Usage Guidelines

When you enable multicast routing, MFIB forwarding is enabled on all interfaces by default. Use the no form of the command to disable MFIB forwarding on a specific interface. Only the no form of the command appears in the running configuration.

When MFIB forwarding is disabled on an interface, the interface does not accept any multicast packets unless specifically configured through other methods. IGMP packets are also prevented when MFIB forwarding is disabled.

Usage Guidelines

The migrate l2l command migrates all LAN-to-LAN IKEv1 configuration to IKEv2.

If you use the overwrite keyword, the ASA overwrites any existing IKEv2 configuration with migrated commands instead of merging them.

The migrate remote-access command migrates the IKEv1 or SSL settings to IKEv2, but you must still perform these configuration tasks:

• Load the Secure Client package file(s) in webvpn configuration mode.

• Configure the Secure Client profiles and specify them for group policies.

• Associate any customization objects you used for IKEv1 connections with the tunnel group(s) used for IKEv2 connections.

• Specify server authentication identity certificates (trustpoints) using the crypto ikev2 remote-access trust-point command. The ASA uses the trustpoint to authenticate itself to remote Secure Clients connecting with IKEv2.

• Specify IKEv2 and/or SSL for any tunnel groups or group policies you may have configured in addition to the default ones (the DefaultWEBVPNGroup tunnel-group and default group-policy are configured to allow IKEv2 or SSL).

• Configure group aliases or group URLs in the tunnel-groups to enable the clients to connect to groups other than the default group.

• Update any external group policies and/or user records.

• Any other global, tunnel group, group policy settings to change client behavior.

• Configure the port to be used by the client to download files and/or perform software upgrades for IKEv2 using the crypto ikev2 enable <interface> [client-services [port]] command.

Usage Guidelines

The minimum object size must be smaller than the maximum object size. The ASA calculates the size after compressing the object, if cache compression is enabled.

Usage Guidelines

If a directory with the same name already exists, then the new directory is not created.

Usage Guidelines

Use this command only if you are recommended to do so by Cisco Technical Assistance Center (TAC).

Usage Guidelines

In multiple context mode, the ASA includes a configuration for each context that identifies the security policy, interfaces, and almost all the options you can configure on a stand-alone device (see the config-url command to identify the context configuration location). The system administrator adds and manages contexts by configuring them in the system configuration, which, like a single mode configuration, is the startup configuration. The system configuration identifies basic settings for the ASA. The system configuration does not include any network interfaces or network settings for itself; rather, when the system needs to access network resources (such as downloading the contexts from the server), it uses one of the contexts that is designated as the admin context.

When you change the context mode using the mode command, you are prompted to reboot.

The context mode (single or multiple) is not stored in the configuration file, even though it does endure reboots. If you need to copy your configuration to another device, set the mode on the new device to match using the mode command.

When you convert from single mode to multiple mode, the ASA converts the running configuration into two files: a new startup configuration that comprises the system configuration, and admin.cfg that comprises the admin context (in the root directory of the internal Flash memory). The original running configuration is saved as old_running.cfg (in the root directory of the internal Flash memory). The original startup configuration is not saved. The ASA automatically adds an entry for the admin context to the system configuration with the name “admin.”

If you convert from multiple mode to single mode, you might want to first copy a full startup configuration (if available) to the ASA; the system configuration inherited from multiple mode is not a complete functioning configuration for a single mode device.

Not all features are supported in multiple context mode. See the CLI configuration guide for more information.

Usage Guidelines

The number of interfaces that can be monitored for the ASA is platform dependent and can be determined by viewing the show failover command output.

Hello messages are exchanged during every interface poll frequency time period between the ASA failover pair. The failover interface poll time is 3 to 15 seconds. For example, if the poll time is set to 5 seconds, testing begins on an interface if 5 consecutive hellos are not heard on that interface (25 seconds).

Monitored failover interfaces can have the following status:

• Unknown—Initial status. This status can also mean the status cannot be determined.

• Normal—The interface is receiving traffic.

• Testing—Hello messages are not heard on the interface for five poll times.

