Table of Contents

Preface

Overview of the ACS Command Line Interface

Using the ACS Command Line Interface

ACS Command Reference

Title Page

Preface

This guide describes how you can configure and maintain Cisco Secure Access Control System (ACS) 5.8.1 by using the command-line interface (CLI). Each topic provides a high-level summary of the tasks required for using the CLI in the Cisco Application Deployment Engine (ADE) OS 2.2 which, in combination with ACS 5.8.1, runs on the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliances.

■Who Should Read This Guide

■How to Use This Guide

■How This Guide Is Organized

■Document Conventions

■Documentation Updates

■Related Documentation

■Obtaining Documentation and Submitting a Service Request

Use this guide in conjunction with the documentation listed in Related Documentation.

Who Should Read This Guide

The majority of the instructions in this guide are straightforward; however, a few are complex. Therefore, only experienced users should use these instructions.

Use this guide in conjunction with the documentation listed in Related Documentation.

How to Use This Guide

Cisco recommends the following:

■Read the document in its entirety. Subsequent sections build on information and recommendations discussed in previous sections.

■Use this document for all-inclusive information about the ACS appliance.

■Do not vary from the command-line conventions (see Document Conventions).

How This Guide Is Organized

Title

Description

Overview of the ACS CLI

Provides an overview of the ACS CLI environment and command modes.

Using the ACS CLI

Describes how you can access and administer ACS from the CLI.

ACS Command Reference

Provides a complete description of all the commands.

Document Conventions

Convention

Description

font

Commands and keywords.

font

Variables for which you supply values.

[ ]

Keywords or arguments that appear within square brackets are optional.

{x | y | z}

A choice of required keywords appears in braces separated by vertical bars. You must select one.

font

Examples of information displayed on the screen.

font

Examples of information you must enter.

< >

Nonprinting characters (for example, passwords) appear in angle brackets.

[ ]

Default responses to system prompts appear in square brackets.

. Notes contain helpful suggestions or references to material not covered in the manual.

. A tip might not consist of an action or troubleshooting help, but could still contain useful information.

Documentation Updates

Table 1 Updates to CLI Reference Guide for Cisco Secure Access Control System 5.8.1

Date

Description

03/21/2016

Cisco Secure Access Control System, Release 5.8.1

Related Documentation

for any updates.

Select Products > Security > Access Control and Policy > Cisco Secure Access Control System > Cisco Secure Access Control System 5.8.1.

Table 2 Product Documentation

Document Title

Available Formats

Installation and Upgrade Guide for Cisco Secure Access Control System 5.8.1

Software Developer’s Guide for Cisco Secure Access Control System 5.8.1

Obtaining Documentation and Submitting a Service Request

, which also lists all new and revised Cisco technical documentation, at:

as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.

Overview of the ACS CLI

Cisco Secure Access Control System (ACS) 5.8.1 uses the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliances running the Cisco Application Deployment Engine (ADE) OS 2.2.2.011. This chapter provides an overview of how to access the ACS CLI, the different command modes, and the commands that are available in each mode.

You can configure and monitor ACS 5.8.1 through the web interface. You can also use the CLI to perform the configuration and monitoring tasks that this guide describes.

The following sections describe the ACS CLI:

■Accessing the ACS Command Environment

■User Accounts and Modes in ACS

■Types of Command Modes in ACS

■CLI Audit

Accessing the ACS Command Environment

You can access the ACS CLI through a secure shell (SSH) client or the console port using one of the following machines:

■Windows PC running Windows 7/XP/Vista.

■Apple computer running Mac OS X 10.4 or later.

■PC running Linux.

For detailed information on accessing the CLI, see Using the ACS CLI

User Accounts and Modes in ACS

Two different types of accounts are available on the ACS server:

■Admin (administrator)

■Operator (user)

utility to configure the appliance. During this setup process, an administrator user account, also known as an Admin account, is created.

After you enter the initial configuration information, the appliance automatically reboots and prompts you to enter the username and the password that you specified for the Admin account. It is this Admin account that you must use to log in to the ACS CLI for the first time.

commands but cannot modify the configurations.

command in the configuration mode (see Types of Command Modes in ACS).

Table 1 lists the command privileges for each type of user account: Admin and Operator (user).

Table 1 Command Privileges

Command

User Account

Admin

Operator (User)

access-setting accept-all

acs commands

acs config

acs-config-web-interface

application commands

backup

backup-logs

banner

cdp run

clock

configure terminal

copy commands

crypto

debug

debug-adclient

debug-log

delete

dir

end

exit

export-data

export-data-message-catalog

forceout

halt

hostname

icmp

import-data

import-export-abort

import-export-status

interface

ip default-gateway

ip domain-name

ip domain round-robin

ip domain timeout

ip name-server

ip route

ipv6 enable

ipv6 route

kron

logging commands

mkdir

nslookup

ntp

password

password policy

patch

ping

reload

replication

repository

reset-management-interface-certificate

restore commands

rmdir

service

show acs-cores

show acs-config-web-interface

show acs-logs

show application

show backup

show cdp

show clock

show cpu

show crypto

show debug-adclient

show debug-log

show disks

show icmp_status

show interface

show inventory

show ip route

show ipv6 route

show logging

show logins

show memory

show ntp

show ports

show process

show repository

show restore

show running-configuration

show startup-configuration

show tac

show tech-support

show terminal

show timezone

show timezones

show udi

show uptime

show users

show version

snmp-server commands

ssh

tcp

tech

telnet

terminal

traceroute

undebug

username

write

When you log in to the ACS server, it places you in the Operator (user) mode or the Admin (EXEC) mode. Typically, logging in requires a username and password.

You can always tell when you are in the Operator (user) mode or Admin (EXEC) mode by looking at the prompt. A right angle bracket (>) appears at the end of the Operator (user) mode prompt; a pound sign (#) appears at the end of the Admin mode prompt, regardless of the submode.

ACS configuration mode requires a specific, authorized user role to execute each ACS configuration command; see ACS Configuration Commands.

Types of Command Modes in ACS

ACS supports these command modes:

■EXEC—Use the commands in this mode to perform system-level configuration. In addition, certain EXEC mode commands have ACS-specific abilities. See EXEC Commands.

■ACS configuration—Use the commands in this mode to import or export configuration data, synchronize configuration information between the primary and secondary ACS, reset IP address filtering and management interface certificate, define debug logging and show the logging status.

This mode requires an administrator user account to log in and perform the ACS configuration-related commands. See ACS Configuration Commands.

■Configuration—Use the commands in this mode to perform additional configuration tasks in ACS. See Configuration Commands.

EXEC Commands

(for example, application installation, application start and stop, copy files and installations, restore backups, and display information).

In addition, certain EXEC-mode commands have ACS-specific abilities (for example, start an ACS instance, display and export ACS logs, and reset an ACS configuration to factory default settings.

■Table 2 lists the EXEC commands and provides a short description of each.

■Table 3 lists the show commands in the EXEC mode and provides a short description of each.

For detailed information on EXEC commands, see Understanding the Command Modes.

EXEC or System-Level Commands

Table 2 Summary of EXEC Commands

Command

Description

acs start | stop

Starts or stops an ACS server.

acs start | stop process

Starts or stops a process in ACS.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs delete core

Deletes an ACS run-time core file or JVM core log.

acs delete log

Deletes an ACS run-time core file or JVM core log excluding the latest log.

acs config-web-interface

Enables or disables an interface for ACS configuration web.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Restores an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

acs zeorize-machine

Starts the zeroization; deletes key and sensitive files, running memory, and swap files.

application install

Installs a specific application bundle.

application remove

Removes a specific application.

application reset-config

Resets an ACS configuration to factory defaults.

application start

Starts or enables a specific application.

application stop

Stops or disables a specific application.

application upgrade

Upgrades a specific application bundle.

backup

Performs a backup and places the backup in a repository.

backup-logs

Performs a backup of all the logs on ACS to a remote location.

banner

Displays the banner text before and after logging in to ACS CLI.

clock

Sets the system clock on the ACS server.

configure

Enters the Configuration mode.

copy

Copies any file from a source to a destination.

crypto

Performs crypto key operations.

debug

Displays any errors or events for various command situations; for example, backup and restore, configuration, copy, resource locking, file transfer, and user management.

delete

Deletes a file in the ACS server.

dir

Lists the files in the ACS server.

exit

Exits from the EXEC mode.

forceout

Forces the logout of all the sessions of a specific ACS server system user.

halt

Disables or shuts down the ACS server.

help

Describes the help utility and how to use it in the ACS server.

mkdir

Creates a new directory.

nslookup

Queries the IPv4 address or hostname of a remote system.

ping

Determines the network connectivity to a remote system.

password

Updates the CLI password.

reload

Reboots the ACS server.

restore

Restores a previous backup.

rmdir

Removes an existing directory.

show

Provides information about the ACS server.

ssh

Starts an encrypted session with a remote system.

tech

Provides Technical Assistance Center (TAC) commands.

telnet

Telnets to a remote system.

terminal length

Sets terminal line parameters.

terminal session-timeout

Sets the inactivity timeout for all terminal sessions.

terminal session-welcome

Sets the welcome message on the system for all terminal sessions.

terminal terminal-type

Specifies the type of terminal connected to the current line of the current session.

traceroute

Traces the route of a remote IP address.

undebug

command for various command situations. For example, backup and restore, configuration, copy, resource locking, file transfer, and user management.

write

Copies, displays, or erases the running ACS server information.

Show Commands

The show commands are used to view the ACS settings and are among the most useful commands. See Table 3 for a summary of the show commands.

.

Table 3 Summary of Show Commands

Command

Description

acs-cores

Displays ACS run-time core files and JVM core logs.

acs-logs

Displays ACS server debug logs.

acs config-web-interface

Indicates whether an interface is disabled or enabled for ACS configuration web.

application

(requires keyword)

Displays information about the installed application. For example, status information or version information.

backup

(requires keyword)

Displays information about the backup.

cdp

(requires keyword)

Displays information about the enabled Cisco Discovery Protocol (CDP) interfaces.

clock

Displays the day, date, time, time zone, and year of the system clock.

cpu

Displays CPU information.

crypto

Displays crypto key information.

disks

Displays file-system information of the disks.

icmp_status

Displays the Internet Control Message Protocol (ICMP) echo/response configuration information.

interface

Displays statistics for all the interfaces configured on ACS.

inventory

Displays information about the hardware inventory, including the ACS appliance model and serial number.

logging

(requires keyword)

Displays ACS server logging information.

ip route

Displays the static ip routes.

ipv6 route

Displays the ipv6 routes.

logins

(requires keyword)

Displays the login history of an ACS server.

memory

Displays memory usage by all running processes.

ntp

Displays the status of the Network Time Protocol (NTP) servers.

ports

Displays all the processes listening on the active ports.

process

Displays information about the active processes of the ACS server.

repository

(requires keyword)

Displays the file contents of a specific repository.

restore

(requires keyword)

Displays the restore history in ACS.

running-config

Displays the contents of the configuration file that currently runs in ACS.

startup-config

Displays the contents of the startup configuration in ACS.

tech-support

Displays system and configuration information that you can provide to the Cisco Technical Assistance Center (TAC) when you report a problem.

terminal

Displays information about the terminal configuration parameter settings for the current terminal line.

timezone

Displays the current time zone in ACS.

timezones

Displays all the time zones available for use in ACS.

udi

Displays information about the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance Unique Device Identifier (UDI).

uptime

Displays how long the system you are logged in to has been up and running.

users

Displays information about the system users.

version

Displays information about the currently loaded software version, along with hardware and device information.

ACS Configuration Commands

Use ACS configuration commands to set the debug log level for the ACS management and runtime components, to show system settings, to reset server certificates and IP address access lists, and to manage import and export processes.

command in EXEC mode.

Table 4 lists the ACS configuration commands and provides a short description of each.

Table 4 Summary of ACS Configuration Commands

Command

Description

Required User Role

access-setting accept-all

Resets IP address filtering to allow all IP addresses to access the management pages of an ACS server.

Only the super admin can run this command on a primary ACS node.

acsview-db-compress

Compresses the ACS View database by rebuilding each table in the database and releasing the unused space. As a result, the physical size of the database is reduced.

Any authorized user, irrespective of role, can run this command.

acsview merge-from-supportbundle

Merges the ACS View database with the specified support bundle data.

Only the super admin or system admin can run this command.

acsview rebuild-database

Rebuilds the ACS View database and keeps the log data only for the specified number of days.

Only the super admin or system admin can run this command.

acsview replace-clean-

activesessionsdb

Removes the active session information from the ACS View database and makes it as a fresh database.

Only the super admin or system admin can run this command.

acsview replace-cleandb

Removes all data from the ACS View database and makes the current View database as a fresh View database.

Only the super admin or system admin can run this command.

acsview show-dbsize

Displays the physical and actual size of the ACS view database and the transaction log files.

Only the super admin or system admin can run this command.

acsview truncate-log

Truncates the ACS view database transaction logs.

Only the super admin or system admin can run this command.

database-compress

Reduces the ACS database size by removing unused disk space from within the ACS database file.

Any authorized user, irrespective of role, can run this command.

debug-adclient

Enables debug logging of an Active Directory client.

Only the network-device admin can run this command.

debug-log

Defines the local debug logging level for the ACS components.

Any authorized user, irrespective of role, can run this command.

export-data

Exports configuration data from an ACS local store to a remote repository.

Only users who have Read permission to a specific configuration object in the web interface can export that particular configuration data to a remote repository.

export-data-message-catalog

Exports the message catalog messages from the ACS message catalog to a remote repository.

Only users who have Read permission to the message catalog messages in ACS web interface can export those particular log messages to a remote repository.

import-data

Imports configuration data from a remote repository to an ACS local store.

Only users who have Create, Read, Update, and Delete (CRUD) permissions to a specific configuration object in the web interface can import that particular configuration data to an ACS local store.

import-export-abort

Aborts specific (or all) import and export processes.

Only the super admin can simultaneously abort a running process and all pending import and export processes.

However, a user who owns a particular import or export process can terminate that particular process by using the process ID, or by stopping the process when it is in progress.

import-export-status

Displays the status of the import and export processes.

Any authorized user, irrespective of role, can run this command.

no debug-adclient

Disables debug logging of an Active Directory client.

Only the network-device admin can run this command.

no debug-log

Restores the default local debug logging level of the ACS components.

Any authorized user, irrespective of role, can run this command.

replication force-sync

Synchronizes configuration information between the primary and secondary ACS.

Only the super admin or system admin can run this command on a secondary ACS node.

replication status

Shows the replication status of the ACS database.

Only the super admin or system admin can run this command.

reset-management-

interface-certificate

Resets the management interface certificate to the default self-signed certificate.

Only the super admin or system admin can run this command.

show debug-adclient

Displays debug logging status for an Active Directory client.

Any authorized user, irrespective of role, can run this command.

show debug-log

Displays the local debug logging status for subsystems.

Any authorized user, irrespective of role, can run this command.

For detailed information on ACS Configuration mode commands, see Understanding the Command Modes.

Configuration Commands

command in the EXEC mode.

Some of the configuration commands will require you to enter the configuration submode to complete the configuration.

Table 5 lists the configuration commands and provides a short description of each.

Table 5 Summary of Configuration Commands

Command

Description

backup-staging-url

Specifies a Network File System (NFS) temporary space or staging area for the remote directory for backup and restore operations.

cdp holdtime

Specifies the amount of time the receiving device should hold a CDP packet from the ACS server before discarding it.

cdp run

Enables CDP.

cdp timer

Specifies how often the ACS server sends CDP updates.

clock

Sets the time zone for display purposes.

conn-limit

Configures the TCP connection limit from the source IP.

do

Executes an EXEC-level command from the configuration mode or any configuration submode.

command precedes the EXEC command.

end

Returns to EXEC mode.

exit

Exits the configuration mode.

hostname

Sets the hostname of the system.
When you intend to use the AD ID store and set up multiple ACS instances with the same name prefix, use a maximum of 19 characters for the hostname, so that it does not affect AD functionality.

icmp echo

Configures the ICMP echo requests.

interface

Configures an interface type and enters the interface configuration mode.

ip address

Sets the IP address and netmask for the Ethernet interface.

This is an interface configuration command.

ipv6 address

Sets the IPv6 address and prefix length for the Ethernet interface. This is an interface configuration command.

ipv6 address autoconfig

Enables IPv6 stateless autoconfiguration in the interface configuration mode.

ip default-gateway

Defines or sets a default gateway with an IP address.

ip domain-name

Defines a default domain name that an ACS server uses to complete hostnames.

ip domain round-robin

Defines a round robin selection of name servers from the available list of name servers.

ip domain timeout

Defines a default amount of time the resolver will wait for a response from a remote name server before retrying the query via a different name server

ip name-server

Sets the Domain Name System (DNS) servers for use during a DNS query.

ip route

Configures the static IPv4 address routes.

ipv6 enable

Enables the IPv6 stack globally or for a specific interface.

ipv6 route

Configures the static IPv6 address routes.

kron occurrence

Schedules one or more Command Scheduler commands to run at a specific date and time or at a recurring level.

kron policy-list

Specifies a name for a Command Scheduler policy.

logging

Enables the system to forward logs to a remote system.

logging loglevel

command.

max-ssh

Configures the number of concurrent SSH sessions with a remote system.

no

Disables or removes the function associated with the command.

ntp

Synchronizes the software clock through the NTP server for the system.

ntp authenticate

Enables authentication of all time sources.

ntp authentication-key

Adds Message Digest 5 (MD5)-type authentication keys for trusted time sources.

ntp server

Specifies an NTP server to use.

ntp trusted-key

Specifies the key numbers for trusted time sources.

password-policy

Enables and configures the password policy.

rate-limit

Configures the TCP/UDP/ICMP packet-rate limit from the source IP.

repository

Enters the repository submode.

service

Specifies the type of service to manage.

snmp-server community

Sets up the community access string to permit access to the Simple Network Management Protocol (SNMP).

snmp-server contact

Configures the SNMP contact MIB value on the system.

snmp-server host

Sends SNMP traps to a remote system.

snmp-server location

Configures the SNMP location MIB value on the system.

snmp-server trap dskThresholdLimit

Configures the SNMP server to receive traps when a ACS partition reaches its disk threshold utilization value.

synflood-limit

Configures the TCP SYN packet limit from the source IP.

tcp

Enables fast recycling of TIME_WAIT sockets, enables reuse of TIME_WAIT sockets, and configures the timeout value for TCP final packets.

username

Adds a user to the system with a password and a privilege level.

For detailed information on configuration mode and submode commands, see Understanding the Command Modes.

CLI Audit

You must have administrator access to execute ACS configuration commands. Whenever an administrator logs in to the configuration mode and executes a command that causes configuration changes in the ACS server, the information related to those changes is logged in the ACS operational logs.

Table 6 lists the configuration mode commands that, when executed, generate operational logs.

Table 6 Configuration Mode Commands for the Operation Log

Command

Description

clock

Sets the system clock on the ACS server.

hostname

Sets the hostname of the system.

ip address

Sets the IP address and netmask for the Ethernet interface.

ip name-server

Sets the DNS servers for use during a DNS query.

ntp

Specifies NTP configuration.

ntp server

Allows synchronization of the software clock by the NTP server for the system.

You can view these logs using the show acs-logs command. For more information on log file types and the information that is stored in each log file, see show acs-logs.

In addition to the configuration mode commands, there are some commands in the EXEC and ACS configuration mode that generate operational logs, as listed in Table 7 and Table 8:

Table 7 EXEC Mode Commands for the Operation Log

Command

Description

acs (Instance)

Starts or stops an ACS instance.

acs (Process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs delete core

Deletes an ACS run-time core file or JVM core log.

acs delete log

Deletes an ACS run-time core file or JVM core log excluding the latest log.

acs patch

Installs and removes ACS patches.

acs restore

Performs a restoration of an ACS configuration.

acs reset-config

Resets the ACS configuration to factory defaults.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository. If View exists, View data will also get backed up.

backup-logs

Backs up system logs.

restore

Restores from backup the file contents of a specific repository.

Table 8 ACS Configuration Mode Commands for the Operation Log

Command

Description

access-setting accept-all

Resets the IP address filtering to allow all IP addresses to access the management pages of an ACS server.

debug-adclient

Enables debug logging of an Active Directory client.

debug-log

Defines the local debug logging level for the ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

export-data-message-catalog

Exports the message catalog messages from ACS message catalog to a remote repository.

import-data

Imports configuration data from a remote repository to an ACS local store.

import-export-abort

Aborts specific (or all) import and export processes.

replication

Synchronizes configuration information between the primary and secondary ACS.

reset-management-interface-certificate

Resets the management interface certificate to the default self-signed certificate.

Using the ACS CLI

This chapter provides helpful tips for understanding and configuring the Cisco Secure ACS 5.8.1 from the CLI.

■Before Accessing the ACS CLI

■Accessing the ACS CLI

■Understanding the Command Modes

■Navigating the CLI Commands

■Where to Go Next

Before Accessing the ACS CLI

Before logging in to the ACS CLI, review the tasks that you should have completed during hardware installation:

1. Starting the CSACS-1121 Appliance

2. Starting the Cisco SNS-3415 and Cisco SNS-3495 Appliances

3. Running Setup to Configure ACS

Starting the CSACS-1121 Appliance

Complete these steps before you configure the CSACS-1121 appliance:

1. Connect the power cord to the CSACS-1121 (see Figure 1).

Figure 1 Rear View of CSACS-1121

1

AC power receptacle

5

(Blocked) GigabitEthernet 1

2

(Blocked) GigabitEthernet

6

(In Use) GigabitEthernet 0

3

Serial connector

7

USB 3 connector

4

Video connector

8

USB 4 connector

2. Connect the network cable to the GigabitEthernet 0 connector (see Figure 1).

The setup utility (that appears when the CSACS-1121 boots) only configures the GigabitEthernet 0 port. For information on connecting cables, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.8.1.

3. Power up the CSACS-1121.

The appliance boots automatically, and the setup utility appears (see Running Setup to Configure ACS).

Starting the Cisco SNS-3415 and Cisco SNS-3495 Appliances

Complete these steps before you configure the Cisco SNS-3415 or Cisco SNS-3495 appliance:

1. Connect the power cord to the Cisco SNS-3415 or Cisco SNS-3495 appliance (see Figure 2).

Figure 2 Cisco SNS-3415 Appliance Rear View

1

Power supply

7

Serial port (RJ-45 connector)

2

Slot 2: Low-profile PCIe slot on riser (half-height, half-length, x16 connector, x8 lane width)

8

1-GB Ethernet dedicated management port used to access CIMC (labeled M)

3

Slot 1: PCIe1 card containing 1-GB Ethernet ports (GigE2 and GigE3)

9

1-GB Ethernet port 1 (GigE0) for Cisco Secure ACS management communication

4

1-GB Ethernet port 3 (GigE2)

10

1-GB Ethernet port 2 (GigE1)

5

1-GB Ethernet port 4 (GigE3)

11

USB ports

6

VGA video connector

12

Rear identification button

Figure 3 Cisco SNS-3495 Appliance Rear View

1

Power supplies (up to two)

7

Serial port (RJ-45 connector)

2

Slot 2: Low-profile Peripheral Component Interconnect Express (PCIe) slot on riser (half-height, half-length, x16 connector, x16 lane width)

8

1-GB Ethernet dedicated management port used to access CIMC (labeled M)

3

Slot 1: PCIe1 card containing 1-GB Ethernet ports (GigE2 and GigE3)

9

1-GB Ethernet port 1 (GigE0) for Cisco Secure ACS management communication

4

1-GB Ethernet port 3 (GigE2)

10

1-GB Ethernet port 2 (GigE1)

5

1-GB Ethernet port 4 (GigE3)

11

USB ports

6

VGA video connector

12

Rear identification button

2. Connect the network cable to the GigabitEthernet 0 connector (see Figure 2 and Figure 3).

The setup utility (which appears when the Cisco SNS-3415 or Cisco SNS-3495 appliances boots) only configures the GigabitEthernet 0 port. For information on connecting cables, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.8.1.

3. Power up the appliance.

The appliance boots automatically, and the setup utility appears (see Running Setup to Configure ACS).

Starting the Cisco SNS-3515 and Cisco SNS-3595 Appliances

Complete these steps before you configure the Cisco SNS-3515 or Cisco SNS-3595 appliance:

1. Connect the power cord to the Cisco SNS-3515 or Cisco SNS-3595 appliance (see Figure 4).

Figure 4 Cisco SNS-3515 or 3595 Appliance Rear View

1

PCIe riser 1/slot 1

7

Serial port (RJ-45 connector)

2

PCIe riser 2/slot 2

8

Dual 1-GbE Ethernet ports (LAN1 and LAN2)

3

Modular LAN-on-motherboard (mLOM) card slot

9

VGA video port (DB-15)

4

Grounding-lug hole (for DC power supplies)

10

Rear unit identification button/LED

5

USB 3.0 ports (two)

11

Power supplies (up to two, redundant as 1+1)

6

1-GbE Ethernet dedicated management port

2. Connect the network cable to the GigabitEthernet 0 connector (see Figure 4).

The setup utility (which appears when the Cisco SNS-3515 or Cisco SNS-3595 appliances boots) only configures the GigabitEthernet 0 port. For information on connecting cables, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.8.1.

3. Power up the appliance.

The appliance boots automatically, and the setup utility appears (see Running Setup to Configure ACS).

Running Setup to Configure ACS

command, ensure that you have values for the following network configuration prompts:

■Hostname

■IP address

■Netmask

■Gateway

■Domain

■Nameserver

■NTP Server

■User ID

■Password

command.

*************************************************

Please type ‘setup’ to configure the appliance

*************************************************

localhost login: setup

Last login: Mon Jul 2 08:45:24 on ttyS0

Press 'Ctrl-C' to abort setup

Enter hostname[]: acs

Enter IP address[]: 172.16.0.0

Enter IP default netmask[]: 255.255.255.224

Enter IP default gateway[]: 172.16.0.1

Enter default DNS domain[]: example.com

Enter Primary nameserver[]: 172.16.12.33

Add secondary nameserver? Y/N : n

Add primary NTP server [time.nist.gov]: 172.16.12.33

Add secondary NTP server? Y/N : n

Enter system timezone[UTC]:

Enable SSH Service? Y/N [N] : Y

Enter username[admin]:

Enter password:

Enter password again:

Pinging the gateway...

Pinging the primary nameserver...

Do not use 'Ctrl-C' from this point on...

Appliance is configured

Installing applications...

Installing acs ...

/opt/CSCOacs/bin...

...

...

The system is going down for reboot NOW!

Application bundle (acs) installed successfully

INIT: Sending processes the TERM signal...

After you enter the required information, the appliance automatically reboots and the following login prompt appears:

machine_name login:

identifies the hostname that you specified.

In this example, the following prompt appears:

ACS login:

To log in, use the administrator user account (and the corresponding password) that you created during the setup process. You must also use this Admin account to log in to the ACS CLI for the first time. See Accessing the ACS CLI.

After accessing the CLI as an administrator, you can create more users (with admin and operator privileges) with SSH access to the CLI by running the username command in the configuration mode.

command.

Accessing the ACS CLI

Before logging in to the ACS CLI, ensure that you have completed the hardware installation and configuration process outlined in Before Accessing the ACS CLI.

To log into ACS server and access the CLI, use an SSH secure shell client or the console port. You can log in from:

■A PC running Windows XP/Vista.

■A PC running Linux.

■An Apple computer running Mac OS X 10.4 or later.

■Any terminal device compatible with VT100 or ANSI characteristics. On the VT100-type and ANSI devices, you can use cursor-control and cursor-movement key.

Keys include left arrow, up arrow, down arrow, right arrow, Delete, and Backspace. The CLI senses the use of the cursor-control keys and automatically uses the optimal device characteristics (see Supported Hardware and Software Platforms, for more information).

command (see EXEC Mode).

Supported Hardware and Software Platforms

The following valid terminal types can access ACS CLI:

■1178

■2621

■5051

■6053

■8510

■altos5

■amiga

■ansi

■apollo

■Apple_Terminal

■att5425

■ibm327x

■kaypro

■vt100

See the terminfo database for a complete listing.

You can also access ACS through an SSH client or the console port.

Opening the CLI with Secure Shell

To access the ACS CLI environment, use any SSH client that supports SSH v2.

