encryption-key

The encryption-key can be 0 (specifies that an unencrypted key follows), 6 (specifies that an advanced encryption scheme [AES] encrypted key follows), 7 (specifies that a hidden key follows), or a line specifying the unencrypted (clear-text) server key.

15.2(2)T

This command was introduced.

15.4(1)T

This command was modified. The 6 keyword was added.

aaa new-model

Enables new RADIUS and AAA access control commands and functions and disables old commands.

address ipv4

Configures the RADIUS server accounting and authentication parameters for PAC provisioning.

password encryption aes

Enables a type 6 encrypted preshared key.

radius server

Specifies the name for the RADIUS server configuration for PAC provisioning and enters RADIUS server configuration mode.

number

User parameters. Valid values range from 1 to 8.

value value

To be used if the parameter has a constant value.

prompt string

To be used if the parameter is supplied after the crypto ca authenticate command or the crypto ca enroll command has been entered.

12.2(13)ZH

This command was introduced.

12.3(4)T

This command was integrated into Cisco IOS Release 12.3(4)T.

authentication command

Specifies the HTTP command that is sent to the CA for authentication.

crypto ca profile enrollment

Defines an enrollment profile.

enrollment command

Specifies the HTTP command that is sent to the CA for enrollment.

inspect

Defines an inspect type parameter map, which configures connection thresholds, timeouts, and other parameters pertaining to the inspect action.

urlfilter

Defines a URL-filter-specific parameter map.

protocol-info

Defines an application-specific parameter map.

consent

Defines an authentication proxy consent parameter map.

parameter-map-name

Name of the parameter map.

12.4(6)T

This command was introduced.

12.4(9)T

The protocol-info keyword was added.

12.4(15)T

The consent keyword was added.

12.4(20)T

Support for ICQ and Windows Messenger was added.

15.2(1)T1

This command was introduced.

15.4(2)T

This command was replaced by the parameter-map type cws global command.

content-scan out

Enables content scanning on an egress interface.

15.4(2)T

This command was introduced. This command replaces the parameter-map type content-scan global command.

cws out

Enables Cloud Web Security content scanning on an egress interface.

parameter-map-name

Name of the inspect parameter map.

global

Defines a global inspect parameter map.

default

Defines a default inspect parameter map.

12.4(6)T

This command was introduced.

15.1(1)T

This command was modified. The keywords global and default were added.

15.1(2)T

This command was modified. Support for IPv6 was added.

Cisco IOS XE Release 3.4S

This command was integrated into Cisco IOS XE Release 3.4S.

alert {on | off}

Enables Cisco IOS stateful packet inspection alert messages.

audit-trail {on | off}

Enables and disables audit trail messages.

dns-timeout seconds

Specifies the Domain Name System (DNS) idle timeout.

gtp

Configures the inspection parameters for General Packet Radio Service (GPRS) Tunneling Protocol (GTP).

icmp idle-timeout seconds

Configures the timeout for Internet Control Message Protocol (ICMP) sessions.

max-incomplete {low | high} number-of-connections

Defines the number of existing half-open sessions that will cause the software to start and stop deleting half-open sessions.

one-minute {low | high} number-of-connections

Defines the rate of new half-open session initiation in one minute that will cause the system to start deleting half-open sessions and stop deleting half-open sessions.

tcp finwait-time seconds

Specifies how long a TCP session will be managed after the Cisco IOS firewall detects a FIN-exchange.

tcp idle-time seconds

Configures the timeout for TCP sessions.

tcp max-incomplete host threshold [block-time minutes}

Specifies threshold and blocking time values for TCP host-specific denial-of-service (DoS) detection and prevention.

tcp synwait-time seconds

Specifies how long the software will wait for a TCP session to reach the established state before dropping the session.

udp idle-time seconds

Configures the timeout of UDP sessions going through the firewall.

alert

Turns on Cisco IOS stateful packet inspection alert messages.

audit-trail

Turns audit trail messages on and off.

dns-timeout

Specifies the DNS idle timeout.

gtp

Configures the inspection parameters for GTP.

icmp idle-timeout

Configures the timeout for ICMP sessions.

inspect

Enables Cisco IOS stateful packet inspection.

