Usage Guidelines

Add DNS servers using the name-server command.

This command replaces the dns name-server command.

Usage Guidelines

When you subscribe to the Cisco Cloud Web Security service, you are assigned a primary Cloud Web Security proxy server and backup proxy server.

If any client is unable to reach the primary server, then the ASA starts polling the tower to determine availability. (If there is no client activity, the ASA polls every 15 minutes.) If the proxy server is unavailable after a configured number of retries (the default is 5; this setting is configurable), the server is declared unreachable, and the backup proxy server becomes active.

If a client or the ASA can reach the server at least twice consecutively before the retry count is reached, the polling stops and the tower is determined to be reachable.

The retry count also applies to application health checking if you enable it.

After a failover to the backup server, the ASA continues to poll the primary server. If the primary server becomes reachable, then the ASA returns to using the primary server.

Usage Guidelines

Use the retry-interval command to specify or reset the number of seconds the ASA waits between connection attempts. Use the timeout command to specify the length of time during which the ASA attempts to make a connection to a AAA server.

This command does not apply to servers in an RSA SecurID REST API server group.

Note

For the RADIUS protocol, if the server responds with an ICMP Port Unreachable message, the retry-interval setting is ignored and the AAA server is immediately moved to the failed state. If this is the only server in the AAA group, it is reactivated and another request is sent to it. This is the intended behavior.

Usage Guidelines

The ASA starts the revalidation timer after each successful posture validation. The expiration of this timer triggers the next unconditional posture validation. The ASA maintains posture validation during revalidation. The default group policy becomes effective if the Access Control Server is unavailable during posture validation or revalidation.

Usage Guidelines

Use the revert webvpn all command to disable and remove all web-related information (customization, plug-in, translation table, URL list, and web content) from the flash memory of the ASA. Removal of all web-related data returns default settings when applicable.

Usage Guidelines

For detailed procedures for customizing the Secure Client GUI, see the AnyConnect VPN Client Administrator Guide.

Usage Guidelines

Use the revert webvpn customization command to remove Clientless SSL VPN support for the specified customization and to remove it from the cache memory on the ASA. Removal of a customization object returns default settings when applicable. A customization object contains the configuration parameters for a specific, named portal page.

Version 8.0 software extends the functionality for configuring customization, and the new process is incompatible with previous versions. During the upgrade to 8.0 software, the security appliance preserves a current configuration by using old settings to generate new customization objects. This process occurs only once, and is more than a simple transformation from the old format to the new one because the old values are only a partial subset of the new ones.

Note	Version 7.2 portal customizations and URL lists work in the Beta 8.0 configuration only if clientless SSL VPN (WebVPN) is enabled on the appropriate interface in the Version 7.2(x) configuration file before you upgrade to Version 8.0.

Usage Guidelines

Use the revert webvpn plug-in protocol command to disable and remove Clientless SSL VPN support for the specified Java-based client application, as well as to remove it from the flash drive of the ASA.

Usage Guidelines

Use the revert webvpn translation-table command to disable and remove an imported translation table and to remove it from the flash memory. Removal of a translation table returns default settings when applicable.

Usage Guidelines

Use the revert webvpn url-list command to disable and remove a current URL list from the flash drive of the ASA. Removal of a url-list returns default settings when applicable.

The template argument used with the revert webvpn url-list command specifies the name of a previously configured list of URLs. To configure such a list, use the url-list command in global configuration mode.

Usage Guidelines

Use the revert webvpn content command to disable and remove a file containing the web content and to remove it from the flash memory of the ASA. Removal of web content returns default settings when applicable.

Usage Guidelines

The signer of the OCSP response is usually the OCSP server (responder) certificate. After receiving the response, devices try to verify the responder certificate.

Normally a CA sets the lifetime of its OCSP responder certificate to a relatively short period to minimize the chance of compromising its security. The CA includes an ocsp-no-check extension in the responder certificate that indicates it does not need revocation status checking. But if this extension is not present, the device tries to check the certificate revocation status using the revocation methods you configure for the trustpoint with this revocation-check command. The OCSP responder certificate must be verifiable if it does not have an ocsp-no-check extension since the OCSP revocation check fails unless you also set the none option to ignore the status check.