• Link Down—The interface or VLAN is administratively down.

• No Link—The physical link for the interface is down.

• Failed—No traffic is received on the interface, yet traffic is heard on the peer interface.

In Active/Active failover, this command is only valid within a context.

Usage Guidelines

The more filesystem: command prompts you to enter the alias of the local directory or file systems.

Note	When you view a configuration file that you have saved using the more command, tunnel-group passwords in the configuration file appear in clear text.

Usage Guidelines

The mount command uses the Installable File System (IFS) to mount the CIFS file system. IFS, a filesystem API, enables the security appliance to recognize and load drivers for file systems.

The mount command attaches the CIFS file system on the security appliance to the UNIX file tree. Conversely, the no mount command detaches it.

The mount-name specified in the mount command is used by other CLI commands to refer to the filesystem already mounted on the security appliance. For example, the database command, which sets up file storage for the Local Certificate Authority, needs the mount name of an existing mounted file system to save database files to non-flash storage.

The CIFS remote file-access protocol is compatible with the way applications share data on local disks and network file servers. Running over TCP/IP and using the Internet's global DNS, CIFS is an enhanced version of Microsoft's open, cross-platform Server Message Block (SMB) protocol, the native file-sharing protocol in the Windows operating systems.

Always exit from the root shell after using the mount command. The exit keyword in mount-cifs-config mode returns the user to global configuration mode.

In order to reconnect, remap your connections to storage.

Note	Mounting of CIFS and FTP file systems are supported. (See the mount name type ftp command.) Mounting Network File System (NFS) volumes is not supported for this release.

Usage Guidelines

The mount name type ftp command uses the Installable File System (IFS) to mount the specified network file system. IFS, a filesystem API, enables the security appliance to recognize and load drivers for file systems.

To confirm that the FTP file system actually is mounted, use the dir all-filesystems instruction

The mount-name specified in the mount command is used when other CLI commands refer to the filesystem already mounted on the security appliance. For example, the database command, which sets up file storage for the local certificate authority, needs the mount name of a mounted file system to save database files to non-flash storage.

Note	Using the mount command when you create an FTP-type mount requires that the FTP server must have a UNIX directory listing style. Microsoft FTP servers have the MS-DOS directory listing style as their default.

Note	Mounting of CIFS and FTP file systems are supported. (See the mount name type ftp command.) Mounting Network File System (NFS) volumes is not supported for this release.

Usage Guidelines

This command lets you statically configure where multicast sources are located. The ASA expects to receive multicast packets on the same interface as it would use to send unicast packets to a specific source. In some cases, such as bypassing a route that does not support multicast routing, multicast packets may take a different path than the unicast packets.

Static multicast routes are not advertised or redistributed.

Use the show mroute command displays the contents of the multicast route table. Use the show running-config mroute command to display the mroute commands in the running configuration.

Usage Guidelines

To enable MS-CHAPv2 as the protocol used between the ASA and the RADIUS server for a VPN connection, password management must be enabled in the tunnel-group general-attributes. Enabling password management generates an MS-CHAPv2 authentication request from the ASA to the RADIUS server. See the description of the password-management command for details.

If you use double authentication and enable password management in the tunnel group, then the primary and secondary authentication requests include MS-CHAPv2 request attributes. If a RADIUS server does not support MS-CHAPv2, then you can configure that server to send a non-MS-CHAPv2 authentication request by using the no mschapv2-capable command.

Usage Guidelines

The line containing the proxy server IP address or hostname and the port number must be less than 100 characters long.

Refer to the Cisco Secure Client Administrator Guide , Release 3.1 or the release notes for your mobile device for further information about proxy settings.

Usage Guidelines

Refer to the Cisco Secure Client Administrator Guide , Release 3.1 or the release notes for your mobile device for further information about proxy settings.

Usage Guidelines

Enabling this feature hides the Connections tab in Microsoft Internet Explorer for the duration of an AnyConnect VPN session. In addition, from Windows 10 version 1703 (or later), enabling this feature also hides the system proxy tab in the Settings app for the duration of an AnyConnect VPN session. Disabling the feature leaves the display of the Connections tab in Microsoft Internet Explorer and system proxy tab in the Settings app unchanged.

