I N D E X

Symbols & Numerics# (pound sign), 29(*,G) multicast flows, 131? (question mark), context-based help, 314GE (4-port Gigabit Ethernet) SSM, 725

AAAA, configuring

command accounting, 286–287command authorization, 283–285

AAA servers, user management, 272–280administrative users, 280–287end-user cut-through proxy, 287–301

abbreviatingcommands, 30contiguous 0s on IPv6 addresses, 61

ABRs (Area Border Routers), 101absolute uauth timer, 9access control, 323accessing

ASA Flash memory partitions, 194–195firewall user interface

with console connection, 232–233with PDM/ASDM, 238–242with SSH session, 235, 237with Telnet, 234

FWSM on Catalyst 6500 switch, 28specific privilege levels, 263

accountinglocal user activity, 272of generic users on Cisco firewalls, 263–264

ACEs (access control entries)adding to ACLs, 353–355logging activity, 379–380removing from ACLs, 358–359time range, applying, 360–362time-based, 356

ACLs (access control lists)ACEs

adding, 353logging activity, 379–380removing, 358–359

time range, applying, 360–362time-based, 356

applying to lower-security interfaces, 351to outbound direction, 8

compiling, 352configuring, 348–349, 353descriptions, adding, 359–360downloadable, verifying, 299examples of, 362–363extended, 356–357hit counters, resetting, 382hit counts, displaying, 707–708logging activity, 617–619manipulating, 357–358monitoring, 380–382object groups, 352

applying, 373–379defining, 363–373enhanced service object groups, defining,

370–373ICMP type, defining, 367–369network object groups, defining, 364–365protocol object groups, defining, 365–367service object groups, defining, 369–370

recompiling, 353renaming, 359verifying firewall connectivity, 705–707wildcards, specifying, 355

activating debug packet sessions, 690–691activation keys

unlocking firewall features, 39upgrading, 40–41

active firewall process, checking, 629–632active shuns, verifying connectivity, 718–720active-active failover pair, 474–477

configuration example, 501–508requirements, 482–484

active-standby failover pair, 474–475configuration example, 498–501manually upgrading, 520–524

AD (Anomaly Detection) policies, configuring on AIP SSM, 778–780

addingACEs to ACLs, 354–355descriptions to ACLs, 359–360

848

address spoofing on outside interface, 5–6address translation, 323

conn entries, 326connection limits, configuring, 328–330dynamic NAT, configuring, 341–346dynamic PAT, configuring, 342–346embryonic connections, limiting, 330–331identity NAT, configuring, 338–340inbound access, defining, 324NAT exemption, 327

configuring, 340–341outbound access, defining, 323–324outside NAT, 328PAT, 326policy NAT, configuring, 335–338same-security access, 324–325static NAT, 326, 331–334types of supported on Cisco firewalls, 326–327verifying, 709–714xlate entries, 325xlate table entries

clearing, 717table timeout values, adjusting, 717–718

addressing, multicast, 127adjacency logging (OSPF), disabling, 106adjusting

fragment cache size, 72interface MTU, 70–71resource limits to security contexts, 186terminal screen width, 34xlate table timeout values, 717–718

admin context, 169, 173–175administration of ASA Flash memory, 196–200administrative context, 158administrative distance, 83–84administrative sessions, monitoring, 244–245administrative users, 261

managing with AAA servers, 280–287administratively scoped addresses, 127, 142advertising default routes, 96AIP (Advanced Inspection and Prevention) SSM,

725configuring, 769–772IPS policies, configuring, 777–780IPS sensors, configuring, 780–781IPS virtual sensors, configuring, 781–785license, updating, 773–774

managing, 773signature database file, updating, 774–776

alerts (syslog), 799-802alias keyword, 319allocating

firewall resources to contexts, 185–191resources in multiple-context mode, 185–186

analyzing firewall logs, 619–623application inspection, 423, 426

configuring, 426–432DCERPC inspection, configuring, 437–438DNS inspection, configuring, 438–440ESMTP inspection, configuring, 441–443FTP inspection, configuring, 443–446GTP inspection, configuring, 446–448H.323 inspection, configuring, 449–451HTTP inspection, configuring, 452–460ICMP inspection, configuring, 460–462IM inspection, configuring, 462, 464IPSec Passthru inspection, configuring, 465matching text with regular expressions,

433–437MGCP inspection, configuring, 465, 467MGCP map, configuring, 467NetBIOS inspection, configuring, 468RADIUS accounting inspection, configuring,

468–469SNMP accounting inspection, configuring,

470–471application partition passwords, resetting, 308applications

for optimizing Syslog servers, 590–591logging analysis, 620

applyingACLs to lower-security interfaces, 351object groups to access lists, 373–379policy maps to interface, 406–420

default policies, 421–423time ranges to ACEs, 360–362

area 0, 107areas (OSPF), subnet notation, 107ARP (Address Resolution Protocol)

configuring, 68–69static entries, clearing, 319

ARP cache, clearing, 69arp command, alias keyword, 319ARP inspection, 314

configuring, 320

address spoofing on outside interface

849

arp timeout command, 699arrow keys, recalling commands, 32ASA (Adaptive Security Algorithm), 4ASA (Adaptive Security Appliance)

4GE SSM, 725AIP SSM, 725, 769–780classifiers, 166configuring as Auto Update Server, 228–232CSC SSM, 725

automatic updates, configuring, 741–743configuring, 729–738connecting to management interface,

740–741inspection policy configuration, 744–769repairing initial configuration, 738–740

failover pair capabilities, 39Flash memory

administration, 194–200partitions, accessing, 194–195

MAC address allocation, 165Packet Tracer feature, verifying firewall

connectivity, 692–694Passwords, recovering, 302–305SSM modules, initial configuration, 726–729traceroute, performing, 703–705

ASA 7.2, WCCPv2, 396–397ASA 7.3, configuring redundant interfaces, 48–49ASA 8.0, configuring EIGRP, 97–101ASBRs (Autonomous System Boundary Routers),

101ASDM (Adaptive Security Device Manager)

accessing firewall user interface, 238–242ACL hit counts, displaying, 707–708firewall throughput, checking, 638–639image file, copying into Flash memory, 238–

