Feedback
Table Of Contents
Command Reference
This chapter provides detailed descriptions on each PIX Firewall command.
Before using this chapter, read:
•
"," for important information about command line guidelines including ports and protocols.
•
•
The following notes can help you as you configure the PIX Firewall:
•
•
•
•
•
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix
•
•
•
http://www.isi.edu/in-notes/iana/assignments/port-numbers
http://www.isi.edu/in-notes/iana/assignments/protocol-numbers
•
aaa
Enable, disable, or view TACACS+ or RADIUS user authentication, authorization, and accounting for the server previously designated with the aaa-server command. (Configuration mode.)
aaa accounting acctg_service |except inbound|outbound| if_name local_ip local_mask
foreign_ip foreign_mask group_tagno aaa accounting authen_service |except inbound | outbound | if_name group_tag
aaa authentication authen_service |except inbound|outbound| if_name local_ip local_mask
foreign_ip foreign_mask group_tagno aaa authentication [authen_service |except inbound|outbound | if_name local_ip local_mask foreign_ip foreign_mask group_tag
aaa authentication [serial |enable |telnet] console group_tag
no aaa authentication [serial|enable|telnet] console group_tag
aaa authorization author_service |except inbound| outbound| if_name
local_ip local_mask foreign_ip foreign_maskno aaa authorization [author_service |except inbound | outbound | if_name
local_ip local_mask foreign_ip foreign_mask]show aaa
Syntax Description
accounting
Enable or disable accounting services with authentication server. Use of this command requires that you previously used the aaa-server command to designate an authentication server.
acctg_service
The accounting service. Accounting is provided for all services or you can limit it to one or more services. Possible values are any, ftp, http, telnet, or protocol/port. Use any to provide accounting for all TCP services. To provide accounting for UDP services, use the protocol/port form.
For protocol/port, the TCP protocol appears as 6, the UDP protocol appears as 17, and so on, and port is the TCP or UDP destination port. A port value of 0 (zero) means all ports. For protocols other than TCP and UDP, the port is not applicable and should not be used.authentication
Enable or disable user authentication, prompt user for username and password, and verify information with authentication server.
When used with the console option, enables or disables authentication service for access to the PIX Firewall console over Telnet or from the Console connector on the PIX Firewall unit.
Use of the aaa authentication command requires that you previously used the aaa-server command to designate an authentication server.
authen_service
The application with which a user is accessing a network. Use any, ftp, http, or telnet. The any value enables accounting or authentication for all TCP services. To have users prompted for authentication credentials, they must use FTP, HTTP, or Telnet. (HTTP is the Web and only applies to web browsers that can prompt for a username and password.)
If the authentication or authorization server is authenticating services other than FTP, HTTP, or Telnet, using any will not permit those services to authenticate in the firewall. The firewall only knows how to communicate with FTP, HTTP, and Telnet for authentication and authorization.
Only set this parameter to a service other than any if the authentication or authorization server is set the same way. Unless you want to temporarily restrict access to a specific service, setting a service in this command can increase system administration work and may cause all connections to fail if the authentication or authorization server is authenticating one service and you set this command to another.
authorization
Enable or disable TACACS+ user authorization for services (PIX Firewall does not support RADIUS authorization). The authentication server determines what services the user is authorized to access.
author_service
The services which require authorization. Use any, ftp, http, telnet, or protocol/port. Services not specified are authorized implicitly. Services specified in the aaa authentication command do not affect the services which require authorization.
For protocol/port:
•
•
aaa authorization udp/53-1024 inside 0 0 0 0This example enables authorization for DNS lookups to the inside interface for all clients, and authorizes access to any other services that have ports in the range of 53 to 1024.
Note
except
Create an exception to a previously specified set of services.
inbound
Authenticate or authorize inbound connections. Inbound means the connection originates on the outside interface and is being directed to the inside or perimeter.
outbound
Authenticate or authorize outbound connections. Outbound means the connection originates on the inside and is being directed to the outside or perimeter.
if_name
Interface name from which users require authentication. Use if_name in combination with the local_ip address and the foreign_ip address to determine where access is sought and from whom. The local_ip address is always on the highest security level interface and foreign_ip is always on the lowest. See the Examples section for how the if_name affects the use of this command.
local_ip
The IP address of the highest security level interface from which or to which access is sought. You can set this address to 0 to let the authentication server decide which hosts are authenticated.
local_mask
Network mask of local_ip. Always specify a specific mask value. Use 0 if the IP address is 0.
foreign_ip
The IP address of the lowest security level interface from which or to which access is sought.
foreign_mask
Network mask of foreign_ip. Always specify a specific mask value. Use 0 if the IP address is 0.
console
Specify that access to the PIX Firewall console require authentication and optionally, log configuration changes to a syslog server.
The aaa authentication serial console command lets you require authentication verification to access the PIX Firewall's serial console. The serial console options also logs to a syslog server changes made to the configuration from the serial console.
Authenticated access to the PIX Firewall console has different types of prompts depending on the option you choose with the aaa authentication [serial|enable|telnet] console command. While the enable option allows three tries before stopping with an access denied message, both the serial and telnet options cause the user to be prompted continually until successfully logging in. The serial option requests a username and password before the first command line prompt on the serial console connection. The telnet option forces you to specify a username and password before the first command line prompt of a Telnet console connection. The enable option requests a username and password before accessing privileged mode for serial or Telnet connections.
Telnet access to the PIX Firewall console is available from any internal interface (not the outside interface) and requires previous use of the telnet command.
Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis. If the console login request times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the enable password.
The maximum password length for accessing the console is 16 characters.
group_tag
The group tag set with the aaa-server command.
Usage Guidelines
The aaa command enables or disables the following AAA (Authentication, Authorization, and Accounting) features:
•
•
•
•
Note
Note
Usage Notes
1
2
3
(a)
(b)
authentication_user_name@remote_system_user_nameauthentication_password@remote_system_passwordIf you daisy-chain PIX Firewall units, Telnet authentication works in the same way as a single unit, but FTP and HTTP authentication have additional complexity for users because they have to enter each password and username with an additional at (@) character and password or username for each daisy-chained system. Users can exceed the 63-character password limit depending on how many units are daisy-chained and password length.
Some FTP graphical user interfaces (GUIs) do not display challenge values.
(c)
4
5
6
(a)
(b)
(c)
7
aaa authentication any outbound 0 0 serveraaa authentication except outbound perim_net perim_mask server8
Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied.
To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested.
Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set. This is because the browser caches the "Authorization: Basic=Uuhjksdkfhk==" string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts. Flushing the cache is of no use.
As long as the user repeatedly browses the Internet, the browser resends the "Authorization: Basic=Uuhjksdkfhk==" string to transparently reauthenticate the user.
9
10
11
12
13
14
15
16
17
18
19
service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is:Unable to connect to remote host: Connection timed outSee also: aaa-server, auth-prompt, service, telnet, virtual.
Examples
1
This example enables authentication for connections originated from the inside network to the outside network:
aaa authentication any outbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 tacacs+This example enables authentication for connections originated from the inside network to the perimeter network:
aaa authentication any outbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 tacacs+This example enables authentication for connections originated from the outside network to the inside network:
aaa authentication any inbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 tacacs+This example enables authentication for connections originated from the outside network to the perimeter network:
aaa authentication any inbound 192.150.50.0 255.255.255.0 192.150.50.0 255.255.255.0 tacacs+This example enables authentication for connections originated from the perimeter network to the outside network:
aaa authentication any perimeter 192.150.50.0 255.255.255.0 192.150.50.0 255.255.255.0 tacacs+2
nat (inside) 1 10.0.0.0 255.255.255.0aaa authentication any outbound 0 0 tacacs+aaa authentication except outb 10.0.0.42 255.255.255.255 tacacs+3
aaa-server AuthIn protocol tacacs+aaa-server AuthIn (inside) host 10.16.1.20 thisisakey timeout 20static (inside, outside) 192.150.50.0 10.16.1.0 netmask 255.255.255.0 10 60conduit permit tcp 192.150.50.0 255.255.255.0 10.16.1.0 255.255.255.0aaa authentication any inbound 0 0 AuthIn4
aaa authorization udp/53 inbound 0.0.0.0 0.0.0.05
aaa authorization 1/0 outbound 0.0.0.0 0.0.0.0This means that users will not be able to ping external hosts if they have not been authenticated using Telnet, HTTP, or FTP.
6
aaa authorization 1/8 outbound 0.0.0.0 0.0.0.0aaa-server
Specify an AAA server. (Configuration mode.)
aaa-server group_tag (if_name) host server_ip key timeout seconds
no aaa-server group_tag (if_name) host server_ip key timeout seconds
aaa-server group_tag protocol auth_protocol
clear aaa-server [group_tag]
Syntax Description
Usage Guidelines
The aaa-server command lets you specify an AAA server group. PIX Firewall lets you define separate groups of TACACS+ or RADIUS servers for specifying different types of traffic; such as, a TACACS+ server for inbound traffic and another for outbound traffic. Another use is where all outbound HTTP traffic will be authenticated by a TACACS+ server, and all inbound traffic will use RADIUS.
AAA server group are defined by a tag name that directs different types of traffic to each authentication server. If the first authentication server in the list fails, the AAA subsystem fails over to the next server in the tag group. You can have up to 16 tag groups and each group can have up to 16 AAA servers for a total of up to 256 AAA servers.
The aaa command references the tag group.
The aaa-server command replaces the radius-server and tacacs-server commands.
Note
If accounting is in effect, the accounting information goes only to the active server.
The default configuration provides these two aaa-server protocols:
aaa-server TACACS+ protocol tacacs+aaa-server RADIUS protocol radius
Note
Examples
1
aaa-server TACACS+ (inside) host 10.1.1.10 thekey timeout 20aaa authentication any outbound 0 0 0 0 TACACS+aaa authorization any outbound 0 0 0 0aaa accounting any outbound 0 0 0 0 TACACS+aaa authentication any serial console TACACS+This example specifies that the authentication server with the IP address 10.1.1.10 resides on the inside interface and is in the default TACACS+ server group. The next three command statements specify that any users starting outbound connections to any foreign host will be authenticated using TACACS+, that the users who are successfully authenticated are authorized to use any service, and that all outbound connection information will be logged in the accounting database. The last command statement specifies that access to the PIX Firewall's serial console requires authentication from the TACACS+ server.
2
aaa-server AuthIn protocol radiusaaa-server AuthIn (inside) host 10.0.1.40 ab timeout 20aaa-server AuthIn (inside) host 10.0.1.41 abc timeout 4aaa-server AuthOut protocol radiusaaa-server AuthOut (inside) host 10.1.1.2 abc123 timeout 15aaa authenticate any inbound 0 0 0 0 AuthInaaa authentication any outbound 0 0 0 0 AuthOutaccess-group
Binds the access list name to the interface interface-name to permit or deny IP packets incoming into the interface. (Configuration mode.)
access-group access-list-name in interface interface-name
clear access-group access-list-name in interface interface-name
no access-group access-list-name in interface interface-name
show access-group access-list-name in interface interface-name
Syntax Description
access-list-name
The name associated with a given access list.
in interface
Filters on inbound packets at the given interface.
interface-name
The name of the network interface.
Usage Guidelines
The access-group command binds the name of a given access list to an interface. Access lists are applied to traffic inbound to interface. If the access list permits the address, the PIX Firewall continues to process the packet. If the access list rejects the address, the firewall discards the packet and generates a syslog message.
If no access list is bound to an interface, the conduit list or outbound list is checked.
Note
Note
The no access-group command unbinds the "access-list-name" from the interface interface-name.
The show access-group command displays the current access-list bound to the interface(s).
The clear access-group command removes all entries from access-list indexed by "list-name." If "list-name" is not specified, all access-lists are destroyed.
Examples
The following example shows use of the access-group command. The example indicates that access list 101 will be bound to the outside interface.
access-group 101 in interface outsideaccess-list
Create an access list. (Configuration mode.)
access-list access-list-name [deny | permit] protocol source source-netmask destination destination-netmask
no access-list access-list-name [deny | permit] protocol source source-netmask destination destination-netmask
clear access-list
show access-list
Syntax Description
Usage Guidelines
The access-list command allows you to create an access list. After you have defined an access list, bind it to an interface using the access-group command or bind it to a crypto map entry using the crypto map command. The show access-list command lists the access-list command statements in the configuration. The clear access-list command removes all access-list command statements from the configuration.
Note
Note
Note
If the access list is bound to an interface, the access list selects which traffic will be able to traverse the PIX Firewall. When bound to a crypto map entry, the access list selects which IP traffic will be protected by IPSec and which traffic will not be protected. For example, access lists can be created to protect all IP traffic between Subnet A and Subnet Y or traffic between Host A and Host B.
The access lists themselves are not specific to IPSec. It is the crypto map entry referencing the specific access list that defines whether IPSec processing is applied to the traffic matching a permit in the access list.
Crypto access lists associated with IPSec crypto map entries have four primary functions:
•
•
•
•
The crypto access list you define will be associated with an interface after you define the corresponding crypto map entry and apply the crypto map set to the interface. Different access lists must be used in different entries of the same crypto map set. However, both inbound and outbound traffic will be evaluated against the same "outbound" IPSec access list. Therefore, the access list's criteria are applied in the forward direction to traffic exiting your PIX Firewall and the reverse direction to traffic entering your PIX Firewall.
If you want certain traffic to receive one combination of IPSec protection (for example, authentication only) and other traffic to receive a different combination of IPSec protection (for example, both authentication and encryption), you need to create two different crypto access lists to define the two different types of traffic. These different access lists are then used in different crypto map entries that specify different IPSec policies.
Cisco recommends that you configure "mirror image" crypto access lists for use by IPSec and that you avoid using the any keyword. See the sections "Mirror Image Crypto Access Lists at each IPSec Peer" and "any Keyword in Crypto Access Lists" in "."
Note
If you configure multiple statements for a given crypto access list to be used for IPSec, in general the first permit statement that is matched will be the statement used to determine the scope of the IPSec security association. That is, the IPSec security association will be set up to protect traffic that meets the criteria of the matched statement only. Later, if traffic matches a different permit statement of the crypto access list, a new, separate IPSec security association will be negotiated to protect traffic matching the newly matched access list statement.
Examples
The following example creates a numbered crypto access list that specifies a Class C subnet for the source and a Class C subnet for the destination of IP packets. When the PIX Firewall uses this crypto access list, all IP traffic that is exchanged between the source and destination subnets will be encrypted.
access-list 101 permit ip 172.21.3.0 0.0.0.255 172.22.2.0 0.0.0.255This crypto access list would be applied to an interface as an outbound crypto access list after you define a crypto map and apply it to the interface.
alias
Administer overlapping addresses with dual NAT. (Configuration mode.)
alias [(if_name)] dnat_ip foreign_ip [netmask]
no alias [[(if_name)] dnat_ip foreign_ip [netmask]]
show alias
Syntax Description
Usage Guidelines
The alias command translates one address into another. Use this command to prevent conflicts when you have IP addresses on a network that are the same as those on the Internet or another intranet. You can also use this command to do address translation on a destination address. For example, if a host sends a packet to 192.150.50.1, you can use alias to redirect traffic to another address, such as, 192.150.50.42.
Note
After changing or removing an alias command statement, use the clear xlate command.
There must be an A (address) record in the DNS zone file for the "dnat" address in the alias command.
The alias command has two uses which can be summarized in the following ways of reading an alias command statement:
•
•
The no alias command disables a previously set alias command statement. The show alias command displays alias command statements in the configuration.
The alias command automatically interacts with DNS servers on your network to ensure that domain name access to the aliased IP address is handled transparently.
You can specify a net alias by using network addresses for the foreign_ip and dnat_ip IP addresses. For example, alias 10.1.1.0 192.150.50.0 255.255.255.0 creates aliases for each IP address between 192.150.50.1 and 192.150.50.254.
Note
Usage Notes
1
alias (inside) 192.168.8.14 192.150.50.1 255.255.255.255static (inside,outside) 192.150.50.1 192.168.8.14 netmask 255.255.255.255conduit permit tcp host 192.150.50.1 eq ftp-data host 192.168.8.14An alias is specified with the inside address 192.168.8.14 mapping to the foreign address 192.150.50.1.
Examples
1
alias (inside) 192.168.1.0 192.159.1.0 255.255.255.0show aliasalias 192.168.1.0 192.159.1.0 255.255.255.0When client 192.159.1.123 connects to domain.com, the DNS response from an external DNS server to the internal client's query would be altered by the PIX Firewall to: 192.168.1.33. If the PIX Firewall uses 192.150.50.1 through 192.150.50.254 as the global pool IP addresses, the packet goes to the PIX Firewall with SRC=192.159.1.123 and DST=192.168.1.33. The PIX Firewall translates it to SRC=192.150.50.254 and DST=192.159.1.33 on the outside.
2
The period at the end of the www.domain.com. domain name must be included.
The alias command is:
alias 10.1.1.11 192.150.50.11 255.255.255.255PIX Firewall doctors the nameserver replies to 10.1.1.11 for inside clients to directly connect to the web server.
The conduit command statement you would expect to use is:
conduit permit tcp host 192.150.50.11 eq telnet host 192.150.50.7But with the alias command, use this command:
conduit permit tcp host 192.150.50.11 eq telnet host 192.159.1.7You can test the DNS entry for the host with the following nslookup command:
nslookup -type=any www.domain.comarp
Change or view the ARP cache, and set the timeout value. (Configuration mode.)
arp if_name ip_address mac_address [alias]
clear arp
no arp if_name ip_address
show arp [if_name] [ip_address mac_address alias]
arp timeout seconds
no arp timeout
show arp timeout
Syntax Description
Usage Guidelines
The arp command adds an entry to the PIX Firewall ARP cache. ARP is a low-level TCP/IP protocol that resolves a node's physical address from its IP address through an ARP request asking the node with a particular IP address to send back its physical address. The presence of entries in the ARP cache indicates that the PIX Firewall has network connectivity. The clear arp command clears the ARP table but not the alias (permanent) entries. Use the no arp command to remove these entries. The show arp command lists the entries in the ARP table.
Note
Use the arp command to add an entry for new hosts you add on your network or when you swap an existing host for another. Alternatively, you can wait for the duration specified with the arp timeout command to expire and the ARP table rebuilds itself automatically with the new host information.
The arp timeout command sets the duration that an ARP entry can stay in the PIX Firewall ARP table before expiring. The timer is known as the ARP persistence timer. The default value is
14,400 seconds (4 hours).The no arp timeout command sets the timer to its default value. The show arp timeout command displays its current value.
Examples
The following examples illustrate use of the arp and arp timeout commands:
arp inside 192.168.0.42 00e0.1e4e.2a7carp outside 192.168.0.43 00e0.1e4e.3d8b aliasshow arpoutside 192.168.0.43 00e0.1e4e.3d8b aliasinside 192.168.0.42 00e0.1e4e.2a7cclear arp inside 192.168.0.42arp timeout 42show arp timeoutarp timeout 42 secondsno arp timeoutshow arp timeoutarp timeout 14400 secondsauth-prompt
Change the AAA challenge text. (Configuration mode.)
auth-prompt [accept|reject|prompt] string
clear auth-prompt
no auth-prompt [accept|reject|prompt] string
show auth-prompt
Syntax Description
Usage Guidelines
The auth-prompt command lets you change the AAA challenge text for HTTP, FTP, and Telnet access. This text displays above the username and password prompts that users view when logging in. If you do not use this command, FTP users view FTP authentication, HTTP users view HTTP Authentication, and challenge text does not appear for Telnet access.
If the user authentication occurs from Telnet, you can use the accept and reject options to display different authentication prompts if the authentication attempt is accepted or rejected by the authentication server.
Example
The following example shows how to set the authentication prompt and how users view the prompt:
auth-prompt XYZ Company Firewall AccessAfter this string is added to the configuration, users view:
XYZ Company Firewall AccessUser Name:Password:The prompt keyword can be included or omitted. For example:
auth-prompt prompt Hello There!This command statement is the same as:
auth-prompt Hello There!ca
Configure the PIX Firewall to interoperate with a Certification Authority (CA). (Configuration mode.)
ca authenticate ca_nickname [fingerprint]
ca configure ca_nickname ca | ra retry_period retry_count [crloptional]
no ca configure ca_nickname
show ca configure
ca crl request ca_nickname
ca enroll ca_nickname challenge_password [serial] [ipaddress]
no ca enroll ca_nickname
ca generate rsa key|specialkey key_modulus_size
ca identity ca_nickname ca_ipaddress[:ca_script_location] [ldap_ip address]
no ca identity ca_nickname
show ca identity
ca save all
no ca save all
show ca certificate
ca zeroize rsa
show ca mypubkey rsa
Note
Syntax Description
Usage Guidelines
ca authenticate
The ca authenticate command allows the PIX Firewall to authenticate its CA by obtaining the CA's self-signed certificate, which contains the CA's public key.
In order to authenticate a peer's certificate(s), a PIX Firewall must obtain the CA certificate containing the CA public key. Because the CA certificate is a self-signed certificate, the key should be authenticated manually by contacting the CA administrator. You are given the choice of authenticating the public key in that certificate by including within the ca authenticate command the key's fingerprint, which is retrieved in some out-of-band process. The PIX Firewall will discard the received CA certificate and generate an error message, if the fingerprint you specified is different from the received one. You can also simply compare the two fingerprints without having to enter the key within the command.
If you are using RA mode (within the ca configure command), when you issue the ca authenticate command, the RA signing and encryption certificates will be returned from the CA, as well as the CA certificate.
The ca authenticate command is not saved to the PIX Firewall configuration. However, the public keys embedded in the received CA (and RA) certificates are saved in the configuration as part of the RSA public key record (called the "RSA public key chain"). To save the public keys permanently to Flash memory, use the ca save all command.
To view the CA's certificate, use the show ca certificate command.
Note
Example
In this example, a request for the CA's certificate was sent to the CA. The fingerprint was not included in the command. The CA sends its certificate and the PIX Firewall prompts for verification of the CA's certificate by checking the CA certificate's fingerprint. Using the fingerprint associated with the CA's certificate retrieved in some out-of-band process from a CA administrator, compare the two fingerprints. If both fingerprints match, then the certificate is considered valid.
ca authenticate mycaCertificate has the following attributes:Fingerprint: 0123 4567 89AB CDEF 0123The following example shows the error message. This time, the fingerprint is included in the command. The two fingerprints do not match, and therefore the certificate is not valid.
ca authenticate myca 0123456789ABCDEF0123Certificate has the following attributes:Fingerprint: 0123 4567 89AB CDEF 5432%Error in verifying the received fingerprint. Type help or `?' for a list of available commands.ca configure
The ca configure command is used to specify the communication parameters between the PIX Firewall and the CA.
Use the no ca configure command to reset each of the communication parameters to the default value. If you want to show the current settings stored in RAM, use the show ca configure command.
Example
The following example indicates myca is the name of the CA and the CA will be contacted rather than the RA. It also indicates the PIX Firewall will wait 5 minutes before sending another certificate request, if it does not receive a response, and will resend a total of 15 times before dropping its request. If the CRL is not accessible, crloptional tells the PIX Firewall to accept other peer's certificates.
ca configure myca ca 5 15 [crloptional]ca crl request
The ca crl request command allows the PIX Firewall to obtain an updated CRL from the CA at any time.
A PIX Firewall automatically requests a CRL from the CA at various times, depending on whether the CA is in the RA mode or not. If the CA is not in the RA mode, a CRL is requested whenever the system reboots and finds that it does not already contain a valid (un-expired) CRL. If the CA is in the RA mode, no CRL can be obtained until a peer's certificate is sent via an ISAKMP exchange. This is because the certificate itself contains the location where the PIX Firewall must query to get the appropriate CRL. When a CRL expires, the PIX Firewall automatically requests an updated one. Until a new valid CRL is obtained, the PIX Firewall will not accept peers' certificates.
Use the ca crl request command only if your CA does not support a RA. A CRL lists all the network's devices' certificates that have been revoked. The PIX Firewall will not accept revoked certificates; therefore, any peer with a revoked certificate cannot exchange IPSec traffic with your firewall.
The first time your PIX Firewall receives a certificate from a peer, it will download a CRL from the CA. Your PIX Firewall then checks the CRL to make sure the peer's certificate has not been revoked. (If the certificate appears on the CRL, it will not accept the certificate and will not authenticate the peer.)
A CRL can be reused with subsequent certificates until the CRL expires. If your PIX Firewall receives a peer's certificate after the applicable CRL has expired, it will download the new CRL.
If your PIX Firewall has a CRL which has not yet expired, but you suspect that the CRL's contents are out of date, use the ca crl request command to request that the latest CRL be immediately downloaded to replace the old CRL.
