Usage Guidelines

The pre-fill-username command enables the use of a username extracted from the certificate field specified in the username-from-certificate command as the username for username/password authentication and authorization. To use this pre-fill username from certificate feature, you must configure both commands.

To enable this feature, you must also configure the username-from-certificate command in tunnel-group general-attributes mode.

Usage Guidelines

Assigning a primary or secondary preference to a failover group specifies which unit the failover group becomes active on when you set the preempt command. Both failover groups become active on the first unit that boots up (even if it seems like they boot simultaneously, one unit becomes active first), despite the primary or secondary setting for the group. When the other unit comes online, any failover groups that have the second unit as a priority do not become active on the second unit unless the failover group is configured with the preempt command or is manually forced to the other unit with the no failover active command. If the failover group is configured with the preempt command, the failover group automatically becomes active on the designated unit.

Note	If Stateful Failover is enabled, the preemption is delayed until the connections are replicated from the unit on which the failover group is currently active.

Usage Guidelines

The prefix-list commands are ABR type 3 LSA filtering commands. ABR type 3 LSA filtering extends the capability of an ABR that is running OSPF to filter type 3 LSAs between different OSPF areas. Once a prefix list is configured, only the specified prefixes are sent from one area to another area. All other prefixes are restricted to their OSPF area. You can apply this type of area filtering to traffic going into or coming out of an OSPF area, or to both the incoming and outgoing traffic for that area.

When multiple entries of a prefix list match a given prefix, the entry with the lowest sequence number is used. The ASA begins the search at the top of the prefix list, with the entry with the lowest sequence number. Once a mach is made, the ASA does not go through the rest of the list. For efficiency, you may want to put the most common matches or denials near the top of the list by manually assigning them a lower sequence number.

By default, the sequence numbers are automatically generated. They can be suppressed with the no prefix-list sequence-number command. Sequence numbers are generated in increments of 5. The first sequence number generated in a prefix list would be 5. The next entry in that list would have a sequence number of 10, and so on. If you specify a value for an entry, and then do not specify values for subsequent entries, the generated sequence numbers are increased from the specified value in increments of 5. For example, if you specify that the first entry in the prefix list has a sequence number of 3, and then add two more entries without specifying a sequence number for the additional entries, the automatically generated sequence numbers for those two entries would be 8 and 13.

You can use the ge and le keywords to specify the range of the prefix length to be matched for prefixes that are more specific than the network /len argument. Exact match is assumed when neither the ge or le keywords are specified. The range is from min_value to 32 if only the ge keyword is specified.The range is from len to max_value if only the le keyword is specified.

The value of the min_value and max_value arguments must satisfy the following condition:

len < min_value <= max_value <= 32

Use the no form of the command to remove specific entries from the prefix list. Use the clear configure prefix-list command to remove a prefix list. The clear configure prefix-list command also removes the associated prefix-list description command, if any, from the configuration.

Usage Guidelines

You can enter prefix-list and prefix-list description commands in any order for a particular prefix list name; you do not need to create the prefix list before entering a prefix list description. The prefix-list description command will always appear on the line before the associated prefix list in the configuration, no matter what order you enter the commands.

If you enter a prefix-list description command for a prefix list entry that already has a description, the new description replaces the original description.

You do not need to enter the text description when using the no form of this command.

Usage Guidelines

Only the no form of this command appears in the configuration. When the no form of this command is in the configuration, the sequence numbers, including the manually configured ones, are removed from the prefix-list commands in the configuration and new prefix lists entries are not assigned a sequence number.

When prefix list sequence numbering is enabled, all prefix list entries are assigned sequence numbers using the default numbering method (starting with 5 and incrementing each number by 5). If a sequence number was manually assigned to a prefix list entry before numbering was disabled, the manually assigned number is restored. Sequence numbers that are manually assigned while automatic numbering is disabled are also restored, even though they are not displayed while numbering is disabled.

