scope Commands

scope

To “scope into” (enter) an existing managed object, use the relevant scope command in the appropriate command mode.

scope object_type name [ parameters]

Syntax Description

object_type

The type of object to be entered. Examples include local user account and organization.

name

The name of the specific object to be entered.

parameters

(Optional) Any additional properties or parameters needed to identify the object. With this command, the name is generally sufficient to identify an object. Refer to the description of the create command for the specific object type for more information.

Command Modes

Depends on the type of object being scoped into; refer to the description of the create command for the specific object type for more information.

Command History

Refer to the description of the create command for the specific object type for history information.

Usage Guidelines

Objects are abstract representations of physical components or logical entities that can be managed. For example, the chassis, security modules, network modules, ports, and processors are physical components represented as managed objects, while licenses, user roles, and platform policies are logical entities represented as managed objects.

FXOS provides four general commands for managing objects: create , delete , enter , and scope . For example, you can create a local user account, you can delete a local user account, and you can enter a local user account to assign or change properties for that account; you also can “scope into” the local user account to assign or change properties.

Generally, the keywords and options available to each of these object-management commands are the same, so we detail only the create version of the various object commands. In other words, for information about the delete command for a particular object, refer to the description of the create command for that object. For example, refer to create local-user for information related to scoping into an existing local user account.

Examples

This example shows how to enter security mode, scope into a local user account and display account details:

firepower # scope security
firepower /security # scope local-user test_user
firepower /security/local-user # show detail
Local User test_user:
    First Name: test
    Last Name: user
    Email: test_user@testuser.com
    Phone:
    Expiration: Never
    Password: ****
    User lock status: Not Locked
    Account status: Active
    User Roles:
        Name: admin
        Name: read-only
    User SSH public key:
firepower /security/local-user # 

scope adapter

To enter adapter mode, use the scope adapter command.

scope adapter { rack_server/ id| chassis/ server/ id}

Syntax Description

rack_server/ id

The adapter location specified using the rack-server and adapter IDs entered in n/n format.

chassis/ server/ id

The adapter location specified using the chassis, server and adapter IDs entered in n/n/n format.

Note

 

The chassis ID is always 1.

Command Modes

EXEC mode

Command History

Release Modification

1.1(1)

Command added.

Usage Guidelines

In adapter mode, you can activate or update a firmware version, view a variety of adapter-specific data, and scope into host and external Ethernet interfaces.

Examples

This example shows how to enter adapter mode using the chassis, server and adapter IDs:

firepower# scope adapter 1/1/1
firepower /chassis/server/adapter # 

scope app-software

To enter application software mode, use the scope app-software command.

scope app-software

Syntax Description

This command has no arguments or keywords.

Command Modes

scope ssa/

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You can use the download image command in application software mode to copy a logical device software image to the Firepower 4100/9300 chassis.

Examples

This example shows how to enter application software mode:

firepower# scope ssa
firepower /ssa # scope app-software
firepower /ssa/app-software # 

scope auto-install

To enter automatic installation mode for infrastructure updates, use the scope auto-install command.

scope auto-install

Syntax Description

This command has no arguments or keywords.

Command Modes

Firmware (/firmware) mode

Command History

Release

Modification

1.4(1)

Command added.

Usage Guidelines

None

Examples

This example shows how to enter firmware mode and then auto-install mode:

FP9300-A# scope firmware
FP9300-A /firmware # scope auto-install
FP9300-A /firmware/auto-install # 

scope auto-macpool

To manage the MAC address pool for container instance interface , use the scope auto-macpool command.

scope auto-macpool

Syntax Description

This command has no arguments or keywords.

Command Modes

scope ssa/

Command History

Release

Modification

2.4(1)

Command added.

Usage Guidelines

The FXOS chassis automatically generates MAC addresses for container instance interfaces, and guarantees that a shared interface in each instance uses a unique MAC address.

If you manually assign a MAC address to a shared interface within the application, then the manually-assigned MAC address is used. If you later remove the manual MAC address, the autogenerated address is used. In the rare circumstance that the generated MAC address conflicts with another private MAC address in your network, we suggest that you manually set the MAC address for the interface within the application.

Because autogenerated addresses start with A2, you should not start manual MAC addresses with A2 due to the risk of overlapping addresses.


Note


Even if you are not sharing a subinterface, if you manually configure MAC addresses, make sure you use unique MAC addresses for all subinterfaces on the same parent interface to ensure proper classification.


The FXOS chassis generates the MAC address using the following format:

A2xx.yyzz.zzzz

Where xx.yy is a user-defined prefix or a system-defined prefix, and zz.zzzz is an internal counter generated by the chassis. The system-defined prefix matches the lower 2 bytes of the first MAC address in the burned-in MAC address pool that is programmed into the IDPROM. Use connect fxos , then show module to view the MAC address pool. For example, if the range of MAC addresses shown for module 1 is b0aa.772f.f0b0 to b0aa.772f.f0bf, then the system prefix will be f0b0.

