and bytes moving through each interface. The number of seconds is the duration the PIX Firewall has been online since the last reboot. The clear traffic command clears counters for the show traffic command output.
Examples
The following is sample output for the show traffic command:

show traffic outside: received (in 3786 secs): 97 packets 6191 bytes 42 pkts/sec 1 bytes/sec transmitted (in 3786 secs): 99 packets 10590 bytes 0 pkts/sec 2 bytes/sec
show uauth
See the uauth command page for information on the show uauth command.
6-175
Chapter 6 show version
Command Reference
show version
View the PIX Firewall operating information. (Unprivileged mode.) show version
Usage Guidelines
The show version command lets you view the PIX Firewall units software version, operating time since last reboot, processor type, Flash memory type, interface boards, and serial number (BIOS ID). Version 5.1(1) and later lists the activation key in the show version command display. In the following examples, the amount of Flash memory (2 MB or 16 MB) is identified by:

Flash AT29C040A @ 0x300 for 2 MB of Flash Flash i28F640J5 @ 0x300 for 16 MB of Flash
Examples
The following is sample output for the show version command.

show version Cisco Secure PIX Firewall Version 5.1(1) Compiled on Fri 01-Oct-99 13:56 by pixbuild pix515 up 4 days 22 hours 10 mins 42 secs Hardware: PIX-515, 64 MB RAM, CPU Pentium 200 MHz Flash i28F640J5 @ 0x300 BIOS Flash AT29C257 @ 0xfffd8000 0: 1: 2: 3: ethernet0: ethernet1: ethernet2: ethernet3: address address address address is is is is 00aa.0000.0037, 00aa.0000.0038, 00a0.c92a.f029, 00a0.c948.45f9, irq irq irq irq 11 10 9 7
Licensed Features: Failover: Enabled VPN-DES: Enabled VPN-3DES: Disabled Maximum Interfaces: 6 Serial Number: 123 (0x7b) Activation Key: 0xc5233151 0xb429f6d0 0xda93739a 0xe15cdf51
show xlate
See the xlate command page for information on the show xlate command.
6-176
78-10392-02
Chapter 6
Command Reference snmp-server
snmp-server
Provide SNMP event information. (Configuration mode.) snmp-server community key snmp-server contact text snmp-server location text snmp-server host [if_name] ip_addr snmp-server enable traps clear snmp-server command no snmp-server command show snmp-server
Syntax Description
community key
Enter the password key value in use at the SNMP management station. The SNMP community string is a shared secret among the SNMP management station and the network nodes being managed. PIX Firewall uses the key to determine if the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the routers, firewall, and the management station with this same string. The PIX Firewall then honors SNMP requests using this string and does not respond to requests with an invalid community string. The key is a case-sensitive value up to 32 characters in length. Spaces are not permitted. The default, if this option is not used, is public.
contact text
Supply your name or that of the PIX Firewall system administrator. The text is case-sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space. Specify your PIX Firewall location. The text is case-sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space. Specify an IP address of the SNMP management station to which traps should be sent and/or from which the SNMP requests come. You can specify up to five SNMP management stations. Use with these parameters:

location text
host
if_nameThe interface name where the SNMP management station resides. ip_addrThe IP address of a host to which SNMP traps should be sent and/or from which the SNMP requests come.
enable traps
Enable or disable sending SNMP trap notifications via syslog.
6-177
Chapter 6 snmp-server
Command Reference
Usage Guidelines
Use the snmp-server command to identify site, management station, community string, and user information. In understanding SNMP use, the PIX Firewall is considered the SNMP agent or SNMP server. The management station is the system running the SNMP program that receives and processes the SNMP information that the PIX Firewall sends. An SNMP object ID (OID) for PIX Firewall now displays in SNMP event traps sent from the PIX Firewall. OID 1.3.6.1.4.1.9.1.227 was assigned as the PIX Firewall system object ID. The clear snmp-server and no snmp-server commands removes command statements. The show snmp-server command displays the information.
MIB Support
You can browse the System and Interface groups of MIB-II. All SNMP values in the PIX Firewall are read only (RO). The PIX Firewall does not support browsing of the Cisco syslog MIB. Browsing a MIB is different from sending traps. Browsing means doing an snmpget or snmpwalk of the MIB tree from the management station to determine values. Traps are different; they are unsolicited comments from the managed device to the management station for certain events, such as link up, link down, syslog event generated, and so on. New in version 5.1, the Cisco Firewall MIB and Cisco Memory Pool MIB are now available. These MIBs provide the following PIX Firewall information via SNMP:

Buffer usage from the show block command Connection count from the show conn command Failover status Memory usage from the show memory command
See SNMP Traps in Chapter 3, Advanced Configurations for more information on SNMP traps.
Receiving SNMP Requests from an SNMP Management Station
To receive SNMP requests from a management station:

Identify the management station with an snmp-server host command statement. Specify snmp-server command options for the location, contact, and community. Start the SNMP software on the management station and begin issuing SNMP requests to the PIX Firewall.
Examples
The following example shows commands you would enter to start receiving SNMP requests from a management station:
snmp-server snmp-server snmp-server snmp-server community wallawallabingbang location Building 42, Sector 54 contact Sherlock Holmes host perimeter 10.1.2.42
6-178
78-10392-02
Chapter 6
Command Reference snmp-server
The next example is the sample output for the show snmp-server command:
show snmp snmp-server snmp-server snmp-server snmp-server host perimeter 10.1.2.42 location Building 42, Sector 54 contact Sherlock Holmes community wallawallabingbang
6-179
Chapter 6 static
Command Reference
static
Map local IP address to a global IP address. (Configuration mode.) static [(internal_if_name, external_if_name)] global_ip local_ip [netmask network_mask] [max_conns [em_limit]] [norandomseq] no static [[(internal_if_name, external_if_name)] global_ip local_ip[netmask network_mask] [max_conns [em_limit]] [norandomseq]] show static
Syntax Description
internal_if_name The internal network interface name. The higher security level interface you are accessing. external_if_name The external network interface name. The lower security level interface you are accessing. global_ip A global IP address. This address cannot be a PAT (Port Address Translation) IP address. The IP address on the lower security level interface you are accessing. The local IP address from the inside network. The IP address on the higher security level interface you are accessing. Reserve word required before specifying the network mask. The network mask pertains to both global_ip and local_ip. For host addresses, always use 255.255.255.255. For network addresses, use the appropriate class mask or subnet mask; for example, for Class A networks, use 255.0.0.0. An example subnet mask is 255.255.255.224. The maximum number of connections permitted through the static at the same time. The embryonic connection limit. An embryonic connection is one that has started but not yet completed. Set this limit to prevent attack by a flood of embryonic connections. The default is 0, which means unlimited connections. Do not randomize the TCP/IP packets sequence number. Only use this option if another inline firewall is also randomizing sequence numbers and the result is scrambling the data. Use of this option opens a security hole in the PIX Firewall.
local_ip
netmask network_mask
max_conns
em_limit
norandomseq
Usage Guidelines
The static command creates a permanent mapping (called a static translation slot or xlate) between a local IP address and a global IP address. Use the static and access-list commands when you are accessing an interface of a higher security level from an interface of a lower security level; for example, when accessing the inside from a perimeter or the outside interface.
6-180
78-10392-02
Chapter 6
Command Reference static
The interface names on the static command may seem confusing at first. This is further complicated by how NAT is handled on the PIX Firewall. If NAT is disabled, with the nat 0 command, statics are specified with a different set of rules than when NAT is enabled. For either no NAT or NAT, the rule of which command to access an interface stays the same as shown in Table 6-7. Table 6-7 assumes that the security levels are 40 for dmz1 and 60 for dmz2.
Table 6-7 Interface Access Commands by Interface
From This Interface inside inside inside dmz1 dmz1 dmz1 dmz2 dmz2 dmz2 outside outside outside
To This Interface outside dmz1 dmz2 outside dmz2 inside outside dmz1 inside dmz1 dmz2 inside
Use This Command nat nat nat nat static static nat nat static static static static
With NAT Enabled
NAT (Network Address Translation) is enabled with the nat n command where n has the value 1 or greater; for example, nat 1 0 0. Always specify the interface name of the highest security level interface you are accessing, followed by the lower security level interface. The IP addresses are also confusing because the first IP address you specify is for the lower security level interface. The second IP address is for the higher security level interface. The way to remember this is as follows: static (high,low) low high For example, assume you have four interfaces on the PIX Firewall that have security levels set with the nameif command as follows:
nameif nameif nameif nameif ethernet0 ethernet1 ethernet2 ethernet3 outside security0 inside security100 dmz1 security40 dmz2 security60
To access the inside from the outside interface, you need a static command like the following:
static (inside,outside)
outside_ip_address inside_ip_address
netmask
mask
Replace outside_ip_address with the global IP address (an IP address on the lower security level interface). Replace inside_ip_address with the IP address of the host on the higher security level interface that you want to grant access to.
6-181
Chapter 6 static
Command Reference
Use these replacements in the rest of the commands in this section. Replace mask with 255.255.255.255 for host addresses, except when subnetting is in effect; for example, 255.255.255.128. For network addresses, use the appropriate class mask; for example, for Class A networks, use 255.0.0.0. To access the inside from the dmz1 interface, you need a static command like the following:
static (inside,dmz1) dmz1_ip_address inside_ip_address netmask mask
To access the inside from the dmz2 interface, you need a static command like the following:
static (inside,dmz2) dmz2_ip_address inside_ip_address netmask mask
To access the dmz2 interface from the dmz1 interface, you need a static command like the following:
static (dmz2,dmz1) dmz1_ip_address dmz2_ip_address netmask mask
To go the other way around, from a higher security level interface to a lower security level interface, use the nat and global commands. For example, to access dmz1 from dmz2, use these commands:
nat (dmz2) 1 0 0 global (dmz1) 1 global_ip_address-global_ip_address
Replace global_ip_address-global_ip_address with the IP address range of the addresses in the pool of global addresses. The nat command specifies the name of the higher security level interface; the pool of global addresses are on the lower security level interface. View the nat command page for more information on using these commands.
Note
If you use a static command, you must also use an access-list command. The static command makes the mapping, the access-list command lets users access the static mapping. The first IP address you specify in the static command is the first IP address you specify in the access-list command as shown in this example:
static (dmz2,dmz1) 10.1.1.1 192.168.1.1 netmask 255.255.255.255 access-list acl_dmz1 permit tcp 10.1.1.0 255.255.255.0 host 10.1.1.1 access-group acl_dmz1 in interface dmz1
The static command maps the address 10.1.1.1 on the dmz1 interface so that users on the dmz1 interface can access the 192.168.1.1 host on the dmz2 interface. The access-list command lets any users in the 10.1.1.0 network access the 10.1.1.1 address over any TCP port. The access-group command statement binds the access-list command statement to the dmz1 interface.
Note
Always make access-list command statements as specific as possible. Using the any option to allow any host access should be used with caution for access lists used with statics.
With No-NAT
With no-NAT, the static command has a different sense of logic. With NAT disabled, addresses on both sides of the firewall are registered addresses. Between interfaces, addresses must be on different subnets that you control with subnetting. See Appendix D, Subnet Masking and Addressing, for more information.
6-182
78-10392-02
Chapter 6
Command Reference static
Without address translation, you protect addresses on the inside or perimeter interfaces by not providing access to them. Without an access-list command statement, the inside host cannot be accessed on the outside and is, in effect, invisible to the outside world. Conversely, only by opening statics and access lists to servers on the inside or perimeter interfaces, do the hosts become visible. Without address translation, the format of the static command becomes different: static (high,low) high high Again, the security level set for each interface with the nameif command determines what information you fill in. You are using static to access a higher security interface from a lower security interface. The IP address you want visible on the lower security interface is that of the higher security interface. This is the IP address users on the lower security interfaces network will use to access the server on the higher security level interfaces network. Because address translation is not occurring, the actual address of the server is presented as both the visible address and the address of the host. For example, a web server on the dmz, 209.165.201.5 needs to be accessible by users on the outside. The static and access-list command statements are as follows:
static (dmz,outside) 209.165.201.5 209.165.201.5 netmask 255.255.255.255 access-list acl_out permit tcp any host 209.165.201.5 eq www access-group acl_out in interface outside
The static command presents the 209.165.201.5 address on the outside interface. The DNS server on the outside would map this IP address to the domain of the company; for example, cisco.com. Users accessing cisco.com are permitted to access the web server via port 80 by the access-list command. Another example of no-NAT statics would be when users on dmz1 need to access a web server on dmz2. The network uses a Class C address and subnets it with the .240 subnet. Addresses 209.165.201.1 to 209.165.201.14 are on dmz1, and addresses 209.165.201.17 to 209.165.201.30 are on dmz2. The web server is at 209.165.201.25. The static and access-list command statements are as follows:
static (dmz2,dmz1) 209.165.201.25 209.165.201.25 netmask 255.255.255.255 access-list acl_dmz1 permit tcp any host 209.165.201.25 eq www access-group acl_dmz1 in interface dmz1
The static command statement opens access to the web server at 209.165.201.25. The access-list command statement permits access to the web server only on port 80 (www).
Additional static Information
After changing or removing a static command statement, use the clear xlate command. You can create a single mapping between the global and local hosts, or create a range of statics known as net statics. The static command determines the network mask of network statics by the netmask option or by the number in the first octet of the global IP address. The netmask option can be used to override the number in the first octet. If the address is all zeros where the net mask is zero, then the address is a net address.
Note
Do not create statics with overlapping global IP addresses. You can have as many statics as needed as long the total size of your configuration does not exceed the maximum size permitted for your Flash memory unit. Refer to the Release Notes for the Cisco Secure PIX Firewall Version 5.1(2) for more information on the maximum size of a configuration. See also: access-list
6-183
Chapter 6 static
Command Reference
Examples
The example that follows creates a static command and then permits users to call in through H.323 using Intel InternetPhone, CU-SeeMe, CU-SeeMe Pro, MeetingPoint, or MS NetMeeting to 10.1.1.2 using IP address 209.165.201.2, to 10.1.1.10 using IP address 209.165.201.10, and so on. The net static command that follows maps addresses 209.165.201.1 through 209.165.201.30 to local addresses 10.1.1.1 through 10.1.1.30.
static (inside, outside) 209.165.201.0 10.1.1.0 netmask 255.255.255.255 access-list acl_out permit tcp any 209.165.201.0 255.255.255.224 eq h323 access-group acl_out in interface outside
The following example shows the commands used to disable Mail Guard:
static (dmz1,outside) 209.165.201.1 10.1.1.1 netmask 255.255.255.255 access-list acl_out permit tcp any host 209.165.201.1 eq smtp access-group acl_out in interface outside no fixup protocol smtp 25
In this example, the static command sets up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. (The MX record for DNS needs to point to the 209.165.201.1 address so that mail is sent to this address.) The access-list command lets any outside users access the global address through the SMTP port (25). The no fixup protocol command disables the Mail Guard feature.
6-184
78-10392-02
Chapter 6
Command Reference syslog
syslog
Enable syslog message facility. Obsolete command replaced by the logging command. (Privileged mode.)
Note
See the logging command for more information. The syslog command is available for backward compatibility.
6-185
Chapter 6 sysopt
Command Reference
sysopt
Change PIX Firewall system options. (Configuration mode.) sysopt connection enforcesubnet no sysopt connection enforcesubnet sysopt connection permit-ipsec no sysopt connection permit-ipsec sysopt connection permit-pptp no sysopt connection permit-pptp sysopt connection tcpmss bytes no sysopt connection tcpmss bytes sysopt connection timewait no sysopt connection timewait sysopt ipsec pl-compatible no sysopt ipsec pl-compatible sysopt nodnsalias inbound sysopt nodnsalias outbound no sysopt nodnsalias inbound no sysopt nodnsalias outbound sysopt noproxyarp if_name no sysopt noproxyarp if_name sysopt security fragguard no sysopt security fragguard sysopt radius ignore-secret no sysopt radius ignore-secret clear sysopt show sysopt
Syntax Description
connection enforcesubnet connection permit-ipsec
Enable spoof address filtering based on subnet.
Implicitly permit any packet that came from an IPSec tunnel and bypass the checking of an associated access-list, conduit, or access-group command statement for IPSec connections. Allow PPTP traffic to bypass conduit or access-list command statement checking.
connection permit-pptp
6-186
78-10392-02
Chapter 6
Command Reference sysopt
connection tcpmss bytes
Force TCP proxy connection to have a maximum segment size no greater than bytes. The default value for bytes is 1380. Force each TCP connection to linger in a shortened TIME_WAIT state of at least 15 seconds after the final normal TCP close-down sequence. Enables IPSec packets to bypass the PIX Firewall units NAT and ASA features and allows incoming IPSec packets to terminate on the inside interface. Disable inbound embedded DNS A record fixups according to aliases that apply to the A record address. Disable outbound DNS A record replies. Disable proxy-arps on a PIX Firewall interface. Enable the IP Frag Guard feature. Ignore authenticator key to avoid retransmit caveat.
connection timewait
ipsec pl-compatible
nodnsalias inbound
nodnsalias outbound noproxyarp if_name security fragguard radius ignore-secret

Usage Guidelines
The sysopt commands let you tune various PIX Firewall security and configuration features. In addition, you can use this command to disable the PIX Firewall IP Frag Guard feature.
sysopt connection enforcesubnet
The sysopt connection enforcesubnet command prevents external users from spoofing internal addresses. This command prevents packets with a source address belonging to the destination subnet from traversing the PIX Firewall. For example, if a packet arrives from the outside but has a source address belonging to the inside subnet, the PIX Firewall does not let the packet through. The sysopt connection enforcesubnet command applies only to inbound connections. To configure the PIX Firewall to detect spoofed IP addresses, use explicit access-list deny command statements in the configuration; for example:
access-list acl_grp deny ip any in_host_net1 in_host_net1_mask access-list acl_grp deny ip any in_host_net2 in_host_net2_mask
Replace in_host_netn with the addresses on the internal network.