Note	With any permutation of the optional arguments, none must be the last keyword used.

The ASA tries the methods in the order in which you configure them, trying the second and third methods only if the previous method returns an error (for example, server down), instead of finding the status as revoked.

You can set a revocation checking method in the client certificate validating trustpoint and also configure no revocation checking (revocation-check none) in the responder certificate validating trustpoint. See the match certificate command for a configuration example.

If you have configured the ASA with the revocation-check crl none command, when a client connects to the ASA, it automatically starts downloading the CRL because it has not been cached, then validates the certificate, and finishes downloading the CRL. In this case, if the CRL is not cached, the ASA validates the certificate before downloading the CRL.

The following options for bypassing revocation checking, which was removed in ASA 9.13(1), was later restored:

When you are assigning OCSP URL for revocation checking, you can specify the management interface from where the OCSP is reachable. This interface value determines the routing decision.

Usage Guidelines

The ASA performs content rewriting for applications to insure that they render correctly over WebVPN connections. Some applications do not require this processing, such as external public websites. For these applications, you might choose to turn off content rewriting.

You can turn off content rewriting selectively by using the rewrite command with the disable option to let users browse specific sites directly without going through the ASA. This is similar to split-tunneling in IPsec VPN connections.

You can use this command multiple times. The order in which you configure entries is important because the ASA searches rewrite rules by order number and applies the first rule that matches.

Usage Guidelines

Reauthentication on IKE rekey applies only to IPsec connections.

If you enable reauthentication on IKE rekey, the ASA prompts the user to enter a username and password during initial Phase 1 IKE negotiation and also prompts for user authentication whenever an IKE rekey occurs. Reauthentication provides additional security.

The user has 30 seconds to enter credentials, and up to three attempts before the SA expires at approximately two minutes and the tunnel terminates. Use the extended keyword to allow users to reenter authentication credentials until the maximum lifetime of the configured SA.

To check the configured rekey interval, in monitoring mode, issue the show crypto ipsec sa command to view the security association lifetime in seconds and lifetime in kilobytes of data.

Note	The reauthentication fails if there is no user at the other end of the connection.

Usage Guidelines

If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.

Use the show interface command to view the rip authentication commands on an interface.

Usage Guidelines

If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates. When you enable neighbor authentication, you must ensure that the key and key_id arguments are the same as those used by neighbor devices that provide RIP version 2 updates. The key is a text string of up to 16 characters.

Use the show interface command to view the rip authentication commands on an interface.

Usage Guidelines

You can override the global setting on a per-interface basis by entering the rip receive version command on an interface.

If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.

Usage Guidelines

You can override the global RIP send version setting on a per-interface basis by entering the rip send version command on an interface.

If you specify RIP version 2, you can enable neighbor authentication and use MD5-based encryption to authenticate the RIP updates.

Usage Guidelines

If the directory is not empty, the rmdir command fails.

Usage Guidelines

Use the route command to enter a default or static route for an interface. To enter a default route, set ip_address and netmask to 0.0.0.0, or use the shortened form of 0 . All routes that are entered using the route command are stored in the configuration when it is saved.

You can define a separate default route for tunneled traffic along with the standard default route. When you create a default route with the tunneled option, all traffic from a tunnel terminating on the ASA that cannot be routed using learned or static routes, is sent to this route. For traffic emerging from a tunnel, this route overrides over any other configured or learned default routes.

The following restrictions apply to default routes with the tunneled option:

• Do not enable unicast RPF (ip verify reverse-path ) on the egress interface of a tunneled route. Enabling uRPF on the egress interface of a tunneled route causes the session to fail.

• Do not enable TCP intercept on the egress interface of the tunneled route, because the session will fail.

