Table Of Contents
C Commands
ca
Configure the PIX Firewall to interoperate with a certification authority (CA).
ca authenticate ca_nickname [fingerprint]
[no] ca configure ca_nickname ca | ra retry_period retry_count [crloptional]
[no] ca crl request ca_nickname
[no] ca enroll ca_nickname challenge_password [serial] [ipaddress]
ca generate rsa {key | specialkey} key_modulus_size
[no] ca identity ca_nickname [ca_ipaddress| hostname [:ca_script_location] [ldap_ip address| hostname]]
[no] ca save all
[no] ca subject-name ca_nickname X.500_string
[no] ca verifycertdn X.500_string
ca zeroize rsa [keypair_name]
show ca certificate
show ca crl
show ca configure
show ca identity
show ca mypubkey rsa
show ca subject-name
show ca verifycertdn
Syntax Description
Defaults
The retry_count default is 0.
Command Modes
Configuration mode.
Usage Guidelines
The sections that follow describe each ca command.
The PIX Firewall currently supports the CA servers from VeriSign, Entrust, Baltimore Technologies, and Microsoft. Refer to the Cisco PIX Firewall and VPN Configuration Guide for a list of specific CA server versions the PIX Firewall supports.
The lifetime of a certificate and the certificate revocation list (CRL) is checked in UTC, which is the same as GMT. Set the PIX Firewall clock to UTC to ensure that CRL checking works correctly. Use the clock command to set the PIX Firewall clock.
The PIX Firewall authenticates the entity certificate (the device certificate). The PIX Firewall assumes the entity certificate is issued by the same trusted point or root (the CA server). As a result, they should have the same root certificate (issuer certificate). Therefore, the PIX Firewall assumes the entity exchanges the entity certificate only, and cannot process a certificate chain that includes both the entity and root certificates.
ca authenticate
The ca authenticate command allows the PIX Firewall to authenticate its certification authority (CA) by obtaining the CA's self-signed certificate, which contains the CA's public key.
To authenticate a peer's certificate(s), a PIX Firewall must obtain the CA certificate containing the CA public key. Because the CA certificate is a self-signed certificate, the key should be authenticated manually by contacting the CA administrator. You are given the choice of authenticating the public key in that certificate by including within the ca authenticate command the key's fingerprint, which is retrieved in an out-of-band process. The PIX Firewall will discard the received CA certificate and generate an error message, if the fingerprint you specified is different from the received one. You can also simply compare the two fingerprints without having to enter the key within the command.
If you are using RA mode (within the ca configure command), when you issue the ca authenticate command, the RA signing and encryption certificates will be returned from the CA, as well as the CA certificate.
The ca authenticate command is not saved to the PIX Firewall configuration. However, the public keys embedded in the received CA (and RA) certificates are saved in the configuration as part of the RSA public key record (called the "RSA public key chain"). To save the public keys permanently to Flash memory, use the ca save all command. To view the CA's certificate, use the show ca certificate command.
Note
If the CA does not respond by a timeout period after this command is issued, the terminal control will be returned so it will not be tied up. If this happens, you must re-enter the command.
ca configure
The ca configure command is used to specify the communication parameters between the PIX Firewall and the CA.
Use the no ca configure command to reset each of the communication parameters to the default value. If you want to show the current settings stored in RAM, use the show ca configure command.
The following example indicates that myca is the name of the CA and the CA will be contacted rather than the RA. It also indicates that the PIX Firewall will wait 5 minutes before sending another certificate request, if it does not receive a response, and will resend a total of 15 times before dropping its request. If the CRL is not accessible, crloptional tells the PIX Firewall to accept other peer's certificates.
ca configure myca ca 5 15 crloptionalca crl request
The ca crl request command allows the PIX Firewall to obtain an updated CRL from the CA at any time. The no ca crl command deletes the CRL within the PIX Firewall.
A CRL lists all the network's devices' certificates that have been revoked. The PIX Firewall will not accept revoked certificates; therefore, any peer with a revoked certificate cannot exchange IPSec traffic with your PIX Firewall.
The first time your PIX Firewall receives a certificate from a peer, it will download a CRL from the CA. Your PIX Firewall then checks the CRL to make sure the peer's certificate has not been revoked. (If the certificate appears on the CRL, it will not accept the certificate and will not authenticate the peer.)
A CRL can be reused with subsequent certificates until the CRL expires. When the CRL does expire, the PIX Firewall automatically updates it by downloading a new CRL and replaces the expired CRL with the new CRL.