The ca crl request command is not saved with the PIX Firewall configuration between reloads.
Example
The following example indicates the PIX Firewall will obtain an updated CRL from the CA with the name myca:
ca crl request mycaca enroll
The ca enroll command is used to send an enrollment request to the CA requesting a certificate for all of your PIX Firewall's key pairs. This is also known as "enrolling" with the CA. (Technically, enrolling and obtaining certificates are two separate events, but they both occur when this command is issued.)
Your PIX Firewall needs a signed certificate from the CA for each of its RSA key pairs; if you previously generated general purpose keys, the ca enroll command will obtain one certificate corresponding to the one general purpose RSA key pair. If you previously generated special usage keys, this command will obtain two certificates corresponding to each of the special usage RSA key pairs.
If you already have a certificate for your keys, you will be unable to complete this command; instead, you will be prompted to remove the existing certificate first.
The ca enroll command is not saved with the PIX Firewall configuration between reloads. To verify if the enrollment process succeeded and to display PIX Firewall's certificate, use the show ca certificate command. If you want to cancel the current enrollment request, use the no ca enroll command.
The required challenge password is necessary in the event that you need to revoke your PIX Firewall's certificate(s). When you ask the CA administrator to revoke your certificate, you must supply this challenge password as a protection against fraudulent or mistaken revocation requests.
Note
If you lose the password, the CA administrator may still be able to revoke the PIX Firewall's certificate but will require further manual authentication of the PIX Firewall administrator identity.
The PIX Firewall's serial number is optional. If you provide it, it will be included in the obtained certificate. The serial number is not used by IPSec or IKE but may be used by the CA to either authenticate certificates or to later associate a certificate with a particular device. Ask your CA administrator if serial numbers should be included. If you are in doubt, include the serial number.
Normally, you would not include the IP address because the IP address binds the certificate more tightly to a specific entity. Also, if the PIX Firewall is moved, you would need to issue a new certificate.
Example
The following example indicates that the PIX Firewall will send an enrollment request to the CA myca.example.com. The password 1234567890 is specified, as well as the PIX Firewall's serial number of 197754987.
ca enroll myca.example.com 1234567890 197754987ca generate rsa
The ca generate rsa command generates RSA key pairs for your PIX Firewall. RSA keys are generated in pairs—one public RSA key and one private RSA key. If your PIX Firewall already has RSA keys when you issue this command, you will be warned and prompted to replace the existing keys with new keys.
Note
The ca generate rsa command is not saved in the PIX Firewall configuration. However, the keys generated by this command are saved in the persistent data file in Flash memory, which is never displayed to the user or backed up to another device.
Example
In this example, one general purpose RSA key pair is to be generated. The selected size of the key modulus is 2048.
ca generate rsa key 2048
Note
ca identity
The ca identity command declares the CA that your PIX Firewall will use. Currently, PIX Firewall supports one CA at one time. The no ca identity command removes the ca identity from the configuration and deletes all certificates issued by the specified CA. The show ca identity command shows the current settings stored in RAM.
The PIX Firewall uses a subset of the HTTP protocol to contact the CA, and so must identify a particular cgi-bin script to handle CA requests. The default location and script on the CA server is /cgi-bin/pkiclient.exe. If the CA administrator has not put the CGI script in the above location, include the location and the name of the script within the ca identity command statement.
By default, querying of a certificate or a CRL is done via Cisco's PKI protocol. If the CA supports Lightweight Directory Access Protocol (LDAP), query functions may use LDAP as well. The IP address of the LDAP server must be included within the ca identity command statement.
Example
The following example indicates that the CA myca.example.com is declared as the PIX Firewall's supported CA. The CA's IP address of 205.139.94.231 is provided.
ca identity myca.example.com 205.139.94.231ca save all
The ca save all commands allows you to save the PIX Firewall's RSA key pairs, the CA, RA and PIX Firewall's certificates, and the CA's CRLs in the persistent data file in Flash memory between reloads. The no ca save command removes the saved data from PIX Firewall's Flash memory.
The ca save command itself is not saved with the PIX Firewall configuration between reloads.
To view the current status of requested certificates, and relevant information of received certificates, such as CA and RA certificates, use the show ca certificate command. Because the certificates contain no sensitive data, any user is allowed to issue this show command.
ca zeroize rsa
The ca zeroize rsa command deletes all RSA keys that were previously generated by your PIX Firewall. If you issue this command, you must also perform two additional task. Perform these tasks in the following order:
•
•
show ca mypubkey rsa
The show ca mypubkey rsa command displays the PIX Firewall's public keys in a DER/BER encoded PKCS#1 representation.
Example
The following is sample output of the show ca mypubkey rsa command. Special usage RSA keys were previously generated for this PIX Firewall using the ca generate rsa command:
show ca mypubkey rsa% Key pair was generated at: 15:34:55 Aug 05 1999Key name: pixfirewall.example.comUsage: Signature KeyKey Data:305c300d 06092a86 4886f70d 01010105 00034b00 30480241 00c31f4a ad32f60d6e7ed9a2 32883ca9 319a4b30 e7470888 87732e83 c909fb17 fb5cae70 3de738cf6e2fd12c 5b3ffa98 8c5adc59 1ec84d78 90bdb53f 2218cfe7 3f020301 0001% Key pair was generated at: 15:34:55 Aug 05 1999Key name: pixfirewall.example.comUsage: Encryption KeyKey Data:305c300d 06092a86 4886f70d 01010105 00034b00 30480241 00d8a6ac cc64e57a48dfb2c1 234661c7 76380bd5 72ae62f7 1706bdab 0eedd0b5 2e5feef0 76319d98908f50b4 85a291de 247b6711 59b30026 453bfa3c 45234991 5d020301 0001clock
Set the PIX Firewall clock for use with the PIX Firewall Syslog Server and the Public Key Infrastructure (PKI) protocol. (Configuration mode.)
clock
clock set hh:mm:ss month day year
clock set hh:mm:ss day month year
show clock
Syntax Description
Usage Guidelines
The clock command lets you specify the current time, month, day, and year for use time stamped syslog messages, which you can enable with the logging timestamp command. You can view the current time with the clock or the show clock command.
You can interchange the settings for the day and the month; for example, clock set 21:0:0 1 apr 2000.
A time prior to January 1, 1998 or after December 31, 2097 will not be accepted (the maximum date that the clock command can work to).
While the PIX Firewall clock is year 2000 compliant, it does not adjust itself for daylight savings time changes; however, it does know about leap years.
The PIX Firewall clock setting is retained in memory when the power is off by a battery on the PIX Firewall's motherboard. Should this battery fail, contact Cisco's customer support for a replacement PIX Firewall unit.
Cisco's PKI protocol uses the clock to make sure that a CRL is not expired. Otherwise, the CA may reject or allow certificates based on an incorrect timestamp.
Example
To enable PFSS time-stamp logging for the first time, use these commands:
clock set 21:0:0 apr 1 2000show clock21:00:05 Apr 01 2000logging host 192.150.50.3logging timestamplogging trap 5In this example, the clock command sets the clock to 9 pm on April 1, 2000. The logging host command specifies that a syslog server is at IP address 192.150.50.3. The PIX Firewall automatically determines that the server is a PFSS and sends syslog messages to it via TCP and UDP. The logging timestamp command enables sending time stamped syslog messages. The logging trap command specifies that messages at syslog level 0 through 5 be sent to the syslog server. The value 5 is used to capture severe and normal messages, but also those of the aaa authentication enable command.
conduit
Add, delete, or show conduits through the firewall for incoming connections. (Configuration mode.)
conduit permit | deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]]
no conduit permit | deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]]
conduit permit | deny icmp global_ip global_mask foreign_ip foreign_mask [icmp_type]
clear conduit
show conduit
permit
Permit access if the conditions are matched.
deny
Deny access if the conditions are matched.
protocol
Specify the transport protocol for the connection. Possible literal values are icmp, tcp, udp, or an integer in the range 0 through 255 representing an IP protocol number. Use ip to specify all transport protocols. You can view valid protocol numbers online at:
http://www.isi.edu/in-notes/iana/assignments/protocol-numbers
If you specify the icmp protocol, you can permit or deny ICMP access to one or more global IP addresses. Specify the ICMP type in the icmp_type variable, or omit to specify all ICMP types. See the Usage Guidelines for a complete list of the ICMP types.
global_ip
A global IP address previously defined by a global or static command. You can use any if the global_ip and global_mask are 0.0.0.0 0.0.0.0. The any option applies the permit or deny parameters to the global addresses.
If global_ip is a host, you can omit global_mask by specifying the host command before global_ip. For example:
conduit permit tcp host 192.150.50.1 eq ftp anyThis example lets any foreign host access global address 192.150.50.1 for FTP.
global_mask
Network mask of global_ip. The global_mask is a 32-bit, four-part dotted decimal; such as, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for global_ip, use 0 for the global_mask; otherwise, enter the global_mask appropriate to global_ip.
foreign_ip
An external IP address (host or network) that can access the global_ip. You can specify 0.0.0.0 or 0 for any host. If both the foreign_ip and foreign_mask are 0.0.0.0 0.0.0.0, you can use the shorthand any option.
If foreign_ip is a host, you can omit foreign_mask by specifying the host command before foreign_ip. For example:
conduit permit tcp any eq ftp host 192.150.50.42This example lets foreign host 192.150.50.42 access any global address for FTP.
foreign_mask
Network mask of foreign_ip. The foreign_mask is a 32-bit, four-part dotted decimal; such as, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for foreign_ip, use 0 for the foreign_mask; otherwise, enter the foreign_mask appropriate to foreign_ip. You can also specify a mask for subnetting, for example, 255.255.255.192.
operator
A comparison operand that lets you specify a port or a port range.
Use without an operator and port to indicate all ports; for example:
conduit permit tcp any anyUse eq and a port to permit or deny access to just that port. For example use eq ftp to permit or deny access only to FTP:
conduit deny tcp host 192.168.1.1 eq ftp 192.150.50.1Use lt and a port to permit or deny access to all ports less than the port you specify. For example, use lt 2025 to permit or deny access to the well known ports (1 to 1024):
conduit permit tcp host 192.168.1.1 lt 1025 anyUse gt and a port to permit or deny access to all ports greater than the port you specify.
For example, use gt 42 to permit or deny ports 43 to 65535:conduit deny udp host 192.168.1.1 gt 42 host 192.150.50.42Use neq and a port to permit or deny access to every port except the ports that you specify.
For example, use neq 10 to permit or deny ports 1-9 and 11 to 65535:conduit deny tcp host 192.168.1.1 neq 10 host 192.150.50.42 neq 42Use range and a port range to permit or deny access to only those ports named in the range.
For example, use range 10 1024 to permit or deny access only to ports 10 through 1024. All other ports are unaffected.conduit deny tcp any range ftp telnet anyNote By default, all ports are denied until explicitly permitted.
port
Service(s) you permit to be used while accessing global_ip or foreign_ip. Specify services by the port that handles it, such as smtp for port 25, www for port 80, and so on. You can specify ports by either a literal name or a number in the range of 0 to 65535. You can specify all ports by not specifying a port value; for example:
conduit deny tcp any anyThis command is the default condition for the conduit command in that all ports are denied until explicitly permitted.
You can view valid port numbers online at:
http://www.isi.edu/in-notes/iana/assignments/port-numbers
See "Ports" in "," for a list of valid port literal names in port ranges; for example, ftp h323. You can also specify numbers.
icmp_type
The type of ICMP message. lists the ICMP type literals that you can use in this command. Omit this option to mean all ICMP types. An example of this command that permits all ICMP types is conduit permit icmp any any. This command lets ICMP pass inbound and outbound.
Syntax Description
Usage Guidelines
A conduit command statement creates an exception to the PIX Firewall Adaptive Security mechanism by permitting connections from one firewall network interface to access hosts on another.
The clear conduit command removes all conduit command statements from your configuration.
The conduit command can permit or deny access to either the global or static commands; however, neither is required for the conduit command. You can associate a conduit command statement with a global or static command statement through the global address, either specifically to a single global address, a range of global addresses, or to all global addresses.
When used with a static command statement, a conduit command statement permits users on a lower security interface to access a higher security interface. When not used with a static command statement, a conduit command statement permits both inbound and outbound access.
If you associate a conduit command statement with a static command statement, only the interfaces specified on the static command statement have access to the conduit command statement. For example, if a static command statement lets users on the dmz interface access a server on the inside interface, only users on the dmz interface can access the server via the static command statement. Users on the outside do not have access.
Note
The permit and deny options for the conduit command are processed in the order listed in the PIX Firewall configuration. In the following example host 192.159.1.250 is not denied access through the PIX Firewall because the permit option precedes the deny option:
conduit permit tcp host 192.150.50.4 255.255.255.255 eq 80 anyconduit deny tcp host 192.150.50.4 255.255.255.0 192.159.1.250 255.255.255.255 eq 80 any
Note
After changing or removing a conduit command statement, use the clear xlate command.
You can remove a conduit command statement with the no conduit command. Use the show conduit command to view the conduit command statements in the configuration.
If you prefer more selective ICMP access, you can specify a single ICMP message type as the last option in this command. lists possible ICMP types values.
Usage Notes
1
2
3
4
5
6
The two conduit command statements for the PPTP transport protocol, which is a subset of the GRE protocol, are as shown in this example:
static (dmz2,outside) 192.150.50.5 192.168.1.5 netmask 255.255.255.255conduit permit tcp host 192.150.50.5 eq 1723 anyconduit permit gre host 192.150.50.5 anyIn this example, PPTP is being used to handle access to host 192.168.1.5 on the dmz2 interface from users on the outside. Outside users access the dmz2 host using global address 192.150.50.5. The first conduit command statement opens access for the PPTP protocol and gives access to any outside users. The second conduit command statement permits access to GRE. If PPTP was not involved and GRE was, you could omit the first conduit command statement.
7
For MSRPC, two conduit command statements are required, one for port 135 and another for access to the high ports (1024-65535). For Sun RPC, a single conduit command statement is required for UDP port 111.
Once you create a conduit command statement for RPC, you can use the following command to test its activity from a UNIX host:
rpcinfo -u unix_host_ip_address 150001Replace unix_host_ip_address with the IP address of the UNIX host.
8
static (inside, outside) 192.150.50.0 10.1.1.0conduit permit tcp 192.150.50.0 255.255.255.0 eq ftp anystatic (inside, outside) 203.31.17.3 10.1.1.3conduit permit udp host 192.150.50.3 eq h323 host 1.2.3.3In this case, the host at 1.2.3.3 has InternetPhone access in addition to its blanket FTP access.
Examples
1
static (inside,outside) 192.150.50.1 192.168.1.49 netmask 255.255.255.255 0 0conduit permit tcp host 192.150.50.1 eq smtp host 192.150.50.42To disable Mail Guard, enter this command:
no fixup protocol smtp 252
static (inside,outside) 192.150.50.0 192.168.1.0 netmask 255.255.255.0 0 0conduit permit tcp 192.150.50.0 255.255.255.0 eq h323 anyconduit permit tcp 192.150.50.0 255.255.255.0 eq 113 192.150.50.0 255.255.255.03
static (perimeter,outside) 192.150.50.4 192.168.1.4 netmask 255.255.255.0 0conduit permit tcp host 192.150.50.4 eq 80 anyIn this example, the static command statement maps the perimeter host, 10.1.1.4. to the global address, 192.150.50.4. The conduit command statement specifies that the global host can be accessed on port 80 (web server) by any outside host.
configure
Clear or merge current configuration with that on floppy or Flash memory, start configuration mode, or view current configuration. (Privileged mode.)
clear configure primary|secondary|all
configure net [[server_ip]:[filename]]
configure floppy
configure memory
configure terminal
show configure
Syntax Description
Usage Guidelines
The clear configure command resets a configuration to its default values. Use this command to create a template configuration or when you want to clear all values. The clear configure primary command resets the default values for the interface, ip, mtu, nameif, and route commands. This command also deletes interface names in the configuration. The clear configure secondary command removes alias, conduit, global, and static command statements from the configuration. However, clear configure secondary command does not remove tftp-server command statements.
Note
The configure net command merges the current running configuration with a TFTP configuration stored at the IP address you specify and from the file you name. If you specify both the IP address and path name in the tftp-server command, you can specify :filename as simply a colon ( : ). For example:
configure net :Use the write net command to store the configuration in the file.
Note
The configure floppy command merges the current running configuration with the configuration stored on diskette. This command assumes that the diskette was previously created by the write floppy command.
The configure memory command merges the configuration in Flash memory into the current configuration in RAM.
The configure terminal command starts configuration mode. Exit configuration mode with the quit command. After exiting configuration mode, use write memory to store your changes in Flash memory or write floppy to store the configuration on diskette. Use the write terminal command to display the current configuration.
The show configure command lists the contents of the configuration in Flash memory.
Each command statement from diskette (with configure floppy), Flash memory (with configure memory), or TFTP transfer (with configure net) is read into the current configuration and evaluated in the same way as commands entered from a keyboard with these rules:
•
•
•
Example
The following examples shows how to configure the PIX Firewall using a configuration retrieved with TFTP:
configure net 10.1.1.1:/tftp/config/pixconfigThe pixconfig file is stored on the TFTP server at 10.1.1.1 in the tftp/config folder.
The following example shows how to configure the PIX Firewall from a diskette:
configure floppyThe following example shows how to configure the PIX Firewall from the configuration stored in Flash memory:
configure memoryThe following example shows the commands you enter to access configuration mode, view the configuration, and save it in Flash memory.
Access privileged mode with the enable command and configuration mode with the configure terminal command. View the current configuration with the write terminal command and save your configuration to Flash memory using the write memory command.
pixfirewall> enablepassword:pixfirewall# configure terminalpixfirewall(config)# write terminal: Saved... config commands ...: Endwrite memorycrypto dynamic-map
Create, view, or delete a dynamic crypto map entry. (Configuration mode.)
crypto dynamic-map dynamic-map-name dynamic-seq-num
no crypto dynamic-map dynamic-map-name [dynamic-seq-num]
crypto dynamic-map dynamic-map-name dynamic-seq-num match address access-list-name
no crypto dynamic-map dynamic-map-name dynamic-seq-num match address access-list-name
crypto dynamic-map dynamic-map-name dynamic-seq-num set peer hostname | ip-address
no crypto dynamic-map dynamic-map-name dynamic-seq-num set peer hostname | ip-address
crypto dynamic-map dynamic-map-name dynamic-seq-num set pfs [group1 | group2]
no crypto dynamic-map dynamic-map-name dynamic-seq-num set pfs
crypto dynamic-map dynamic-map-name dynamic-seq-num set security-association lifetime seconds seconds | kilobytes kilobytes
no crypto dynamic-map dynamic-map-name dynamic-seq-num set security-association lifetime seconds | kilobytes
crypto dynamic-map dynamic-map-name dynamic-seq-num set transform-set transform-set-name1 [... transform-set-name9]
no crypto dynamic-map dynamic-map-name dynamic-seq-num set transform-set transform-set-name1 [... transform-set-name9]
show crypto dynamic-map [tag dynamic-map-name]
Note
Syntax Description
Note
Usage Guidelines
crypto dynamic-map
The crypto dynamic-map command allows you to create a dynamic crypto map entry. The no crypto dynamic-map command deletes a dynamic crypto map set or entry. The show crypto dynamic-map command allows you to view a dynamic crypto map set.
Dynamic crypto maps are policy templates used when processing negotiation requests for new security associations from a remote IPSec peer, even if you do not know all of the crypto map parameters required to communicate with the peer (such as the peer's IP address). For example, if you do not know about all the remote IPSec peers in your network, a dynamic crypto map allows you to accept requests for new security associations from previously unknown peers. (However, these requests are not processed until the IKE authentication has completed successfully.)
When a PIX Firewall receives a negotiation request via IKE from another peer, the request is examined to see if it matches a crypto map entry. If the negotiation does not match any explicit crypto map entry, it will be rejected unless the crypto map set includes a reference to a dynamic crypto map.
The dynamic crypto map accepts "wildcard" parameters for any parameters not explicitly stated in the dynamic crypto map entry. This allows you to set up IPSec security associations with a previously unknown peer. (The peer still must specify matching values for the "wildcard" IPSec security association negotiation parameters.)
If the PIX Firewall accepts the peer's request, at the point that it installs the new IPSec security associations it also installs a temporary crypto map entry. This entry is filled in with the results of the negotiation. At this point, the PIX Firewall performs normal processing, using this temporary crypto map entry as a normal entry, even requesting new security associations if the current ones are expiring (based upon the policy specified in the temporary crypto map entry). Once the flow expires (that is, all of the corresponding security associations expire), the temporary crypto map entry is removed.
Dynamic crypto maps are used for determining whether or not traffic should be protected.
Note
Examples
The following example configures an IPSec crypto map set.
Crypto map entry mymap 30 references the dynamic crypto map set mydynamicmap, which can be used to process inbound security association negotiation requests that do not match mymap entries 10 or 20. In this case, if the peer specifies a transform set that matches one of the transform sets specified in mydynamicmap, for a flow "permitted" by the access list 103, IPSec will accept the request and set up security associations with the remote peer without previously knowing about the peer. If accepted, the resulting security associations (and temporary crypto map entry) are established according to the settings specified by the remote peer.
The access list associated with mydynamicmap 10 is also used as a filter. Inbound packets that match a permit statement in this list are dropped for not being IPSec protected. (The same is true for access lists associated with static crypto maps entries.) Outbound packets that match a permit statement without an existing corresponding IPSec security association are also dropped.
crypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set my_t_set1crypto map mymap 10 set peer 10.0.0.1 10.0.0.2crypto map mymap 20 ipsec-isakmpcrypto map mymap 20 match address 102crypto map mymap 20 set transform-set my_t_set1 my_t_set2crypto map mymap 20 set peer 10.0.0.3crypto dynamic-map mydynamicmap 10 match address 103dynamic-map mydynamicmap 10 set transform-set my_t_set1 my_t_set2 my_t_set3crypto map mymap 30 ipsec-isakmp dynamic mydynamicmapThe following is sample output for the show crypto dynamic-map command:
show crypto dynamic-mapCrypto Map Template "dyn1" 10access-list 152 permit ip host 172.21.114.67 anyCurrent peer: 0.0.0.0Security association lifetime: 4608000 kilobytes/120 secondsPFS (Y/N): NTransform sets={ tauth, t1, }The following partial configuration was in effect when the above show crypto dynamic-map command was issued:
crypto ipsec security-association lifetime seconds 120crypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto ipsec transform-set tauth ah-sha-hmaccrypto dynamic-map dyn1 10crypto dynamic-map dyn1 set transform-set tauth t1crypto dynamic-map dyn1 match address 152crypto map to-firewall local-address Ethernet0crypto map to-firewall 10 ipsec-isakmpcrypto map to-firewall 10 set peer 172.21.114.123crypto map to-firewall 10 set transform-set tauth t1crypto map to-firewall 10 match address 150crypto map to-firewall 20 ipsec-isakmp dynamic dyn1access-list 150 permit ip host 172.21.114.67 host 172.21.114.123access-list 150 permit ip host 15.15.15.1 host 172.21.114.123access-list 150 permit ip host 15.15.15.1 host 8.8.8.1access-list 152 permit ip host 172.21.114.67 anycrypto dynamic-map match address
See the crypto map match address command within the crypto map command page for information about this command.
crypto dynamic-map set peer
See the crypto map set peer command within the crypto map command page for information about this command.
crypto dynamic-map set pfs
See the crypto map set pfs command within the crypto map command page for information about this command.
crypto dynamic-map set security-association lifetime
See the crypto map set security-association lifetime command within the crypto map command page for information about this command.
crypto dynamic-map set transform-set
See the crypto map set transform-set command within the crypto map command page for information about this command.
Note
crypto ipsec
Create, view, or delete crypto related global values (Configuration mode.)
crypto ipsec security-association lifetime seconds seconds | kilobytes kilobytes
no crypto ipsec security-association lifetime seconds | kilobytes
show crypto ipsec security-association lifetime
crypto ipsec transform-set transform-set-name transform1 [transform2 [transform3]]
no crypto ipsec transform-set transform-set-name
show crypto ipsec transform-set [tag transform-set-name]
clear crypto [ipsec] sa
clear crypto [ipsec] sa peer
clear crypto [ipsec] sa map map-name
clear crypto [ipsec] sa entry destination-address protocol spi
clear crypto [ipsec] sa counters
show crypto ipsec sa [map map-name | address | identity] [detail]
Note
Syntax Description
Usage Guidelines
crypto ipsec security-association lifetime
The crypto ipsec security-association lifetime command is used to change global lifetime values used when negotiating IPSec security associations. To reset a lifetime to the default value, use the no crypto ipsec security-association lifetime command. The show crypto ipsec security-association lifetime command allows you to view the security-association lifetime value configured for a particular crypto map entry.