max-incomplete

Defines the number of existing half-open sessions that will cause the software to start and stop deleting half-open sessions.

ipv6 routing-enforcement-header loose

Provides backward compatibility with the legacy IPv6 inspection.

one-minute

Defines the number of new unestablished sessions that will cause the system to start deleting half-open sessions and stop deleting half-open sessions.

tcp finwait-time

Specifies how long a TCP session will be managed after the Cisco IOS firewall detects a FIN exchange.

tcp idle-time

Configures the timeout for TCP sessions.

tcp max-incomplete host

Specifies the threshold and blocking time values for TCP host-specific DoS detection and prevention.

tcp synwait-time

Specifies how long the software will wait for a TCP session to reach the established state before dropping the session.

udp idle-time

Configures the timeout of UDP sessions going through the firewall.

gtp

(Optional) Specifies the General Packet Radio Service (GPRS) Tunneling Protocol (GTP).

Cisco IOS XE Release 3.5S

This command was introduced.

Cisco IOS XE Release 3.7S

This command was modified. The gtp keyword was added.

aggressive-aging

Enables aggressive aging of half-opened firewall sessions.

alert

Enables stateful packet inspection alert messages.

inspect

Enables stateful packet inspection.

log

Logs the firewall activity for an inspect parameter map.

max-incomplete

Configures the half-opened session limit for a VRF.

parameter-map type inspect global

Defines a global inspect-type parameter map.

show parameter-map type inspect-global

Displays global parameter map information.

tcp syn-flood limit

Configures a limit to the number of TCP half-opened sessions before triggering SYN cookie processing for new SYN packets.

vrf-pmap-name

Name of the parameter map.

Cisco IOS XE Release 3.3S

This command was introduced.

parameter-map type

Creates or modifies a parameter map.

show parameter-map type inspect-vrf

Displays information about the configured inspect VRF-type parameter maps.

zone-pmap-name

Name of the parameter map.

Cisco IOS XE Release 3.3S

This command was introduced.

parameter-map type

Creates or modifies a parameter map.

show parameter-map type inspect-zone

Displays information about the configured inspect zone-type parameter maps.

name

The name of the mitigation type parameter map.

12.4(6)T

This command was introduced.

12.4(15)XZ

This command was integrated into Cisco IOS Release 12.4(15)XZ.

acl drop

Configures an ACL drop enforcement action in a TMS Rules Engine configuration.

class-map type control mitigation

Configures a mitigation type class map.

ignore (TMS)

Configures the TMS Rules Engine to ignore a mitigation enforcement action.

match primitive

Configures a primitive match in a mitigation type class map.

match priority

Configures the match priority level for a mitigation enforcement action.

policy-map type control mitigation

Configures a mitigation type policy map.

redirect route

Configures a redirect enforcement action in a mitigation type policy map.

source parameter

Attaches a mitigation type parameter map to a policy-map class configuration.

tms-class

Associates an interface with an ACL drop enforcement action.

variable

Defines the next-hop variable in a mitigation type parameter map.

show parameter-map type ooo global

Displays OoO global parameter-map information.

tcp reassembly

Changes the default parameters for OoO queue processing of TCP sessions.

tcp reassembly memory limit

Specifies the limit of the OoO queue size for TCP sessions.

msrpc

(Optional) Defines a Microsoft Remote Procedure Call (MSRPC) protocol-info parameter map.

sip

(Optional) Defines a Session Initiation Protocol (SIP) protocol-info parameter map.

stun-ice

(Optional) Defines a Session Traversal Utilities for Network Address Translation (NAT) and Interactive Connectivity Establishment (STUN-ICE) protocol-info parameter map.

parameter-map-name

Name of the parameter map.

12.4(11)T

This command was introduced.

15.0(1)M

This command was modified. The sip keyword was added.

15.1(4)M

This command was modified. The msrpc keyword was added.

disable open-media-channel

Prevents the creation of RTP or RTCP media channels when a SIP class map is used for SIP inspection.

parameter-map type inspect

Configures an inspect type parameter map for connecting thresholds, timeouts, and other parameters pertaining to the inspect action.

parameter-map-name

Name of the parameter map. The name can have a maximum of 228 alphanumeric characters.

12.4(9)T

This command was introduced.