If your PIX Firewall has a CRL which has not yet expired, but you suspect that the CRL's contents are out of date, use the ca crl request command to request that the latest CRL be immediately downloaded to replace the old CRL.
The ca crl request command is not saved with the PIX Firewall configuration between reloads.
The following example indicates the PIX Firewall will obtain an updated CRL from the CA with the name myca:
ca crl request mycaThe show ca crl command lets you know whether there is a CRL in RAM, and where and when the CRL is downloaded.
The following is sample output from the show ca crl command. See Table 4-2 for descriptions of the strings within the following sample output.
show ca crlCRL:CRL Issuer Name:CN = MSCA, OU = Cisco, O = VSEC, L = San Jose, ST = CA, C = US, EA=<16> username@example.comLastUpdate:17:07:40 Jul 11 2000NextUpdate:05:27:40 Jul 19 2000ca enroll
The ca enroll command is used to send an enrollment request to the CA requesting a certificate for all of your PIX Firewall unit's key pairs. This is also known as "enrolling" with the CA. (Technically, enrolling and obtaining certificates are two separate events, but they both occur when this command is issued.)
Your PIX Firewall needs a signed certificate from the CA for each of its RSA key pairs; if you previously generated general purpose keys, the ca enroll command will obtain one certificate corresponding to the one general purpose RSA key pair. If you previously generated special usage keys, this command will obtain two certificates corresponding to each of the special usage RSA key pairs.
If you already have a certificate for your keys, you will be unable to complete this command; instead, you will be prompted to remove the existing certificate first.
The ca enroll command is not saved with the PIX Firewall configuration between reloads. To verify if the enrollment process succeeded and to display the PIX Firewall unit's certificate, use the show ca certificate command. If you want to cancel the current enrollment request, use the no ca enroll command.
The required challenge password is necessary in the event that you need to revoke your PIX Firewall unit's certificate(s). When you ask the CA administrator to revoke your certificate, you must supply this challenge password as a protection against fraudulent or mistaken revocation requests.
Note
If you lose the password, the CA administrator may still be able to revoke the PIX Firewall's certificate, but will require further manual authentication of the PIX Firewall administrator identity.
The PIX Firewall unit's serial number is optional. If you provide the serial option, the serial number will be included in the obtained certificate. The serial number is not used by IPSec or IKE but may be used by the CA to either authenticate certificates or to later associate a certificate with a particular device. Ask your CA administrator if serial numbers should be included in the certificate. If you are in doubt, specify the serial option.
The PIX Firewall unit's IP address is optional. If you provide the ipaddress option, the IP address will be included in the obtained certificate. Normally, you would not include the ipaddress option because the IP address binds the certificate more tightly to a specific entity. Also, if the PIX Firewall is moved, you would need to issue a new certificate.
Note
The following example indicates that the PIX Firewall will send an enrollment request to the CA myca.example.com. The password 1234567890 is specified, as well as a request for the PIX Firewall unit's serial number to be embedded in the certificate.
ca enroll myca.example.com 1234567890 serialca generate rsa
The ca generate rsa command generates RSA key pairs for your PIX Firewall. RSA keys are generated in pairs—one public RSA key and one private RSA key. If your PIX Firewall already has RSA keys when you issue this command, you will be warned and prompted to replace the existing keys with new keys.
Note
The ca generate rsa command is not saved in the PIX Firewall configuration. However, the keys generated by this command are saved in the persistent data file in Flash memory, which is never displayed to the user or backed up to another device.
In this example, one general-purpose RSA key pair is to be generated. The selected size of the key modulus is 2048.
ca generate rsa key 2048
Note
ca identity
The ca identity command declares the CA that your PIX Firewall will use. Currently, PIX Firewall supports one CA at one time. The no ca identity command removes the ca identity command from the configuration and deletes all certificates issued by the specified CA and CRLs. The show ca identity command shows the current settings stored in RAM.
The PIX Firewall uses a subset of the HTTP protocol to contact the CA, and so must identify a particular cgi-bin script to handle CA requests. The default location and script on the CA server is /cgi-bin/pkiclient.exe. If the CA administrator has not put the CGI script in the previously listed location, include the location and the name of the script within the ca identity command statement.
By default, querying of a certificate or a CRL is done via Cisco's PKI protocol. If the CA supports Lightweight Directory Access Protocol (LDAP), query functions may use LDAP as well. The IP address of the LDAP server must be included within the ca identity command statement.