IPSec security associations use shared secret keys. These keys and their security associations time out together.
Assuming that the particular crypto map entry does not have lifetime values configured, when the PIX Firewall requests new security associations during security association negotiation, it will specify its global lifetime value in the request to the peer; it will use this value as the lifetime of the new security associations. When the PIX Firewall receives a negotiation request from the peer, it will use the smaller of the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations.
There are two lifetimes: a "timed" lifetime and a "traffic-volume" lifetime. The security association expires after the first of these lifetimes is reached.
If you change a global lifetime, the change is only applied when the crypto map entry does not have a lifetime value specified. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command. See the clear crypto [ipsec] sa command within the crypto ipsec command page for more information.
To change the global timed lifetime, use the crypto ipsec security-association lifetime seconds command. The timed lifetime causes the security association to time out after the specified number of seconds have passed.
To change the global traffic-volume lifetime, use the crypto ipsec security-association lifetime kilobytes command. The traffic-volume lifetime causes the security association to time out after the specified amount of traffic (in kilobytes) has been protected by the security associations' key.
Shorter lifetimes can make it harder to mount a successful key recovery attack, since the attacker has less data encrypted under the same key to work with. However, shorter lifetimes require more CPU processing time for establishing new security associations. The lifetime values are ignored for manually established security associations (security associations installed using an ipsec-manual crypto map command entry).
The security association (and corresponding keys) will expire according to whichever occurs sooner, either after the number of seconds has passed (specified by the seconds keyword) or after the amount of traffic in kilobytes has passed (specified by the kilobytes keyword).
A new security association is negotiated before the lifetime threshold of the existing security association is reached, to ensure that a new security association is ready for use when the old one expires. The new security association is negotiated either 30 seconds before the seconds lifetime expires or when the volume of traffic through the tunnel reaches 256 kilobytes less than the kilobytes lifetime (whichever occurs first).
If no traffic has passed through the tunnel during the entire life of the security association, a new security association is not negotiated when the lifetime expires. Instead, a new security association will be negotiated only when IPSec sees another packet that should be protected.
Examples
This example shortens both lifetimes, because the administrator feels there is a higher risk that the keys could be compromised. The timed lifetime is shortened to 2,700 seconds (45 minutes), and the traffic-volume lifetime is shortened to 2,304,000 kilobytes (10 megabytes per second for one half hour).
crypto ipsec security-association lifetime seconds 2700crypto ipsec security-association lifetime kilobytes 2304000The following is a sample output for the show crypto ipsec security-association lifetime command:
show crypto ipsec security-association lifetimeSecurity-association lifetime: 4608000 kilobytes/120 secondsThe following configuration was in effect when the above show crypto ipsec security-association lifetime command was issued:
crypto ipsec security-association lifetime seconds 120crypto ipsec transform-set
The crypto ipsec transform-set command defines a transform set. To delete a transform set, use the no crypto ipsec transform-set command. To view the configured transform sets, use the show crypto ipsec transform-set command.
A transform set specifies one or two IPSec security protocols (either ESP or AH or both) and specifies which algorithms to use with the selected security protocol. During the IPSec security association negotiation, the peers agree to use a particular transform set when protecting a particular data flow.
You can configure multiple transform sets, and then specify one or more of these transform sets in a crypto map entry. The transform set defined in the crypto map entry is used in the IPSec security association negotiation to protect the data flows specified by that crypto map entry's access list. During the negotiation, the peers search for a transform set that is the same at both peers. When such a transform set is found, it is selected and is applied to the protected traffic as part of both peer's IPSec security associations.
When security associations are established manually, a single transform set must be used. The transform set is not negotiated.
Before a transform set can be included in a crypto map entry, it must be defined using the crypto ipsec transform-set command.
To define a transform set, you specify one to three "transforms"—each transform represents an IPSec security protocol (ESP or AH) plus the algorithm you want to use. When the particular transform set is used during negotiations for IPSec security associations, the entire transform set (the combination of protocols, algorithms, and other settings) must match a transform set at the remote peer.
In a transform set you could specify the AH protocol, the ESP protocol, or both. If you specify an ESP protocol in a transform set, you can specify just an ESP encryption transform or both an ESP encryption transform and an ESP authentication transform.
Examples of acceptable transform combinations are as follows:
•
•
•
•
If one or more transforms are specified in the crypto ipsec transform-set command for an existing transform set, the specified transforms will replace the existing transforms for that transform set.
If you change a transform set definition, the change is only applied to crypto map entries that reference the transform set. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command.
For more information about transform sets, see "Transform Sets" in "."
Examples
This example defines one transform set (named "standard"), which will be used with an IPSec peer that supports the ESP protocol. Both an ESP encryption transform and an ESP authentication transform is specified in this example:
crypto ipsec transform-set standard esp-des esp-md5-hmacThe following is a sample output for the show crypto ipsec transform-set command:
show crypto ipsec transform-setTransform set combined-des-sha: { esp-des esp-sha-hmac }will negotiate = { Tunnel, },Transform set combined-des-md5: { esp-des esp-md5-hmac }will negotiate = { Tunnel, },Transform set t1: { esp-des esp-md5-hmac }will negotiate = { Tunnel, },Transform set t100: { ah-sha-hmac }will negotiate = { Tunnel, },Transform set t2: { ah-sha-hmac }will negotiate = { Tunnel, },{ esp-des }will negotiate = { Tunnel, },The following configuration was in effect when the above show crypto ipsec transform-set command was issued:
crypto ipsec transform-set combined-des-sha esp-des esp-sha-hmaccrypto ipsec transform-set combined-des-md5 esp-des esp-md5-hmaccrypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto ipsec transform-set t100 ah-sha-hmaccrypto ipsec transform-set t2 ah-sha-hmac esp-descrypto ipsec set transform-set
The crypto ipsec set transform-set command allows you to specify which transform sets can be used with a given crypto map entry. Use the no crypto ipsec set transform-set command to remove all transform sets from a crypto map entry. This command is required for all static and dynamic crypto map entries.
For an ipsec-isakmp crypto map entry, you can list multiple transform sets with this command. List the higher priority transform sets first.
If the PIX Firewall initiates the negotiation, the transform sets are presented to the IPSec peer in the order specified in the crypto map entry. If the IPSec peer initiates the negotiation, the PIX Firewall accepts the first transform set that matches one of the transform sets specified in the crypto map entry.
The first matching transform set that is found at both peers is used for the security association. If no match is found, IPSec will not establish a security association. The traffic will be dropped because there is no security association to protect the traffic.
For an ipsec-manual crypto map entry, you can specify only one transform set. If the transform set does not match the transform set at the remote peer's crypto map, the two peers will fail to correctly communicate because the peers are using different rules to process the traffic.
If you want to change the list of transform sets, re-specify the new list of transform sets to replace the old list. This change is only applied to crypto map entries that reference this transform set. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command.
Any transform sets included in a crypto map must previously have been defined using the crypto ipsec transform-set command.
Example
The following example defines two transform sets and specifies that they can both be used within a crypto map entry. (This example applies only when IKE is used to establish security associations. With crypto maps used for manually established security associations, only one transform set can be included in a given crypto map entry.)
crypto ipsec transform-set my_t_set1 esp-des esp-sha-hmaccrypto ipsec transform-set my_t_set2 ah-sha-hmac esp-des esp-sha-hmaccrypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set my_t_set1 my_t_set2crypto map mymap set peer 10.0.0.1 10.0.0.2In this example, when traffic matches access list 101, the security association can use either transform set "my_t_set1" (first priority) or "my_t_set2" (second priority) depending on which transform set matches the IPSec peer's transform sets.
clear crypto [ipsec] sa
The clear crypto ipsec sa command allows you to delete IPSec security associations. If the security associations were established via IKE, they are deleted and future IPSec traffic will require new security associations to be negotiated. When IKE is used, the IPSec security associations are established only when needed.
If the security associations are manually established, the security associations are deleted.
If the peer, map, entry, or counters keywords are not used, all IPSec security associations will be deleted. This command clears (deletes) IPSec security associations.
If the security associations were established via IKE, they are deleted and future IPSec traffic will require new security associations to be negotiated. (When IKE is used, the IPSec security associations are established only when needed.)
If the security associations are manually established, the security associations are deleted and reinstalled. (When IKE is not used, the IPSec security associations are created as soon as the configuration is completed.)
If the peer, map, entry, or counters keywords are not used, all IPSec security associations will be deleted.
The peer keyword deletes any IPSec security associations for the specified peer.
The map keyword deletes any IPSec security associations for the named crypto map set.
The entry keyword deletes the IPSec security association with the specified address, protocol, and SPI.
If any of the previous commands cause a particular security association to be deleted, all the "sibling" security associations—that were established during the same IKE negotiation—are deleted as well.
The counters keyword simply clears the traffic counters maintained for each security association; it does not clear the security associations themselves.
If you make configuration changes that affect security associations, these changes will not apply to existing security associations but to negotiations for subsequent security associations. You can use the clear crypto sa command to restart all security associations so they will use the most current configuration settings. In the case of manually established security associations, if you make changes that affect security associations you must use the clear crypto sa command before the changes take effect.
Note
If the PIX Firewall is processing active IPSec traffic, Cisco recommends that you only clear the portion of the security association database that is affected by the changes to avoid causing active IPSec traffic to temporarily fail.
Note
Examples
The following example clears (and reinitializes if appropriate) all IPSec security associations at the PIX Firewall:
clear crypto saThe following example clears (and reinitializes if appropriate) the inbound and outbound IPSec security associations established along with the security association established for address 10.0.0.1 using the AH protocol with the SPI of 256:
clear crypto sa entry 10.0.0.1 AH 256show crypto ipsec sa
The show crypto ipsec sa command allows you to view the settings used by current security associations. If no keyword is used, all security associations are displayed. They are sorted first by interface, and then by traffic flow (for example, source/destination address, mask, protocol, port). Within a flow, the security associations are listed by protocol (ESP/AH) and direction (inbound/outbound).
Examples
The following is a sample output for the show crypto ipsec sa command:
show crypto ipsec sainterface: Ethernet0Crypto map tag: firewall-alice, local addr. 172.21.114.123local ident (addr/mask/prot/port): (172.21.114.123/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (172.21.114.67/255.255.255.255/0/0)current_peer: 172.21.114.67PERMIT, flags={origin_is_acl,}#pkts encaps: 10, #pkts encrypt: 10, #pkts digest 10#pkts decaps: 10, #pkts decrypt: 10, #pkts verify 10#send errors 10, #recv errors 0local crypto endpt.: 172.21.114.123, remote crypto endpt.: 172.21.114.67path mtu 1500, media mtu 1500current outbound spi: 20890A6Finbound esp sas:spi: 0x257A1039(628756537)transform: esp-des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 26, crypto map: firewall-alicesa timing: remaining key lifetime (k/sec): (4607999/90)IV size: 8 bytesreplay detection support: Yinbound ah sas:outbound esp sas:spi: 0x20890A6F(545852015)transform: esp-des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 27, crypto map: firewall-alicesa timing: remaining key lifetime (k/sec): (4607999/90)IV size: 8 bytesreplay detection support: Youtbound ah sas:interface: Tunnel0Crypto map tag: firewall-alice, local addr. 172.21.114.123local ident (addr/mask/prot/port): (172.21.114.123/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (172.21.114.67/255.255.255.255/0/0)current_peer: 172.21.114.67PERMIT, flags={origin_is_acl,}#pkts encaps: 10, #pkts encrypt: 10, #pkts digest 10#pkts decaps: 10, #pkts decrypt: 10, #pkts verify 10#send errors 10, #recv errors 0local crypto endpt.: 172.21.114.123, remote crypto endpt.: 172.21.114.67path mtu 1500, media mtu 1500current outbound spi: 20890A6Finbound esp sas:spi: 0x257A1039(628756537)transform: esp-des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 26, crypto map: firewall-alicesa timing: remaining key lifetime (k/sec): (4607999/90)IV size: 8 bytesreplay detection support: Yinbound ah sas:outbound esp sas:spi: 0x20890A6F(545852015)transform: esp-des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 27, crypto map: firewall-alicesa timing: remaining key lifetime (k/sec): (4607999/90)IV size: 8 bytesreplay detection support: Youtbound ah sas:crypto map
To create, modify, view or delete a crypto map entry. Also used to delete a crypto map set. (Configuration mode.)
crypto map map-name client configuration address initiate | respond
no crypto map map-name client configuration address initiate | respond
crypto map map-name interface interface-name
no crypto map map-name interface interface-name
show crypto map [interface interface-name | tag map-name]
crypto map map-name seq-num ipsec-isakmp | ipsec-manual [dynamic dynamic-map-name]
no crypto map map-name seq-num
crypto map map-name seq-num match address access-list-name
no crypto map map-name seq-num match address access-list-name
crypto map map-name seq-num set peer hostname | ip-address
no crypto map map-name seq-num set peer hostname | ip-address
crypto map map-name seq-num set pfs [group1 | group2]
no crypto map map-name seq-num set pfs
crypto map map-name seq-num set security-association lifetime seconds seconds | kilobytes kilobytes
no crypto map map-name seq-num set security-association lifetime seconds seconds | kilobytes kilobytes
crypto map map-name set session-key inbound | outbound ah spi hex-key-string
no crypto map map-name seq-num set session-key inbound | outbound ah
crypto map map-name set session-key inbound | outbound esp spi cipher hex-key-string [authenticator hex-key-string]
no crypto map map-name seq-num set session-key inbound | outbound esp
crypto map map-name seq-num set transform-set transform-set-name1
[... transform-set-name6]no crypto map map-name seq-num set transform-set transform-set-name1
[... transform-set-name6]
Note
Syntax Description
Usage Guidelines
crypto map client configuration address
Use the crypto map client configuration address command to configure IKE Mode Configuration on your PIX Firewall. The IKE Mode Configuration allows the PIX Firewall to download an IP address to the peer (client) as part of an IKE negotiation. With crypto map client configuration address command, you define the crypto map(s) that should attempt to configure the peer.
Use the no crypto map client configuration address command to restore the default value. The IKE Mode Configuration is not enabled by default.
The keyword initiate indicates the PIX Firewall will attempt to set IP addresses for each peer. The respond keyword indicates the PIX Firewall will accept requests for IP addresses from any requesting peer.
See the section "About IKE Mode Configuration (Dynamic IP Address Assignment for Cisco Secure VPN Client)" in "," for more information about the IKE Mode Configuration.
Examples
The following examples configure IKE Mode Configuration on your PIX Firewall:
crypto map mymap client configuration address initiatecrypto map mymap client configuration address respondcrypto map interface
The crypto map interface command applies a previously defined crypto map set to an interface. Use the no crypto map command to remove the crypto map set from the interface. Use the show crypto map [interface | tag] to view the crypto map configuration.
Use this command to assign a crypto map set to an interface. You must assign a crypto map set to an interface before that interface can provide IPSec services. Only one crypto map set can be assigned to an interface. If multiple crypto map entries have the same map-name but a different seq-num, they are considered to be part of the same set and will all be applied to the interface. The crypto map entry with the lowest seq-num is considered the highest priority and will be evaluated first. A single crypto map set can contain a combination of ipsec-isakmp and ipsec-manual crypto map entries.
Note
Examples
The following example assigns crypto map set mymap to the outside interface. When traffic passes through the outside interface, the traffic will be evaluated against all the crypto map entries in the mymap set. When outbound traffic matches an access list in one of the mymap crypto map entries, a security association (if IPsec) will be established per that crypto map entry's configuration (if no security association or connection already exists).
crypto map mymap interface outsideThe following is sample output for the show crypto map command:
show crypto mapCrypto Map: "firewall-alice" pif: outside local address: 172.21.114.123Crypto Map "firewall-alice" 10 ipsec-isakmpPeer = 172.21.114.67access-list 141 permit ip host 172.21.114.123 host 172.21.114.67Current peer: 172.21.114.67Security-association lifetime: 4608000 kilobytes/120 secondsPFS (Y/N): NTransform sets={ t1, }The following configuration was in effect when the above show crypto map command was issued:
crypto map firewall-alice 10 ipsec-isakmpcrypto map firewall-alice 10 set peer 172.21.114.67crypto map firewall-alice 10 set transform-set t1crypto map firewall-alice 10 match address 141The following is sample output for the show crypto map command when manually established security associations are used:
show crypto mapCrypto Map "multi-peer" 20 ipsec-manualPeer = 172.21.114.67access-list 120 permit ip host 1.1.1.1 host 1.1.1.2Current peer: 172.21.114.67Transform sets={ t2, }Inbound esp spi: 0,cipher key: ,auth_key: ,Inbound ah spi: 256,key: 010203040506070809010203040506070809010203040506070809,Outbound esp spi: 0cipher key: ,auth key: ,Outbound ah spi: 256,key: 010203040506070809010203040506070809010203040506070809,The following configuration was in effect when the above show crypto map command was issued:
crypto map multi-peer 20 ipsec-manualcrypto map multi-peer 20 set peer 172.21.114.67crypto map multi-peer 20 set session-key inbound ah 256010203040506070809010203040506070809010203040506070809crypto map multi-peer 20 set session-key outbound ah 256010203040506070809010203040506070809010203040506070809crypto map multi-peer 20 set transform-set t2crypto map multi-peer 20 match address 120crypto map ipsec-manual | ipsec-isakmp
To create or modify a crypto map entry, use the crypto map ipsec-manual | ipsec-isakmp command. To create or modify an ipsec-manual crypto map entry, use the ipsec-manual option of the command. To create or modify an ipsec-isakmp crypto map entry, use the ipsec-isakmp option of the command. Use the no crypto map command to delete a crypto map entry or set.
Note
Once a crypto map entry has been created, you cannot change the parameters specified at the global configuration level because these parameters determine which of the configuration commands are valid at the crypto map level. For example, once a map entry has been created as ipsec-isakmp, you cannot change it to ipsec-manual; you must delete and reenter the map entry.
After you define crypto map entries, you can use the crypto map interface command to assign the crypto map set to interfaces.
Crypto maps provide two functions: filtering/classifying traffic to be protected, and defining the policy to be applied to that traffic. The first use affects the flow of traffic on an interface; the second affects the negotiation performed (via IKE) on behalf of that traffic.
IPSec crypto maps link together definitions of the following:
•
•
•
•
A crypto map set is a collection of crypto map entries each with a different seq-num but the same map-name. Therefore, for a given interface, you could have certain traffic forwarded to one peer with specified security applied to that traffic, and other traffic forwarded to the same or a different peer with different IPSec security applied. To accomplish this you would create two crypto maps, each with the same map-name, but each with a different seq-num.
The number you assign to the seq-num argument should not be arbitrary. This number is used to rank multiple crypto map entries within a crypto map set. Within a crypto map set, a crypto map entry with a lower seq-num is evaluated before a map entry with a higher seq-num; that is, the map entry with the lower number has a higher priority.
Examples
The following example shows the minimum required crypto map configuration when IKE will be used to establish the security associations:
crypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap set transform-set my_t_set1crypto map mymap set peer 10.0.0.1The following example shows the minimum required crypto map configuration when the security associations are manually established.crypto transform-set someset ah-md5-hmac esp-descrypto map mymap 10 ipsec-manualcrypto map mymap 10 match address 102crypto map mymap 10 set transform-set somesetcrypto map mymap 10 set peer 10.0.0.5crypto map mymap 10 set session-key inbound ah 256 98765432109876549876543210987654crypto map mymap 10 set session-key outbound ah 256 fedcbafedcbafedcfedcbafedcbafedccrypto map mymap 10 set session-key inbound esp 256 cipher 0123456789012345crypto map mymap 10 set session-key outbound esp 256 cipher abcdefabcdefabcdcrypto map ipsec-isakmp dynamic
To specify that a given crypto map entry is to reference a pre-existing dynamic crypto map, use the crypto map ipsec-isakmp dynamic command.
Use the crypto dynamic-map command to create dynamic crypto map entries. After you create a dynamic crypto map set, use the crypto map ipsec-isakmp dynamic command to add the dynamic crypto map set to a static crypto map.
Give crypto map entries which reference dynamic map sets the lowest priority map entries so that inbound security association negotiation requests will try to match the static maps first. Only after the request does not match any of the static maps do you want it to be evaluated against the dynamic map set.
To make a crypto map entry that references a dynamic crypto map to be set to the lowest priority map entry, give the map entry the highest seq-num of all the map entries in a crypto map set.
For more information about dynamic maps, see the section "Dynamic Crypto Maps" in "."
Examples
The following example configures an IPSec crypto map set that includes a reference to a dynamic crypto map set.
Crypto map "mymap 10" allows security associations to be established between the PIX Firewall and either (or both) of two remote IPSec peers for traffic matching access list 101. Crypto map "mymap 20" allows either of two transform sets to be negotiated with the peer for traffic matching access list 102.
Crypto map entry "mymap 30" references the dynamic crypto map set "mydynamicmap," which can be used to process inbound security association negotiation requests that do not match "mymap" entries 10 or 20. In this case, if the peer specifies a transform set that matches one of the transform sets specified in "mydynamicmap" for a flow "permitted" by the access list 103, IPSec will accept the request and set up security associations with the peer without previously knowing about the peer. If accepted, the resulting security associations (and temporary crypto map entry) are established according to the settings specified by the peer.
The access list associated with "mydynamicmap 10" is also used as a filter. Inbound packets that match a permit statement in this list are dropped for not being IPSec protected. (The same is true for access lists associated with static crypto maps entries.) Outbound packets that match a permit statement without an existing corresponding IPSec security association are also dropped.
crypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set my_t_set1crypto map mymap 10 set peer 10.0.0.1crypto map mymap 10 set peer 10.0.0.2crypto map mymap 20 ipsec-isakmpcrypto map mymap 10 match address 102crypto map mymap 10 set transform-set my_t_set1 my_t_set2crypto map mymap 10 set peer 10.0.0.3crypto dynamic-map mydynamicmap 10crypto dynamic-map mydynamicmap 10 match address 103crypto dynamic-map mydynamicmap 10 set transform-set my_t_set1 my_t_set2 my_t_set3crypto map mymap 30 ipsec-isakmp dynamic mydynamicmapcrypto map match address
To assign an extended access list to a crypto map entry, use the crypto map match address command. Use the no crypto map match address command to remove the extended access list from a crypto map entry.
This command is required for all static crypto map entries. If you are defining a dynamic crypto map entry (with the crypto dynamic-map command), this command is not required but is strongly recommended.
Use the access-list command to define this access list.
The access list specified with this command will be used by IPSec to determine which traffic should be protected by IPSec crypto and which traffic does not need protection. (Traffic that is permitted by the access list will be protected. Traffic that is denied by the access list will not be protected in the context of the corresponding crypto map entry.)
Note
The crypto access list specified by this command is used when evaluating both inbound and outbound traffic. Outbound traffic is evaluated against the crypto access lists specified by the interface's crypto map entries to determine if it should be protected by crypto, and if so (if traffic matches a permit entry), which crypto policy applies. (If necessary, in the case of static IPSec crypto maps, new security associations are established using the data flow identity as specified in the permit entry; in the case of dynamic crypto map entries, if no security association exists, the packet is dropped.) After passing the regular access lists at the interface, inbound traffic is evaluated against the crypto access lists specified by the entries of the interface's crypto map set to determine if it should be protected by crypto and, if so, which crypto policy applies. (In the case of IPSec, unprotected traffic is discarded because it should have been protected by IPSec.)
The access list is also used to identify the flow for which the IPSec security associations are established. In the outbound case, the permit entry is used as the data flow identity (in general), while in the inbound case the data flow identity specified by the peer must be "permitted" by the crypto access list.
Note
Examples
The following example shows the minimum required crypto map configuration when IKE will be used to establish the security associations. (This example is for a static crypto map.)
crypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set my_t_set1crypto map mymap 10 set peer 10.0.0.1crypto map set peer
Use the crypto map set peer command to specify an IPSec peer in a crypto map entry. Use the no crypto map set peer command to remove an IPSec peer from a crypto map entry.
This command is required for all static crypto maps. If you are defining a dynamic crypto map (with the crypto dynamic-map command), this command is not required, and in most cases is not used because, in general, the peer is unknown.
For ipsec-isakmp crypto map entries, you can specify multiple peers by repeating this command. The peer that packets are actually sent to is determined by the last peer that the PIX Firewall received either traffic or a negotiation request from for a given data flow. If the attempt fails with the first peer, IKE tries the next peer on the crypto map list.