To use this feature, you must also specify a private-side proxy.

Note	Hiding the system proxy tab in the Settings app for the duration of an AnyConnect VPN session needs AnyConnect version 4.7.03052 or later.

This command makes a temporary change to the user registry for the duration of the AnyConnect VPN session. When AnyConnect closes the VPN session, it returns the registry to the state it was in before the session.

You might enable this feature to prevent users from specifying a proxy service and changing LAN settings. Preventing user access to these settings enhances endpoint security during the AnyConnect session.

Refer to the Cisco Secure Client Administrator Guide , or the release notes for your mobile device for further information about proxy settings.

Usage Guidelines

The line containing the proxy server IP address or hostname and the port number can contain up to 100 characters.

This command supports the following combinations of options:

• [no] msie-proxy method no-proxy

• [no] msie-proxy method no-modify

• [no] msie-proxy method [auto-detect] [use-server] [use-pac-url]

You can use a text editor to create a proxy auto-configuration (.pac) file for your browser. A .pac file is a JavaScript file that contains logic that specifies one or more proxy servers to be used, depending on the contents of the URL. The .pac file resides on a web server. When you specify use-pac-url , the browser uses the .pac file to determine the proxy settings. Use the msie-proxy pac-url command to specify the URL from which to retrieve the .pac file.

Refer to the Cisco Secure Client Administrator Guide , Release 3.1 or the release notes for your mobile device for further information about proxy settings.

Usage Guidelines

Requirements

To use the proxy auto-configuration feature, the remote user must use the Cisco AnyConnect VPN Client. To enable the use of the proxy auto-configuration URL, you must also configure the msie-proxy method command with the use-pac-url option.

Why Use This Command

Many network environments define HTTP proxies that connect a web browser to a particular network resource. The HTTP traffic can reach the network resource only if the proxy is specified in the browser and the client routes the HTTP traffic to the proxy. SSLVPN tunnels complicate the definition of HTTP proxies because the proxy required when tunneled to an enterprise network can differ from that required when connected to the Internet via a broadband connection or when on a third-party network.

In addition, companies with large networks might need to configure more than one proxy server and let users choose between them, based on transient conditions. By using .pac files, an administrator can author a single script file that determines which of numerous proxies to use for all client computers throughout the enterprise.

The following are some examples of how you might use a PAC file:

• Choosing a proxy at random from a list for load balancing.

• Rotating proxies by time of day or day of the week to accommodate a server maintenance schedule.

• Specifying a backup proxy server to use in case the primary proxy fails.

• Specifying the nearest proxy for roaming users, based on the local subnet.

How to Use the Proxy Auto-Configuration Feature

You can use a text editor to create a proxy auto-configuration (.pac) file for your browser. A .pac file is a JavaScript file that contains logic that specifies one or more proxy servers to be used, depending on the contents of the URL. Use the msie-proxy pac-url command to specify the URL from which to retrieve the .pac file. Then, when you specify use-pac-url in the msie-proxy method command, the browser uses the .pac file to determine the proxy settings.

Refer to the Cisco Secure Client Administrator Guide , Release 3.1 or the release notes for your mobile device for further information about proxy settings.

Usage Guidelines

The line containing the proxy server IP address or hostname and the port number must be less than 100 characters long.

Refer to the Cisco Secure Client Administrator Guide , Release 3.1 or the release notes for your mobile device for further information about proxy settings.

Usage Guidelines

The mtu command lets you to set the payload size (not including Layer 2 headers or VLAN tagging) that is sent on a connection. Data that is larger than the MTU value is fragmented before being sent. The default MTU is 1500 bytes for Ethernet interfaces (which is also the maximum without jumbo frame reservation). In this case, the size of the packet with Layer 2 headers (14 bytes) and VLAN tagging (4 bytes) is 1518 bytes. This value is sufficient for most applications, but you can pick a lower number if network conditions require it.