239packet capture sessions, configuring with

Packet Capture Wizard, 683–685assigning

IP address to interfaces, 54–58privilege levels

to commands, 268–271to users, 265

security level to interfaces, 54unique MAC addresses to ASA physical

addresses, 167–168VLAN number to logical interface, 52–53

attributes of trunk links, 46audit trails, generating, 245AUS (Automatic Upgrade Server), automatically

upgrading failover pair, 524authentication

of generic users on Cisco firewalls, 262–263of local users, 265–267uauth, absolute uauth timer, 9

authorization, local user configuration, 268–272authorizing

firewall command access, 267–272user activity with TACACS+ servers, 291–293

Auto Update clientconfiguring firewall as, 221–227verifying operation, 227

Auto Update Server, configuring firewall as, 228–232

automatic CSC SSM updates, configuring, 741– 743

automatically upgrading image files, 211Auto-RP, 136–137

Bbanners, configuring on user interface, 243–244Base license, failover support, 39BEQ (best-effort queuing), 73–74, 663

configuring, 75–77displaying information, 77

best practicesfor firewall configuration, 21–23for security policy maintenance, 21–23

bidirectional mode (PIM), 135configuring, 138neighbor filtering, 143–144

Bidirectional NAT, 328boot image setting, displaying, 201bootstrap router method, 136bridge mode (CSM), 550broadcast traffic, 126BSRs (bootstrap routers), 136buffered logging, enabling, 626buffered messages, viewing, 597bump-in-the-wire, 312bypass links, 81–83

bypass links

850

Ccalculating runtime differences on processes,

630–632candidate RPs, 136capture sessions

controlling, 680–681copying buffer contents

to TFTP server, 676to web browser, 677–680

displaying trunk contents, 675–676example, 682monitoring, 673–674verifying packets passing through interfaces,

666–673capturing traffic

with Packet Capture Wizard, 683–685on VLANs inside switch chassis, 686–689

Catalyst 6500 switch, FWSM, 20accessing, 28

changeto command, 185changeto system command, 584changing message severity levels, 616characteristics of context configuration files,

168–169checking system resources, 627

failover performance, 646–655firewall CPU load, 627–632firewall interface throughput, 655–665firewall memory usage, 633–636firewall throughput, 638–645inspection engine activity, 645–646stateful inspection resources, 636–638

circular logging buffer, 597Cisco firewalls

clock management, 581setting clock manually, 582–583setting clock with NTP, 584–586

message logging, configuring, 591–613specifications, 20–21supported translation types, 326–327user management

accounting local user activity, 272generic users, 262–264with AAA servers, 272–301with local database, 264–272

CiscoACS servers, configuring command authorization, 283–285

class maps, configuring, 398–406classifiers, 160, 166classifying traffic, 398–406clear ip verify statistics command, 86clear traffic command, 514clearing

ARP cache, 69internal logging buffer, 615static ARP entries, 319xlate table entries, 717

CLI, initial firewall configuration, 41–42clock management, 581

setting clock manually, 582–583setting clock with NTP, 584–586

clock summer-time command, recurring keyword, 583

collecting Syslog firewall logs, 21–23combining load balancing techniques, 530command accounting, configuring, 286–287command authorization, configuring, 283–285command history, 32commands

abbreviating, 30active, viewing, 29arp, alias keyword, 319arp timeout, 699changeto, 185changeto system, 584clear ip verify statistics, 86clear traffic, 514configure terminal, 41–42debug icmp trace, 10–11debug ntp authentication, 586debug track, 94editing, 30entering, 29executing on failover peer, 517–519failover active, 516failover exec, 519failover mac address, 490failover poll, 492failover preempt, 486failover reload-standby, 517filtering output, 32–33fragment chain, 72

calculating runtime differences on processes

851

inspect, 432mac-address auto, 167mode multiple, 172operators, 356ping

example, 696permitting on ASA and PIX platforms, 696

preempt, 489privilege levels, 262

assigning, 268–271regular expressions

operators, 33searching, 32–33

same-security-traffic, 323show activation-key, 170, 518show admin-context, 191show arp, 68–69show arp-inspection, 320show blocks, 516, 634show conn, 326, 713show dhcprelay statistics, 125show failover, 497, 508–513, 521show firewall, 312show flash, 200show interface, 176, 515show ipv6 interface, 67show local-host, 715show logging, 614, 622show memory detail, 634show mode, 171show pim topology, 153show processes, 629show resource allocation, 189show rip, 96–97show running-config all, 30show service-policy, 427, 645show shun statistics, 383show tech-support, 692show traffic, 514show version, 34–36show xlate, 709–714static, 327syntax errors, 31terminal width, 34write mem, 42

community string (SNMP), defining, 257–258compiling access lists, 352

conditional NATconfiguring, 335–338static NAT, 335

configuration commands, entering manually, 218configuration examples

of active-active failover, 501–508with FWSM, 500– 501with PIX firewalls, 498–501

of active-standby failover, 474–475configuration files

of contexts, characteristics, 168–169running configuration

copying across failover pair, 217–218displaying, 214saving to Flash memory, 214–215saving to TFTP server, 216–217

startup configurationdisplaying, 213–214erasing configuration commands, 218managing, 211–213selecting, 212–213

configuration mode, 29configure terminal command, 41–42configuring

ACLs, 348–349, 353address translation

connection limits, 328–330dynamic NAT, 341–346dynamic PAT, 342–346identity NAT, 338–340NAT exemption, 340–341policy NAT, 335–338static NAT, 331–334

AIP SSM, 769–772IPS policies, 777–780IPS sensors, 780–781IPS virtual sensors, 781–785

application inspection, 426–432DCERPC inspection, 437–438DNS inspection, 438–440ESMTP inspection, 441–443FTP inspection, 443–446GTP inspection, 446–449H.323 inspection, 449–451HTTP inspection, 452–460ICMP inspection, 460–462IM inspection, 462, 464

configuring

852

IPSec Passthru inspection, 465matching text with regular expressions,

433–437MGCP inspection, 465, 467MGCP map, 467NetBIOS inspection, 468RADIUS accounting inspection, 468–469SNMP accounting inspection, 470–471

ARP, 68–69banners on user interface, 243–244bidirectional PIM neighbor filtering, 144class maps, 398–406command accounting, 286–287command authorization, 283–285content filters, 390–395contexts, 174–180CSC SSM, 729

automatic updates, 741–743FTP inspection policies, 753–755initial settings, 733–738inspection policies, 744–753POP3 inspection policies, 765–769SMTP inspection policies, 755–764traffic inspection, 730–733

CSM FWLB, 552–561CSS FWLB, 571–574DDNS, 121–123

verifying configuration, 123–124DHCP relay, 124–125DHCP server functions, 116–120EIGRP, 97–101failover, 484, 495

contexts, 495health monitoring policy, 490–492interface failure policy, 492primary unit, 485–488stateful, 492–497

firewallsas Auto Update client, 221–227as Auto Update Server, 228–232best practices, 21–23