Cisco IOS XE Release 3.2S

This command was integrated into Cisco IOS XE Release 3.2S.

.

Dot

Matches any single character. For example, d.g matches dog, dag, dtg, and any word that contains those characters.

( xxx )

Subexpression

A subexpression segregates characters from surrounding characters so that you can use other metacharacters on the subexpression. For example, d(o|a)g matches dog and dag, but do|ag matches do and ag. A subexpression can also be used with repeat quantifiers to differentiate the characters meant for repetition. For example, ab(xy){3}z matches abxyxyxyz.

|

Alternation

Matches either of the expressions that it separates. For example, dog|cat matches dog or cat.

?

Question mark

A quantifier that indicates that there are 0 or 1 of the previous expression. For example, lo?se matches lse or lose.

*

Asterisk

A quantifier that indicates that there are 0, 1, or any number of the previous expression. For example, lo*se matches lse, lose, loose, and so on.

+

Plus

A quantifier that indicates that there is at least one occurrence of the previous expression. For example, lo+se matches lose and loose, but not lse.

{ x }

Repeat quantifier

Repeat exactly x times. For example, ab(xy){3}z matches abxyxyxyz.

{ x ,}

Minimum repeat quantifier

Repeat at least x times. For example, ab(xy){2,}z matches abxyxyz, abxyxyxyz, and so on.

[ abc ]

Character class

Matches any character in the bracket. For example, [abc] matches a, b, or c.

[^ abc ]

Negated character class

Matches a single character that is not contained within brackets. For example, [^abc] matches any character other than a, b, or c; and [^A-Z] matches any single character that is not an uppercase letter.

[ a - c ]

Character range class

Matches any character in the specified range. [a-z] matches any lowercase letter. You can mix characters and ranges; for example, [abcq-z] matches a, b, c, q, r, s, t, u, v, w, x, y, z, and so does [a-cq-z].

“ ”

Quotation marks

Preserves trailing or leading spaces in the string. For example, “test” preserves the leading space when it looks for a match.

^

Caret

Specifies the beginning of a line.

\

Escape character

When preceding a literal character, it matches the literal character. For example, \[matches the left square bracket.

char

Character

When the character is not a metacharacter, it matches the literal character.

\r

Carriage return

Matches a carriage return 0x0d.

\n

New line

Matches a new line 0x0a.

\t

Tab

Matches a tab 0x09.

\f

Formfeed

Matches a form feed 0x0c.

\x nn

Escaped hexadecimal number

Matches an ASCII character using hexadecimal numbers (exactly two digits).

\ nnn

Escaped octal number

Matches an ASCII character as an octal number (exactly three digits). For example, the character 040 represents a space.

class-map type inspect

Creates a Layer 3 and Layer 4 or a Layer 7 (application-specific) inspect-type class map.

class type inspect

Specifies the traffic (class) on which an action is to be performed.

match request regex

Configures an HTTP firewall policy to permit or deny HTTP traffic on the basis of request messages whose URI or arguments (parameters) match a defined regular expression.

parameter-map type

Creates or modifies a parameter map.

policy-map type inspect

Creates a Layer 3 and Layer 4 or a Layer 7 (application-specific) inspect-type policy map.

parameter-map-name

Name of the parameter map for the global parameters associated with the TRPS.

12.4(15)XZ

This command was introduced.

12.4(20)T

This command was integrated into Cisco IOS Release 12.4(20)T.

15.1(2)T

This command was modified. The pipeline, on, and offkeywords were added.

alert

Turns on or off URL-filtering system alert messages that are displayed on the console.

cache-entry lifetime

Specifies how long an entry remains in the cache table.

cache-size maximum-memory

Specifies the size of the categorization cache.

parameter-map type urlfpolicy

Specifies per-policy URL filtering parameters.

server

Specifies information about the TRPS.

parameter-map-name

Name of the URL parameter map.

12.4(6)T

This command was introduced.