The following example shows you how to log in with a Secure Shell (SSH) client (connecting to a wired WAN) via a PC by using Windows XP. Assuming that ACS is preconfigured through the setup utility to accept an Admin (administrator) user, log in as Admin.

1. Use any SSH client and start an SSH session.

The SSH window appears.

to connect.

The Connect to Remote Host window appears.

3. Enter a hostname, username, port number, and authentication method.

from the drop-down list.

.

The Enter Password window appears, overlapping the Connect to Remote Host window.

5. Enter your assigned password for the administrator.

The SSH with the Add Profile window appears.

.

on the Add Profile window.

The ACS prompt acs/admin# appears. You can now enter ACS CLI commands.

Opening the CLI Using a Local PC

If you need to configure ACS locally (without connecting to a wired LAN), you can connect a PC to the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance’s console port (see Figure 1) by using a null-modem cable.

The serial console connector (port) provides access to the CLI locally by connecting a terminal—a PC running terminal-emulation software or an ASCII terminal—to the console port. The console port (EIA/TIA-232 asynchronous) requires only a null-modem cable.

To connect a PC running terminal-emulation software to the console port, use a DB-9 female to DB-9 female null-modem cable.

To connect an ASCII terminal to the console port, use a DB-9 female to DB-25 male straight-through cable with a DB-25 female to DB-25 female gender changer.

The default parameters for the console port are 9600 baud, 8 data bits, no parity, 1 stop bit, and no hardware flow control.

If using a Cisco switch on the other side of the connection, set the switchport to duplex auto, speed auto (the default).

To open the CLI by connecting to the console port:

1. Connect a null-modem cable to the console port on the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance and to the COM port on your PC.

2. Set up a terminal emulator to communicate with ACS. Use the following settings for the terminal emulator connection: 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control.

3. When the terminal emulator activates, press Enter.

4. At the window, enter your username, and press Enter.

5. Enter the password, and press Enter.

When the CLI activates, you can enter CLI commands to configure ACS.

Understanding the Command Modes

This section describes the ACS command modes in detail. The primary modes of operation are:

■EXEC Mode

■ACS Configuration Mode

■Configuration Mode

■Configuration Submodes

EXEC Mode

When you start a session on ACS, you begin in the Admin or EXEC mode. From the EXEC mode, you can enter the configuration mode. Most of the EXEC commands (one-time commands), such as show commands, display the current configuration status. The Admin or EXEC mode prompt consists of the device name or hostname before a pound sign (#), as shown:

acs/admin# (Admin or EXEC mode)

for the user account.

You can always tell when you are in the EXEC mode, the ACS configuration mode, or the configuration mode by looking at the prompt. In the:

■EXEC mode, a pound sign (#) appears after the ACS server hostname and your username. For example:

acs/admin#

■ACS configuration mode, the (config-acs) keyword and the pound sign (#) appear after the hostname of the ACS server and your username.

You must have privileges to enter the ACS configuration mode, and must supply the username and the password that you use to log in to the ACS web interface. See ACS Configuration Mode.

For example:

acs/admin# acs-config

Escape character is CNTL/D.

Username: acsadmin

Password: <pwd>

acs/acsadmin(config-acs)# (ACS configuration mode)

■Configuration mode, the (config) keyword and a pound sign (#) appear after the hostname of the ACS server and your username.

For example:

acs/admin# configure

Enter configuration commands, one per line. End with CNTL/Z.

acs/admin(config)# (configuration mode)

If you are familiar with UNIX, you can equate the EXEC mode to root access. You could also equate it to the administrator level in Windows NT or the supervisor in NetWare. In this mode, you have permission to access everything in the ACS server, including the configuration commands.

command. Enter this command only when in the EXEC mode.

For example:

acs/admin# configure

Enter configuration commands, one per line. End with CNTL-Z.

acs(config)# (configuration mode)

The configuration mode has several submodes; each has its own prompt. To enter these submodes, you must first enter the configuration mode by entering the configure terminal command.

To exit the configuration mode, enter the end, exit, or Ctrl-z command. To exit the EXEC mode, enter the exit command.

To exit both configuration and EXEC modes, enter this sequence of commands:

acs/admin(config)# exit

acs/admin# exit

To obtain a listing of commands in the EXEC mode, enter a question mark (?):

acs/admin# ?

ACS Configuration Mode

Use the ACS configuration mode to set the debug log level for the ACS management and runtime components, show system settings, reset server certificate and IP address access list, and manage import and export processes.

command in the EXEC mode; then, enter the administrative username and password that you use to log in to the ACS web interface.

, and the first time you log in to the web interface, you will be prompted to change the default password. Cisco recommends that you do so for security reasons. You can change your password for the first time only by logging into the web interface. You will also be prompted to install the license.

user. You can, however, create other users with admin privileges from the web interface.

) and changed password, or the username and password for a newly created admin user, to access the ACS CLI in the ACS configuration mode.

When in the ACS configuration mode, ACS expects ACS configuration commands.

). For example:

acs/admin(config-acs)# ?

to leave the ACS configuration mode and return to the EXEC mode.

Some ethernet interface related attributes will be missing in the output while executing the CLI command ethernet-interface show-configuration in acs-config mode on the ESX machine. This is because the ESX does not support displaying all regular interface attributes.

For example:

Output in ESX server:

acs243-254/acsadmin(config-acs)# ethernet-interface show-configuration

Settings for eth0:

Supported ports: [ TP ]

Supported link modes: 1000baseT/Full

10000baseT/Full

Supported pause frame use: No

Supports auto-negotiation: No

Advertised link modes: Not reported

Advertised pause frame use: No

Advertised auto-negotiation: No

Speed: 10000Mb/s

Duplex: Full

Port: Twisted Pair

PHYAD: 0

Transceiver: internal

Auto-negotiation: off

MDI-X: Unknown

Supports Wake-on: uag

Wake-on: d

Link detected: yes

acs243-254/acsadmin(config-acs)#

Configuration Mode

Use the configuration mode to make changes to the existing configuration. When you save the configuration, these commands remain across ACS server reboots, but only if you run either of these commands:

■copy running-config startup-config

■write memory

command in the EXEC mode. When in the configuration mode, ACS expects configuration commands.

For example:

acs/admin# configure

Enter configuration commands, one per line. End with CNTL-Z.

acs/admin(config)# (configuration mode)

From this level, you can enter commands directly into the ACS configuration. To obtain a listing of commands in this mode, enter a question mark (?):

acs/admin(config)# ?

The configuration mode has several configuration submodes. Each of these submodes places you deeper in the prompt hierarchy. When you enter exit, ACS backs you out one level and returns you to the previous level. When you enter exit again, ACS backs you out to the EXEC level.

In the configuration mode, you can alternatively enter Ctrl-z instead of the end or exit command.

Configuration Submodes

In the configuration submodes, you can enter commands for specific configurations. For example:

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)#

To obtain a list of commands in this mode, enter a question mark (?):

acs/admin(config-GigabitEthernet)# ?

Use the exit or end command to exit this prompt and return to the configuration prompt.

commands.

Table 1 Command Options for Configuration Submodes

Command

Comment

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# ?

Configure ethernet interface:

do EXEC command

end Exit from configure mode

exit Exit from this submode

ip Configure IP features

ipv6 Configure IPv6 features

no Negate a command or set its defaults

shutdown Shutdown the interface

acs/admin(config-ethernet)#

Enter the command that you want to configure for the interface. This example uses the interface GigabitEthernet command.

Enter ? to display what you can enter next on the command line.

This example shows the available interface GigabitEthernet configuration submode commands.

acs/admin(config-GigabitEthernet)# ip ?

address Configure IP address

acs/admin(config-GigabitEthernet)# ip

acs/admin(config-GigabitEthernet)# ipv6 ?

address Configure IPv6 address

Enable/Disable IPv6 for the interface

Enter the command that you want to configure for the interface. This example uses the ip and ipv6 commands.

Enter ? to display what you can enter next on the command line.

This example shows the available ip and ipv6 configuration submode commands.

acs/admin(config-GigabitEthernet)# ip address ?

<A.B.C.D> IPv4 address

acs/admin(config-GigabitEthernet) ip address

acs/admin(config-GigabitEthernet)# ipv6 address ?

<X:X:X::X(/n)> Configure IPv6 address

autoconfig Configure IPv6 auto-configuration address

acs/admin(config-GigabitEthernet) ip address

Enter the command that you want to configure for the interface. This example uses the ip address and ipv6 address command.

Enter ? to display what you must enter next on the command line. In this example, you must enter the required IPv4 and IPv6 addresses.

A carriage return <cr> does not appear; therefore, you must enter additional arguments to complete the command.

acs/admin(config-GigabitEthernet)# ip address 172.16.0.1 ?

<A.B.C.D> Network mask

acs/admin(config-GigabitEthernet)# ip address 172.16.0.1

acs/admin(config-GigabitEthernet)# ipv6 address 2001:DB8::21/64 ?

<cr> Carriage Return

acs/admin(config-GigabitEthernet)# ipv6 address 2001:DB8::21/64

acs/admin(config-GigabitEthernet)# ipv6 address autoconfig ?

<cr> Carriage Return

acs/admin(config-GigabitEthernet)# ipv6 address autoconfig

Enter the keyword or argument that you want to use. This example uses the 172.16.0.1 IPv4 address and 2001:DB8::21/64 IPv6 address.

Enter ? to display what you can enter next on the command line.

A carriage return <cr> does not display; therefore, you must enter additional arguments to complete the command.

acs/admin(config-GigabitEthernet)# ip address 172.16.0.1 255.255.255.224 ?

<cr> Carriage Return

acs/admin(config-GigabitEthernet)# ip address 172.16.0.1 255.255.255.224

Enter the network mask. This example uses 255.255.255.224.

Enter ? to display what you can enter next on the command line.

Press Enter. A carriage return <cr> displays; press Enter again to complete the command.

Navigating the CLI Commands

This section describes how to navigate the commands and modes on ACS.

■Getting Help

■Using the No and Default Forms of Commands

■Command-Line Conventions

Getting Help

Use the question mark (?) and the arrow keys to help you enter commands:

):

acs/admin# ?

(with no space):

acs/admin# s?

at the prompt or after entering part of a command followed by a space:

acs/admin# show ?

ACS displays a list and brief description of available keywords and arguments.

The <cr> symbol in command help stands for “carriage return” (Return or Enter key). The <cr> at the end of command help output indicates that you have the option to press Enter to complete the command and that the arguments and keywords in the list preceding the <cr> symbol are optional.

The <cr> symbol by itself indicates that no more arguments or keywords are available, and that you must press Enter to complete the command.

key to see more commands.

Using the No and Default Forms of Commands

Some EXEC or configuration commands have a no form. In general, use the no form to disable a function. Use the command without the no keyword to re-enable a disabled function or to enable a function disabled by default; for example, an IP address enabled by default. To disable the IP address, use the no ip address command; to re-enable the IP address, use the ip address command.

Configuration commands can also have a default form, which returns the command settings to the default values. Most commands disable by default, so in such cases using the default form has the same result as using the no form of the command.

However, some commands are enabled by default and have variables set to certain default values. In these cases, the default form of the command enables the command and sets the variables to their default values.

See ACS Command Reference for a description of the complete syntax of the configuration commands, and the no and default forms of a command.

Command-Line Conventions

While reading this document, you might not understand some of the information if you do not know certain basic conventions of CLI usage.

Note the following sections:

■Command-Line Editing Key Conventions

■Command-Line Completion

■Continuing Output at the --More-- Prompt

Command-Line Editing Key Conventions

ACS provides a number of keyboard shortcuts that you can use to edit an entered line.

Tab

Tries to finish the current command.

key:

■At the beginning of a line, lists all the short-form options.

■When you enter a partial command, the system lists all the short form options beginning with those characters.

■When only one possible option is available, the system fills in the option automatically.

Ctrl-C

Aborts the sequence. Breaks out of any executing command and returns to the previous mode.

Ctrl-D

Exits the ACS configuration mode and returns to the EXEC mode.

Ctrl-Z

Exits the configuration mode and returns to the previous configuration mode.

?

You can get a list of the available commands by entering a question mark (?) at the prompt (see Getting Help).

Command-Line Completion

Command-line completion makes the ACS CLI more user-friendly. It saves you extra key strokes and helps out when you cannot remember a command’s syntax.

For example, in the show running-config command:

acs/admin# show running-config

You could have used:

acs/admin# sh run

ACS expands the command sh run to show running-config.

key after you type sh; the ACS CLI fills in the best completion, in this case show.

If the ACS CLI does not understand a command, it repeats the entire command line and places a caret symbol (^) under the point at which it could not parse the command.

For example:

acs/admin# show running-config

^

% Invalid input detected at ‘^’ marker.

The caret symbol (^) points to the first letter in the command line that ACS does not understand. Usually, this means that you need to provide additional arguments to complete the command or you mispelled the command. In this case, you omitted the “r” in the “unning” command. To fix the error, retype the command.

key. As long as you can match one command, the ACS CLI will complete the command.

again. For more information, see Tab.

Continuing Output at the --More-- Prompt

prompt appears at the bottom of the screen.

to display the next full screen of output.

prompt, try entering a smaller value for the screen length by using the terminal length EXEC command. Command output will not pause if you set the length value to zero (0).

Where to Go Next

Now that you are familiar with some of the ACS CLI basics, you can begin to configure ACS by using the CLI.

Remember that:

■You can use the question mark (?) and arrow keys to help you enter commands.

■Each command mode restricts you to a set of commands. If you have difficulty entering a command, check the prompt and then enter the question mark (?) to see a list of available commands.

■To disable a feature, enter the keyword no before the command; for example, no ip address.

■You must save your configuration changes so that you preserve them during a system reload or power outage.

Proceed to ACS Command Reference for command listings, descriptions, syntax, usage guidelines, and sample output.

ACS Command Reference

This chapter contains an alphabetical listing of the commands that are specific to Cisco Secure ACS 5.8.1. The following modes are available with these commands:

■EXEC

–System-level

–Show

■ACS Configuration

command to access ACS configuration mode.

■Configuration

–Configuration submode

command to access configuration mode.

in place of the ACS server’s hostname.

command to determine the cause of the error.

Before proceeding to use the ACS CLI commands, familiarize yourself with disk space management in the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance. This section describes disk space management for the purpose of managing logs that you can view or download from the ACS CLI and includes:

■Debug logs

■Debug backup logs

■Platform logs

Managing disk space on the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 is important to enable you to use ACS efficiently. Table 1 describes the disk space allocated for each set of log files.

Table 1 Disk Space Allocation for ACS Process Logs

Process

Log File

Maximum Disk Space

(in MB)

ADE OS 2.2

/var/log/ade/ADE.log

50

Monit

/opt/CSCOacs/logs/monit.log

55

Management

/opt/CSCOacs/logs/ACSManagementAudit.log

55

/opt/CSCOacs/logs/ACSManagement.log

1000

/opt/CSCOacs/mgmt/apache-tomcat-6.0.37/logs/*

55

Runtime

/opt/CSCOacs/logs/acsRuntime.log*

1000

1000

/opt/CSCOacs/runtime/core.*

2000

/opt/CSCOacs/logs/localStore/*

95,000

Config Database

/opt/CSCOacs/db/acs.db

> 5120

/opt/CSCOacs/db/acs*.log

100

/opt/CSCOacs/db/dberr.log

100

Viewer

/opt/CSCOacs/logs/*

155

Viewer database

/opt/CSCOacs/view/data/db/acsview.db

150,000

/opt/CSCOacs/view/data/db/acsview.log

100

/opt/CSCOacs/view/data/db/acsview.errlog

100

AD Agent

/var/log/centrifydc.log

50

/opt/CSCOacs/logs/ACSADAgent.log

55

Backup

Packaged files within a temporary directory

105,000

/var/log/backup.log

50

/var/log/backup-success.log

50

Upgrade/Patch

/opt/CSCOacs/patches/*

500

/opt/CSCOacs/logs/acsupgrade.log

50

.log format, where:

—Specifies the name of the log file.

—Specifies any value from 1 to 10. This value varies depending on the log file. While some utilities roll over up to 10 log files, others roll over up to 9 log files. For information on these log files, see Table 2.

For instance, the default maximum file size for log files that log rotate manages is 5 MB. When a log file (for example, acsupgrade.log) reaches the 5-MB limit, it is renamed as acsupgrade.log.1. With every 5-MB increase in file size, the latest file is renamed as acsupgrade.log.2, acsupgrade.log.3, and so on.

Log rotate stores up to 10 log files at a given time. The latest log information, however, is always stored in acsupgrade.log. In ACS, log rotate runs as an hourly kron job and verifies the disk space allocated for the log files.

Table 2 Log File Rotation

Process

Log File

Number of Rotated Versions

Monit

/opt/CSCOacs/logs/monit.log

10

Upgrade

/opt/CSCOacs/logs/acsupgrade.log

10

Management

logs/catalina.out

10

/opt/CSCOacs/logs/ACSManagement.log

9

/opt/CSCOacs/logs/ACSManagementAudit.log

10

/opt/CSCOacs/logs/MonitoringAndReportingProcess.log

10

AD Agent

/opt/CSCOacs/logs/ACSADAgent.log

10

Runtime

/opt/CSCOacs/logs/acsRuntime.log

9

This chapter describes:

■EXEC Commands

■Show Commands

■ACS Configuration Commands

■Configuration Commands

EXEC Commands

Each EXEC command includes a brief description of its use, command syntax, usage guidelines, and sample output.

Table 3 lists the EXEC commands that this section describes.

Table 3 List of EXEC Commands

■acs (instance) *

■acs (process) *

■acs backup *

■acs-config *

■acs config-web-interface

■acs delete core *

■acs delete log *

■acs patch *

■acs reset-config *

■acs reset-password *

■acs restore *

■acs support *

■acs zeroize-machine *

■application install

■application remove

■application reset-config

■application start

■application stop

■application upgrade

■backup *

■backup-logs

■banner

■clock

■configure

■copy *

■crypto

■debug

■delete

■dir

■exit

■forceout

■halt

■help

■mkdir

■nslookup

■password

■ping

■reload

■restore *

■rmdir

■show (see Show Commands)

■shutdown

■ssh

■tech

■telnet

■terminal length

■terminal session-timeout

■terminal session-welcome

■terminal terminal-type

■traceroute

■undebug

■write

Commands marked with an asterisk (*) represent those that are specific to ACS functionality.

acs (instance)

command in the EXEC mode.

Syntax Description

Starts an ACS instance.

Stops an ACS instance.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command to stop any ACS process, it automatically starts after the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance boots up.

Examples

Example 1

acs/admin# acs start

Starting ACS.............................

To verify that ACS processes are running, use the

'show application status acs' command.

Example 2

acs/admin#

acs/admin# acs stop

Stopping ACS......................

acs/admin#

Related Commands

Command

Description

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Defines the local debug logging level for the ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

acs (process)

command in the EXEC mode.

Syntax Description

start

Starts an ACS process.

stop

Stops an ACS process.

adclient

Starts or stops the adclient process of an ACS server.

database

Starts or stops the database process of an ACS server.

management

Starts or stops the management process of an ACS server.

runtime

Starts or stops the runtime process of an ACS server.

view-logprocessor

Starts or stops the view-logprocessor process of an ACS server.

view-alertmanager

Starts or stops the view-alertmanager process of an ACS server.

view-collector

Starts or stops the view-collector process of an ACS server.

view-database

Starts or stops the view-database process of an ACS server.

view-jobmanager

Starts or stops the view-jobmanager process of an ACS server.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command to stop any ACS process, it automatically starts after the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance boots up.

When ACS cannot start or stop the ACS process that you want to start or stop, it prompts you with a relevant message.

The ACS processes may fail to start or stop in the following scenarios:

■Watchdog is not running.

process, the CLI displays the following message:

‘adclient’ is not configured, therefore will not be started.

process, the CLI displays the following message:

‘adclient’ is not configured. Attempting to stop it anyway.

■If you start a view-based ACS process on an ACS server that is not a log collector, the CLI displays the following error message:

% Error: This is not a log collector node. Cannot start 'proc-name'.

refers to the specific view process that you attempted to start.

■If you stop a view-based ACS process on an ACS server that is not a log collector, the CLI displays the following message:

This is not a log collector node. Attempting to stop 'proc-name' anyway.

refers to the specific view process that you attempted to stop.

Examples

Example 1

acs/admin# acs start database

Starting database

acs/admin#

Example 2

acs/admin# acs stop database

Stopping database

acs/admin#

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

show application

Shows application status and version information.

acs backup

command in the EXEC mode.

Syntax Description

Name of the backup file. This can be a maximum of 100 alphanumeric characters.

repository

Repository command.

Location where files should be backed up to. This can be a maximum of 80 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Performs a backup of ACS data and places the backup in a repository.

.

command, the backup files include:

■Database—Database files include data related to ACS.

.

file for information about the last backup operation.

ACS prompts for an encryption password when you run the full backup from ACS CLI. ACS again prompts for a confirmation of the encryption password.

command if you are backing up ACS logs) to view troubleshooting information. Failures in the ACS aspect of the backup are clearly described on the terminal.

If you use this command on a secondary ACS, no backup occurs. You can use the ACS web interface to designate an ACS node to collect logs.

filename, to enable periodic backups. For more information, see acs restore.

Examples

acs/admin# acs backup mybackup repository myrepository

% backup in progress: Starting Backup...10% completed

% Creating backup with timestamped filename: mybackup-081007-2055.tar.gpg

Please enter backup encryption password [8-32 chars]: xxxxxxxxx

Please enter the password again: xxxxxxxxx

ACS backup file 'mybackup-081007-2055.tar.gpg' successfully copied to repository 'myrepository'

acs/admin#

Related Commands

Command

Description

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

backup-staging-url

Configures a Network File System (NFS) location that backup and restore operations will use as a staging area to package and unpackage backup files.

debug-log

Defines the local debug logging level for the ACS components.

delete

Deletes a file from the ACS server.

dir

Lists a file from the ACS server.

kron occurrence

Schedules one or more Command Scheduler commands to run at a specific date and time or a recurring level.

export-data

Exports configuration data from an ACS local store to a remote repository.

reload

Reboots the system.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

repository

Enters the repository submode for configuration of backups.

restore

Restores the file contents of a specific repository from the backup.

show acs-logs

Displays ACS server debug logs.

show backup history

Displays the backup history of the system.

show debug-adclient

Shows the debug log-level status for subsystems (enabled or disabled).

show repository

Displays the available backup files located on a specific repository.

acs-config

To enter the ACS Configuration mode, use the acs-config command in the EXEC mode.

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

, and the first time you log in to the web interface, you will be prompted to change the default password.

It is recommended that you do so for security reasons. You can change your password for the first time only by logging into the web interface. You will also be prompted to install the license.

user. You can, however, create other users with admin privileges from the web interface.

) and changed password, or the username and password for a newly created admin user, to access the ACS CLI in the ACS Configuration mode.

Up to six users can access the ACS Configuration mode at a time; six users equal six sessions. When one of the six sessions ends, you must wait up to five minutes for the session to be available to another user.

.

After you provide valid login credentials, ACS prompts you to change your password for any of the following reasons:

■Password expiration.

■Account inactivity.

command run.

■Super administrator has selected Change password on next login for an admin account through GUI.

When ACS prompts you to change your password, enter your old password, then a new password (conforming to the password policy), and confirm your new password (repeat the new password that you specified).

If you fail to change your password when you are requested to, you cannot log in to ACS Configuration mode.

Examples

Example 1 – Success

acs/admin# acs-config

Escape character is CNTL/D.

Username: user1

Password:

acs/admin(config-acs)#

Example 2 – Failure

acs/admin# acs-config

Escape character is CNTL/D.

This command requires ACS to be running.

Issue 'acs start' command and try again.

acs/admin

Example 3 – Failure

acs/admin# acs-config

Escape character is CNTL/D.

Username: user1

Password:

Authentication failed.

Username:

Example 4 – Failure

acs/admin# acs-config

Escape character is CNTL/D.

Username: acsadmin

Password:

Failed to login with the default password.

Use the web interface to modify the default password

acs/admin#

Example 5 – Success

acs/admin# acs-config

Escape character is CNTL/D.

Username: acsadmin

Password:

Administrator must change password.

Old password:

New password:

Confirm new password:

acs/admin(config-acs)#

Example 6 – Failure

acs/admin# acs-config

Escape character is CNTL/D.

Username: acsadmin

Password:

Administrator must change password.

Old password:

Invalid value.

acs/admin#

Example 7 – Failure

acs/admin# acs-config

Escape character is CNTL/D.

Username: acsadmin

Password:

Administrator must change password.

Old password:

New password:

Confirm new password:

Cannot change password:

Password and confirm password must be the same

acs/admin#

Example 8 – Failure

acs/admin# acs-config

Escape character is CNTL/D.

Username: acsadmin

Password:

Administrator must change password.

Old password:

New password:

Confirm new password:

Cannot change password:

Value is out of range (8 - 32)

acs/admin#

If the new password does not conform with the password policy, ACS displays the password policy details as shown in the previous example.

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Defines the local debug logging level for the ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

acs config-web-interface

command in the EXEC mode.

Syntax Description

(Optional) Specify one of the interfaces, to enable or disable that specific interface alone.

Enables the interface for ACS migration, password change, or Representational State Transfer (REST) services for the user.

Disables the interface for ACS migration, password change, or REST services for the user.

Defaults

Disabled.

Command Modes

EXEC

Usage Guidelines

Enables or disables an interface to migrate the ACS database, change the user password, or use REST services through the CLI.

If you do not want to migrate your ACS database, change the user password or use REST services. Cisco recommends that you disable these interfaces.

Examples

Example 1

acs/admin# acs config-web-interface migration enable

acs/admin#

Example 2

acs/admin# acs config-web-interface [migration | ucp | view | rest] disable

acs/admin#

Related Commands

Command

Description

show acs-config-web-interface

Indicates whether the ACS configuration web interface is enabled or disabled.

acs delete core

command in the EXEC mode.

Syntax Description

Name of the run-time core file or JVM core log. You can use up to 255 alphanumeric characters to specify the filename.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command.

Examples

Example 1

acs/admin# acs delete core xyz.log

% Error: Invalid core file 'xyz.log'

Use 'show acs-cores' to list the core files

acs/admin(config-acs)#

Example 2

acs/admin# acs delete core hs_err_pid12477.log

Core file 'hs_err_pid12477.log' deleted successfully

acs/admin

Related Commands

Command

Description

acs delete log

Deletes an ACS run-time core file or JVM core log excluding the latest one.

show acs-logs

Displays ACS server debug logs.

show acs-cores

Displays ACS run-time core files and JVM core logs.

acs delete log

command in the EXEC mode.

Syntax Description

Name of the run-time core file or JVM core log. You can use up to 255 alphanumeric characters to specify the filename.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command.

Examples

Example 1

acs/admin# acs delete log xyz.log

% Error: Invalid log file 'xyz.log'

Use 'show acs-logs' to list the log files

acs/admin

Example 2

acs/admin# acs delete log catalina.out

% Error: most recent log files cannot be deleted, only older logs.

acs/admin

Example 3

acs/admin# acs delete log catalina.2008-12-10.log

Log file 'catalina.2008-12-10.log' deleted successfully

acs/admin

Related Commands

Command

Description

acs delete core

Deletes an ACS run-time core file or JVM core log.

show acs-logs

Displays ACS server debug logs.

show acs-cores

Displays ACS run-time core files and JVM core logs.

acs patch

command in the EXEC mode.

Syntax Description

install

Install command.

remove

Remove command.

.tar.gpg

Name of the patch, which always has the .tar.gpg filename extension.

repository

Repository command.

Location where files should installed from or removed to. This can be a maximum of 80 alphanumeric characters.

Defaults

.

Command Modes

EXEC

Usage Guidelines

ACS patches contain small fixes that include isolated files, not a full version of the ACS software. ACS patch installations and removals require that you restart ACS.

Examples

Example 1

acs/admin# acs patch install acspatch.tar.gpg repository myrepository

Save the Current ADE-OS running configuration? (yes/no) [yes] ? yes

Generating configuration...

Saved the ADE-OS running configuration to startup successfully

Getting bundle to local machine...

md5: aa45b77465147028301622e4c590cb84

sha256: 3b7f30d572433c2ad0c4733a1d1fb55cceb62dc1419b03b1b7ca354feb8bbcfa

% Please confirm above crypto hash with what is posted on download site.