FragGuard, 71–73identity NAT for exclusive outbound use, 340IGMP, 147–149interfaces, 50, 52–60

examples, 58–60IP address assignment, 54–58MTU, 70–71

IOS FWLB, 531–540IPv6, 61–63

neighbor advertisements, 65–66neighbor discovery, 64–65prefix advertisements, 66–67

IPv6 addresses, 60–61local user authorization, 268–272medium-security interfaces, inbound access,

350–352message logging, 591–613multicast boundaries, 142–143multiple-context mode, 170–173

navigating multiple security contexts, 173–174

OSPF, 105–112example configuration, 115–116on firewall, 101–104on both sides of firewall, 104–105prefix lists, 108redistribution, 112–115

PIM, 137–141neighbor filtering, 143–144

priority queuing, 75–77RADIUS user authorization, 294–295redundant interfaces, 48–49RIP on firewall, 95–97

verifying configuration, 96–97shuns, 382–384

example, 384–386SLA monitor process, 89–92SMR, 145–147

example, 150SNMP, 256–259SSM modules

AIP SSM, 769–772CSC SSM, 729-733initial configuration, 726–729

static routes, 86–87, 89switch ports, 485transparent firewall, 314–317

access lists, 321ARP inspection, 319–321interface speed, 315MAC address learning process, 318–319management address, 317–319non-IP protocol forwarding policy,

321– 322

configuring

853

conn table, 7entries, 7–8size, checking, 637–638

connecting to CSC SSM management interface, 740–741

connection limitsconfiguring for address translation, 328–329outbound, configuring on UDP/TCP, 329–330

connectionless protocols, 9ICMP, stateful inspection, 10–13UDP, 13–15

connection-oriented protocols, 9TCP, 15–19

connectionsembryonic, 16–17

limiting, 330–331maximum limit of, defining, 18TCP intercept, 18

half-closed, 18inbound access, 324

xlate lookup, 7maximum number supported on Cisco firewalls,

37–39outbound access, 323–324shunning, 382–384

example, 384–386stateful inspection, 7verifying, 711–716

connectivityactive shuns, verifying, 718–720IPv6, testing, 67–68of failover pairs, 481–482verifying, 691–722

with ACLs, 705–707console connection, accessing firewall user

interface, 232–233console logging, 595–596content filtering, 19

configuring, 390–395examples, 396WCCPv2, 396–397

context mode, displaying, 171context-based help, 31contexts, 158

admin contexts, 173–175allocating firewall resources, 185–191assigning to failover groups, 495

classifiers, 166configuration files, characteristics, 168–169configuring, 174–180CPU usage, displaying, 192example definition, 180–185inside context interfaces, sharing, 161–164labeling, 175multiple-context mode

configuring, 170–173navigating multiple security contexts,

173–174resource allocation, 185–186

physical interfaces, mapping to logical interfaces, 178

system execution space, features, 169–170system name, viewing, 176

controllingcapture sessions, 680–681traffic

ACLs, configuring, 348–349to/from medium-security interfaces, 349–

352copying

ASDM image into Flash memory, 238–239capture buffer contents

to TFTP server, 676to web browser, 677–680

files to/from Flash memory, 196–197PDM image into Flash memory, 238–239running configuration across failover pair,

217–218CPU utilization

checking, 627–632of contexts, displaying, 192

crashesforcing, 250information, saving, 248–249

crashinfo filesdeleting, 251generating, 249viewing, 250–251

creatingdirectories

in Flash memory, 198in PIX 7.x Flash memory, 198–199

test crashinfo files, 249

creating

854

critical messages (syslog), 802-803CSC (Content Security and Control) SSM, 725

automatic updates, configuring, 741–743configuring, 729initial configuration, repairing, 738–740initial settings, configuring, 733–738inspection policies

configuring, 744–753FTP, configuring, 753–755POP3, configuring, 765–769SMTP, configuring, 755–764

management interface, connecting to, 740–741traffic inspection, configuring, 730–733

CSM (Content Switching Module) FWLB, 549–552

configuring, 552–561displaying information, 569–571example configuration, 561–569

CSS (Cisco Content Services Switch), 529CSS FWLB

configuring, 571–574displaying information, 579example configuration, 574–579

Ctrl-I command, displaying typed commands, 30

DDCERPC (Distributed Computing Environment

Remote Procedure Call), 437DCERPC inspection, configuring, 437–438DDNS (Dynamic DNS), 120

configuring, 121–123database, updating, 121verifying configuration, 123–124

debug icmp trace command, 10–11debug ntp authentication command, 586debug packet sessions, enabling, 689–691debug track command, 94debugging

failover activity, 513–516ICMP debugging, enabling, 697–698

debugging messages (syslog), 837-845default behavior of firewalls, 4default policies, defining, 421–423default routes, 84

advertising, 96

defininglogging policies, 594–595object groups, 363–364

enhanced service object groups, 370–373ICMP type object groups, 367–369network object groups, 364–365protocol object groups, 365–367service object groups, 369–370

policy maps, 406–420default policies, 421–423

security policies in MPF, 397–398server reactivation policies, 274SNMP community string, 257–258

deletingcrashinfo files, 251files from Flash memory, 197

depletion mode, 274descriptions, adding to ACLs, 359–360detecting

firewall failures, 480spam

in POP3 e-mail, 767–768in SMTP e-mail, 759–762

DHCP (Dynamic Host Configuration Protocol), 19

DDNS, configuring, 121–124DHCP relay, configuring, 124–125DHCP server, configuring, 116–120directories

creating in Flash memory, 198–199removing from Flash memory, 199

disablingactive commands, 29OSPF adjacency logging, 106screen paging, 34

disconnecting from active PDM sessions, 245displaying

ACL hit counts, 707–708active PDM/ASDM management application

sessions, 245ARP inspection status, 320available firewall interfaces, 46–47boot image setting, 201buffered messages, 597configured contexts, 174context information, 191context mode, 171

critical messages (syslog)

855

contexts, 174, 191system name, 176

CPU usage for contexts, 192CSM FWLB information, 569–571CSS FWLB information, 579failover statistics, 508–513firewall crash information, 250–251firewall features, 34IOS FWLB information, 546–549monitoring status of interfaces, 497PIX 6.3 flash files, 200priority queuing information, 77redundant interface status, 49–50running configuration, 214startup configuration, 213–214startup configuration environment variable, 212trunk contents, 675–676typed commands, Ctrl-I, 30

disruptingping process, 697traceroute process, 705

DMZ (demilitarized zone) networks, 349–352protecting, 22

DNS Guard, 15DNS inspection, configuring, 438–440DNS resolution, configuring on firewall interface,