The user-defined prefix is an integer that is converted into hexadecimal. For an example of how the user-defined prefix is used, if you set a prefix of 77, then the chassis converts 77 into the hexadecimal value 004D (yyxx). When used in the MAC address, the prefix is reversed (xxyy) to match the chassis native form:

A24D.00zz.zzzz

For a prefix of 1009 (03F1), the MAC address is:

A2F1.03zz.zzzz

Examples

This example shows how to enter mac-pool mode:


firepower# scope ssa
firepower /ssa # scope auto-macpool
firepower /ssa/auto-macpool # 

scope banner

To enter banner-management mode, use the scope banner command.

scope banner

Syntax Description

This command has no arguments or keywords.

Command Modes

scope security/

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

In this mode, you can manage the banner presented by the appliance prior to user log-in.

Examples

This example shows you how to enter banner mode and view the current pre-login banner:

firepower # scope security
firepower /security # scope banner
firepower /security/banner # show pre-login-banner

Pre login banner:
    Message
    -------
    Firepower-9300-2
Western Data Center

firepower /security/banner # 

scope cabling

To enter cabling mode, use the scope cabling command.

scope cabling

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release Modification

1.1(1)

Command added.

Usage Guidelines

You can access fabric mode from cabling mode, where you can view and manage port breakouts.

Examples

This example shows how to enter cabling mode:

FP9300-A # scope cabling
FP9300-A /cabling #

scope callhome

To enter callhome mode, use the scope callhome command.

scope callhome

Syntax Description

This command has no arguments or keywords.

Command Modes

Monitoring mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter callhome mode from monitoring mode:

FP9300-A#scope monitoring
FP9300-A /monitoring # scope callhome
FP9300-A /monitoring/callhome #
                               

scope card

To enter adminstrative mode for a specific fabric card, use the scope card command.

scope card card_ID

Syntax Description

card_ID

The fabric cardʼs numeric identifier.

Command Modes

scope fabric-interconnect/

Command History

Release Modification

1.1(1)

Command added.

Usage Guidelines

In card mode, you can take the fabric card offline or online.

Examples

This example shows how to enter card mode and view available commands:

firepower# scope fabric-interconnect
firepower /fabric-interconnect # scope card 2
firepower /fabric-interconnect/card # ?
  acknowledge  Acknowledge 
  scope        Changes the current mode 
  set          Set property values 
  show         Show system information 

firepower /fabric-interconnect/card # 

Command

Description

set adminstate

Takes a fabric card offline or online.

scope cfg-export-policy

To enter the configuration export policy, use the scope cfg-export-policy command.

scope cfg-export-policy name

Syntax Description

name

The name of the configuration export policy to enter.

You cannot create or delete a configuration export policy. You can only configure the existing default policy; enter default as the policy name.

Command Modes

scope org/

Command History

Release Modification

2.0.1

Command added.

Usage Guidelines

You cannot create or delete a configuration export policy; you can only configure the existing default policy.

Examples

This example shows how to enter the configuration export policy and view the details of its current settings:

firepower # scope org
firepower /org # scope cfg-export-policy default
firepower /org/cfg-export-policy # show detail
Config Export policy:
    Name: default
    Description: Configuration Export Policy
    Admin State: Enable
    Protocol: Ftp
    Hostname: 192.168.1.2
    User: user1
    Remote File: /export/cfg-backup.xml
    Schedule: Daily
    Port: Default
    Current Task:
firepower /org/cfg-export-policy # 

scope cfg-export-reminder

To enter the configuration-export reminder object, use the scope cfg-export-reminder command.

scope cfg-export-reminder

Syntax Description

This command has no arguments or keywords.

Command Modes

scope org/

Command History

Release Modification

2.0.1

Command added.

Usage Guidelines

You cannot create or delete a configuration-export reminder object; you can only configure the existing reminder object.

Examples

This example shows how to enter the configuration-export reminder object and view its current settings:

firepower # scope org
firepower /org # scope cfg-export-reminder
firepower /org/cfg-export-reminder # show

Config Export Reminder:
    Config Export Reminder (Days): 30
    AdminState: Enable
firepower /org/cfg-export-reminder # 

scope chassis

To enter chassis mode, use the scope chassis command.

scope chassis chassis_id

Syntax Description

chassis_id

Chassis identification number. This value is always 1.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter chassis mode:


firepower# scope chassis 1
firepower /chassis # 

scope cimc

To enter cimc mode, use the scope cimc command.

scope cimc

Syntax Description

This command has no arguments or keywords.

Command Modes

scope chassis, scope server.