The following example indicates that the CA myca.example.com is declared as the PIX Firewall unit's supported CA. The CA's IP address of 205.139.94.231 is provided.
ca identity myca.example.com 205.139.94.231ca save all
The ca save all commands lets you save the PIX Firewall unit's RSA key pairs, the CA, RA and PIX Firewall unit's certificates, and the CA's CRLs in the persistent data file in Flash memory between reloads. The no ca save command removes the saved data from PIX Firewall unit's Flash memory.
The ca save command itself is not saved with the PIX Firewall configuration between reloads.
To view the current status of requested certificates, and relevant information of received certificates, such as CA and RA certificates, use the show ca certificate command. Because the certificates contain no sensitive data, any user can issue this show command.
ca subject-name ca_nickname X.500_string
The ca subject-name ca_nickname X.500_string command is a certificate enrollment enhancement that supports X.500 directory names.
When the ca subject-name ca_nickname X.500_string command is configured, the firewall enrolls the device certificate with the subject Distinguished Name (DN) that is specified in the X.500_string, using RFC 1779 format. The supported DN attributes are listed in Table 4-1
For more information on RFC 1779, refer to http://www.ietf.org/rfc/rfc1779.txt.
PIX Firewall software Version 6.3 supports X.509 (certificate support) on the VPN client. Cisco IOS software, the VPN 3000 concentrator, and the PIX Firewall look for the correct VPN group (mode config group) according to the ou attribute. (The ou attribute is part of the subject DN of the device certificate when the Easy VPN client negotiates the RSA signature.) For example,
ca subject-name myca ou=my_department, o=my_org, st=CA, c=USwhere my_department is the VPN group.
Note
ca verifycertdn X.500_string
The ca verifycertdn X.500_string command verifies the certificate's Distinguished Name (DN) and acts as a subject name filter, based on the X.500_string. If the subject name of the peer certificate matches the X.500_string, then it is filtered out and ISAKMP negotiation fails.
ca zeroize rsa
The ca zeroize rsa command deletes all RSA keys that were previously generated by your PIX Firewall. If you issue this command, you must also perform two additional tasks. Perform these tasks in the following order:
1.
2.
To delete a specific RSA key pair, specify the name of the RSA key you want to delete using the option keypair_name within the ca zeroize rsa command statement.
Note
show ca commands
The show ca certificate command displays the CA Server's subject name, CRL distribution point (where the PIX Firewall will obtain the CRL), and lifetime of both the CA server's root certificate and the PIX Firewall's certificates.
The following is sample output from the show ca certificate command. The CA certificate stems from a Microsoft CA server previously generated for this PIX Firewall.
show ca certificateRA Signature CertificateStatus:AvailableCertificate Serial Number:6106e08a000000000005Key Usage:SignatureCN = SCEPOU = VSECO = CiscoL = San JoseST = CAC = USEA =<16> username@example.comValidity Date:start date:17:17:09 Jul 11 2000end date:17:27:09 Jul 11 2001CertificateStatus:AvailableCertificate Serial Number:1f80655400000000000aKey Usage:General PurposeSubject NameName:pixfirewall.example.comValidity Date:start date:20:06:23 Jul 17 2000end date:20:16:23 Jul 17 2001CA CertificateStatus:AvailableCertificate Serial Number:25b81813efe58fb34726eec44ae82365Key Usage:SignatureCN = MSCAOU = CiscoO = VSECL = San JoseST = CAC = USEA =<16> username@example.comValidity Date:start date:17:07:34 Jul 11 2000RA KeyEncipher CertificateStatus:AvailableCertificate Serial Number:6106e24c000000000006Key Usage:EncryptionCN = SCEPOU = VSECO = CiscoL = San JoseST = CAC = USEA =<16> username@example.comValidity Date:start date:17:17:10 Jul 11 2000end date:17:27:10 Jul 11 01Table 4-2 describes strings within the show ca certificate command sample output.
The show ca crl command displays whether there is a certificate revocation list (CRL) in the PIX Firewall RAM, and where and when the CRL downloaded.
The show ca configure command displays the current communication parameter settings stored in the PIX Firewall RAM.
The show ca identity command displays the the current certification authority (CA) settings stored in RAM.
The show ca mypubkey rsa command displays the PIX Firewall unit's public keys in a DER/BER encoded PKCS#1 representation.