197DoS attacks, preventing IP address spoofing,

84–86downloadable ACLs

enabling on firewall, 298verifying, 299

downloading operating system image from monitor prompt, 202–206

DUAL (Diffusing Update Algorithm), 97dynamic NAT

configuring, 341–346examples, 346–348

dynamic PATconfiguring, 342–346examples, 346–348

Eediting commands, 30EIGRP (Enhanced Interior Gateway Routing

Protocol)configuring, 97–101DUAL, 97

EMBLEM format (system messages), 588embryonic connections, 16–17

limiting, 330–331maximum limit of, defining, 18TCP intercept, 18

enablingbuffered logging, 626debug packet sessions, 689–691ICMP debugging, 697–698ICMP inspection, 703RPF, 85

end users, 261end-user cut-through proxy

configuration examples, 300–301configuring on AAA servers, 287–300

enhanced service object groups, defining, 370–373

entering commands, 29environment variable for startup configuration,

displaying, 212erasing

configuration commands from startup configuration, 218

Flash memory, 199–200error messages (syslog), 804-815ESMTP inspection, configuring, 441–443examining firewall crash information, 248–249example configurations

CSM FWLB, 561–569CSS FWLB, 574–579interfaces, 58–60OSPF, 115–116

examplesof ACLs, 362–363of capture session, 681–682of content filters, 396of context definition, 180–185of dynamic NAT, 346–348of dynamic PAT, 346–348

examples

856

of firewall failover configurationactive-active, 501–508active-standby with FWSM, 500–501active-standby with PIX firewalls,

498– 500of IOS FWLB, 540–546of ping command, 696of SMR configuration, 150

exec banners, configuring on user interface, 243–244

executing commandson failover peer, 517–519remotely, 519

exploits, VLAN hopping, 79–80preventing, 80–81

extended access lists, 356–357extended pings

disrupting, 697sending, 696–697

Ffailover, 19

active-active failover pair, 474–477configuration example, 501–508requirements, 482–484

active-standby failover pair, 474–475configuration example, 498–501manually upgrading, 520–524

cause of, determining, 652–655configuring, 484, 495contexts, configuring, 495debugging, 513–516displaying statistics, 508–513health monitoring policy, configuring, 490–492interfaces

failure policy, configuring, 492“testing” mode, 480–481

LAN-based, 479manually forcing role change, 516primary unit, configuring, 485–488required licenses, 475resetting failed firewall unit, 517stateful

configuring, 492–497monitoring, 514–516

toggling roles, 655verifying

communication, 647–650unit roles, 646–647

failover active command, 516failover cable, 479failover exec command, 519failover groups, 482–484failover hello messages, 492failover mac address command, 490failover pairs

connectivity, 481–482copying running configuration across, 217–218

failover poll command, 492failover preempt command, 486failover reload-standby command, 517failures, detecting, 480feasible successors, 97features of firewalls

displaying, 34unlocking, 39

fields of system messages, 588file blocking (HTTP), configuring on CSC SSM,

751files

copying to/from Flash memory, 196–197deleting from Flash, 197renaming in Flash, 198

filtering. See also content filteringcommand output, 32–33POP3 content, 768–769SMTP content, 758–759

fine-tuning logging message generation, 615–616firewall farms, 527firewall masks, 355firewalls

configuringas Auto Update client, 221–227as Auto Update Server, 228–232

crashes, forcing, 250interface throughput, checking, 655–665

first-hop routers, 128fixed-group addresses, 127fixup. See application inspectionflash files, displaying in PIX 6.3, 200

examples

857

Flash memoryASA

administration, 196–200managing, 194

copying files to/from, 196–197creating new directories, 198deleting files from, 197erasing, 200formatting, 199FWSM, managing, 194–196hierarchical structure, 195–196managing, 192–193operating system image

downloading from monitor prompt, 202– 206

identifying, 200–201upgrading, 205–210

PIX 7.x, creating directories, 198–199removing directories, 199renaming files, 198running configuration, saving, 214–215system integrity, verifying, 199

FO (Failover) license, 39FO-AA (Failover-Active/Active) license, 39forcing

failover role change, 516firewall crashes, 250

foreign addresses, 6formatting Flash memory, 199FragGuard, configuring, 71–73fragment cache, adjusting size of, 72fragment chain command, 72FTP, uploading logging buffer contents, 598FTP inspection

configuring, 443–446policies, configuring on CSC SSM, 753–755

FWLB (Firewall Load Balancing), 527–528CSM FWLB, 549–552

configuring, 552–561displaying information, 569–571example configuration, 561–569

CSS FWLBconfiguring, 571–574displaying information, 579example configuration, 574–579

IOS FWLB, 530–531configuring, 531–540displaying information, 546–549example, 540–546

methods of, 529FWSM (Firewall Services Module), 20

accessing on Catalyst 6500 switch, 28failover pairs, 477

capabilities, 39Flash memory management, 194–196logical interfaces, 47NTP support, 584passwords, recovering, 307–308security levels, 316VLAN groups, defining, 47

GGeneral Queries (IGMPv2), 130generating

audit trails, 245test crashinfo files, 249

generic usersaccounting, 263–264authentication, 262–263managing on Cisco firewalls, 262

global addresses, 6, 61global configuration mode, 29globally scoped addresses, 127GMT (Greenwich Mean Time), 581Group-Specific Queries (IGMPv2), 130GTP inspection, configuring, 446–449

HH.323 inspection, configuring, 449–451half-closed connections, 18half-open connections, 17hardware load balancing, CSM FWLB, 549–552

configuring, 552–561displaying information, 569–571example configuration, 561–569

help system, context-based help, 31hierarchical structure of flash file system,

195–196

hierarchical structure of flash file system

858

history of failover state changes, displaying, 513hit counter (ACL), resetting, 382hitless upgrade, 479, 519holdtime timer, setting, 491HTTP inspection

configuring, 452–460policies, configuring on CSC SSM, 751

file blocking, 751HTTP scanning, 751–753URL blocking, 745–746URL filtering, 746–750

HTTP scanning, configuring on CSC SSM, 751–753

IICMP (Internet Control Message Protocol)