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter cimc mode:

tb-03# scope chassisss
tb-03 /chassis # scope server
tb-03 /chassis/server # scope cimc
tb-03 /chassis/server/cimc #

scope cloud-connector

To enter cloud connector mode, use the scope cloud-connector command.

scope cloud-connector

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release Modification

1.1(1)

Command added.

Examples

This example shows how to enter cloud connector mode:

FP9300-A # scope cloud-connector
FP9300-A /cloud-connector #

scope default-auth

To enter default authentication mode, use the scope default-auth command.

scope default-auth

Syntax Description

This command has no arguments or keywords.

Command Modes

Security mode

Authentication domain (/security/auth-domain)

Command History

Release

Modification

1.4(1)

Command added.

Usage Guidelines

Use the set commands in this mode to configure default authentication parameters such as authentication service and session timeout values.

An authentication domain must be created prior to using this command to enter the default authentication mode for a domain.

Examples

This example shows how to enter security mode and then default authentication mode:

FP9300-A# scope security
FP9300-A /security # scope default-auth
FP9300-A /security/default-auth # 

scope environment-features

To enter environment features in configuration mode, use the scope environment-features command.

scope environment-features

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope system

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter environment features mode:

firepower # scope system
firepower /system # scope environment-features
firepower /system/environment-features # show

scope eth-uplink

To enter Ethernet uplink mode, use the scope eth-uplink command.

scope eth-uplink

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter Ethernet uplink mode:

firepower#scope eth-uplink
firepower /eth-uplink #

scope eth-server

To enter Ethernet server mode, use the scope eth-server command.

scope eth-server

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter ethernet server mode:

firepower#scope eth-server
firepower /eth-server #

scope export-config

To enter an existing export-configuration object, use the scope export-config command.

scope export-config hostname

Syntax Description

hostname The identifier of the export-configuration object; this is the name or IP address of the remote server on which the configuration was backed up.

Command Modes

scope system/

Command History

Release Modification

1.1.(1)

Command added.

Usage Guidelines

An export-configuration object is created when you issue an export-config command to back up the current logical device and platform configuration, and scope export-config is used to enter the object and edit its parameters—there are no create or enter commands associated with export-configuration objects. There is a delete command available which you can use to delete an export-configuration object.

Examples

This example shows how to scope into a previously exported configuration object:

firepower # scope system
firepower /system # scope export-config 192.168.1.2
firepower /system/export-config #

scope fabric

To enter fabric mode, use the scope fabric command.

scope fabric [ a]

Syntax Description

a

Specifies Fabric A. There is only one fabric on Firepower devices. Use of this keyword is optional.

Command Modes

scope eth-uplink, scope eth-server

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

In fabric mode, you can manage interfaces, port-channels, aggregate interfaces, and VLANs.

Examples

This example shows how to enter fabric mode:

firepower# scope eth-uplink
firepower /eth-uplink # scope fabric a
firepower /eth-uplink/fabric # 

Examples

firepower# scope eth-server
firepower /eth-server # scope fabric
firepower /eth-server/fabric #

scope fabric-interconnect

To enter fabric interconnect mode, use the scope fabric-interconnect command.

scope fabric-interconnect a

Syntax Description

a

Specifies Fabric A. There is only one fabric on Firepower devices.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter fabric interconnect mode:

firepower# scope fabric-interconnect a
firepower /fabric-interconnect # 

scope fan-module

To enter a specific fan module, use the scope fan-module command in chassis mode.

scope fan-module { 1 module_id}

Syntax Description

tray_id

The tray_id is always 1.

module_id

Identifies the specific fan module to enter; value can be 1 through 8.

Command Modes

scope chassis/

Command History

Release Modification

1.1(1)

Command added.

Examples

This example shows how to scope into fan-module mode:

firepower# scope chassis
firepower /chassis # scope fan-module 1 2
firepower /chassis/fan-module #

scope faulty-policy

To enter the fault policy for one of the functional areas of the system, use the scope faulty policy command.

scope faulty policy

Syntax Description

This command has no arguments or keywords.

Command Modes

scope monitoring

Command History

Release Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

scope firmware

To enter firmware mode, use the scope firmware command.

scope firmware

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter firmware mode:

firepower# scope firmware
firepower /firmware #

scope firmware-install

To enter firmware-installation mode, use the scope firmware-install command.

scope firmware-install

Syntax Description

This command has no arguments or keywords.

Command Modes

Firmware mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

Use this scope to update system firmware with a previously downloaded firmware package.

Examples

This example shows how to enter firmware-installation mode:

FP9300-A# scope firmware
FP9300-A /firmware # scope firmware-install
FP9300-A /firmware-install # 

scope flow-control

To enter flow-control mode, use the scope flow-control command.

scope flow-control

Syntax Description

This command has no arguments or keywords.

Command Modes

scope eth-uplink/

Command History

Release Modification

1.1.1

Command added.