For ipsec-manual crypto entries, you can specify only one peer per crypto map. If you want to change the peer, you must first delete the old peer and then specify the new peer.
You can specify the peer by its host name only if the host name is mapped to the peer's IP address in a DNS server or if you manually map the host name to the IP address with the ip host command.
Examples
The following example shows a crypto map configuration when IKE will be used to establish the security associations. In this example, a security association could be set up to either the peer at 10.0.0.1 or the peer at 10.0.0.2.
crypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set my_t_set1crypto map mymap 10 set peer 10.0.0.1 10.0.0.2crypto map set pfs
The crypto map set pfs command sets IPSec to ask for perfect forward secrecy (PFS) when requesting new security associations for this crypto map entry, or that IPSec requires PFS when receiving requests for new security associations. To specify that IPSec should not request PFS, use the no crypto map set pfs command. This command is only available for ipsec-isakmp crypto map entries and dynamic crypto map entries.
By default, PFS is not requested.
With PFS, every time a new security association is negotiated, a new Diffie-Hellman exchange occurs, which requires additional processing time. PFS adds another level of security because if one key is ever cracked by an attacker, only the data sent with that key will be compromised.
During negotiation, this command causes IPSec to request PFS when requesting new security associations for the crypto map entry. The default (group1) is sent if the set pfs statement does not specify a group. If the peer initiates the negotiation and the local configuration specifies PFS, the peer must perform a PFS exchange or the negotiation will fail. If the local configuration does not specify a group, a default of group1 will be assumed, and an offer of either group1 or group2 will be accepted. If the local configuration specifies group2, that group must be part of the peer's offer or the negotiation will fail. If the local configuration does not specify PFS, it will accept any offer of PFS from the peer.
The 1024-bit Diffie-Hellman prime modulus group, group2, provides more security than group1, but requires more processing time than group1.
Examples
This example specifies that PFS should be used whenever a new security association is negotiated for the crypto map "mymap 10":
crypto map mymap 10 ipsec-isakmpcrypto map mymap 10 set pfs group2crypto map set security-association lifetime
To override (for a particular crypto map entry) the global lifetime value, which is used when negotiating IPSec security associations, use the crypto map set security-association lifetime command. To reset a crypto map entry's lifetime value to the global value, use the no crypto map set security-association lifetime command.
The crypto map's security associations are negotiated according to the global lifetimes.
This command is only available for ipsec-isakmp crypto map entries and dynamic crypto map entries.
IPSec security associations use shared secret keys. These keys and their security associations time out together.
Assuming that the particular crypto map entry has lifetime values configured, when the PIX Firewall requests new security associations during security association negotiation, it will specify its crypto map lifetime value in the request to the peer; it will use this value as the lifetime of the new security associations. When the PIX Firewall receives a negotiation request from the peer, it will use the smaller of the lifetime value proposed by the peer or the locally configured lifetime value as the lifetime of the new security associations.
There are two lifetimes: a "timed" lifetime and a "traffic-volume" lifetime. The session keys/security association expires after the first of these lifetimes is reached.
If you change a lifetime, the change will not be applied to existing security associations, but will be used in subsequent negotiations to establish security associations for data flows supported by this crypto map entry. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command. See the clear crypto sa command for more details.
To change the timed lifetime, use the crypto map set security-association lifetime seconds command. The timed lifetime causes the keys and security association to time out after the specified number of seconds have passed.
To change the traffic-volume lifetime, use the crypto map set security-association lifetime kilobytes command. The traffic-volume lifetime causes the key and security association to time out after the specified amount of traffic (in kilobytes) has been protected by the security association's key.
Shorter lifetimes can make it harder to mount a successful key recovery attack, because the attacker has less data encrypted under the same key to work with.
However, shorter lifetimes require more CPU processing time.
The lifetime values are ignored for manually established security associations (security associations installed via an ipsec-manual crypto map entry).
To for more information about how these lifetimes, see "How These Lifetimes Work" in "."
Examples
This example shortens the timed lifetime for a particular crypto map entry, because there is a higher risk that the keys could be compromised for security associations belonging to the crypto map entry. The traffic-volume lifetime is not changed because there is not a high volume of traffic anticipated for these security associations. The timed lifetime is shortened to 2,700 seconds (45 minutes).
crypto map mymap 10 ipsec-isakmpset security-association lifetime seconds 2700crypto map set session-key
To manually specify the IPSec session keys within a crypto map entry, use the crypto map set session-key command. Use the no crypto map set session-key command to remove IPSec session keys from a crypto map entry. This command is only available for ipsec-manual crypto map entries.
If the crypto map's transform set includes:
•
•
•
When you define multiple IPSec session keys within a single crypto map, you can assign the same security parameter index (SPI) number to all the keys. The SPI is used to identify the security association used with the crypto map. However, not all peers have the same flexibility in SPI assignment.
You may have to coordinate SPI assignment with the peer's network administrator, making certain that the same SPI is not used more than once for the same destination address/protocol combination.
Security associations established using this command do not expire (unlike security associations established using IKE).
The PIX Firewall's session keys must match its peer's session keys.
If you change a session key, the security association using the key will be deleted and reinitialized.
Examples
The following example shows a crypto map entry for manually established security associations. The transform set "t_set" includes only an AH protocol.
crypto ipsec transform-set t_set ah-sha-hmaccrypto map mymap 20 ipsec-manualcrypto map mymap 20 match address 102crypto map mymap 20 set transform-set t_setcrypto map mymap 20 set peer 10.0.0.21crypto map mymap 20 set session-key inbound ah 300 1111111111111111111111111111111111111111crypto map mymap 20 set session-key outbound ah 300 2222222222222222222222222222222222222222The following example shows a crypto map entry for manually established security associations. The transform set "someset" includes both an AH and an ESP protocol, so session keys are configured for both AH and ESP for both inbound and outbound traffic. The transform set includes both encryption and authentication ESP transforms, so session keys are created for both using the cipher and authenticator keywords.
crypto ipsec transform-set someset ah-sha-hmac esp-des esp-sha-hmaccrypto map mymap 10 ipsec-manualcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set somesetcrypto map mymap 10 set peer 10.0.0.1crypto map mymap 10 set session-key inbound ah 300 9876543210987654321098765432109876543210crypto map mymap 10 set session-key outbound ah 300 fedcbafedcbafedcbafedcbafedcbafedcbafedccrypto map mymap 10 set session-key inbound esp 300 cipher 0123456789012345authenticator 0000111122223333444455556666777788889999crypto map mymap 10 set session-key outbound esp 300 cipher abcdefabcdefabcdauthenticator 9999888877776666555544443333222211110000
crypto map set transform-set
To specify which transform sets can be used with the crypto map entry, use the crypto map set transform-set command. Use the no crypto map set transform-set command to remove all transform sets from a crypto map entry.
This command is required for all static and dynamic crypto map entries.
For an ipsec-isakmp crypto map entry, you can list up to six transform sets with this command. List the higher priority transform sets first.
If the local PIX Firewall initiates the negotiation, the transform sets are presented to the peer in the order specified in the crypto map command statement. If the peer initiates the negotiation, the local PIX Firewall accepts the first transform set that matches one of the transform sets specified in the crypto map entry.
The first matching transform set that is found at both peers is used for the security association. If no match is found, IPSec will not establish a security association. The traffic will be dropped because there is no security association to protect the traffic.
For an ipsec-manual crypto map command statement, you can specify only one transform set. If the transform set does not match the transform set at the remote peer's crypto map, the two peers will fail to correctly communicate because the peers are using different rules to process the traffic.
If you want to change the list of transform sets, respecify the new list of transform sets to replace the old list. This change is only applied to crypto map command statements that reference this transform set. The change will not be applied to existing security associations, but will be used in subsequent negotiations to establish new security associations. If you want the new settings to take effect sooner, you can clear all or part of the security association database by using the clear crypto sa command.
Any transform sets included in a crypto map command statement must previously have been defined using the crypto ipsec transform-set command.
Example
The following example defines two transform sets and specifies that they can both be used within a crypto map entry. (This example applies only when IKE is used to establish security associations. With crypto maps used for manually established security associations, only one transform set can be included in a given crypto map command statement.)
crypto ipsec transform-set my_t_set1 esp-des esp-sha-hmaccrypto ipsec transform-set my_t_set2 ah-sha-hmac esp-des esp-sha-hmaccrypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 101crypto map mymap 10 set transform-set my_t_set1 my_t_set2crypto map mymap set peer 10.0.0.1 10.0.0.2In this example, when traffic matches access list 101 the security association can use either transform set "my_t_set1" (first priority) or "my_t_set2" (second priority) depending on which transform set matches the remote peer's transform sets.
debug
Debug packets or ICMP tracings through the PIX Firewall. (Configuration mode.)
debug crypto ipsec
no debug crypto ipsec
debug crypto isakmp
no debug crypto isakmp
debug crypto ca
no debug crypto ca
debug icmp trace
no debug icmp trace
debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]]
[[proto icmp] | [proto tcp [sport src_port] [dport dest_port]] |
[proto udp [sport src_port] [dport dest_port]] [rx | tx | both]no debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]]
[[proto icmp] | [proto tcp [sport src_port] [dport dest_port]] |
[proto udp [sport src_port] [dport dest_port]] [rx | tx | both]debug sqlnet
no debug sqlnet
show debug
Syntax Description
if_name
Interface name from which the packets are arriving; for example, to monitor packets coming into the PIX Firewall from the outside, set if_name to outside.
src source_ip
Source IP address.
netmask mask
Network mask.
dst dest_ip
Destination IP address.
proto icmp
Display ICMP packets only.
proto tcp
Display TCP packets only.
sport src_port
Source port. See the "Ports" section in "" for a list of valid port literal names.
dport dest_port
Destination port.
proto udp
Display UDP packets only.
rx
Display only packets received at the PIX Firewall.
tx
Display only packets that were transmitted from the PIX Firewall.
both
Display both received and transmitted packets.
Usage Guidelines
The debug command lets you view debug information. The show debug command displays the current state of tracing. You can debug the contents of network layer protocol packets with debug packet.
The debug sqlnet command reports on traffic between Oracle SQL*Net clients and servers through the PIX Firewall. The debug icmp trace command shows ICMP packet information, the source IP address, and the destination address of packets arriving, departing, and traversing the PIX Firewall including pings to the PIX Firewall's own interfaces.
The debug crypto ipsec, debug crypto isakmp, and debug crypto ca commands let you debug IPSec connections. Use the no form of the command to disable debugging.
Use of the debug commands can slow down busy networks.
Trace Channel Feature
The debug icmp trace and debug sqlnet commands now send their output to the Trace Channel. The location of the Trace Channel depends on whether you have a simultaneous Telnet console session running at the same time as the console session, or if you are using only the PIX Firewall serial console:
•
•
•
•
The debug commands are shared between all Telnet and serial console sessions.
Note
Additional debug Command Information
Note
Note
To stop a debug packet trace command, enter:
no debug packet if_nameReplace if_name with the name of the interface; for example, inside, outside, or a perimeter interface name.
To stop a debug icmp trace command, enter:
no debug icmp traceExamples
The following example turns on this command:
debug icmp traceWhen you ping a host through the PIX Firewall from any interface, trace output displays on the console. The following example shows a successful ping from an external host (192.150.50.42) to the PIX Firewall's outside interface (192.150.50.1):
Inbound ICMP echo reply (len 32 id 1 seq 256) 192.150.50.1 > 192.150.50.42Outbound ICMP echo request (len 32 id 1 seq 512) 192.150.50.42 > 192.150.50.1Inbound ICMP echo reply (len 32 id 1 seq 512) 192.150.50.1 > 192.150.50.42Outbound ICMP echo request (len 32 id 1 seq 768) 192.150.50.42 > 192.150.50.1Inbound ICMP echo reply (len 32 id 1 seq 768) 192.150.50.1 > 192.150.50.42Outbound ICMP echo request (len 32 id 1 seq 1024) 192.150.50.42 > 192.150.50.1Inbound ICMP echo reply (len 32 id 1 seq 1024) 192.150.50.1 > 192.150.50.42NO DEBUG ICMP TRACEICMP trace offThis example shows that the ICMP packet length is 32 bytes, that the ICMP packet identifier is 1, and the ICMP sequence number. The ICMP sequence number starts at 0 and is incremented each time a request is sent.
You can debug the contents of packets with the debug packet command:
debug packet inside--------- PACKET ----------- IP --4.3.2.1 ==> 255.3.2.1ver = 0x4 hlen = 0x5 tos = 0x0 tlen = 0x60id = 0x3902 flags = 0x0 frag off=0x0ttl = 0x20 proto=0x11 chksum = 0x5885-- UDP --source port = 0x89 dest port = 0x89len = 0x4c checksum = 0xa6a0-- DATA --00000014: 00 01 00 00 |....00000024: 00 00 00 01 20 45 49 45 50 45 47 45 47 45 46 46 | .... EIEPEGEGEFF00000034: 43 43 4e 46 41 45 44 43 41 43 41 43 41 43 41 43 | CCNFAEDCACACACAC00000044: 41 43 41 41 41 00 00 20 00 01 c0 0c 00 20 00 01 | ACAAA.. ..... ..00000054: 00 04 93 e0 00 06 60 00 01 02 03 04 00 | ......`......--------- END OF PACKET ---------This display lists the information as it appears in a packet.
An example of the show debug command follows:
show debugdebug icmp trace offdebug packet offdebug sqlnet offdisable
Exit privileged mode and return to unprivileged mode. (Privileged mode.)
disable
Usage Guidelines
The disable command exits privileged mode and returns you to unprivileged mode. Use the enable command to return to privileged mode.
Example
The following example shows how to exit privileged mode:
pixfirewall# disablepixfirewall>domain-name
Change the IPSec domain name. (Configuration mode.)
domain-name name
Syntax Description
Usage Guidelines
The domain-name command lets you change the IPSec domain name.
Note
enable
Start privileged mode. (Unprivileged mode.)
enable
Usage Guidelines
The enable command starts privileged mode. The PIX Firewall prompts you for your privileged mode password. By default, a password is not required—press the Enter key at the Password prompt to start privileged mode. Use disable to exit privileged mode. Use enable password to change the password.
Example
The following example shows how to start privileged mode with the enable command and then configuration mode with the configure terminal command.
pixfirewall> enablePassword:pixfirewall# configure terminalpixfirewall(config)#enable password
Set the privileged mode password. (Privileged mode.)
enable password password [encrypted]
show enable password
Syntax Description
password
A case-sensitive password of up to 16 alphanumeric characters.
encrypted
Specifies that the password you entered is already encrypted. The password must be 16 characters in length.
Usage Guidelines
The enable password command changes the privileged mode password, for which you are prompted after you enter the enable command. When the PIX Firewall starts and you enter privileged mode, the password prompt appears. There is not a default password (press the Enter key at the Password prompt). The show enable password command lists the encrypted form of the password.
You can return the enable password to its original value (press the Enter key at prompt) by entering:
pixfirewall# enable passwordpixfirewall#
Note
Use the passwd command to set the password for PIX Firewall Manager and Telnet access to the PIX Firewall console. The default passwd value is cisco.
See also: passwd.
Examples
The following examples show how to start privileged mode with the enable command, change the enable password with the enable password command, enter configuration mode with the configure terminal command, and display the contents of the current configuration with the write terminal command:
pixfirewall> enablePassword:pixfirewall# enable password w0ttal1fepixfirewall# configure terminalpixfirewall(config)# write terminalBuilding configuration......enable password 2oifudsaoid.9ff encrypted...The following example shows the use of the encrypted option:
enable password 1234567890123456 encryptedshow enable passwordenable password 1234567890123456 encryptedenable password 1234567890123456show enable passwordenable password feCkwUGktTCAgIbD encryptedestablished
Allow or disallow return connections based on an established connection. (Configuration mode.)
established protocol dst_port_1 [permitto protocol [dst_port_2[-dst_port_2]]] [permitfrom protocol [src_port[-src_port]]]
no established protocol dst_port_1 [permitto protocol [dst_port_2[-dst_port_2]]] [permitfrom protocol [src_port[-src_port]]]
clear established
show established
Syntax Description
protocol
IP protocol type of udp or tcp.
dst_port_1
The destination port to which you want to establish a connection. See the "Ports" section in "" for a list of valid port literal names.
dst_port_2
The destination port that you want the PIX Firewall to permit the connection to return on.
src_port
The source port on the server from which the return connection will originate.
permitto
Permit inbound connections to the specified port or protocol. This option only opens the destination port.
permitfrom
Permit inbound connections from the specified port or protocol. Used with the permitto option, the permitfrom option provides a more specific source port. If the permitfrom option is used by itself, it requests access from a specific port to any port.
Usage Guidelines
The established command allows outbound connections return access to the PIX Firewall on different ports from which the original connection originated from. This command works with two connections, an original connection outbound from a network protected by the PIX Firewall and a return connection from a server on an external host. The PIX Firewall finds dst_port_1 in its translation table and associates the established command information with the outbound translation. The outbound translation indicates the source and destination IP addresses.
The first protocol and port you specify is for the destination of the original connection. The permitto and permitfrom options refine the information you specify for the return connection.
Note
The permitto option lets you specify a new protocol or port for the return connection at the PIX Firewall. The permitfrom option lets you specify a new protocol or port at the remote server. The no established command disables the established feature. The show established command shows the established commands in the configuration. The clear established command removes all establish command statements from your configuration.
Note
You can use the established command with a PAT or a non-PAT global command statement, as well as with the nat 0 command statement (where there are no global command statements).
The established command works as shown in the following format:
established A B permitto C D permitfrom E FThis command works as though it were written "For protocol A and port B, permit a connection back to the PIX Firewall through protocol C and port D, and, optionally, permit a return connection from the server over protocol E and port F."
For example:
established tcp 6060 permitto tcp 6061 permitfrom tcp 6059In this case, a source connection starts using TCP port 6060. The PIX Firewall then lets the return connection come back in over TCP port 6061 from a server that is providing the same service at TCP port 6059.
For multimedia applications such as RealAudio, VDO, Xing, VocalTec, H.323, and CU-SeeMe, PIX Firewall handles return packet access through the firewalls transparently. For other applications, such as Internet gaming, if the return packets do not return correctly and the application does not work, the established command provides an alternative functionality.
Security Problem
While this command is running, all UDP or TCP traffic is permitted between the client and server for the current TCP connection. This command only allows the host to which the inside client is connected to deliver UDP data or make high TCP port connections back to the client.
The established command can potentially open a large security hole in the PIX Firewall if not used with discretion. Whenever you use this command, if possible, also use the permitto and permitfrom options to indicate ports to which and from which access is permitted. Without these options, users outside the PIX Firewall can access any ports on servers behind the firewall that are accessible with the conduit and static commands.
The following example illustrates this problem:
static (inside,outside) 192.150.50.42 192.168.1.42 netmask 255.255.255.255conduit permit tcp host 192.150.50.42 eq http anyestablished tcp 0In this example, inside host 192.168.1.42 can be accessed from the outside interface for Web access as permitted by the conduit command statement. Because this is a web server (using the HTTP port), access permission is granted to any outside host. However, the established command modifies the effect of the conduit command statement and lets any user access any port on the 192.168.1.42 server.
Examples
The following example occurs when a local host 10.1.1.1 starts a TCP connection on port 9999 to a foreign host 192.150.50.1. The example allows packets from the foreign host 192.150.50.1 on port 4242 back to local host 10.1.1.1 on port 5454:
established tcp 9999 permitto tcp 5454 permitfrom tcp 4242The next example allows packets from foreign host 192.150.50.1 on any port back to local host 10.1.1.1 on port 5454:
established tcp 9999 permitto tcp 5454exit
Exit an access mode. (All modes.)
exit
Usage Guidelines
Use the exit command to exit from an access mode. This command is the same as quit.
Example
The following example shows how to exit configuration mode and then privileged mode:
pixfirewall(config)# exitpixfirewall# exitpixfirewall>failover
Change or view access to the optional failover feature. (Configuration mode.)
failover [active]
failover ip address if_name ip_address
failover link [stateful_if_name]
failover reset
failover timeout hh:mm:ss
no failover active
show failover
Syntax Description
Usage Guidelines
Use the failover command without an argument after you connect the optional failover cable between your primary firewall and a secondary firewall. The default configuration has failover enabled. Enter no failover in the configuration file for the PIX Firewall if you will not be using the failover feature. Use the show failover command to verify the status of the connection and to determine which unit is active.
Use the failover active command to initiate a failover switch from the Standby unit, or the no failover active command from the Active unit to initiate a failover switch. You can use this feature to return a failed unit to service, or to force an Active unit offline for maintenance. Because the Standby unit does not keep state information on each connection, all active connections will be dropped and must be re-established by the clients.
Use the failover link command to enable Stateful Failover.
If a failover IP address has not been entered, show failover will display 0.0.0.0 for the IP address, and monitoring of the interfaces will remain in "waiting" state. A failover IP address must be set for failover to work.
To configure failover:
Step 1
Step 2
Step 3
Step 4
See "Failover" in "," for additional configuration information.
Examples
The following output shows that failover is enabled, and that the Primary unit state is active:
show failoverFailover OnCable status: NormalReconnect time-out 0:00:00This host: Primary - ActiveActive time: 3456 (sec)Interface 4th (172.16.1.112): NormalInterface intf3 (192.168.3.2): NormalInterface intf2 (192.168.2.2): NormalInterface outside (192.168.1.8): NormalInterface inside (10.1.1.6): NormalOther host: Secondary - StandbyActive time: 0 (sec)Interface 4th (172.16.1.111): NormalInterface intf3 (192.168.3.1): NormalInterface intf2 (192.168.2.1): NormalInterface outside (192.168.1.7): NormalInterface inside (10.1.1.2): NormalStandby Logical Update StatisticsLink : intf2Stateful Obj xmit xerr rcv rerrGeneral 53 0 0 0sys cmd 53 0 0 0up time 0 0 0 0xlate 0 0 0 0tcp conn 0 0 0 0udp conn 0 0 0 0ARP tbl 0 0 0 0RIF Tbl 0 0 0 0The "Cable status" has these values:
•
•
•
You can view the IP addresses of the Standby unit with the show ip address command:
show ip addressSystem IP Addresses:ip address outside 192.150.50.2 255.255.255.0ip address inside 192.168.2.1 255.255.255.0ip address perimeter 192.150.70.3 255.255.255.0Current IP Addresses:ip address outside 192.150.50.2 255.255.255.0ip address inside 192.168.2.1 255.255.255.0ip address perimeter 192.150.70.3 255.255.255.0The Current IP Addresses are the same as the System IP Addresses on the failover Active unit. When the Primary unit fails, the Current IP Addresses become those of the Standby unit.
filter
Enable or disable outbound URL or HTML object filtering. (Configuration mode.)
filter activex port local_ip mask foreign_ip mask
no filter activex port local_ip mask foreign_ip mask
filter url http|except local_ip local_mask foreign_ip foreign_mask [allow]
no filter url http|except [local_ip local_mask foreign_ip foreign_mask]
show filter
Syntax Description
Usage Guidelines
The sections that follow describe each type of filter.
filter activex
The filter activex command filters out ActiveX, Java applets, and other HTML <object> usages from outbound packets.
ActiveX controls, formerly known as OLE or OCX controls, are components you can insert in a web page or other application. These controls include custom forms, calendars, or any of the extensive third-party forms for gathering or displaying information. As a technology, it creates many potential problems for the network clients including causing workstations to fail, introducing network security problems, or be used to attack servers.
This feature blocks the HTML <object> tag and comments it out within the HTML web page.
Note
Note
Note
filter activex Example
To specify that all outbound connections have ActiveX blocking, use:
filter activex 80 0 0 0 0This command specifies that the ActiveX blocking applies to Web traffic on port 80 from any local host and for connections to any foreign host.
filter url
The filter url command lets you prevent outbound users from accessing World Wide Web URLs that you designate using the WebSENSE filtering application.
The allow option to the filter command determines how the PIX Firewall behaves in the event that the WebSENSE server goes offline. If you use the allow option with the filter command and the WebSENSE server goes offline, port 80 traffic passes through the PIX Firewall without filtering. Used without the allow option and with the server offline, PIX Firewall stops outbound port 80 (Web) traffic until the server is back online, or if another URL server is available, passes control to the next URL server.