% Continue? Y/N [Y]?

% Installing an ACS patch requires a restart of ACS services.

Would you like to continue? yes/no

Example 2

acs/admin# acs patch remove acspatch

Removing an ACS patch requires a restart of ACS services.

Would you like to continue? Y/N

Related Commands

Command

Description

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

acs reset-config

command in the EXEC mode.

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command to reset your ACS to the factory default configuration, any configurations you have performed are lost; however, the appliance settings (such as network settings and backup repositories) are not affected.

ACS does not need to be running when you use this command.

Examples

acs/admin# acs reset-config

This command will reset the ACS configuration.

Would you like to continue? Y/N

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

application reset-config

Resets an application configuration to factory defaults.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Defines the local debug logging level for the ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

acs reset-password

To reset any administrator account password to its default setting, use the acs reset-password command in EXEC mode. In ACS 5.8.1, you need to specify the username of the administrator account next to the acs reset password command to provide additional security to the command.

Syntax Description

Username of the administrator account whose password needs to be reset. This can be a maximum of 100 alphanumeric characters.

Defaults

This command resets the specified ACS administrator password to its default setting (default) and enables the account if it is a recovery account. If the administrator account is not a recovery account, then you need to enable the account manually. Resetting this password does not affect other ACS administrators.

Command Modes

EXEC

Usage Guidelines

You cannot use this command on a secondary ACS node.

) to access the ACS Configuration mode (which requires you to provide the web interface username and password), the login fails and the system prompts you to change the default password.

Examples

acs/admin# acs reset-password admin1

This command resets the 'ACS Administrator' password to its original value and enables the account if it is a recovery admin.

Are you sure you want to continue? (yes/no) y

Password was reset successfully

acs/admin#

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Backs up the system (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Defines the local debug logging level for the ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

acs restore

command in the EXEC mode.

Syntax Description

Name of backup file. This can be a maximum of 100 alphanumeric characters.

.tar.gpg is added to the backup filename to generate a unique backup filename, where:

■yy—Two-digit representation of the year (the last two digits).

■mm—Two-digit representation of the month. Single-digit months are preceded by zero (0).

■dd—Two-digit representation of the day of the month. Single digit months are preceded by zero (0).

■hh—Two-digit representation of the hour of the day of a 24-hour clock. Single-digit hours are preceded by zero (0).

■MM—Two-digit representation of the minute of the hour. Single-digit minutes are preceded by zero (0).

as the filename, the resulting file may be named dailyBackup-080229-2335.tar.gpg.

repository

Repository command.

Location where files should be restored from. This can be a maximum of 80 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Restores an ACS configuration from one ACS node to another. The restoration is performed from a temporary directory (the repository). ACS prompts for a decryption password when you restore the ACS backup from ACS CLI.

If you are restoring an primary ACS node configuration to a secondary, you must configure the secondary to local mode before you use this command (deregister from the primary node).

If you are restoring the backup file on a node that was part of the ACS deployment when the backup was performed, ACS replaces the database. This includes:

■Old certificates and certificate requests, if any exist

■Database password file

■Viewer database

The prikeypwd.key is not included, because this file can be associated only with the private keys of the original ACS primary node.

In ACS 5.8.1, the ACS database does not contain the prikeypwd.key; it is available only in the file system.

part of the deployment when the backup was performed, as the new ACS node might not have any local certificates to associate with.

After a restoration is complete, you must use the ACS web interface to designate an ACS node as a log collector.

ACS backup is now encrypted using a dynamic encryption password. Therefore ACS prompts for an encryption password when you run a backup that contains ACS data. The user is prompted for a decryption password while restoring a backup that contains ACS data.

ACS does not prompt for a decryption password when you restore ACS 5.5 version’s backup in ACS 5.8.1.

Examples

acs/admin# acs restore mybackup-080229-2335.tar.gpg repository myrepository

Restore requires a restart of ACS services. Continue? (yes/no)yes

%Warning: Do not use Ctrl-C or close this terminal window until the restore completes.

Initiating restore. Please wait...

%restore in progress: Starting Restore...10% completed

%restore in progress: Retrieving backup file from Repository...20% completed

Please enter backup decryption password [8 - 32 chars]:xxxxxxxxx

% restore in progress: Decrypting backup data...40% completed

% restore in progress: Decrypting backup data...50% completed

Calculating disk size for /opt/backup/restore-mybackup-080229-2335.tar.gpg

Total size of the restore files are 24 M.

Max size defined for restore files are 97887 M.

Restoring the data base will affect the distributed setup. For example, replication between primary and secondary will be broken. It is recommended to schedule a downtime to carry out the restore operation. After restore, you will have to configure each secondary to local mode and then re-connect with primary. Do you want to continue with restore operation?. <yes/no>: yes

% Application restore successful.

acs/admin#

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

backup-staging-url

Configures a Network File System (NFS) location that backup and restore operations use as a staging area to package and unpackage backup files.

debug-log

Defines the local debug logging level for the ACS components.

delete

Deletes a file from the ACS server.

dir

Lists a file in the ACS server.

export-data

Exports configuration data from an ACS local store to a remote repository.

reload

Reboots the system.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

repository

Enters the repository submode for configuration of backups.

restore

Restores the file contents of a specific repository from the backup.

show acs-logs

Displays ACS server debug logs.

show backup history

Displays the backup history of the system.

show debug-adclient

Shows the debug log-level status for subsystems (enabled or disabled).

show repository

Displays the available backup files located on a specific repository.

acs support

command in the EXEC mode.

Syntax Description

.tar.gz to the repository.

repository

Repository command.

Location where files should be restored from. This can be a maximum of 80 alphanumeric characters.

Encryption command to encrypt the support bundle.

Password to encrypt the support bundle.

description

Description command.

Text, between quotation marks, which is saved in a readme.txt file that is included in the ACS support bundle.

include-cores

Includes core files in the ACS support bundle.

Includes core files in the ACS support bundle that are older than the number of days that you specify with this argument. By default, or if you specify 0, the core files are not included. Specify a value between 0 and 365.

include-db

Includes the ACS database in the ACS support bundle.

Original

Includes all the data from the ACS database.

Secure

Includes the data from the ACS database excluding any sensitive information.

include-debug-logs

Includes debug log files in the ACS support bundle.

Includes the number of recent debug log files in the ACS support bundle of ACS management and runtime subsystems and the ACS Viewer that you specify with this argument.

For example, if you specify 1, the most recent logs are included. Specify a value between 0 and 999.

include-local-logs

Includes logs that a customer can view via the CLI or the ACS web interface in the ACS support bundle.

Includes the number of log files in the ACS support bundle that you specify with this argument. By default, logs are not included. Specify a value between 0 and 999.

include-system-logs

Includes recent system logs in the ACS support bundle.

Includes the number of recent system log files from each node in the ACS support bundle that you specify with this argument. By default, or if you specify 0, the core files are not included. Specify a value between 0 and 365.

include-logs

Includes logs from the Viewer database in the ACS support bundle.

Includes Viewer database logs of the most recent number of days that you specify with this argument in the ACS support bundle. Specify a value between 0 and 365. If you specify 0, no logs are included.

all-categories

Includes messages from all logging categories in the ACS support bundle.

log-categories

Includes messages from a subset of logging categories in the ACS support bundle.

aaa-accounting

Includes messages from the AAA accounting logging category in the ACS support bundle.

aaa-audit

Includes messages from the AAA audit logging category in the ACS support bundle.

aaa-diagnostics

Includes messages from the AAA diagnostic logging category in the ACS support bundle.

administrative-audit

Includes messages from the administrative audit logging category in the ACS support bundle.

system-diagnostics

Includes messages from the system diagnostics logging category in the ACS support bundle.

Defaults

The command generates a tar.gz file, which can contain the following components:

■ACS (non-sensitive data) and Viewer (as text) configuration data.

■All core files, if any exist.

commands.

■The log files, as you specify in your command structure.

■The monitoring and reporting logs, if any exist.

■The most recent copy of system logs from each node.

■A readme.txt file.

Command Modes

EXEC

Usage Guidelines

.

You are prompted for a username and password that can access the remote location.

.

Possible errors are standard FTP and SCP error messages.

Table 4 Protocol Prefix Keywords

Keyword

Source of Destination

Source or destination URL for FTP network server. The syntax for this alias:

Source or destination URL for SCP network server. The syntax for this alias:

Source or destination URL for an SFTP network server. The syntax for this alias:

Source or destination URL for a TFTP network server. The syntax for this alias:

The protocol keywords sftp and tftp are not available for ACS file transfers.

Examples

acs/admin# acs support file01 repository myrepository encryption-passphrase xyz description “files to bundle for assistance” include-cores 3 include-db secure include-debug-logs 10 include-local-logs 5 include-system-logs 1 include-logs 7 log-categories aaa-audit administrative-audit

Collecting support information ...(file01.tar.gz)

ACS support file 'file01.tar.gz' successfully copied to repository 'myrepository'

acs/admin#

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Defines the local debug logging level for the ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

acs zeroize-machine

command in the EXEC mode. This command securely deletes the partition on which ACS is installed.

It also securely deletes the swap partition and restarts the machine to clear all information in RAM. After the command executes, ACS will no longer function on the appliance. You must reinstall ACS on the appliance.

acs zeroize-machine

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

EXEC

Usage Guidelines

When you enter this command, ACS will prompt you for confirmation for three times before running the command. The command performs the following steps:

1. Stops ACS processes so that the device is not busy and secure deletion happens.

2. Deletes the following devices:

–/dev/smosvg/home

–/dev/smosvg/localdiskvol

–/dev/smosvg/optvol

–/dev/smosvg/recvol

–/dev/smosvg/storeddatavol

–/dev/smosvg/tmpvol

–/dev/smosvg/swapvol

The optvol is the partition on which ACS is installed and all the sensitive information in ACS is stored here. The swap is maintained in swapvol.

3. Scans each partition type internally, using the fstab file.

4. Turns off the journaling; otherwise data zeroization might not happen.

5. Overwrites each partition twice with random bytes and zeroes at the end.

6. Restarts the machine to delete the RAM content.

It is recommended not to use the ACS machine after you run this command.

Examples

acs/admin# acs zeroize-machine

This command performs key zeroization of the ACS machine

Warning: This operation is irreversible - it completely deletes the ACS machine!

Are you sure you want to perform key zeroization now? (yes/no)

Please enter 'yes' or 'no'

Are you sure you want to perform key zeroization now? (yes/no) yes

Are you absolutely sure you want to perform key zeroization now? (yes/no) no

application install

command.

Syntax Description

install

Installs a specific application.

Application bundle filename. This can be a maximum of 255 alphanumeric characters.

Remote repository name. This can be a maximum of 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Installs the specified application bundle on the appliance. The application bundle file is pulled from the specified repository.

command when another installation or removal operation of an application is in progress, you will see the following warning message:

An existing application install, remove, or upgrade is in progress. Try again shortly.

The ACS machine will be rebooted automatically soon after the installation gets completed.

Examples

acs/admin# application install acs.tar.gz myremoterepository

Do you want to save the current configuration ? (yes/no) [yes] ?

Generating configuration...

Saved the running configuration to startup successfully

acs/admin#

Related Commands

Command

Description

application remove

Removes or uninstalls an application.

application start

Starts or enables an application.

application stop

Stops or disables an application.

show application

Shows application information for the installed application packages on the system.

application remove

form of this command.

Syntax Description

Application name. This can be a maximum of 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None

Examples

acs/admin# application remove acs

acs/admin#

Related Commands

Command

Description

application install

Installs an application bundle.

application start

Starts or enables an application.

application stop

Stops or disables an application.

show application

Shows application information for the installed application packages on the system.

application reset-config

command in the EXEC mode.

Syntax Description

Name of the application to reset its configuration to factory defaults. Up to 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command to reset the ACS configuration to factory defaults without reimaging the ACS appliance or VM.

Examples

acs/admin# application reset-config acs

Application successfully reset configuration

acs/admin#

Related Commands

Command

Description

acs reset-config

Resets the ACS configuration to factory defaults.

application start

command in the EXEC mode.

Syntax Description

Name of the predefined application that you want to enable. This can be a maximum of 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Enables an application.

You cannot use this command to start ACS.

Examples

acs/admin# application start acs

acs/admin#

Related Commands

Command

Description

application install

Installs an application bundle.

application remove

Removes or uninstalls an application.

application stop

Stops or disables an application.

show application

Shows application information for the installed application packages on the system.

application stop

command in the EXEC mode.

Syntax Description

Name of the predefined application that you want to disable. This can be a maximum of 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Disables an application.

You cannot use this command to stop ACS.

Examples

acs/admin# application stop acs

acs/admin#

Related Commands

Command

Description

application install

Installs an application bundle.

application remove

Removes or uninstalls an application.

application start

Starts or enables an application.

show application

Shows application information for the installed application packages on the system.

application upgrade

command.

Syntax Description

application-bundle

Application name. Up to 255 alphanumeric characters.

remote-repository-name

Remote repository name. Up to 255 alphanumeric characters.

Command Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

The application upgrade command upgrades the application using the specified application bundle and preserves the application configuration data.

command when another application upgrade operation is in progress, you will see the following warning message:

The ACS appliance is rebooted during the application upgrade process.

It is recommended not to upgrade ACS during aggregation time. If you upgrade ACS during the aggregation time, ACS View upgrade will fail.

backup

command in EXEC mode.

Syntax Description

Name of backup file. This can be a maximum of 100 alphanumeric characters.

repository

Repository command.

Location where the files should be backed up to. This can be a maximum of 80 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

The backup command performs a backup of ACS data and places the backup in a repository.

When you are using this command for ACS, the backup files include:

■Database—Database files include data related to ACS as well as the ADE OS. You can view backup files of the ADE-OS at:

–/storedconfig

–/storeddata

■Database password file—dbcred.cal, located at /opt/CSCOacs/conf.

■Certificate store—Located at /opt/CSCOacs/conf.

■Viewer database—If the ACS node you are backing up has Viewer enabled.

ACS prompts for an encryption password when you run the full backup fron ACS CLI. ACS again prompts for a confirmation of the encryption password.

command to display the backup operations and determine whether they succeeded.

command if you are backing up ACS logs) to view troubleshooting information. Failures in the ACS aspect of the backup are clearly described in messages that are displayed on the terminal.

Examples

acs/admin# backup mybackup repository myrepository

% backup in progress: Starting Backup...10% completed

% Creating backup with timestamped filename: myback2-081007-2129.tar.gpg

Please enter backup encryption password [8-32 chars]: xxxxxxxxx

Please enter the password again: xxxxxxxxx

% backup in progress: Backing up ADEOS configuration...55% completed

Calculating disk size for /opt/backup/backup-mybackup2-081007-2129

Total size of backup files are 16 M.

Max Size defined for backup files are 97887 M.

% backup in progress: Moving Backup file to the repository...75% completed

% backup in progress: Completing Backup...100% completed

acs/admin#

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Defines the local debug logging level for the ACS components.

delete

Deletes a file from the ACS server.

dir

Lists a file from the ACS server.

export-data

Exports configuration data from an ACS local store to a remote repository.

reload

Reboots the system.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

repository

Enters the repository submode for configuration of backups.

restore

Restores the file contents of a specific repository from the backup.

show acs-logs

Displays ACS server debug logs.

show backup history

Displays the backup history of the system.

show debug-adclient

Shows the debug log-level status for subsystems (enabled or disabled).

show repository

Displays the available backup files located on a specific repository.

backup-logs

command in the EXEC mode.

Syntax Description

Name of one or more files to back up. This can be a maximum of 100 alphanumeric characters.

repository

Repository command.

Location where files should be backed up. This can be a maximum of 80 alphanumeric characters.

Defaults

This command backs up the following log files, which are located in specific directories:

■ACS server files located in the /var/log directory.

■ACS debug, audit, and diagnostic files located in the /opt/CSCSacs/logs directory.

identifies the Tomcat version that you are running.

■ACS database files located in the /opt/CSCOacs/db directory.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# backup-logs mysyslogs repository myrepository

% Creating log backup with timestamped filename: mysyslogs-081007-2130.tar.gz

acs/admin#

Related Commands

Command

Description

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

restore

Restores the file contents of a specific repository from the backup.

repository

Enters the repository submode for configuration of backups.

show backup history

Displays the backup history of the system.

show repository

Displays the available backup files located on a specific repository.

banner

command in the EXEC mode.

Syntax Description

install

Command to display the banner text.

remove

Command to remove the banner text.

post-login

Command to display the banner after logging in.

Command to display the banner before logging in.

file-name

Name of the file from which the banner text is copied. The name can be a maximum of 256 alphanumeric characters.

repository

Repository command.

Location where the banner text file is present. This can be a maximum of 256 alphanumeric characters.

Defaults

None

Command Modes

EXEC

Usage Guidelines

You must create a text file with the banner text and save that text file in a repository before executing this command. If you want to display different banners for post- and pre-logins, you must create two different banner text files. The banners that are configured using the banner command from ACS CLI do not reflect in ACS web interface, whereas the banners that are configured in ACS web interface impacts the ACS CLI banners.

Table 5 displays the supported repositories to store the banner text files.

Table 5 Supported Repositories to Store Banner Text

Banner

NFS

SFTP

FTP

CDROM

TFTP

HTTP

Local disk

Pre-Login

Yes

Yes

No

Yes

No

No

No

Post-Login

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Examples

acs/admin# banner install post-login myfile1 repository myrepository

acs/admin#

Related Commands

Command

Description

show clock

Displays the time and date set on the system software clock.

show repository

Displays the available backup files located on a specific repository.

repository

Enters the repository submode for configuration of backups.

clock

command in the EXEC mode.

Syntax Description

set

Sets the system clock.

Current month of the year by name. This can be a maximum of three alphabetic characters. For example, Jan for January.

Current day (by date) of the month. Value = 1 to 31. Up to two numbers.

Current time in hours (24-hour format), minutes, and seconds.

Current year (no abbreviation).

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Sets the system clock. You must restart the ACS server to take effect of the changes after setting the clock.

Examples

acs/admin# clock set Jan 4 05:05:05 2007

Clock was modified. You must restart ACS.

Do you want to restart ACS now? (yes/no) yes

Stopping ACS .................

Starting ACS ......................

acs/admin#

Related Commands

Command

Description

show clock

Displays the time and date set on the system software clock.

configure

option, this command copies a remote configuration to the system, overwriting the existing configuration.

Syntax Description

terminal

Runs configuration commands from the terminal.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

).

.

command in the EXEC mode.

Examples

acs/admin# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

acs/admin(config)#

Related Commands

Command

Description

show running-configuration

Displays the contents of the currently running configuration file or the configuration.

show startup-configuration

Displays the contents of the startup configuration file or the configuration.

copy

command in ACS copies a configuration (running or startup).

Running Configuration

The ACS active configuration stores itself in the ACS RAM. Every configuration command you enter resides in the running configuration. If you reboot your ACS server, you lose the configuration. If you make changes that you want to save, you must copy the running configuration to a safe location, such as a network server, or save it as the ACS server startup configuration.

Startup Configuration

You cannot edit a startup configuration directly. All commands that you enter store themselves in the running configuration, which you can copy into the startup configuration.

In other words, when you boot an ACS server, the startup configuration becomes the initial running configuration. As you modify the configuration, the two diverge:

■The startup configuration remains the same.

■The running configuration reflects the changes that you have made.

If you want to make your changes permanent, you must copy the running configuration to the startup configuration.

command scenarios available:

copy running-configuration startup-configuration

Copies the running configuration to the startup configuration. Replaces the startup-configuration with the running configuration.

If you do not save the running configuration, you will lose all your configuration changes during the next reboot of the ACS server. Once you are satisfied that the current configuration is correct, copy your configuration to the startup configuration with the preceding command.

copy startup-configuration running-configuration

Copies the startup configuration to the running configuration. Merges the startup configuration on top of the running configuration.

startup-configuration

Copies but does not merge a remote file to the startup configuration.

running-configuration

Copies and merges a remote file to the running configuration.

Copies the startup configuration to a remote system.

Copies the running configuration to a remote system.

Copies log files from the system to another location.

command is supported only for the local disk and not for a repository.

Syntax Description

running-configuration

Represents the current running configuration file.

startup-configuration

Represents the configuration file used during initialization (startup).

See Table 4 for protocol keyword options.

Hostname of destination.

Location of destination.

logs

System log files.

acs-logs

ACS log files.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command allows you to copy a file (such as a system image or configuration file) from one location to another location. The source and destination for the file specified uses the ACS file system, through which you can specify any supported local or remote file location. The file system being used (a local memory source or a remote system) dictates the syntax used in the command.

command and have the ACS server prompt you for any missing information.

command).

The entire copying process might take several minutes and differs from protocol to protocol and from network to network.

Use the filename relative to the directory for file transfers.

Examples

Example 1

acs/admin# copy run start

Generating configuration...

acs/admin#

Example 2

acs/admin# copy logs ftp://host01/ldir01

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs-config

Enters the ACS Configuration mode.

acs reset-config

Resets the ACS configuration to factory defaults.

acs support

Gathers information for troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

debug-log

Defines the local debug logging level for the ACS components.

delete

Deletes a file from the ACS server.

dir

Lists a file from the ACS server.

export-data

Exports configuration data from an ACS local store to a remote repository.

reload

Reboots the system.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

crypto

To generate a new public key pair, export the current public key to a repository, and import a public key to the authorized keys list, use the crypto command in EXEC mode. It is also possible to view the public key information and delete selected keys.

crypto host_key {add | delete} host {hostname | IP-address}

crypto key [delete {hash | authorized-keys | rsa}]

crypto key {export | import} filename repository repository-name

crypto key generate rsa

Syntax Description

host_key

Allows you to perform crypto host-key operations.

add

Adds trusted host keys.

delete

Deletes trusted host keys.

host

Hostname command.

hostname | IP-address

IP address or hostname of the server on which you perform the crypto host-key operations.

key

Allows you to perform crypto key operations.

delete

(Optional) Deletes a public/private key pair.

hash

Hash value. Supports up to 80 characters.

authorized-keys

Authorized key(s) that you want to delete.

rsa

RSA key pair that you want to delete.

export

Exports a public/private key pair to a remote repository.

import

Imports a public/private key pair from a remote repository.

filename

The filename to which the public key is exported to or imported. Supports up to 80 characters.

repository

Repository command.

repository-name

The repository to which the public key is exported to or imported.

generate

Generates a public/private key pair.

rsa

RSA key pair that you want to generate.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

The Cisco ADE OS supports public key authentication without the password for SSH access to administrators and user identities.

Use the crypto key generate rsa command to generate a new public or private key pair with a 2048-bit length for the current user. The key attributes are fixed and support RSA key types. If the key pair already exists, you will be prompted to permit an over-write before continuing with a passphrase. If you provide the passphrase, you will be prompted for the passphrase whenever you access the public or private key. If the passphrase is empty, no subsequent prompts for the passphrase occur.

Examples

Example 1

acs/admin# crypto host_key add host acs

host key fingerprint added

# Host acs found: line 1 type RSA

2048 dd:df:e9:2f:4b:6f:cb:95:4e:47:0f:3a:a4:36:43:98 10.77.241.75 (RSA)

acs/admin#

Example 2

acs/admin# crypto host_key delete host acs

host key fingerprint for acs removed.

acs/admin#

Example 3

acs/admin# crypto key generate rsa

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

acs/admin#

acs/admin# show crypto key

admin public key: ssh-rsa 85:4a:70:d8:ea:b1:66:d0:32:31:57:52:aa:e0:a0:a2 admin@acs

acs/admin# crypto key generate rsa

Private key for user admin already exists. Overwrite? y/n [n]: y

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

acs/admin# show crypto key

admin public key: ssh-rsa 65:a5:b8:2c:86:d4:d4:65:41:63:b7:d5:4c:a0:59:36 admin@acs

acs/admin#

Example 4

acs/admin# crypto key export mykey_rsa repository myrepository

acs/admin# show crypto key

admin public key: ssh-rsa f8:7f:8a:79:44:b8:5d:5f:af:e1:63:b2:be:7a:fd:d4 admin@acs

acs/admin#

Example 5

acs/admin# crypto key delete rsa

acs/admin#

acs/admin# show crypto key

acs/admin#

Example 6

acs/admin# show crypto authorized_keys

Authorized keys for admin

acs/admin# crypto key delete authorized_keys

acs/admin#

acs/admin# show crypto authorized_keys

acs/admin#

Example 7

acs/admin# crypto key import mykey_rsa repository myrepository

acs/admin# show crypto key

admin public key: ssh-rsa f8:7f:8a:79:44:b8:5d:5f:af:e1:63:b2:be:7a:fd:d4 admin@acs

acs/admin#

Related Commands

Command

Description

show crypto

Displays information about the public keys and authorized keys for the administrators and users who are logged in currently.

debug

command in the EXEC mode.

Syntax Description

all

Enables all debugging.

application

Application files.

■all—Enables all application debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■install—Enables application install debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■operation—Enables application operation debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■uninstall—Enables application uninstall debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

backup-restore

Backs up and restores files.

■all—Enables all debug output for backup-restore. Set level between 0 and 7 with 0 being severe and 7 being all.

■backup—Enables backup debug output for backup-restore. Set level between 0 and 7 with 0 being severe and 7 being all.

■backup-logs—Enables backup-logs debug output for backup-restore. Set level between 0 and 7 with 0 being severe and 7 being all.

■history—Enables history debug output for backup-restore. Set level between 0 and 7 with 0 being severe and 7 being all.

■restore—Enables restore debug output for backup-restore. Set level between 0 and 7 with 0 being severe and 7 being all.

cdp

CDP configuration files.

—Enables all CDP configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables configuration debug output for CDP. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables infrastructure debug output for CDP. Set level between 0 and 7 with 0 being severe and 7 being all.

config

Configuration files.

■all—Enables all configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables backup configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables clock configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■infra—Enables configuration infrastructure debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables command scheduler configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables network configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■repository—Enables repository configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

—Enables service configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

copy

Copy commands. Set level between 0 and 7 with 0 being severe and 7 being all.

locks

Resource locking.

■all—Enables all resource locking debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■file—Enables file locking debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

logging

Logging configuration files.

all—Enables all logging configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

snmp

SNMP configuration files.

all—Enables all SNMP configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

system

System files.

■all—Enables all system files debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■id—Enables system ID debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■info—Enables system info debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■init—Enables system init debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

transfer

File transfer. Set level between 0 and 7 with 0 being severe and 7 being all.

user

User management.

■all—Enables all user management debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

■password-policy—Enables user management debug output for password-policy. Set level between 0 and 7 with 0 being severe and 7 being all.

utils

Utilities configuration files.

all—Enables all utilities configuration debug output. Set level between 0 and 7 with 0 being severe and 7 being all.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command to identify various failures within the ACS server; for example, setup failures or configuration failures.

Examples

acs/admin# debug all

acs/admin# mkdir disk:/1

acs/admin# 6 [7178]: utils: vsh_root_stubs.c[2301]: mkdir operation success

acs/admin# rmdir disk:/1

acs/admin# 6 [7180]: utils: vsh_root_stubs.c[2171]: Invoked Remove Directory disk:/1 command 6 [7180]: utils: vsh_root_stubs.c[2228]: Remove Directory operation success

acs/admin# undebug all

acsvw-test8/admin# 7 [2826]: cdp:infra: ether-write.c[87]: WriteEther(): wrote len: 192

7 [2826]: cdp:infra: ether-write.c[112]: cdpd write succeed...

7 [2826]: cdp:infra: main.c[128]:

Writing with retransmissiontime 60...

Related Commands

Command

Description

undebug

command for various command situations.

delete

form of this command.

Syntax Description

Filename. This can be a maximum of 240 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

If you attempt to delete the configuration file or image, the system prompts you to confirm the deletion. Also, if you attempt to delete the last valid system image, the system prompts you to confirm the deletion.

Examples

acs/admin# delete myfile

acs/admin#

Related Commands

Command

Description

dir

Lists all the files on the ACS server.

dir

form of this command.