sysopt connection permit-ipsec
Use the sysopt connection permit-ipsec command in IPSec configurations to permit IPSec traffic to pass through the PIX Firewall without a check of conduit or access-list command statements. An access-list or conduit command statement must be available for inbound sessions. By default, any inbound session must be explicitly permitted by a conduit or access-list command statement. With IPSec protected traffic, the secondary access list check could be redundant. To enable IPSec authenticated/cipher inbound session to always be permitted, enable sysopt connection permit-ipsec. The no sysopt connection permit-ipsec command disables the option.
6-187
Chapter 6 sysopt
Command Reference
Note
If both the sysopt ipsec pl-compatible command and the sysopt connection permit-ipsec command are used within your configuration, the sysopt ipsec pl-compatible command will take precedence.
Note
If the sysopt connection permit-ipsec command is not configured, you must explicitly configure a access-list command statement to permit IPSec traffic to traverse the PIX Firewall.
Examples
The following is a minimal IPSec configuration to enable a session to be connected from host 172.21.100.123 to host 172.21.200.67 across an IPSec tunnel that terminates from peer 209.165.201.1 to peer 201.165.200.225. With sysopt connection permit-ipsec and access-list command statements: On peer 209.165.201.1:
static 172.21.100.123 172.21.100.123 access-list 10 permit ip host 172.21.200.67 host 172.21.100.123 crypto ipsec transform-set t1 esp-des esp-md5-hmac crypto map mymap 10 ipsec-isakmp crypto map mymap 10 match address 10 crypto map mymap 10 set transform-set t1 crypto map mymap 10 set peer 172.21.200.1 crypto map mymap interface outside
On peer 201.165.200.225:
static 172.21.200.67 172.21.200.67 access-list 10 permit ip host 172.21.100.123 host 172.21.200.67 crypto ipsec transform-set t1 esp-des esp-md5-hmac crypto map mymap 10 ipsec-isakmp crypto map mymap 10 match address 10 crypto map mymap 10 set transform-set t1 crypto map mymap 10 set peer 172.21.100.1 crypto map mymap interface outside
With sysopt connection permit-ipsec and without conduit command statements: On peer 209.165.201.1:
static 172.21.100.123 172.21.100.123 access-list 10 permit ip host 172.21.200.67 host 172.21.100.123 crypto ipsec transform-set t1 esp-des esp-md5-hmac crypto map mymap 10 ipsec-isakmp crypto map mymap 10 match address 10 crypto map mymap 10 set transform-set t1 crypto map mymap 10 set peer 172.21.200.1 crypto map mymap interface outside sysopt connection permit-ipsec
6-188
78-10392-02
Chapter 6
On peer 201.165.200.225:
static 172.21.200.67 172.21.200.67 access-list 10 permit ip host 172.21.100.123 host 172.21.200.67 crypto ipsec transform-set t1 esp-des esp-md5-hmac crypto map mymap 10 ipsec-isakmp crypto map mymap 10 match address 10 crypto map mymap 10 set transform-set t1 crypto map mymap 10 set peer 172.21.100.1 crypto map mymap interface outside sysopt connection permit-ipsec
sysopt connection permit-pptp
Let PPTP traffic bypass conduit and access-list command statement checking. Use the vpdn command to implement PPTP.
Examples
In the following example, a PPTP client authenticates using mschap, negotiates mppe encryption, receives the dns and wins server addresses, and Telnets to the host 192.168.0.2 directly through the nat 0 command.
ip local pool my-addr-pool 10.1.1.1-10.1.1.254 aaa-server my-aaa-server-group (inside) host 192.168.0.10 key 12345678 aaa-server my-aaa-server-group protocol radius vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe auto required vpdn group 1 client configuration address local my-addr-pool vpdn group 1 client authentication aaa my-aaa-server-group vpdn group 1 client configuration dns 10.2.2.99 vpdn group 1 client configuration wins 10.2.2.100 vpdn enable outside access-list nonat permit ip 10.1.1.0 255.255.255.0 host 192.168.0.2 access-list nonat permit ip 10.1.1.0 255.255.255.0 host 10.2.2.99 access-list nonat permit ip 10.1.1.0 255.255.255.0 host 10.2.2.100 nat (inside) 0 access-list nonat sysopt connection permit-pptp
sysopt connection tcpmss
The sysopt connection tcpmss command forces proxy TCP connections to have a maximum segment size no greater than bytes. This command requests that each side not send a packet of a size greater than bytes at any time during the initial TCP connection establishment.
Note
If the client sending the proxy TCP connection does not announce a maximum segment size, PIX Firewall assumes that the RFC 793 default value of 536 bytes is in effect. If the client announces a maximum segment size larger than the number of bytes, PIX Firewall reduces the maximum segment size to bytes. The bytes value can be a minimum of 28 and any maximum number. You can disable this feature by setting bytes to zero. By default, the PIX Firewall sets 1380 bytes as the sysopt connection tcpmss even though this command does not appear in the default configuration. The calculation for setting the TCP maximum segment size to 1380 bytes is as follows:
1380 data + 20 TCP + 20 IP + 24 AH + 24 ESP_CIPHER + 12 ESP_AUTH + 20 IP = 1500 bytes
6-189
Chapter 6 sysopt
Command Reference
1500 bytes is the MTU for Ethernet connections. Cisco recommends that the default value of 1380 bytes be used for Ethernet and mixed Ethernet and Token Ring environments. If the PIX Firewall has all Token Ring interfaces, you can set bytes to 4056. However, if even one link along the path through the network is not a Token Ring, setting bytes to such a high value may cause poor throughput. In its 1380 byte default value, this command increases throughput of the sysopt security fragguard command. The TCP maximum segment size is the maximum size that an end host can inject into the network at one time (see RFC 793 for more information on the TCP protocol). The sysopt connection tcpmss command is recommended in a network environment being attacked being with overly aggressive TCP or HTTP stack with a faulty path MTU value that is degrading the performance of the PIX Firewall IP Frag Guard feature. Environments where one or more end hosts reside on a Token Ring network are especially susceptible to this faulty behavior.
Note
Although, not advised for normal use of this feature, if you encounter the syslog IPFRAG messages 209001 and 209002, you can raise the bytes value.
sysopt connection timewait
The sysopt connection timewait command is necessary for end host applications whose default TCP terminating sequence is a simultaneous close instead of the normal shutdown sequence (see RFC 793). In a simultaneous close, both ends of the transaction initiate the closing sequence, as opposed to the normal sequence where one end closes and the other end acknowledges prior to initiating its own closing sequence. The default behavior of the PIX Firewall is to track the normal shutdown sequence and release the connection after two FINs and the ACKnowledgment of the last FIN segment. This quick release heuristic enables the PIX Firewall to sustain a high connection rate. However with a simultaneous close, the quick release forces one side of the connection to linger in the CLOSING state (see RFC 793). Many sockets in the CLOSING state can degrade the performance of an end host. For instance, some WinSock mainframe clients are known to exhibit this behavior and degrade the performance of the mainframe server. Old versions of HP/UX are also susceptible to this behavior. Enabling the sysopt connection timewait command enables a quiet time window for the abnormal close down sequence to complete. The no sysopt connection timewait command disables the option, which is off by default.
Note
Use of the sysopt connection timewait command may impact PIX Firewall performance especially with low memory configuration and highly dynamic traffic pattern such as HTTP.
sysopt ipsec pl-compatible
Note
The sysopt ipsec pl-compatible command provides a migration path for Private Link users from Private Link tunnels to IPSec tunnels. The sysopt ipsec pl-compatible command enables the IPSec feature to simulate the Private Link feature supported in PIX Firewall version 4. The Private Link feature provides encrypted tunnels to be established across an unsecured network between Private-Link equipped PIX Firewall units. The sysopt ipsec pl-compatible command allows IPSec packets to bypass the NAT and ASA features and enables incoming IPSec packets to terminate on the sending interface. The no sysopt ipsec pl-compatible command disables the option, which is off by default.
6-190
78-10392-02
Chapter 6
Note
When using the sysopt ipsec pl-compatible command, all PIX Firewall features, such as access list control, stateful inspection, and user authentication, are bypassed for IPSec packets only.
Note
If both the sysopt ipsec pl-compatible command and the sysopt connection permit-ipsec command are used within your configuration, the sysopt ipsec pl-compatible command will take precedence.
Note
If the alias command is used with the sysopt ipsec pl-compatible command, a static route command statement must be added for each IP address specified in the alias command statement.
Examples
For an example of the use of the sysopt ipsec pl-compatible command, see the Converting Private Link to IPSec section in Chapter 3, Advanced Configurations.
sysopt nodnsalias
The sysopt nodnsalias inbound disables inbound embedded DNS A record fixups according to aliases that apply to the A record address. sysopt nodnsalias outbound affects outbound replies. This command remedies the case when a DNS server is on the outside and users on the inside need to access a server on a perimeter interface. In the past, you would use the alias command to permit DNS responses to resolve correctly through the PIX Firewall, but formerly you had to reverse the parameters for the local IP address and foreign IP address. For example, you would normally code the alias command as follows:
alias (inside) 192.168.1.4 209.165.201.11 255.255.255.255
Inside host 192.168.1.5 needs access to www.cisco.com, which resolves at an outside ISP DNS to 209.165.201.11. The PIX Firewall fixes this DNS response sending the host a response of 192.168.1.4. The host uses its gateway (the PIX Firewall) to go to 192.168.1.4, which the PIX Firewall now aliases back to the 209.165.201.11. Because this is actually 192.168.1.4, a server on the perimeter interface of the PIX Firewall, the packet is dropped because the PIX Firewall sent the packet to the outside interface, which is the incorrect interface. The sysopt nodnsalias inbound command has the same effect as reversing the alias command statement parameters as follows:
alias (inside) 209.165.201.11 192.168.1.4 255.255.255.255
This works properly because everything happens in reverse. The DNS is now modified to 209.165.201.11 and the host inside uses its gateway (the PIX Firewall) to get there, the PIX Firewall aliases this back to 192.168.1.4 and routes it out the perimeter interface to the correct host and the TCP connection is established.
sysopt noproxyarp
The sysopt noproxyarp command lets you disable proxy-arps on a PIX Firewall interface.
6-191
Chapter 6 sysopt
Command Reference
sysopt radius ignore-secret
Some commonly used RADIUS servers, such as Livingston version 1.16, have a usage caveat where they do not include the key in the authenticator hash in the accounting acknowledgment response. This can cause the PIX Firewall to continually retransmit the accounting request. Use the sysopt radius ignore-secret command to cause the PIX Firewall to ignore the key in the authenticator of accounting acknowledgments thus avoiding the retransmit problem. (The key described here is the key you set with the aaa-server command.)
sysopt security fragguard
The sysopt security fragguard command enables the IP Frag Guard feature. This feature is disabled by default. This feature enforces two addition security checks in addition to the security checks recommend by RFC 1858 against the many IP fragment style attacks: teardrop, land, and so on. First, each non-initial IP fragments is required to be associated with an already seen valid initial IP fragments. Second, IP fragments are rated to 100 full IP fragmented packets per second to each internal host. The IP Frag Guard feature operates on all interfaces in the PIX Firewall and cannot be selectively enabled or disabled by interface. PIX Firewall uses the security fragguard command to enforce the security policy determined by a access-list permit or access-list deny command to permit or deny packets through the PIX Firewall.
Note
Use of the sysopt security fragguard command breaks normal IP fragmentation conventions. However, not using this command exposes PIX Firewall to the possibility of IP fragmentation attacks. Cisco recommends that packet fragmentation not be permitted on the network if at all possible.
Note
If PIX Firewall is used as a tunnel for FDDI packets between routers, disable the security fragguard command feature.
Note
Because Linux sends IP fragments in reverse order, fragmented Linux packets will not pass through the PIX Firewall with the sysopt security fragguard command enabled. The show sysopt command lists the sysopt commands in the configuration. The clear sysopt command resets the sysopt command to default settings. The no sysopt security fragguard command disables the IP Frag Guard feature.
Examples
The following example disables IP Frag Guard and then lists the current command options:
no sysopt security fragguard show sysopt sysopt security fragguard no sysopt connection tcpmss no sysopt connection timewait
6-192
78-10392-02
Chapter 6
Command Reference telnet
telnet
Specify internal host for PIX Firewall console access via Telnet. (Privileged mode.) telnet ip_address [netmask] [if_name] clear telnet [ip_address [netmask] [if_name]] no telnet [ip_address [netmask] [if_name]] show telnet telnet timeout minutes show telnet timeout
Syntax Description
ip_address
An IP address of a host or network that can access the PIX Firewall Telnet console. If an interface name is not specified, the address is assumed to be on an internal interface. PIX Firewall automatically verifies the IP address against the IP addresses specified by the ip address commands to ensure that the address you specify is on an internal interface. If an interface name is specified, PIX Firewall only checks the host against the interface you specify. Bit mask of ip_address. To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255. If you do not specify netmask, it defaults to 255.255.255.255 regardless of the class of local_ip. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address in ip_address. If IPSec is operating, PIX Firewall lets you specify an unsecure interface name, typically, the outside interface. At a minimum, the crypto map command must be configured to specify an interface name with the telnet command. The number of minutes that a Telnet session can be idle before being closed by PIX Firewall. The default is 5 minutes. The range is 1 to 60 minutes.
netmask
if_name
timeout minutes
Usage Guidelines
The telnet command lets you specify which hosts can access the PIX Firewall console with Telnet. You can enable Telnet to the PIX Firewall on all interfaces. However, the PIX Firewall enforces that all Telnet traffic to the outside interface be IPSec protected. Therefore, to enable Telnet session to the outside interface, configure IPSec on the outside interface to include IP traffic generated by the PIX Firewall and enable Telnet on the outside interface. Up to 16 hosts or networks are allowed access to the PIX Firewall console with Telnet, 5 simultaneously. The show telnet command displays the current list of IP addresses authorized to access the PIX Firewall. Use the no telnet or clear telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout feature to set the maximum time a console Telnet session can be idle before being logged off by PIX Firewall. The clear telnet command does not affect the telnet timeout command duration. The no telnet command cannot be used with the telnet timeout command.
6-193
Chapter 6 telnet
Command Reference
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the firewall console. Use the debug isakmp command to terminate an active Telnet console session. If the aaa command is used with the console option, Telnet console access must be authenticated with an authentication server. Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis.
Note
If you have configured the aaa command to require authentication for PIX Firewall Telnet console access and the console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the password that was set with the enable password command.
Usage Notes
1.
If you do not specify the interface name, the telnet command adds command statements to the configuration to let the host or network access the Telnet console from all internal interfaces. When you use the show telnet command, this assumption may not seem to make sense. For example, if you enter the following command without a netmask or interface name:
telnet 192.168.1.1
If you then use the show telnet command, you see that not just one command statement is specified, but all internal interfaces are represented with a command statement:
show telnet 192.168.1.1 255.255.255.255 inside 192.168.1.1 255.255.255.255 intf2 192.168.1.1 255.255.255.255 intf3
The purpose of the show telnet command is that, were it possible, the 192.168.1.1 host could access the Telnet console from any of these internal interfaces. An additional facet of this behavior is that you have to delete each of these command statements individually with the following commands:
no telnet 192.168.1.1 255.255.255.255 inside no telnet 192.168.1.1 255.255.255.255 intf2 no telnet 192.168.1.1 255.255.255.255 intf3
2.
To access the PIX Firewall with Telnet from the intf2 perimeter interface, use the following command:
telnet 192.168.1.1 255.255.255.255 int2
3. 4.
The default password to access the PIX Firewall console via Telnet is cisco. Some Telnet applications such as the Windows 95 or Windows NT Telnet sessions may not support access to the PIX Firewall units command history feature via the arrow keys. However, you can access the last entered command by pressing Ctrl-P. The telnet timeout command affects the next session started but not the current session. If you connect a computer directly to the inside interface of the PIX Firewall with Ethernet to test Telnet access, you must use a cross-over cable and the computer must have an IP address on the same subnet as the inside interface. The computer must also have its default route set to be the inside interface of the PIX Firewall. Telnet access to the console must be configured before you use PIX Firewall Manager.
5. 6.
7.
6-194
78-10392-02
Chapter 6
Command Reference telnet
8.
If you need to access the PIX Firewall console from outside the PIX Firewall, you can use a static and access-list command pair to permit a Telnet session to a Telnet server on the inside interface, and then from the server to the PIX Firewall. In addition, you can attach the console port to a modem but this may add a security problem of its own. You can use the same terminal settings as for HyperTerminal, which is described in Chapter 2, Configuring the PIX Firewall. If you have IPSec configured, you can access the PIX Firewall console with Telnet from outside the PIX Firewall. Once an IPSec tunnel is created from an outside host to the PIX Firewall, you can access the console from the outside host.
9.
Output from the debug crypto ipsec and debug crypto isakmp commands does not display in a Telnet console session.
See also: aaa, kill, passwd, who.

