CLI and Configuration Management
The Secure Firewall eXtensible Operating System (FXOS) operates differently from the ASA CLI. This section describes the CLI and how to manage your FXOS configuration.
About the CLI
FXOS uses a managed object model, where managed objects are abstract representations of physical or logical entities that can be managed. For example, chassis, network modules, ports, and processors are physical entities represented as managed objects, and licenses, user roles, and platform policies are logical entities represented as managed objects.
Four general commands are available for object management:
-
create object
-
delete object
-
enter object
-
scope object
You can use the scope command with any managed object, whether a permanent object or a user-instantiated object. The other commands allow you to create and manage user-instantiated objects. For every create object command, a corresponding delete object and enter object command exists. You can use the enter object command to create new objects and edit existing objects, so you can use it instead of the create object command, which will give an error if an object already exists.
At any time, you can enter the ? character to display the options available at the current state of the command syntax.
Connect to the ASA or FXOS Console
The Firepower 2100 console port connects you to the FXOS CLI. From the FXOS CLI, you can then connect to the ASA console, and back again. If you SSH to FXOS, you can also connect to the ASA CLI; a connection from SSH is not a console connection, so you can have multiple ASA connections from an FXOS SSH connection. Similarly, if you SSH to the ASA, you can connect to the FXOS CLI.
You can only have one console connection at a time. When you connect to the ASA console from the FXOS console, this connection is a persistent console connection, not like a Telnet or SSH connection.
Procedure
| Step 1 |
Connect your management computer to the console port. The Firepower 2100 ships with a DB-9 to RJ-45 serial cable, so you will need a third party serial-to-USB cable to make the connection. Be sure to install any necessary USB serial drivers for your operating system. Use the following serial settings:
You connect to the FXOS CLI. Enter the user credentials; by default, you can log in with the admin user and the default password, Admin123. |
| Step 2 |
Connect to the ASA: connect asa Example: |
| Step 3 |
To return to the FXOS console, enter Ctrl+a, d. |
Connect to FXOS with SSH
You can connect to FXOS on Management 1/1 with the default IP address, 192.168.45.45. If you configure remote management (the ASA fxos permit command), you can also connect to the data interface IP address on the non-standard port, by default, 3022.
To connect using SSH to the ASA, you must first configure SSH access according to the ASA general operations configuration guide.
You can connect to the ASA CLI from FXOS, and vice versa.
FXOS allows up to 8 SSH connections.
Before you begin
To change the management IP address, see Change the FXOS Management IP Addresses or Gateway.
Procedure
| Step 1 |
On the management computer connected to Management 1/1, SSH to the management IP address (by default https://192.168.45.45, with the username: admin and password: Admin123). You can log in with any username (see Add a User). If you configure remote management, SSH to the ASA data interface IP address on port 3022 (the default port). |
| Step 2 |
Connect to the ASA CLI. connect asa To return to the FXOS CLI, enter Ctrl+a, d. Example: |
| Step 3 |
If you SSH to the ASA (after you configure SSH access in the ASA), connect to the FXOS CLI. connect fxos You are prompted to authenticate for FXOS; use the default username: admin and password: Admin123. To return to the ASA CLI, enter exit or type Ctrl-Shift-6, x. Example: |
Commit, Discard, and View Pending Commands
When you enter a configuration command in the CLI, the command is not applied until you save the configuration. Until committed, a configuration command is pending and can be discarded. While any commands are pending, an asterisk (*) appears before the command prompt. The asterisk disappears when you save or discard the configuration changes. You can accumulate pending changes in multiple command modes and apply them together. You can view the pending commands in any command mode.