Syntax Description

Directory name. This can be a maximum of 80 alphanumeric characters. Requires disk:/ preceding the directory name.

recursive

Lists a local directory or filename recursively.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# dir

Directory of disk:/

16384 Jul 02 2008 08:34:49 lost+found/

4096 Jul 16 2008 02:10:20 mytest/

4096 Jul 11 2008 09:12:12 save-config/

Usage for disk: filesystem

49741824 bytes total used

6815842304 bytes free

7233003520 bytes available

acs/admin#

Example 2

acs/admin# dir disk:/mytest

Directory of disk:/mytest

Usage for disk: filesystem

49741824 bytes total used

6815842304 bytes free

7233003520 bytes available

acs/admin#

Example 3

acs/admin# dir recursive

Directory of disk:/

4096 Jul 16 2008 02:10:20 mytest/

16384 Jul 02 2008 08:34:49 lost+found/

4096 Jul 11 2008 09:12:12 save-config/

Directory of disk:/mytest

No files in directory

Directory of disk:/lost+found

No files in directory

Directory of disk:/save-config

555 Jul 11 2008 09:12:12 running-config

Usage for disk: filesystem

49741824 bytes total used

6815842304 bytes free

7233003520 bytes available

Related Commands

Command

Description

delete

Deletes a file from the ACS server.

exit

command in the EXEC mode.

exit

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Use the exit command in EXEC mode to exit an active session (log out of the ACS server) or to move up from the Configuration mode.

Examples

acs/admin# exit

Related Commands

Command

Description

end

Exits the Configuration mode.

exit

Exits the Configuration mode or EXEC mode.

Exits the Configuration mode.

forceout

command in the EXEC mode.

Syntax Description

Name of the user. This can be a maximum of 31 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command in EXEC mode to force a user from an active session.

Examples

acs/admin# forceout user1

halt

command in EXEC mode.

halt

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command, ensure that ACS is not performing any backup, restore, installation, upgrade, or remove operation. If you run the halt command while ACS is performing any of these operations, you will get one of the following warning messages:

WARNING: A backup or restore is currently in progress! Continue with halt?

WARNING: An install/upgrade/remove is currently in progress! Continue with halt?

to cancel the halt.

in response to the warning message displayed, ACS asks you to respond to the following option:

Do you want to save the current configuration ?

to save the existing ACS configuration. ACS displays the following message:

Saved the running configuration to startup successfully

Examples

acs/admin# halt

acs/admin#

Related Commands

Command

Description

reload

Reboots the system.

help

command in the EXEC mode.

help

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

All configuration modes

Usage Guidelines

command provides a brief description of the context-sensitive help system. To:

■List all commands available for a particular command mode, enter a question mark (?) at the system prompt.

■Obtain a list of commands that begin with a particular character string, enter the abbreviated command entry immediately followed by a question mark (?). This form of help is called word help, because it lists only the keywords or arguments that begin with the abbreviation that you entered.

■List the keywords and arguments associated with a command, enter a question mark (?) in place of a keyword or argument on the command line. This form of help is called command syntax help, because it lists the keywords or arguments that apply based on the command, keywords, and arguments that you have already entered.

Examples

acs/admin# help

Help may be requested at any point in a command by entering a question mark '?'. If nothing matches, the help list will be empty and you must backup until entering a '?' shows the available options.

Two styles of help are provided:

1. Full help is available when you are ready to enter a command argument (e.g. 'show ?') and describes each possible argument.

2. Partial help is provided when an abbreviated argument is entered and you want to know what arguments match the input (e.g. 'show pr?'.)

acs/admin#

mkdir

command in the EXEC mode.

Syntax Description

with the directory name. This can be a maximum of 80 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

must be included appears.

Examples

acs/admin# mkdir disk:/test/

acs/admin# dir

Directory of disk:/

16384 Jun 28 2007 00:09:50 lost+found/

4096 Jun 28 2007 14:34:27 test/

Usage for disk: filesystem

88150016 bytes total used

44585803776 bytes free

47064707072 bytes available

acs/admin#

Related Commands

Command

Description

dir

Displays a list of files on the ACS server.

rmdir

Removes an existing directory.

nslookup

command in the EXEC mode.

Syntax Description

IPv4 or IPv6 address or hostname of a remote system. This can be a maximum of 64 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# nslookup 1.2.3.4

Trying "4.3.2.1.in-addr.arpa"

Host 4.3.2.1.in-addr.arpa not found: 3(NXDOMAIN) Received 105 bytes from 209.165.200.225#53 in 5 ms

Example 2

acs/admin# nslookup 209.165.200.225

Trying "225.200.165.209.in-addr.arpa"

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15007 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:

;225.200.165.209.in-addr.arpa. IN PTR

;; ANSWER SECTION:

225.200.165.209.in-addr.arpa. 86400 IN PTR ACS.cisco.com.

;; AUTHORITY SECTION:

165.209.in-addr.arpa. 86400 IN NS ns2.cisco.com.

165.209.in-addr.arpa. 86400 IN NS ns1.cisco.com.

;; ADDITIONAL SECTION:

ns1.cisco.com. 86400 IN A 209.165.200.225

ns2.cisco.com. 86400 IN A 209.165.200.225

Received 146 bytes from 172.69.2.133#53 in 5 ms

Example 3

acs149/admin# nslookup _finger._tcp.child1.apkacs-dev.com

Trying "_finger._tcp.child1.apkacs-dev.com"

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34964

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:

;_finger._tcp.child1.apkacs-dev.com. IN ANY

;; ANSWER SECTION:

_finger._tcp.child1.apkacs-dev.com. 3600 IN SRV 0 0 79.

_finger._tcp.child1.apkacs-dev.com. 3600 IN SRV 10 0 79.

Received 90 bytes from 10.77.243.169#53 in 0 ms

acs/admin#

ping

command in the EXEC mode.

Syntax Description

IPv4 address of the system to ping. This can be a maximum of 64 alphanumeric characters.

IPv6 address of the system to ping. This can be a maximum of 64 alphanumeric characters.

Hostname of the system to ping. This can be a maximum of 64 alphanumeric characters.

df

Specification for packet fragmentation.

to not set DF.

packetsize

Specify the size of the ping packet; the value can be between 0 and 65507.

pingcount

Specify the number of ping echo requests; the value can be between 1 and 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command sends an echo request packet to an address, then awaits a reply. The ping output can help you evaluate path-to-host reliability, delays over the path, and whether you can reach a host.

Examples

Example 1

acs/admin# ping 172.16.0.1 df 2 packetsize 10 pingcount 2

PING 172.16.0.1 (172.16.0.1) 10(38) bytes of data.

18 bytes from 172.16.0.1: icmp_seq=0 ttl=40 time=306 ms

18 bytes from 172.16.0.1: icmp_seq=1 ttl=40 time=300 ms

--- 172.16.0.1 ping statistics ---

2 packets transmitted, 2 received, 0% packet loss, time 1001ms

rtt min/avg/max/mdev = 300.302/303.557/306.812/3.255 ms, pipe 2

acs/admin#

Example 2

ACS143/admin# ping ip 10.56.24.191 df 2 packetsize 10 pingcount 2

PING 10.56.24.191 (10.56.24.191) 10(38) bytes of data.

18 bytes from 10.56.24.191: icmp_seq=0 ttl=43 time=259 ms

18 bytes from 10.56.24.191: icmp_seq=1 ttl=43 time=259 ms

--- 10.56.24.191 ping statistics ---

2 packets transmitted, 2 received, 0% packet loss, time 999ms

rtt min/avg/max/mdev = 259.376/259.450/259.525/0.514 ms

acs/admin#

Example 3

ACS143/admin# ping ipv6 5abe::20c:29ff:feac:cbbe gigabitEthernet 0 packet size 10 pingcount 2

PING 5abe::20c:29ff:feac:cbbe (5abe::20c:29ff:feac:cbbe) from 5abe::bd1d:4b94:8884:27ca etho 10 data bytes.

18 bytes from 5abe::20c:29ff:feac:cbbe: icmp_seq=0 ttl=64 time=3.41 ms

18 bytes from 5abe::20c:29ff:feac:cbbe: icmp_seq=1 ttl=64 time=0.856 ms

--- 5abe::20c:29ff:feac:cbbe ping statistics ---

2 packets transmitted, 2 received, 0% packet loss, time 999ms

rtt min/avg/max/mdev = 0.856/2.134/3.412/1.278 ms pipe 2

acs/admin#

password

To update the ACS CLI account password, use the password command in EXEC mode.

password

Syntax Description

This command has no arguments or keywords.

Defaults

None

Command Modes

EXEC

Usage Guidelines

None

Examples

acs/admin# password

Enter old password:xxxxxxxxx

Enter new password:xxxxxxxxxx

Confirm new password:xxxxxxxxxx

acs/admin#

Related Commands

Command

Description

password-policy

Enables and configures the password policy.

reload

command in the EXEC mode.

reload

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command halts the system. Use the command after you enter configuration information into a file and save it to the startup configuration.

command, you will see any of the following warning messages:

WARNING: A backup or restore is currently in progress! Continue with reload?

WARNING: An install/upgrade/remove is currently in progress! Continue with reload?

to cancel the halt.

in response to the warning message displayed, ACS asks you to respond to the following option:

Do you want to save the current configuration ?

to save the existing ACS configuration. ACS displays the following message:

Saved the running configuration to startup successfully

Examples

acs/admin# reload

Continue with reboot? [y/n] y

Broadcast message from root (pts/0) (Tue Oct 7 23:01:46 2008):

The system is going down for reboot NOW!

acs/admin#

Related Commands

Command

Description

halt

Disables the system.

restore

form of this command.

Syntax Description

Name of the backed-up file that resides in the repository. This can be a maximum of 120 alphanumeric characters.
You must add the .tar.gpg extension after the filename (for example, myfile.tar.gpg).

Name of the repository you want to restore from backup.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

When you use this command for ACS, the ACS server reboots automatically. ACS prompts for a decryption password when you restore the full backup from ACS CLI.

Examples

acs/admin# restore backup1.tar.gpg repository repository1

Restore may require a reboot to successfully complete. Continue? (yes/no) [yes] ? yes

%Warning: Do not use Ctrl-C or close this terminal window until the restore completes.

Initiating restore. Please wait...

%restore in progress: Starting Restore...10% completed

%restore in progress: Retrieving backup file from Repository...20% completed

Please enter backup decyption password [8 - 32 chars]:xxxxxxxxx

% restore in progress: Decrypting backup data...40% completed

% restore in progress: Decrypting backup data...50% completed

Calculating disk size for /opt/backup/restore-backup1.tar.gpg-1367921805

Total size of the restore files are 24 M.

Max size defined for restore files are 97887 M.

Restoring the data base will affect the distributed setup. For example, replication between primary and secondary will be broken. It is recommended to schedule a downtime to carry out the restore operation. After restore, you will have to configure each secondary to local mode and then re-connect with primary. Do you want to continue with restore operation?. <yes/no>: yes

% Application restore successful.

acs/admin#

Related Commands

Command

Description

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

repository

Enters the repository submode for configuration of backups.

show repository

Displays the available backup files located on a specific repository.

show backup history

Displays the backup history of the system.

rmdir

command in the EXEC mode.

Syntax Description

Directory name. This can be a maximum of 80 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# mkdir disk:/test/

acs/admin# dir

Directory of disk:/

16384 Jun 28 2007 00:09:50 lost+found/

4096 Jun 28 2007 14:34:27 test/

Usage for disk: filesystem

88150016 bytes total used

44585803776 bytes free

47064707072 bytes available CAM/admin#

acs/admin# rmdir disk:/test

acs/admin# dir

Directory of disk:/

16384 Jun 28 2007 00:09:50 lost+found/

Usage for disk: filesystem

88145920 bytes total used

44585807872 bytes free

47064707072 bytes available CAM/admin#

Related Commands

Command

Description

dir

Displays a list of files on the ACS server.

mkdir

Creates a new directory.

show

commands, see Show Commands.

Syntax Description

commands.

Table 6 Summary of Show Commands

Command 1

Description

application

(requires keyword)2

Displays information about the installed application; for example, status or version.

backup

(requires keyword)

Displays information about the backup.

cdp

(requires keyword)

Displays information about the enabled Cisco Discovery Protocol (CDP) interfaces.

clock

Displays the day, date, time, time zone, and year of the system clock.

cpu

Displays CPU information.

crypto

Displays crypto key information.

disks

Displays file-system information of the disks.

interface

Displays statistics for all the interfaces configured on the ADE OS 1.0.2 system.

logging

(requires keyword)

Displays system logging information.

logins

(requires keyword)

Displays login history.

memory

Displays memory usage by all running processes.

ntp

Displays the status of the Network Time Protocol (NTP).

ports

Displays all the processes listening on the active ports.

process

Displays information about the active processes of the ACS server.

repository

(requires keyword)

Displays the file contents of a specific repository.

restore

(requires keyword)

Displays restore history on the ACS server.

running-config

Displays the contents of the currently running configuration file on the ACS server.

startup-config

Displays the contents of the startup configuration on the ACS server.

tech-support

Displays system and configuration information that you can provide to the Cisco Technical Assistance Center (TAC) when reporting a problem.

terminal

Displays information about the terminal configuration parameter settings for the current terminal line.

timezone

Displays the time zone of the ACS server.

timezones

Displays all the time zones available for use on the ACS server.

udi

Displays information about the system’s Unique Device Identifier (UDI).

uptime

Displays how long the system you are logged in to has been up and running.

users

Displays information for currently logged in users.

ip route

Displays information for specific IP addresses, network masks or protocols.

nullnull

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

commands require at least one keyword to function.

Examples

acs/admin# show application

<name> <Description>

acs Cisco Secure Access Control System 5.8.1

acs/admin#

shutdown

form of this command.

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Interface Configuration

Usage Guidelines

When you shut down an interface using this command, you lose connectivity to the CSACS-1121, Cisco SNS-3415, Cisco SNS-3495, Cisco SNS-3515, or Cisco SNS-3595 appliance through that interface (even though the appliance is still powered on). However, if you have configured the second interface on the appliance with a different IP and have not shut down that interface, you can access the appliance through that second interface.

using the ONBOOT parameter:

■Disable an interface, set ONBOOT="no"

■Enable an interface, set ONBOOT="yes"

command to enable an interface.

Examples

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# shutdown

Related Commands

Command

Description

interface

Configures an interface type and enters the interface mode.

ip address (interface configuration mode)

Sets the IP address and netmask for the Ethernet interface.

show interface

Displays information about the system IP interfaces.

ip default-gateway

Sets the IP address of the default gateway of an interface.

ssh

command in the EXEC mode.

An Admin or Operator (user) can use this command (see Table 1).

or

Syntax Description

IP address of the remote system. This can be a maximum of 64 alphanumeric characters.

Hostname of the remote system. This can be a maximum of 64 alphanumeric characters.

Username of the user logging in through SSH.

]

(Optional) Indicates the port number of the remote host. From 0 to 65,535. Default 22.

version [1 | 2]

(Optional) Indicates the version number. Default 2.

delete

Deletes the SSH fingerprint of a specific host.

Defaults

Disabled.

Command Modes

EXEC (Admin or Operator)

Usage Guidelines

command enables a system to make a secure, encrypted connection to another remote system or server. This connection provides functionality similar to that of an outbound Telnet connection except that the connection is encrypted. With authentication and encryption, the SSH client allows for secure communication over an insecure network.

Examples

Example 1

acs/admin# ssh delete acs123

acs/admin#

Example 2

acs/admin# ssh acs2 admin

admin@acs2's password:

Last login: Wed Jul 11 05:53:20 2008 from ACS.cisco.com

acs2/admin#

tech

command in EXEC mode.

Syntax Description

dumptcp

Logs the TCP packages to console.

Gigabit Ethernet interface number (0 to 3).

Specifies a maximum package count. The default is continuous (no limit).

Specifies the package count. The valid entries are form 1 to 10000.

mpstat

Logs processor-related information sent to the console. See the Linux mpstat command.

netstat

Logs network-related information that are sent to the console for every 5 seconds. See the Linux netstat command.

iostat

Logs CPU statistics and I/O statistics for devices and partitions that are sent to the console for every 5 seconds. See the Linux iostat command.

vmstat

Logs memory, processes, and paging summary that sent every 5 seconds. See the Linux vmstat command.

top

Logs a dynamic real-time view of a running system, which runs in batch mode every 5 seconds. See the Linux top command.

Defaults

Disabled.

Command Modes

EXEC

Usage Guidelines

If you see bad UDP checksum warnings in the tech dumptcp output, it may not be a cause for concern. The tech dumptcp command examines outgoing packets before they exit the Ethernet microprocessor. Most modern Ethernet chips calculate checksums on outgoing packets, and so the operating system software stack does not. Hence, it is normal to see outgoing packets declared as bad UDP checksums.

Press Ctrl+C to return to the working mode after you run the any of the tech commands.

Examples

acs/admin# tech dumptcp 0

140816:141088(272) ack 1921 win 14144

08:26:12.034630 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141088:141248(160) ack 1921 win 14144

08:26:12.034635 IP dhcp-64-102-82-153.cisco.com.2221 > ACS.cisco.com.ssh: . ack 139632 win 64656

08:26:12.034677 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141248:141520(272) ack 1921 win 14144

08:26:12.034713 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141520:141680(160) ack 1921 win 14144

08:26:12.034754 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141680:141952(272) ack 1921 win 14144

08:26:12.034756 IP dhcp-64-102-82-153.cisco.com.2221 > ACS.cisco.com.ssh: . ack 140064 win 65520

08:26:12.034796 IP ACS.cisco.com.ssh > dhcp-64-102-82-153.cisco.com.2221: P 141952:142112(160) ack 1921 win 14144

1000 packets captured

1000 packets received by filter

0 packets dropped by kernel

acs/admin#

telnet

command in Operator (user) or EXEC mode.

Syntax Description

IP address of the remote system. Can be a maximum of 64 alphanumeric characters.

Hostname of the remote system. Can be a maximum of 64 alphanumeric characters.

(Optional) Indicates the port number of the remote host. From 0 to 65,535.

Defaults

No default behavior or values.

Command Modes

Operator

EXEC

Usage Guidelines

None.

Examples

acs/admin# telnet 172.16.0.11 port 23

ACS.cisco.com login: admin

password:

Last login: Mon Jul 2 08:45:24 on ttyS0

acs/admin#

terminal length

command in the EXEC mode.

Syntax Description

Number of lines on the screen. Contains between 0 to 511 lines, inclusive. A value of zero (0) disables pausing between screens of output.

Defaults

24 lines

Command Modes

EXEC

Usage Guidelines

The system uses the length value to determine when to pause during multiple-screen output.

Examples

acs/admin# terminal length 0

acs/admin#

terminal session-timeout

command in the EXEC mode.

Syntax Description

Sets the number of minutes for the inactivity timeout. From 0 to 525,600. Zero (0) disables the timeout.

Defaults

30 minutes

Command Modes

EXEC

Usage Guidelines

Setting the terminal session-timeout command to zero (0) results in no timeout being set.

Examples

acs/admin# terminal session-timeout 40

acs/admin#

Related Commands

Command

Description

terminal session-welcome

Sets a welcome message on the system for all users who log in to the system.

terminal session-welcome

To set a welcome message on the system for all users who log in to the system, use the terminal session-welcome command in EXEC mode.

Syntax Description

Welcome message. This can be a maximum of 2,023 alphanumeric characters. XML reserved characters are not allowed.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Specify a message using up to 2,023 characters.

Examples

acs/admin# terminal session-welcome Welcome

acs/admin#

Related Commands

Command

Description

terminal session-timeout

Sets the inactivity timeout for all sessions.

terminal terminal-type

command in EXEC mode.

Syntax Description

Defines the terminal name and type, and permits terminal negotiation by hosts that provide that type of service. This can be a maximum of 80 alphanumeric characters.

Defaults

VT100

Command Modes

EXEC

Usage Guidelines

Indicate the terminal type if it is different from the default of VT100.

Examples

acs/admin# terminal terminal-type vt220

acs/admin#

traceroute

command in EXEC mode.

Syntax Description

IP address of the remote system. This can be a maximum of 64 alphanumeric characters.

Hostname of the remote system. This can be a maximum of 64 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# traceroute 172.16.0.1

traceroute to 172.16.0.1 (172.16.0.1), 30 hops max, 38 byte packets

1 172.16.0.1 0.067 ms 0.036 ms 0.032 ms

acs/admin#

Example 2

ACS143/admin# traceroute ip 10.77.243.152

traceroute to 10.77.243.152 (10.77.243.152), 30 hops max, 40 byte packets

1 10.77.243.152 ms 2.661 ms 2.666 ms 2.661 ms

acs/admin#

Example 3

ACS143/admin# traceroute ipv6 5abe::20c:29ff:feac:cbbe

traceroute to 5abe::20c:29ff:feac:cbbe (5abe::20c:29ff:feac:cbbe), 30 hops max, 40 byte packets

1 5abe::20c:29ff:feac:cbbe 2.684 ms 2.681 ms 2.676 ms

acs/admin#

undebug

To disable debugging functions, use the undebug command in EXEC mode.

Syntax Description

all

Disables all debugging.

application

Application files.

■all—Disables all application debug output.

■install—Disables application install debug output.

■operation—Disables application operation debug output.

■uninstall—Disables application uninstall debug output.

backup-restore

Backs up and restores files.

■all—Disables all debug output for backup-restore.

■backup—Disables backup debug output for backup-restore.

■backup-logs—Disables backup-logs debug output for backup-restore.

■history—Disables history debug output for backup-restore.

■restore—Disables restore debug output for backup-restore.

cdp

CDP configuration files.

—Disables all CDP configuration debug output.

—Disables configuration debug output for CDP.

—Disables infrastructure debug output for CDP.

config

Configuration files.

■all—Disables all configuration debug output.

—Disables backup configuration debug output.

—Disables clock configuration debug output.

■infra—Disables configuration infrastructure debug output.

—Disables command scheduler configuration debug output.

—Disables network configuration debug output.

■repository—Disables respository configuration debug output.

—Disables service configuration debug output.

copy

Copy commands.

icmp

ICMP echo response configuration.

all—Disables all debug output for ICMP echo response configuration.

locks

Resource locking.

■all—Disables all resource locking debug output.

■file—Disables file locking debug output.

logging

Logging configuration files.

all—Disables all debug output for logging configuration.

snmp

SNMP configuration files.

all—Disables all debug output for SNMP configuration.

system

System files.

■all—Disables all system files debug output.

■id—Disables system ID debug output.

■info—Disables system info debug output.

■init—Disables system init debug output.

transfer

File transfer.

user

User management.

■all—Disables all user management debug output.

■password-policy—Disables user management debug output for password-policy.

utils

Utilities configuration files.

all—Disables all utilities configuration debug output.

Number of the priority level at which you set the undebug output. Set level between 0 and 7 with 0 being severe and 7 being all.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# undebug all

acs/admin#

Related Commands

Command

Description

debug

Displays errors or events for command situations.

write

command with the appropriate argument in the EXEC mode.

Syntax Description

erase

Erases the startup-configuration.

memory

Copies running-configuration to startup-configuration.

terminal

Copies the running-configuration to console.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# write memory

Generating configuration...

acs/admin#

Example 2

acs/admin# write terminal

Generating configuration...

!

hostname ACS

!

ip domain-name cisco.com

!

interface GigabitEthernet 0

ip address 209.165.200.225 255.255.255.224

!

interface GigabitEthernet 1

shutdown

!

ip name-server 209.165.201.1

!

ip default-gateway 209.165.202.129

!

clock timezone UTC

!

username admin password hash $1$UMCQIJy1$8Z.9tkpO1QzCo4zyc1jso0 role admin

!

service sshd

!

password-policy

lower-case-required

upper-case-required

digit-required

no-username

disable-cisco-passwords

min-password-length 6

!

logging localhost

logging loglevel 6

!

acs/admin#

Show Commands

command includes a brief description of its use, command syntax, usage guidelines, and sample output.

Table 7 lists the Show commands in the EXEC mode, which are described in this section. The command marked with an asterisk (*) represents those that are specific to ACS functionality.

Table 7 List of EXEC Show Commands

■show acs-config-web-interface

■show acs-cores

■show acs-logs *

■show application *3

■show backup history

■show banner

■show cdp

■show clock

■show cpu

■show crypto

■show disks

■show icmp_status

■show interface

■show inventory

■show ip route

■show ipv6 route

■show logging

■show logins

■show memory

■show ntp

■show ports

■show process

■show repository

■show restore

■show running-configuration

■show startup-configuration

■show tech-support

■show terminal

■show timezone

■show timezones

■show udi

■show uptime

■show users

■show version *

null

show acs-config-web-interface

command in the EXEC mode.

show acs-config-web-interface

Syntax Description

No arguments or keywords.

Defaults

The interface for ACS configuration web is enabled by default.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show acs-config-web-interface

migration interface is enabled

ucp interface is disabled

view interface is disabled

Related Commands

acs config-web-interface

Enables or disables an interface for ACS configuration web.

show acs-cores

command in the EXEC mode.

Syntax Description

details

Displays the modification time and size (in KB) for each core and log file.

Defaults

The ACS core files are located at /opt/CSCOacs/runtime/core and the JVM core logs are located at /hs_err_pid.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show acs-cores

core.2464

core.3535

hs_err_pid12477.log

acs/admin#

Example 2

acs/admin# show acs-cores details

Filesize (kb) Date Time Filename

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4562 Nov 18 13:45 core.2464

6788 Nov 10 12:33 core.3535

1193 Apr 29 11:59 hs_err_pid12477.log

acs/admin#

Example 3

acs/admin# show acs-cores

No ACS core files exist

acs/admin#

Related Commands

Command

Description

acs delete core

Deletes an ACS run-time core file or JVM core log.

acs delete log

Deletes an ACS run-time core file or JVM core log excluding the latest log.

show acs-logs

Displays ACS server debug logs.

show acs-logs

command in the EXEC mode.

Syntax Description

details

Displays the modification time and size (in KB) for each log file. Also lists the available logfiles.

filename

Specifies a file whose contents you want to view.

Name of the logfile (up to 255 characters) whose contents you want to view.

|

Output modifier variables:

■begin—Matched pattern. Up to 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables (see Table 9).

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

The ACS logs are located at /opt/CSCOacs/logs, and include the logs displayed in Table 8:

Table 8 ACS Logs

Logs

Description

ACSADAgent.log*

Stores the logs of an Active Directory client.

acsLogForward.log

Stores the debug log of log-forwarding processes.

ACSManagementAudit.log

Stores the details of the operations and configuration that are performed by administrators when using the ACS web interface or CLI.

ACSManagement.log

Stores information, warning, and debug messages from ACS web interface, CLI, and UCP web-service components.

acsRuntime.log

Stores the debug logs from runtime subsystem.

acsupgrade.log

Stores the patch installation and upgrade operation logs.

monit.log

Stores information about the health of various ACS processes. These include:

■Web interface

■Runtime process that processes the authentication and authorization requests

■ACS database

■ACS Monitoring and Report Viewer

MonitoringAndReportingAlert.log

Stores the logs from view-alertmanager process.

MonitoringAndReportingCollector.log

Stores the logs from view-logprocessor process.

MonitoringAndReportingDatabase.log

Stores the logs from view-database process.

MonitoringAndReportingExpertTroubleshooting.log

Stores the debug logs from the expert-troubleshooting feature of the Monitoring and Report Viewer web interface.

MonitoringAndReportingProcess.log

Stores the logs from all of the ACS view processes.

MonitoringAndReportingScheduler.log

Stores the logs from view-jobmanager process.

MonitoringAndReportingUI.log

Stores the logs from Monitoring and Report Viewer web interface.

acsLocalStore.log*

Stores the logs from the local system.

catalina.out*

Stores information and debug messages from ACS, and Monitoring and Report Viewer web interfaces of the web server.

dberr.log

Stores the error logs from ACS database.

The log files that are marked with an asterisk (*) are numbered and rolled over based on a configured maximum file size. Once a log file touches the configured limit, the data is rolled over to another file. The new files are named by suffixing the time stamp or sequential numbers to the log filename.

command.

Command Modes

EXEC

Usage Guidelines

You can use this command when ACS is not running.