ACLs operation, 8debugging, enabling, 697–698message types, 788–790object groups, defining, 367–369ping, 481restricting traffic, 23stateful inspection, 10–11

case study, 12–13time-exceeded messages, permitting, 704

ICMP inspectionconfiguring, 460–462enabling, 703

identifying operating system image in Flash memory, 200–201

identity NAT, configuring, 338–340idle uauth timer, 9IEEE 802.1Q trunks, attributes, 46IGMP (Internet Group Message Protocol)

configuring, 147–149SMR, configuring, 145–147verifying operation, 151–152

IGMP proxy agent, 126IM inspection, configuring, 462–464image files, automatically upgrading, 211inbound access, 324

configuring on medium-security interfaces, 350–352

inbound connections, 4xlate lookup, 7

informational messages (syslog), 827-837initial firewall configuration, 41–42initial settings, configuring on CSC SSM,

733–738initiating

firewall reload, 246–247after specific time interval, 247–248

multiple context mode, 172–173inline interface configuration, 781inside context interfaces, sharing, 161–164inside interfaces, 2–3inspect command, 432inspection engines, 9. See also application

inspectionactivity, checking, 645–646ICMP stateful inspection, 10–13TCP stateful inspection, 15–19UDP stateful inspection, 13–15

inspection policies (CSC SSM), 744– 753FTP, configuring, 753–755HTTP, configuring, 745–753interface polltime, 492POP3, configuring, 765–769SMTP, configuring, 755–764

interface priority queues, 73–74interfaces

ASA, assigning unique MAC addresses, 167– 168

configuring, 50, 52–60connectivity

checking ARP cache, 698–700checking routing table, 700testing with ping packets, 695–696verifying, 691–692, 720–722verifying with ACLs, 705–707verifying with traceroute, 700–703

DNS resolution, configuring, 197example configurations, 58–60inbound access, 324inside context interfaces, sharing, 161–164IP addresses

assigning, 54–58IPv6 addresses, configuring, 60–61

logical, assigning VLAN number, 52–53lower-security, applying ACLs, 351

history of failover state changes

859

medium-securityinbound access, 350, 352traffic, controlling, 349–352

monitoring status, displaying, 497MTU, configuring, 70–71outbound access, 323–324physical, mapping to contexts, 158, 160–161policy maps, applying, 406–423redundant interface groups, 474same-security access, 324–325security level, assigning, 54testing mode, 480–481verifying packets passing through via capture

sessions, 666–676internal clock

setting manually, 582–583setting with NTP, 584–586

internal logging buffer, clearing, 615invoking

context-based help, 31Packet Tracer tool, 694

IOS FWLB, 530–531configuring, 531–540displaying information, 546–549example, 540–546

IP address spoofing, preventing, 84–86IP addresses, assigning to interfaces, 54–58IP multicast, 127

addressing, 127administratively scoped addresses, 142bidirectional PIM neighbor filtering,

configuring, 144IGMP

configuring, 147–149verifying operation, 151–152

multicast boundaries, configuring, 142–143multicast trees, 128PIM, 130–131

configuring, 137–141Sparse Mode, 131–134verifying operation, 152–155Version 1, 136

PIM neighbor filtering, configuring, 143–144PIM-SM, RP designation, 136–137RPF, 128–129

SMRconfiguring, 145–147example configuration, 150

IP port numbers, 790–791corresponding Cisco firewall keywords,

791– 794ip verify reverse-path interface, 85IPS (Intrusion Prevention Systems), configuring

on AIP SSM, 778–780policies, 777–779sensors, 780–781virtual sensors, 781–785

IPSec Passthru inspection, configuring, 465IPv6

configuring, 60–63connectivity, testing, 67–68neighbor advertisements, configuring, 65–66neighbor discovery, configuring, 64–65prefix advertisements, configuring, 66–67

ISNs (initial sequence numbers), 8, 331

J-K-Lknowledge base, 779

labeling contexts, 175LAN-based failover, 479–481last-hop routers, 128Layer 2 firewalls, 312Layer 3 traffic

classifying, 398–406policy maps, defining, 406–420

Layer 4 trafficclassifying, 398–406policy maps, defining, 406–420

Leave Group messages (IGMPv2), 130length of terminal screen, adjusting, 34level 0 passwords, resetting, 263license, registering, 39licenses

activation keys, 39upgrading, 40–41

Base license, failover support, 39FO-AA, 39required for failover, 475upgrading, 39

licenses

860

limitations on outbound UDP/TCP connections, 329–330

limitingembryonic connections, 330–331resource allocation on security contexts,

186–188resources allocated to contexts, 185–189TCP MSS size, 71

link-local addresses, 61, 127links, bypass links, 81–83link-state protocols, OSPF configuration, 105–

112listing available firewall interfaces, 46–47LLQ (low-latency queue), 74, 663

configuring, 75–77displaying information, 77

load balancingCSM FWLB, 549–552

configuring, 552–561displaying information, 569–571example configuration, 561–569

FWLB, 528–529IOS FWLB, 530–531

configuring, 531–540displaying information, 546–549example, 540–546

local addresses, 6local database, user management, 264–265

accounting local user activity, 272firewall command access, authorizing, 267–272local user authentication, 265–267local user authorization, configuring, 268–272

loggingACE activity, 379–380ACL activity, 617–619

logging messages, 587analyzing firewall logs, 619–623clearing internal logging buffer, 615configuring, 591–613destinations, verifying, 614logging to secure Syslog server with SSL, 604–

611manually testing message generation, 615pruning messages, 615–616sending messages

to ASDM management application, 613to email address, 611–613

severity levelschanging, 616setting, 587

time stamp synchronization, 588logging timestamp message, 604logical interfaces, 35, 47

mapping to physical interfaces, 178subinterface number, 51–52VLAN number, assigning, 52–53

logical VLAN interfaces, 51–52login banner, configuring on user interface,

243–244lookups (xlate table), 7lower-security interfaces, applying ACLs, 351LSAs (link-state advertisements), 101

MMAC addresses

of ASA physical interfaces, displaying, 165learning process, configuring on transparent

firewalls, 318–319mac-address auto command, 167management traffic, restricting access to, 23managing

AIP SSM, 773Flash memory, 192–193

ASA, 194FWSM, 194–196

startup configuration, 211–213manipulating ACLs, 357–358manually forcing failover role change, 516manually resetting failed firewall units, 517manually setting internal clock, 582–583manually testing logging message generation, 615manually upgrading active-standby pair,

520– 524mapping

to contexts, 158, 160–161to logical interfaces (contexts), 178

mapping agents, 136medium-security interfaces

inbound access, configuring, 350, 352traffic, controlling, 349–352

Membership Report messages, 129

limitations on outbound UDP/TCP connections

861

memoryFlash

copying files to/from, 196–197creating directories in, 198deleting files from, 197downloading operating system image,