Usage Guidelines

An IKEv2 SA is a key used in phase 1 to enable IKEv2 peers to communicate securely in phase 2. After entering the crypto ikev2 policy command, use the prf command to select the pseudo-random function used for the construction of keying material for all of the cryptographic algorithms used in the SA.

Usage Guidelines

Assigning a primary or secondary preference to a failover group specifies which unit the failover group becomes active on when you set the preempt command. Both failover groups become active on the first unit that boots up (even if it seems like they boot simultaneously, one unit becomes active first), despite the primary or secondary setting for the group. When the other unit comes online, any failover groups that have the second unit as a priority do not become active on the second unit unless the failover group is configured with the preempt command or is manually forced to the other unit with the no failover active command. If the failover group is configured with the preempt command, the failover group automatically becomes active on the designated unit.

Usage Guidelines

LLQ priority queuing lets you prioritize certain traffic flows (such as latency-sensitive traffic like voice and video) ahead of other traffic.

The ASA supports two types of priority queuing:

• Standard priority queuing—Standard priority queuing uses an LLQ priority queue on an interface (see the priority-queue command), while all other traffic goes into the “best effort” queue. Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is called tail drop .To avoid having the queue fill up, you can increase the queue buffer size. You can also fine-tune the maximum number of packets allowed into the transmit queue. These options let you control the latency and robustness of the priority queuing. Packets in the LLQ queue are always transmitted before packets in the best effort queue.

• Hierarchical priority queuing—Hierarchical priority queuing is used on interfaces on which you enable a traffic shaping queue (the shape command). A subset of the shaped traffic can be prioritized. The standard priority queue is not used. See the following guidelines about hierarchical priority queuing:

• Priority packets are always queued at the head of the shape queue so they are always transmitted ahead of other non-priority queued packets.

• Priority packets are never dropped from the shape queue unless the sustained rate of priority traffic exceeds the shape rate.

• For IPsec-encrypted packets, you can only match traffic based on the DSCP or precedence setting.

• IPsec-over-TCP is not supported for priority traffic classification.

Configuring QoS with Modular Policy Framework

To enable priority queuing, use the Modular Policy Framework. You can use standard priority queuing or hierarchical priority queuing.

For standard priority queuing, perform the following tasks:

1.class-map —Identify the traffic on which you want to perform priority queuing.

2.policy-map —Identify the actions associated with each class map.

• a.class —Identify the class map on which you want to perform actions.

• b.priority —Enable priority queuing for the class map.

3.service-policy —Assigns the policy map to an interface or globally.

For hierarchical priority-queuing, perform the following tasks:

1.class-map —Identify the traffic on which you want to perform priority queuing.

2.policy-map (for priority queuing)—Identify the actions associated with each class map.

• a.class —Identify the class map on which you want to perform actions.

• b.priority —Enable priority queuing for the class map. You can only include the priority command in this policy map if you want to use is hierarchically.

3.policy-map (for traffic shaping)—Identify the actions associated with the class-default class map.

• a.class class-default —Identify the class-default class map on which you want to perform actions.

• b.shape —Apply traffic shaping to the class map.

• c.service-policy —Call the priority queuing policy map in which you configured the priority command so you can apply priority queuing to a subset of shaped traffic.

4.service-policy —Assigns the policy map to an interface or globally.

Usage Guidelines

Members of the cluster communicate over the cluster control link to elect a master unit, as follows:

1. When you enable clustering for a unit (or when it first starts up with clustering already enabled), it broadcasts an election request every 3 seconds.

2. Any other units with a higher priority respond to the election request; the priority is set between 1 and 100, where 1 is the highest priority.

3. If after 45 seconds, a unit does not receive a response from another unit with a higher priority, then it becomes master.

Note	If multiple units tie for the highest priority, the cluster unit name, and then the serial number is used to determine the master.

4. If a unit later joins the cluster with a higher priority, it does not automatically become the master unit; the existing master unit always remains as the master unless it stops responding, at which point a new master unit is elected.

