Configuring an FQDN ACL
|
|
|
- Alicia Bradley
- 6 years ago
- Views:
Transcription
1 This document describes how to configure an access control lists (ACL) using a fully qualified domain name (FQDN). The feature allows you to configure and apply an ACL to a wireless session based on the domain name system (DNS). The domain names are resolved to IP addresses, the IP addresses are given to the client as part of the DNS response, and the FQDN is then mapped to an ACL based on the IP address. Finding Feature Information, page 1 Restrictions for Configuring FQDN ACL, page 1 Information About, page 2 How to Configure FQDN ACL, page 2 Monitoring an FQDN ACL, page 5 Configuration Examples for an FQDN ACL, page 5 Additional References for Configuring FQDN ACL, page 6 Feature Information for Configuring FQDN ACL, page 7 Finding Feature Information Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to An account on Cisco.com is not required. Restrictions for Configuring FQDN ACL The Configuring FQDN ACL feature is supported only on IPv4 wireless sessions. 1
2 Information About Information About When access control lists (ACLs) are configured using a fully qualified domain name (FQDN), ACLs can be applied based on the destination domain name. The destination domain name is then resolved to an IP address, which is provided to the client as a part of the DNS response. Guest users can log in using web authentication with a parameter map that consists of an FQDN ACL name. Before you configure an FQDN ACL, complete the following tasks: Configure an IP access list. Configure an IP domain name list. Map an FQDN ACL with a domain name. You can apply an access list to a specific domain by configuring the RADIUS server to send the fqdn-acl-name AAA attribute to the controller. The operating system checks for the passthrough domain list and its mapping, and permits the FQDN. The FQDN ACL allows clients to access only configured domains without authentication. Note By default, an IP access list name is configured with the same name as the pass-through domain name. To override the default name, you can use the access-session passthrou-access-group access-group-name passthrou-domain-list domain-list-name command in global configuration mode. How to Configure FQDN ACL Configuring an IP Access List SUMMARY STEPS 1. configure terminal 2. ip access-list extended name 3. permit ip any any 4. end 2
3 Configuring a Domain Name List DETAILED STEPS Step 1 Command or Action configure terminal Enters global configuration mode. Step 2 # configure terminal ip access-list extended name Creates the IP access list. Step 3 Step 4 (config)# ip access-list extended ABC permit ip any any (config-ext-nacl)# permit ip any any end (config)# end Specifies the domains to be allowed for the wireless client. The domains are specified in the domain name list. Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. Configuring a Domain Name List You can configure a domain name list that contains a list of domain names that are allowed for DNS snooping by the access point. The DNS domain list name string must be identical to the extended access list name. SUMMARY STEPS 1. configure terminal 2. passthrou-domain-list name 3. match word 4. end DETAILED STEPS Step 1 Command or Action configure terminal Enters global configuration mode. # configure terminal 3
4 Mapping the FQDN ACL with a Domain Name Step 2 Command or Action passthrou-domain-list name Configures a passthrough domain name list. Step 3 Step 4 (config)# passthrou-domain-list abc (config-fqdn-acl-domains)# match word (config-fqdn-acl-domains)# match play.google.com (config-fqdn-acl-domains)# match end (config)# end Configures a passthrough domain list. Adds a list of websites that the client is allowed to query for access without first being required to be authenticated through the RADIUS server. Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. Mapping the FQDN ACL with a Domain Name SUMMARY STEPS 1. configure terminal 2. access-session passthrou-access-group access-group-name passthrou-domain-list domain-list-name 3. parameter-map type webauth domain-list-name and login-auth-bypass fqdn-acl-name acl-name domain-name domain-name DETAILED STEPS Step 1 Command or Action configure terminal Enters global configuration mode. Step 2 # configure terminal access-session passthrou-access-group access-group-name passthrou-domain-list domain-list-name Maps the FQDN ACL AAA attribute name with the domain name list. Use this command when configuring central web authentication. (config)# access-session passthrou-access-group abc passthrou-domain-list abc 4