Usage Guidelines

Flow-control policies determine whether the Ethernet ports send and receive IEEE 802.3x pause frames when the receive buffer for a port fills. These pause frames request that the transmitting port stop sending data for a few milliseconds until the buffer clears. For flow control to work between devices, you must enable the corresponding send and receive flow-control parameters for both devices.

The default flow-control policy disables send and receive control, and sets the priority to auto-negotiate.

Examples

The following example shows how to scope into flow-control mode and view current policy information:

firepower # scope eth-uplink
firepower /eth-uplink # scope flow-control
firepower /eth-uplink/flow-control # show policy detail
Flowctrl policy:
    Name: default
    receive: Off
    send: Off
    Prio: Auto
firepower /eth-uplink/flow-control # 

scope health monitoring policy

Memory usage metrics

Memory stats collected can be enabled or disabled using the cli under scope ‘stats-collection-memory’. By default, it is enabled.

Also fault threshold can be set for all memory monitoring faults. The threshold-value can range between 50-99. By default, it is set at 95%.

scope health-monitoring-policy

scope stats-collection-memory

enable | disable

set fault-threshold <threshold-value>

Command Modes

Monitoring mode

Command History

Release

Modification

2.11.1

This command was introduced.

Usage Guidelines

This command enables or disables memory monitoring and also changes the fault threshold value for all the memory monitoring faults.

Examples

firepower# scope monitoring
firepower /monitoring # scope health-monitoring-policy
firepower /monitoring/health-monitoring-policy # scope stats-collection-memory
firepower /monitoring/health-monitoring-policy/stats-collection-memory # set fault-threshold 75
firepower /monitoring/health-monitoring-policy/stats-collection-memory # disable
firepower /monitoring/health-monitoring-policy/stats-collection-memory* # commit-buffer
firepower /monitoring/health-monitoring-policy/stats-collection-memory # show
Memory stats collection policy:
Admin State Fault-Threshold (%)
-----------
Disabled 75
firepower /monitoring/health-monitoring-policy/stats-collection-memory # show detail
Admin State: Disabled
Fault Threshold (%): 75

CPU usage metrics

CPU stats collected can be enabled or disabled using the cli under scope ‘stats-collection-cpu'. By default it is enabled.

Also fault threshold can be set for all cpu monitoring faults. The threshold-value can range between 50-99. By default it is set at 90%.

scope health-monitoring-policy

scope stats-collection-cpu

enable | disable

set fault-threshold <threshold-value>

Command Modes

Monitoring mode

Command History

Release

Modification

2.11.1

This command was introduced.

Usage Guidelines

This command enables or disables CPU monitoring and also changes the fault threshold value for all the CPU monitoring faults.

Examples

firepower# scope monitoring
firepower /monitoring # scope health-monitoring-policy
firepower /monitoring/health-monitoring-policy # scope stats-collection-cpu
firepower /monitoring/health-monitoring-policy/stats-collection-cpu # set fault-threshold 85
firepower /monitoring/health-monitoring-policy/stats-collection-cpu # enable
firepower /monitoring/health-monitoring-policy/stats-collection-cpu * # commit-buffer
firepower /monitoring/health-monitoring-policy/stats-collection-cpu # show
Cpu stats collection policy:
Admin State Fault-Threshold (%)
-----------
Enabled 85
firepower /monitoring/health-monitoring-policy/stats-collection-cpu # show detail
Admin State: Enabled
Fault Threshold (%): 85

scope hw-crypto

To enable or disable TLS crypto acceleration on a container instance, use the scope hw-crypto command. For more information about TLS crypto acceleration, see the Management Center Configuration Guide.

scope hw-crypto

Command Modes

connect module

Command History

Release

Modification

2.7.1

This command was introduced.

Usage Guidelines

This command enables or disables TLS crypto acceleration on a container instance.

Examples

Following is an example of enabling TLS crypto acceleration on a container instance:

scope ssa
/ssa # show app-instance

App Name   Identifier Slot ID    Admin State Oper State       Running Version Startup Version Deploy Type Turbo Mode Profile Name Cluster State   Cluster Role
---------- ---------- ---------- ----------- ---------------- --------------- --------------- ----------- ---------- ------------ --------------- ------------
ftd        FTD-FDM    1          Enabled     Online           6.5.0.1159      6.5.0.1159      Native      No                      Not Applicable  None
ftd        ftd2       2          Enabled     Online           6.5.0.1159      6.5.0.1159      Container   No         Default-Small Not Applicable  None

/ssa # sc slot 2
/ssa/slot # scope app-instance ftd ftd2
/ssa/slot/app-instance # scope hw-crypto
/ssa/slot/app-instance/hw-crypto # set admin-state enabled
 /ssa/slot/app-instance/hw-crypto* # commit-buffer