202–206formatting, 199identifying operating system image, 200–

201managing, 192–196removing directories from, 199renaming files in, 198upgrading operating system image, 205–

210usage, checking, 633–636

merging startup and running configuration commands, 219–221

messagesICMP, 788–790IGMP Membership Report, 129logging, 587

analyzing firewall logs, 619–623buffered messages, displaying, 597destinations, verifying, 614logging ACL activity, 617–619logging to secure Syslog server with SSL,

604–611manually testing, 615pruning messages, 615–616sending messages to ASDM management

application, 613sending messages to email address, 611–

613setting severity levels, 587time stamp synchronization, 588

logging timestamp, 604severity levels, changing, 616syslog

severity level 1 alerts, 799-802severity level 2 critical messages, 802-803severity level 3 error messages, 804-815severity level 4 warning messages,

815-821severity level 5 notifications, 821-822

severity level 6 informational messages, 827-832

severity level 7 debugging messages, 831-845

system messages, format, 588MGCP inspection, configuring, 465, 467MGCP map, configuring, 467MIBs, 252, 255

monitoring firewall activity, 251–252objects, 253

mode multiple command, 172modifying message severity levels, 616monitor screen length/width, changing, 34monitoring

ACLs, 380–382active shun activity, 383address translations, 709–714administrative sessions, 244–245capture sessions, 673–674connections, 711–716firewall activity with SNMP, 251–252

traps, 255firewall configuration changes, 722–723stateful failover, 514–516xlate entries based on local address, 710

MOTD banners, configuring on user interface, 243–244

MPF (Modular Policy Framework), defining security policies, 397–398

mroutes, 142MSS (maximum segment size), configuring, 71MTU (maximum transmission unit), interface

configuration, 70–71multicast, 126–127

boundaries, configuring, 142–143IGMP

configuring, 147–149verifying operation, 151–152

OUI values, 127PIM, 130–131, 136

configuring, 137–141verifying operation, 152–155

PIM-SM, 131–134RP designation, 136–137

routingmulticast trees, 128RPF, 128–129

multicast

862

SMRconfiguring, 145–147example configuration, 150

multicast groups, 126multicast trees, 128multiple-context mode, 158, 313

classifiers, 160configuring, 170–173initiating, 172–173navigating multiple security contexts, 173–174resource allocation, 185–186

Nnaming format for downloadable ACLs, 299NAT

Bidirectional, 328identity NAT, configuring, 338–340policy NAT, configuring, 335–338

NAT exemption, 327configuring, 340–341

navigating multiple security contexts, 173–174NBNS (NetBIOS Name Service), configuring

NetBIOS inspection, 468neighbor advertisements, IPv6 configuration,

65–66neighbor discovery, IPv6 configuration, 64–65NetBIOS inspection, configuring, 468network object groups, defining, 364–365non-IP protocol forwarding policy, configuring

on transparent firewall, 321–322notifications (syslog), 821-827NTP (Network Time Protocol), setting internal

clock, 584–586

Oobject groups, 352

applying to ACLs, 373–379defining, 363–364enhanced service object groups, defining,

370–373ICMP type, defining, 367–369network object groups, defining, 364–365protocol object groups, defining, 365–367

service object groups, defining, 369–370operating system

of active-standby failover pair, upgrading, 520–524

downloading image from monitor prompt, 202–206

identifying image in Flash memory, 200–201upgrading image, 205–210

operators, 356optimizing Syslog servers, 589options (commands), entering, 29OSPF (Open Shortest Path First)

Areas, subnet notation, 107configuring, 105–112example configuration, 115–116prefix lists, configuring, 108redistribution, configuring, 112–115static route redistribution, configuring, 114virtual links, 109

OUI (Organizationally Unique Identifier) values, 127, 168

outbound access, 323–324outbound connections, 4

UDP/TCP limitations, 329–330xlate lookup, 7

output interface queues, 73–74outside interfaces, 2–3

address spoofing, 5–6Outside NAT, 328

Ppacket capture, 19Packet Capture Wizard, enabling packet capture

sessions in ASDM, 683–685packet classifiers, 160Packet Tracer feature, verifying firewall

connectivity, 692–694Packet Tracer tool, invoking, 694packets

fragments, handling, 71–73ICMP, stateful inspection of, 10–13IPv4, Protocol field, 787–788TCP, stateful inspection of, 15–19UDP, stateful inspection of, 13–15

multicast

863

parametersof conn table entries, 7–8for xlate table entries, 6

partitions, accessing ASA Flash memory, 194–195passwords, recovering

ASA, 302–305FWSM, 307–308PIX, 303–307

PAT (Port Address Translation), 326dynamic PAT, configuring, 342–346

PDM (PIX Device Manager)accessing firewall user interface, 238–242image file, copying into Flash memory,

238–239perfmon counters, checking firewall throughput,

643–645permitting ICMP time-exceeded messages, 704physical interfaces, mapping

to contexts, 158–161to logical interfaces, 178

PIM (Protocol Independent Multicast), 130–131bidirectional mode, 135configuring, 137–141neighbor filtering, configuring, 143–144

bidirectional configuring, 144shared trees, 132Sparse Mode, 131–134verifying operation, 152–155Version 1, 136

PIM-SM, RP designation, 136–137ping command, 481

example, 696permitting on ASA and PIX platforms, 696

PIXfailover pair capabilities, 39passwords, recovering, 306–307

PIX 6.3, displaying flash files, 200policy maps

default policies, defining, 421–423defining, 406–420

policy NAT, configuring, 335–338POP3 inspection policies, configuring on CSC

SSM, 765–766content filtering, 768–769spam detection, 767–768

port numbers, 790–791corresponding Cisco firewall keywords,

791–794predefined logging messages, 591–592preempt command, 489prefix advertisements (IPv6), configuring, 66–67preventing

IP address spoofing, 84–86VLAN hopping, 80–81

primary failover unit, configuring, 485–488priority queuing

configuring, 75–77displaying information, 77

privilege levels, 262accessing, 263assigning

to commands, 268–271to users, 265

privileged EXEC mode, 28processes, calculating runtime differences,

630–632promiscuous monitoring, 780protecting DMZ, 22Protocol field, 787

corresponding Cisco firewall keywords, 788protocol object groups, defining, 365–367pruning messages, 615–616