Examples
The following examples permit hosts 192.168.1.3 and 192.168.1.4 to access the PIX Firewall console via Telnet. In addition, all the hosts on the 192.168.2.0 network are given access:
telnet 192.168.1.3 255.255.255.255 inside telnet 192.168.1.4 255.255.255.255 inside telnet 192.168.2.0 255.255.255.0 inside show telnet 192.168.1.3 255.255.255.255 inside 192.168.1.4 255.255.255.255 inside 192.168.2.0 255.255.255.0 inside
You can remove individual entries with the no telnet command or all telnet command statements with the clear telnet command:
no telnet 192.168.1.3 255.255.255.255 inside show telnet 192.168.1.4 255.255.255.255 inside 192.168.2.0 255.255.255.0 inside clear telnet show telnet
You can change the maximum session idle duration as follows:

telnet timeout 10 show telnet timeout telnet timeout 10 minutes
An example Telnet console login session appears as follows (the password does not display when entered):
PIX passwd: cisco Welcome to the PIX Firewall Type help or ? for a list of available commands. pixfirewall>
6-195
Chapter 6 terminal
Command Reference
terminal
Change console terminal settings. (Configuration mode.) terminal [no] monitor terminal width characters
Syntax Description
monitor width characters
Enable or disable syslog message displays on the console. Set the width for displaying information during console sessions. Permissible values are 0, which means 511 characters, or a value in the range of 40 to 511.
Usage Guidelines
The terminal monitor command lets you enable or disable the display of syslog messages in the current session for either Telnet or serial access to the PIX Firewall console. Use the logging monitor command to enable or disable various levels of syslog messages to the console; use the terminal no monitor command to disable the messages on a per session basis. Use terminal monitor to restart the syslog messages for the current session. The terminal width command sets the width for displaying command output. The terminal width is controlled by the command: terminal width nn, where nn is the width in characters. If you enter a line break, it is not possible to backspace to the previous line.
Examples
The following example shows enabling logging and then disabling logging only in the current session with the terminal no monitor command:
logging monitor terminal no monitor
6-196
78-10392-02
Chapter 6
Command Reference tftp-server
tftp-server
Specify the IP address of the TFTP configuration server. (Configuration mode.) tftp-server [if_name] ip_address path no tftp-server [[if_name] ip_address path] clear tftp-server [[if_name] ip_address path] show tftp-server
Syntax Description
if_name
Interface name on which the TFTP server resides. If not specified, an internal interface is assumed. If you specify the outside interface, a warning message informs you that the outside interface is unsecure. The IP address or network of the TFTP server. The path and filename of the configuration file. The format for path differs by the type of operating system on the server. The contents of path are passed directly to the server without interpretation or checking. The configuration file must exist on the TFTP server. Many TFTP servers require the configuration file to be world-writable to write to it and world-readable to read from it.
ip_address path
Usage Guidelines
The tftp-server command lets you specify the IP address of the server that you use to propagate PIX Firewall configuration files to your firewalls. Use the tftp-server command with the configure net command to read from the configuration or with the write net command to store the configuration in the file you specify. The clear tftp-server command removes the tftp-server command from your configuration. PIX Firewall supports only one TFTP server. The path name you specify in the tftp-server is appended to the end of the IP address you specify in the configure net and write net commands. The more you specify of a file and path name with the tftp-server command, the less you need to specify with the configure net and write net commands. If you specify the full path and filename in the tftp-server command, the IP address in the configure net and write net commands can be represented with a colon ( : ). The no tftp server command disables access to the server. The show tftp-server command lists the tftp-server command statements in the current configuration.
Examples
The following example specifies a TFTP server and then reads the configuration from /pixfirewall/config/test_config:
tftp-server 10.1.1.42 /pixfirewall/config/test_config ... configure net :
6-197
Chapter 6 timeout
Command Reference
timeout
Set the maximum idle time duration. (Configuration mode.) timeout [xlate [hh:mm:ss]] [conn [hh:mm:ss]] [half-closed [hh:mm:ss]] [udp [hh:mm:ss]] [rpc [hh:mm:ss]] [h323 [hh:mm:ss]] [uauth [hh:mm:ss] [absolute | inactivity]] clear timeout show timeout
Syntax Description
xlate hh:mm:ss
Idle time until a translation slot is freed. This duration must be at least 1 minute. The default is 3 hours. Idle time until a connection slot is freed. Use 0:0:0 for the time value to never time out a connection. This duration must be at least 5 minutes. The default is 1 hour.
conn hh:mm:ss
half-closed hh:mm:ss Idle time until a TCP half-close connection is freed. The default is 10 minutes. Use 0:0:0 to never time out a half-closed connection. The minimum is 5 minutes. udp hh:mm:ss Idle time until a UDP slot is freed. This duration must be at least 1 minute. The default is 2 minutes. Idle time until an RPC slot is freed. This duration must be at least 1 minute. The default is 10 minutes. Duration for H.323 inactivity timer. When this time elapses, the port used by the H.323 service closes. This duration must be at least 5 minutes. The default is 5 minutes. Duration before authentication and authorization cache times out and user has to reauthenticate next connection. This duration must be shorter than the xlate values. Set to 0 to disable caching. Do not set to zero if passive FTP is used on the connections. Run uauth timer continuously, but after timer elapses, wait to reprompt the user until the user starts a new connection, such as clicking a link in a web browser. The default uauth timer is absolute. To disable absolute, set the uauth timer to 0 (zero). Start uauth timer after a connection becomes idle.
rpc hh:mm:ss
h323 hh:mm:ss
uauth hh:mm:ss
absolute
inactivity
Usage Guidelines
The timeout command sets the idle time for connection, translation UDP, RPC, and H.323 slots. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence. The clear timeout command sets the durations to their default values.
6-198
78-10392-02
Chapter 6
Command Reference timeout
Note
Do not use the timeout uauth 0:0:0 command if passive FTP is used for the connection, or if the virtual command is used for Web authentication.
Note
The connection timer takes precedence over the translation timer, such that the translation timer only works after all connections have timed out.
uauth inactivity and absolute Qualifiers
The uauth inactivity and absolute qualifiers cause users to have to reauthenticate after either a period of inactivity or an absolute duration.
Note
If you set the inactivity timer to a duration, but the absolute timer to zero, then users are only reauthenticated after the inactivity timer elapses. If you set both timers to zero, then users have to reauthenticate on every new connection. The inactivity timer starts after a connection becomes idle. If a user establishes a new connection before the duration of the inactivity timer, the user is not required to reauthenticate. If a user establishes a new connection after the inactivity timer expires, the user must reauthenticate. The default durations are zero for the inactivity timer and 5 minutes for the absolute timer; that is, the default behavior is to cause the user to reauthenticate every 5 minutes. The absolute timer runs continuously, but waits to reprompt the user when the user starts a new connection, such as clicking a link and the absolute timer has elapsed, then the user is prompted to reauthenticate. The absolute timer must be shorter than the xlate timer; otherwise, a user could be reprompted after their session already ended. Inactivity timers give users the best Web access because they are not prompted to regularly reauthenticate. Absolute timers provide security and manage the PIX Firewall connections better. By being prompted to reauthenticate regularly, users manage their use of the resources more efficiently. Also by being reprompted, you minimize the risk that someone will attempt to use another users access after they leave their workstation, such as in a college computer lab. You may want to set an absolute timer during peak hours and an inactivity timer thereafter. Both an inactivity timer and an absolute timer can operate at the same time, but you should set the absolute timer duration longer than the inactivity timer. If the absolute timer is less than the inactivity timer, the inactivity timer never occurs. For example, if you set the absolute timer to 10 minutes and the inactivity timer to an hour, the absolute timer reprompts the user every 10 minutes; therefore, the inactivity timer will never be started. Use the show timeout command to display the current timeout command settings. See also: show xlate, uauth.
Note
RPC and NFS are very unsecure protocols and should be used with caution.
6-199
Chapter 6 timeout
Command Reference
Examples
The following is the sample output for the show timeout command:
show timeout timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 timeout uauth 0:05:00 absolute
The following is the sample output for the timeout command in which variables are changed and then displayed with the show timeout command:
timeout uauth 0:5:00 absolute uauth 0:4:00 inactivity show timeout timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 timeout rpc 0:10:00 h323 0:05:00 timeout uauth 0:05:00 absolute uauth 0:04:00 inactivity
6-200
78-10392-02
Chapter 6
Command Reference uauth (clear and show)
uauth (clear and show)

Delete all authorization caches for a user. (Privileged mode.) clear uauth [username] show uauth [username]
Syntax Description
username
Usage Guidelines
Clear or view user authentication information by username.
The clear uauth command deletes one users or all users AAA authorization caches, which forces the user or users to reauthenticate the next time they create a connection. The show uauth command displays one or all currently authenticated users, the host IP to which they are bound, and, if applicable, any cached IP and port authorization information. The show uauth command also lists CiscoSecure 2.1 and later idletime and timeout values, which can be set for different user groups. Each user hosts IP address has an authorization cache attached to it. If the user attempts to access a service that has been cached from the correct host, the firewall considers it preauthorized and immediately unproxies the connection. This means that once you are authorized to access a web site, for example, the authorization server is not contacted for each of the images as they are loaded (assuming they come from the same IP address). This significantly increases performance and reduces load on the authorization server. The cache allows up to 16 address and service pairs for each user host. The output from the show uauth command displays the username provided to the authorization server for authentication and authorization purposes, the IP address that the username is bound to, and whether the user is authenticated only, or has cached services. Use the timeout uauth command to specify how long the cache should be kept after the user connections become idle. The timeout command value must be at least 2 minutes. Use the clear uauth command to delete all authorization caches for all users, which will cause them to have to reauthenticate the next time they create a connection. See also: aaa authorization, timeout.
Examples
The following is the sample output for the show uauth command:
show uauth user pat from 209.165.201.2 authenticated user robin from 209.165.201.4 authorized to: port 192.168.67.34/telnet 192.168.67.11/http 192.168.67.56/tcp/25 192.168.67.42/ftp user terry from 209.165.201.7 authorized to: port 192.168.1.50/http 209.165.201.8/http
192.168.67.33/tcp/8001
In this example, Pat has authenticated with the server but has not completed authorization. Robin has preauthorized connections to the Telnet, Web (HTTP), sendmail, FTP services, and to TCP port 8001 on 192.168.67.33. Terry has been browsing the Web and is authorized for Web browsing to the two sites shown.
6-201
Chapter 6 uauth (clear and show)
Command Reference
The next example causes Pat to reauthenticate:

clear uauth pat
6-202
78-10392-02
Chapter 6
Command Reference url-cache
url-cache
Cache responses to URL filtering requests to the Websense server. (Configuration mode.) url-cache dst | src_dst size no url-cache dst | src_dst size clear url-cache show url-cache stat
Syntax Description
dst
Cache entries based on the URL destination address. Select this mode if all users share the same URL filtering policy on the Websense server. Cache entries based on the both the source address initiating the URL request as well as the URL destination address. Select this mode if users do not share the same URL filtering policy on the Websense server. Specify a value for the cache size within the range 1 to 128 KB. Use the stat option to display additional URL cache statistics, including the number of cache lookups and hit rate.
src_dst
size stat
Usage Guidelines
The url-cache command caches responses to URL filtering requests to the Websense server. Caching stores URL access privileges in memory on the PIX Firewall. When a host requests a connection, the PIX Firewall first looks in the URL cache for matching access privileges instead of forwarding the request to the Websense server. Disable caching with the no url-cache command. The clear url-cache command removes url-cache command statements from the configuration.
Note
Access to the URL cache does not update the Websense accounting logs. Before using this command, let Websense run to accumulate logs to let you view Websense accounting information. After you get a usage profile that meets your security needs, enable this command to increase throughput.
Note
If you change settings on the Websense server, disable the cache with the no url-cache command and then re-enable the cache with the url-cache command. The url-cache command allows you to enable URL caching, set the size of the cache, and displays cache statistics. The show url-cache command with the stats option displays the following entries:

SizeThe size of the cache in kilobytes, set with the url-cache size option. EntriesThe maximum number of cache entries based on the cache size. In UseThe current number of entries in the cache.
6-203
Chapter 6 url-cache
Command Reference
LookupsThe number of times the PIX Firewall has looked for a cache entry. HitsThe number of times the PIX Firewall has found an entry in the cache.
You can view additional information about Websense access with the show perfmon command.
Examples
The following example caches all outbound HTTP connections based on the source and destination addresses:
url-cache src_dst 128
The following is the sample output for the show url-cache stat command:
show url-cache stat URL Filter Cache Stats ---------------------Size : 1KB Entries : 36 In Use : 30 Lookups : 300 Hits : 290
6-204
78-10392-02
Chapter 6
Command Reference url-server
url-server
Designate a server running Websense for use with the filter command. (Configuration mode.) url-server [(if_name)] host ip_address [timeout seconds] no url-server host ip_address
Syntax Description
if_name
The network interface where the authentication server resides. If not specified, the default is inside. The server that runs the Websense URL filtering application. The maximum idle time permitted before PIX Firewall switches to the next server you specified. The default is 5 seconds.
host ip_address timeout seconds
Usage Guidelines
The url-server command designates a server that runs Websense, a URL filtering application. Once you designate the server, enable the URL filtering service with the filter command.
Note
You can have a total of 16 URL servers. Follow these steps to filter URLs:
Designate a Websense server with the url-server command. Enable filtering with the filter command. If needed, improve throughput with the url-cache command. However, this command does not update Websense logs, which may affect Websense accounting reports. Accumulate Websense run logs before using the url-cache command. Use the show url-cache stats and the show perfmon commands to view run information. Additional information on Websense is available at the following site: http://www.websense.com
Examples
Step 4
The following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
url-server (perimeter) host 10.0.1.1 filter url http 0 0 0 0 filter url except 10.0.2.54 255.255.255.255 0 0
6-205
Chapter 6 virtual
Command Reference
virtual
Access PIX Firewall virtual server. (Configuration mode.) virtual http ip_address [warn] virtual telnet ip_address
Syntax Description
ip_address
For outbound use, ip_address must be an address routed to the PIX Firewall. Use an RFC 1918 address that is not in use on any interface. For inbound use, ip_address must be an unused global address. An access-list and static command pair must provide access to ip_address, as well as an aaa authentication command statement. See the Examples section for more information. For example, if an inside client at 192.168.0.100 has a default gateway set to the inside interface of the PIX Firewall at 192.168.0.1, the ip_address can be any IP address not in use on that segment (such as 10.2.3.4). As another example, if the inside client at 192.168.0.100 has a default gateway other than the PIX Firewall (such as a router at 192.168.0.254), then the ip_address would need to be set to a value that would get statically routed to the PIX Firewall. This might be accomplished by using a value of 10.0.0.1 for the ip_address, then on the client, setting the PIX Firewall at 192.168.0.1 as the route to host 10.0.0.1.
warn
Let virtual http command users know that the command was redirected. This option is only applicable for text-based browsers where the redirect cannot happen automatically.
Usage Guidelines
The virtual http command lets web browsers work correctly with the PIX Firewall aaa command. The aaa command assumes that the AAA server database is shared with a web server. PIX Firewall automatically provides the AAA server and web server with the same information. The virtual http command works with the aaa command to authenticate the user, separate the AAA server information from the web clients URL request, and direct the web client to the web server. Use the show virtual http command to list commands in the configuration. Us the no virtual http command to disable its use. The virtual http command works by redirecting the web browsers initial connection to the ip_address, which resides in the PIX Firewall, authenticating the user, then redirecting the browser back to the URL which the user originally requested. This mechanism comprises the PIX Firewall units new virtual server feature. The reason this command is named as it is, is because the virtual http command accesses the virtual server for use with HTTP, another name for the Web. This command is especially useful for PIX Firewall interoperability with Microsoft IIS, but is useful for other authentication servers. When using HTTP authentication to a site running Microsoft IIS that has Basic text authentication or NT Challenge enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: Authorization: Basic=Uuhjksdkfhk== to the HTTP GET commands. This string contains the PIX Firewall authentication credentials.
6-206
78-10392-02
Chapter 6
Command Reference virtual
Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied. To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested. Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set. This is because the browser caches the Authorization: Basic=Uuhjksdkfhk== string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts. Flushing the cache is of no use.
Note
If you want double authentication through the authentication and web browser, configure the authentication server to not accept anonymous connections.
Note
Do not set the timeout uauth duration to 0 seconds when using the virtual command because this will prevent HTTP connections to the real web server.
Note
For both the virtual http and virtual telnet commands, if the connection is started on either an outside or perimeter interface, a static and access-list command pair is required for the fictitious IP address. The virtual telnet command allows the Virtual Telnet server to provide a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication. The virtual telnet command can be used both to log in and log out of the PIX Firewall. When an unauthenticated user Telnets to the virtual IP address, they are challenged for their username and password, and then authenticated with the TACACS+ or RADIUS server. Once authenticated, they see the message Authentication Successful and their authentication credentials are cached in the PIX Firewall for the duration of the uauth timeout. If a user wishes to log out and clear their entry in the PIX Firewall uauth cache, the user can again Telnet to the virtual address. The user is prompted for their username and password, the PIX Firewall removes the associated credentials from the uauth cache, and the user will receive a Logout Successful message. If inbound users on either the perimeter or outside interfaces need access to the Virtual Telnet server, a static and access-list command pair must accompany use of the virtual telnet command. The global IP address in the static command must be a real IP address. The local address in the static command is the IP address of the virtual server. The Virtual Telnet server provides a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication. Users first connect to the Virtual Telnet server IP address, where the user is prompted for a username and password.
6-207
Chapter 6 virtual
Command Reference
Examples
virtual httpThe following example shows the commands required to use the virtual http command for an inbound connection:
static (inside, outside) 209.165.201.1 192.168.1.1 netmask 255.255.255.255 access-list acl_out permit tcp any host 209.165.201.1 eq 80 access-group acl_out in interface outside aaa authentication include any inbound 192.168.1.1 255.255.255.255 0 0 tacacs+ virtual http 209.165.201.1
The next example displays the show virtual command output:

show virtual http virtual http 209.165.201.1
virtual telnetAfter adding the virtual telnet command to the configuration and writing the configuration to Flash memory, users wanting to start PPTP sessions through PIX Firewall use Telnet to access the ip_address as shown in the following example: On the PIX Firewall:
virtual telnet 209.165.201.25 static (inside,outside) 209.165.201.25 10.8.8.11 netmask 255.255.255.255 access-list acl_out permit tcp any host 209.165.201.25 eq telnet access-group acl_out in interface outside write memory
On an inside host:
/unix/host%telnet 209.165.201.30 Trying 209.165.201.30... Connected to 209.165.201.30. Escape character is ^]. username: username TACACS+ Password: password Authentication Successful Connection closed by foreign host. /unix/host%
The username and password are those for the user on the TACACS+ server.
6-208
78-10392-02
Chapter 6
Command Reference vpdn
vpdn
Implements the PPTP feature. (Configuration mode.) vpdn enable if_name vpdn group group_name accept dialin pptp vpdn group group_name ppp authentication PAP | CHAP | MSCHAP vpdn group group_name ppp encryption mppe 40 | 128 | auto [required] vpdn group group_name client configuration address local address_pool_name vpdn group group_name client configuration dns dns_server_ip1 [dns_server_ip2] vpdn group group_name client configuration wins wins_server_ip1 [wins_server_ip2] vpdn group group_name client authentication aaa aaa_server_group vpdn group group_name client authentication local vpdn username username password password vpdn group group_name pptp echo echo_timeout
show vpdn tunnel [id tunnel_id | packets | state | summary | transport] show vpdn username [username] show vpdn session [id session_id | username login_name | packets | state | window] show vpdn pppinterface [id intf_id]
clear vpdn [group | username | tunnel [all | [id tunnel_id]]]