Following is an example of disabling TLS crypto acceleration on a container instance:

scope ssa
/ssa # show app-instance

App Name   Identifier Slot ID    Admin State Oper State       Running Version Startup Version Deploy Type Turbo Mode Profile Name Cluster State   Cluster Role
---------- ---------- ---------- ----------- ---------------- --------------- --------------- ----------- ---------- ------------ --------------- ------------
ftd        FTD-FDM    1          Enabled     Online           6.5.0.1159      6.5.0.1159      Native      No                      Not Applicable  None
ftd        ftd2       2          Enabled     Online           6.5.0.1159      6.5.0.1159      Container   No         Default-Small Not Applicable  None

/ssa # sc slot 2
/ssa/slot # scope app-instance ftd ftd2
 /ssa/slot/app-instance # scope hw-crypto
 /ssa/slot/app-instance/hw-crypto # set admin-state disbled
 /ssa/slot/app-instance/hw-crypto* # commit-buffer

scope import-config

To enter an existing import-configuration object, use the scope import-config command.

scope import-config hostname

Syntax Description

hostname The identifier of the import-configuration object; this is the name or IP address of the remote server on which the configuration resides.

Command History

Release Modification

1.1.(1)

Command added.

Usage Guidelines

An export-configuration object is created when you issue an export-config command to back up the current logical device and platform configuration; the import-config command is used to import a previously exported configuration file, while simultaneously creating an import-configuration object.

You can use scope import-config to enter an existing import-configuration object and edit its parameters. There are no create or enter commands associated with import-configuration objects. There is a delete command available which you can use to delete an import-configuration object.

Examples

This example shows how to scope into an existing import-configuration object:

firepower # scope system
firepower /system # scope import-config 192.168.1.2
firepower /system/import-config #

scope info-policy

To enter system info policies in configuration mode, use the scope info-policy command.

scope info-policy

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope system

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter info policy mode:

firepower # scope system
firepower /system # scope info-policy
firepower /system/info-policy #

scope interface

To enter configuration mode for a specific interface, use the scope interface command.

scope interface { Ethernetslot_id/port_id| slot_num}

Syntax Description

Ethernetslot_id/port_id

The Ethernet port name.

slot_num The interface slot number.

Command Modes

scope eth-uplink/scope fabric a/

Command History

Release

Modification

1.1.1

Command added.

Examples

This example shows how to scope into configuration mode for a specific interface and view its current configuration:

firepower # scope eth-uplink
firepower /eth-uplink # scope fabric a
firepower /eth-uplink/fabric # scope interface Ethernet1/5
firepower /eth-uplink/fabric/interface # show detail

Interface:
    Port Name: Ethernet1/5
    User Label:
    Port Type: Data
    Admin State: Enabled
    Oper State: Up
    State Reason:
    flow control policy: default
    Auto negotiation: No
    Admin Speed: 1 Gbps
    Oper Speed: 1 Gbps
    Admin Duplex: Full Duplex
    Oper Duplex: Full Duplex
    Ethernet Link Profile name: default
    Oper Ethernet Link Profile name: fabric/lan/eth-link-prof-default
    Udld Oper State: Admin Disabled
    Inline Pair Admin State: Enabled
    Inline Pair Peer Port Name:
    Allowed Vlan: All
    Network Control Policy: default
    Current Task:
firepower /eth-uplink/fabric/interface #

scope ipsec

To enter IPSec mode, use the scope ipsec command.

scope ipsec

Syntax Description

This command has no arguments or keywords.

Command Modes

Security mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter IPSec mode:

FP9300-A# scope security
FP9300-A /security # scope ipsec
FP9300-A /security/ipsec # 

scope ipv6-config

To enter IPv6 configuration mode, where you can configure the fabricʼs IPv6 management interface, use the scope ipv6-config command in fabric interconnect mode.

scope ipv6-config

Syntax Description

This command has no arguments or keywords.

Command Modes

Fabric interconnect mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter IPv6 configuration mode:

FP9300-A# scope fabric-interconnect a
FP9300-A /fabric-interconnect # scope ipv6-config
FP9300-A /fabric-interconnect/ipv6-config # 

scope ldap

To enter Lightweight Directory Access Protocol (LDAP) configuration mode, use the scope ldap command.

scope ldap

Syntax Description

This command has no arguments or keywords.

Command Modes

scope security/

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter LDAP mode:

firepower# scope security
firepower /security # scope ldap
firepower /security/ldap # 

scope licdebug

To enter license debug mode from license mode, use the scope licdebug command.

scope licdebug

Syntax Description

This command has no arguments or keywords.

Command Modes

License mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter license debug mode from license mode:

FP9300-A # scope license
FP9300-A /license # scope licdebug
FP9300-A /license/licdebug # 

scope license

To enter license mode, use the scope license command.

scope license

Syntax Description

This command has no arguments or keywords.