12.4(15)XZ

This command was removed.

alert

Turns on or off URL-filtering system alert messages that are displayed on the console.

allow-mode

Turns on or off the default mode (allow mode) of the filtering algorithm.

audit-trail

Turns on or off the logging of URL information into the syslog server or router.

cache

Configures cache parameters.

exclusive-domain

Adds or removes a domain name to or from the exclusive domain list so that the Cisco IOS firewall does not have to send lookup requests to the vendor server.

max-request

Specifies the maximum number of outstanding requests that can exist at any given time.

max-resp-pak

Specifies the maximum number of HTTP responses that the Cisco IOS firewall can keep in its packet buffer.

server vendor

Specifies a vendor server for URL filtering.

local

Specifies that the parameters are for a local URL filtering policy.

trend

Specifies that the parameters are for a Trend Micro URL filtering policy.

n2h2

Specifies that the parameters are for a SmartFilter (previously N2H2) URL filtering policy.

websense

Specifies that the paramaters are for a Websense URL filtering policy.

parameter-map-name

The name of the parameter map for a URL filtering policy.

12.4(15)XZ

This command was introduced.

alert {on | off}

Turns on or off URL filtering alert messages that are displayed on the console. The default is off.

allow-mode {on | off}

Specifies whether to allow or block URL requests when the URL filtering process does not have connectivity to a URL filtering database. When allow-mode is on, all unmatched URL requests are allowed; when off, all unmatched URL requests are blocked. The default is off.

block-page {messagestring | redirect-urlurl }

Specifies the response to a blocked URL request.

• message string --Specifies the message text to be displayed when a URL request is blocked.

• redirect-url url --Specifies the URL of the web page to be displayed when a URL request is blocked.

exit

Exits from the parameter map.

no

Negates or sets default values for a command.

allow-mode {on | off}

Specifies whether to allow or block URL requests when the URL filtering process does not have connectivity to a URL filtering database. When allow-mode is on, all unmatched URL requests are allowed; when off, all unmatched URL requests are blocked. The default is off.

block-page {messagestring | redirect-urlurl }

Specifies the response to a blocked URL request.

• message string --Specifies the message text to be displayed when a URL request is blocked.

• redirect-url url --Specifies the URL of the web page to be displayed when a URL request is blocked.

exit

Exits from the parameter map.

max-request number-requests

Specifies the maximum number of pending requests. The range is from 1 to 2147483647. The default is 1000.

max-resp-pak number-responses

Specifies the number of HTTP responses that can be buffered. The range is from 0 and 20000. The default is 200.

no

Negates or sets default values for a command.

truncate hostname

Specifies that URLs be truncated at the end of the domain name.

alert {on | off}

Turns on or off URL filtering alert messages that are displayed on the console. The default is off.

allow-mode {on | off}

Specifies whether to allow or block URL requests when the URL filtering process does not have connectivity to a URL filtering database. When allow-mode is on, all unmatched URL requests are allowed; when off, all unmatched URL requests are blocked. The default is off.

block-page {messagestring | redirect-urlurl }

Specifies the response to a blocked URL request.

• message string --Specifies the message text to be displayed when a URL request is blocked.

• redirect-url url --Specifies the URL of the web page to be displayed when a URL request is blocked.

cache-entry-lifetime hours

Specifies how long, in hours, an entry remains in the cache table. The default is 24.

cache-size maximum-entries number-entries

Specifies the maximum number of entries that can be stored in the categorization cache. The default is 5000.

exit

Exits from the parameter map.

max-request number-requests

Specifies the maximum number of pending requests. The range is from 1 to 2147483647. The default is 1000.

max-resp-pak number-responses

Specifies the number of HTTP responses that can be buffered. The range is from 0 and 20000. The default is 200.

no

Negates or sets default values for a command.

server {server-name | ip-address} [source-interface interface-name][outside] [port port-number] [retrans retransmission-count] [timeout seconds]

Specifies the parameters for the URL filtering server.

• server {server-name | ip-address}

Specifies the domain name or the IP address of the URL filtering server.

• [source-interface interface-name]

Specifies the interface whose IP address will be used as the source IP address when a TCP connection is established between the system and the URL filtering server.

• outside

Specifies whether the URL filtering server is outside the network.

• port port-number

Specifies the port that is listening for requests. The range is from 1 to 65535. The default is 80.

• retrans retransmission-count

Specifies the number of times the Cisco IOS firewall retransmits the lookup request when a response is not received from the Trend Router Provisioning Server (TRPS). The range is from 1 to 5. The default is 3.