Examples

Example 1

acs/admin# show acs-logs

ACSADAgent.log

ACSManagementAudit.log

ACSManagement.log

acsRuntime.log

monit.log

MonitoringAndReportingAlert.log

MonitoringAndReportingCollector.log

MonitoringAndReportingDatabase.log

MonitoringAndReportingProcess.log

MonitoringAndReportingScheduler.log

MonitoringAndReportingUI.log

reportService.0.acs.2008Oct08_20_02_37_Pacific_Daylight_Time.0.log

acsLocalStore.log

catalina.out

acs/admin#

Example 2

acs/admin# show acs-logs details

Filesize (kb) Date Time Filename

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

26 Oct 7 19:32 ACSManagementAudit.log

65 Oct 7 19:32 ACSManagement.log

12 Oct 7 19:32 acsRuntime.log

6 Oct 7 19:33 monit.log

0 Oct 7 19:17 MonitoringAndReportingAlert.log

2 Oct 7 19:34 MonitoringAndReportingCollector.log

6 Oct 7 19:32 MonitoringAndReportingDatabase.log

3 Oct 7 19:33 MonitoringAndReportingProcess.log

0 Oct 7 19:17 MonitoringAndReportingScheduler.log

0 Oct 7 19:18 MonitoringAndReportingUI.log

0 Oct 8 20:02

reportService.0.acs.2008Oct08_20_02_37_Pacific_Daylight_Time.0.log

8 Oct 7 19:32 acsLocalStore.log

19 Oct 7 19:32 catalina.out

acs/admin#

Example 3

acs/admin# show acs-logs filename acsRuntime.log

MessageBus,07/10/2008,19:16:40:569,ERROR,66497456,MessageBusSender::connect: unable to connect to the management;exception=Connection refused,MessageBusSender.cpp:131

Handler,07/10/2008,19:17:35:273,WARN ,67550128,NIL-CONTEXT,Posture Server did not have any ca cert configured,PostureServerHandler.cpp:63

Handler,07/10/2008,19:17:35:274,WARN ,67550128,NIL-CONTEXT,AcsNode does *not* have an Https Certificate,PostureServerHandler.cpp:100

--More-- (press Spacebar to continue)

Related Commands

Command

Description

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

show application

command in the EXEC mode.

Syntax Description

status

Displays the status of the installed application.

For ACS usage, the display includes whether the ACS is the primary or secondary, and the status of the services.

version

Displays the application version for an installed application—the ACS.

Name of installed application. The application name is case-sensitive.

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables (see Table 9).

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Table 9 Output Modifier Variables for Count or Last

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

Here is a list of various application status displayed and their interpretation.

When you stop an ACS process, the process status is displayed as "not monitored". When you start the same process again, ACS displays the status as "changed" approximately for 30 seconds for few processes and then it will be moved to running.

Status

Description

Running

When the application is in running state.

Execution Failed

When the process has failed to start but still trying to start the process.

Not Monitored

After watchdog failed to start the process as configured.

Restarting

When either the process cannot be found or the process ID file is missing and the watchdog restarts the process.

Initializing

Intermediate state when the watchdog comes up or watchdog starts again to monitor a process. This is shown also when any of the processes has failed to pass the active test.

Examples

Example 1

acs/admin# show application

<name> <Description>

acs Cisco Secure Access Control System 5.8.1

acs/admin#

Example 2

acs/admin# show application version acs

Cisco ACS VERSION INFORMATION

-----------------------------

Version : 5.8.1.0.28

Internal Build ID : B.221

acs/admin#

Example 3

acs/admin# show application status acs

ACS role: PRIMARY

Process 'database' running

Process 'management' running

Process 'runtime' running

Process 'adclient' running

Process 'ntpd' running

Process 'view-database' running

Process 'view-jobmanager' running

Process 'view-alertmanager' running

Process 'view-collector' running

Process 'view-logprocessor' running

acs/admin#

Example 4

acs/admin# show application status acs

ACS role: PRIMARY

"ACS is busy applying a recent configuration change

requiring enabling/disabling of processes.

Status is unavailable.

Please check again in a minute."

acs/admin#

This message appears when a set of processes change because of a view node selection or Active Directory configuration.

Example 5

acs/admin# show application status acs

ACS is not running.

Issue 'application start acs' command to start ACS.

acs/admin#

Related Commands

Command

Description

application install

Installs an application bundle.

application remove

Removes or uninstalls an application.

application start

Starts or enables an application.

application stop

Stops or disables an application.

application upgrade

Upgrades an application bundle.

show backup history

command in the EXEC mode.

show backup history

Syntax Description

history

Displays history information about any backups on the system.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show backup history

Wed Jul 18 12:55:21 UTC 2007: backup logs logs-0718.tar.gz to repository fileserver007: success

Wed Jul 18 12:55:53 UTC 2007: backup full-0718.tar.gpg to repository fileserver007: success

acs/admin#

Example 2

acs/admin# show backup history

backup history is empty

Related Commands

Command

Description

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

restore

Restores from backup the file contents of a specific repository.

repository

Enters the repository submode for configuration of backups.

show repository

Displays the available backup files located on a specific repository.

show banner

command in the EXEC mode.

show banner {post-login | pre-login}

Syntax Description

post-login

Displays the post-login information that is configured in the Cisco Secure ACS server for the current CLI session.

pre-login

Displays the pre-login information that is configured in the Cisco Secure ACS server for the current CLI session.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show banner pre-login

Copyright(c) 2015 Cisco Systems, Inc. All rights Reserved

acs/admin#

Example 2

acs/admin# show banner post-login

No post-login banner installed

acs/admin#

Related Commands

Command

Description

show repository

Displays the available backup files located on a specific repository.

show cdp

command in the EXEC mode.

Syntax Description

all

Shows enabled CDP interfaces.

neighbors

Shows CDP neighbors.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show cdp all

CDP protocol is enabled ...

broadcasting interval is every 60 seconds.

time-to-live of cdp packets is 180 seconds.

CDP is enabled on port GigabitEthernet0.

acs/admin#

Example 2

acs/admin# show cdp neighbors

CDP Neighbor : acs-test2

Local Interface : GigabitEthernet0

Device Type : cisco WS-C3560G-48PS

Port : GigabitEthernet0/36

Address : 209.165.200.225

acs/admin#

Related Commands

Command

Description

cdp holdtime

Specifies the length of time that the receiving device should hold a CDP packet from your router before discarding it.

cdp run

Enables the CDP.

cdp timer

Specifies how often the ACS server sends CDP updates.

show clock

command in the EXEC mode.

show clock

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show clock

Tue Oct 7 20:13:22 UTC 2008

acs/admin#

output in the previous example includes Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), Great Britain, or Zulu time (see Tables Table 17, Table 18, and Table 19 on pages A-94 and A-95 for sample time zones).

Related Commands

Command

Description

clock

Sets the system clock for display purposes.

show cpu

command in the EXEC mode.

Syntax Description

statistics

Displays CPU statistics.

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables (see Table 10).

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

|—Output modifier variables (see Table 10).

Table 10 Output Modifier Variables for Count or Last

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show cpu

processor : 0

model : Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz

speed(MHz): 2133.737

cache size: 2048 KB

processor : 1

model : Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz

speed(MHz): 2133.737

cache size: 2048 KB

acs/admin#

Example 2

acs/admin# show cpu statistics

user time: 8312

kernel time: 3200

idle time: 15510748

i/o wait time: 5295

irq time: 972

acs/admin#

Related Commands

Command

Description

show disks

Displays the system information of all disks.

show memory

Displays the amount of system memory that each system process uses.

show crypto

To display information about the public keys and authorized keys for the administrators and users who are logged in, use the show crypto command in EXEC mode.

show crypto {authorized-keys | host-keys | key} {[ > file ] | [ | ] }

Syntax Description

authorized-keys

Displays authorized key information for the user who is currently logged in.

host-keys

Displays host key information for the user who is currently logged in.

key

Displays key information for the user who is currently logged in.

>

Redirects output to the specified file.

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

>—Output redirection.

|—Output modifier variables.

■count—Count the number of lines in the output. Add number after the word count.

>—Output redirection.

|—Output modifier variables.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

>—Output redirection.

|—Output modifier variables.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

>—Output redirection.

|—Output modifier variables.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

>—Output redirection.

|—Output modifier variables.

■last—Display the last few lines of output. Add a number after the word last. This can be a maximum of 80 lines to display. Default is 10.

>—Output redirection.

|—Output modifier variables.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None

Examples

acs/admin# show crypto authorized_keys

Authorized keys for admin.

acs/admin#

acs/admin# show crypto host_keys

Host keys for admin.

acs/admin#

acs/admin# show crypto key

admin public key: ssh-rsa f8:7f:8a:79:44:b8:5d:5f:af:e1:63:b2:be:7a:fd:d4 admin@acs

acs/admin#

Related Commands

Command

Description

crypto

Performs crypto key operations.

show cpu

Displays CPU information.

show memory

Displays the amount of system memory that each system process uses.

show disks

command in the EXEC mode.

Syntax Description

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables (see Table 11).

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

|—Output modifier variables (see Table 11).

Table 11 Output Modifier Variables for Count or Last

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

|—Output modifier variables.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command.

Examples

acs/admin# show disks

disk: 1% used (48564 of 7063480)

temp. space 2% used (35844 of 2031952)

Internal filesystems:

all internal filesystems have sufficient free space

acs/admin#

Related Commands

Command

Description

show cpu

Displays CPU information.

show memory

Displays the amount of system memory that each system process uses.

show icmp_status

command in EXEC mode.

Syntax Description

>

Output direction.

Name of file to redirect standard output (stdout).

|

Output modifier commands:

—Matched pattern. This can be a maximum of 80 alphanumeric characters.

—Count the number of lines in the output. Add number after the word count.

–|—Output modifier commands (see Table 12).

—End with line that matches. This can be a maximum of 80 alphanumeric characters.

—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Table 12 Output Modifier Variables for Count or Last

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

|—Output modifier variables.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show icmp_status

icmp echo response is turned on

acs/admin#

Example 2

acs/admin# show icmp_status

icmp echo response is turned off

acs/admin#

Related Commands

Command

Description

icmp echo

Configures the Internet Control Message Protocol (ICMP) echo requests.

show interface

command in the EXEC mode.

|

Syntax Description

GigabitEthernet

Shows the Gigabit Ethernet interface. Either 0, 1, 2, 3, 4, or 5.

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show interface

GigabitEthernet 0

Link encap:Ethernet HWaddr A4:4C:11:2A:40:F2

inet addr:10.56.53.142 Bcast:10.56.53.255 Mask:255.255.255.0

inet6 addr: 2001:420:4482:2453:7490:94c6:8ff7:c8c8/64 Scope:Global

inet6 addr: 2001:420:4482:2453:a64c:11ff:fe2a:40f2/64 Scope:Global

inet6 addr: fe80::a64c:11ff:fe2a:40f2/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:6775 errors:0 dropped:0 overruns:0 frame:0

TX packets:570 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:661488 (645.9 KiB) TX bytes:73094 (71.3 KiB)

Memory:fab00000-fac00000

GigabitEthernet 1

Link encap:Ethernet HWaddr A4:4C:11:2A:40:F3

BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

Memory:faa00000-fab00000

GigabitEthernet 2

Link encap:Ethernet HWaddr 00:10:18:C3:E5:9C

BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

Interrupt:106 Memory:f6000000-f6012800

GigabitEthernet 3

Link encap:Ethernet HWaddr 00:10:18:C3:E5:9E

BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

Interrupt:114 Memory:f4000000-f4012800

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

inet6 ad

acs/admin#

Related Commands

Command

Description

interface

Configures an interface type and enters the interface configuration submode.

show inventory

command in the EXEC mode.

show inventory |

Syntax Description

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show inventory

NAME: "CSACS1121-K9 chassis", DESCR: "CSACS1121-K9 chassis"

PID: CSACS1121-K9 , VID: V01 , SN: CAM12345678

Total RAM Memory: 4149500 kB

CPU Core Count: 2

CPU 0: Model Info: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz

CPU 1: Model Info: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz

Hard Disk Count(*): 2

Disk 0: Device Name: /dev/sda

Disk 0: Capacity: 250.00 GB

Disk 0: Geometry: 255 heads 63 sectors/track 30401 cylinders

Disk 1: Device Name: /dev/sdb

Disk 1: Capacity: 250.00 GB

Disk 1: Geometry: 255 heads 63 sectors/track 30401 cylinders

NIC Count: 2

NIC 0: Device Name: eth0

NIC 0: HW Address: 00:15:17:59:73:81

NIC 0: Driver Descr: e1000: eth0: e1000_probe: Intel(R) PRO/1000 Network Connect

ion

NIC 1: Device Name: eth1

NIC 1: HW Address: 00:15:17:59:73:82

NIC 1: Driver Descr: e1000: eth1: e1000_probe: Intel(R) PRO/1000 Network Connect

ion

(*) Hard Disk Count may be Logical.

acs/admin#

show ip route

command in the EXEC mode.

show ip route |

Syntax Description

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC.

Usage Guidelines

None.

Examples

acs/admin# show ip route

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

10.77.247.64 0.0.0.0 255.255.255.224 U 0 0 0 eth0

0.0.0.0 10.77.247.65 0.0.0.0 UG 0 0 0 eth0

Related Commands

Command

Description

ip address

Sets the IP address and netmask for the Ethernet interface.

ip route

Configures the static routes.

show ipv6 route

command in the EXEC mode.

show ipv6 route |

Syntax Description

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC.

Usage Guidelines

None.

Examples

acs/admin# show ipv6 route

Kernel IPv6 routing table

Destination Next Hop Flags Metric Ref Use Iface

2001::/6 :: UA 256 1058 0 eth0

2001::/64 2001::212:44ff:fe30:bc0a UG 1024 0 0 eth0

fe80::/64 :: U 256 0 0 eth0

::/0 fe80::212:44ff:fe30:bc0a UGDA 1024 7 0 eth0

::1/128 :: U 0 24 9 lo

2001::215:17ff:fe7f:7780/128 :: U 0 0 1 lo

2001::9893:fc06:19ee:6453/128 :: U 0 0 1 lo

2001::c0bf:f906:75e9:9868/128 :: U 0 4 1 lo

2001::c996:dafc:1419:73f3/128 :: U 0 0 1 lo

fe80::215:17ff:fe7f:7780/128 :: U 0 3 1 lo

ff00::/8 :: U 256 0 0 eth0

acs240-228/admin#

Related Commands

Command

Description

ip address

Sets the IP address and netmask for the Ethernet interface.

ip route

Configures the static routes.

show logging

command in the EXEC mode. Using this command, you can also view messages from a specific log file within ACS application log directory and system logs.

Syntax Description

application

Displays application logs.

—Application name. This can be a maximum of 255 alphanumeric characters.

–tail—Tail system syslog messages.

–count—Tail last count messages. From 0 to 4,294,967,295.

|—Output modifier variables (see below).

internal

Displays the syslogs configuration.

system

Displays the system syslogs.

—System log file name. This can be a maximum of 255 alphanumeric characters.

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

This command displays the state of syslog error and event logging, including host addresses, and for which logging destinations (console, monitor, buffer, or host), logging is enabled.

Examples

Example 1

acs/admin# show logging system

775 Aug 27 2015 07:10:01 backup-success.log

58148 Aug 19 2015 11:53:14 anaconda.program.log

62871 Aug 19 2015 11:53:14 anaconda.log

4488859 Aug 24 2015 19:31:50 messages

2778 Aug 19 2015 12:11:19 boot.log

32064 Aug 24 2015 19:22:39 tallylog

138018 Aug 19 2015 11:53:14 anaconda.syslog

5941481 Aug 24 2015 19:33:01 cron

203300 Aug 19 2015 11:53:14 anaconda.storage.log

331301 Aug 19 2015 12:04:59 dracut.log

10897 Aug 24 2015 14:43:25 maillog

0 Aug 23 2015 04:59:35 spooler

36855 Aug 19 2015 12:09:12 pbis-open-install.log

5147 Aug 19 2015 11:53:14 anaconda.yum.log

850 Aug 24 2015 16:12:16 backup.log

0 Aug 19 2015 11:47:25 spooler.1

72432 Aug 19 2015 12:10:37 dmesg

15 Aug 24 2015 19:33:01 prev-passwd-lock-info.txt

16064 Aug 19 2015 12:08:16 faillog

29568 Aug 24 2015 19:22:39 wtmp

6881 Aug 22 2015 07:42:09 maillog.1

3072 Aug 24 2015 19:22:34 btmp

40368 Aug 22 2015 07:29:40 secure.1

0 Aug 19 2015 12:08:17 restore-success.log

146584 Aug 24 2015 19:22:39 lastlog

71737 Aug 19 2015 11:54:35 dmesg.old

0 Aug 19 2015 12:08:17 restore.log

--More--

Example 2

acs/admin# show logging internal

log server: localhost

Global loglevel: 6

Status: Enabled

acs/admin#

Example 3

ACS166/admin# show logging application

13466 Apr 22 2013 13:46:02 acsupgrade.log

2451 Apr 22 2013 13:45:18 MonitoringAndReportingCollector.log

0 Apr 17 2013 13:26:45 MonitoringAndReportingExpertTroubleshooting.log

2617 Apr 22 2013 14:44:33 ACSManagementAudit.log

7817 Apr 22 2013 13:47:02 monit.log

140082 Apr 23 2013 13:01:05 ACSManagement.log

3314 Apr 22 2013 13:43:58 acsLogForward.log

0 Apr 17 2013 13:27:29 MonitoringAndReportingUI.log

34409 Apr 23 2013 13:00:31 MonitoringAndReportingDatabase.log

8399 Apr 22 2013 13:45:03 acsRuntime.log

9923 Apr 23 2013 04:00:00 MonitoringAndReportingProcess.log

0 Apr 17 2013 13:27:17 MonitoringAndReportingAlert.log

0 Apr 17 2013 13:27:45 MonitoringAndReportingScheduler.log

2658 Apr 23 2013 11:45:38 ACSADAgent.log

Example 4

ACS166/admin# show logging application ACSManagement.log

Apr 17 2013 13:28:11 CisACS_34001 1 1 1 REPLICATION Dispatching transaction , 1/ConfigTransactionID=1

Apr 17 2013 13:28:12 CisACS_52000 2 1 1 AUDIT Added configuration , inLocalMode=false, TransactionID=1, ObjectId=1, ObjectName=ACS, AdminName=SERVICE, ObjectType=Service Selection Policy

Apr 17 2013 13:28:12 CisACS_34001 3 1 1 REPLICATION Dispatching transaction , 1/ConfigTransactionID=2

Apr 17 2013 13:28:13 CisACS_34001 4 1 1 REPLICATION Dispatching transaction , 1/ConfigTransactionID=3

Apr 17 2013 13:28:13 CisACS_34001 5 1 1 REPLICATION Dispatching transaction , 1/ConfigTransactionID=4

Apr 17 2013 13:28:13 CisACS_41007 6 1 1 DISTMGMT ACS Node record found , AdminName=SERVICE

Apr 17 2013 13:28:13 CisACS_34001 7 1 1 REPLICATION Dispatching transaction , 1/ConfigTransactionID=5

Apr 17 2013 13:28:13 CisACS_34001 8 1 1 REPLICATION Dispatching transaction , 1/ConfigTransactionID=6

Apr 17 2013 13:28:14 CisACS_34000 9 1 1 REPLICATION Appending transaction , AdminName=SERVICE, 1/ConfigTransactionID=19

Apr 17 2013 13:28:14 CisACS_52000 10 1 1 AUDIT Added configuration , inLocalMode=false, TransactionID=4, ObjectId=1, ObjectName=ACS166, AdminName=SERVICE, ObjectType=ACS Instance

Example 5

ACS166/admin# show logging system

29186 Apr 17 2013 13:11:26 anaconda.syslog

0 Apr 21 2013 00:00:01 boot.log

25536 Apr 19 2013 19:41:30 secure.1

23 Apr 22 2013 13:47:01 snmpd.log

12024 Apr 23 2013 11:45:30 faillog

384 Apr 18 2013 21:32:14 btmp

13898 Apr 23 2013 12:56:35 secure

0 Apr 21 2013 00:00:01 spooler

1246 Apr 22 2013 14:40:04 backup-success.log

146292 Apr 22 2013 17:14:40 lastlog

1246 Apr 22 2013 14:40:04 backup.log

1597631 Apr 20 2013 23:59:31 messages.1

Example 6

ACS166/admin# show logging system ade/ADE.log

Apr 17 13:20:47 localhost ADE-SERVICE[2450]: [2586]:[info] config:network: main.c[252] [setup]: Setup is complete

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: hangup signal caught, configuration read

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: [4641]:[notice] icmp: icmputils_cli.c[139] [setup]: Generating icmp echo response config

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: [4641]:[info] icmp: cars_icmpcfg.c[118] [setup]: Got the current ICMP Echo response config as : enabled

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: [4641]:[info] icmp: icmputils_cli.c[160] [setup]: Got ICMP echo config: on

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: [4641]:[notice] icmp: icmputils_cli.c[167] [setup]: Finished icmp echo response config generation

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: [4641]:[notice] logging: fwlimits_cli.c[853] [setup]: Finished limits config generation

Apr 17 13:20:51 localhost ADE-SERVICE[2450]: [4641]:[info] config:infra: cm_generate.c[223] [setup]: generate error: Empty list retrieved without an error

show logins

command in the EXEC mode.

show logins cli

Syntax Description

cli

Lists the login history.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

keyword; otherwise, an error occurs.

Examples

acs/admin# show logins cli

admin pts/0 dhcp-64-102-82-1 Thu May 3 05:23 still logged in

admin pts/0 dhcp-64-102-82-1 Thu May 3 04:31 - 05:11 (00:39)

admin pts/0 dhcp-64-102-82-1 Thu May 3 04:16 - 04:17 (00:00)

admin pts/0 dhcp-64-102-82-1 Thu May 3 03:53 - 04:16 (00:22)

wtmp begins Tue Oct 7 13:21:14 2008

acs/admin#

show memory

command in the EXEC mode.

show memory

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show memory

total memory: 2074924 kB

free memory: 1687324 kB

cached: 162984 kB

swap-cached: 0 kB

acs/admin#

show ntp

command in the EXEC mode.

show ntp

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show ntp

Primary NTP : 1.ntp.esl.cisco.com

Secondary NTP : 2.ntp.esl.cisco.com

synchronised to NTP server (209.165.202.129) at stratum 2

time correct to within 37 ms

polling server every 128 s

acs/admin#

Related Commands

Command

Description

ntp

Allows synchronization of the software clock by the NTP server for the system.

show ports

command in the EXEC mode.

Syntax Description

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

|—Output modifier variables (see Table 13).

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

|—Output modifier variables (see Table 13).

Table 13 Output Modifier Variables for Count or Last

|

Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

|—Output modifier variables.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

|—Output modifier variables.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

command, the port must have an associated active session.

Examples

acs/admin# show ports

Process : dbsrv10 (9253)

tcp: 0.0.0.0:2638, :::2638

Process : portmap (2615)

tcp: 0.0.0.0:111

udp: 0.0.0.0:111

Process : dbsrv10 (10019)

tcp: 0.0.0.0:43216, :::43216

Process : rt_daemon (9450)

tcp: 172.23.245.28:49

udp: 0.0.0.0:32771, 0.0.0.0:1812, 0.0.0.0:1813, 0.0.0.0:1645, 0.0.0.0:1646

Process : monit (6933)

tcp: 127.0.0.1:2812

Process : java (9756)

tcp: :::2020, ::ffff:127.0.0.1:8005, :::6666, :::2030, :::61616, :::80, ::ffff:127.0.0.1:51515, :::443

Process : sshd (2776)

tcp: :::22

Process : java (10023)

udp: :::20514

acs/admin#

show process

command in the EXEC mode.

show process |

Syntax Description

|

(Optional) Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the interface. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

See Table 14 for process field descriptions.

acs/admin# show process

USER PID TIME TT COMMAND

root 1 00:00:00 ? init

root 2 00:00:00 ? migration/0

root 3 00:00:00 ? ksoftirqd/0

root 4 00:00:00 ? migration/1

root 5 00:00:00 ? ksoftirqd/1

root 6 00:00:00 ? events/0

root 7 00:00:00 ? events/1

root 8 00:00:00 ? khelper

root 9 00:00:00 ? kacpid

root 36 00:00:00 ? kblockd/0

root 37 00:00:00 ? kblockd/1

root 55 00:00:00 ? pdflush

root 58 00:00:00 ? aio/0

root 59 00:00:00 ? aio/1

root 38 00:00:00 ? khubd

root 57 00:00:00 ? kswapd0

root 203 00:00:00 ? kseriod

root 320 00:00:00 ? ata/0

root 321 00:00:00 ? ata/1

root 325 00:00:00 ? scsi_eh_0

root 326 00:00:00 ? scsi_eh_1

--More-- (press Spacebar to continue)

Table 14 Show Process Field Descriptions

Field

Description

USER

Logged-in user.

PID

Process ID.

TIME

The time the command was last used.

TT

Terminal that controls the process.

COMMAND

Type of process or command used.

show repository

command in the EXEC mode.

Syntax Description

Name of the repository whose contents you want to view. This can be a maximum of 80 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show repository myrepository

back1.tar.gpg

back2.tar.gpg

acs/admin#

Related Commands

Command

Description

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

restore

Restores from backup the file contents of a specific repository.

repository

Enters the repository submode for configuration of backups.

show backup history

Displays the backup history of the system.

show restore

command in the EXEC mode.

Syntax Description

history

Displays the restore history.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show restore history

Tue Sep 4 03:42:48 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Tue Sep 4 03:46:15 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Tue Sep 4 03:51:07 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Tue Sep 4 03:54:35 PDT 2008: restore 11backup_Local.File2.tar.gpg from repository executeBackupRepo: success Wed Sep 5 12:31:21 UTC 2008: restore cdromRestore.tar.gpg from repository cdrom1: success admin#

acs/admin#

Example 2

acs/admin# show restore history

restore history is empty

acs/admin#

Related Commands

Command

Description

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

restore

Restores from backup the file contents of a specific repository.

repository

Enters the repository submode for configuration of backups.

show backup history

Displays the backup history of the system.

show running-configuration

command in the EXEC mode.

show running-configuration

Syntax Description

No arguments or keywords.

Defaults

The show running-configuration command displays all of the configuration information.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show running-configuration

Generating configuration...

!

hostname acs

!

ip domain-name cisco.com

!

interface GigabitEthernet 0

ip address 209.165.200.225 255.255.255.224

!

interface GigabitEthernet 1

shutdown

!

!

clock timezone UTC

!

!

username admin password groove role admin

!

service sshd

!

repository myrepository

url ftp://209.165.200.234/backup

user bubba password gump

!

password-policy

lower-case-required

upper-case-required

digit-required

no-username

disable-cisco-passwords

min-password-length 6

!

logging localhost

logging loglevel 6

!

cdp timer 60

cdp holdtime 180

cdp run GigabitEthernet 0

!

icmp echo on

!

acs/admin#

Related Commands

Command

Description

configure

Enters the Configuration mode.

show startup-configuration

Displays the contents of the startup configuration file or the configuration.

show startup-configuration

command in the EXEC mode.

show startup-configuration

Syntax Description

No arguments or keywords.

Defaults

The show startup-configuration command displays all of the startup configuration information.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show startup-configuration

Generating configuration...

!

hostname acs

!

ip domain-name cisco.com

!

interface GigabitEthernet 0

ip address 209.165.200.225 255.255.255.224

!

interface GigabitEthernet 1

shutdown

!

!

clock timezone UTC

!

!

username admin password groove role admin

!

service sshd

!

repository myrepository

url ftp://209.165.200.234/backup

user bubba password gump

!

--More-- (press Spacebar to continue)

Related Commands

Command

Description

configure

Enters the Configuration mode.

show running-configuration

Displays the contents of the currently running configuration file or the configuration.

show tech-support

command in the EXEC mode.

Syntax Description

file

Save any technical support data as a file in the local disk.

Filename to save. This can be a maximum of 80 alphanumeric characters.

Defaults

Passwords and other security information do not appear in the output.

Command Modes

EXEC

Usage Guidelines

command is useful for collecting a large amount of information about your ACS server for troubleshooting purposes. You can then provide output to technical support representatives when reporting a problem.

Examples

acs/admin# show tech-support

###################################################

Application Deployment Engine(ADE) - Release 1.0

Technical Support Debug Info follows...