5 Monitoring an FQDN ACL Step 3 Command or Action parameter-map type webauth domain-list-name and login-auth-bypass fqdn-acl-name acl-name domain-name domain-name (config)# parameter-map type webauth abc (config-params-parameter-map)# login-auth-bypass fqdn-acl-name abc domain-name abc Maps an FQDN ACL name with the domain name list. Use the command when configuring local authentication on the controller. The RADIUS server can be configured to return an FQDN ACL name as part of the authenticated user profile. The controller dynamically applies the FQDN ACL to the user if the FQDN ACL is defined on the controller. Monitoring an FQDN ACL The following commands can be used to monitor FQDN ACLs. Command show access-session interface interface-name details show access-session fqdn fqdn-maps show access-session fqdn list-domain domain-name show access-session fqdn passthru-domain-list Displays the FQDN ACL information configured on the interface. Displays the FQDN ACL mapped to the domain name list. Displays the domain names. Displays the domains that are configured. Configuration Examples for an FQDN ACL Examples: FQDN ACL Configuration This example shows how to create IP access list: # config terminal (config)# ip access-list extended abc (config-ext-nacl)# permit ip any any (config-ext-nacl)# end # show ip access-list abc This example shows how to configure domain name list: # config terminal (config)# passthrou-domain-list abc (config-fqdn-acl-domains)# match play.google.com (config-fqdn-acl-domains)# end # show access-session fqdn fqdn-maps 5
6 Additional References for Configuring FQDN ACL This example shows how to map FQDN ACL with domain name using central web authentication: # config terminal (config)# access-session passthrou-access-group abc passthrou-domain-list abc (config)# end # show access-session interface vlan 20 This example shows how to map FQDN ACL with domain name using local authentication: # config terminal (config)# parameter-map type webauth abc (config-params-parameter-map)# login-auth-bypass fqdn-acl-name abc domain-name abc (config-params-parameter-map)# end # show access-session fqdn fqdn-maps Additional References for Configuring FQDN ACL Related Documents Related Topic Cisco IOS commands Security commands Document Title Cisco IOS Master Command List, All Releases Cisco IOS Security Command Reference: Commands A to C Cisco IOS Security Command Reference: Commands D to L Cisco IOS Security Command Reference: Commands M to R Cisco IOS Security Command Reference: Commands S to Z ACL configuration guide Security Configuration Guide: Access Control Lists Technical Assistance Description The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. Link 6
7 Feature Information for Configuring FQDN ACL Feature Information for Configuring FQDN ACL The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to An account on Cisco.com is not required. 7
8 Feature Information for Configuring FQDN ACL Table 1: Feature Information for Configuring FQDN ACL Feature Name Releases Feature Information 8
9 Feature Information for Configuring FQDN ACL Feature Name Releases Feature Information The feature allows you to configure and apply an access control lists (ACL) to a wireless session based on the domain name system (DNS). The domain names are resolved to IP addresses, where the IP addresses are given to the client as part of the DNS response; the FQDN is then mapped to an ACL based on the IP address. In Cisco IOS RElease 15.2(2)E or Cisco IOS XE 3.6E, this feature is supported on the following platforms: Catalyst 4500E Supervisor Engine 7-E Catalyst 4500E Supervisor Engine 7L-E Catalyst 4500E Supervisor Engine 8-E Catalyst 4500-X Series Switches Catalyst 3850 Series Switches Catalyst 3650 Series Switches Cisco 5760 Wireless Controller Cisco Industrial Ethernet 3000 Series Switches Cisco Industrial Ethernet 2000 Series Switches Cisco Catalyst 2960-S Series Switches (Stout) Cisco Catalyst 2960-X Series Switches (Porter) Cisco Catalyst 2960-X Series Switches (Kingfisher) The following commands were introduced or modified: access 9
10 Feature Information for Configuring FQDN ACL Feature Name Releases Feature Information session passthrou access group, login-auth-bypass, parameter-map type webauth global, pass throu domain list name, show access-session fqdn. 10
IEEE 802.1X Open Authentication
allows a host to have network access without having to go through IEEE 802.1X authentication. Open authentication is useful in an applications such as the Preboot Execution Environment (PXE), where a device