• timeout seconds

Specifies the number of seconds that the Cisco IOS firewall waits for a response from the TRPS. The range is from 1 to 300. The default is 60.

truncate {hostname | script-options}

Specifies that URLs be truncated.

• hostname

Specifies that URLs be truncated at the end of the domain name.

• script-options

Specifies that URLs be truncated at the left-most question mark in the URL.

urlf-server-log {on | off}

Enables sending information about HTTP requests to the URL filtering server’s log server. The information includes the URL, the hostname, the source IP address, and the destination IP address.

parameter-type trend-global

Specifies the global parameters associated with Trend Micro URL filtering policies.

parameter-map-name

Name of the parameter map for a local URL filtering policy.

12.4(15)XZ

This command was introduced.

12.4(20)T

This command was integrated into Cisco IOS Release 12.4(20)T.

*

Asterisk--matches any sequence of 0 or more characters.

[ abc ]

Character class--matches any character in the brackets. The character matching is case sensitive. For example, [abc] matches a, b, or c.

[ a - c ]

Character range class. Matches any character in the range. The character matching is case sensitive. [a-z] matches any lowercase letter. You can mix characters and ranges; for example, [abcq-z] matches a, b, c, q, r, s, t, u, v, w, x, y, z, and so does [a-cq-z].

[0-9]

Numerical range class. Matches any number in the brackets. For example [0-9] matches 0, 1, 2, 3, 4, 5, 6, 7, 8, or 9.

class-map type urlfilter

Creates a class map that specifies the traffic to which a URL filtering policy applies.

pattern (parameter-map)

Configures a matching pattern that specifies a list of domains, URL keywords, or URL metacharacters that should be allowed or blocked by local URL filtering.

view-name

View name, which can include 1 to 30 alphanumeric characters.

The view-name argument must not have a number as the first character; otherwise, you will receive the following error message: “Invalid view name.”

inclusive

(Optional) Specifies that all commands are included by default.

12.3(7)T

This command was introduced.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

Cisco IOS XE Release 2.1

This command was integrated into Cisco IOS XE Release 2.1.

12.2(33)SXI

This command was integrated into Cisco IOS Release 12.2(33)SXI.

15.4(1)T

This command was integrated into Cisco IOS Release 15.4(1)T.

15.4(1)S

This command was integrated into Cisco IOS Release 15.4(1)S.

Cisco IOS XE Release 3.11S

This command was integrated into Cisco IOS XE Release 3.11S.

commands (view)

Adds commands to a CLI view.

secret 5

Associates a CLI view or a superview with a password.

superview-name

Superview name, which can include 1 to 30 alphanumeric characters.

The superview-name argument must not have a number as the first character.

12.3(11)T

This command was introduced.

12.2(33)SRB

This command was integrated into Cisco IOS Release 12.2(33)SRB.

Cisco IOS XE Release 2.1

This command was integrated into Cisco IOS XE Release 2.1.

12.2(33)SXI

This command was integrated into Cisco IOS Release 12.2(33)SXI.

parser view

Creates or changes a CLI view and enters view configuration mode.

secret 5

Associates a CLI view or a superview with a password.

view

Adds a normal CLI view to a superview.

log

(Optional) Logs the packets passed by the firewall pass policy.

12.4(6)T

This command was introduced.

Cisco IOS-XE 2.4

This command was integrated into Cisco IOS-XE Release 2.4. The log keyword was added.

class type inspect

Specifies the traffic (class) on which an action is to be performed.

parameter-map type inspect

Configures an inspect parameter map for connecting thresholds, timeouts, and other parameters pertaining to the inspect action.

policy-map type inspect

Creates a Layer 3 or Layer 4 inspect type policy map.

log (parameter-map type)

Logs the firewall activity for an inspect parameter map.

12.4(22)T

This command was introduced.

Cisco IOS XE Release 2.3

This command was implemented on the Cisco ASR 1000 series routers.

crypto gdoi gm

Changes the IPsec SA status of group members.

Cisco IOS XE Release 3.2SE

This command was introduced in a release earlier than Cisco IOS XE Release 3.2SE.