Note
To filter URLs:
Step 1
Step 2
Step 3
Step 4
Information on WebSENSE is available at: http://www.websense.com/products/websense/
filter url Example
The following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
url-server (perimeter) host 10.0.1.1filter url http 0 0 0 0filter url except 10.0.2.54 255.255.255.255 0 0fixup protocol
Change, enable, disable, or list a PIX Firewall application protocol feature. (Configuration mode.)
fixup protocol ftp [port]
fixup protocol http [port[-port]
fixup protocol h323 [port[-port]]
fixup protocol rsh [514]
fixup protocol smtp [port[-port]]
fixup protocol sqlnet [port[-port]]
no fixup protocol protocol [port[-port]]
clear fixup
show fixup [protocol protocol]
Syntax Description
protocol
Specify the protocol to fix up: ftp, http, h323, rsh, smtp, sqlnet.
port
Specify the port number or range for the application protocol. The default ports are: 80 for http, 1720 for h323, 25 for smtp, and 1521 for sqlnet. The default port value for rsh cannot be changed, but additional port statements can be added. See the "Ports" section in "" for a list of valid port literal names.
Usage Guidelines
The fixup protocol commands let you view, change, enable, or disable the use of a service or protocol through the PIX Firewall. The ports you specify are those that the PIX Firewall listens at for each respective service. You can change the port value for each service except rsh. The fixup protocol commands are always present in the configuration and are enabled by default.
The fixup protocol command performs the Adaptive Security Algorithm based on different port numbers other than the defaults. This command is global and changes things for both inbound and outbound connections, and cannot be restricted to any statics.
The FTP port can be changed; however if you change the default of port 21, to something like 2021, all FTP control connections must happen on port 2021. FTP control connections on port 21 will no longer work.
You can add multiple port settings for each protocol with separate commands; for example:
fixup protocol ftp 21fixup protocol ftp 4254fixup protocol ftp 9090These commands cause PIX Firewall to listen to the standard FTP port of 21 but also to listen for FTP traffic at ports 4254 and 9090.
The clear fixup command removes fixup commands from the configuration that you added. It does not remove the default fixup protocol commands.
The show fixup command lists all values or the show fixup protocol protocol command lists an individual protocol.
The fixup protocol smtp command enables the Mail Guard feature, which only lets mail servers receive the RFC 821, section 4.5.1 commands of HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT. All other commands are rejected with the "500 command unrecognized" reply code.
You can disable the fixup of a protocol by removing all fixups of the protocol from the configuration using the no fixup command. After you remove all fixups for a protocol, the no fixup form of the command or the default port is stored in the configuration.
The fixup protocol h323 command provides support for Intel InternetPhone, CU-SeeMe, CU-SeeMe Pro, MeetingPoint, and MS NetMeeting.
Note
Examples
The following example enables access to an inside server running Mail Guard:
static (inside, outside) 192.150.50.1 192.168.42.1 netmask 255.255.255.0conduit permit tcp host 192.150.50.1 eq smtp anyfixup protocol smtp 25This example shows the default fixup protocol values:
show fixupfixup protocol ftp 21fixup protocol http 80fixup protocol smtp 25fixup protocol h323 1720fixup protocol rsh 514fixup protocol sqlnet 1521The following example shows the commands to disable Mail Guard:
static (dmz1,outside) 192.150.50.1 10.1.1.1 netmask 255.255.255.255conduit permit tcp host 192.150.50.1 eq smtp anyno fixup protocol smtp 25In this example, the static command sets up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. (The MX record for DNS needs to point to the 192.150.50.1 address so that mail is sent to this address.) The conduit command lets any outside users access the global address through the SMTP port (25). The no fixup protocol command disables the Mail Guard feature.
flashfs
Clear Flash memory or display Flash memory sector sizes. (Configuration mode.)
clear flashfs
show flashfs
Note
Usage Guidelines
The clear flashfs command clears Flash memory.
The show flashfs command displays the size in bytes of each Flash memory sector.
The data in each sector is as follows:
•
•
•
•
Example
Use the following command to clear Flash memory:
clear flashfsUse the following commands to display the Flash memory sector sizes:
show flashfsflash file system: version:1 magic:0x12345679file 0: origin: 0 length:1794104file 1: origin: 2095104 length:1496file 2: origin: 0 length:0file 3: origin: 2096640 length:140clear flashfsshow flashfsflash file system: version:0 magic:0x0file 0: origin: 0 length:0file 1: origin: 0 length:0file 2: origin: 0 length:0file 3: origin: 0 length:0The origin values are integer multiples of the underlying Flash memory sector size.
floodguard
Enable or disable Flood Defender to protect against flood attacks. (Configuration mode.)
floodguard enable | disable
show floodguard
Syntax Description
Usage Guidelines
The floodguard command lets you reclaim PIX Firewall resources if the user authentication (uauth) subsystem runs out of resources. If an inbound or outbound uauth connection is being attacked or overused, the PIX Firewall will actively reclaim TCP user resources.
When the resources deplete, the PIX Firewall lists messages about it being out of resources or out of tcpusers.
If the PIX Firewall uauth subsystem is depleted, TCP user resources in different states are reclaimed depending on urgency in the following order:
1
2
3
4
The floodguard command is enabled by default.
Example
The following example enables the floodguard command and lists the floodguard command statement in the configuration:
floodguard enableshow floodguardfloodguard enableglobal
Create or delete entries from a pool of global addresses. (Configuration mode.)
global [(if_name)] nat_id global_ip[-global_ip] [netmask global_mask]
no global [(if_name)] nat_id [global_ip[-global_ip] [netmask global_mask]]
show global
Syntax Description
Usage Guidelines
The global command defines a pool of global addresses. The global addresses in the pool provide an IP address for each outbound connection, and for those inbound connections resulting from outbound connections. Ensure that associated nat and global command statements have the same nat_id.
After changing or removing a global command statement, use the clear xlate command.
Use the no global command to remove access to a nat_id, or to a PAT address, or address range within a nat_id. Use the show global command to view the global command statements in the configuration.
Usage Notes
1
2
global (outside) 1 192.150.50.1-192.150.50.10 netmask 255.255.255.0global (outside) 1 192.150.50.42 netmask 255.255.255.03
4
5
1.50.150.192.in-addr.arpa. IN PTR pix.domain.com.Examples
The following example declares two global pool ranges and a PAT address. Then the nat command permits all inside users to start connections to the outside network:
global (outside) 1 192.150.50.1-192.150.50.10 netmask 255.255.255.0global (outside) 1 192.150.50.42 netmask 255.255.255.0Global 192.150.50.42 will be Port Address Translatednat (inside) 1 0 0clear xlateThe next example creates a global pool from two contiguous Class C addresses and gives the perimeter hosts access to this pool of addresses:
global (outside) 1000 192.150.50.1-192.150.50.254global (outside) 1000 192.150.51.1-192.150.51.254nat (perimeter) 1000 0 0help
Display help information. (Unprivileged mode.)
help
?
Usage Guidelines
The help or ? command displays help information about all commands. You can view help for an individual command by entering the command name followed by a question mark or just the command name and pressing the Enter key.
If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:
<--- More --->The More prompt uses syntax similar to the UNIX more command:
•
•
•
Example
The following example shows how you can display help information by following the command name with a question mark:
enable ?usage: enable password <pw> [encrypted]Help information is available on the core commands (not the show, no, or clear commands) by entering ? at the command prompt:
?aaa Enable, disable, or view TACACS+ or RADIUSuser authentication, authorization and accountinghostname
Change the host name in the PIX Firewall command line prompt. (Configuration mode.)
hostname newname
Syntax Description
newname
New host name for the PIX Firewall prompt. This name can be up to 16 alphanumeric characters and mixed case.
Usage Guidelines
The hostname command changes the host name label on prompts. The default host name is pixfirewall.
Note
Example
The following example shows how to change a host name:
pixfirewall(config)# hostname spinnerspinner(config)# hostname pixfirewallpixfirewall(config)#interface
Identify network interface speed and duplex. (Configuration mode.)
interface hardware_id [hardware_speed] [shutdown]
clear interface
show interface
Syntax Description
Usage Guidelines
The interface command identifies the speed and duplex settings of the network interface boards.
Use show interface to view information about the interface.The clear interface command resets all of the statistics for FDDI, Token Ring, and Ethernet interface cards except those that count normal traffic.
The shutdown option lets you disable an interface. When you first install PIX Firewall version 5.0, all interfaces are shut down by default. You must explicitly enable an interface by entering the command without the shutdown option. If the shutdown option does not exist in the command, packets are passed by the driver to and from the card.
If the shutdown option does exist, packets are dropped in either direction. Inserting a new card defaults to the default interface command containing the shutdown option. (That is, if you add a new card and then enter the write memory command, the shutdown option is saved into Flash memory for the interface.) When upgrading from a previous version to the current version, interfaces are enabled.
The configuration of the interface affects buffer allocation (the PIX Firewall will allocate more buffers for higher line speeds). Buffer allocation can be checked with the show blocks command.
Note
Note
Usage Notes
1
2
show interface Notes
The show interface command lets you view network interface information for both Ethernet and Token Ring, depending on which is installed in your PIX Firewall. This is one of the first commands you should use when establishing network connectivity after installing a PIX Firewall.
The information in the show interface display is as follows:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Example
The following example assigns names to each interface, enables auto detection for the interface parameters, and then shows interface activity:
nameif ethernet0 outside security0nameif token-ring0 inside security100nameif ethernet1 DMZ security50interface ethernet0 autointerface token-ring0 16mbpsinterface ethernet1 autoshow interfaceinterface ethernet0 "outside" is up, line protocol is upHardware is i82557 ethernet, irq 10, address is 0060.7380.2f16IP address 192.150.50.1, subnet mask 255.255.0.0MTU 1500 bytes, BW 100000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1 packets output, 0 bytes, 0 underrunsinterface token-ring0 "inside" is up, line protocol is upHardware is o3137 token-ring, irq 9, address is 0000.8326.72c6IP address 10.0.0.1, subnet mask 255.0.0.0MTU 8192 bytes, BW 16000 Kbit, Ring-speed: 16Mbps116 packets input, 27099 bytes, 0 no bufferReceived 116 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 116 frame, 0 overrun, 0 ignored, 0 abort3 packets output, 150 bytes, 0 underrunsinterface ethernet1 "DMZ" is up, line protocol is upHardware is i82557 ethernet, irq 9, address is 00a0.c95d.0282IP address 127.0.0.1, subnet mask 255.255.255.0MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 packets output, 0 bytes, 0 underrunsip
Identify addresses for local pool and network interfaces. (Configuration mode.)
ip local pool pool_name pool_start-address[-pool_end-address]
no ip local pool pool_name pool_start-address[-pool_end-address]
show ip local pool pool_name ip_address[-ip_address]
ip address if_name ip_address [netmask]
show ip
Syntax Description
Usage Guidelines
The ip local pool command lets you create a pool of local addresses to be used for assigning dynamic ip addresses to remote VPN clients. The address range of this pool of local addresses must not overlap with any command statement that lets you specify an IP address. To delete an address pool, use the no ip local pool command. Use the show ip local pool command to view usage information about the pool of local addresses.
To reference this pool of local addresses, use the isakmp client configuration address-pool command. See the isakmp command page for more information.
The ip address command lets you assign an IP address to each interface. Use the show ip command to view which addresses are assigned to the network interfaces. If you make a mistake while entering this command, re-enter the command with the correct information.
After changing an ip address command, use the clear xlate command.
Note
The default address for an interface is 127.0.0.1.
PIX Firewall configurations using failover require a separate IP address for each network interface on the Standby unit. The system IP address is the address of the Active unit. When the show ip address command is executed on the Active unit, the current IP address is the same as the system IP address. When the show ip address command is executed on the Standby unit, the system IP address is the failover IP address configured for the Standby unit.
ip address Example
The following example shows how to list IP addresses:
show ip addressSystem IP Addresses:ip address outside 192.150.50.2 255.255.255.0ip address inside 192.168.2.1 255.255.255.0ip address perimeter 192.150.70.3 255.255.255.0Current IP Addresses:ip address outside 192.150.50.2 255.255.255.0ip address inside 192.168.2.1 255.255.255.0ip address perimeter 192.150.70.3 255.255.255.0The Current IP Addresses are the same as the System IP Addresses on the failover Active unit. When the Primary unit fails, the Current IP Addresses become those of the Standby unit.
ip local pool Example
The following example creates a pool of IP addresses and then displays the pool contents:
ip local pool mypool 10.0.0.10-10.0.0.20show ip local pool mypoolPool Begin End Free In usemypool 10.0.0.10 10.0.0.20 11 0Available Addresses:10.0.0.1010.0.0.1110.0.0.1210.0.0.1310.0.0.1410.0.0.1510.0.0.1610.0.0.1710.0.0.1810.0.0.1910.0.0.20ipsec
Configure IPSec policy. (Configuration mode; however, the clear ipsec command is Privileged mode.)
clear ipsec
ipsec ...
show ipsec
Usage Guidelines
The clear ipsec command clears an IPSec policy. The ipsec command is a shortened form of the crypto ipsec command. See the crypto ipsec command page for information on all other command options and examples. The show ipsec command displays the current policy.
isakmp
Negotiates IPSec security associations and enables IPSec secure communications.
(Configuration mode.)isakmp client configuration address-pool local pool-name [interface-name]
no isakmp client configuration address-pool local pool-name
isakmp enable interface-name
no isakmp enable interface-name
isakmp identity address | hostname
no isakmp identity
isakmp key keystring address peer-address [netmask]
no isakmp key keystring address peer-address
isakmp policy priority authentication pre-share | rsa-sig
no isakmp policy priority authentication pre-share | rsa-sig
isakmp policy priority encryption des | 3des
no isakmp policy priority encryption des | 3des
isakmp policy priority group 1 | 2
no isakmp policy priority group 1 | 2
isakmp policy priority hash md5 | sha
no isakmp policy priority hash md5 | sha
isakmp policy priority lifetime seconds
no isakmp policy priority lifetime seconds
show isakmp policy
show isakmp sa
clear isakmp
Note
Syntax Description
Usage Guidelines
isakmp client configuration address-pool local
The isakmp client configuration address-pool local command is used to configure the IP address local pool to reference IKE. Use the no crypto isakmp client configuration address-pool local command to restore to the default value.
Before using this command, use the ip local pool command to define a pool of local addresses to be assigned to a remote IPSec peer.
Examples
The following example references IP address local pools to IKE with "mypool" as the pool-name:
isakmp client configuration address-pool local mypool outsideisakmp enable
The isakmp enable command is used to enable ISAKMP negotiation on the interface on which the IPSec peer will communicate with the PIX Firewall. ISAKMP is enabled by default. Use the no isakmp enable command to disable IKE.
Note
Examples
The following example shows how to disable IKE on the outside interface:
no isakmp enable outsideisakmp identity
To define the ISAKMP identity the PIX Firewall uses when participating in the IKE protocol, use the isakmp identity command. Use no isakmp identity command to reset the ISAKMP identity to the default value of IP address.
When two peers use IKE to establish IPSec security associations, each peer sends its ISAKMP identity to the remote peer. It will send either its IP address or host name depending on how each has its ISAKMP identity set. By default, the PIX Firewall's ISAKMP identity is set to the IP address. As a general rule, set the PIX Firewall's and its peer's identities in the same way to avoid an IKE negotiation failure. This failure could be due to either the PIX Firewall or its peer not recognizing its peer's identity, and a DNS lookup not able to resolve the identity.
Examples
The following example uses pre-shared keys between the PIX Firewall and its peer and sets both their ISAKMP identities to hostname.
At the PIX Firewall, the ISAKMP identity is set to hostname:
isakmp identity hostnameAt the peer, the ISAKMP identity is set to hostname:
isakmp identity hostnameisakmp key
To configure a pre-shared authentication key, use the isakmp key command. Use the no isakmp key command to delete a pre-shared authentication key. You would configure this key at both peers whenever you specify pre-shared keys in an IKE policy. Otherwise the policy cannot be used because it will not be submitted for matching by the IKE process.
Note
The isakmp key command is the second task required to configure the pre-shared keys at the peers. (The first task is accomplished with the isakmp identity command.)
Use the address keyword, if the peer ISAKMP identity is set to its IP address. Otherwise use the hostname keyword.
Examples
The following example shows "sharedkeystring" as the authentication key to share between the PIX Firewall and its peer. The peer's ISAKMP identity in this example was previously set using the keyword hostname. Thus in this example, we again use the hostname keyword to specify the peer's hostname.
isakmp key sharedkeystring hostname mypeer.example.comisakmp policy authentication
The isakmp policy authentication command allows you to specify the authentication method within an IKE policy. IKE policies define a set of parameters to be used during IKE negotiation.
If you specify RSA signatures, you must configure the PIX Firewall and its peer to obtain certificates from a CA. If you specify pre-shared keys, you must separately configure these pre-shared keys within the PIX Firewall and its peer.
Use the no isakmp policy authentication command to reset the authentication method to the default value of RSA signatures.
Examples
The following example shows use of the isakmp policy authentication command. This example sets the authentication method of rsa-signatures to be used within the IKE policy with the priority number of 40.
isakmp policy 40 authentication rsa-sigisakmp policy encryption
To specify the encryption algorithm within an IKE policy, use the isakmp policy encryption command. IKE policies define a set of parameters to be used during IKE negotiation.
DES and 3DES are the two encryption algorithm options available.
Use the no isakmp policy encryption command to reset the encryption algorithm to the default value, which is des.
Examples
The following example shows use of the isakmp policy encryption command. This example sets the Triple DES algorithm to be used within the IKE policy with the priority number of 40.
isakmp policy 40 encryption 3desisakmp policy group
Use the isakmp policy group command to specify the Diffie-Hellman group to be used in an IKE policy. IKE policies define a set of parameters to be used during IKE negotiation.
There are two group options: 768-bit or 1024-bit. The 1024-bit Diffie Hellman provides stronger security, but it requires more CPU time to execute.
Use the no isakmp policy group command to reset the Diffie-Hellman group identifier to the default value of group 1, 768-bit Diffie Hellman.
Examples
The following example shows use of the isakmp policy group command. This example sets group 2, the 1024-bit Diffie Hellman, to be used within the IKE policy with the priority number of 40.
isakmp policy 40 group 2isakmp policy hash
Use the isakmp policy hash command to specify the hash algorithm to be used in an IKE policy. IKE policies define a set of parameters to be used during IKE negotiation.
There are two hash algorithm options: SHA-1 and MD5. MD5 has a smaller digest and is considered to be slightly faster than SHA-1.
To reset the hash algorithm to the default value of SHA-1, use the no isakmp policy hash command.
Examples
The following example shows use of the isakmp policy hash command. This example sets the MD5 hash algorithm to be used within the IKE policy with the priority number of 40.
isakmp policy 40 hash md5isakmp policy lifetime
To specify the lifetime of an IKE security association before it expires, use the isakmp policy lifetime command. Use the no isakmp policy lifetime command to reset the security association lifetime to the default value of 86,400 seconds (one day).
When IKE begins negotiations, it looks to agree upon the security parameters for its own session. The agreed-upon parameters are then referenced by a security association at each peer. The security association is retained by each peer until the security association's lifetime expires. Before a security association expires, it can be reused by subsequent IKE negotiations, which can save time when setting up new IPSec security associations. New security associations are negotiated before current security associations expire.
To save setup time for IPSec, configure a longer IKE security association lifetime. However, the shorter the lifetime (up to a point), the more secure the IKE negotiation is likely to be.
Note
Example
The following example shows use of the isakmp policy lifetime command. This example sets the lifetime of the IKE security association to 50,400 seconds (14 hours) within the IKE policy with the priority number of 40.
isakmp policy 40 lifetime 50,400show isakmp policy
To view the parameters for each IKE policy, use the show isakmp policy command.
Example
The following is a sample output from the show isakmp policy command after two IKE policies were configured (with priorities 70 and 90 respectively):
show isakmp policyProtection suite priority 70encryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 5000 seconds, no volume limitProtection suite priority 90encryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #1 (768 bit)lifetime: 10000 seconds, no volume limitDefault protection suiteencryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #1 (768 bit)lifetime: 86400 seconds, no volume limit
Note
show isakmp sa
To view all current IKE security associations between the PIX Firewall and its peer, use the show isakmp sa command.
Examples
The following is a sample output from the show isakmp sa command after IKE negotiations were successfully completed between the PIX Firewall and its peer:
show isakmp sadst src state pending created16.132.40.2 16.132.30.2 QM_IDLE 0 1clear crypto isakmp
Use the clear crypto isakmp command to clear active IKE connections.
kill
Terminate a Telnet session. (Privileged mode.)
kill telnet_id
Syntax Description
Usage Guidelines
The kill command terminates a Telnet session. Use the who command to view the Telnet session ID value. When you kill a Telnet session, the PIX Firewall lets any active commands terminate and then drops the connection without warning the user. The kill command does not affect PIX Firewall Manager sessions.
See also: show who, telnet.
Example
The following example shows use of the show who command to list the active Telnet sessions and the use of the kill command to end Telnet session 2:
show who2: From 10.10.54.0kill 2logging
Enable or disable syslog and SNMP logging. (Configuration mode.)
logging on
no logging on
logging buffered level
clear logging
no logging buffered
logging console level
no logging console
logging facility facility
no logging facility facility
logging host [in_if_name] ip_address [protocol /port]
no logging host [in_if_name] ip_address
logging message syslog_id
no logging message syslog_id
clear logging disabled
show logging disabled
logging monitor level
no logging monitor level
logging timestamp
no logging timestamp
logging trap level
no logging trap level
show logging
Syntax Description
Usage Guidelines
The logging command lets you enable or disable sending informational messages to the console, to a syslog server, or to an SNMP management station.
You can also use this guide to get the message numbers that can be individually suppressed with the logging message command.
Important Notes
1
2
3
4
5
See also: ca, telnet, terminal
Viewing Syslog Messages from the Console
To view syslog messages from the PIX Firewall console:
Step 1
logging buffered 7The value 7 causes all syslog message levels to be stored in the buffer. If preferred, set the value to a lower number to view fewer messages.
Refer to Appendix A of the System Log Messages for the Cisco Secure PIX Firewall Version 5.0 guide for a list of messages that appear at each severity level.
Step 2
show loggingStep 3
Step 4
New messages appear at the end of the logging listing.
Viewing Syslog Messages from a Telnet Console Session
To view syslog messages from a Telnet console session:
Step 1
telnet 192.168.1.2 255.255.255.255 insideYou can also set the duration that a Telnet session can be idle before PIX Firewall disconnects the session to a value greater than the default of 5 minutes. A good value is at least 15 minutes, which you can set as follows:
telnet timeout 15Step 2
telnet 192.168.1.1Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
terminal no monitorno logging monitorSending Syslog Messages to a Syslog Server
PIX Firewall can send syslog messages to any syslog server. In the event that all syslog servers are offline, PIX Firewall stores up to 100 messages in its memory. Subsequent messages that arrive overwrite the buffer starting from the first line.
To send messages to a syslog server:
Step 1
logging host interface address [protocol/port]Replace interface with the interface on which the server exists and address with the IP address of the host. An example logging host command is as follows:
logging host outside 192.150.50.5If the syslog server is receiving messages on a non-standard port, you can replace protocol with udp and port with the new port value. The default protocol is UDP with a default port of 514. You can also specify TCP with a default of 1468. To date, there is only one TCP syslog server, the Cisco PIX Firewall Syslog Server (PFSS). See "PIX Firewall Syslog Server (PFSS)" for more information.Only one logging host UDP or TCP command statement is permitted for a specific syslog server. A subsequent command statement overrides the previous one. Use the write terminal command to view the logging host command statement in the configuration—the UDP option is shown as "17" and the TCP option as "6."
Step 2
logging trap debuggingCisco recommends that you use the debugging level during initial setup and during testing. Thereafter, set the level from debugging to errors for production use.
Step 3
Step 4
Step 5
clock set 14:25:00 apr 1 1999logging timestampIn this example, the clock is set to the current time of 2:25 pm on April 1, 1999, and time stamping is enabled. To disable timestamp logging, use the no logging timestamp command.
Receiving Requests
For the PIX Firewall to receive requests from an SNMP management station:
Step 1
Step 2
Sending SNMP Traps to an SNMP Management Station
Refer to "," for information on SNMP traps. To send traps to an SNMP management station:
Step 1
If you only want to send the cold start, link up, and link down generic traps, no further configuration is required.
Step 2
Step 3
logging trap debuggingCisco recommends that you use the debugging level during initial set up and during testing. Thereafter, set the level from debugging to a lower value for production use.