Command Modes

Any command mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter license mode from EXEC level:

FP9300-A# scope license
FP9300-A /license # 

scope mem-leak-logging

To enable the stack trace state to detect the memory leak of each UCSM process, use the scope mem-leak-logging command.

scope mem-leak-logging set

Syntax Description

set

set memory leak logging for the knob.

Command Modes

scope monitoring/scope sysdebug

Usage Guidelines

Use this command to enable the memory leak feature to debug memory leak issues for the specified process and to enable the stack trace.

Examples

This example shows how to set the knob state and enable stack trace mode:

Firepower#scope monitoring
Firepower /monitoring# scope sysdebug                                        
Firepower /monitoring/sysdebug#  scope mem-leak-logging
Firepower /monitoring/sysdebug/mem-leak-logging # set  ?
  appag-log               Memory Leak Logging for appAG 
  bladeag-log            Memory Leak Logging for bladeAG 
  dcosag-log             Memory Leak Logging for dcosAG 
  dme-log                 Memory Leak Logging for dme 
  extvmmag-log       Memory Leak Logging for extvmmAG 
  hostagentag-log     Memory Leak Logging for hostagentAG 
  licenseag-log         Memory Leak Logging for licenseAG 
  nicag-log               Memory Leak Logging for nicAG 
  portag-log              Memory Leak Logging for portAG 
  rsdag-log                Memory Leak Logging for rsdAG 
  serviceorchag-log   Memory Leak Logging for serviceOrchAG 
  sessionmgrag-log   Memory Leak Logging for sessionmgrAG 
  statsag-log              Memory Leak Logging for statsAG 
  svcmonag-log        Memory Leak Logging for svcmonAG 
Firepower /monitoring/sysdebug/mem-leak-logging # set statsag-log enable ?
  <CR>
  stacktrace  Stacktrace for Memory Leak Report
Firepower /monitoring/sysdebug/mem-leak-logging # set statsag-log enable stacktrace ?
  off  Off
  on   On

scope monitoring

To enter system monitoring mode, use the scope monitoring command.

scope monitoring

Syntax Description

This command has no arguments or keywords.

Command Modes

Any command mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter monitoring mode:

FP9300-A#scope monitoring
FP9300-A /monitoring #

scope network-features

To enter network features in configuration mode, use the scope network-features command.

scope network-features

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope system

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter network features mode:

firepower # scope system
firepower /system # scope network-features
firepower /system/network-features* # show

scope org

To enter organization mode, use the scope org command.

scope org [ org_name]

Syntax Description

org_name

(Optional) The organization name.

Command Modes

Any command mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter organization mode:

FP9300-A# scope org org100
FP9300-A /org #

scope packet-capture

To enter packet capture mode, use the scope packet-capture command.

scope packet-capture

Syntax Description

This command has no arguments or keywords.

Command Modes

Any command mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter packet capture mode:

FP9300-A#scope packet-capture
FP9300-A /monitoring #

scope password-profile

To enter password profile mode, use the scope password-profile command.

scope password-profile

Syntax Description

This command has no arguments or keywords.

Command Modes

Security mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter password profile security mode:

FP9300-A # scope security
FP9300-A /security # scope password-profile
FP9300-A /security/password-profile #

scope profile

To enter Smart Call Home and Smart Licensing destination profile mode, use the scope profile command.

scope profile profile_name

Syntax Description

profile_name

The name of the destination profile; between 1 and 16 characters.

Command Modes

Callhome (/monitoring/callhome/) mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter profile mode and then display the destination configured for the profile:

FP9300-A /monitoring/callhome # scope profile SLProfile
FP9300-A /monitoring/callhome/profile # show destination

Destination:
    Name       Transport Protocol Email or HTTP/HTTPS URL Address
    ---------- ------------------ -------------------------------
    SLDest     Https              https://tools.cisco.com/its/service/oddce/services/DDCEService
FP9300-A /monitoring/callhome/profile #

scope qos

To enter qos mode, use the scope qos command.

scope qos

Syntax Description

This command has no arguments or keywords.

Command Modes

scope eth-server

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

In qos mode, you can distinguish the traffic, queuing bandwidth for each packet, regardless of packet, and size.

Examples

This example shows how to enter qos mode.

Firepower# scope eth-server
Firepower /eth-server # scope qos
Firepower /eth-server/qos #

scope radius

To enter Remote Authentication Dial-In User Service (RADIUS) configuration mode, use the scope radius command.

scope radius

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope security

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter radius mode:

firepower # scope security
firepower /security # scope radius
firepower /security/radius #

scope reservation

To enter license reservation mode, use the scope reservation command.

scope reservation

Syntax Description

This command has no arguments or keywords.