Q-Rqueuing

priority queuingconfiguring, 75–77displaying information, 77

transmit ring, 7

R (Restricted) license, 39RADIUS

accounting inspection, configuring, 468–469user authorization, configuring, 294–295

rate-limiting logging messages, 593reachability, testing, 91–95recalling commands, 32recompiling access lists, 353

recompiling access lists

864

recovering passwordsASA, 302–305FWSM, 307–308PIX, 303–307

recurring keyword (clock summer-time command), 583

redistribution, configuring OSPF, 112–115redundant interface groups, 474redundant interfaces, configuring, 48–49registering firewall licenses, 39regular expressionsregular expressions

application inspection, text matching, 433–437operators, 33performing searches on, 32–33

reloading firewalls, 246–247after specific time interval, 247–248

remark ACEs, adding to ACLs, 359–360remote command execution, 519removing

ACEs from ACLs, 358–359directories in Flash memory, 199static routes, 88

renamingACLs, 359files in Flash memory, 198

repairing CSC SSM initial configuration, 738–740

requirements for active-active failover, 482–484resetting

ACL hit counters, 382application partition passwords, 308failed firewall unit, 517level 0 passwords, 263

resources, allocating to contexts, 185–191restricting

access to management traffic, 23ICMP traffic, 23

RFC 2827, 5RFC Sourcebook, 787RIP (Routing Information Protocol)

configuring on firewall, 95–97verifying configuration, 96–97

route lookups, 531route maps (OSPF), configuring, 112–115routed firewall mode, 311router mode (CSM), 550

routing information sources, 83routing IP multicast, 128–129routing tables, checking connectivity, 700RP (Rendezvous Point), 131RPF (Reverse Path Forwarding), 84, 128–129

enabling, 85preventing IP address spoofing, 85–86

running configuration, 478configuration commands, entering manually,

218copying across failover pair, 217–218displaying, 214merging configuration commands with startup

configuration, 219–221saving to Flash memory, 214–215saving to TFTP server, 216–217

runtime differences, calculating on processes, 630–632

Ssame-security access, 324–325same-security-traffic command, 323saving

firewall crash information, 248–249running configuration to Flash memory,

214– 215running configuration to TFTP server, 216–217

scheduling firewall reloads, 247screen paging, disabling, 34searching for regular expressions, 32–33security contexts, 158security levels

assigning to interfaces, 54on FWSM, 316

security policiesbest practices, 21–23defining in MPF, 397–398

"security wheel", 23selecting startup configuration, 212–213sending Syslog messages with TCP, 602server reactivation policies, defining, 274service contact port, 791service object groups, defining, 369–370

recovering passwords

865

setting system clockmanually, 582–583with NTP, 584–586

severity levels, 587changing, 616setting for message logging, 587severity level 1 alerts, 799-802severity level 2 critical messages, 802-803severity level 3 error messages, 804-815severity level 4 warning messages, 815-821severity level 5 notifications, 821-827severity level 6 informational messages,

827-837severity level 7 debugging messages, 832-845

shared trees, 131-132sharing inside context interfaces, 161–164show activation-key command, 170, 518show admin-context command, 191show arp command, 68–69show arp-inspection command, 320show blocks command, 516, 634show conn command, 326, 713show dhcprelay statistics command, 125show failover command, 497, 508–513, 521show firewall command, 312show flash command, 200show interface command, 176, 515show ipv6 interface command, 67show local-host command, 715show logging command, 614, 622show memory detail command, 634show mode command, 171show pim topology command, 153show processes command, 629show resource allocation command, 189show rip command, 96–97show running-config all command, 30show service-policy command, 427, 645show shun statistics command, 383show tech-support command, 692show traffic command, 514show version command, 34–36show xlate command, 709–714shunning traffic, 382–384

example, 384–386

shunsconfiguring, 382–384verifying connectivity, 718–720

signature database file (AIP SSM), updating, 774–776

single-context mode, 158site-local addresses, 61SLA (service level agreement) monitor process,

configuring, 89–92SMR (stub multicast router), 128

configuring, 145–147example configuration, 150

SMTP inspection policies, configuring on CSC SSM, 755–758

mail handling, 763–765SMTP filtering, 758–759spam detection, 759–762

SNMP (Simple Network Management Protocol)accounting inspection, configuring, 470–471configuring, 256–259MIBs, 253, 255monitoring firewall activity, 251–252traps, 255–256

software load balancing, IOS FWLB, 530–531configuring, 531–540displaying information, 546–549example, 540–546

source address, spoofing, 5spam

detecting in POP3 e-mail, 767–768SMTP inspection, configuring, 759–762

SPAN (switch port analyzer), configuring traffic capture sessions, 687

Sparse Mode (PIM), 131sparse mode (PIM)

shared trees, 132specifications of Cisco firewalls, 20–21spoofed IP addresses, preventing, 84–86SPT (shortest path tree), 135SSH (Secure Shell), accessing firewall user

interface, 235–237SSL (Secure Sockets Layer), secure Syslog server

logging, 604–611

SSL (Secure Sockets Layer)

866

SSM modules4GE SSM, 725AIP SSM, 725

configuring, 769–772IPS policies, configuring, 777–780license, updating, 773–774managing, 773signature database file, updating, 774–

776CSC SSM, 725

automatic updates, configuring, 741–743configuring, 729–738FTP inspection policies, configuring,

753–755initial configuration, repairing, 738–740inspection policies, configuring, 744–753management interface, connecting to,

740–741POP3 inspection policies, configuring,

765–769SMTP inspection policies, configuring,

755–764initial configuration, 726–729

startup configuration, 478configuration commands, merging with running

configuration commands, 219–221displaying, 213–214environment variable, displaying, 212erasing configuration commands from, 218managing, 211–213selecting, 212–213

stateful backup, 531stateful failover, 481

configuring, 492–497monitoring, 514–516

stateful inspection, 7, 9of ICMP, 10–11

case study, 12–13packet classifiers, 160resources, checking, 636–638of TCP, 15–18

TCP normalization, 18–19of UDP, 13–15

stateless backup, 531stateless failover, 481static ARP entries, clearing, 319static command, 327

static NAT, 326, 331–334static routes

configuring, 86–89reachability, testing, 93–95redistributing into OSPF, 114removing, 88SLA monitor process, configuring, 89–92

stealth firewalls, 312sticky connections, 532stratum, 581structure of flash file system hierarchy, 195–196stub routers, 126subinterface number, 51–52supported translation types on Cisco firewalls,

326–327switch ports, configuring, 485synchronizing time stamps on logging messages,

588syntax errors, 31Syslog, 19

firewall logs, collecting, 21–23firewall throughput, checking, 639messages

sending with TCP, 602severity level 1 alerts, 799-802severity level 2 critical messages, 802-803severity level 3 error messages, 804-815severity level 4 warning messages,