Step 4
Step 5
Suppressing Syslog Messages
To suppress syslog messages:
Step 1
Step 2
no logging message 103012Step 3
Step 4
For example, to suppress the following message:
%PIX-6-305002: Translation built for gaddr IP_addr to IP_addrUse the following command to stop this message from being sent to the syslog server:
no logging message 305002You can view all disabled messages or just one with the following commands:
show logging disabledno logging message 305002show logging message 305002syslog 305002 disabledIf you want to let the message resume being sent, use the following command:
logging message 305002Additional logging Command Information
The PIX Firewall generates syslog messages for system events, such as security alerts and resource depletion. Using a UNIX syslog facility, you can specify which types of syslog messages create email alerts, are stored in log files, or display on the console of a designated inside network host. Use the logging monitor command to determine what messages display in a Telnet session to the PIX Firewall console.
To disable messages for a specific session, use the terminal no monitor command.
Because the PIX Firewall shares the eight facilities with other UNIX network devices, the logging facility command lets you choose the facility that the PIX Firewall marks on each message it sends to the syslog host. Messages are sent to the syslog host over UDP.
Use the show logging command to view the current syslog hosts and previously sent messages.
PIX Firewall Syslog Server (PFSS)
The PIX Firewall Syslog Server (PFSS) provides a syslog server that runs from a Windows NT system and receives TCP and UDP syslog messages from up to 10 PIX Firewalls. This server is provided at no charge from Cisco Connection Online (CCO).
Use of the PFSS gives you the additional benefit of reliability through receiving TCP event messages and being able to monitor whether the server is up or down from the PIX Firewall. Installation instructions for the PFSS are provided in the Installation Guide for the Cisco Secure PIX Firewall Version 5.0.
Note
You can configure the PIX Firewall to send syslog messages via UDP or TCP. If syslog messages are sent using TCP, and if the Windows NT partition in which the log files are stored runs out of disk space, the PIX Firewall stops all traffic until the disk space is freed. When this occurs, and you want to restart use of the PIX Firewall, you can need to stop logging to the Windows NT system by entering a no logging host command statement, then start logging to another PFSS server.
If you configure the PIX Firewall to send syslog messages using UDP, the PIX Firewall operates normally regardless of the ability of the PFSS to receive messages.
Windows NT installation and configuration instructions for the PIX Firewall Syslog Server (PFSS) are described in the Installation Guide for the Cisco Secure PIX Firewall Version 5.0.
Note
PFSS creates seven rotating syslog files monday.log, tuesday.log, wednesday.log, thursday.log, friday.log, saturday.log, and sunday.log. If a week has passed since the last log file was created, it will rename the old log file to day.mmddyy where day is the current day, mm is the month, dd is the day, and yy is the year.
PFSS also creates the pfss.log file where all values are stored.
If the Windows NT file system is full, the PIX Firewall Syslog Server disables all TCP connections from the PIX Firewall by closing its TCP listen socket.
The PIX Firewall tries to re-connect to the PIX Firewall Syslog Server five times, and during the retry, it stops all new connections through the PIX Firewall. If the TCP connection cannot be re-established, the status of the host log is set to disable after the fifth attempt.
Changing Windows NT PFSS Parameters
Step 1
Step 2
Step 3
•
•
•
•
•
Note
Recovering After the Windows NT Disk is Full
To recover from a disk full situation:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Example
The following example shows how to start console logging and view the results:
logging buffered debuggingshow loggingSyslog logging: enabledTimestamp logging: disabledConsole logging: disabledMonitor logging: disabledBuffer logging: level debugging, 37 messages loggedTrap logging: disabled305001: Portmapped translation built for gaddr 192.150.50.5/0 laddr 192.168.1.2/256...The line of output starting with 305001 shows a translation to a PAT global through global address 192.150.50.5 from a host at 192.168.1.2. The "305001" identifies a syslog message for creating a translation through a PAT global. Refer to System Log Messages for the Cisco Secure PIX Firewall Version 5.0 for more information on syslog messages.
mtu
Specify the MTU (maximum transmission unit) for an interface. (Configuration mode.)
mtu if_name bytes
no mtu [if_name bytes]
show mtu
Syntax Description
Usage Guidelines
The mtu command sets the size of data sent on a connection. Data larger than the MTU value is fragmented before being sent. The minimum value for bytes is 64 and the maximum is 65,535 bytes.
PIX Firewall supports the IP Path MTU Discovery mechanism, as defined in RFC 1191. IP Path MTU Discovery allows a host to dynamically discover and cope with differences in the maximum allowable maximum transmission unit (MTU) size of the various links along the path. Sometimes a PIX Firewall is unable to forward a datagram because it requires fragmentation (the packet is larger than the MTU you set for the interface), but the "don't fragment" (DF) bit is set. The network software sends a message to the sending host, alerting it to the problem. The host will have to fragment packets for the destination so that they fit the smallest packet size of all the links along the path.
For Ethernet interfaces, the default MTU is 1,500 bytes in a block, which is also the maximum. This value is sufficient for most applications, but you can pick a lower number if network conditions warrant it.
For Token Ring and FDDI, the default is 8,192 bytes.
The no mtu command resets the MTU block size to 1,500 for Ethernet interfaces and 8,192 for Token Ring. The show mtu command displays the current block size. The show interface command also shows the MTU value.
Example
The following example shows use of the mtu command for use with Token Ring and Ethernet:
interface token-ring0 16mbpsinterface ethernet0 automtu inside 8192show mtumtu outside 1500mtu inside 8192name / names
Associate a name with an IP address. (Configuration mode.)
name ip_address name
no name [ip_address name]
names
no names
clear names
show names
Syntax Description
Usage Guidelines
Use the name command to identify a host by a text name. The names you define become like a host table local to the PIX Firewall. Because there is no connection to DNS or /etc/hosts on UNIX servers, use of this command is a mixed blessing—it makes configurations much more readable but introduces another level of abstraction to administer; not only do you have to add and delete IP addresses to your configuration as you do now, but with this command, you need to ensure that the host names either match existing names or you have a map to list the differences.
The names command enables use of the name command to map text strings to IP addresses. The clear names and no names commands are the same and disable use of the name text strings. The show names command lists the name command statements in the configuration.
Notes
1
2
3
4
Example
In the example that follows, the names command enables use of the name command. The name command substitutes pix_inside for references to 192.168.42.3, and pix_outside for 192.150.50.33. The ip address commands use these names while assigning IP addresses to the network interfaces. The no names command disables the name values from displaying. Subsequent use of the names command restores their display:
namesname 192.168.42.3 pix_insidename 192.150.50.33 pix_outsideip address inside pix_insideip address outside pix_outsideshow ip addressinside ip address pix_inside mask 255.255.255.255outside ip address pix_outside mask 255.255.255.255no namesshow ip addressinside ip address 192.168.42.3 mask 255.255.255.255outside ip address 192.150.50.33 mask 255.255.255.255namesshow ip addressinside ip address pix_inside mask 255.255.255.255outside ip address pix_outside mask 255.255.255.255nameif
Name interfaces and assign security level. (Configuration mode.)
nameif hardware_id if_name security_level
show nameif
Syntax Description
Usage Guidelines
The nameif command lets you assign a name to an interface. You can use this command to assign interface names if you have more than two network interface circuit boards in your PIX Firewall. The first two interfaces have the default names inside and outside. The inside interface has default security level 100, the outside interface has default security level 0.
Usage Notes
1
2
3
4
See also: interface.
Example
The following example shows use of the nameif command:
nameif ethernet2 perimeter1 sec50nameif ethernet3 perimeter2 sec20nat
Associate a network with a pool of global IP addresses. (Configuration mode.)
nat [(if_name)] nat_id local_ip [netmask [max_conns [em_limit]]] [norandomseq]
no nat [[(if_name)] nat_id local_ip [netmask [max_conns [em_limit]]]] [norandomseq]
show nat
Syntax Description
Usage Guidelines
The nat command lets you enable or disable address translation for one or more internal addresses. Address translation means that when a host starts an outbound connection, the IP addresses in the internal network are translated into global addresses. Network Address Translation (NAT) lets your network have any IP addressing scheme and the firewall protects these addresses from visibility on the external network.
After changing or removing a nat command statement, use the clear xlate command.
The connection limit lets you set the maximum number of outbound connections that can be started with the IP address criteria you specify. The embryonic connection limit lets you prevent a type of attack where processes are started without being completed. An embryonic connection is a connection that someone attempted but has not completed and has not yet seen data. Every connection is embryonic until it sets up.
You can use the no nat command to remove a nat command statement and you can use the show nat command to view nat command statements in the current configuration.
helps you decide when to use the nat or static commands for access between the various interfaces in the PIX Firewall. For this table, assume that the security levels are 40 for dmz1 and 60 for dmz2.
The rule of thumb is that for access from a higher security level interface to a lower security level interface, use the nat command. From lower security level interface to a higher security level interface, use the static command.
Usage Notes
1
Addresses on each interface must be on a different subnet. See "," for more information on subnetting.
The nat 0 1.2.3.0 command means let those IP addresses in the 1.2.3.0 net appear on the outside without translation. All other hosts are translated depending on how their nat command statements appear in the configuration.
2
3
See also: global, outbound, apply.
Examples
The following example specifies with nat command statements that all the hosts on the 10.0.0.0 and 3.3.3.0 inside networks can start outbound connections. The global command statements create a pool of global addresses:
nat (inside) 1 10.0.0.0 255.0.0.0global (outside) 1 192.150.50.25-192.150.50.27global (outside) 1 192.150.50.28nat (inside) 3 3.3.3.0 255.255.255.0global (outside) 3 192.150.50.30-192.150.50.254When using the nat 0 command, if you want the addresses to be visible from the outside network, use the static and conduit command:
nat (inside) 0 192.150.50.0 255.255.255.0static (inside, outside) 192.150.50.1 192.150.50.1conduit permit tcp host 192.150.507.1 eq ftp host 10.0.0.1static (inside, outside) 192.150.50.2 207.31.17.2conduit permit tcp host 192.150.50.2 eq ftp host 10.0.0.1...outbound / apply
Create an access list for controlling Internet use. (Configuration mode.)
outbound list_ID permit|deny ip_address [netmask [java|port[-port]]] [protocol]
outbound list_ID except ip_address [netmask [java|port[-port]]] [protocol]
clear outbound
no outbound [list_ID permit|deny ip_address [netmask [java|port[-port]]] [protocol]]
no outbound [list_ID except ip_address [netmask [java|port[-port]]] [protocol]]
show outbound
apply [(if_name)] list_ID outgoing_src|outgoing_dest
clear apply
no apply [[(if_name)] list_ID outgoing_src|outgoing_dest]
show apply [(if_name)] [list_ID outgoing_src|outgoing_dest]
Syntax Description
list_ID
A tag number for the access list. The access list number you use must be the same for the apply and outbound commands. This value must be a positive number. This number can be the same as what you use with nat and global. This number is just an arbitrary number that groups outbound command statements to an apply command statement.
permit
Allow the access list to access the specified IP address and port.
deny
Deny the access list access to the specified IP address and port.
except
Create an exception to a previous outbound command. An except command statement applies to permit or deny command statements only with the same access list ID.
When used with apply outgoing_src, the IP address of an except command statement applies to the destination address.
When used with apply outgoing_dest, the IP address of an except command statement applies to the source address.
See "Outbound List Rules" for more information.
ip_address
The IP address for this access list entry. Do not specify a range of addresses. The 0.0.0.0 ip_address can be abbreviated as 0.
netmask
The network mask for comparing with the IP address; 255.255.255.0 causes the access list to apply to an entire Class C address. 0.0.0.0 indicates all access. The 0.0.0.0 netmask can be abbreviated as 0.
port
A port or range of ports that the access list is permitted or denied access to. See the "Ports" section in "" for a list of valid port literal names.
java
The java keyword indicates port 80 and when used with the deny option, means that the firewall blocks Java applets from being downloaded from ip_address (depending on use of the apply command). Java applets are permitted by default and do not have to be explicitly permitted.
protocol
Limit outbound access to udp, tcp, or icmp protocols. If a protocol is not specified, the default is tcp.
if_name
The network interface originating the connection.
outgoing_src
Deny or permit an internal IP address the ability to start outbound connections using the service(s) specified in the outbound command.
outgoing_dest
Deny or permit access to an external IP address using the service(s) specified in the outbound command.
Usage Guidelines
The outbound command creates an access list that lets you specify the following:
•
•
•
•
Outbound lists are filters on outgoing packets from the PIX Firewall. The filter can be based on the source IP address, the destination IP address, and the destination port/protocol as specified by the rules. The use of an outbound command requires use of the apply command. The apply command lets you specify whether the access control list applies to inside users' ability to start outbound connections with apply command's outgoing_src option, or whether the access list applies to inside users' ability to access servers on the outside network with the apply command's outgoing_dest option.
After adding, removing, or changing outbound command statements, use the clear xlate command.
Use the no outbound command to remove a single outbound command statement from the configuration. Use the clear outbound command to remove all outbound command statements from the configuration. The show outbound command displays the outbound command statements in the configuration.
Use the no apply command to remove a single apply command statement from the configuration. Use the clear apply command statement to remove all the apply command statements from the configuration. The show apply command displays the apply command statements in the configuration.
Outbound List Rules
Rules, written as outbound list_ID... command statements are global to the PIX Firewall, they are activated by apply list_ID outgoing_src|outgoing_dest command statements. When applied to outgoing_src, the source IP address, the destination port, and protocol are filtered. When applied to outgoing_dest, the destination IP address, port, and protocol are filtered.
The outgoing_src and outgoing_dest outbound lists are filtered independently. If any one of the filters contain deny, the outbound packet is denied. When multiple rules are used to filter the same packet, the best matched rule takes effect. The best match is based on the IP address mask and the port range check. More strict IP address masks and smaller port ranges are considered a better match. If there is a tie, a permit overrides a deny.
Rules are grouped by a list_ID. Within each list_ID, except rules (that is, outbound n except ...) can be set. The except option reverses the best matched rule of deny or permit. In addition, PIX Firewall filters the specified IP address and mask in the rule for the destination IP address of the outbound packet if the list is applied to the outbound_src. Alternatively, PIX Firewall filters the source IP address if the list is applied to the outgoing_dest. Furthermore, the except rules only apply to rules with the same list_ID. A single except rule within a list_ID without another permit or deny rule has no effect. If multiple except rules are set, the best match is checked for which except to apply.
The outbound command rules are now sorted by the best match checking. Use the show outbound command to see how the best match is judged by the PIX Firewall.
Usage Notes
1
2
3
4
outbound 1 deny 0 0 0apply (inside) 1 outgoing_srcThen add command statements that permit or deny hosts access to specific ports, for example:
outbound 1 deny 0 0 0outbound 1 permit 10.1.1.1 255.255.255.255 23 tcp
outbound 1 permit 10.1.1.1 255.255.255.255 80 tcp
apply (inside) 1 outgoing_src
If you used the except option, you could state this same example as follows:
outbound 1 deny 0 0 0outbound 1 except 192.150.50.11 255.255.255.255 23 tcp
outbound 1 except 192.150.50.11 255.255.255.255 80 tcp
apply (inside) 1 outgoing_srcIn the preceding outbound except command statement, IP address 192.150.50.11 is the destination IP address, not the source address. This means that everyone is denied outbound access, except those users going to 192.150.50.11 via Telnet or HTTP (80).
5
PIX Firewall removes applets containing a Java signature anywhere in the packet, but does not remove applets encapsulated in some archive files. Legitimate, non-Java files with Java signatures are also blocked.6
You must have a specific deny command statement to block Java applets.7
8
9
Examples
The first outbound group sets inside hosts so that they can only see and Telnet to perimeter hosts, and do DNS lookups. In this example, the perimeter network address is 192.150.50.0 and the network mask is 255.255.255.0:
outbound 9 deny 0.0.0.0 0.0.0.0 0 0outbound 9 except 192.150.50.0 255.255.255.0 23 tcpoutbound 9 except 0.0.0.0 0.0.0.0 53 udpThe next outbound group in this same example lets hosts 10.1.1.11 and 10.1.1.12 go anywhere:
outbound 11 deny 0.0.0.0 0.0.0.0 0 0outbound 11 permit 10.1.1.11 255.255.255.255 0 0outbound 11 permit 10.1.1.12 255.255.255.255 0 0outbound 11 permit 0.0.0.0 0.0.0.0 21 tcpoutbound 11 permit 10.3.3.3 255.255.255.255 143 tcpThis last outbound group in this same example lets hosts on the perimeter only access TCP ports 389 and 30303 and UDP port 53 (DNS). Finally, the apply command statements set the outbound groups so that the permit and deny rules affect access to all external addresses.:
outbound 13 deny 0.0.0.0 0.0.0.0 0 0outbound 13 permit 0.0.0.0 0.0.0.0 389 tcpoutbound 13 permit 0.0.0.0 0.0.0.0 30303 tcpoutbound 13 permit 0.0.0.0 0.0.0.0 53 udpapply (inside) 9 outgoing_srcapply (inside) 11 outgoing_srcapply (perim) 13 outgoing_srcControlling Outbound Connections
The following example prevents all inside hosts from starting outbound connections:
outbound 1 deny 0 0 0apply (inside) 1 outgoing_srcThe 0 0 0 at the end of the command means all IP addresses (0 is the same as 0.0.0.0), with a 0.0.0.0 subnet mask and for all services (port value is zero).
Conversely, the following example permits all inside hosts to start connections to the outside (this is the default if an access list is not created):
outbound 1 permit 0 0 0apply (inside) 1 outgoing_srcControlling Inside Hosts' Access to Outbound Services
The following example prevents inside host 192.168.1.49 from accessing the World Wide Web
(port 80):outbound 11 deny 192.168.1.49 255.255.255.255 80 tcpapply (inside) 11 outgoing_srcControlling Inside Hosts' Access to Outside Servers
If your employees are spending too much time examining GIF images on a particular site with two web servers, you can use the following example to restrict this access:
outbound 12 deny 192.168.146.201 255.255.255.255 80 tcpoutbound 12 deny 192.168.146.202 255.255.255.255 80 tcpapply (inside) 12 outgoing_destPreventing Use of Java Applets
The following example prevents all inside users from executing Java applets on the inside network:
outbound 1 deny 0 0 javaapply (inside) 1 outgoing_srcUsing except Command Statements
An except command statement only provides exception to items with the same list_ID. Consider the following example:
outbound 9 deny 0.0.0.0 0.0.0.0 0 0outbound 9 except 20.0.0.0 255.0.0.0 23 tcpoutbound 9 except 0.0.0.0 0.0.0.0 53 udpoutbound 11 deny 0.0.0.0 0.0.0.0 0 0outbound 11 permit 10.1.1.11 255.255.255.255 0 0outbound 11 permit 10.1.1.12 255.255.255.255 0 0outbound 11 permit 0.0.0.0 0.0.0.0 21 tcpoutbound 11 permit 10.3.3.3 255.255.255.255 143 tcpoutbound 13 deny 0.0.0.0 0.0.0.0 0 0outbound 13 permit 0.0.0.0 0.0.0.0 389 tcpoutbound 13 permit 0.0.0.0 0.0.0.0 30303 tcpoutbound 13 permit 0.0.0.0 0.0.0.0 53 udpIn the preceding examples, the following two command statements work against other command statements in list 9 but not in lists 11 and 13:
outbound 9 except 20.0.0.0 255.0.0.0 23 tcpoutbound 9 except 0.0.0.0 0.0.0.0 53 udpIn the following example, the set of deny, permit, and except option command statements denies everybody from connecting to external hosts except for DNS queries and Telnet connections to hosts on 20.0.0.0. The host with IP address 10.1.1.11 is permitted outbound access, and has access to everywhere except to 20.0.0.0 via Telnet and anywhere to use DNS:
outbound 1 deny 0.0.0.0 0.0.0.0 0 tcpoutbound 1 permit 10.1.1.11 255.255.255.255 0 tcpoutbound 1 except 20.0.0.0 255.0.0.0 23 tcpoutbound 1 except 0.0.0.0 0.0.0.0 53 udpapply (inside) outgoing_srcpager
Enable or disable screen paging. (Privileged mode.)
pager [lines number]
clear pager
no pager
show pager
Syntax Definition
number
The number of lines before the More prompt appears. The minimum is 1.
Use 0 to disable paging.
Usage Guidelines
The pager lines command lets you specify the number of lines in a page before the More prompt appears. The pager command enables display paging, and no pager disables paging and lets output display completely without interruption. If you set pager lines to some value and want to revert back to the default, enter the pager command without options. The clear pager command resets the number of lines in a page to 24.
Use pager 0 to disable paging.
The show pager command displays pager status.
When paging is enabled, the following prompt appears:
<--- More --->The More prompt uses syntax similar to the UNIX more command:
•
•
To return to the command line, press the q key.
Example
The following example shows use of the pager command:
pixfirewall# pager lines 2pixfirewall# ping inside 10.0.0.4210.0.0.42 NO response received -- 1010ms10.0.0.42 NO response received -- 1000ms<--- More --->passwd
Set password for Telnet and PIX Firewall Manager access to the firewall console. (Privileged mode.)
passwd password [encrypted]
show passwd
Syntax Description
Usage Guidelines
The passwd command sets a password for Telnet and PIX Firewall Manager access to the firewall console. An empty password is also changed into an encrypted string. However, any use of a write command displays or writes the passwords in encrypted form. Once passwords are encrypted, they are not reversible back to plain text.
Note
See also: enable password.
Example
The following example shows use of the passwd command:
passwd watag00s1amshow passwdpasswd jMorNbK0514fadBh encryptedperfmon
View performance information. (Privileged mode.)
perfmon interval seconds
perfmon quiet | verbose
show perfmon
Syntax Description
Usage Guidelines
The perfmon command lets you monitor the PIX Firewall's performance. Use the show perfmon command to view the information immediately. Use the perfmon verbose command to display the information every two minutes continuously. Use the perfmon interval seconds command with the perfmon verbose command to display the information continuously every number of seconds you specify.
Note
Use the perfmon quiet command to disable the display.
An example of the performance information is:
This information lists the number of translations, connections, WebSENSE requests, address translations (called "fixups"), and AAA transactions that occur each second.
Example
The following commands display the performance monitor statistics every 30 seconds on the PIX Firewall console:
perfmon interval 30perfmon verboseping
Determine if other IP addresses are visible from the PIX Firewall. (Privileged mode.)
ping if_name ip_address
Syntax Description
Usage Guidelines
The ping command determines if the PIX Firewall has connectivity or if a host is available on the network. The command output shows if the response was received; that is, that the host exists on the network. If the host is not responding, ping displays "NO response received." Use show interface to ensure that the PIX Firewall is connected to the network and is passing traffic.
If you want internal hosts to be able to ping external hosts, you must create an ICMP conduit for echo reply; for example, to give ping access to all hosts, use the conduit permit icmp any any command.
If you are pinging through PIX Firewall between hosts or routers, but the pings are not successful, use the debug icmp trace command to monitor the success of the ping. If pings are both inbound and outbound, they are successful.
Example
The ping command makes three attempts to reach an IP address:
ping inside 192.168.42.54192.168.42.54 response received -- 0Ms192.168.42.54 response received -- 0Ms192.168.42.54 response received -- 0Msquit
Exit configuration or privileged mode. (All modes.)
quit
Usage Guidelines
Use the quit command to exit configuration or privileged mode.
Example
The following example shows use of the quit command:
pixfirewall(config)# quitpixfirewall# quitpixfirewall>reload
Reboot and reload the configuration. (Privileged mode.)
reload
Usage Guidelines
The reload command reboots the PIX Firewall and reloads the configuration from a bootable floppy
disk or, if a diskette is not present, from Flash memory.
Note
Any response other than n causes the reboot to occur.
Note
Example
The following example shows use of the reload command:
reloadProceed with reload? [confirm] yRebooting...PIX Bios V2.7...rip
Change RIP settings. (Configuration mode.)
rip if_name default|passive
no rip if_name default|passive
show rip [if_name]
Syntax Description
Usage Guidelines
The rip passive command enables IP routing table updates from received RIP (Routing Information Protocol) broadcasts. Use show rip to display the current RIP settings. Use no rip to disable the PIX Firewall IP routing table updates. The default is to enable IP routing table updates.
Example
The following example shows use of the show rip and rip inside default commands:
show riprip outside passiveno rip outside defaultrip inside passiveno rip inside defaultrip inside defaultshow riprip outside passiveno rip outside defaultrip inside passiverip inside defaultroute
Enter a static or default route for the specified interface. (Configuration mode.)
route if_name ip_address netmask gateway_ip [metric]
clear route [if_name ip_address [netmask gateway_ip]]
no route [if_name ip_address [netmask gateway_ip]]
show route
Syntax Description
Usage Guidelines
Use the route command to enter a default or static route for an interface. To enter a default route, set ip_address and netmask to 0.0.0.0, or the shortened form of 0. All routes entered using the route command are stored in the configuration when it is saved.