The following is sample output from the show ca mypubkey rsa command. Special usage RSA keys were previously generated for this PIX Firewall using the ca generate rsa command.
show ca mypubkey rsa% Key pair was generated at: 15:34:55 Aug 05 1999Key name: pixfirewall.example.comUsage: Signature KeyKey Data:305c300d 06092a86 4886f70d 01010105 00034b00 30480241 00c31f4a ad32f60d6e7ed9a2 32883ca9 319a4b30 e7470888 87732e83 c909fb17 fb5cae70 3de738cf6e2fd12c 5b3ffa98 8c5adc59 1ec84d78 90bdb53f 2218cfe7 3f020301 0001% Key pair was generated at: 15:34:55 Aug 05 1999Key name: pixfirewall.example.comUsage: Encryption KeyKey Data:305c300d 06092a86 4886f70d 01010105 00034b00 30480241 00d8a6ac cc64e57a48dfb2c1 234661c7 76380bd5 72ae62f7 1706bdab 0eedd0b5 2e5feef0 76319d98908f50b4 85a291de 247b6711 59b30026 453bfa3c 45234991 5d020301 0001Examples
In the following example, a request for the CA's certificate was sent to the CA. The fingerprint was not included in the command. The CA sends its certificate and the PIX Firewall prompts for verification of the CA's certificate by checking the CA certificate's fingerprint. Using the fingerprint associated with the CA's certificate retrieved in some out-of-band process from a CA administrator, compare the two fingerprints. If both fingerprints match, then the certificate is considered valid.
ca authenticate mycaCertificate has the following attributes:Fingerprint: 0123 4567 89AB CDEF 0123The following example shows the error message. This time, the fingerprint is included in the command. The two fingerprints do not match, and therefore the certificate is not valid.
ca authenticate myca 0123456789ABCDEF0123Certificate has the following attributes:Fingerprint: 0123 4567 89AB CDEF 5432%Error in verifying the received fingerprint. Type help or `?' for a list of available commands.ca generate rsa key
The ca generate rsa command generates RSA key pairs for your PIX Firewall. RSA keys are generated in pairs—one public RSA key and one private RSA key.
ca generate rsa key modulus
Syntax Description
Note
Defaults
RSA key modulus default (during PDM setup) is 768. The default domain is ciscopix.com.
Command Modes
Configuration mode.
Usage Guidelines
If your PIX Firewall already has RSA keys when you issue this command, you are warned and prompted to replace the existing keys with new keys.
Note
PDM uses the Secure Sockets Layer (SSL) communications protocol to communicate with the PIX Firewall.
SSL uses the private key generated with the ca generate rsa command. For a certificate, SSL uses the key obtained from a certification authority (CA). If that does not exist, it uses the PIX Firewall self-signed certificate created when the RSA key pair was generated.
If there is no RSA key pair when an SSL session is initiated, the PIX Firewall creates a default RSA key pair using a key modulus of 768.
The ca generate rsa command is not saved in the PIX Firewall configuration. However, the keys generated by this command are saved in a persistent data file in Flash memory, which can be viewed with the show ca my rsa key command.
Examples
The following example demonstrates how one general purpose RSA key pair is generated. The selected size of the key modulus is 1024.
router(config) ca generate rsa key 1024Key name:pixfirewall.cisco.comUsage:General Purpose KeyKey Data:30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c8ed4c9f5e0b52 aea931df 04db2872 5c4c0afd 9bd0920b 5e30de82 63d834ac f2e1db1f1047481a 17be5a01 851835f6 18af8e22 45304d53 12584b9c 2f48fad5 31e1be5abb2ddc46 2841b63b f92cb3f9 8de7cb01 d7ea4057 7bb44b4c a64a9cf0 efaacd42e291e4ea 67efbf6c 90348b75 320d7fd3 c573037a ddb2dde8 00df782c 39020301 0001capture
Enables packet capture capabilities for packet sniffing and network fault isolation.
capture capture_name [access-list acl_name][buffer bytes] [ethernet-type type][interface name] [packet-length bytes] [circular-buffer]
no capture capture_name [access-list [acl_name]] [interface name] [circular-buffer]
clear capture capture_name
show capture [capture_name] [access-list acl_name] [detail] [dump]
Syntax Description
Defaults
The default type is 0.
Command Modes
Configuration mode.
Usage Guidelines
To enable packet capturing, attach the capture to an interface with the interface option. Multiple interface statements attach the capture to multiple interfaces.
If the buffer contents are copied to a TFTP server in ASCII format, then only the headers can be seen. The details and hex dump of the packets can not be seen. To see the details and hex dump, transfer the buffer in PCAP format and then read with TCPDUMP or Ethereal using the options to show the detail and hex dump of the packets.