815-821severity level 5 notifications, 821-827severity level 6 informational messages,

827-837severity level 7 debugging messages,

831-845secure logging with SSL, 604–611servers, optimizing, 589viewing recent messages, 626–627

system execution space, 158, 169features, 169–170

system messages, EMBLEM format, 588system name (contexts), displaying, 176system resources, checking, 627

failover performance, 646–655firewall CPU load, 627–632firewall interface throughput, 655–665firewall memory usage, 633–636

SSM modules

867

firewall throughput, 638–645inspection engine activity, 645–646stateful inspection resources, 636–638

TTACACS+ servers

authorizing user activity, 291–293enable authentication support, 281

TCPconnections

monitoring, 711–716embryonic connections, 18, 330–331half-closed connections, 18half-open connections, 17

ISNs, 331MSS, configuring, 71sending Syslog messages, 602stateful inspection, 15–18

TCP normalization, 18–19TCP intercept, 18TCP normalization, 18Telnet, accessing firewall user interface, 234terminal screen width, adjusting, 34terminal width command, 34termination of TCP connections, 17test crashinfo files, generating, 249testing

address reachability, 91connectivity

with ARP cache, 698–700with ping packets, 695–696

IPv6 connectivity, 67–68logging message generation, 615reachability, 93–95

"testing mode", 480–481TFTP server, saving running configuration to,

216–217three-way handshakes, 15throughput, checking, 638–645time stamps, synchronizing on logging messages,

588timed reactivation, 274time-based ACEs, 356time-exceeded messages (ICMP), permitting, 704timers

CPU utilization, 629Holdtime, setting, 491idle uauth timer, 9

toggling failover roles, 655topologies, 77–79

bypass links, 81–83traceroute

disrupting, 705performing on ASA, 703–705verifying firewall connectivity, 700–703

trafficcapture sessions, enabling on VLAN inside

switch chassis, 686– 689classifying, 398–406controlling

to/from medium-security interfaces, 349– 352

with ACLs, 348–349shunning, 382–384

example, 384–386traffic counters, checking firewall throughput,

640–643traffic inspection, configuring on CSC SSM,

730–733translation table size, checking, 636–637translations

conditional, 335dynamic NAT, configuring, 341–346dynamic PAT, configuring, 342–346identity NAT, configuring, 338–340NAT exemption, configuring, 340–341policy NAT, configuring, 335–338static NAT, 331–334xlate table entries

clearing, 717timeout values, adjusting, 717–718

transmit ring, 76transparent firewall mode, 312–314

ARP inspection, 314interface support, 312

transparent firewallsaccess lists, configuring, 321ARP inspection, configuring, 319–321configuring, 314–317interface speed, configuring, 315MAC address learning process, configuring,

318–319

transparent firewalls

868

management address, configuring, 317–319non-IP protocol forwarding policy, configuring,

321–322traps (SNMP), 255–256triggering a firewall reload, 246–247

after specific time interval, 247–248troubleshooting logging buffer content uploads to

FTP server, 598trunk link attributes, 46trunks, displaying contents, 675–676tuning OSPF, 110Turbo ACLs

compiling, 352recompiling, 353

Uuauth

absolute uauth timer, 9verifying firewall connectivity, 720–722

UDPConnections, monitoring, 711–716stateful inspection, 13–15

unicast traffic, 126unique MAC addresses, assigning to physical

interfaces, 167–168unlocking firewall features, 39updating

AIP SSM license, 773–774AIP SSM signature database file, 774–776DDNS database, 121

upgradingactive-standby failover pair, 520–524failover pair with AUS, 524image files, 211licenses, 39

activation keys, 40–41operating system image, 205–210

uploading logging buffer contents to FTP, 598UR (Unrestricted) license, 39URL blocking, configuring on CSC SSM, 745–

746URL filtering, configuring on CSC SSM, 746–750URLs, RFC Sourcebook, 787user activity, generating audit trails, 245user activity accounting, configuring, 300

user authentication. See uauthuser contexts, 158user EXEC mode, 28user interface

accessingwith console connection, 232–233with SSH, 235, 237with Telnet, 234

administrative sessions, monitoring, 244–245command history, 32commands

abbreviating, 30editing, 30entering, 29

context-based help, 31regular expressions

operators, 33searching for, 32–33

user interface modes, 28configuration mode, 29privileged EXEC mode, 28user EXEC mode, 28

user management (Cisco firewalls)with AAA servers, 272–280

administrative users, 280–287end-user cut-through proxy, 287–301

generic users, 262accounting, 263–264authentication, 262–263

with local database, 264–265accounting local user activity, 272firewall command access, authorizing,

267–272local user authentication, 265–267

VVACL (VLAN ACLs), enabling traffic capture

sessions, 688–689verifying

address translation, 709–714based on local addresses, 710

Auto Update client operation, 227connections, 711–716DDNS configuring, 123–124downloadable ACLs, 299

transparent firewalls

869

failover communication, 647–650failover roles, 646–647firewall connectivity, 691–692

ACLs, 705–707checking ARP cache, 698–700checking routing table, 700checking Uauth, 720–722with Packet Tracer feature, 692–694testing with ping packets, 695–696with traceroute, 700–703

Flash memory system integrity, 199IGMP multicast operation, 151–152message logging activity, 614packets passing through interfaces via capture

sessions, 666–676PIM multicast routing, 152–155rip configuration, 96–97

viewingactive commands, 29boot image setting, 201buffered messages, 597configured contexts, 174context information, 191context mode, 171failover statistics, 508–513firewall crash information, 250–251list of firewall features, 34priority queuing information, 77running configuration, 214startup configuration, 213–214Syslog information, 626–627

virtual links, 109virtual sensors, configuring on AIP SSM, 781–785VLAN groups, defining on FWSM, 47VLAN hopping, 79–80

preventing, 80–81VLAN inline pair configuration, 781VLAN number, assigning to logical interface,

52–53VLANs

logical interfaces, 51–52traffic, capturing inside switch chassis, 686–689

VPN users, 261

Wwarning messages (syslog), 815-821WCCPv2, 396–397weighted least connections algorithm, 557weighted round robin algorithm, 557well-known port numbers, service contact port,

791wildcards, specifying for ACLs, 355write mem command, 42

X-Y-Zxlate table, 6

entries, 325clearing, 717locating based on local addresses, 710parameters, 6verifying, 709–714

lookups, 7size, checking, 636–637timeout values, adjusting, 717–718

zero downtime upgrade, 479, 519

zero downtime upgrade