Create static routes to access networks connected outside a router on any interface. The effect of a static route is like stating "to send a packet to the specified network, give it to this router." For example, PIX Firewall sends all packets destined to the 192.168.42.0 network through the 192.168.1.5 router with this static route command statement:
route dmz 192.168.42.0 255.255.255.0 192.168.1.5 1Examples
Specify one default route command statement for the outside interface, which in this example, has an IP address of 192.150.50.1:
route outside 0 0 192.150.50.1 1For static routes, if two networks, 10.1.2.0 and 10.1.3.0 connect via a hub to the dmz1 interface router at 10.1.1.4, add these static route command statements to provide access to the networks:
route dmz1 10.1.2.0 255.0.0.0 10.1.1.4 1route dmz1 10.1.3.0 255.0.0.0 10.1.1.4 1service
Reset inbound connections. (Configuration mode.)
service resetinbound
show service
Syntax Description
Usage Guidelines
The service command works with all inbound TCP connections to statics whose conduits or uauth (user authorization) do not allow inbound. One use is for resetting IDENT connections. If an inbound TCP connection is attempted and denied, you can use the service resetinbound command to return an RST (reset flag in the TCP header) to the source. Without the option, the PIX Firewall drops the packet without returning an RST.
For use with IDENT, the PIX Firewall sends a TCP RST to the host connecting inbound and stops the incoming IDENT process so that email outbound can be transmitted without having to wait for IDENT to time out. In this case, the PIX Firewall sends a syslog message stating that the incoming connection was a denied connection. Without service resetinbound, the PIX Firewall drops packets that are denied and generates a syslog message stating that the SYN was a denied connection. However, outside hosts keep retransmitting the SYN until the IDENT times out.
When an IDENT connection is timing out, you will notice that connections slow down. Perform a trace to determine that IDENT is causing the delay and then invoke the service command.
The service resetinbound command provides a safer way to handle an IDENT connection through the PIX Firewall. Ranked in order of security from most secure to less secure are these methods for handling IDENT connections:
1
2
3
When using the aaa command, if the first attempt at authorization fails and a second attempt causes a timeout, use the service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is:
Unable to connect to remote host: Connection timed outExample
The following example shows use of the service resetinbound command:
service resetinboundshow serviceservice resetinboundsession
Access an embedded AccessPro router console. (Privileged mode.)
session enable
no session
show session
Note
Syntax Description
Usage Guidelines
The session command lets you specify Cisco IOS commands on an AccessPro router console when the router is installed in your PIX Firewall. Use COM port 4 on the AccessPro router to communicate with the PIX Firewall.
Exit the router console session by entering tilde-dot (~.). Press the tilde key and when you hear a bell sound from your terminal, press the dot key.
While a router console session is occurring, the PIX Firewall disables failover because they both require the same interrupts.
Example
This example enables an AccessPro session, starts the session, and then disables it:
session enableSession has been enabled.sessionWarning: FAILOVER has been disabled!!!Attempting session with embedded router, use ~. to quit!acpro> ~.no sessionSession has been disabledsessionSession is not enabledshow
View command information. (Differs by mode.)
show ?
Usage Guidelines
The show command without arguments or the show ? command lets you view the names of the show commands and their descriptions. Explanations for each show command are provided on the respective command page for the command itself where appropriate; for example, show arp is described on the arp command page.
Note
If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:
<--- More --->The More prompt uses syntax similar to the UNIX more command:
•
•
•
Example
The following example shows use of the show ? command:
show ?? help ...show blocks / clear blocks
Show system buffer utilization. (Privileged mode.)
clear blocks
show blocks
Usage Guidelines
The show blocks command lists preallocated system buffer utilization. In the show blocks listing, the SIZE column displays the block type. The MAX column is the maximum number of allocated blocks. The LOW column is the fewest blocks available since last reboot. The CNT column is the current number of available blocks. A zero in the LOW column indicates a previous event where memory exhausted. A zero in the CNT column means memory is exhausted now. Exhausted memory is not a problem as long as traffic is moving through the PIX Firewall. You can use the show conn command to see if traffic is moving. If traffic is not moving and the memory is exhausted, a problem may be indicated.
The clear blocks command keeps the maximum count to whatever number is allocated in the system and equates the low count to the current count.
Example
The following example shows use of the show blocks command:
show blocksSIZE MAX LOW CNT4 1600 1600 160080 100 97 97256 80 79 791550 788 402 40465536 8 8 8show checksum
Display the configuration checksum. (Unprivileged mode.)
show checksum
Usage Guidelines
This command displays four groups of hexadecimal numbers that act as a digital summary of the contents of the configuration. This same information stores with the configuration when you store it in Flash memory. By using the show config command and viewing the checksum at the end of the configuration listing and using the show checksum command, you can compare the numbers to see if the configuration has changed. The PIX Firewall tests the checksum to determine if a configuration has not been corrupted.
Example
The following example shows use of the show checksum command:
show checksumCryptochecksum: 1a2833c0 129ac70b 1a88df85 650dbb81show conn
Display all active connections. (Privileged mode.)
show conn [count] [foreign|local ip[-ip2] [netmask mask]] [protocol tcp|udp|protocol]
[fport|lport port1[-port2]] [state up[,finin][,finout] [,http_get] [,smtp_data] [,smtp_banner]
[,smtp_incomplete][,nojava] [,data_in] [,data_out] [,sqlnet_fixup_data]
[,conn_inbound] [,rpc] [,h323] [,dump]Syntax Description
count
Display only the number of used connections. This feature is no longer supported and returns unreliable information.
foreign| local ip[-ip2] netmask mask
Display active connections by the foreign IP address or by local IP address. Qualify foreign or local active connections by network mask.
protocol tcp|udp|protocol
Display active connections by protocol type. protocol is a protocol specified by number. See "Protocols" in "," for a list of valid protocol literal names.
fport|lport port1[-port2]
Display foreign or local active connections by port. See "Ports" in "," for a list of valid port literal names.
state
Display active connections by their current state: up (up), FIN inbound (finin), FIN outbound (finout), HTTP get (http_get), SMTP mail data (smtp_data), SMTP mail banner (smtp_banner), incomplete SMTP mail connection (smtp_incomplete), an outbound command denying access to Java applets (nojava), inbound data (data_in), outbound data (data_out), SQL*Net data fix up (sqlnet_fixup_data), inbound connection (conn_inbound), RPC connection (rpc), H.323 connection (h323), dump clean up connection (dump).
Usage Guidelines
The show conn command displays the number and information about the active TCP connections.
Example
The following example shows use of the show conn command:
show conn6 in use, 6 most usedTCP out 192.150.50.41:80 in 10.3.3.4:1404 idle 0:00:00 Bytes 11391TCP out 192.150.50.41:80 in 10.3.3.4:1405 idle 0:00:00 Bytes 3709TCP out 192.150.50.41:80 in 10.3.3.4:1406 idle 0:00:01 Bytes 2685TCP out 192.150.50.41:80 in 10.3.3.4:1407 idle 0:00:01 Bytes 2683TCP out 192.150.50.41:80 in 10.3.3.4:1403 idle 0:00:00 Bytes 15199TCP out 192.150.50.41:80 in 10.3.3.4:1408 idle 0:00:00 Bytes 2688UDP out 192.150.50.70:24 in 10.3.3.4:1402 idle 0:01:30UDP out 192.150.50.70:23 in 10.3.3.4:1397 idle 0:01:30UDP out 192.150.50.70:22 in 10.3.3.4:1395 idle 0:01:30In this example, host 10.3.3.4 on the inside has accessed a web site at 192.150.50.41. The global address on the outside interface is 192.150.50.70.
show history
Display previously entered lines. (Privileged mode.)
show history
Usage Guidelines
This command displays previously entered commands. You can examine commands individually with the up and down arrows or by entering ^p to view previously entered lines or ^n to view the next line.
Example
The following example shows use of the show history command:
show historyenable...show interface
See the interface command page for a description of the show interface command.
show memory
Show system memory utilization. (Privileged mode.)
show memory
Usage Guidelines
This command displays a summary of the maximum physical memory and current free memory available to the PIX Firewall operating system. Memory in the PIX Firewall is allocated as needed.
Example
The following example shows use of the show memory command:
show memorynnnnnnnn bytes total, nnnnnnn bytes freeshow processes
Display processes. (Privileged mode.)
show processes
Usage Guidelines
This command displays a listing of running processes. Processes are lightweight threads requiring only a few instructions. In the listing, PC is the program counter, SP is the stack pointer, STATE is the address of a thread queue, Runtime is the number of milliseconds that the thread has been running, SBASE is the stack base address, Stack is the current number of bytes used and the total size of the stack, and Process lists the thread's function.
Example
The following example shows use of the show processes command:
show processesPC SP STATE Runtime SBASE Stack ProcessLsi 800125de 803603d0 80075ba0 0 8035f410 4004/4096 arp_timer...show tech-support
View information to help a support analyst. (Privileged mode.)
show tech-support
Usage Guidelines
The show tech-support command lists information technical support analysts need to help you diagnose PIX Firewall problems. This command combines the output from the show commands that provide the most information to a technical support analyst.
Example
The following example shows use of the show tech-support command:
show tech-supportPIX Version 5.0(n)nnnCompiled on Fri 28-May-99 04:08 by pixbuildPIX Bios V2.7pixfirewall up 100 days 6 hours 17 mins...show traffic
Shows interface transmit and receive activity. (Privileged mode.)
show traffic
Usage Guidelines
This command lists the number of packets and bytes moving through each interface. The number of seconds is the duration the PIX Firewall has been online since the last reboot.
Example
The following example shows use of the show traffic command:
show trafficoutside:received (in 3786 secs):97 packets 6191 bytes42 pkts/sec 1 bytes/sectransmitted (in 3786 secs):99 packets 10590 bytes0 pkts/sec 2 bytes/sec ...show uauth
See the uauth command page for information on the show uauth command.
show version
View the PIX Firewall operating information. (Unprivileged mode.)
show version
Usage Guidelines
This command lets you view the PIX Firewall's software version, operating time since last reboot, processor type, Flash memory type, interface boards, and serial number (BIOS ID). Version 5.0(2) and later lists the activation key in the show version command display.
Example
The following example lists the output of the show version command.
show versionCisco Secure PIX Firewall Version 5.0(2)Compiled on Fri 01-Oct-99 13:56 by pixbuildpix515 up 4 days 22 hours 10 mins 42 secsHardware: PIX-515, 64 MB RAM, CPU Pentium 200 MHzFlash i28F640J5 @ 0x300BIOS Flash AT29C257 @ 0xfffd80000: ethernet0: address is 00aa.0000.0037, irq 111: ethernet1: address is 00aa.0000.0038, irq 102: ethernet2: address is 00a0.c92a.f029, irq 93: ethernet3: address is 00a0.c948.45f9, irq 7Licensed Features:Failover: EnabledVPN-DES: EnabledVPN-3DES: DisabledMaximum Interfaces: 6Serial Number: 123 (0x7b)Activation Key: 0xc5233151 0xb429f6d0 0xda93739a 0xe15cdf51show xlate
See the xlate command page for information on the show xlate command.
snmp-server
Provide SNMP event information. (Configuration mode.)
snmp-server community key
snmp-server contact text
snmp-server location text
snmp-server host [if_name] ip_addr
snmp-server enable traps
clear snmp-server command
no snmp-server command
show snmp-server
Syntax Description
Usage Guidelines
Use the snmp-server command to identify site, management station, community string, and user information.
In understanding SNMP use, the PIX Firewall is considered the SNMP agent or SNMP server. The management station is the system running the SNMP program that receives and processes the SNMP information that the PIX Firewall sends.
An SNMP object ID (OID) for PIX Firewall now displays in SNMP event traps sent from the PIX Firewall. OID 1.3.6.1.4.1.9.1.227 was assigned as the PIX Firewall system object ID.
The clear snmp-server and no snmp-server commands removes command statements. The show snmp-server command displays the information.
MIB Support
You can browse the System and Interface groups of MIB-II. All SNMP values in the PIX Firewall are read only (RO). The PIX Firewall does not support browsing of the Cisco syslog MIB.
Browsing a MIB is different from sending traps. Browsing means doing an snmpget or snmpwalk of the MIB tree from the management station to determine values. Traps are different; they are unsolicited "comments" from the managed device to the management station for certain events, such as link up, link down, syslog event generated, and so on.
See "SNMP Traps" in "" for more information on SNMP traps.
Receiving SNMP Requests from an SNMP Management Station
To receive SNMP requests from a management station:
Step 1
Step 2
Step 3
Example
The following example shows how to start sending SNMP traps from the management station:
snmp-server community wallawallabingbangsnmp-server location Building 42, Sector 54snmp-server contact Sherlock Holmessnmp-server host perimeter 10.1.2.42show snmpsnmp-server host perimeter 10.1.2.42snmp-server location Building 42, Sector 54snmp-server contact Sherlock Holmessnmp-server community wallawallabingbangstatic
Map local IP address to a global IP address. (Configuration mode.)
static [(internal_if_name, external_if_name)] global_ip local_ip [netmask network_mask]
[max_conns [em_limit]] [norandomseq]no static [[(internal_if_name, external_if_name)] global_ip local_ip[netmask network_mask]
[max_conns [em_limit]] [norandomseq]]show static
Syntax Description
Usage Guidelines
The static command creates a permanent mapping (called a static translation slot or "xlate") between a local IP address and a global IP address. Use the static and conduit commands when you are accessing an interface of a higher security level from an interface of a lower security level; for example, when accessing the inside from a perimeter or the outside interface.
The interface names on the static command may seem confusing at first. This is further complicated by how NAT is handled on the PIX Firewall. If NAT is disabled, with the nat 0 command, statics are specified with a different set of rules than when NAT is enabled. For either no NAT or NAT, the rule of which command to access an interface stays the same as shown in .
assumes that the security levels are 40 for dmz1 and 60 for dmz2.
With NAT Enabled
NAT (Network Address Translation) is enabled with the nat n command where "n" has the value 1 or greater; for example, nat 1 0 0.
Always specify the interface name of the highest security level interface you are accessing, followed by the lower security level interface. The IP addresses are also confusing because the first IP address you specify is for the lower security level interface. The second IP address is for the higher security level interface. The way to remember this is as follows:
static (high,low) low high
For example, assume you have four interfaces on the PIX Firewall that have security levels set with the nameif command as follows:
nameif ethernet0 outside security0nameif ethernet1 inside security100nameif ethernet2 dmz1 security40nameif ethernet3 dmz2 security60To access the inside from the outside interface, you need a static command like:
static (inside,outside) outside_ip_address inside_ip_address netmask maskReplace outside_ip_address with the global IP address (an IP address on the lower security level interface). Replace inside_ip_address with the IP address of the host on the higher security level interface that you want to grant access to. Use these replacements in the rest of the commands in this section. Replace mask with 255.255.255.255 for host addresses, except when subnetting is in effect; for example, 255.255.255.128. For network addresses, use the appropriate class mask; for example, for Class A networks, use 255.0.0.0.
To access the inside from the dmz1 interface, you need a static command like:
static (inside,dmz1) dmz1_ip_address inside_ip_address netmask maskTo access the inside from the dmz2 interface, you need a static command like:
static (inside,dmz2) dmz2_ip_address inside_ip_address netmask maskTo access the dmz2 interface from the dmz1 interface, you need a static command like:
static (dmz2,dmz1) dmz1_ip_address dmz2_ip_address netmask maskTo go the other way around, from a higher security level interface to a lower security level interface, use the nat and global commands. For example, to access dmz1 from dmz2, use these commands:
nat (dmz2) 1 0 0global (dmz1) 1 global_ip_address-global_ip_addressReplace global_ip_address-global_ip_address with the IP address range of the addresses in the pool of global addresses. The nat command specifies the name of the higher security level interface; the pool of global addresses are on the lower security level interface.
View the nat command page for more information on using these commands.
Note
The first IP address you specify in the static command is the first IP address you specify in the conduit command as shown in this example:
static (dmz2,dmz1) 10.1.1.1 192.168.1.1 netmask 255.255.255.255conduit permit tcp host 10.1.1.1 10.1.1.0 255.255.255.0The static command maps the address 10.1.1.1 on the dmz1 interface so that users on the dmz1 interface can access the 192.168.1.1 host on the dmz2 interface. The conduit command lets any users in the 10.1.1.0 network access the 10.1.1.1 address over any TCP port.
Note
With No-NAT
With no-NAT, the static command has a different sense of logic. With NAT disabled, addresses on both sides of the firewall are registered addresses. Between interfaces, addresses must be on different subnets that you control with subnetting. See "," for more information.
Without address translation, you protect addresses on the inside or perimeter interfaces by not providing access to them. Without a conduit command statement, the inside host cannot be accessed on the outside and is, in effect, invisible to the outside world. Conversely, only by opening statics and conduits to servers on the inside or perimeter interfaces, do the hosts become visible.
Without address translation, the format of the static command becomes different:
static (high,low) high high
Again, the security level set for each interface with the nameif command determines what information you fill in. You are using static to access a higher security interface from a lower security interface. The IP address you want visible on the lower security interface is that of the higher security interface. This is the IP address users on the lower security interface's network will use to access the server on the higher security level interface's network. Because address translation is not occurring, the actual address of the server is presented as both the visible address and the address of the host.
For example, a web server on the dmz, 192.150.50.65 needs to be accessible by users on the outside. The static and conduit command statements are:
static (dmz,outside) 192.150.50.65 192.150.50.65 netmask 255.255.255.192conduit permit tcp host 192.150.50.65 eq www anyThe static command presents the 192.150.50.65 address on the outside interface. The DNS server on the outside would map this IP address to the domain of the company; for example, domain.com. Users accessing domain.com are permitted to access the web server via port 80 by the conduit command.
Another example of no-NAT statics would be when users on dmz1 need to access a web server on dmz2. The network uses a Class C address and subnets it with the .192 subnet. Addresses 192.150.50.65 to 192.150.50.126 are on dmz1, and addresses 192.150.50.129 to 192.150.50.190 are on dmz2. The web server is at 192.150.50.142. The static and conduit command statements are:
static (dmz2,dmz1) 192.150.50.142 192.150.50.142 netmask 255.255.255.192conduit permit tcp host 192.150.50.142 eq www 192.150.50.64 255.255.255.192The static command statement opens access to the web server at 192.150.50.142. The conduit command statement permits access to the web server only on port 80 (www) and further refines the access to stipulate that only users on the 192.150.50.64 subnet can access the web server. See "," for more information on subnetting.
Additional static Information
After changing or removing a static command statement, use the clear xlate command.
You can create a single mapping between the global and local hosts, or create a range of statics known as net statics.
The static command determines the network mask of network statics by the netmask option or by the number in the first octet of the global IP address. The netmask option can be used to override the number in the first octet. If the address is all zeros where the net mask is zero, then the address is a net address.
Note
You can have as many statics as needed as long the total size of your configuration does not exceed 500 KB.
See also: conduit.Examples
The example that follows creates a static command and then permits users to call in through H.323 using Intel InternetPhone, CU-SeeMe, CU-SeeMe Pro, MeetingPoint, or MS NetMeeting to 10.1.1.222 using IP address 192.150.50.222 to 10.1.1.188 using IP address 192.150.50.188, and so on. The net static command that follows maps addresses 192.150.50.1 through 192.150.50.254 to local addresses 10.1.1.1 through 10.1.1.254.
static (inside, outside) 192.150.50.0 10.1.1.0 8 50conduit permit tcp host 192.150.50.0 eq h323 anyThe following example shows the commands used to disable Mail Guard:
static (dmz1,outside) 192.150.50.1 10.1.1.1 netmask 255.255.255.255conduit permit tcp host 192.150.50.1 eq smtp anyno fixup protocol smtp 25In this example, the static command sets up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. (The MX record for DNS needs to point to the 192.150.50.1 address so that mail is sent to this address.) The conduit command lets any outside users access the global address through the SMTP port (25). The no fixup protocol command disables the Mail Guard feature.
syslog
Enable syslog message facility. Obsolete command replaced by the logging command. (Privileged mode.)
Note
sysopt
Change PIX Firewall system options. (Configuration mode.)
sysopt connection enforcesubnet
no sysopt connection enforcesubnet
sysopt connection permit-ipsec
no sysopt connection permit-ipsec
sysopt connection tcpmss bytes
no sysopt connection tcpmss bytes
sysopt connection timewait
no sysopt connection timewait
sysopt ipsec pl-compatible
no sysopt ipsec pl-compatible
sysopt nodnsalias inbound
sysopt nodnsalias outbound
no sysopt nodnsalias inbound
no sysopt nodnsalias outbound
sysopt noproxyarp if_name
no sysopt noproxyarp if_name
sysopt security fragguard
no sysopt security fragguard
clear sysopt
show sysopt
Syntax Description
Usage Guidelines
The sysopt commands let you tune various PIX Firewall security and configuration features. In addition, you can use this command to disable the PIX Firewall IP Frag Guard feature.
sysopt connection enforcesubnet
The sysopt connection enforcesubnet command prevents external users from spoofing internal addresses. This command prevents packets with a source address belonging to the destination subnet from traversing the PIX Firewall. For example, if a packet arrives from the outside but has a source address belonging to the inside subnet, the PIX Firewall does not let the packet through.
The sysopt connection enforcesubnet command applies only to inbound connections.
To configure the PIX Firewall to detect spoofed IP addresses, use explicit conduit deny command statements in the configuration; for example:
conduit deny ip any in_host_net1 in_host_net1_maskconduit deny ip any in_host_net2 in_host_net2_maskReplace in_host_netn with the addresses on the internal network.
sysopt connection permit-ipsec
To enable IPSec traffic to always pass the conduit check, set the sysopt connection permit-ipsec command.
Conduit must be available for inbound sessions.
By default, any inbound session must be explicitly permitted by a conduit. With IPSec protected traffic, the secondary conduit check could be redundant. To enable IPSec authenticated/cipher inbound session to always be permitted, enable sysopt connection permit-ipsec.
The no sysopt connection permit-ipsec command disables the option.
Note
Examples
The following is a minimal IPSec configuration to enable a session to be connected from host 172.21.100.123 to host 172.21.200.67 across an IPSec tunnel that terminates from peer 171.21.100.1 to peer 171.21.200.1.
With sysopt connection permit-ipsec:
On peer 171.21.100.1
static 172.21.100.123 172.21.100.123access-list 10 permit ip host 172.21.100.123 host 172.21.200.67crypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 10crypto map mymap 10 set transform-set t1crypto map mymap 10 set peer 172.21.200.1crypto map mymap interface outsideconduit permit ip host 172.21.100.123 host 172.21.200.67On peer 171.21.200.1
static 172.21.200.67 172.21.200.67access-list 10 permit ip host 172.21.200.67 host 172.21.100.123crypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 10crypto map mymap 10 set transform-set t1crypto map mymap 10 set peer 172.21.100.1crypto map mymap interface outsideconduit permit ip host 172.21.200.67 host 172.21.100.123
With sysopt connection permit-ipsec:
On peer 171.21.100.1
static 172.21.100.123 172.21.100.123access-list 10 permit ip host 172.21.100.123 host 172.21.200.67crypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 10crypto map mymap 10 set transform-set t1crypto map mymap 10 set peer 172.21.200.1crypto map mymap interface outsidesysopt connection permit-ipsecOn peer 171.21.200.1
static 172.21.200.67 172.21.200.67access-list 10 permit ip host 172.21.200.67 host 172.21.100.123crypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto map mymap 10 ipsec-isakmpcrypto map mymap 10 match address 10crypto map mymap 10 set transform-set t1crypto map mymap 10 set peer 172.21.100.1crypto map mymap interface outsidesysopt connection permit-ipsecsysopt connection tcpmss
The sysopt connection tcpmss command forces proxy TCP connections to have a maximum segment size no greater than bytes. This command requests that each side not send a packet of a size greater than bytes at any time during the initial TCP connection establishment.
Note
The bytes value can be a minimum of 28 and any maximum number. You can disable this feature by setting bytes to zero. The default is 1380 bytes, which Cisco recommends for Ethernet and mixed Ethernet and Token Ring environments. If the PIX Firewall has all Token Ring interfaces, you can set bytes to 4056. However, if even one link along the path through the network is not a Token Ring, setting bytes to such a high value may cause poor throughput. In its 1380 byte default value, this command increases throughput of the sysopt security fragguard command.
The TCP maximum segment size is the maximum size that an end host can inject into the network at one time (see RFC 793 for more information on the TCP protocol). The sysopt connection tcpmss command is recommended in a network environment being attacked being with overly aggressive TCP or HTTP stack with a faulty path MTU value that is degrading the performance of the PIX Firewall IP Frag Guard feature. Environments where one or more end hosts reside on a Token Ring network are especially susceptible to this faulty behavior.