The ethernet-type and access-list options select the packets to store in the buffer. A packet must pass both the Ethernet and access list filters before the packet is stored in the capture buffer.
The capture capture_name circular-buffer command enables the capture buffer to overwrite itself, starting from the beginning, when the capture buffer is full.
Enter the no capture command with either the access-list or interface option unless you want to clear the capture itself. Entering no capture without options deletes the capture. If the access-list option is specified, the access list is removed from the capture and the capture is preserved. If the interface option is specified, the capture is detached from the specified interface and the capture is preserved.
To clear the capture buffer, use the clear capture capture_name command. The short form of clear capture is not supported to prevent accidental destruction of all packet captures.
Note
Use the copy capture: capture_name tftp://location/path [pcap] command to copy capture information to a remote TFTP server.
Use the https://pix-ip-address/capture/capture_name[/pcap] command to view the packet capture information with a web browser.
If the pcap option is specified, then a libpcap-format file is downloaded to your web browser and can be saved using your web browser. (A libcap file can be viewed with Tcpdump or Ethereal.)
The show capture command displays the capture configuration when no options are specified. If the capture_name is specified, then it displays the capture buffer contents for that capture.
Output Formats
The decoded output of the packets are dependent on the protocol of the packet. In Table 4-3, the bracketed output is displayed when the detail option is specified.
Examples
On a web browser, the capture contents for a capture named "mycapture" can be viewed at the following location:
https://209.165.200.232/capture/mycapture/pcapTo download a libpcap file (used in web browsers such as Internet Explorer or Netscape Navigator) to a local machine, enter the following:
https://209.165.200.232/capture/http/pcapIn the following example, the traffic is captured from an outside host at 209.165.200.241 to an inside HTTP server.
access-list http permit tcp host 10.120.56.15 eq http host 209.165.200.241access-list http permit tcp host 209.165.200.241 host 10.120.56.15 eq httpcapture http access-list http packet-length 74 interface insideTo capture ARP packets, enter the following:
pixfirewall(config)# capture arp ethernet-type arp interface outsideTo display the packets captured by an ARP capture, enter the following:
pixfirewall(config)# show capture arp2 packets captured19:12:23.478429 arp who-has 209.165.200.228 tell 209.165.200.1019:12:26.784294 arp who-has 209.165.200.228 tell 209.165.200.102 packets shownTo capture PPPoE Discovery packets on multiple interfaces, enter the following:
pixfirewall(config)# capture pppoed ethernet-type pppoed interface outsidepixfirewall(config)# capture pppoed interface insideThe following stores a PPPoED trace to a file name "pppoed-dump" on a TFTP server at 209.165.201.17. (Some TFTP servers require that the file exists and is world writable, so check your TFTP server for the appropriate permissions and file first.)
pixfirewall(config)# copy capture:pppoed tftp://209.165.201.17/pppoed-dumpWriting to file '/tftpboot/pppoed-dump' at 209.165.201.17 on outsideTo display the capture configuration, use the show capture command without specifying any options as follows:
pixfirewall(config)# show capturecapture arp ethernet-type arp interface outsidecapture http access-list http packet-length 74 interface insideclear
Removes configuration files and commands from the configuration, or resets command values. However, using the no form of a command is preferred to using the clear form to change your configuration because the no form is usually more precise.
clear file configuration | pdm | pki
clear command
no command
Command Modes
Configuration mode for clear commands that remove or reset firewall configurations. Privilege mode for commands that clear items such as counters in show commands. Additionally, the clear commands available in less secure modes are available in subsequent (more secure) modes. However, commands from a more secure mode are not available in a less secure mode.
Syntax Description
Table 4-4, Table 4-5, and Table 4-6 list the clear commands available in each mode.
Table 4-4 Unprivileged Mode Clear Command
clear pager
Resets the number of displayed lines to 24.
Table 4-6 Configuration Mode Clear Commands
clear aaa
Removes aaa command statements from the configuration.
clear aaa accounting
Removes aaa-server command statements from the configuration.
clear aaa-server
Remove a defined server group from the configuration.
clear access-group
Removes access-group command statements from the configuration.
clear access-list
Removes access-list command statements from the configuration. This command also stops all traffic through the PIX Firewall on the affected access-list command statements.
clear access-list aclname counters
Clears the counters shown by the show access-list command.
clear alias
Removes alias command statements from the configuration.
clear apply
Removes apply command statements from the configuration.
clear capture
Clears the packet capture.
clear clock
Removes clock command statements from the configuration.