Command Modes

License mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter reservation mode from license mode:

FP9300-A# scope license
FP9300-A /license # scope reservation
FP9300-A /license/reservation # 

scope security

To enter security mode, use the scope security command.

scope security

Syntax Description

This command has no arguments or keywords.

Command Modes

Any command mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter security mode:

firepower# scope security
firepower /security #

scope server

To enter server mode, use the scope server command.

scope server { id| dynamic_uuid| chassis_id/ blade_id}

Syntax Description

id

The server ID; an integer between 1 and 255.

dynamic_uid

The server’s dynamic universally unique ID (UUID).

chassis_id/ blade_id

The server specified using chassis and blade IDs; must be entered in n/n format.

Note

 

The chassis ID is always 1.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter server mode:

FP9300-A# scope server 1/1
FP9300-A /chassis/server #

scope server-features

To enter server features in configuration mode, use the scope server-features command.

scope server-features

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope system

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter server features mode:

firepower # scope system
firepower /system # scope server-features
firepower /system/server-features* # show

scope service-profile

To enter service profile mode, use the scope service-profile command.

scope service-profile { dynamic_uuid| org| server}

Syntax Description

dynamic_uuid

The dynamic UUID of the service profile.

org

The name of the organization for which the service profile was created; between 1 and 16 characters.

server

The ID of the server for which the service profile was created.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

To use this command with the org option, an organization and a service profile for that organization must already exist.

To use this command with the server option, the server can be specified with its server ID, or the chassis ID and blade ID (n/n format). The chassis ID is always 1.

Examples

This example shows how to enter service profile mode:

firepower # scope service-profile server 1/1
firepower /org/service-profile #

scope services

To enter system services in configuration mode, use the scope services command.

scope services

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope system

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter services mode:

firepower # scope system
firepower /system # scope services
firepower /system/services #

scope slot

To enter slot mode for a specific SSP module, use the scope slot command.

scope slot slot_ID

Syntax Description

slot_ID/ id

Identifies the module slot. For the FP9300, this value can be 1, 2, or 3; on the FP4100, this value is 1.

Command Modes

scope ssa/

Command History

Release Modification

1.1(1)

Command added.

Usage Guidelines

In slot mode, you can update the application image on the logical device.

Examples

This example shows how to enter slot mode:

firepower# scope ssa
firepower /ssa # scope slot 2
firepower /ssa/slot # 

scope ssa

To enter security services (ssa) mode, use the scope ssa command.

scope ssa

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter ssa mode:

FP9300-A# scope ssa
FP9300-A /ssa #

scope stats-collection-policy

To enter the statistics collection policy for one of the functional areas of your system, use the scope stats-collection-policy command.

scope stats-collection-policy policy-area

Syntax Description

policy-area

The specific collection policy area:

  • Adapter – statistics related to the adapters.

  • Chassis – statistics related to the blade chassis.

  • FEX – statistics related to configured Fabric Extender(s).

  • Host – this policy is a placeholder for future support.

  • Port – statistics related to the ports, including server ports, uplink Ethernet ports, and uplink Fibre Channel ports.

  • Server – statistics related to servers.

Command Modes

scope monitoring/

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

Statistics can be collected and reported for several of the functional areas of your system.

Use the set collection-interval command to define how frequently statistics are collected, and use the set reporting-interval command to define how frequently the statistics are reported. These intervals define a statistics collection policy.

Reporting intervals are longer than collection intervals so that multiple statistical data points can be collected during the reporting interval, which provides sufficient data to calculate and report minimum, maximum, and average values.


Note


There is one default statistics collection policy for each of the functional areas. You cannot create additional statistics collection policies and you cannot delete the existing default policies. You can only modify the default policies.


Examples

This example shows how to enter the statistics collection policy for ports, set the collection interval to one minute, set the reporting interval to 30 minutes, and then commit the transaction:

firepower # scope monitoring
firepower /monitoring # scope stats-collection-policy port
firepower /monitoring/stats-collection-policy # set collection-interval 1minute
firepower /monitoring/stats-collection-policy* # set reporting-interval 30minute
firepower /monitoring/stats-collection-policy* # commit-buffer
firepower /monitoring/stats-collection-policy #

scope stats-threshold-policy

To enter the statistics threshold policy for one of the components of your system, use the scope stats-threshold-policy command.

scope stats-threshold-policy policy-name

Syntax Description

policy-name

The name of the specific threshold policy to enter.

You cannot create or delete a statistics threshold policy for Ethernet server ports or Ethernet uplink ports. You can only configure the existing default policy, so for these policies, enter default as the policy-name .

Command Modes

scope eth-server/

scope eth-uplink/

scope org/

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

A statistics threshold policy monitors statistics about certain aspects of the system and generates an event if a specified threshold is crossed. You can set both minimum and maximum thresholds. For example, you can configure the policy to raise an alarm if the CPU temperature exceeds a certain value, or if a server is overutilized or underutilized.