15.2(2)E

This command was modified. In Cisco IOS Release 15.2(2)E and later releases, you have to configure either the passwd key random command or the passwd key obfuscate command after using the passwd encryption on command.

passwd key

Manages password keys.

Cisco IOS XE Release 3.2SE

This command was introduced in a release earlier than Cisco IOS XE Release 3.2SE.

passwd encryption

Enables or disables global AES encryption.

string

Name of the password.

12.2(8)T

This command was introduced.

12.4(24)T

Support for IPv6 Secure Neighbor Discovery (SeND) was added.

crypto ca trustpoint

Declares the CA that your router should use.

0

(Optional) Specifies that an unencrypted password follows.

6

(Optional) Specifies that an advanced encryption scheme (AES) encrypted password follows.

7

(Optional) Specifies that a hidden password follows.

password

The unencrypted (clear text) shared password.

15.4(1)T

This command was introduced.

aaa authorization cache filterserver

Enables AAA authorization caches and the downloading of ACL configurations from a RADIUS filter server.

aaa cache filterserver

Enables AAA filter server definitions.

aaa new-model

Enables the AAA access control model.

0

(Optional) A plain text password will follow. The default is 0.

7

(Optional) An encrypted password will follow. The default is 0.

password

The password.

12.4(6)T

This command was introduced.

dot1x credentials

Specifies the 802.1X credentials profile to be used.

password

Character string that specifies the line password. The first character cannot be a number. The string can contain any alphanumeric characters, including spaces, up to 80 characters. You cannot specify the password in the format number-space-anything. The space after the number causes problems. For example, hello 21 is a legal password, but 21 hello is not. The password checking is case sensitive. For example, the password Secret is different than the password secret.

10.0

This command was introduced.

12.2(33)SRA

This command was integrated into Cisco IOS release 12.(33)SRA.

12.2SX

This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

enable password

Sets a local password to control access to various privilege levels.

password

Password for users to enter the CLI view or superview. A password can contain any combination of alphanumeric characters.

12.3(7)T

This command was introduced.

12.3(11)T

This command was enhanced to support superviews.

12.3(14)T

This command was replaced by the secret command.

parser view

Creates or changes a CLI view and enters view configuration mode.

12.3(2)T

This command was introduced.

12.2(18)SXD

This command was integrated into Cisco IOS Release 12.2(18)SXD.

12.2(33)SRA

This command was integrated into Cisco IOS release 12.(33)SRA.

key config-key password-encryption

Stores a type 6 encryption key in private NVRAM.

password logging

Provides a log of debugging output for a type 6 password operation.

12.3(2)T

This command was introduced.

12.2(18)SXD

This command was integrated into Cisco IOS Release 12.2(18)SXD.

12.2(33)SRA

This command was integrated into Cisco IOS release 12.(33)SRA.

key config-key password-encryption

Stores an encryption key in private NVRAM.

password encryption aes

Enables a type 6 encrypted preshared key.

expression

Matching pattern argument that refers to a domain name, URL keyword, URL metacharacter entry, or a URL keyword and URL metacharacter combination.

12.4(15)XZ

This command was introduced.

12.4(20)T

This command was integrated into Cisco IOS Release 12.4(20)T.

Cisco IOS XE Release 3.2S

This command was integrated into Cisco IOS XE Release 3.2S.

*

Asterisk—matches any sequence of 0 or more characters.

[ abc ]

Character class—matches any character within brackets. The character matching is case sensitive. For example, [abc] matches a, b, or c.

[ a-c ]

Character range class—matches any character in a specified range. The character matching is case sensitive. For example, [a-z] matches any lowercase letter. You can also mix characters and ranges; for example, [abcq-z] matches a, b, c, q, r, s, t, u, v, w, x, y, z, and so does [a-cq-z].