Note

You can manually force a unit to become the master using the cluster master unit command. For centralized features, if you force a master unit change, then all connections are dropped, and you have to re-establish the connections on the new master unit. See the configuration guide for a list of centralized features.

Usage Guidelines

You must first use the vpn load-balancing command to enter VPN load-balancing mode.

This command sets the priority of the local device participating in the virtual load-balancing cluster.

The priority must be an integer in the range of 1 (lowest) to 10 (highest).

The priority is used in the master-election process as one way to determine which of the devices in a VPN load-balancing cluster becomes the master or primary device for the cluster. See CLI configuration guide for details about the master-election process.

The no form of the command reverts the priority specification to the default value.

Usage Guidelines

LLQ priority queuing lets you prioritize certain traffic flows (such as latency-sensitive traffic like voice and video) ahead of other traffic.

The ASA supports two types of priority queuing:

• Standard priority queuing—Standard priority queuing uses an LLQ priority queue on an interface that yopu create using the priority-queue command, while all other traffic goes into the “best effort” queue. Because queues are not of infinite size, they can fill and overflow. When a queue is full, any additional packets cannot get into the queue and are dropped. This is called tail drop . To avoid having the queue fill up, you can increase the queue buffer size (the queue-limit command). You can also fine-tune the maximum number of packets allowed into the transmit queue (the tx-ring-limit command). These options let you control the latency and robustness of the priority queuing. Packets in the LLQ queue are always transmitted before packets in the best effort queue.

• Hierarchical priority queuing—Hierarchical priority queuing is used on interfaces on which you enable a traffic shaping queue. A subset of the shaped traffic can be prioritized. The standard priority queue is not used.

Note

On the ASA 5505 only, configuring a priority queue on one interface overwrites the same configuration on all other interfaces; only the last applied configuration is present on all interfaces. Also, if the priority queue configuration is removed from one interface, it is removed from all interfaces. To work around this issue, configure the priority-queue command on only one interface. If different interfaces need different settings for the queue-limit and/or tx-ring-limit commands, use the largest of all queue limits and smallest of all tx-ring-limits on any one interface (CSCsi13132).

Usage Guidelines

The privilege command lets you set privilege levels for ASA commands when you configure the aaa authorization command LOCAL command. Even though the command uses the LOCAL keyword, this keyword enables local, RADIUS, and LDAP (mapped) authorization.

Usage Guidelines

The following commands are used in profile configuration mode.

Enable or Disable a Profile

To enable a call-home profile, use the active command in call-home-profile configuration mode. To disable a call-home profile, use the no active command in call-home-profile configuration mode. You can access the call-home-profile configuration mode by first entering the call-home then profile command. The default is enabled.

active

no active

Set Profile Commands to Default

To set the call home profile settings to their default values use the default command in call-home-profile configuration mode. You can access the call-home-profile configuration mode by first entering the call-home then profile commands. You can also reset call-home configuration mode settings from this mode. Use command help, default ? , to determine and reset all call-home profile and general settings.

default { activedestinationemail-subjectsubscribe-to-alert-group}

Destination Type, Address and Settings

To set the destination address, reference identity, message format, and transport method for the Smart Call Home message receiver, use the destination command in call-home-profile configuration mode. To remove the destination parameters, or reset them to default, use the no destination or default command.

The default message format is XM, the default message size is 5MB (0 means unlimited), and the default transport method is e-mail. You must specify a previously configured reference identity. This is used to validate the call-home server’s certificate when connecting. It applies to http destinations only.

destination address { e-mail e-mail-addresshttp http-url}

no destination address { e-mailhttp [all]}

destination address http http-url reference-identity ref-id-name

no destination address http http-url reference-identity ref-id-name

destination address { e-mail e-mail-addresshttp http-url} msg-format { short-textlong-textxml}

no destination address { e-mail e-mail-addresshttp http-url} msg-format { short-textlong-textxml}

destination message-size-limit max-size

no destination message-size-limit max-size

destination preferred-msg-format { short-textlong-textxml}

no destination preferred-msg-format { short-textlong-textxml}

destination transport-method { e-mailhttp}

no destination transport-method { e-mailhttp}

Configure E-mail Subject

To set a prefix or suffix on the email subject for call-home email, use the email-subject command in call-home-profile configuration mode. To clear these fields use the no email-subject command. You can access the call-home-profile configuration mode by first entering the call-home then profile command.