There is one default statistics threshold policy each for Ethernet server ports or Ethernet uplink ports. You cannot create additional statistics threshold policies and you cannot delete the existing default policies for these components—you can only modify the default policies.

However, you can create and delete statistics threshold policies in organization mode (scope org/). See the create stats-threshold-policy command for more information.


Note


Use the set collection-interval command to define how frequently statistics are collected, and use the set reporting-interval command to define how frequently the statistics are reported. These intervals define a statistics collection policy.


Examples

This example shows how to scope into the default Ethernet uplink statistics threshold policy, create an error statistics class, create a cyclic redundancy check (CRC) error count property, specify that the normal CRC error count per polling interval is 1000, create an above normal warning threshold of 1250, and then commit the class:

firepower # scope eth-uplink
firepower /eth-uplink # scope stats-threshold-policy default
firepower /eth-uplink/stats-threshold-policy # create class ether-error-stats
firepower /eth-uplink/stats-threshold-policy/class* # create property crc-delta
firepower /eth-uplink/stats-threshold-policy/class/property* # set normal-value 1000
firepower /eth-uplink/stats-threshold-policy/class/property* # create threshold-value above-normal warning
firepower /eth-uplink/stats-threshold-policy/class/property/threshold-value* # set escalating 1250
firepower /eth-uplink/stats-threshold-policy/class/property/threshold-value* # commit-buffer
firepower /eth-uplink/stats-threshold-policy/class/property/threshold-value #

This example shows how to scope into organization mode, create a new statistics threshold policy for server and server component statistics, create a threshold policy class for CPU environment statistics, create a CPU temperature property, specify that the normal CPU temperature is 48.5° C, create an above normal warning threshold of 50° C, and commit the entire transaction:

firepower # scope org
firepower /org # create stats-threshold-policy ServStatsPolicy
firepower /org/stats-threshold-policy* # create class cpu-env-stat
firepower /org/stats-threshold-policy/class* # create property temperature
firepower /org/stats-threshold-policy/class/property* # set normal-value 48.5
firepower /org/stats-threshold-policy/class/property* # create threshold-value above-normal warning
firepower /org/stats-threshold-policy/class/property/threshold-value* # set escalating 50.0
firepower /org/stats-threshold-policy/class/property/threshold-value* # commit-buffer
firepower /org/stats-threshold-policy/class/property/threshold-value #

Examples

This example shows how to scope into the default ethernet server statistics threshold policy.

Firepower# scope eth-server
Firepower /eth-server # scope stats-threshold-policy default
Firepower /eth-server/stats-threshold-policy #

scope storage-features

To enter storage features in configuration mode, use the scope storage-features command.

scope storage-features

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope system

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter storage features mode:

firepower # scope system
firepower /system # scope environment-features
firepower /system/environment-features # show

scope system

To enter system-management mode, use the scope system command.

scope system

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release

Modification

1.1(1)

Command added.

Usage Guidelines

In this mode, you can manage the system configuration, including exporting and importing a configuration file.

Examples

This example shows how to enter system-management mode:

firepower# scope system
firepower /system # 

scope tacacs

To enter Terminal Access Controller Access Control System (TACACS) configuration mode, use thescope tacacs command.

scope tacacs

Syntax Description

This command has no arguments or keywords.

Command Modes

Scope security

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object

Examples

This example shows how to enter tacacs mode:

firepower # scope security
firepower /security # scope tacacs
firepower /security/tacacs #

scope telemetry

To enter telemetry mode, use the scope telemetry command.

scope telemetry

Syntax Description

This command has no arguments or keywords.

Command Modes

scope system, scope services

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You can use the enable or disable and show commands

scope vnic

To enter virtual NIC mode, use the scope vnic command.

scope vnic dynamic_mac

Syntax Description

dynamic_mac

The virtual NICʼs dynamic MAC address.

Command Modes

EXEC mode

Service profile mode

Command History

Release

Modification

1.1(1)

Command added.

Examples

This example shows how to enter virtual NIC mode while in organization mode:


FP9300-A # scope org org10
FP9300-A /org # scope service-profile sp10
FP9300-A /org/service-profile # scope vnic vNIC10 
FP9300-A /org/service-profile/vnic # 

sub scopes (scope fabric-interconnect)

To enter switch uplink mode, use the scope sw-uplink command in scope fabric interconnect mode.

scope sw-uplink

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC mode

Command History

Release

Modification

2.3.1

Command added.

Usage Guidelines

You do not have to enter this mode with a managed object.

Examples

This example shows how to enter sw-uplink mode:

firepower# scope fabric-interconnect
firepower /fabric-interconnect # scope sw-uplink
firepower /fabric-interconnect/sw-uplink #