###################################################

*****************************************

Checking dmidecode Serial Number(s)

*****************************************

0x0736C7F6

0x0736C803

0x0736C808

0x0736C81F

AZAX74601334

*****************************************

Displaying System Uptime...

*****************************************

20:41:46 up 6:42, 1 user, load average: 0.45, 0.20, 0.12

*****************************************

Display Memory Usage(KB)

*****************************************

total used free shared buffers cached

Mem: 4148032 2951612 1196420 0 59440 1873920

-/+ buffers/cache: 1018252 3129780

Swap: 8191992 0 8191992

*****************************************

Displaying Processes(ax --forest)...

*****************************************

PID TTY STAT TIME COMMAND

1 ? S 0:00 init [3]

2 ? S 0:00 [migration/0]

3 ? SN 0:00 [ksoftirqd/0]

4 ? S 0:00 [migration/1]

5 ? SN 0:00 [ksoftirqd/1]

--More--(Press Enter or Spacebar.)

Related Commands

Command

Description

show interface

Displays the usability status of the interfaces.

show process

Displays information about active processes.

show running-configuration

Displays the contents of the current running configuration.

show terminal

command in the EXEC mode.

show terminal

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show terminal

TTY: /dev/pts/0 Type: "vt100"

Length: 25 lines, Width: 80 columns

Session Timeout: 30 minutes

acs/admin#

output.

Table 15 Show Terminal Field Descriptions

Field

Description

TTY: /dev/pts/0

Displays standard output to type of terminal.

Type: “vt100“

Type of current terminal used.

Length: 24 lines

Length of the terminal display.

Width: 80 columns

Width of the terminal display, in character columns.

Session Timeout: 30 minutes

Length of time, in minutes, for a session, after which the connection closes.

show timezone

command in the EXEC mode.

show timezone

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show timezone

UTC

acs/admin#

Related Commands

Command

Description

clock timezone

Sets the time zone on the system.

show timezones

Displays the time zones available on the system.

show timezones

command in the EXEC mode.

show timezones

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

See clock timezone, for examples of the time zones available for the ACS server.

Examples

acs/admin# show timezones

PST8PDT

Hongkong

Etc/GMT-7

Etc/GMT-12

Etc/GMT-4

Etc/GMT-13

Etc/GMT-11

Etc/GMT-1

Etc/GMT+5

Etc/GMT-14

Etc/GMT+11

Etc/GMT+6

Etc/Zulu

Etc/GMT+7

Etc/Universal

Etc/GMT-2

Etc/GMT+10

Etc/GMT-8

Etc/GMT+8

Etc/GMT+1

Etc/GMT0

Etc/GMT+9

Etc/GMT+3

Etc/GMT-3

Etc/GMT

Etc/GMT-5

Etc/GMT-0

Etc/GMT-6

Etc/GMT+4

Etc/GMT-9

Etc/GMT+12

Etc/GMT+2

Etc/UCT

Etc/GMT-10

Etc/GMT+0

Etc/Greenwich

Etc/UTC

Pacific/Norfolk

--More-- (Press Enter or Spacebar)

Related Commands

Command

Description

show timezone

Displays the time zone set on the system.

clock timezone

Sets the time zone on the system.

show udi

command in the EXEC mode.

show udi

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

Example 1

acs/admin# show udi

SPID: ADE-1010

VPID: VO1

Serial: 123455

acs/admin#

Example 2

acs/admin# sh udi

SPID:: Cisco-VM-SPID

VPID: V01

Serial: Cisco-VM-SN

command on VMware servers running VMware ESXi 4.1.0.

show uptime

command in the EXEC mode.

show uptime |

Syntax Description

|

(Optional) Output modifier variables:

■begin—Matched pattern. This can be a maximum of 80 alphanumeric characters.

■count—Count the number of lines in the output. Add number after the word count.

■end—End with line that matches. This can be a maximum of 80 alphanumeric characters.

■exclude—Exclude lines that match. This can be a maximum of 80 alphanumeric characters.

■include—Include lines that match. This can be a maximum of 80 alphanumeric characters.

■last—Display last few lines of output. Add number after the word last. This can be a maximum of 80 lines to display. Default 10.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show uptime

4 day(s), 16:36:58

acs/admin#

show users

command in the EXEC mode.

show users

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

None.

Examples

acs/admin# show users

USERNAME ROLE HOST TTY LOGIN DATETIME

admin Admin tty1 Tue Apr 21 10:50:10 2015

-------------------

DETACHED SESSIONS:

-------------------

USERNAME ROLE STARTDATE

% No disconnected user sessions present

acs130/admin#

show version

command in the EXEC mode.

show version

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

EXEC

Usage Guidelines

This command displays information about the ADE-OS 2.0 software version running on the ACS server, and the ACS version.

Examples

acs/admin# sh version

Cisco Application Deployment Engine OS Release: 2.2

ADE-OS Build Version: 2.2.2.010

ADE-OS System Architecture: x86_64

Copyright (c) 2005-2015 by Cisco Systems, Inc.

All rights reserved.

Hostname: acs

Version information of installed applications

---------------------------------------------

Cisco ACS VERSION INFORMATION

-----------------------------

Version: 5.8.1.0.15

Internal Build ID: B.257

acs/admin#

ACS Configuration Commands

Each ACS Configuration command includes a brief description of its use, command syntax, usage guidelines, and sample output.

command in the EXEC mode.

This section describes the following Configuration commands.

■access-setting accept-all

■acsview-db-compress

■acsview merge-from-supportbundle

■acsview rebuild-database

■acsview replace-clean-activesessionsdb

■acsview replace-cleandb

■acsview show-dbsize

■acsview truncate-log

■database-compress

■debug-adclient

■debug-log

■ethernet-interface

■export-data

■export-data-message-catalog

■import-data

■import-export-abort

■import-export-status

■no debug-adclient

■no debug-log

■replication force-sync

■replication status

■reset-management-interface-certificate

■show debug-adclient

■show debug-log

access-setting accept-all

command in the ACS Configuration mode. Only the super admin has the privilege to use this command on a primary ACS node.

access-setting accept-all

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

command when all system administrators' access to an ACS node through the GUI is blocked. This problem occurs when an administrator defines an access list that includes all IP addresses and blocks access to the GUI.

When you run this command, IP address filtering is set to allow all IP addresses to connect the management pages, but the IP addresses defined in the IP Ranges table to allow or reject the IP addresses to access the management pages are not reset; therefore, you can reuse this table to set IP address filtering.

Examples

acs/admin(config-acs)# access-setting accept-all

access setting allows all IP addresses to connect

acs/admin(config-acs)#

acsview-db-compress

Use the acsview-db-compress command to compress the ACS View database file size. This command compresses the ACS View database by rebuilding each table in the database and releasing the unused space. As a result, the physical size of the database is reduced.

acsview-db-compress

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

ACS is stopped during the database compression process. ACS restarts automatically after the database compression. Database compression takes sometime, based on the database size. If the database size is large, then the compression happens in hours. This CLI command needs to executed only in the log collector server.

It is strongly recommended to execute this CLI only during maintenance hours, as it requires restarting the ACS services. The option to compress the view database is also mentioned in the description of one of the alerts that is sent when the databasae reaches a certain limit.

Examples

acs242-197/acsadmin(config-acs)# acsview-db-compress

You can chose to compress ACS View database. This operation will take more time if the size of the database is big. During this operation, ACS services will be stopped. Services will be started automatically when the compression is over. Do you want to continue (y/n)?

Please wait till ACS services return after the ACS View database is compressed. Refer to ADE.log for more details about the ACS View db compress.

acsview merge-from-supportbundle

Use the acsview merge-from-supportbundle command to merge the existing ACS view database with the information given in the specified support bundle.

Syntax Description

Holds the support bundle file name which is to be merged with the existing ACS view database. This support bundle file should be present in the local disk.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

ACS view services are stopped during the support bundle merge operation. ACS view services restart automatically after the merge operation is successful.

You should copy the decrypted support bundle of the same version which we have specified in the support file name of the merge command including the patch version. You should copy this file using the copy command in CLI.

Examples

acs242-197/acsadmin(config-acs)# acsview merge-from-supportbundle clisupport.tar.gz

Do you want to clean the data first?[y/n]

Please wait till database merge operation is completed. Refer ADE.log for more details about the status.

Related Commands

Command

Description

acsview rebuild-database

Rebuilds the ACS view database and keeps the log data only for the specified number of days.

acsview replace-clean-activesessionsdb

Removes the active session information from the ACS view database and make it as a fresh database.

acsview replace-cleandb

Removes all data from the ACS view database and makes the current view database as a fresh view database.

acsview show-dbsize

Displays the physical and actual size of the ACS view database and the transaction log files.

acsview truncate-log

Truncates the ACS view database transaction logs.

a c sview rebuild-database

Use the acsview rebuild-database command to rebuild the database with the log information up to the specified number of days. If you specify to rebuild the database for 10 days, then ACS view database keeps only the last 10 days data and erases the remaining data.

Syntax Description

Holds a integer value for number of days.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

ACS view services are stopped during the database rebuild operation. ACS view services restart automatically after rebuild operation is successful.

You need to clean up the unwanted files and have enough disk space before executing the rebuild-database command in ACS view.

Examples

acs242-197/acsadmin(config-acs)# acsview rebuild-database 10

This operation will take more time if the number of records are more in the database.During this operation,ACSview unloads the data for given number of days to localdisk or opt which one is having more space,Stops view services ,replaces with clean db,restart view services and reload the data.Do you want to continue (y/n)?

Please wait till database reload operation is completed.Refer ADE.log for more details.

Related Commands

Command

Description

acsview merge-from-supportbundle

Merges the ACS view database with the specified support bundle data.

acsview replace-clean-activesessionsdb

Removes the active session information from the ACS view database and make it as a fresh database.

acsview replace-cleandb

Removes all data from the ACS view database and makes the current view database as a fresh view database.

acsview show-dbsize

Displays the physical and actual size of the ACS view database and the transaction log files.

acsview truncate-log

Truncates the ACS view database transaction logs.

acsview replace-clean-activesessionsdb

Use the acsview replace-clean-activesessionsdb command to clean up the active session information in the ACS view database. This command removes the active session information in the ACS view database.

acsview replace-clean-activesessionsdb

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

ACS view services are stopped during database active sessions clean up process. ACS view services restart automatically after the active sessions clean up operation is successful.

Examples

acs242-197/acsadmin(config-acs)# acsview replace-clean-activesessionsdb

acs242-197/acsadmin(config-acs)#

Related Commands

Command

Description

acsview merge-from-supportbundle

Merges the ACS view database with the specified support bundle data.

acsview rebuild-database

Rebuilds the ACS view database and keeps the log data only for the specified number of days.

acsview replace-cleandb

Removes all data from the ACS view database and makes the current view database as a fresh view database.

acsview show-dbsize

Displays the physical and actual size of the ACS view database and the transaction log files.

acsview truncate-log

Truncates the ACS view database transaction logs.

acsview replace-cleandb

Use the acsview replace-cleandb command to clean up the information in the ACS view database. This command removes all data from the ACS view database. That is, this command replaces the current database with a fresh view database.

acsview replace-cleandb

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

ACS view services are stopped during database clean up process. ACS view services restart automatically after the database clean up operation is successful.

Examples

acs242-197/acsadmin(config-acs)# acsview replace-cleandb

acs242-197/acsadmin(config-acs)#

Related Commands

Command

Description

acsview merge-from-supportbundle

Merges the ACS view database with the specified support bundle data.

acsview rebuild-database

Rebuilds the ACS view database and keeps the log data only for the specified number of days.

acsview replace-clean-activesessionsdb

Removes the active session information from the ACS view database and make it as a fresh database.

acsview show-dbsize

Displays the physical and actual size of the ACS view database and the transaction log files.

acsview truncate-log

Truncates the ACS view database transaction logs.

acsview show-dbsize

Use the acsview show-dbsize command to display the physical and active size of the ACS view database. It also displays the physical size of the ACS view transaction log files.

acsview show-dbsize

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

acs242-197/acsadmin(config-acs)# acsview show-dbsize

Actual DB Size (bytes) : 63692800

Actual DB Size (GBs) :0.06

Physical DB Size (bytes):64667648

Physical DB Size (GBs) :0.06

Physical ACSviewlog file Size (GBs) :0

acs242-197/acsadmin(config-acs)#

Related Commands

Command

Description

acsview merge-from-supportbundle

Merges the ACS view database with the specified support bundle data.

acsview rebuild-database

Rebuilds the ACS view database and keeps the log data only for the specified number of days.

acsview replace-clean-activesessionsdb

Removes the active session information from the ACS view database and make it as a fresh database.

acsview replace-cleandb

Removes all data from the ACS view database and makes the current view database as a fresh view database.

acsview truncate-log

Truncates the ACS view database transaction logs.

acsview truncate-log

Use the acsview truncate-log command to truncate the ACS view database transaction log messages.

acsview truncate-log

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

acs242-197/acsadmin(config-acs)# acsview truncate-log

acs242-197/acsadmin(config-acs)#

Related Commands

Command

Description

acsview merge-from-supportbundle

Merges the ACS view database with the specified support bundle data.

acsview rebuild-database

Rebuilds the ACS view database and keeps the log data only for the specified number of days.

acsview replace-clean-activesessionsdb

Removes the active session information from the ACS view database and make it as a fresh database.

acsview replace-cleandb

Removes all data from the ACS view database and makes the current view database as a fresh view database.

acsview show-dbsize

Displays the physical and actual size of the ACS view database and the transaction log files.

database-compress

command in the ACS Configuration mode. This command has the option to truncate ACS transaction history.

This command does not erase or modify any information during the database compression, except for the transaction history if the truncate flag is used.

When you run this command, ACS is stopped, and the process of compressing the ACS database is executed. ACS starts automatically after the process is done.

The progress of the command execution is logged in the ADE.log file.

Syntax Description

Truncates the transaction history.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

acs/admin(config-acs)# database-compress

Related Commands

Command

Description

debug-adclient

Enables debug logging for an Active Directory client.

no debug-adclient

Disables debug logging for an Active Directory client.

debug-log

Defines the local debug logging level for the ACS components.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

debug-adclient

form of this command. Only the network-device admin can enable or disable debug logging for an Active Directory client.

debug-adclient enable

Syntax Description

No arguments or keywords.

Defaults

Disabled.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

When you set the log level of debug logs to DEBUG for the following components, the active directory client logs are automatically enabled. Similarly, when you disable the DEBUG log level on one of these components, the active directory logs are disabled:

■all

■mgmt

■runtime

■runtime-idstores

Examples

acs/admin(config-acs)# debug-adclient enable

acs/admin(config-acs)#

Related Commands

Command

Description

no debug-adclient

Disables debug logging for an Active Directory client.

debug-log

Defines the local debug logging level for the ACS components.

show debug-log

Shows the debug log level status for subsystems (enabled or disabled).

show debug-adclient

Shows the debug log level status for an Active Directory client (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

debug-log

To set the local debug logging level for all or specific ACS components, use the debug-log command in the ACS Configuration mode. Any user, irrespective of role, can run this command.

Syntax Description

can be any of the components described in the Usage Guidelines.

all

Selects local debug logging on all components.

level

Selects local debug logging level. The options are:

■debug—Selects logging messages with the DEBUG severity level.

■info—Selects logging messages with the INFO severity level.

■warn—Selects logging messages with the WARN severity level.

■error—elects logging messages with the ERROR severity level.

■fatal—Selects logging messages with the FATAL severity level.

■none—Selects logging messages with the no severity level.

Defaults

All ACS debug logging is set to warn.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

You can select any of the following options (including suboptions) as a component:

items in the list below.

–runtime-admin

–runtime-authenticators

–runtime-authorization

–runtime-config-manager

–runtime-config-notification-flow

–runtime-customerlog

–runtime-crypto

–runtime-dataaccess

–runtime-dbpassword

–runtime-eap

–runtime-event-handler

–runtime-idstores

–runtime-infrastructure

–runtime-logging

–runtime-logging-notification-flow

–runtime-message-bus

–runtime-message-catalog

–runtime-radius

–runtime-rule-engine

–runtime-state-manager

–runtime-tacacs

–runtime-xml-config

items in the list below.

–mgmt-audit

–mgmt-common

–mgmt-aac

–mgmt-bl

–mgmt-cli

–mgmt-gui

–mgmt-system

–mgmt-notification

–mgmt-bus

–mgmt-dbal

–mgmt-replication

–mgmt-distmgmt

–mgmt-validation

–mgmt-changepassword

–mgmt-license

–mgmt-acsview

command.

When you set the log level of debug logs to DEBUG for the following components, the active directory client logs are automatically enabled. Similarly, when you disable the DEBUG log level on one of these components, the active directory logs are disabled:

■all

■mgmt

■runtime

■runtime-idstores

Examples

acs/admin(config-acs)# debug-log mgmt level warn

acs/admin(config-acs)#

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

export-data

Exports configuration data from an ACS local store to a remote repository.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores the file contents of a specific repository from the backup.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

ethernet-interface

command in ACS configuration mode.

ethernet-interface configure [on | off]

ethernet-interface set-to-default

ethernet-interface show-configuration

Syntax Description

configure

Updates the ethernet interface configuration.

set-to-default

Sets the current ethernet interface configuration to default.

show-configuration

Displays the current ethernet interface configurations.

Auto-negotiation (On or Off)

Automatically negotiates the link speed of the ethernet interface.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None

Examples

acs/admin(config-acs)# ethernet-interface show-configuration

Settings for eth0:

Current message level: 0x00000007 (7)

drv probe link

Link detected: yes

acs/admin(config-acs)#

Related Commands

Command

Description

interface

Displays statistics for all the interfaces configured on ACS.

export-data

in ACS configuration mode. Only users who have read permission to a specific configuration object in the GUI can export that data to a remote repository.

Syntax Description

user

Exports the user configuration data to the remote repository.

host

Exports the host configuration data to the remote repository.

device

Exports the device configuration information to the remote repository.

identity-group

Exports the identity groups data to the remote repository.

network-device-group-device-type

Exports the network device groups and network device types data to the remote repository.

network-device-group-location

Exports the network device group location information to the remote repository.

downloadable-acl

Exports the downloadable acls data to the remote repository.

command-set

Exports the command sets information to the remote repository.

administrator

Exports the administrator accounts to the remote repository.

The remote repository to which to export the configuration data.

The filename for the configuration data to be stored in the remote repository.

that you provide.

full

Encrypts the export file using the GNU Privacy Guard (GPG) encryption mechanism and uses a remote repository to export the file securely. If you specify the security type as full, you must specify a repository of the type SFTP.

A secret phrase to encrypt the export file. If you specify the security type as full or only-sec-files, you must specify the secret phrase.

none

Neither encrypts the import file nor uses a secured remote repository for export.

only-sec-repo

Uses the secured remote repository to export the file. If you specify the security type as only-sec-repo, you must specify a repository of the type SFTP.

only-sec-file

Encrypts the export file using the GPG encryption mechanism.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

command to learn the status of export operations.

If the export process violates the security constraints defined in the security type parameters (full, none, only-sec-repo, and only-sec-files), the ACS server returns a validation error similar to the following:

Repository 'ftp01' has low security level

command is asynchronous, which allows you to execute other CLI commands when the export operation is in progress.

Examples

acs/admin(config-acs)# export-data user repostiory01 file01 resultfile01 full password

Export process Id is: 1

acs/admin(config-acs)#

Related Commands

Command

Description

export-data-message-catalog

Exports the messages from the ACS message catalog to a remote repository.

import-data

Imports configuration data from a remote repository to an ACS local store.

import-export-abort

Aborts all or specific import or export processes.

import-export-status

Displays the status of all or specific import or export processes.

export-data-message-catalog

in ACS configuration mode. Only users who have read permission to the message catalog log messages in the ACS web interface can export that specific configuration data to a remote repository.

Syntax Description

The root repository to which the exported file is saved.

The filename to download the configuration data and store it in the remote repository.

that you provide.

full

Encrypts the export file using the GNU Privacy Guard (GPG) encryption mechanism and uses remote repository to export the file securely. If you specify the security type as full, you must specify a repository of the type SFTP.

A secret phrase to encrypt the export file. If you specify the security type as full or only-sec-files, you must specify the secret phrase.

none

Neither encrypts the import file nor uses the secured remote repository for export.

only-sec-repo

Uses the secured remote repository to export the file. If you specify the security type as only-sec-repo, you must specify a repository of the type SFTP.

only-sec-file

Encrypts the export file using the GPG encryption mechanism.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

When you run this command, the ACS server writes the message catalog log messages in the filename specified in the command and saves it in the root repository.

Examples

acs/admin(config-acs)# export-data-message-catalog root exportfile1 resultfile2 full password

acs/admin(config-acs)#

Related Commands

Command

Description

export-data

Exports configuration data from an ACS local store to a remote repository.

import-data

Imports configuration data from a remote repository to an ACS local store.

import-export-status

Displays the status of all or specific import or export processes.

import-data

in the ACS Configuration mode. Only users who have CRUD permissions to a specific configuration object in ACS web interface can import that particular configuration data to an ACS local store.

Syntax Description

update

Updates the records in the ACS local store that match the records in the specified remote repository.

delete

Deletes the records in the ACS local store that match the records in the specified remote repository.

add

Adds the records that do not match the records of the import file in the remote repository to the ACS local store.

user | host | device | idgroup | ndg | dacl | cmdset

Imports the specified type of configuration data from the import file in the remote repository.

Remote repository from which to import the configuration data.

Import filename in the remote repository.

.

abort-on-error

Aborts the import operation if an error occurs during the import process.

cont-on-error

Ignores errors, if any occur, and continues the import process.

full

Encrypts the import file using the GPG encryption mechanism and uses secured remote repository to import the file. If you specify the security type as full, you must specify a repository of the type SFTP.

none

Neither encrypts the import file nor uses the secured remote repository for import.

Provide the secret phrase to decrypt the import file. If you specify the security type as full or only-sec-files, you must specify the secret phrase.

only-sec-repo

Uses the secured remote repository to import the file. If you specify the security type as only-sec-repo, you must specify a repository of the type SFTP.

only-sec-files

Encrypts the import file using GPG encryption mechanism.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

command to learn the status of import operations.

If the import process violates the security constraints defined in the security type parameters (full, none, only-sec-repo, and only-sec-files), the ACS server returns a validation error similar to the following:

Repository 'ftp01' has low security level

command is asynchronous, which allows you to execute other CLI commands when the import operation is in progress.

Examples

acs/admin(config-acs)# import-data add user repository01 file01 resultfile01 abort-on-error full password

Import process Id is: 2

acs/admin(config-acs)#

Related Commands

Command

Description

export-data

Exports configuration data from an ACS local store to a remote repository.

import-export-abort

Aborts all or specific import or export processes.

import-export-status

Displays the status of all or specific import or export processes.

import-export-abort

command in the ACS Configuration mode. Only the super admin can simultaneously abort a running process and all pending import and export processes.

However, a user who owns a particular import or export process can abort that particular process by using the process ID, or by stopping the process when it is in progress.

Syntax Description

running

Aborts if any import or export processes is in progress.

all

Aborts if any import or export processes is in progress or waiting in queue to be processed.

id

Aborts the import or export processes with the specified ID, whether it is in progress or waiting in queue to be processed. You must specify the process ID.

To abort a specific import or export processes, specify the process ID.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

Example 1

acs/admin(config-acs)# import-export-abort running

Aborted process ID #5

acs/admin(config-acs)#

Example 2

acs/admin(config-acs)# import-export-abort running

No running processes.

acs/admin(config-acs)#

Example 3

acs/admin(config-acs)# import-export-abort all

Aborted process ID #20, 50 pending processes are removed.

acs/admin(config-acs)#

Example 4

acs/admin(config-acs)# import-export-abort id 3

Removed pending process ID #3 from queue.

acs/admin(config-acs)#

Example 5

acs/admin(config-acs)# import-export-abort id 201

No such process ID #201.

acs/admin(config-acs)#

Related Commands

Command

Description

export-data

Exports configuration data from an ACS local store to a remote repository.

import-data

Imports configuration data from a remote repository to an ACS local store.

import-export-status

Displays the status of all or specific import or export processes.

import-export-status

command in the ACS Configuration mode. Any user, irrespective of role, can run this command.

Syntax Description

current

Displays the status of the currently running processes.

all

Displays the status of all the import and export processes, including any pending processes.

id

Displays the status of an import or export process with the specified ID. You must specify the process ID.

To view the import or export status based on a particular process, specify the process ID.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

Example 1

acs/admin(config-acs)# import-export-status current

20 out of 30 records are processed, 0 failed.[]

acs/admin(config-acs)#

Example 2

acs/admin(config-acs)# import-export-status id 3

Process id# 3 completed; 10 out of 10 records are processed, 0 failed.[]

acs/admin(config-acs)#

Example 3

acs/admin(config-acs)# import-export-status id 4

Process id# 3 is pending; its number in the pending queue is 8.

acs/admin(config-acs)#

Example 4

acs/admin(config-acs)# import-export-status all

Process id# is running; 10 out of 10 records are processed, 0 failed; 0 are pending.

acs/admin(config-acs)#

Example 5

acs/admin(config-acs)# import-export-status all

No process is running.

acs/admin(config-acs)#

Related Commands

Command

Description

export-data

Exports configuration data from an ACS local store to a remote repository.

import-data

Imports configuration data from a remote repository to an ACS local store.

import-export-abort

Aborts all or specific import or export processes.

no debug-adclient

command in the ACS Configuration mode. Only the network-device admin can enable or disable debug logging for an Active Directory client.

no debug-adclient enable

Syntax Description

No arguments or keywords.

Defaults

Disabled.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

acs/admin(config-acs)# no debug-adclient enable

acs/admin(config-acs)#

Related Commands

Command

Description

debug-adclient

Enables debug logging for an Active Directory client.

debug-log

Defines the local debug logging level for the ACS components.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show debug-adclient

Shows the debug log level status for an Active Directory client (enabled or disabled).

no debug-log

command in the ACS Configuration mode. Any user, irrespective of role, can run this command.

Syntax Description

can be any of the components described in the Usage Guidelines.

all

Selects local debug logging on all components.

Defaults

All debug logging is disabled.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

You can select any of the following as a component:

items in the list below:

–runtime-admin

–runtime-authenticators

–runtime-authorization

–runtime-config-manager

–runtime-config-notification-flow

–runtime-customerlog

–runtime-crypto

–runtime-dataaccess

–runtime-dbpassword

–runtime-eap

–runtime-event-handler

–runtime-idstores

–runtime-infrastructure

–runtime-logging

–runtime-logging-notification-flow

–runtime-message-bus

–runtime-message-catalog

–runtime-radius

–runtime-rule-engine

–runtime-state-manager

–runtime-tacacs

–runtime-xml-config

items in the list below:

–mgmt-audit

–mgmt-common

–mgmt-aac

–mgmt-bl

–mgmt-cli

–mgmt-gui

–mgmt-system

–mgmt-notification

–mgmt-bus

–mgmt-dbal

–mgmt-replication

–mgmt-distmgmt

–mgmt-validation

–mgmt-changepassword

–mgmt-license

–mgmt-acsview

Examples

acs/admin(config-acs)# no debug-log all

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs-config

Enters the ACS Configuration mode.

acs reset-config

Resets the ACS configuration to factory defaults.

acs support

Gathers information for troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

debug-log

Defines the local debug logging level for the ACS components.

replication force-sync

Synchronizes the secondary ACS database to the primary ACS database.

restore

Restores from backup the file contents of a specific repository.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show acs-logs

Displays ACS server debug logs.

show application

Shows application status and version information.

show version

Displays information about the software version of the system.

replication force-sync

command in the ACS Configuration mode. Only the super admin or system admin can run this command on a secondary ACS node.

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

You can use this command only on a secondary ACS. If you use this command on the primary ACS, this message appears:

Replication synchronization must be done on a SECONDARY instance.

This command stops the ACS application, which remains unavailable for the duration of the synchronization process. The duration of the synchronization process depends on the size of the ACS database—it could take a significant amount of time to complete. Ensure that you use this command when you do not need to access your ACS.

ACS restarts after the primary-to-secondary synchronization is complete.

Examples

acs/admin(config-acs)# replication force-sync

Success.