clear conduit
Removes conduit command statements from the configuration.
clear dhcpd
Removes dhcpd command statements from the configuration.
clear established
Removes established command statements from the configuration.
clear filter
Removes filter command statements from the configuration.
clear fixup
Resets fixup protocol command statements to their default values.
clear flashfs
Clears Flash memory before downgrading to a previous PIX Firewall version.
clear global
Removes global command statements from the configuration.
clear http
Removes all HTTP hosts and disables the server.
clear icmp
Removes icmp command statements from the configuration.
clear igmp
Removes IGMP groups.
igmp
clear ip
Sets all PIX Firewall interface IP addresses to 127.0.0.1 and stops all traffic.
clear ip address
Clears all PIX Firewall interface IP addresses (configuration mode).
clear ip audit
Clears the IDS signature on the interface (configuration mode).
clear ip local pool
Clears pool of local IP addresses for dynamic assignment to a VPN.
clear ip verify reverse-path
Clears RPF IP spoofing protection (configuration mode).
clear [crypto] dynamic-map
Remove crypto dynamic-map command statements from the configuration.The keyword crypto is optional.
clear [crypto] ipsec sa
Delete the active IPSec security associations. The keyword crypto is optional.
clear [crypto] ipsec sa counters
Clear the traffic counters maintained for each security association. The keyword crypto is optional.
clear [crypto] ipsec sa entry destination-address protocol spi
Delete the active IPSec security association with the specified address, protocol, and SPI. The keyword crypto is optional.
clear [crypto] ipsec sa map map-name
Delete the active IPSec security associations for the named crypto map set. The keyword crypto is optional.
clear [crypto] ipsec sa peer
Delete the active IPSec security associations for the specified peer. The keyword crypto is optional.
clear [crypto] isakmp sa
Delete the active IKE security associations. The keyword crypto is optional.
clear [crypto] map
Delete all parameters entered through the crypto map command belonging to the specified map. Does not delete dynamic maps.
clear isakmp
Remove isakmp command statements from the configuration.
clear isakmp log
Clears events in the isakmp log buffer
clear interface
Clear counters for the show interface command.
clear logging
Clear syslog message queue accumulated by the logging buffered command.
clear mroute
Clear a multicast route.
mroute
clear names
Removes name command statements from the configuration.
clear nameif
Reverts nameif command statements to default interface names and security levels.
clear nat
Removes nat command statements from the configuration.
clear ntp
Removes ntp command statements from the configuration.
clear outbound
Removes outbound command statements from the configuration.
clear ospf [process-id] {process | counters | neighbor [neighbor-intf] [neighbr-id]}
Clears and restarts the OSPF process with the specified ID, resets OSPF interface counters, neighbor interface router designation, or neighbor router ID, depending on the option selected. This command does not remove any configuration. Use the no form of the router ospf or routing interface command to remove the OSPF configuration.
clear pdm
Removes all locations, disables logging and clears the PDM buffer. Internal PDM command.
clear privilege
Removes privilege command statements from the configuration.
clear rip
Removes rip command statements from the configuration.
clear route
Removes route command statements from the configuration that do not contain the CONNECT keyword.
clear service
Removes service command statements from the configuration.
clear snmp-server
Removes snmp-server command statements from the configuration.
ยท When this feature is off, regular SIP Fixup will work as it does under PIX 6.3.3
clear ssh
Removes ssh command statement from the configuration.
clear static
Removes static command statements from the configuration.
clear sysopt
Removes sysopt command statements from the configuration.
clear telnet
Removes telnet command statements from the configuration.
clear tftp-server
Removes tftp-server command statements from the configuration.
clear timeout
Resets timeout command durations to their default values.
clear url-cache
Removes url-cache command statements from the configuration.
clear url-server
Removes url-server command statements from the configuration.
clear username
Removes username command statements from the configuration.
clear virtual
Removes virtual command statements from the configuration.
clear vpdn
Removes vpdn command statements from the configuration.
clear vpnclient
Removes vpnclient command statements from the configuration.
clock
Set the PIX Firewall clock for use with the PIX Firewall Syslog Server (PFSS) and the Public Key Infrastructure (PKI) protocol.
clock set hh:mm:ss {day month | month day} year
clear clock
[no] clock summer-time zone recurring [week weekday month hh:mm week weekday month hh:mm] [offset]
[no] clock summer-time zone date {day month | month day} year hh:mm {day month | month day} year hh:mm [offset]
[no] clock timezone zone hours [minutes]
show clock [detail]
Syntax Description