email-subject { appendprepend} chars

no email-subject { appendprepend} chars

Subscribe to an alert group

To subscribe to an alert group use the subscribe-to-alert-group command in call-home-profile configuration mode. To clear these subscriptions use the no subscribe-to-alert-group command. You can access the call-home-profile configuration mode by first entering the call-home then profile command.

• [no] subscribe-to-alert-group alert-group-name [severity {catastrophic | disaster | emergencies | alert | critical | errors | warning | notifications | informational | debugging}]—Subscribes to events of a group with a specified severity level.alert-group-name: Syslog, diagnostic, environment, or threat are valid values.

• [no] subscribe-to-alert-group syslog [{severity {catastrophic | disaster | emergencies | alert | critical | errors | warning | notifications | informational | debugging} | message start [-end]}]—Subscribes to syslogs with a severity level or message ID.start-[end]: One syslog message ID or a range of syslog message IDs.

  Note

  Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debugging only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Also, use it during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood of increasing the processing overhead that will affect system use.

• [no] subscribe-to-alert-group inventory [periodic {daily | monthly day_of_month | weekly day_of_week [hh:mm]]—Subscribes to inventory events.day_of_month: Day of the month, 1-31.day_of_week: Day of the week (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday).hh, mm: Hours and minutes of a day, in 24-hour time.

• [no] subscribe-to-alert-group configuration [export full | minimum] [periodic {daily | monthly day_of_month | weekly day_of_week [hh:mm]]—Subscribes to configuration events.full: Configuration to export the running configuration, startup configuration, feature list, number of elements in an access list, and the context name in multimode.minimum: Configuration to export-only feature list, number of elements in an access list, and the context name in multimode.day_of_month: Day of the month, 1-31.day_of_week: Day of the week (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday).hh, mm: Hours and minutes of a day, in 24-hour time.

• [no] subscribe-to-alert-group telemetry periodic {hourly | daily | monthly day_of_month | weekly day_of_week [hh:mm]—Subscribes to telemetry periodic events.day_of_month: Day of the month, 1-31.day_of_week: Day of the week (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday).hh, mm: Hours and minutes of a day, in 24-hour time.

• [no] subscribe-to-alert-group snapshot periodic {interval minutes | hourly [mm] | daily | monthly day_of_month |weekly day_of_week [hh:mm]}—Subscribes to snapshot periodic events.minutes: The interval in minutes.day_of_month: Day of the month, 1-31.day_of_week: Day of the week (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday).hh, mm: Hours and minutes of a day, in 24-hour time.

Usage Guidelines

The order in which you enter the keywords determines the order of the elements in the prompt, which are separated by a slash (/).

In multiple context mode, you can view the extended prompt when you log in to the system execution space or the admin context. Within a non-admin context, you only see the default prompt, which is the hostname and the context name.

The ability to add information to a prompt allows you to see at-a-glance which ASA you are logged into when you have multiple modules. During a failover, this feature is useful when both ASAs have the same hostname.

Usage Guidelines

This command enables and disables the propagation of a security group tag in CTS Layer 2 SGT Imposition.

Restrictions

• Supported only on physical interfaces, VLAN interfaces, port channel interfaces, and redundant interfaces.

• Not supported on logical interfaces or virtual interfaces, such as BVI, TVI, and VNI.

Usage Guidelines

IKEv2 IPsec proposals can have multiple encryption and integrity types. Use this command to specify the types, which allows the peer to pick and choose as desired.

You must choose the null integrity algorithm if AES-GMC/GMAC is configured as the encryption algorithm.