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

Enables debug logging for components.

export-data

Exports configuration data from an ACS local store to a remote repository.

restore

Restores the file contents of a specific repository from the backup.

show acs-logs

Displays ACS server debug logs.

show application

Displays application status and version information.

show version

Displays information about the software version of the system.

replication status

To check the replication status ACS database (configuration information), use the command replication status.

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

You can use this command to check the replication status of the ACS database.

Examples

acs205/acsadmin(config-acs)# replication_status

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

reset-management-interface-certificate

command in the ACS Configuration mode. Only the super admin and system admin can run this command.

reset-management-interface-certificate

Syntax Description

No arguments or keywords.

Defaults

None.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

run this command when you assign an invalid GUI certificate for the management interface and your login to ACS GUI is denied, or when you want to reset the existing management interface certificate to the default self-signed certificate.

When you run this command, the ACS server performs the following process:

1. For first-time management interface certificate reset:

a. Disconnects the association of the invalid certificate with the management interface.

The disconnected invalid certificate remains in the database.

.

c. Associates the new self-signed certificate with the management interface.

):

a. Disconnects all the associations (the management interface, external policy server, and EAP server associations from the invalid certificate).

.

c. Associates the new self-signed certificate with the management interface and establishes the connections between the new certificate and external policy and EAP servers.

refers to the ACS server name. If the hostname is lnx-01, then the certificate’s subject name would be lnx-01--reset.

Examples

Example 1 – Success

acs/admin(config-acs)# reset-management-interface-certificate

Resetting ACS Management Interface Certificate...

Management Interface Certificate Reset Completed.

acs/admin(config-acs)#

Example 2 – Failure

acs/admin(config-acs)# reset-management-interface-certificate

Resetting ACS Management Interface Certificate...

Failed to Reset Management Interface Certificate.

See the logs for more details

acs/admin(config-acs)#

show debug-adclient

command in the ACS Configuration mode. Any user, irrespective of role, can run this command.

Syntax Description

No arguments or keywords.

Defaults

Disabled.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

None.

Examples

acs/admin(config-acs)# show debug-adclient

Active Directory client debug is disabled

Related Commands

Command

Description

debug-adclient

Enables debug logging for an Active Directory client.

no debug-adclient

Disables debug logging for an Active Directory client.

debug-log

Defines the local debug logging level for the ACS components.

show debug-adclient

Shows the debug log level status for subsystems (enabled or disabled).

show debug-log

command in the ACS Configuration mode. Any user, irrespective of role, can run this command.

Syntax Description

can be any of the components described in the Usage Guidelines.

all

Displays the currently configured local debug logging status for all components.

Defaults

All ACS debug logging is set to warn.

Command Modes

ACS configuration (acs-config)

Usage Guidelines

You can select any of the following (including the suboptions) as a component:

items in the list below:

–runtime-admin

–runtime-authenticators

–runtime-authorization

–runtime-config-manager

–runtime-config-notification-flow

–runtime-customerlog

–runtime-crypto

–runtime-dataaccess

–runtime-dbpassword

–runtime-eap

–runtime-event-handler

–runtime-idstores

–runtime-infrastructure

–runtime-logging

–runtime-logging-notification-flow

–runtime-message-bus

–runtime-message-catalog

–runtime-radius

–runtime-rule-engine

–runtime-state-manager

–runtime-tacacs

–runtime-xml-config

items in the list below:

–mgmt-audit

–mgmt-common

–mgmt-aac

–mgmt-bl

–mgmt-cli

–mgmt-gui

–mgmt-system

–mgmt-notification

–mgmt-bus

–mgmt-dbal

–mgmt-replication

–mgmt-distmgmt

–mgmt-validation

–mgmt-changepassword

–mgmt-license

–mgmt-acsview

Examples

ACS/admin(config-acs)# sh debug-log mgmt

mgmt warn

mgmt-acsview warn

ACS/admin(config-acs)# sh debug-log runtime

runtime warn

ACS/admin(config-acs)# sh debug-log mgmt-acsview

mgmt-acsview warn

Related Commands

Command

Description

acs (instance)

Starts or stops an ACS instance.

acs (process)

Starts or stops an ACS process.

acs backup

Performs a backup of an ACS configuration.

acs-config

Enters the ACS Configuration mode.

acs patch

Installs and removes ACS patches.

acs reset-config

Resets the ACS configuration to factory defaults.

acs reset-password

Resets the ‘acsadmin’ administrator password to the default setting.

acs restore

Performs a restoration of an ACS configuration.

acs support

Gathers information for ACS troubleshooting.

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

backup-logs

Backs up system logs.

debug-log

To set the local debug logging level for all or specific ACS components.

export-data

Exports configuration data from an ACS local store to a remote repository.

restore

Restores the file contents of a specific repository from the backup.

show acs-logs

Displays ACS server debug logs.

show application

Displays application status and version information.

show version

Displays information about the software version of the system.

Configuration Commands

Each Configuration command includes a brief description of its use, command syntax, usage guidelines, and sample output.

.

Some of the Configuration commands require you to enter the configuration submode to complete the command configuration.

command in the EXEC mode.

Table 16 lists the Configuration commands that are described in this section.

Table 16 List of Configuration Commands

■backup interface

■backup-staging-url

■cdp holdtime

■cdp run

■cdp timer

■clock timezone

■conn-limit

■do

■end

■exit

■hostname

■icmp echo

■interface

■ip address

■ipv6 address

■ipv6 address autoconfig

■ip default-gateway

■ip domain-name

■ip domain round-robin

■ip domain timeout

■ip name-server

■ip route

■ipv6 enable

■ipv6 route

■kron occurrence

■kron policy-list

■logging

■max-ssh

■ntp

■ntp authenticate

■ntp authentication-key

■ntp server

■ntp trusted-key

■password-policy

■rate-limit

■repository

■service

■snmp-server community

■snmp-server contact

■snmp-server host

■snmp-server location

■snmp-server trap dskThresholdLimit

■synflood-limit

■tcp

■username

backup interface

command in interface configuration mode. To remove the interface bonding, use the no form of this command.

Syntax Description

GigabitEthernet

Configures the Gigabit Ethernet interface.

Number of the Gigabit Ethernet port to configure. The valid options are 0, 1, 2, 3, 4, and 5.

Defaults

No default behavior or values.

Command Modes

Interface Configuration (config-GigabitEthernet)

Usage Guidelines

Use this command in interface configuration mode to create interface bondings.

Examples

Example 1 (Configuring Bond 0)

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# no shutdown

acs/admin(config-GigabitEthernet)# backup interface GigabitEthernet 1

WARN: IP address of interface eth1 will be removed once NIC bonding is enabled.

Configuring backup interface may result in undesired side effects on any installed

application(s).

Are you sure you want to proceed? Y/N [N]:y

Shutting down ntpd: [ OK ]

ntpd: Synchronizing with time server: [ OK ]

Starting ntpd: [ OK ]

Bonding Interface was modified.

ACS is restarting and a new HTTP certificate will be generated.

Stopping ACS.

Stopping Management and View........

acs/admin(config-GigabitEthernet)# exit

acs/admin(config)# exit

acs/admin#

Example 2 (Configuring Bond 1)

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 2

acs/admin(config-GigabitEthernet)# no shutdown

acs/admin(config-GigabitEthernet)# backup interface GigabitEthernet 3

WARN: IP address of interface eth1 will be removed once NIC bonding is enabled.

Configuring backup interface may result in undesired side effects on any installed

application(s).

Are you sure you want to proceed? Y/N [N]:y

Shutting down ntpd: [ OK ]

ntpd: Synchronizing with time server: [ OK ]

Starting ntpd: [ OK ]

Bonding Interface was modified.

ACS is restarting and a new HTTP certificate will be generated.

Stopping ACS.

Stopping Management and View........

acs/admin(config-GigabitEthernet)# exit

acs/admin(config)# exit

acs/admin#

Example 4 (Removing Bond 1)

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 2

acs/admin(config-GigabitEthernet)# no backup interface GigabitEthernet 3

Removing backup interface configuration may result in undesired side effects on any

installed application(s).

Are you sure you want to proceed? Y/N [N]:y

Shutting down ntpd: [ OK ]

ntpd: Synchronizing with time server: [ OK ]

Starting ntpd: [ OK ]

Bonding Interface was modified.

ACS is restarting and a new HTTP certificate will be generated.

ACS is not running.

To start ACS type 'application start acs'.

Starting ACS ..........

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config-GigabitEthernet)# exit

acs/admin(config)# exit

acs/admin

Related Commands

Command

Description

show interface

Displays information about the system interfaces.

ip address (interface configuration mode)

Sets the IP address and netmask for the interface.

shutdown (interface configuration mode)

Shuts down the interface.

backup-staging-url

command in Configuration mode.

Syntax Description

4.

null

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

path.

You cannot back up any data when the staging server is down. When the staging server is down, you cannot perform backup and restore operations using any of the configured repositories as they use the same staging server to create the backup file. You have to bring the staging server up or delete the backup staging URL so that the repositories work properly. The backup.tar.gpg file is created under /opt during backup operation when the NFS staging URL is not configured. So, before deleting the backup staging URL, you need to make sure that you have enough space in the /opt location. The backup operation will fail if ACS does not have enough space in /opt location.

Examples

acs/admin(config)# backup-staging-url nfs://loc-filer02a:/vol/local1/private1/jdoe

acs/admin(config)#

cdp holdtime

form of this command.

Syntax Description

Specifies the hold time, in seconds. Value from 10 to 255 seconds.

Defaults

180 seconds

Command Modes

Configuration

Usage Guidelines

CDP packets transmit with a time to live, or hold time, value. The receiving device will discard the CDP information in the CDP packet after the hold time has elapsed.

command takes only one argument; otherwise, an error occurs.

Examples

acs/admin(config)# cdp holdtime 60

acs/admin(config)#

Related Commands

Command

Description

cdp timer

Specifies how often the ACS server sends CDP updates.

cdp run

Enables the CDP.

cdp run

form of this command.

Syntax Description

GigabitEthernet

Specifies the GigabitEthernet interface on which to enable CDP.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

The command has one optional argument, an interface name. Without an optional interface name, the command enables CDP on all interfaces.

The default for this command is on interfaces that are already up and running. When you are bringing up an interface, stop CDP first; then, start CDP again.

Examples

acs/admin(config)# cdp run GigabitEthernet 0

acs/admin(config)#

Related Commands

Command

Description

cdp holdtime

Specifies the length of time that the receiving device should hold a CDP packet from the ACS server before discarding it.

cdp timer

Specifies how often the ACS server sends CDP updates.

cdp timer

form of this command.

Syntax Description

Specifies how often, in seconds, the ACS server sends CDP updates. Value from 5 to 254 seconds.

Defaults

60 seconds

Command Modes

Configuration

Usage Guidelines

CDP packets transmit with a time to live, or hold time, value. The receiving device will discard the CDP information in the CDP packet after the hold time has elapsed.

command takes only one argument; otherwise, an error occurs.

Examples

acs/admin(config)# cdp timer 60

acs/admin(config)#

Related Commands

Command

Description

cdp holdtime

Specifies the amount of time that the receiving device should hold a CDP packet from the ACS server before discarding it.

cdp run

Enables CDP.

clock timezone

form of this command.

Syntax Description

Name of the time zone visible when in standard time. This can be a maximum of 64 alphanumeric characters.

Defaults

UTC

Command Modes

Configuration

Usage Guidelines

The system internally keeps time in UTC. If you do not know your specific time zone, you can enter the region, country, and city (see Tables Table 17, Table 18, and Table 19 for sample time zones to enter on your system).

Table 17 Common Time Zones

Acronym or name

Time Zone Name

Europe

GMT, GMT0, GMT-0, GMT+0, UTC, Greenwich, Universal, Zulu

Greenwich Mean Time, as UTC

GB

British

GB-Eire, Eire

Irish

WET

Western Europe Time, as UTC

CET

Central Europe Time, as UTC + 1 hour

EET

Eastern Europe Time, as UTC + 2 hours

United States and Canada

EST, EST5EDT

Eastern Standard Time, as UTC -5 hours

CST, CST6CDT

Central Standard Time, as UTC -6 hours

MST, MST7MDT

Mountain Standard Time, as UTC -7 hours

PST, PST8PDT

Pacific Standard Time, as UTC -8 hours

HST

Hawaiian Standard Time, as UTC -10 hours

Table 18 Australia Time Zones

Australia 5

ACT6

Adelaide

Brisbane

Broken_Hill

Canberra

Currie

Darwin

Hobart

Lord_Howe

Lindeman

LHI7

Melbourne

North

NSW8

Perth

Queensland

South

Sydney

Tasmania

Victoria

West

Yancowinna

nullnullnullnull

Table 19 Asia Time Zones

Asia 9

Aden10

Almaty

Amman

Anadyr

Aqtau

Aqtobe

Ashgabat

Ashkhabad

Baghdad

Bahrain

Baku

Bangkok

Beirut

Bishkek

Brunei

Calcutta

Choibalsan

Chongqing

Columbo

Damascus

Dhakar

Dili

Dubai

Dushanbe

Gaza

Harbin

Hong_Kong

Hovd

Irkutsk

Istanbul

Jakarta

Jayapura

Jerusalem

Kabul

Kamchatka

Karachi

Kashgar

Katmandu

Kuala_Lumpur

Kuching

Kuwait

Krasnoyarsk

nullnull

. A list of all the time zones available in the ACS server appears. Choose the most appropriate one for your time zone.

Examples

acs/admin(config)# clock timezone EST

Time zone was modified. You must restart ACS.

Do you want to restart ACS now? (yes/no)

Stopping ACS .................

Starting ACS ......................

acs/admin(config)# exit

acs/admin# show timezone

EST

acs/admin#

Related Commands

Command

Description

show timezones

Displays a list of available time zones on the system.

show timezone

Displays the current time zone set on the system.

conn-limit

To configure the limit of incoming TCP connections from a source IP address, use the conn-limit

command in configuration mode. To remove this function, use the no form of this command.

Syntax Description

Number of TCP connections

(Optional). Source IP address to which to apply the TCP connection limit.

(Optional). Source IP mask to which to apply the TCP connection limit.

(Optional). Destination port number to which to apply the TCP connection limit.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

Use a greater value for the number of TCP connections when you execute the conn-limit command. You might experience performance issues when you have fewer TCP connections.

If you set conn-limit for all the protocols, it affects the management to management communication. This will affect the distributed deployment connection.

Examples

acs/admin(config)# conn-limit 25000 ip 192.0.2.24 port 22

Related Commands

Command

Description

rate-limit

Configures a limit for TCP/UDP/ICMP packets from a source IP.

synflood-limit

Configures a limit to TCP SYN packets from a source IP.

do

command in any configuration mode.

Syntax Description

The EXEC command to execute (see Table 21).

Table 20 Command Options for Do Command

Command

Description

Performs a backup of an ACS configuration.

Enters the ACS Configuration mode.

Enables or disables an interface for ACS configuration web.

Installs and removes ACS patches.

Resets the ACS configuration to factory defaults.

Resets the ‘acsadmin’ administrator password to the default setting.

Performs a restoration of an ACS configuration.

Starts an ACS instance.

Stops an ACS instance.

Gathers information for ACS troubleshooting.

Installs a specific application.

Removes a specific application.

Starts or enables a specific application

Stops or disables a specific application.

Upgrades a specific application.

Performs a backup (ACS and ADE OS) and places the backup in a repository.

Performs a backup of all the logs on the ACS server to a remote location.

Sets the system clock on the ACS server.

Enters Configuration mode.

Copies any file from a source to a destination.

Displays any errors or events for various command situations; for example, backup and restore, configuration, copy, resource locking, file transfer, and user management.

Deletes a file on the ACS server.

Lists files on the ACS server.

Forces the logout of all the sessions of a specific ACS node user.

Disables or shuts down the ACS server.

Describes the help utility and how to use it on the ACS server.

Creates a new directory.

Queries the IPv4 address or hostname of a remote system.

Determines the network activity on a remote system.

Reboots the ACS server.

Performs a restore and retrieves the backup out of a repository.

Removes an existing directory.

Provides information about the ACS server.

Starts an encrypted session with a remote system.

Provides Technical Assistance Center (TAC) commands.

Telnets to a remote system.

Sets terminal line parameters.

Sets the inactivity timeout for all terminal sessions.

Sets the welcome message on the system for all terminal sessions.

Specifies the type of terminal connected to the current line of the current session.

Traces the route of a remote IP address.

Disables the output (display of errors or events) of the debug command for various command situations; for example, backup and restore, configuration, copy, resource locking, file transfer, and user management.

Copies, displays, or erases the running ACS server information.

Command Defaults

No default behavior or values.

Command Modes

Configuration or any configuration submode

Usage Guidelines

commands) while configuring your server. After the EXEC command executes, the system will return to the configuration mode you were using.

Examples

acs/admin(config)# do show run

Generating configuration...

!

hostname ems-lnx106

ip domain-name cisco.com

interface ethernet 0

ip address 209.165.200.225 255.255.255.224

interface ethernet 1

shutdown

ip name-server 209.165.201.1

ip default-gateway 209.165.202.129

clock timezone Cuba

!

!

username admin password hash $1$hB$MxIZHvecMiey/P9mM9PvN0 role admin

!

!

logging localhost

logging loglevel 6

!

acs/admin(config)#

end

command in Configuration mode.

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

This command brings you back to EXEC mode regardless of what configuration mode or submode you are in.

Use this command when you finish configuring the system and you want to return to EXEC mode to perform verification steps.

Examples

acs/admin(config)# end

acs/admin#

Related Commands

Command

Description

exit

Exits Configuration mode.

exit (EXEC)

Closes the active terminal session by logging out of the ACS server.

exit

command in Configuration mode.

Syntax Description

No arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

command is used in the ACS server to exit the current command mode to the next highest command mode in the CLI mode hierarchy.

[EXEC] command).

Examples

acs/admin(config)# exit

acs/admin#

Related Commands

Command

Description

end

Exits Configuration mode.

exit (EXEC)

Closes the active terminal session by logging out of the ACS server.

hostname

form of this command. This resets the system to localhost.

Syntax Description

Name of the host. Contains at least 2 to 19 alphanumeric characters and an underscore ( _ ). The hostname must begin with a character that is not a space.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

only occurs once in the configuration of the system. The hostname must contain one argument; otherwise, an error occurs.

Examples

acs/admin(config)# hostname myserver-1

Hostname was modified.

ACS is restarting and a new HTTP certificate will be generated.

Stopping ACS ......................

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

myserver-1/admin(config)#

icmp echo

command in Configuration mode.

Syntax Description

echo

Configures ICMP echo response.

off

Disables ICMP echo response

on

Enables ICMP echo response.

Defaults

The system will behave as if the ICMP echo response is on (enabled).

Command Modes

Configuration

Usage Guidelines

None.

Examples

acs/admin(config)# icmp echo off

Related Commands

Command

Description

show icmp_status

Display ICMP echo response configuration information.

interface

form.

Syntax Description

GigabitEthernet

Configures the GigabitEthernet interface.

Number of the GigabitEthernet port to configure. The valid options are 0, 1, 2, 3, 4, and 5.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

You can use this command to configure subinterfaces to support various requirements.

command, you enter Gigabit Ethernet configuration submode (see the following Syntax Description).

do

EXEC command. Allows you to perform any EXEC commands in this mode (see do).

end

Exits the Gigabit Ethernet configuration submode and returns you to the EXEC mode.

exit

Exits the Gigabit Ethernet configuration submode.

ip

Sets the IP address and netmask for the Ethernet interface (see ip address).

no

Negates the command in this mode. Two keywords are available:

■ip—Sets the IP address and netmask for the interface.

■shutdown—Shuts down the interface.

shutdown

Shuts down the interface (see shutdown).

Examples

Example 1

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)#

Related Commands

Command

Description

show interface

Displays information about the system interfaces.

ip address (interface configuration mode)

Sets the IP address and netmask for the interface.

shutdown (interface configuration mode)

Shuts down the interface (see shutdown).

ip address

form of this command.

You can configure the same IP address on multiple interfaces. You might want to do this to limit the configuration steps required to switch from using one interface to another.

Syntax Description

IPv4 or IPv6 version IP address.

Mask of the associated IP subnet.

Defaults

Enabled.

Command Modes

Interface configuration (config-GigabitEthernet)

Usage Guidelines

Requires exactly one address and one netmask; otherwise, an error occurs.

Examples

acs/admin(config)# interface GigabitEthernet 1

acs/admin(config-GigabitEthernet)# ip address 209.165.200.227 255.255.255.224

IP Address was modified.

ACS is restarting and a new HTTP certificate will be generated.

Stopping ACS ......................

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config-GigabitEthernet)#

Related Commands

Command

Description

(interface configuration mode)

Disables an interface.

ip default-gateway

Sets the IP address of the default gateway of an interface.

show interface

Displays information about the system IP interfaces.

interface

Configures an interface type and enters the interface mode.

ipv6 address

To set the IPv6 address and prefix length for the Ethernet interface, use the ipv6 address command in interface Configuration mode. To remove an IPv6 address or disable IPv6 processing, use the no form of this command.

You can configure the same IPv6 address on multiple interfaces. You might want to do this to limit the configuration steps required to switch from using one interface to another.

Syntax Description

IPv6 version IP address.

Prefix of ipv6 address.

Defaults

Enabled.

Command Modes

Interface configuration (config-GigabitEthernet)

Usage Guidelines

Requires exactly one address and one prefix; otherwise, an error occurs.

Examples

ACS154/admin# configure

Enter configuration commands, one per line. End with CNTL/Z.

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# ipv6 address 1901::20c:29ff:feb8:e4c/64

Changing the IPV6 address may result in undesired side effects on

any installed application(s).

Are you sure you want to proceed? Y/N [N]: Y

Shutting down ntpd: [ OK ]

ntpd: Synchronizing with time server: [ OK ]

Starting ntpd: [ OK ]

IP Address was modified.

ACS is restarting and a new HTTP certificate will be generated.

Stopping ACS.

Stopping Management and View...............................................................

Stopping Runtime.....................

Stopping Database.............

Stopping Ntpd..........................

Cleanup..

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config-GigabitEthernet)

Related Commands

Command

Description

(interface configuration mode)

Disables an interface (see shutdown).

ip default-gateway

Sets the IP address of the default gateway of an interface.

show interface

Displays information about the system IP interfaces.

interface

Configures an interface type and enters the interface mode.

ipv6 address autoconfig

To enable IPv6 stateless autoconfiguration, use the ipv6 address autoconfig command in interface configuration mode. This command does not have a no form.

No arguments or keywords.

Defaults

IPv6 address autoconfiguration is enabled by default in Linux.

Command Modes

Interface configuration (config-GigabitEthernet)

Usage Guidelines

IPv6 address autoconfiguration is enabled by default in Linux. Cisco ADE 2.0 shows the IPv6 address autoconfiguration in the running configuration for any interface that is enabled.

In a setup like full autoconfiguration IPv6, it takes time to load the static IPv6 routes to running configuration after reload. Workaround for this is to re-configure static route after the server is assigned with auto config IPv6 address.

Examples

acs/admin# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# ipv6 address autoconfig

acs/admin(config-GigabitEthernet)# end

acs/admin#

Related Commands

Command

Description

ip address (interface configuration mode)

Sets the IP address and netmask for the Ethernet interface.

ip default-gateway

form of this command.

Syntax Description

IP address of the default gateway.

Defaults

Disabled.

Command Modes

Configuration

Usage Guidelines

If you enter more than one argument or no arguments at all, an error occurs.

Examples

acs/admin(config)# ip default-gateway 209.165.202.129

acs/admin(config)#

Related Commands

Command

Description

ip address(interface configuration mode)

Sets the IP address and netmask for the Ethernet interface.

ip domain-name

form of this command.

Syntax Description

Default domain name used to complete the hostnames. Contains at least 2 to 64 alphanumeric characters.

Defaults

Enabled.

Command Modes

Configuration

Usage Guidelines

If you enter more or fewer arguments, an error occurs.

Examples

acs/admin(config)# ip domain-name cisco.com

acs/admin(config)#

Related Commands

Command

Description

ip name-server

Sets the DNS servers for use during a DNS query.

ip domain round-robin

To set RES_ROTATE in “_res.options”, which performs the round robin selection of the name servers from the available list of name servers, use the ip domain round-robin command in Configuration mode. This command distributes the incoming queries among all the available servers, rather than communicating the first available server in the list every time. To disable this function, use the no form of this command

Defaults

Disabled

Command Modes

Configuration

Usage Guidelines

The ip domain round-robin does not require any arguments.

Examples

acs/admin(config)# ip domain round-robin

Name Server Options was modified. You must restart ACS.

Do you want to restart ACS now? (yes/no)

Related Commands

Command

Description

ip domain timeout

Defines a default amount of time the resolver will wait for a response from a remote name server

ip domain timeout

To define a default amount of time the resolver will wait for a response from a remote name server before retrying the query via a different name server, use the ip domain timeout in Configuration mode. To disable this function, use the no form of this command.

Syntax Description

Specifies amount of time the resolver will wait for response before retrying the query via a different name server. The valid values are 1 to 10 seconds.

Defaults

5 seconds

Command Modes

Configuration

Usage Guidelines

The ip domain timeout command execute only one argument at a time. If you enter multiple arguments, then the command displays an error.

Examples

acs/admin(config)# ip domain timeout 1

Name Server Options was modified. You must restart ACS.

Do you want to restart ACS now? (yes/no)

Related Commands

Command

Description

ip domain-name

Defines a default domain name that an ACS server uses to complete hostnames.

ip name-server

form of this command.

form of this command removes all the name servers from the configuration. Using the no form of this command and one of the IP names removes only that IP name.

Syntax Description

Address of a name server.

(Optional) IP addresses of additional name servers.
You can configure a maximum of three name servers.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

command will occupy the first position and the system will first use that server in resolving the IP addresses.

You can add name servers to the system one at a time or all at once, until you reach the maximum (3). If you already configured the system with three name servers, you must remove at least one server to add additional name servers.

form of this command before you proceed.

Examples

acs/admin(config)# ip name-server 209.165.201.1

Name Server was modified. You must restart ACS.

Do you want to restart ACS now? (yes/no) yes

Stopping ACS ......................

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config)#

You can choose not to restart the ACS server; nevertheless, the changes will take effect.

Related Commands

Command

Description

ip route

Configures the static routes.

ip route

form of this command.

Syntax Description

IP route prefix for the destination.

Prefix mask for the destination.

IP address of the next hop that can be used to reach that network.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

Static routes are manually configured. This makes them inflexible (they cannot dynamically adapt to network topology changes) but extremely stable. Static routes optimize bandwidth utilization, because no routing updates need to be sent to maintain them. They also make it easy to enforce routing policy.

Examples

acs/admin(config)# ip route 192.168.0.0 255.255.0.0 gateway 172.23.90.2

ipv6 enable

To enable IPv6 usage in ACS, use ipv6 enable command in configuration mode. To disable ipv6 stack, use the no form of this command.

no ipv6 enable

Syntax Description

None

Defaults

The IPv6 stack is enabled for all interfaces.

Command Modes

Configuration.

Usage Guidelines

By default, ipv6 stack is enabled on all interfaces. ACS allows you to disable the IPv6 stack globally or for a specific interface using the no ipv6 enable command.

To enable the IPv6 stack globally, use the ipv6 enable command in configuration mode. If you would like to enable the IPv6 stack for a specific interface, use the ipv6 enable command in interface configuration mode.

To disable the IPv6 stack globally, use no ipv6 enable command in configuration mode. If you would like to disable the IPv6 stack for a specific interface, use the no ipv6 enable command in interface configuration mode.

When you disable IPv6 globally, you cannot enable it for a specific interface. Conversely, when you enable IPv6 globally, you can disable it for a specific interface.

When you disable IPv6, ACS allows IPv6 static address configuration and the same is displayed in the running configuration. However, it will not be used.

Examples

Example 1

acs/admin# configure terminal

acs/admin(config)# ipv6 enable

acs/admin(config)# exit

acs/admin#

Example 2

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# ipv6 enable

acs/admin(config-GigabitEthernet)# exit

acs/admin(config)# exit

acs/admin#

Example 3

acs/admin# configure terminal

acs/admin(config)# no ipv6 enable

acs/admin(config)# exit

acs/admin#

Example 4

acs/admin# configure terminal

acs/admin(config)# interface GigabitEthernet 0

acs/admin(config-GigabitEthernet)# no ipv6 enable

acs/admin(config-GigabitEthernet)# end

acs/admin#

Related Commands

Command

Description

ipv6 route

Configures static IPv6 routes.

ipv6 route

form of this command.