Note
sysopt connection timewait
The sysopt connection timewait command forces each TCP connection to linger in a shortened TIME_WAIT state of at least 15 seconds.
The no sysopt connection timewait command disables the option, which is off by default.
Note
sysopt ipsec pl-compatible
Note
The sysopt ipsec pl-compatible command enables the IPSec feature to simulate the Private Link feature supported in PIX Firewal,l version 4. The Private Link feature provides encrypted tunnels to be established across an unsecured network between Private-Link equipped PIX Firewall units. The sysopt ipsec pl-compatible command allows IPSec packets to bypass the NAT and ASA features and enables incoming IPSec packets to terminate on the inside interface. The incoming IPSec packets initially terminate on the outside interface and then are sent to the inside interface.
Because crypto maps are currently only bound to the outside interface, any outgoing packet must be sent to the outside interface to determine whether it is destined for an IPSec tunnel or not. When using the sysopt ipsec pl-compatible command within your configuration, you are required to enter static routes for all subnets of all interfaces and for all hosts behind all routers on all interfaces so that all packets initially bypass the NAT feature and are routed to the outside interface.
The no sysopt ipsec pl-compatible command disables the option, which is off by default.
Note
Note
Note
Example
For an example of the use of the sysopt ipsec pl-compatible command, see the "Private Link to IPSec Conversion" section in "."
sysopt nodnsalias
The sysopt nodnsalias inbound disables inbound embedded DNS A record fixups according to aliases that apply to the A record address. sysopt nodnsalias outbound affects outbound replies.
This command remedies the case when a DNS server is on the outside and users on the inside need to access a server on a perimeter interface. In the past, you would use the alias command to permit DNS responses to resolve correctly through the PIX Firewall, but formerly you had to reverse the parameters for the local IP address and foreign IP address.
For example, you would normally code the alias command as follows:
alias (inside) 192.168.1.4 192.150.50.121 255.255.255.255Inside host 192.168.1.5 needs access to www.domain.com, which resolves at an outside ISP DNS to 192.150.50.121. The PIX Firewall fixes this DNS response sending the host a response of 192.168.1.4. The host uses its gateway (the PIX Firewall) to go to 192.168.1.4, which the PIX Firewall now aliases back to the 192.150.50.121. Because this is actually 192.168.1.4, a server on the perimeter interface of the PIX Firewall, the packet is dropped because the PIX Firewall sent the packet to the outside interface, which is the incorrect interface.
The sysopt nodnsalias inbound command has the same effect as reversing the alias command statement parameters as follows:
alias (inside) 192.150.50.121 192.168.1.4 255.255.255.255This works properly because everything happens in reverse. The DNS is now modified to 192.150.50.121 and the host inside uses its gateway (the PIX Firewall) to get there, the PIX Firewall aliases this back to 192.168.1.4 and routes it out the perimeter interface to the correct host and the TCP connection is established.
sysopt noproxyarp
The sysopt noproxyarp command lets you disable proxy-arps on a PIX Firewall interface.
sysopt security fragguard
The sysopt security fragguard command enables the IP Frag Guard feature. This feature is disabled by default. This feature enforces two addition security checks in addition to the security checks recommend by RFC 1858 against the many IP fragment style attacks: teardrop, land, and so on. First, each non-initial IP fragments is required to be associated with an already seen valid initial IP fragments. Second, IP fragments are rated to 100 full IP fragmented packets per second to each internal host.
The IP Frag Guard feature operates on all interfaces in the PIX Firewall and cannot be selectively enabled or disabled by interface.
PIX Firewall uses the security fragguard command to enforce the security policy determined by a conduit permit or conduit deny command to permit or deny packets through the PIX Firewall.
Note
Note
Note
The show sysopt command lists the sysopt commands in the configuration. The clear sysopt command resets the sysopt command to default settings. The no sysopt security fragguard command disables the IP Frag Guard feature.
Example
The following example disables Frag Guard and then lists the current command options:
no sysopt security fragguardshow sysoptsysopt security fragguardno sysopt connection tcpmssno sysopt connection timewaittelnet
Specify internal host for PIX Firewall console access via Telnet. (Privileged mode.)
telnet ip_address [netmask] [if_name]
clear telnet [ip_address [netmask] [if_name]]
no telnet [ip_address [netmask] [if_name]]
show telnet
telnet timeout minutes
show telnet timeout
Syntax Description
Usage Guidelines
The telnet command lets you specify which hosts can access the PIX Firewall console with Telnet. PIX Firewall lets you specify a host on any of the internal network interfaces that can access the console via Telnet. If you have configured IPSec on your system, you can specify the outside interface. At a minimum, the crypto map command must be configured to specify an interface name with the telnet command.
Up to 16 hosts or networks are allowed access to the PIX Firewall console with Telnet, 5 simultaneously. The show telnet command displays the current list of IP addresses authorized to access the PIX Firewall. Use the no telnet or clear telnet command to remove Telnet access from a previously set IP address. Use the telnet timeout feature to set the maximum time a console Telnet session can be idle before being logged off by PIX Firewall. The clear telnet command does not affect the telnet timeout command duration. The no telnet command cannot be used with the telnet timeout command.
Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the firewall console. Use the debug isakmp command to terminate an active Telnet console session.
If the aaa command is used with the console option, Telnet console access must be authenticated with an authentication server. Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis.
Note
Usage Notes
1
telnet 192.168.1.1If you then use the show telnet command, you see that not just one command statement is specified, but all internal interfaces are represented with a command statement:
show telnet192.168.1.1 255.255.255.255 inside192.168.1.1 255.255.255.255 intf2192.168.1.1 255.255.255.255 intf3The purpose of the show telnet command is that, were it possible, the 192.168.1.1 host could access the Telnet console from any of these internal interfaces. An additional facet of this behavior is that you have to delete each of these command statements individually with the following commands:
no telnet 192.168.1.1 255.255.255.255 insideno telnet 192.168.1.1 255.255.255.255 intf2no telnet 192.168.1.1 255.255.255.255 intf32
telnet 192.168.1.1 255.255.255.255 int23
4
5
6
7
8
See also: aaa, kill, passwd, who.
Examples
The following examples permit hosts 192.168.1.3 and 192.168.1.4 to access the PIX Firewall console via Telnet. In addition, all the hosts on the 192.168.2.0 network are given access:
telnet 192.168.1.3 255.255.255.255 insidetelnet 192.168.1.4 255.255.255.255 insidetelnet 192.168.2.0 255.255.255.0 insideshow telnet192.168.1.3 255.255.255.255 inside192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideYou can remove individual entries with the no telnet command or all telnet command statements with the clear telnet command:
no telnet 192.168.1.3 255.255.255.255 insideshow telnet192.168.1.4 255.255.255.255 inside192.168.2.0 255.255.255.0 insideclear telnetshow telnetYou can change the maximum session idle duration as follows:
telnet timeout 10show telnet timeouttelnet timeout 10 minutesAn example Telnet console login session appears as follows (the password does not display when entered):
PIX passwd: ciscoWelcome to the PIX FirewallCopyright (c) 1995-1999 by Cisco Systems, Inc.Restricted Rights LegendUse, duplication, or disclosure by the Government issubject to restrictions as set forth in subparagraph(c) of the Commercial Computer Software - RestrictedRights clause at FAR sec. 52.227-19 and subparagraph(c) (1) (ii) of the Rights in Technical Data and ComputerSoftware clause at DFARS sec. 252.227-7013.Cisco Systems, Inc.170 West Tasman DriveSan Jose, California 95134-1706Type help or `?' for a list of available commands.pixfirewall>terminal
Change console terminal settings. (Configuration mode.)
terminal [no] monitor
terminal width characters
Syntax Description
Usage Guidelines
The terminal monitor command lets you enable or disable the display of syslog messages in the current session for either Telnet or serial access to the PIX Firewall console. Use the logging monitor command to enable or disable various levels of syslog messages to the console; use the terminal no monitor command to disable the messages on a per session basis. Use terminal monitor to restart the syslog messages for the current session.
The terminal width command sets the width for displaying command output. The terminal width is controlled by the command: terminal width nn, where nn is the width in characters. If you enter a line break, it is not possible to backspace to the previous line.
Example
The following example shows enabling logging and then disabling logging only in the current session with the terminal no monitor command:
logging monitor...terminal no monitortftp-server
Specify the IP address of the TFTP configuration server. (Configuration mode.)
tftp-server [if_name] ip_address path
no tftp-server [[if_name] ip_address path]
show tftp-server
Syntax Description
Usage Guidelines
The tftp-server command lets you specify the IP address of a server that you use to propagate PIX Firewall configuration files to your firewalls. Use the tftp-server command with the configure net command to read from the configuration or with the write net command to store the configuration in the file you specify.
The path name you specify in the tftp-server is appended to the end of the IP address you specify in the configure net and write net commands. The more you specify of a file and path name with the tftp-server command, the less you need to specify with the configure net and write net commands. If you specify the full path and filename in the tftp-server command, the IP address in the configure net and write net commands can be represented with a colon ( : ).
The no tftp server command disables access to the server. The show tftp-server command lists the tftp-server command statements in the current configuration.
Example
The following example specifies a TFTP server and then reads the configuration from /pixfirewall/config/test_config:
tftp-server 10.1.1.42 /pixfirewall/config/test_config...configure net :timeout
Set the maximum idle time duration. (Configuration mode.)
timeout [xlate [hh:mm:ss]] [conn [hh:mm:ss]] [half-closed [hh:mm:ss]] [udp [hh:mm:ss]] [rpc [hh:mm:ss]] [h323 [hh:mm:ss]] [uauth [hh:mm:ss] [absolute | inactivity]]
show timeout
Syntax Description
Usage Guidelines
The timeout command sets the idle time for connection, translation UDP, RPC, and H.323 slots. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence.
Note
Note
uauth inactivity and absolute Qualifiers
The uauth inactivity and absolute qualifiers cause users to have to reauthenticate after either a period of inactivity or an absolute duration.
Note
The inactivity timer starts after a connection becomes idle. If a user establishes a new connection before the duration of the inactivity timer, the user is not required to reauthenticate. If a user establishes a new connection after the inactivity timer expires, the user must reauthenticate. The default durations are zero for the inactivity timer and 5 minutes for the absolute timer; that is, the default behavior is to cause the user to reauthenticate every 5 minutes.
The absolute timer runs continuously, but waits to reprompt the user when the user starts a new connection, such as clicking a link and the absolute timer has elapsed, then the user is prompted to reauthenticate. The absolute timer must be shorter than the xlate timer; otherwise, a user could be reprompted after their session already ended.
Inactivity timers give users the best Web access because they are not prompted to regularly reauthenticate. Absolute timers provide security and manage the PIX Firewall connections better. By being prompted to reauthenticate regularly, users manage their use of the resources more efficiently. Also by being reprompted, you minimize the risk that someone will attempt to use another user's access after they leave their workstation, such as in a college computer lab. You may want to set an absolute timer during peak hours and an inactivity timer thereafter.
Both an inactivity timer and an absolute timer can operate at the same time, but you should set the absolute timer duration longer than the inactivity timer. If the absolute timer is less than the inactivity timer, the inactivity timer never occurs. For example, if you set the absolute timer to 10 minutes and the inactivity timer to an hour, the absolute timer reprompts the user every 10 minutes; therefore, the inactivity timer will never be started.
Use the show timeout command to display the current timeout command settings.
See also: show xlate, uauth.
Note
Examples
The following example lists the output of the show timeout command, how to change the timeout values, and the results:
show timeouttimeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00timeout rpc 0:10:00 h323 0:05:00timeout uauth 0:05:00 absolutetimeout uauth 0:5:00 absolute uauth 0:4:00 inactivityshow timeouttimeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00timeout rpc 0:10:00 h323 0:05:00timeout uauth 0:05:00 absolute uauth 0:04:00 inactivityuauth (clear and show)
Delete all authorization caches for a user. (Privileged mode.)
clear uauth [username]
show uauth [username]
Syntax Description
Usage Guidelines
The clear uauth command deletes one user's or all users' AAA authorization caches, which forces the user or users to reauthenticate the next time they create a connection. The show uauth command displays one or all currently authenticated users, the host IP to which they are bound, and, if applicable, any cached IP and port authorization information.
The show uauth command also lists CiscoSecure 2.1 and later idletime and timeout values, which can be set for different user groups.
Each user host's IP address has an authorization cache attached to it. If the user attempts to access a service that has been cached from the correct host, the firewall considers it preauthorized and immediately unproxies the connection. This means that once you are authorized to access a web site, for example, the authorization server is not contacted for each of the images as they are loaded (assuming they come from the same IP address). This significantly increases performance and reduces load on the authorization server.
The cache allows up to 16 address and service pairs for each user host.
The output from the show uauth command displays the username provided to the authorization server for authentication and authorization purposes, the IP address that the username is bound to, and whether the user is authenticated only, or has cached services.
Use the timeout uauth command to specify how long the cache should be kept after the user connections become idle. The timeout command value must be at least 2 minutes. Use the clear uauth command to delete all authorization caches for all users, which will cause them to have to reauthenticate the next time they create a connection.
See also: aaa authorization, timeout.
Example
The following example lists the output of the show uauth command:
show uauthuser `winifred' from 192.150.50.42 authenticateduser `pollyhedra' from 192.150.50.54 authorized to:port 192.168.67.34/telnet 192.168.67.11/http 192.168.67.33/tcp/8001192.168.67.56/tcp/25 192.168.67.42/ftpuser `brian' from 192.150.50.207 authorized to:port 192.159.1.50/http 192.150.50.69/httpIn this example, user winifred has authenticated with the server but has not completed authorization. User pollyhedra has preauthorized connections to the Telnet, Web (HTTP), sendmail, FTP services, and to TCP port 8001 on 192.168.67.33.
User brian has been browsing the Web and is authorized for Web browsing to the two sites shown.
The next example causes users winifred to reauthenticate:
clear uauth winifredurl-cache
Cache responses to URL filtering requests to the WebSENSE server. (Configuration mode.)
url-cache dst| src_dst size
no url-cache dst| src_dst size
show url-cache stat
Syntax Description
Usage Guidelines
The url-cache command caches responses to URL filtering requests to the WebSENSE server. Caching stores URL access privileges in memory on the PIX Firewall. When a host requests a connection, the PIX Firewall first looks in the URL cache for matching access privileges instead of forwarding the request to the WebSENSE server. Disable caching with the no url-cache command.
Note
Note
The url-cache command allows you to enable URL caching, set the size of the cache, and displays cache statistics.
The show url-cache command with the stats option displays the following entries:
•
•
•
•
•
You can view additional information about WebSENSE access with the show perfmon command.
Examples
The following example caches all outbound HTTP connections based on the source and destination addresses:
url-cache src_dst 128The following example lists the show url-cache stat command:
show url-cache statURL Filter Cache Stats----------------------Size : 1KBEntries : 36In Use : 30Lookups : 300Hits : 290url-server
Designate a server running WebSENSE for use with the filter command. (Configuration mode.)
url-server [(if_name)] host ip_address [timeout seconds]
no url-server host ip_address
Syntax Description
Usage Guidelines
This command designates a server that runs WebSENSE, a URL filtering application. Once you designate the server, enable the URL filtering service with the filter command.
Note
To filter URLs:
Step 1
Step 2
Step 3
Step 4
Additional information on WebSENSE is available at:
http://www.websense.com
Example
The following example filters all outbound HTTP connections except those from the 10.0.2.54 host:
url-server (perimeter) host 10.0.1.1filter url http 0 0 0 0filter url except 10.0.2.54 255.255.255.255 0 0virtual
Access PIX Firewall virtual server. (Configuration mode.)
virtual http ip_address [warn]
virtual telnet ip_address
Syntax Description
ip_address
For outbound use, ip_address must be an address routed to the PIX Firewall. Use an RFC 1918 address that is not in use on any interface.
For inbound use, ip_address must be an unused global address. A conduit and static pair must provide access to ip_address, as well as an aaa authentication command statement. See the "Example: virtual http" section for more information.
For example, if an inside client at 192.168.0.100 has a default gateway set to the inside interface of the PIX Firewall at 192.168.0.1, the ip_address can be any IP address not in use on that segment (such as 10.2.3.4). As another example, if the inside client at 192.168.0.100 has a default gateway other than the PIX Firewall (such as a router at 192.168.0.254), then the ip_address would need to be set to a value that would get statically routed to the PIX Firewall. This might be accomplished by using a value of 10.0.0.1 for the ip_address, then on the client, setting the PIX Firewall at 192.168.0.1 as the route to host 10.0.0.1.
warn
Let virtual http command users know that the command was redirected. This option is only applicable for text-based browsers where the redirect cannot happen automatically.
Usage Guidelines
The virtual http command lets web browsers work correctly with the PIX Firewall aaa command. The aaa command assumes that the AAA server database is shared with a web server. PIX Firewall automatically provides the AAA server and web server with the same information. The virtual http command works with the aaa command to authenticate the user, separate the AAA server information from the web client's URL request, and direct the web client to the web server. Use the show virtual http command to list commands in the configuration. Us the no virtual http command to disable its use.
The virtual http command works by redirecting the web browser's initial connection to the ip_address, which resides in the PIX Firewall, authenticating the user, then redirecting the browser back to the URL which the user originally requested. This mechanism comprises the PIX Firewall's new virtual server feature. The reason this command is named as it is, is because the virtual http command accesses the virtual server for use with HTTP, another name for the Web. This command is especially useful for PIX Firewall interoperability with Microsoft IIS, but is useful for other authentication servers.
When using HTTP authentication to a site running Microsoft IIS that has "Basic text authentication" or "NT Challenge" enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: "Authorization: Basic=Uuhjksdkfhk==" to the HTTP GET commands. This string contains the PIX Firewall authentication credentials.
Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied.
To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested.
Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set. This is because the browser caches the "Authorization: Basic=Uuhjksdkfhk==" string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts. Flushing the cache is of no use.
Note
Note
Note
The virtual telnet command allows the Virtual Telnet server to provide a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication.
The virtual telnet command can be used both to log in and log out of the PIX Firewall. When an unauthenticated user Telnets to the virtual IP address, they are challenged for their username and password, and then authenticated with the TACACS+ or RADIUS server. Once authenticated, they see the message "Authentication Successful" and their authentication credentials are cached in the PIX Firewall for the duration of the uauth timeout.
If a user wishes to log out and clear their entry in the PIX Firewall uauth cache, the user can again Telnet to the virtual address. The user is prompted for their username and password, the PIX Firewall removes the associated credentials from the uauth cache, and the user will receive a "Logout Successful" message.
If inbound users on either the perimeter or outside interfaces need access to the Virtual Telnet server, a static and conduit command pair must accompany use of the virtual telnet command. The global IP address in the static command must be a real IP address. The local address in the static command is the IP address of the virtual server.
The Virtual Telnet server provides a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication. Users first connect to the Virtual Telnet server IP address, where the user is prompted for a username and password.
Example: virtual http
The following example shows the commands required to use the virtual http command for an inbound connection:
static 192.150.50.1 192.168.1.1conduit permit tcp host 192.150.50.1 eq 80 anyaaa authentication any inbound 192.168.1.1 255.255.255.255 0 0 tacacs+virtual http 192.150.50.1The next example displays the show virtual command output:
show virtual httpvirtual http 192.150.50.1Example: virtual telnet
After adding the virtual telnet command to the configuration and writing the configuration to Flash memory, users wanting to start PPTP sessions through PIX Firewall use Telnet to access the ip_address as shown in the following example:
On the PIX Firewall:
virtual telnet 192.150.50.254static 192.150.50.254 10.8.8.11 netmask 255.0.0.0conduit permit tcp host 192.150.50.254 eq telnet anywrite memoryOn an inside host:
/unix/host%telnet 192.150.50.254Trying 192.150.50.254...Connected to 192.150.50.254.Escape character is `^]'.username: usernameTACACS+ Password: passwordAuthentication SuccessfulConnection closed by foreign host./unix/host%The username and password are those for the user on the TACACS+ server.
who
Show active Telnet administration sessions on the PIX Firewall. (Unprivileged mode.)
who [local_ip]
show who [local_ip]
Syntax Description
local_ip
An optional internal IP address to limit the listing to one IP address or to a network IP address.
Usage Guidelines
The who command shows the PIX Firewall tty_id and IP address of each Telnet client currently logged into the PIX Firewall. This command is the same as the show who command.
See also: kill, telnet.
Example
The following example shows how to display the current Telnet sessions:
who2: From 192.168.2.21: From 192.168.1.3write
Store, view, or erase the current configuration. (Privileged mode.)
write net [[server_ip]:[filename]]
write erase
write floppy
write memory
write standby
write terminal
Syntax Description
Usage Guidelines
The write net command stores the current configuration into a file on a TFTP server elsewhere in the network. Additionally, the write net command uses the TFTP server IP address specified in the tftp-server command.
If you specify both the IP address and path name in the tftp-server command, you can specify the write net :filename as simply a colon ( : ). For example:
write net :Use the configure net command to get the configuration from the file.
The write erase command clears the Flash memory configuration.
The write floppy command stores the current configuration on diskette. The diskette must be DOS formatted or a PIX Firewall boot disk. If you are formatting the diskette from Windows, choose the Full format type, not the Quick (erase) selection. You can tell that information is stored on the diskette by observing that the light next to the diskette drive glows while information transfers.
The diskette you create can only be read or written by the PIX Firewall. If you use the write floppy command with a diskette that is not a PIX Firewall boot disk, do not leave the floppy in the floppy drive because it will prevent the firewall from rebooting in the event of a power failure or system reload. Only one copy of the configuration can be stored on a single diskette.
The write memory command saves the current running configuration to Flash memory. Use the configure memory command to merge the current configuration with the image you saved in Flash memory.
PIX Firewall lets processing continue during the write memory command.
If another PIX Firewall console user tries to change the configuration while you are executing the write memory command, the user receives the following messages:
Another session is busy writing configuration to memoryPlease wait a moment for it to finishAfter the write memory command completes, PIX Firewall lets the other command complete.
Note
The write standby command writes the configuration stored in RAM on the Active failover unit to the RAM on the Standby unit. When the Primary unit boots it automatically writes the configuration to the Secondary unit. Use the write standby command if the primary and secondary units' configurations have different information.
The write terminal command displays the current configuration in the PIX Firewall's RAM memory.
You can also display the configuration stored in Flash memory using the show configure command.
See also: configure.
Examples
The following example specifies a configuration file on the TFTP server and then stores the configuration in the new_config file:
tftp-server 10.1.1.2 /pixfirewall/config/new_configwrite net :The following example erases the contents of Flash memory and reloads the PIX Firewall:
write eraseErase PIX configuration in Flash memory? [confirm] yreloadThe following example saves the configuration on diskette:
write floppyBuilding configuration...[OK]The following example saves the current configuration to Flash memory:
write memoryBuilding configuration...[OK]The following example displays the configuration:
write terminalBuilding configuration...: Saved...xlate (clear and show)
View or clear translation slot information. (Privileged mode.)
clear xlate [global | local ip1[-ip2] [netmask mask]] lport|gport port[-port]]
[interface if1[,if2][,ifn]] [state static[,dump][,portmap][,norandomseq][,identity]]show xlate [global | local ip1[-ip2] [netmask mask]] lport|gport port[-port]]
[interface if1[,if2][,ifn]] [state static[,dump][,portmap][,norandomseq][,identity]]Syntax Description
[global | local ip1[-ip2]
[netmask mask]Display active translations by global IP address or local IP address using the network mask to qualify the IP addresses.
lport | gport port[-port]
Display active translations by local and global port specifications. See "Ports" in "" for a list of valid port literal names.
interface if1[,if2][,ifn]
Display active translations by interface.
state
Display active translations by state; static translation (static), dump (cleanup), PAT global (portmap), a nat or static translation with the norandomseq setting (norandomseq), or the use of the nat 0, identity feature (identity).
Usage Guidelines
The clear xlate command clears the contents of the translation slots. ("xlate" means translation slot.) The show xlate command displays the contents of only the translation slots.
Translation slots can persist after key changes have been made. Always use the clear xlate command after adding, changing, or removing the alias, conduit, global, nat, route, or static commands in your configuration.
See also: show conn, timeout, uauth.
Example
The following example lists two static translations, the first with two associated connections (called "nconns") and the second with four.
show xlateGlobal 16.130.3.17 Local 16.130.3.17 static nconns 1 econns 0Global 16.130.3.16 Local 16.130.3.16 static nconns 4 econns 0