Usage Guidelines

Under certain conditions, protocol enforcement is performed even if the command is disabled. This occurs when parsing a DNS resource record is required for other purposes, such as DNS resource record classification, NAT or TSIG check.

Usage Guidelines

If you use this command, be sure to assign HTTP rules to the public interface filter. Subject to permission, the content of the CRL distribution point determines the retrieval method (HTTP, LDAP, and/or SCEP).

Usage Guidelines

The protocol-object command is used with the object-group command to define a protocol object in protocol configuration mode.

You can specify an IP protocol name or number using the protocol argument. The udp protocol number is 17, the tcp protocol number is 6, and the egp protocol number is 47.

Usage Guidelines

This command allows you to disable the IS-IS protocol for a specific routing instance without removing any existing IS-IS configurations parameters. When you enter the protocol shutdown command, the IS-IS protocol continues to run on the ASA, and you can use the current IS-IS configuration, but IS-IS does not form any adjacencies on any interface, and it also clears the IS-IS LSP database.

If you want to disable the IS-IS protocol for a specific interface, use the isis protocol shutdown command.

Usage Guidelines

This command can be configured in an HTTP or NetBIOS policy map. A syslog is issued when the HTTP or NetBIOS parser cannot detect a valid HTTP or NetBIOS message in the first few bytes of the message. This occurs, for instance, when a chunked encoding is malformed and the message cannot be parsed.

Usage Guidelines

Use the proxy-auth command for enabling the parsing of aaa-server proxy authentication text messages into native protocol directives.

Usage Guidelines

To enable parsing and mapping of RADIUS challenge messages from a RADIUS proxy, you must enable the proxy-auth command in tunnel-group configuration mode. Then default mapping values are used. You can change the default mapping values using the proxy-auth_map command.

A remote user connects to the ASA with the Secure Client and tries to authenticate using an RSA SecurID token. The ASA can be configured to use a RADIUS proxy server which in turn, communicates with the SDI server about that authentication.

During authentication, the RADIUS server presents access challenge messages to the ASA. Within these challenge messages are reply messages containing text from the SDI server. The message text is different when the ASA is communicating directly with an SDI server than when the ASA is communicating through the RADIUS proxy.

Therefore, to appear as a native SDI server to the Secure Client, the ASA must interpret the messages from the RADIUS server. Also, because the SDI messages are configurable on the SDI server, the message text on the ASA must match (in whole or in part) the message text on the SDI server. Otherwise, the prompts displayed to the remote client user may not be appropriate for the action required during authentication. The Secure Client might fail to respond, and authentication might fail.

Usage Guidelines

Use proxy bypass for applications and web resources that work better with minimum content rewriting. The proxy-bypass command determines how to treat specific web applications that travel through the ASA.

You can use this command multiple times. The order in which you configure entries is unimportant. The interface and path mask or interface and port uniquely identify a proxy bypass rule.

If you configure proxy bypass using ports rather than path masks, depending on your network configuration, you might need to change your firewall configuration to allow these ports access to the ASA. Use path masks to avoid this restriction. Be aware, however, that path masks can change, so you might need to use multiple pathmask statements to exhaust the possibilities.

A path is everything in a URL after the .com or .org or other types of domain name. For example, in the URL www.example.com/hrbenefits, hrbenefits is the path. Similarly, for the URL www.example.com/hrinsurance, hrinsurance is the path. If you want to use proxy bypass for all hr sites, you can avoid using the command multiple times by using the * wildcard as follows: /hr*.

Usage Guidelines

Use the proxy-ldc-issuer command to issue TLS proxy local dynamic certificates. The proxy-ldc-issuer command grants a crypto trustpoint the role as local CA to issue the LDC and can be accessed from crypto ca trustpoint configuration mode.

The proxy-ldc-issuer command defines the local CA role for the trustpoint to issue dynamic certificates for TLS proxy. This command can only be configured under a trustpoint with “enrollment self.”

Usage Guidelines

In an Azure service chain, ASA virtuals act as a transparent gateway that can intercept packets between the internet and the customer service. The ASA virtual defines an external interface and an internal interface on a single NIC by utilizing VXLAN segments in a paired proxy.