[0-9]

Numerical range class—matches any number within brackets. For example, [0-9] matches 0, 1, 2, 3, 4, 5, 6, 7, 8, or 9.

class-map type urlfilter

Creates a class map that specifies the traffic to which a URL filtering policy applies.

parameter-map type regex

Configures a regex parameter map that matches a specific regular expression pattern and enters parameter-map type inspect configuration mode.

parameter-map type urlf-glob

Creates or modifies a parameter map that specifies a list of domains, URL keywords, or URL metacharacters that should be allowed or blocked by local URL filtering and enters parameter-map type inspect configuration mode.

sequence

Sequence number of the peer.

ipv4-address

IPv4 address of the peer.

ipv6-address

IPv6 address of the peer.

fqdn fqdn-name

Assigns a fully qualified domain name (FQDN) to the peer.

dynamic

(Optional) Dynamically resolves the peer when it is chosen to connect.

ipv6

(Optional) Resolves the peer using the IPv6 address hostname.

track track-number

(Optional) Tracks the peer with the track number specified in the IKEv2 FlexVPN client profile.

up

(Optional) Implies that connection with the peer will be established only if track is in the up state.

down

(Optional) Implies that connection with the peer will be established only if track is in the down state.

15.2(1)T

This command was introduced.

15.2(3)T

This command was modified. Support for IPv6 addresses and hostnames was added.

Cisco IOS XE Release 3.7S

This command was integrated into Cisco IOS XE Release 3.7S.

crypto ikev2 client flexvpn

Defines an IKEv2 FlexVPN client profile.

ip-address

IP address of the peer key server.

12.4(11)T

This command was introduced.

Cisco IOS XE Release 2.3

This command was implemented on the Cisco ASR 1000 series routers.

address ipv4

Sets the source address, which is used as the source for packets originated by the local key server.

local priority

Sets the local key server priority.

redundancy

Enters GDOI redundancy configuration mode and allows for key server redundancy.

server local

Designates a device as a GDOI key server and enters GDOI local server configuration mode.

name

The peer name.

15.1(1)T

This command was introduced.

Cisco IOS XE Release 3.3S

This command was integrated into Cisco IOS XE Release 3.3S.

15.2(4)S

This command was integrated into Cisco IOS Release 15.2(4)S.

address (ikev2 keyring)

Specifies the IPv4 address or the range of the peers in IKEv2 keyring.

crypto ikev2 keyring

Defines an IKEv2 keyring.

description (ikev2 keyring)

Describes an IKEv2 peer or a peer group for the IKEv2 keyring.

hostname (ikev2 keyring)

Specifies the hostname for the peer in the IKEv2 keyring.

identity (ikev2 keyring)

Identifies the peer with IKEv2 types of identity.

pre-shared-key (ikev2 keyring)

Defines a preshared key for the IKEv2 peer.

15.2(1)T

This command was introduced.

Cisco IOS XE Release 3.7S

This command was integrated into Cisco IOS XE Release 3.7S.

crypto ikev2 client flexvpn

Defines an IKEv2 FlexVPN client profile.

high

Specifies the high watermark for aggressive aging.

value

High watermark in absolute values. Valid values are from 1 to 4294967295.

low

Specifies the low watermark values for aggressive aging.

value

Low watermark in absolute values. Valid values are from 1 to 4294967295.

percent percent

Specifies the high watermark percentage for aggressive aging. Valid values are from 1 to 100.

low percent percent

Specifies the low watermark percentage for aggressive aging. Valid values are from 1 to 100.

Cisco IOS XE Release 3.4S

This command was introduced.

max-incomplete aggressive-aging

Configures the aggressive aging of half-opened firewall sessions for inspect parameter maps.

parameter-map type inspect global

Configures a global parameter map and enters parameter-map type inspect configuration mode.

icmp

(Optional) Specifies the maximum half-opened Internet Control Message Protocol (ICMP) connections for the firewall session table.

tcp

(Optional) Specifies the maximum half-opened TCP connections for the firewall session table.

udp

(Optional) Specifies the maximum half-opened UDP connections for the firewall session table.

number

Number of half-opened sessions. Valid values are from 1 to 4294967295.

Cisco IOS XE Release 3.4S

This command was introduced.

max-incomplete (inspect-vrf)

Configures the half-opened session limit for a VRF.

parameter-map type inspect global

Configures a global parameter map and enters parameter-map type inspect configuration mode.

number

Number of half-opened sessions. Valid values are from 1 to 4294967295.

high

Specifies the high watermark for aggressive aging.

value

High watermark in absolute values. Valid values are from 1 to 4294967295.

low

Specifies the low watermark values for aggressive aging.

value

Low watermark in absolute values. Valid values are from 1 to 4294967295.

percent percent

Specifies the high watermark percentage for aggressive aging. Valid values are from 1 to 100.

low percent percent

Specifies the low watermark percentage for aggressive aging. Valid values are from 1 to 100.