The ipv6 route command is meant for adding only the IPv6 default gateway. ACS acts as end host, hence, adding multiple static routes is not supported

Syntax Description

IPv6 route prefix for the destination.

Prefix mask for the destination.

IPv6 address of the next hop that can be used to reach that network.

Defaults

No default behavior or values.

Command Modes

Configuration.

Examples

acs/admin(config)# ipv6 route 2001::/64 gateway 2001::212:44ff:fe30:bc0a

acs/admin(config)#

kron occurrence

form of this command.

Syntax Description

occurrence

Schedules Command Scheduler commands.

Name of the occurrence. This can be a maximum of 80 alphanumeric characters. (See following note and Syntax Description.)

command, you enter the config-occurrence configuration submode (see the following Syntax Description).

at

].

do

EXEC command. Allows you to perform any EXEC commands in this mode (see do).

end

Exits the kron-occurrence configuration submode and returns you to the EXEC mode.

exit

Exits the kron-occurrence configuration mode.

no

Negates the command in this mode.

Three keywords available:

].

■policy-list—Specifies a policy list to be run by the occurrence. This can be a maximum of 80 alphanumeric characters.

■recurring—Execution of the policy lists should be repeated.

policy-list

Specifies a Command Scheduler policy list to be run by the occurrence.

recurring

Identifies that the occurrences run on a recurring basis.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

commands to schedule one or more policy lists to run at the same time or interval.

command to create a Command Scheduler policy containing EXEC CLI commands to be scheduled to run on the ACS server at a specified time. See kron policy-list.

Examples

command, support bundles are downloaded with a unique name (by adding a time stamp), to ensure that the files do not overwrite each other.

acs/admin(config)# kron occurrence daily_occurrence

acs/admin(config-Occurrence)# at 14:35

acs/admin(config-Occurrence)# policy-list daily_support

acs/admin(config-Occurrence)# recurring

acs/admin(config-Occurrence)# exit

acs/admin(config)#

Related Commands

Command

Description

kron policy-list

Specifies a name for a Command Scheduler policy.

acs backup

Backs up an ACS configuration.

kron policy-list

form of this command.

Syntax Description

policy-list

Specifies a name for Command Scheduler policies.

list-name

Name of the policy list. This can be a maximum of 80 alphanumeric characters.

in the kron policy-list command, you enter the config-Policy List configuration submode (see the following Syntax Description).

cli

Command to be executed by the scheduler. This can be a maximum of 80 alphanumeric characters.

do

EXEC command. Allows you to perform any EXEC commands in this mode (see do).

end

Exits from the config-Policy List configuration submode and returns you to the EXEC mode.

exit

Exits this submode.

no

Negates the command in this mode. One keyword available:

■cli–Command to be executed by the scheduler.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

command to create a Command Scheduler policy containing EXEC CLI commands to be scheduled to run on the ACS server at a specified time. Use the kron occurrence and policy list commands to schedule one or more policy lists to run at the same time or interval. See kron occurrence.

ACS backup is now encrypted using a dynamic encryption password. Therefore in ACS 5.8.1, you cannot schedule backup using the kron policy-list command in ACS CLI.

Examples

acs/admin(config)# kron policy-list daily_support

acs/admin(config-Policy List)# cli acs support acssupport repository local encryption-passphrase null

acs/admin(config-Policy List)# exit

acs/admin(config)#

Related Commands

Command

Description

kron occurrence

Specifies schedule parameters for a Command Scheduler occurrence and enters the config-Occurrence configuration mode.

logging

form of this command.

Syntax Description

IP address of remote system to which you forward logs. This can be a maximum of 42 alphanumeric characters.

Hostname of remote system to which you forward logs. This can be a maximum of 42 alphanumeric characters.

loglevel

Configures the log level for the logging command.

Number of the desired priority level at which you set the log messages. Priority levels are (enter the number for the keyword):

■0-emerg—Emergencies: System unusable.

■1-alert—Alerts: Immediate action needed.

■2-crit—Critical: Critical conditions.

■3-err—Error: Error conditions.

■4-warn—Warning: Warning conditions.

■5-notif—Notifications: Normal but significant conditions.

■6-inform—Informational messages. Default.

■7-debug—Debugging messages.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

keyword; an error occurs if you enter two or more of these arguments.

Examples

Example 1

acs/admin(config)# logging 209.165.200.225

acs/admin(config)#

Example 2

acs/admin(config)# logging loglevel 0

acs/admin(config)#

Related Commands

Command

Description

show logging

Displays list of logs for the system.

max-ssh

command in configuration mode.

Syntax Description

Number of concurrent SSH sessions. The range is 1 to 10.

Defaults

None

Command Modes

Configuration

Usage Guidelines

The max-ssh-sessions command allows you to configure the maximum number of concurrent ssh sessions you can open with a remote system.

Examples

acs/admin(config)# max-ssh-sessions 3

Related Commands

Command

Description

show logging

Displays list of logs for the system.

ssh

Starts an encrypted session with a remote system.

ntp

To specify an NTP configuration, use the ntp command in configuration mode with the authenticate, authentication-key, server, and trusted-key commands. To terminate NTP service on a device, use the no ntp command with the authenticate, authentication-key, server, and trusted-key keywords or arguments.

Syntax Description

Enables authentication of all time sources.

Specifies authentication keys for trusted time sources.

Specifies the NTP server to use.

Specifies key numbers for trusted time sources.

Defaults

None

Command Modes

Configuration

Usage Guidelines

Use the ntp command to specify an NTP configuration.

To terminate NTP service on a device, you must enter the no ntp command with keywords or arguments such as authenticate, authentication-key, server, and trusted-key. For example, if you previously issued the ntp server command, use the no ntp command with server. For more information on how to configure an NTP server, see ntp server.

Examples

acs/admin(config)# ntp ?

authenticate Authenticate time sources

authentication-key Authentication key for trusted time sources

server Specify NTP server to use

trusted-key Key numbers for trusted time sources

acs/admin(config)#

acs/admin(config)# no ntp server

The NTP server was modified.

If this action resulted in a clock modification, you must restart ACS.

acs/admin(config)# do show ntp

% no NTP servers configured

Related Commands

Command

Description

ntp authenticate

Enables authentication of all time sources.

ntp authentication-key

Configures authentication keys for trusted time sources.

ntp server

Allows synchronization of the software clock by the NTP server for the system.

ntp trusted-key

Specifies key numbers for trusted time sources that needs to be defined as NTP authentication keys.

show ntp

Displays the status information about the NTP associations.

ntp authenticate

To enable authentication of all time sources, use the ntp authenticate command in configuration mode. Time sources without NTP authentication keys will not be synchronized. To disable this capability, use the no form of this command.

Syntax Description

No arguments or keywords

Defaults

None

Command Modes

Configuration

Usage Guidelines

Use the ntp authenticate command to enable authentication of all time sources. This command is optional, and authentication will work even without this command.

If you want to authenticate in a mixed mode where only some servers require authentication, that is, only some servers need to have keys configured for authentication, then this command should not be executed.

Examples

acs/admin(config)# ntp authenticate

Related Commands

Command

Description

ntp

Synchronizes the software clock through the NTP server for the system.

ntp authentication-key

Configures authentication keys for trusted time sources.

ntp server

Allows synchronization of the software clock by the NTP server for the system.

ntp trusted-key

Specifies key numbers for trusted time sources that need to be defined as NTP authentication keys.

show ntp

Displays the status information about the NTP associations.

ntp authentication-key

Syntax Description

key-id

The identifier that you want to assign to the key. Range is from 1-65535.

md5

Message Digest 5 algorithm encryption type for the authentication key.

hash

Hashed key for authentication. Specifies an encrypted (hashed) key that follows the encryption type. Supports up to 40 characters.

plain

Plain text key for authentication. Specifies an unencrypted plain text key that follows the encryption type. Supports up to 15 characters.

key-value

The key value in the format matching either md5 plain or md5 hash, above.

Defaults

None

Command Modes

Configuration

Usage Guidelines

Use the ntp authentication-key command to set up a time source with an authentication key for NTP authentication and to specify its pertinent key identifier, key encryption type, and key value settings. Add this key to the trusted list before you add this key to the ntp server command.

Time sources without the NTP authentication keys that are added to the trusted list will not be synchronized.

Examples

acs/admin(config)# ntp authentication-key 1 md5 plain SharedWithServe

acs/admin(config)# ntp authentication-key 2 md5 plain SharedWithServ

acs/admin(config)# ntp authentication-key 3 md5 plain SharedWithSer

acs/admin(config)#

(Removes authentication key 3)

acs/admin(config)# no ntp authentication-key 3

acs/admin(config)#

(Removes all authentication keys)

acs/admin(config)no ntp authentication-key

acs/admin(config)#

The show running-config command will always show keys that are entered in MD5 plain format converted into hash format for security. For example, ntp authentication-key 1 md5 hash ee18afc7608ac7ecdbeefc5351ad118bc9ce1ef3.

Related Commands

Command

Description

ntp

Synchronizes the software clock through the NTP server for the system.

ntp authenticate

Enables authentication of all time sources.

ntp server

Allows synchronization of the software clock by the NTP server for the system.

ntp trusted-key

Specifies key numbers for trusted time sources that needs to be defined as NTP authentication keys.

show ntp

Displays the status information about the NTP associations.

ntp server

To allow for software clock synchronization by the NTP server for the system, use the ntp server command in configuration mode. Allows up to three servers each with a key in a separate line. The key is an optional parameter but the key is required for NTP authentication. The Cisco Secure ACS always requires a valid and reachable NTP server. Although key is an optional parameter, it must be configured if you need to authenticate an NTP server. To disable this capability, use the no form of this command only when you want to remove an NTP server and add another one.

no ntp server

Syntax Description

IP address or hostname of the server that provides the clock synchronization. Arguments are limited to 255 alphanumeric characters.

(Optional) Peer key number. Supports up to 65535 numeric characters.

This key needs to be defined with a key value, by using the ntp authentication-key command, and also needs to be added as a trusted key by using the ntp trusted-key command. For authentication to work, the key and the key value should be the same as that is defined on the actual NTP server.

Defaults

None

Command Modes

Configuration

Usage Guidelines

This command allows up to two servers each with a key in a separate line. Use this ntp server command with a trusted key if you want to allow the system to synchronize with a specified server.

The key is optional, but it is required for NTP authentication. ACS always requires a valid and reachable NTP server. Although key is an optional parameter, it must be configured if you need to authenticate an NTP server. Define this key in the ntp authentication-key command first and add this key to the ntp trusted-key command before you add it to the ntp server command.

The show ntp command displays the status of synchronization. If none of the configured NTP servers are reachable or not authenticated (if NTP authentication is configured), then this command displays synchronization to local system timezone with the least stratum. If an NTP server is not reachable or is not properly authenticated, its reach as per this command statistics will be 0.

The ntp server command will give conflicting information during the sync process. The sync process can take up to 20 minutes to complete.

Examples

Example 1

acs/admin(config)# ntp server ntp.esl.cisco.com key 1

% WARNING: Key 1 needs to be defined as a ntp trusted-key.

acs/admin(config)#

acs/admin(config)# ntp trusted-key 1

% WARNING: Key 1 needs to be defined as a ntp authentication-key.

acs/admin(config)#

acs/admin(config)# ntp authentication-key 1 md5 plain SharedWithServe

acs/admin(config)#

acs/admin(config)# ntp server ntp.esl.cisco.com 1

acs/admin(config)# ntp server 192.2.0.80 key 2

acs/admin(config)# ntp server 192.2.0.150 key 3

acs/admin(config)#

acs/admin(config)# do show running-config

Generating configuration...

!

hostname acs

!

ip domain-name cisco.com

!

interface GigabitEthernet 0

ip address 192.21.79.246 255.255.255.0

ipv6 address autoconfig

!

ip name-server 192.70.168.183

!

ip default-gateway 192.21.79.1

!

clock timezone UTC

!

ntp authentication-key 1 md5 hash ee18afc7608ac7ecdbeefc5351ad118bc9ce1ef3

ntp authentication-key 2 md5 hash f1ef7b05c0d1cd4c18c8b70e8c76f37f33c33b59

ntp authentication-key 3 md5 hash ee18afc7608ac7ec2d7ac6d09226111dce07da37

ntp trusted-key 1

ntp trusted-key 2

ntp trusted-key 3

ntp authenticate

ntp server ntp.esl.cisco.com key 1

ntp server 192.68.10.80 key 2

ntp server 192.68.10.150 key 3

!

--More--

acs/admin# show ntp

Primary NTP : ntp.esl.cisco.com

Secondary NTP : 192.68.10.80

Tertiary NTP : 192.68.10.150

synchronised to local net at stratum 11

time correct to within 1024 ms

polling server every 64 s

remote refid st t when poll reach delay offset jitter

==============================================================================

*192.127.1.0 .LOCL. 10 l 46 64 37 0.000 0.000 0.001

192.68.10.80 .RMOT. 16 u 46 64 0 0.000 0.000 0.000

192.68.10.150 .INIT. 16 u 47 64 0 0.000 0.000 0.000

Warning: Output results may conflict during periods of changing synchronization.

acs/admin#

Example 2

acs/admin# show ntp

Primary NTP : ntp.esl.cisco.com

Secondary NTP : 192.68.10.150

Tertiary NTP : 192.68.10.80

synchronised to NTP server (192.68.10.150) at stratum 3

time correct to within 16 ms

polling server every 64 s

remote refid st t when poll reach delay offset jitter

==============================================================================

192.127.1.0 .LOCL. 10 l 35 64 377 0.000 0.000 0.001

+192.68.10.80 144.254.15.122 2 u 36 64 377 1.474 7.381 2.095

*192.68.10.150 144.254.15.122 2 u 33 64 377 0.922 10.485 2.198

Warning: Output results may conflict during periods of changing synchronization.

acs/admin#

Related Commands

Command

Description

ntp

Synchronizes the software clock through the NTP server for the system.

ntp authenticate

Enables authentication of all time sources.

ntp authentication-key

Configures authentication keys for trusted time sources.

ntp trusted-key

Specifies key numbers for trusted time sources that need to be defined as NTP authentication keys.

show ntp

Displays the status information about the NTP associations.

ntp trusted-key

Syntax Description

key

Specifies key number for trusted time sources that needs to be defined as NTP authentication keys. Supports up to 65535 numeric characters.

Defaults

None

Command Modes

Configuration

Usage Guidelines

Define a key as an NTP authentication key, and then add this key to the trusted list before you add this key to an NTP server. ACS allows only the keys that are added to the trusted list for synchronization by the NTP server with the system.

Examples

acs/admin(config)# ntp trusted-key 1

acs/admin(config)# ntp trusted-key 2

acs/admin(config)# ntp trusted-key 3

acs/admin(config)#

(Removes key 2 from the trusted list)

acs/admin(config)# no ntp trusted-key 2

acs/admin(config)#

(Removes all keys from the trusted keys)

acs/admin(config)# no ntp trusted-key

acs/admin(config)#

Related Commands

Command

Description

ntp

The command to specify NTP configuration.

ntp authenticate

Enables authentication of all time sources.

ntp authentication-key

Configures authentication keys for trusted time sources.

ntp server

Allows synchronization of the software clock by the NTP server for the system.

show ntp

Displays the status information about the NTP associations.

password-policy

form of this command.

command before the other password-expiration commands.

Syntax Description

command, you enter the config-password-policy configuration submode.

digit-required

Requires a digit in the password.

disable-repeat-characters

Disables the password’s ability to contain more than four identical characters.

disable-cisco-password

Disables the ability to use the word Cisco or any combination as the password.

lower-case-required

Requires a lowercase letter in the password.

min-password-length

Specifies a minimum number of characters for a valid password. Integer length from 1 to 40.

no-previous-password

Prevents users from reusing a part of their previous password.

no-username

Prohibits users from reusing their username as a part of a password.

password-expiration-days

Number of days until a password expires. Integer length from 1to 3650.

password-expiration-enabled

Enables password expiration.
command before the other password-expiration commands.

password-expiration-warning

Number of days before expiration that warnings of impending expiration begin. Integer length from 0 to 3650.

password-lock-enabled

Locks a password after several failures.

password-lock-retry-count

Number of failed attempts before password locks. Integer length from 1 to 20.

upper-case-required

Requires an uppercase letter in the password.

special-required

Requires a special character in the password.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

None.

Examples

acs/admin(config)# password-policy

acs/admin(config-password-policy)# password-expiration-days 30

acs/admin(config-password-policy)# exit

acs/admin(config)#

rate-limit

To configure the limit of TCP, UDP, or ICMP packets from a source IP address, use the rate-limit command in configuration mode. To remove this limit, use the no form of this command.

If you set a low rate-limit value for all the protocols, it affects the management to management communication. This will affect the distributed deployment connection.

Syntax Description

Number of TCP connections.

ip

IP address keyword.

Source IP address to which to apply the packet connection limit.

mask

The mask keyword.

Source IP mask to which to apply the packet connection limit.

port

The port keyword.

Destination port number to which to apply the packet connection limit.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

None.

Examples

acs/admin(config)# rate-limit 25000 ip 192.10.122.133 port 22

acs/admin(config)# end

acs/admin#

Related Commands

Command

Description

conn-limit

Configures a limit to TCP packet connections from a source IP.

synflood-limit

Configures a limit to TCP SYN packets from a source IP.

repository

command in Configuration mode.

Syntax Description

Name of repository. This can be a maximum of 80 alphanumeric characters.

After you enter the name of the repository in the repository command, you enter the config-Repository configuration submode (see the Syntax Description).

do

EXEC command. Allows you to perform any of the EXEC commands in this mode (see do).

end

Exits the config-Repository mode and returns you to the EXEC mode.

exit

Exits this mode.

no

Negates the command in this mode.

Two keywords available:

■url—Repository URL.

■user—Repository username and password for access.

url

URL of the repository. This can be a maximum of 300 alphanumeric characters (see Table 21).

user

Configure username and password for access. This can be a maximum of 30 alphanumeric characters.

Table 21 URL Keywords

Keyword

Source of Destination

Enter repository URL, including server and path info. This can be a maximum of 80 alphanumeric characters.

Local CD-ROM drive (read only).

Local storage.

All local repositories are created on the /localdisk partition. When you specify disk:// in the repository URL, the system creates directories in a path that is relative to /localdisk.

the directory is created at /localdisk/backup.

to view all the files in the local repository.

11.

1.

1.

1.
You cannot use a TFTP repository for performing ACS upgrade.

1.

https:

1.

null

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

directory of this repository.

directory. You should have permission to access this directory.

If you restore an ACS 5.5 ADE OS backup on ACS 5.8.1, the SFTP repositories that are created in ACS 5.5 do not work in ACS 5.8.1 because of this change in behavior.

You must use the absolute path to fetch the backup file. For windows SFTP server, the virtual path "/" should be mapped to any of the folders in the windows drive.

ACS 5.8.1 does not support HTTPS repository.

Examples

acs/admin# configure terminal

acs/admin(config)# repository sftp

% Warning: Host key of the server must be added using 'crypto host_key add' exec command before sftp repository can be used.

acs/admin(config-Repository)# url sftp://starwars.test.com/repository/system1

acs/admin(config-Repository)# user luke password plain skywalker

acs/admin(config-Repository)# end

% Warning: Host key of the server must be added using 'crypto host_key add' exec command before sftp repository can be used.

acs/admin# crypto host_key add host starwars.test.com

host key fingerprint added

# Host 10.77.241.75 found: line 1 type RSA

2048 dd:df:e9:2f:4b:6f:cb:95:4e:47:0f:3a:a4:36:43:98 10.77.241.75 (RSA)

acs/admin # write memory

Generating Configuration...

acs/admin #

Related Commands

Command

Description

backup

Performs a backup (ACS and ADE OS) and places the backup in a repository.

restore

Performs a restore and takes the backup out of a repository.

show backup history

Displays the backup history of the system.

show repository

Displays the available backup files located on a specific repository.

service

form of this command.

service sshd

Syntax Description

sshd

Secure Shell Daemon. The daemon program for SSH.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

None.

Examples

acs/admin(config)# service sshd

acs/admin(config)#

snmp-server community

form of this command.

ro

Syntax Description

Accessing string that functions much like a password, allowing access to SNMP. No blank spaces allowed. This can be a maximum of 255 alphanumeric characters.

ro

Specifies read-only access.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

argument; otherwise, an error occurs.

Examples

acs/admin(config)# snmp-server community new ro

acs/admin(config)#

Related Commands

Command

Description

snmp-server host

Sends traps to a remote system.

snmp-server location

Configures the SNMP location MIB value on the system.

snmp-server contact

Configures the SNMP contact MIB value on the system.

snmp-server contact

form of this command.

Syntax Description

String that describes the system contact information of the node. This can be a maximum of 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

None.

Examples

acs/admin(config)# snmp-server contact Luke

acs/admin(config)#

Related Commands

Command

Description

snmp-server host

Sends traps to a remote system.

snmp-server community

Sets up the community access string to permit access to the SNMP.

snmp-server location

Configures the SNMP location MIB value on the system.

snmp-server host

form of this command. This command does not display any output on the CLI.

Syntax Description

IP address of the SNMP notification host. This can be a maximum of 64alphanumeric characters.

Name of the SNMP notification host. This can be a maximum of 64 alphanumeric characters.

version {1 | 2c}

(Optional) Version of the SNMP used to send the traps. Default = 1.

If you use the version keyword, specify one of the following keywords:

■1—SNMPv1.

■2c—SNMPv2C.

Password-like community string that is sent with the notification operation.

Defaults

Disabled.

Command Modes

Configuration

Usage Guidelines

The command takes arguments as listed; otherwise, an error occurs.

Examples

acs/admin(config)# snmp-server community new ro 10

acs/admin(config)# snmp-server host 209.165.202.129 version 1 password

acs/admin(config)#

Related Commands

Command

Description

snmp-server community

Sets up the community access string to permit access to SNMP.

snmp-server location

Configures the SNMP location MIB value on the system.

snmp-server contact

Configures the SNMP contact MIB value on the system.

snmp-server location

form of this command.

Syntax Description

String that describes the system’s physical location information. This can be a maximum of 255 alphanumeric characters.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

string, you must enclose the string in quotation marks (“).

Examples

Example 1

acs/admin(config)# snmp-server location Building_3/Room_214

acs/admin(config)#

Example 2

acs/admin(config)# snmp-server location “Building 3/Room 214”

acs/admin(config)#

Related Commands

Command

Description

snmp-server host

Sends traps to a remote system.

snmp-server community

Sets up the community access string to permit access to SNMP.

snmp-server contact

Configures the SNMP location MIB value on the system.

snmp-server trap dskThresholdLimit

form of this command.

Syntax Description

Number that represents the percentage of available disk space. The value ranges from 1 to 100.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

This configuration is common for all the partitions in ACS. If you configure the threshold limit as 40, then you will receive a trap as soon as a partition utilizes 60% of its disk space and only 40% of the disk space is available. That is, a trap is sent when the configured amount of free space is reached.

After you configure this command from ACS CLI, a kron job starts running every minute and monitors the ACS partitions one by one. If any one of the partitions reaches its threshold limit, then ACS sends a trap to the configured SNMP server with the disk path and the threshold limit value. Multiple traps are sent if multiple partitions are reached its threshold limit. You can view the SNMP traps using the traps receiver in a MIB browser.

Examples

Example 1

acs/admin(config)# snmp-server trap dskThresholdLimit 40

acs/admin(config)#

Related Commands

Command

Description

snmp-server host

Sends traps to a remote system.

snmp-server community

Sets up the community access string to permit access to SNMP.

snmp-server contact

Configures the SNMP location MIB value on the system.

synflood-limit

To configure the limit of TCP SYN packets from any source IP address, use the synflood-limit command in configuration mode. To remove this limit, use the no form of this command.

Syntax Description

Number of TCP SYN packets.

Defaults

No default behavior or values.

Command Modes

Configuration

Usage Guidelines

None.

Examples

acs/admin(config)# synflood-limit 12

acs/admin(config)# end

acs/admin#

Related Commands

Command

Description

conn-limit

Configures a limit to TCP connection from a source IP.

rate-limit

Configures a limit for TCP, UDP, or ICMP packets from a source IP.

tcp

form of this command.

enable

form of this command.

enable

form of this command.

Syntax Description

timeout

The TCP final packet timeout value in seconds. The valid range is 0 to 180 seconds. The default value is 60 seconds. The

Defaults

Disabled.

Command Modes

Configuration

Usage Guidelines

All three commands are disabled by default.

It is not recommended to use this command if you use Network Address Translation. Contact your network administrator before implementing this recycle operation.

If you try to reopen the connection during the TIME_WAIT state, it is equal to establishing a new connection. You can reduce the timeout value so that TCP/IP can release the closed connections faster and make the resources available for new connections.

Examples

Example 1

acs/admin(config)# tcp recycle enable

TCP recycle parameter will be enabled which requires ACS restart.

ACS228/admin(config)# to proceed? Y/N [N]: Y

Stopping ACS.

Stopping Management and View...............................................................

Stopping Runtime......

Stopping Database.......

Stopping Ntpd...

Cleanup...

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config)#

Example 2

acs/admin(config)# tcp reuse enable

TCP reuse parameter will be enabled which requires ACS restart.

Are you sure you want to proceed? Y/N [N]: Y

Stopping ACS.

Stopping Management and View...............................................................

Stopping Runtime......

Stopping Database.......

Stopping Ntpd...

Cleanup...

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config)#

Example 3

acs/admin(config)# tcp timeout 30

TCP fin_timeout parameter will be changed which requires ACS restart.

Are you sure you want to proceed? Y/N [N]: Y

Stopping ACS.

Stopping Management and View...............................................................

Stopping Runtime......

Stopping Database.......

Stopping Ntpd...

Cleanup...

Starting ACS ....

To verify that ACS processes are running, use the

'show application status acs' command.

acs/admin(config)#

username

form of this command.

For an existing user, use the following syntax:

Syntax Description

username

Only one word for the username argument. Blank spaces and quotation marks (“) are not allowed. The username can be a maximum of 31 alphanumeric characters.

Password character length. This can be a maximum of 127 alphanumeric characters. You must specify a password for all new users.

hash | plain

Type of password. This can be a maximum of 34 alphanumeric characters.

role admin | user

Sets the privilege level for the user.

disabled

(Optional) Disables the user according to the user’s email address.

(Optional) The user’s email address. For example, user1@mydomain.com.

Defaults

The initial user during setup.

Command Modes

Configuration

Usage Guidelines

user options.

error message when you use the characters |, \, “, <, >, or / in username.

Examples

Example 1

acs/admin(config)# username admin password hash ###### role admin

acs/admin(config)#

Example 2

acs/admin(config)# username admin password plain Secr3tp@swd role admin

acs/admin(config)#

Example 3

acs/admin(config)# username admin password plain Secr3tp@swd role admin email admin123@mydomain.com

acs/admin(config)#

Related Commands

Command

Description

password-policy

Enables and configures the password policy.

show users

Displays a list of users and their privilege level. It also displays a list of logged-in users.

1. The commands in this table require that the show command precedes a keyword; for example, show application.

2. Some show commands require an argument or variable after the keyword to function; for example, show application version. This show command displays the version of the application that is installed on the system (see show application).

3. The show application status acs and show application version acs commands are specific to ACS.

4. Server is the server name and path refers to /subdir/subsubdir. Remember that a colon (:) is required after the server.

5. Enter the country and city together with a forward slash (/) between them; for example, Australia/Currie.

6. ACT = Australian Capital Territory.

7. LHI = Lord Howe Island

8. NSW = New South Wales

9. The Asia time zone includes cities from East Asia, Southern Southeast Asia, West Asia, and Central Asia.

10. Enter the region and city or country together separated by a forward slash (/); for example, Asia/Aden.

11. Server is the server name and path refers to /subdir/subsubdir. Remember that a colon (:) is required after the server for an NFS network server.

CLI Reference Guide for Cisco Secure Access Control System 5.8.1

March 2016

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

Copyright © 2016 Cisco Systems, Inc. All rights reserved.