• Do not use the VoIP inspection engines (CTIQBE, H.323, GTP, MGCP, RTSP, SIP, SKINNY), the DNS inspect engine, or the DCE RPC inspection engine with vlan mapping options or tunneled routes. These inspection engines ignore the vlan-mapping setting which could result in packets being incorrectly routed.

You cannot define more than one default route with the tunneled option; ECMP for tunneled traffic is not supported.

Create static routes to access networks that are connected outside a router on any interface. For example, the ASA sends all packets that are destined to the 192.168.42.0 network through the 192.168.1.5 router with the following static route command.

ciscoasa(config)# route dmz 192.168.42.0 255.255.255.0 192.168.1.5 1

After you enter the IP address for each interface, the ASA creates a CONNECT route in the route table. This entry is not deleted when you use the clear route or clear configure route commands.

Unlike with ACLs, static null0 routes do not cause any performance degradation. The null0 configuration is used to prevent routing loops. BGP leverages the null0 configuration for Remotely Triggered Black Hole routing.

Usage Guidelines

Use route maps to redistribute routes

Use the route-map global configuration command, and the match and set route-map configuration commands, to define the conditions for redistributing routes from one routing protocol into another. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which redistribution is allowed for the current route-map command. The set commands specify the set actions—the particular redistribution actions to perform if the criteria enforced by the match commands are met. The no route-map command deletes the route map.

The match route-map configuration command has multiple formats. The match commands can be given in any order, and all match commands must "pass" to cause the route to be redistributed according to the set actions given with the set commands. The no forms of the match commands remove the specified match criteria.

Use route maps when you want detailed control over how routes are redistributed between routing processes. The destination routing protocol is the one you specify with the router global configuration command. The source routing protocol is the one you specify with the redistribute router configuration command. See the "Examples" section for an illustration of how route maps are configured.

When you are passing routes through a route map, a route map can have several parts. Any route that does not match at least one match clause relating to a route-map command will be ignored; that is, the route will not be advertised for outbound route maps and will not be accepted for inbound route maps. If you want to modify only some data, you must configure a second route map section with an explicit match specified.

The sequence-number argument works as follows:

1. If no entry is defined with the route-map name, an entry is created with the sequence-number argument set to 10.

2. If only one entry is defined with the route-map name, that entry becomes the default entry for the following route-map command. The sequence-number argument of this entry is unchanged.

3. If more than one entry is defined with the route-map name, an error message is printed to indicate that the sequence-number argument is required.

4. If the no route-map name command is specified (with no sequence-number argument), the whole route map is deleted.

Usage Guidelines

When you use the route priority high command to tag higher priority IS-IS IP prefixes for faster processing and installation in the global routing table, you can achieve faster convergence. For example, you can help Voice over IP (VoIP) gateway addresses get processed first to help VoIP traffic get updated faster than other types of packets.

Usage Guidelines

This command can be configured in an IP Options inspection policy map.

You can configure IP Options inspection to control which IP packets with specific IP options are allowed through the ASA. You can allow a packet to pass without change or clear the specified IP options and then allow the packet to pass.

The Router Alert (RTRALT) or IP Option 20 notifies transit routers to inspect the contents of the packet even when the packet is not destined for that router. This inspection is valuable when implementing RSVP and similar protocols require relatively complex processing from the routers along the packets delivery path.

Usage Guidelines

This command allows you to set up a distributed routing core that automatically guarantees the loop-free exchange of routing information between autonomous systems.

Prior to January 2009, BGP autonomous system numbers that were allocated to companies were 2-octetnumbers in the range from 1 to 65535 as described in RFC 4271, A Border Gateway Protocol 4 (BGP-4).

Due to increased demand for autonomous system numbers, the Internet Assigned Number Authority (IANA) allocates four-octet autonomous system numbers in the range from 65536 to 4294967295.

RFC 5396, Textual Representation of Autonomous System (AS) Numbers, documents three methods of representing autonomous system numbers. Cisco has implemented the following two methods:

• Asplain—Decimal value notation where both 2-byte and 4-byte autonomous system numbers are represented by their decimal value. For example, 65526 is a 2-byte autonomous system number and 234567 is a 4-byte autonomous system number.