Cisco IOS XE Release 3.4S

This command was introduced.

max-incomplete aggressive-aging

Configures aggressive aging of half-opened firewall sessions for inspect parameter maps.

parameter-map type inspect global

Configures a global parameter map and enters parameter-map type inspect configuration mode.

number

The number of half-opened connections that triggers TCP SYN cookie protection. Valid values are from 1 to 4294967295.

Cisco IOS XE Release 3.4S

This command was introduced.

parameter-map type inspect global

Configures a global parameter map and enters parameter-map type inspect configuration mode.

protocol

Name or number of a protocol; valid values are; valid values are ahp, eigrp, esp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, object-group, tcp, pcp, pim, udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including Internet Control Message Protocol (ICMP), TCP, and User Datagram Protocol (UDP), use the keyword ip. See the “Usage Guidelines” section for additional qualifiers.

source-addr

(Optional) Number of the network or host from which the packet is being sent in a 32-bit quantity in four-part, dotted-decimal format.

source-wildcard

(Optional) Wildcard bits to be applied to the source in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

any

Specifies any source or any destination host as an abbreviation for the source-addror destination-addr valueand the source-wildcard or destination-wildcard value of 0.0.0.0 255.255.255.255.

host address name

Specifies the source or destination address and name of a single host.

object-group object-group-name

Specifies the source or destination name of the object group.

destination-addr

Number of the network or host to which the packet is being sent in a 32-bit quantity in four-part, dotted-decimal format.

destination-wildcard

Wildcard bits to be applied to the destination in a 32-bit quantity in four-part, dotted-decimal format. Place ones in the bit positions you want to ignore.

object-group dest-addr-group-name

Specifies the destination address group name.

dscp dscp-value

(Optional) Matches the packets with the given Differentiated Services Code Point (DSCP) value; see the “Usage Guidelines” section for valid values.

precedence precedence-value

(Optional) Specifies the precedence filtering level for packets; valid values are a number from 0 to 7 or by a name. See the “Usage Guidelines” section for a list of valid names.

fragments fragment-value

(Optional) Applies the access list entry to noninitial fragments of packets; the fragment is either permitted or denied accordingly. For more details about the fragments keyword, see the "Access List or OGACL Processing of Fragments" and “Fragments and Policy Routing” sections in the “Usage Guidelines” section.

option option-value

(Optional) Matches the packets with the given IP options value number; see the “Usage Guidelines” section for valid values.

reflect access-list-name

(Optional) Create reflexive access list entry.

time-range time-range-value

(Optional) Specifies a time-range entry name.

ttl match-value ttl-value

(Optional) Specifies the match packets with given TTL value; see the “Usage Guidelines” section for valid values.

tos tos-value

(Optional) Specifies the service filtering level for packets; valid values are a number from 0 to 15 or by a name as listed in the “Usage Guidelines” section of the access-list(IP extended) command.

timeout max-time

Specifies the maximum time for a reflexive ACL to live; the valid values are from 1 to 2147483 seconds.

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message for a standard list includes the access list number, whether the packet was permitted or denied, the source address, and the number of packets.

The message for an extended list includes the access list number; whether the packet was permitted or denied; the protocol; whether the protocol was TCP, UDP, ICMP, or a number; and, if appropriate, the source and destination addresses and port numbers and the user-defined cookie or router-generated hash value.

For both standard and extended lists, the message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

The logging facility might drop some logging message packets if there are too many to be handled or if there is more than one logging message to be handled in 1 second. This behavior prevents the router from reloading because of too many logging packets. Therefore, the logging facility should not be used as a billing tool or an accurate source of the number of matches to an access list.

After you specify the log keyword (and the associated word argument), you cannot specify any other keywords or settings for this command.

log-value

(Optional) User-defined cookie appended to the log message. The cookie:

• cannot be more than characters

• cannot start with hexadecimal notation (such as 0x)

• cannot be the same as, or a subset of, the following keywords: reflect, fragment, time-range

• must contain alphanumeric characters only