Usage Guidelines

Setting the proxy server configuration option for the Phone Proxy allows for an HTTP proxy on the DMZ or external network in which all the IP phone URLs are directed to the proxy server for services on the phones. This setting accommodates nonsecure HTTP traffic, which is not allowed back into the corporate network.

The ip_address you enter should be the global IP address based on where the IP phone and HTTP proxy server is located.

If the proxy server is located in a DMZ and the IP phones are located outside the network, the ASA does a lookup to see if there is a NAT rule and uses the global IP address to write into the configuration file.

You can enter a hostname in the ip_address argument when that hostname can be resolved to an IP address by the ASA (for example, DNS lookup is configured) because the ASA will resolve the hostname to an IP address.

By default, the Phone URL Parameters configured under the Enterprise Parameters use an FQDN in the URLs. The parameters might need to be changed to use an IP address if the DNS lookup for the HTTP proxy does not resolve the FQDNs.

To make sure the proxy server URL was written correctly to the IP phones configuration files, check the URL on an IP phone under Settings > Device Configuration > HTTP configuration >Proxy Server URL.

The Phone Proxy does not inspect this HTTP traffic to the proxy server.

If the ASA is in the path of the IP phone and the HTTP proxy server, use existing debugging techniques (such as syslogs and captures) to troubleshoot the proxy server.

You can configure only one proxy server while the Phone Proxy is in use; however, if the IP phones have already downloaded their configuration files after you have configured the proxy server, you must restart the IP phones so that they get the configuration file with the proxy server’s address in the file.

Usage Guidelines

The AWS Gateway Load Balancer combines a transparent network gateway and a load balancer that distributes traffic and scales virtual appliances on demand. The ASA virtual supports the Gateway Load Balancer centralized control plane with a distributed data plane (Gateway Load Balancer endpoint). This use case requires you to configure the VNI interface as a single-arm proxy. Be sure to also enable same-security-traffic permit intra-interface to allow traffic to u-turn out the VTEP source interface.

Usage Guidelines

The ptp domain command is also available in global configuration mode.

Usage Guidelines

This command is entered in interface configuration mode only.

This command is allowed only on physical interfaces. It is not allowed on sub-interfaces, other virtual interfaces, or the management interface.

PTP flows on VLAN sub-interfaces are supported, assuming the appropriate PTP configuration is present on the parent interface.

If PTP is not enabled in any mode, this command will be accepted, but will have no effect. A warning will be issued.

Usage Guidelines

When End to End Transparent mode is disabled, all PTP packets are treated like any other multicast packets. This is equivalent to forward mode.

The ptp mode command is also available in global configuration mode.

Usage Guidelines

If you intend to enable DNScrypt in the DNS inspection policy map, you can optionally configure the DNScrypt provider public key for certificate verification. If you do not configure the key, the default currently distributed public key is used for validation.

Configuring a key is necessary only if Cisco Umbrella changes the public key it uses for DNScrypt encryption.

Usage Guidelines

The CRL is inaccessible by default. You must enable access to the CRL file on the interface and port required.

TCP port 80 is the HTTP default port number. If you configure a non-default port (other than port 80), be sure the cdp-url configuration includes the new port number so other devices know to access this specific port.

The CRL Distribution Point (CDP) is the location of the CRL on the local CA ASA. The URL you configure with the cdp-url command is embedded into any issued certificates. If you do not configure a specific location for the CDP, the default CDP URL is: http://hostname.domain/+CSCOCA+/asa_ca.crl.

An HTTP redirect and a CRL download request are handled by the same HTTP listener, if Clientless SSL VPN is enabled on the same interface. The listener checks for the incoming URL and if it matches the one configured with the cdp-url command, the CRL file downloads. If the URL does not match the cdp-url command, the connection is redirected to HTTPS (if HTTP redirect is enabled).

Usage Guidelines

This command is similar in functionality to the dir command.