• Asdot—Autonomous system dot notation where 2-byte autonomous system numbers are represented by their decimal value and 4-byte autonomous system numbers are represented by a dot notation. For example, 65526 is a 2-byte autonomous system number and 1.169031 is a 4-byte autonomous system number (this is dot notation for the 234567 decimal number).

For details about the third method of representing autonomous system numbers, see RFC 5396.

Usage Guidelines

The router eigrp command creates an EIGRP routing process or enters router configuration mode for an existing EIGRP routing process. You can only create a single EIGRP routing process on the ASA.

Use the following router configuration mode commands to configure the EIGRP routing processes:

• auto-summary —Enable/disable automatic route summarization.

• default-information —Enable/disable the reception and sending of default route information.

• default-metric —Define the default metrics for routes redistributed into the EIGRP routing process.

• distance eigrp —Configure the administrative distance for internal and external EIGRP routes.

• distribute-list —Filter the networks received and sent in routing updates.

• eigrp log-neighbor-changes —Enable/disable the logging of neighbor state changes.

• eigrp log-neighbor-warnings —Enable/disable the logging of neighbor warning messages.

• eigrp router-id —Creates a fixed router ID.

• eigrp stub —Configures the ASA for stub EIGRP routing.

• neighbor —Statically define an EIGRP neighbor.

• network —Configure the networks that participate in the EIGRP routing process.

• passive-interface —Configure an interface to act as a passive interface.

• redistribute —Redistribute routes from other routing processes into EIGRP.

Use the following interface configuration mode commands to configure interface-specific EIGRP parameters:

• authentication key eigrp —Define the authentication key used for EIGRP message authentication.

• authentication mode eigrp —Define the authentication algorithm used for EIGRP message authentication.

• delay —Configure the delay metric for an interface.

• hello-interval eigrp —Change the interval at which EIGRP hello packets are sent out of an interface.

• hold-time eigrp —Change the hold time advertised by the ASA.

• split-horizon eigrp —Enable/disable EIGRP split-horizon on an interface.

• summary-address eigrp —Manually define a summary address.

Usage Guidelines

By default, the ASA uses the highest-level IP address on an interface that is covered by a network command in the OSPF configuration. If the highest-level IP address is a private address, then that address is sent in hello packets and database definitions. To use a specific router ID, use the router-id command to specify a global address for the router ID.

Router IDs must be unique within an OSPF routing domain. If two routers in the same OSPF domain are using the same router ID, routing may not work correctly.

You should enter the router-id command before entering network commands in an OSPF configuration. This prevents possible conflicts with the default router ID generated by the ASA. If you do have a conflict, you will receive the message:

ERROR: router-id id  in use by ospf process pid 

To enter the conflicting ID, remove the network command that contains the IP address causing the conflict, enter the router-id command, and then re-enter the network command.

Clustering

In Layer 2 clustering, you either need to configure the router-id id command or leave the router ID blank, provided all units receive the same router ID.

Usage Guidelines

Router IDs must be unique within an OSPFv2 or OSPFv3 routing domain in clustering. If two routers in the same OSPFv2 or OSPFv3 domain are using the same router ID, routing in clustering may not work correctly.

In Layer 2 clustering, you either need to configure the router-id id command or leave the router ID blank, provided all units receive the same router ID.

When a Layer 3 cluster interface is configured, each unit must have a unique interface IP address. To make sure that each unit has a unique interface IP address, you can configure a local pool of IP addresses for OSPFv2 or OSPFv3 with the router-id cluster-pool command.

Usage Guidelines

This command is used to enable IS-IS routing for an area. An appropriate network entity title (NET) must be configured to specify the area address of the area and system ID of the ASA. Routing must be enabled on one or more interfaces before adjacencies may be established and dynamic routing is possible. See the Related Commands table for a list of commands used to configure IS-IS.

Usage Guidelines

The router ospf command is the global configuration command for OSPF routing processes running on the ASA. Once you enter the router ospf command, the command prompt appears as (config-router)#, indicating that you are in router configuration mode.