The ASA supports IP path MTU discovery (as defined in RFC 1191), which allows a host to dynamically discover and cope with the differences in the maximum allowable MTU size of the various links along the path. Sometimes, the ASA cannot forward a datagram because the packet is larger than the MTU that you set for the interface, but the “don’t fragment” (DF) bit is set. The network software sends a message to the sending host, alerting it to the problem. The host has to fragment packets for the destination so that they fit the smallest packet size of all the links along the path.

When using the Layer 2 Tunneling Protocol (L2TP), we recommend that you set the MTU size to 1380 to account for the L2TP header and IPsec header length.

The minimum MTU allowed on an IPv6 enabled interface is 1280 bytes; however, if IPsec is enabled on the interface, the MTU value should not be set below 1380 because of the overhead of IPsec encryption. Setting the interface below 1380 bytes may result in dropped packets.

Starting in Version 9.1(6), the maximum MTU that the ASA can use is 9198 bytes. This value does not include the Layer 2 header. Formerly, the ASA let you specify the maximum MTU as 65535 bytes, which was inaccurate and could cause problems. If your MTU was set to a value higher than 9198, then the MTU is automatically lowered when you upgrade. In some cases, this MTU change can cause an MTU mismatch; be sure to set any connecting equipment to use the new MTU value.

Usage Guidelines

We suggest setting the MTU to 1600 bytes or greater, which requires you to enable jumbo frame reservation using the jumbo-frame reservation command.

This command is a global configuration command, but is also part of the bootstrap configuration, which is not replicated between units.

Usage Guidelines

Use this command to configure an administratively scoped boundary on an interface to filter multicast group addresses in the range defined by the acl argument. A standard access list defines the range of addresses affected. When this command is configured, no multicast data packets are allowed to flow across the boundary in either direction. Restricting multicast data packet flow enables reuse of the same multicast group address in different administrative domains.

If you configure the filter-autorp keyword, the administratively scoped boundary also examines Auto-RP discovery and announcement messages and removes any Auto-RP group range announcements from the Auto-RP packets that are denied by the boundary ACL. An Auto-RP group range announcement is permitted and passed by the boundary only if all addresses in the Auto-RP group range are permitted by the boundary ACL. If any address is not permitted, the entire group range is filtered and removed from the Auto-RP message before the Auto-RP message is forwarded.

Usage Guidelines

The multicast-routing command enables PIM and IGMP on all interfaces.

Note	PIM is not supported with PAT. The PIM protocol does not use ports and PAT only works with protocols that use ports.If the security appliance is the PIM RP, use the untranslated outside address of the security appliance as the RP address.

The number of entries in the multicast routing tables are limited by the amount of RAM on the system. <xref> lists the maximum number of entries for specific multicast tables based on the amount of RAM on the security appliance. Once these limits are reached, any new entries are discarded.

Usage Guidelines

The following commands are possible:

• A.B.C.D—The IP address of WSA authorized to access ASA.

• host—The client periodically checks connectivity to the Web Security appliance by sending a request to a fictitious host. By default, the fictitious host URL is mus.cisco.com. When AnyConnect Security Mobility is enabled, the Web Security appliance intercepts requests destined for the fictitious host and replies to the client.

• password—Configure WSA password.

• server—Configure WSA server

Usage Guidelines

You can enable AnyConnect Secure Mobility for a given port. The WSA port values are 1 through 21000. If a port is not specified in the command, port 11999 is used.

You must configure AnyConnect Secure Mobility shared secret before executing this command.

Note	To function as expected, this command requires a release of the AsyncOS for Web version 7.0 that provides AnyConnect Secure Mobility licensing support for the Secure Client. It also requires an AnyConnect release that supports AnyConnect Secure Mobility, ASA 8.3, and ASDM 6.3.

Usage Guidelines

This WebVPN submode lets you configure global settings for WebVPN. You can set up the shared secret for AnyConnect Secure Mobility communications.

Usage Guidelines

You must specify a port the AnyConnect Secure Mobility service uses. The communication between the ASA and the WSA is by a secure SSL connection on a port specified by the administrator with values of 1 through 21000.

You must configure AnyConnect Secure Mobility shared secret before executing this command.