Procedure
| Step 1 |
View pending configuration changes. show configuration pending Example: |
||
| Step 2 |
Save the configuration. commit-buffer
Example: |
||
| Step 3 |
Discard configuration changes. discard-buffer Example: |
Example
The following example shows how the prompts change during the command entry process:
firepower-2110# scope system
firepower-2110 /system # scope services
firepower-2110 /system/services # enter ntp-server 10.1.1.1
firepower-2110 /system/services/ntp-server* # show configuration pending
+enter ntp-server 10.1.1.1
+ set ntp-sha1-key-id 0
+! set ntp-sha1-key-string
+exit
firepower-2110 /system/services/ntp-server* #
firepower-2110 /system/services/ntp-server* # commit-buffer
firepower-2110 /system/services/ntp-server #
Save and Filter Show Command Output
You can save the output of show commands by redirecting the output to a text file. You can filter the output of show commands by piping the output to filtering commands.
Saving and filtering output are available with all show commands but are most useful when dealing with commands that produce a lot of text. For example, you can show all or parts of the configuration by using the show configuration command. Copying the configuration output provides a way to backup and restore a configuration.
 Note |
Show commands do not show the secrets (password fields), so if you want to paste a configuration into a new device, you will have to modify the show output to include the actual passwords. |
Filter Show Command Output
To filter the output of a show command, use the following subcommands. Note that in the following syntax description, the initial vertical bar | after the show command is the pipe character and is part of the command, not part of the syntax description. The filtering options are entered after the command’s initial | character.
show command | { begin expression| count| cut expression| egrep expression| end expression| exclude expression| grep expression| head| include expression| last| less| no-more| sort expression| tr expression| uniq expression| wc}
- Filtering Options
-
These are the filtering subcommands:
-
begin —Finds the first line that includes the specified pattern, and display that line and all subsequent lines.
-
count —Counts the number of lines.
-
cut —Removes (“cut”) portions of each line.
-
egrep —Displays only those lines that match the extended-type pattern.
-
end —Ends with the line that matches the pattern.
-
exclude —Excludes all lines that match the pattern and show all other lines.
-
grep —Displays only those lines that match the pattern.
-
head —Displays the first lines.
-
include —Displays only those lines that match the pattern.
-
last —Displays the last lines.
-
less —Filters for paging.
-
no-more —Turns off pagination for command output.
-
sort —Sorts the lines (stream sorter).
-
tr —Translates, squeezes, and/or deletes characters.
-
uniq —Discards all but one of successive identical lines.
-
wc —Displays a count of lines, words, and characters.
-
Note |
Several of these subcommands have additional options that let you further control the filtering. For example, with show configuration | head and show configuration | last, you can use the lines keyword to change the number of lines displayed; the default is 10. As another example, with show configuration | sort, you can add the option -u to remove duplicate lines from the output. (Complete descriptions of these options is beyond the scope of this document; refer to the FXOS help output for the various commands, and to the appropriate Linux help, for more information.) |
Examples
The following example shows how to determine the number of lines currently in the system event log:
FP9300-A# show sel 1/1 | count
3008
FP9300-A#
The following example shows how to display lines from the system event log that include the string “error”:
FP9300-A# show sel 1/1 | include error
968 | 05/15/2016 16:46:25 | CIMC | System Event DDR4_P2_H2_EC
C #0x99 | Upper critical - going high | Asserted | Reading 20
000 >= Threshold 20000 error
FP9300-A#
Related Topics
Save Show Command Output
You can save the output of show commands by redirecting the output to a text file.
show command [ > { ftp:| scp:| sftp:| tftp:| volatile: | workspace:} ] | [ >> { volatile: | workspace:} ]
Syntax Description
|
> { ftp:| scp:| sftp:| tftp:| volatile: | workspace:} |
Redirects the show command output to a specified text file using the selected transport protocol. After you enter the command, you are queried for remote server name or IP address, user name, file path, and so on. If you press Enter at this point, the output is saved locally. |
|
>> { volatile: | workspace:} |
Appends the show command output to the appropriate text file, which must already exist. |
Example
The following example attempts to save the current configuration to the system workspace; a configuration file already exists, which you can choose to overwrite or not.
FP9300-A# show configuration > workspace
File already exists, overwrite (y/n)?[n]n
Reissue command with >> if you want to append to existing file
FP9300-A#
Related Topics
Feedback