Syntax Description
enable if_name
Enable the VPDN function on a PIX Firewall interface. Specify the interface in if_name where PPTP traffic is received. Version 5.1 only supports inbound connections. Specify the VPDN group name. The VPDN group_name is an ASCII string to denote a VPDN group. You can make up the name. The maximum length of the name is 128 bytes. Accept a dial-in request using PPTP.
group group_name
accept dialin pptp
6-209
Chapter 6 vpdn
Command Reference
ppp authentication PAP | Specify the PPP (Point-to-Point Protocol) authentication protocol. The CHAP | MSCHAP Windows client dial-up networking settings lets you specify what authentication protocol to use (PAP, CHAP, or MSCHAP). Whatever you specify on the client must match the setting you use on the PIX Firewall. PAP (Password Authentication Protocol) lets PPP peers authenticate each other. PAP passes the host name or username in clear text. CHAP (Challenge Handshake Authentication Protocol) lets PPP peers prevent unauthorized access through interaction with an access server. MS-CHAP is a Microsoft derivation of CHAP. PIX Firewall supports MS-CHAP version 1 only (not version 2.0). If an authentication protocol is not specified on the host, do not specify the ppp authentication option in your configuration. ppp encryption mppe 40 | Specify the number of session key bits used for MPPE (Microsoft 128 | auto [required] Point-to-Point Encryption) negotiation. The domestic version of the Windows client can support 40- and 128-bit session keys, but international version of the Windows client only supports 40-bit session keys. On the PIX Firewall, use auto to accommodate both. Use required to indicate that MPPE must be negotiated or the connection will be terminated. client configuration address local address_pool_name client configuration dns dns_server_ip1 [dns_server_ip2] Specify the local address pool used to allocate an IP address to a client. Use the ip local pool command to specify the IP addresses for use by the clients. Specify up to two DNS server IP addresses. If set, the PIX Firewall sends this information to the Windows client during the IPCP phase of PPP negotiation.
client configuration wins Specify up to two WINS server IP addresses. wins_server_ip1 [wins_server_ip2] client authentication aaa Specify the AAA server group for user authentication. aaa_server_group client authentication local password pptp echo echo_timeout Authenticate using the local username and password entries you specify in the PIX Firewall configuration. Specify local user password. Specify the PPTP keep-alive echo timeout value in seconds. PIX Firewall terminates a tunnel if an echo reply is not received within the timeout period you specify. Tunnel identification name. Session identification name. A PPP virtual interface is created for each PPTP tunnel. Use the show vpdn session command to display the interface identification value.
id tunnel_id id session_id pppinterface id intf_id
6-210
78-10392-02
Chapter 6
username packets state summary transport window group
Enter or display local username. Packet and byte count. Session state. Tunnel summary information. Tunnel transport information. Window information. [clear command only]Removes all vpdn group commands from the configuration. [clear command only]Removes all vpdn username commands from the configuration. [clear command only]Removes one or more PPTP tunnels from the configuration. [clear command only]Removes all PPTP tunnels from the configuration. [clear command only]Removes PPTP tunnels from the configuration that match tunnel_id. You can view the tunnel IDs with the show vpdn tunnel command.
username
tunnel
all
id tunnel_id
Usage Guidelines
The vpdn command implements the PPTP feature for inbound connections between the PIX Firewall and a Windows client. Point-to-Point Tunneling Protocol (PPTP) is a layer 2 tunneling protocol, which lets a remote client use a public IP network to communicate securely with servers at a private corporate network. PPTP tunnels the IP protocol. RFC 2637 describes the PPTP protocol. Version 5.1 supports only inbound PPTP and only one PIX Firewall interface can have the vpdn command enabled. PPTP is an alternative to IPSec handling for VPN clients. While PPTP is less secure than IPSec, PPTP is easier to implement and maintain. Supported authentication protocols include: PAP, CHAP, and MS-CHAP using external AAA (RADIUS or TACACS+) servers or the PIX Firewall local username and password database. Through the PPP IPCP protocol negotiation, PIX Firewall assigns a dynamic internal IP address to the PPTP client allocated from a locally defined IP address pool. PIX Firewall PPTP VPN supports standard PPP CCP negotiations with Microsoft Point-To-Point Encryption (MPPE) extensions using RSA/RC4 algorithm. MPPE currently supports 40-bit and 128-bit session keys. MPPE generates an initial key during user authentication and refreshes the key regularly. In this release, compression is not supported.
6-211
Chapter 6 vpdn
Command Reference
When you specify MPPE, you must use the MS-CHAP PPP authentication protocol. If you are using an external AAA server, the protocol must be RADIUS and the external RADIUS server must be able to return the Microsoft MSCHAP_MPPE_KEY attribute to the PIX Firewall in the RADIUS Authentication Accept packet. See RFC-2548, Microsoft Vendor Specific RADIUS Attributes, for more information on the MSCHAP_MPPE_KEY attribute. Currently, Cisco has only tested the Steel-Belted RADIUS server from Funk Software as a server able to return the MSCHAP_MPPE_KEYS attribute. PIX Firewall PPTP VPN has been tested with the following Microsoft Windows products: Windows 95 with DUN1.3, Windows 98, Windows NT 4.0 with Service Pack (SP) 6, and Windows 2000 Beta. You can troubleshoot PPTP traffic with the debug ppp and debug vpdn commands. Use the vpdn command with the sysopt connection permit-pptp to allow PPTP traffic to bypass checking of conduit or access-list command statements. The show vpdn commands list tunnel and session information. The clear vpdn command removes all vpdn commands from the configurations and stops all the active PPTP tunnels. The clear vpdn all command lets you remove all tunnels, and the clear vpdn id tunnel_id command lets you remove tunnels associated with tunnel_id. (You can view the tunnel_id with the show vpdn command.) The clear vpdn group command removes all the vpdn group commands from the configuration. The clear vpdn username command removes all the vpdn username commands from the configuration. The clear vpdn command removes all vpdn commands from the configuration.
Examples
The following examples list the output of the show vpdn commands. The following is sample output for the show vpdn tunnel command:
show vpdn tunnel PPTP Tunnel Information (Total tunnels=1 sessions=1) Tunnel id 1, remote id is 1, 1 active sessions Tunnel state is estabd, time since event change 19 secs remote Internet Address 209.165.201.1, port 1723 Local Internet Address 172.16.1.209, port 1723 13 packets sent, 1269 received, 420 bytes sent, 120850 received
The following is sample output for the show vpdn tunnel packet command:
show vpdn tunnel packet PPTP Tunnel Information (Total tunnels=1 sessions=1) LocID 1 Pkts-In 1196 Pkts-Out 13 Bytes-In Bytes-Out 113910 420
The following is sample output for the show vpdn tunnel state command:
show vpdn tunnel state PPTP Tunnel Information (Total tunnels=1 sessions=1)
LocID RemID 1 1
State estabd
Time-Since-Event-Chg 6 secs
6-212
78-10392-02
Chapter 6
The following is sample output for the show vpdn tunnel summary command:
show vpdn tunnel summary PPTP Tunnel Information (Total tunnels=1 sessions=1) LocID RemID 1 1 State Remote Address estabd 172.16.38.194 Port 1723 Sessions 1
The following is sample output for the show vpdn tunnel transport command:
show vpdn tunnel transport PPTP Tunnel Information (Total tunnels=1 sessions=1)
LocID Type Local Address 1 IP 172.16.1.209
Port Remote Address Port 1723 172.16.38.194 1723
The following is sample output for the show vpdn session command:
show vpdn session PPTP Session Information (Total tunnels=1 sessions=1) Call id 1 is up on tunnel id 1 Remote Internet Address is 172.16.38.194 Session username is aperson, state is estabd Time since event change 6552 secs, interface outside Remote call id is 20484 PPP interface id is 1 13 packets sent, 1269 received, 420 bytes sent, 120850 received Seq 14, Ack 1268, Ack_Rcvd 13, peer RWS 64 0 out of order packets
The following is sample output of a simple configuration that allows Windows PPTP clients to dial in without any authentication (not recommended). The Windows client can Telnet to internal host 192.168.0.2 through the static global address 209.165.201.2.
ip local pool my-addr-pool 10.1.1.1-10.1.1.254 vpdn group 1 accept dialin pptp vpdn group 1 client configuration address local my-addr-pool vpdn enable outside static (inside, outside) 209.165.201.2 192.168.0.2 access-list acl_out permit tcp 10.1.1.0 255.255.255.0 host 209.165.201.2 eq telnet access-group acl_out in interface outside
In the next example, PPTP clients authenticate using MS-CHAP and negotiate MPPE encryption with the PIX Firewall. The PPTP client can Telnet to host 192.168.0.2 through the static global 209.165.201.2. The Telnet session will be encrypted.
ip local pool my-addr-pool 10.1.1.1-10.1.1.254 aaa-server my-aaa-server-group (inside) host 192.168.0.10 key 12345678 aaa-server my-aaa-server-group protocol radius vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 client authentication aaa my-aaa-server-group vpdn group 1 ppp encryption mppe auto required vpdn group 1 client configuration address local my-addr-pool vpdn enable outside static (inside, outside) 209.165.201.2 192.168.0.2 access-list acl_out permit tcp 10.1.1.0 255.255.255.0 host 209.165.201.2 eq telnet access-group acl_out in interface outside
6-213
Chapter 6 vpdn
Command Reference
In the next example, PPTP clients authenticate using MS-CHAP, negotiate MPPE encryption, receive the DNS and WINS server addresses, and can Telnet to the host 192.168.0.2 directly through the nat 0 command statement.
ip local pool my-addr-pool 10.1.1.1-10.1.1.254 aaa-server my-aaa-server-group (inside) host 192.168.0.10 key 12345678 aaa-server my-aaa-server-group protocol radius vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe auto required vpdn group 1 client configuration address local my-addr-pool vpdn group 1 client authentication aaa my-aaa-server-group vpdn group 1 client configuration dns 10.2.2.99 vpdn group 1 client configuration wins 10.2.2.100 vpdn enable outside access-list nonat permit ip host 192.168.0.2 10.1.1.0 255.255.255.0 access-list nonat permit ip host 10.2.2.99 10.1.1.0 255.255.255.0 access-list nonat permit ip host 10.2.2.100 10.1.1.0 255.255.255.0 nat (inside) 0 access-list nonat access-list nonat permit tcp 10.1.1.0 255.255.255.0 host 192.168.0.2 eq telnet access-list nonat permit udp 10.1.1.0 255.255.255.0 host 10.2.2.99 eq domain access-list nonat permit udp 10.1.1.0 255.255.255.0 host 10.2.2.100 eq netbios-ns
In the next example, PPTP clients authenticate using MS-CHAP, negotiate MPPE encryption, receive the DNS and WINS server addresses, and can Telnet to the host 192.168.0.2 directly through the nat 0 command statement. An access-group command statement is not present because the sysopt connection permit-pptp command statement allows all the PPTP traffic through the tunnel.
ip local pool my-addr-pool 10.1.1.1-10.1.1.254 aaa-server my-aaa-server-group (inside) host 192.168.0.10 key 12345678 aaa-server my-aaa-server-group protocol radius vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe auto required vpdn group 1 client configuration address local my-addr-pool vpdn group 1 client authentication aaa my-aaa-server-group vpdn group 1 client configuration dns 10.2.2.99 vpdn group 1 client configuration wins 10.2.2.100 vpdn enable outside access-list nonat permit ip host 192.168.0.2 10.1.1.0 255.255.255.0 access-list nonat permit ip host 10.2.2.99 10.1.1.0 255.255.255.0 access-list nonat permit ip host 10.2.2.100 10.1.1.0 255.255.255.0 nat (inside) 0 access-list nonat sysopt connection permit-pptp
6-214
78-10392-02
Chapter 6
In the next example, PPTP clients authenticate using MS-CHAP, negotiate MPPE encryption, receive the DNS and WINS server addresses, and can Telnet to the host 192.168.0.2 directly through the nat 0 command. The PPTP authenticates using the PIX Firewall local username and password database you create with the vpdn username command. Users are reauthenticated again by the aaa command when they start a Telnet session. An access-group command statement is not present because the sysopt connection permit-pptp command statement allows all the PPTP traffic through the tunnel.
ip local pool my-addr-pool 10.1.1.1-10.1.1.254 aaa-server my-aaa-server-group (inside) host 192.168.0.10 key 12345678 aaa-server my-aaa-server-group protocol radius vpdn username usrname1 password password1 vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe auto required vpdn group 1 client configuration address local my-addr-pool vpdn group 1 client authentication local vpdn group 1 client configuration dns 10.2.2.99 vpdn group 1 client configuration wins 10.2.2.100 vpdn enable outside access-list nonat permit ip host 192.168.0.2 10.1.1.0 255.255.255.0 access-list nonat permit ip host 10.2.2.99 10.1.1.0 255.255.255.0 access-list nonat permit ip host 10.2.2.100 10.1.1.0 255.255.255.0 nat (inside) 0 access-list nonat sysopt connection permit-pptp aaa authentication include telnet inbound 192.168.0.2 255.255.255.255 10.1.1.0 255.255.255.0
6-215
Chapter 6 who
Command Reference
who
Show active Telnet administration sessions on the PIX Firewall. (Unprivileged mode.) who [local_ip] show who [local_ip]
Syntax Description
local_ip
An optional internal IP address to limit the listing to one IP address or to a network IP address.
Usage Guidelines
The who command shows the PIX Firewall TTY_ID and IP address of each Telnet client currently logged into the PIX Firewall. This command is the same as the show who command. See also: kill, telnet.
Examples
The following example shows how to display the current Telnet sessions:
who 2: From 192.168.2.2 1: From 192.168.1.3
6-216
78-10392-02
Chapter 6
Command Reference write
write
Store, view, or erase the current configuration. (Privileged mode.) write net [[server_ip]:[filename]] write erase write floppy write memory write standby write terminal
Syntax Description
server_ip
Store current configuration at a host available across the network. If you specify the full path and filename in the tftp-server command, only specify a colon ( : ) in the write command. A filename you specify to qualify the location of the configuration file on the TFTP server named in server_ip. If you set a filename with the tftp-server command, do not specify it in the write command; instead just use a colon ( : ) without a filename. Many TFTP servers require the configuration file to be world-writable to write to it.
filename
erase floppy memory standby terminal