When using the no router ospf command, you do not need to specify optional arguments unless they provide necessary information. The no router ospf command terminates the OSPF routing process specified by its pid. You assign the pid locally on the ASA. You must assign a unique value for each OSPF routing process.

The router ospf command is used with the following OSPF-specific commands to configure OSPF routing processes:

• area —Configures a regular OSPF area.

• compatible rfc1583 —Restores the method used to calculate summary route costs per RFC 1583.

• default-information originate —Generates a default external route into an OSPF routing domain.

• distance —Defines the OSPF route administrative distances based on the route type.

• ignore —Suppresses the sending of syslog messages when the router receives a link-state advertisement (LSA) for type 6 Multicast OSPF (MOSPF) packets.

• log-adj-changes —Configures the router to send a syslog message when an OSPF neighbor goes up or down.

• neighbor —Specifies a neighbor router. Used to allow adjacency to be established over VPN tunnels.

• network —Defines the interfaces on which OSPF runs and the area ID for those interfaces.

• redistribute —Configures the redistribution of routes from one routing domain to another according to the parameters specified.

• router-id —Creates a fixed router ID.

• summary-address —Creates the aggregate addresses for OSPF.

• timer lsa arrival — Defines the minimum interval (in msec) between accepting the same link-state advertisement (LSA) from OSPF neighbors.

• timer pacing flood — Defines the minimum interval (in msec) at which LSAs in the flooding queue are paced between updates.

• timer pacing lsa-group — Defines the interval (in sec) between groups of LSA being refreshed or managed.

• timer pacing retransmission — Defines the minimum interval (in msec) between neighbor retransmissions.

• timer throttle lsa — Defines the delay to generate the first occurrence of LSA (in milliseconds).

• timer throttle spf — Defines the delay between receiving a change to SPF calculation (in milliseconds).

• timer nsf wait —Defines the interface wait interval during NSF restart. The default value is 20 seconds. The permissible range is 1 to 65535 seconds.

Usage Guidelines

The router rip command is the global configuration command for configuring the RIP routing processes on the ASA. You can only configure one RIP process on the ASA. The no router rip command terminates the RIP routing process and removes all router configuration for that process.

When you enter the router rip command, the command prompt changes to ciscoasa(config-router)#, indicating that you are in router configuration mode.

The router rip command is used with the following router configuration commands to configure RIP routing processes:

• auto-summary —Enable/disable automatic summarization of routes.

• default-information originate —Distribute a default route.

• distribute-list in —Filter networks in incoming routing updates.

• distribute-list out —Filter networks in outgoing routing updates.

• network —Add/remove interfaces from the routing process.

• passive-interface —Set specific interfaces to passive mode.

• redistribute —Redistribute routes from other routing processes into the RIP routing process.

• version —Set the RIP protocol version used by the ASA.

Additionally, you can use the following commands in interface configuration mode to configure RIP properties on a per-interface basis:

• rip authentication key —Set an authentication key.

• rip authentication mode —Set the type of authentication used by RIP Version 2.

• rip send version —Set the version of RIP used to send updates out of the interface. This overrides the version set in global router configuration mode, if any.

• rip receive version —Set the version of RIP accepted by the interface. This overrides the version set in global router configuration mode, if any.

RIP is not supported in transparent mode. By default, the ASA denies all RIP broadcast and multicast packets. To permit these RIP messages to pass through an ASA operating in transparent mode you must define access list entries to permit this traffic. For example, to permit RIP version 2 traffic through the ASA, create an access list entry such as the following:

ciscoasa(config)# access-list myriplist extended permit ip any host 224.0.0.9

To permit RIP version 1 broadcasts, create an access list entry such as the following:

ciscoasa(config)# access-list myriplist extended permit udp any any eq rip

Apply these access list entries to the appropriate interface using the access-group command.

You can enable both RIP and OSPF routing on the ASA at the same time.

Usage Guidelines

Configure the RTP port range for the media termination point when you need to scale the number of calls that the Phone Proxy supports.