Usage Guidelines
Clear the Flash memory configuration. Store current configuration on diskette. Store current configuration in Flash memory. Store configuration to the failover Standby unit from RAM to RAM. Display current configuration on the terminal.
The write net command stores the current configuration into a file on a TFTP server elsewhere in the network. Additionally, the write net command uses the TFTP server IP address specified in the tftp-server command. If you specify both the IP address and path name in the tftp-server command, you can specify the write net :filename as simply a colon ( : ). For example:
write net :
Use the configure net command to get the configuration from the file. The write erase command clears the Flash memory configuration.
6-217
Chapter 6 write
Command Reference
The write floppy command stores the current configuration on diskette. The diskette must be DOS formatted or a PIX Firewall boot disk. If you are formatting the diskette from Windows, choose the Full format type, not the Quick (erase) selection. You can tell that information is stored on the diskette by observing that the light next to the diskette drive glows while information transfers. The diskette you create can only be read or written by the PIX Firewall. If you use the write floppy command with a diskette that is not a PIX Firewall boot disk, do not leave the floppy in the floppy drive because it will prevent the firewall from rebooting in the event of a power failure or system reload. Only one copy of the configuration can be stored on a single diskette. The write memory command saves the current running configuration to Flash memory. Use the configure memory command to merge the current configuration with the image you saved in Flash memory. PIX Firewall lets processing continue during the write memory command. If another PIX Firewall console user tries to change the configuration while you are executing the write memory command, the user receives the following messages:
Another session is busy writing configuration to memory Please wait a moment for it to finish
After the write memory command completes, PIX Firewall lets the other command complete.
Note
Only use the write memory command if a configuration has been created with IP addresses for both network interfaces. The write standby command writes the configuration stored in RAM on the Active failover unit to the RAM on the Standby unit. When the Primary unit boots it automatically writes the configuration to the Secondary unit. Use the write standby command if the primary and secondary units configurations have different information. The write terminal command displays the current configuration in the PIX Firewall units RAM memory. You can also display the configuration stored in Flash memory using the show configure command. See also: configure.
Examples
The following example specifies a configuration file on the TFTP server and then stores the configuration in the new_config file:
tftp-server 10.1.1.2 /pixfirewall/config/new_config write net :
The following example erases the contents of Flash memory and reloads the PIX Firewall:
write erase Erase PIX configuration in Flash memory? [confirm] y reload
The following example saves the configuration on diskette:

write floppy Building configuration [OK]
6-218
78-10392-02
Chapter 6
Command Reference write
The following example saves the current configuration to Flash memory:

write memory Building configuration [OK]
The following example displays the configuration:

write terminal Building configuration : Saved
6-219
Chapter 6 xlate (clear and show)
Command Reference
xlate (clear and show)

View or clear translation slot information. (Privileged mode.) clear xlate [global | local ip1[-ip2] [netmask mask]] lport | gport port[-port]] [interface if1[,if2][,ifn]] [state static [,dump] [,portmap] [,norandomseq] [,identity]] show xlate [global | local ip1[-ip2] [netmask mask]] lport | gport port[-port]] [interface if1[,if2][,ifn]] [state static [,dump] [,portmap] [,norandomseq] [,identity]]
Syntax Description
[global | local ip1[-ip2] [netmask mask] lport | gport port[-port]
Display active translations by global IP address or local IP address using the network mask to qualify the IP addresses. Display active translations by local and global port specifications. See Ports in Chapter 1, Introduction for a list of valid port literal names. Display active translations by interface. Display active translations by state; static translation (static), dump (cleanup), PAT global (portmap), a nat or static translation with the norandomseq setting (norandomseq), or the use of the nat 0, identity feature (identity).
interface if1[,if2][,ifn] state
Usage Guidelines
The clear xlate command clears the contents of the translation slots. (xlate means translation slot.) The show xlate command displays the contents of only the translation slots. Translation slots can persist after key changes have been made. Always use the clear xlate command after adding, changing, or removing the aaa-server, access-list, alias, conduit, global, nat, route, or static commands in your configuration. See also: show conn, timeout, uauth.
Examples
The following is sample output for two static translations, the first with two associated connections (called nconns) and the second with four.
show xlate Global 209.165.201.10 Local 209.165.201.10 static nconns 1 econns 0 Global 209.165.201.30 Local 209.165.201.30 static nconns 4 econns 0
6-220
78-10392-02

Commands

Uploaded by

Copyright:

Available Formats

Commands

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Commands

Uploaded by

Copyright:

Available Formats

C H A P T E R

Command Reference aaa

aaa authorization include udp/53-1024 inside 0 0 0 0

Command Reference aaa

The group tag set with the aaa-server command.

PIX Firewall does not support RADIUS authorization.

Command Reference aaa

See also: aaa-server, auth-prompt, service, telnet, virtual.

Command Reference aaa

Command Reference aaa-server

if_name host server_ip key

protocol auth_protocol The type of AAA server, either tacacs+ or radius.

Command Reference aaa-server

acl_name in interface interface-name

Always use the access-list command with the access-group command.

Command Reference access-list

Command Reference access-list

Command Reference access-list

ICMP Message Types

Command Reference alias

Command Reference alias

The alias command follows:

The access-list command statement you would expect to use follows:

But with the alias command, use this command:

Command Reference arp

accept reject prompt

After this string is added to the configuration, users view:

The prompt keyword can be included or omitted. For example:

This command statement is the same as the following:

ca configure ca_nickname ca | ra retry_period retry_count [crloptional] no ca configure ca_nickname show ca configure

ca crl request ca_nickname

ca enroll ca_nickname challenge_password [serial] [ipaddress] no ca enroll ca_nickname

ca generate rsa key | specialkey key_modulus_size

ca identity ca_nickname ca_ipaddress[:ca_script_location] [ldap_ip address] no ca identity ca_nickname show ca identity

ca save all no ca save all

show ca certificate ca zeroize rsa show ca mypubkey rsa

serial ipaddress key specialkey

The sections that follow describe each ca command.

show ca mypubkey rsa

Command Reference clear Commands

Unprivileged Mode Clear Commands

Clear Command clear pager

Description Resets the number of displayed lines to 24.

Described on Command Page pager

Privileged Mode Clear Commands

Described on Command Page arp auth-prompt

Chapter 6 clear Commands

Conguration Mode Clear Commands

Clear Command clear aaa clear access-list

Described on Command Page aaa access-list

Command Reference clear Commands

Conguration Mode Clear Commands (continued)

Chapter 6 clear Commands

Conguration Mode Clear Commands (continued)

Clear Command clear url-server clear virtual clear vpdn

Described on Command Page url-server virtual vpdn

Command Reference clock

Command Reference conduit

permit deny protocol

Note By default, all ports are denied until explicitly permitted.