Per-User ACL Support for 802.1X/MAB/Webauth Users
Per-User ACL Support for 802.1X/MAB/Webauth Users This feature allows per-user ACLs to be downloaded from the Cisco Access Control Server (ACS) as policy enforcement after authentication using IEEE 802.1X,
IEEE 802.1X Multiple Authentication
The feature provides a means of authenticating multiple hosts on a single port. With both 802.1X and non-802.1x devices, multiple hosts can be authenticated using different methods. Each host is individually
IEEE 802.1X with ACL Assignments
The feature allows you to download access control lists (ACLs), and to redirect URLs from a RADIUS server to the switch, during 802.1X authentication or MAC authentication bypass of the host. It also allows
RADIUS Route Download
The feature allows users to configure their network access server (NAS) to direct RADIUS authorization. Finding Feature Information, page 1 Prerequisites for, page 1 Information About, page 1 How to Configure,
AAA Server Groups. Finding Feature Information. Information About AAA Server Groups. AAA Server Groups
Configuring a device to use authentication, authorization, and accounting (AAA) server groups provides a way to group existing server hosts. Grouping existing server hosts allows you to select a subset
Named ACL Support for Noncontiguous Ports on an Access Control Entry
Named ACL Support for Noncontiguous Ports on an Access Control Entry The Named ACL Support for Noncontiguous Ports on an Access Control Entry feature allows you to specify noncontiguous ports in a single
RADIUS for Multiple UDP Ports
RADIUS security servers are identified on the basis of their hostname or IP address, hostname and specific UDP port numbers, or IP address and specific UDP port numbers. The combination of the IP address
Fine-Grain NBAR for Selective Applications
By default NBAR operates in the fine-grain mode, offering NBAR's full application recognition capabilities. Used when per-packet reporting is required, fine-grain mode offers a troubleshooting advantage.
IEEE 802.1X RADIUS Accounting
The feature is used to relay important events to the RADIUS server (such as the supplicant's connection session). The information in these events is used for security and billing purposes. Finding Feature
IPv6 First-Hop Security Binding Table
IPv6 First-Hop Security Binding Table Last Updated: July 25, 2012 A database table of IPv6 neighbors connected to a device is created from information sources such as Neighbor Discovery Protocol (NDP)
Configuring Web-Based Authentication
This chapter describes how to configure web-based authentication on the switch. It contains these sections: Finding Feature Information, page 1 Web-Based Authentication Overview, page 1 How to Configure
NAT Routemaps Outside-to-Inside Support
The feature enables you to configure a NAT routemap configuration that allows IP sessions to be initiated from outside the network to inside the network. This module explains how to configure the feature.
Fine-Grain NBAR for Selective Applications
By default NBAR operates in the fine-grain mode, offering NBAR's full application recognition capabilities. Used when per-packet reporting is required, fine-grain mode offers a troubleshooting advantage.
FPG Endpoint Agnostic Port Allocation
When the Endpoint Agnostic Port Allocation feature is configured, an entry is added to the Symmetric Port Database. If the entry is already available, the port listed in the Symmetric Port Database is
Flow-Based per Port-Channel Load Balancing
The feature allows different flows of traffic over a Gigabit EtherChannel (GEC) interface to be identified based on the packet header and then mapped to the different member links of the port channel.
Configuring Web-Based Authentication
This chapter describes how to configure web-based authentication on the switch. It contains these sections: Finding Feature Information, page 1 Web-Based Authentication Overview, page 1 How to Configure
Nested Class Map Support for Zone-Based Policy Firewall
Nested Class Map Support for Zone-Based Policy Firewall The Nested Class Map Support for Zone-Based Policy Firewall feature provides the Cisco IOS XE firewall the functionality to configure multiple traffic
SSL Custom Application
feature enables users to customize applications that run on any protocol over Secure Socket Layer (SSL), including HTTP over Secure Socket Layer (HTTPS), using the server name, if it exists in the Client
Configuring Local Authentication and Authorization
Configuring Local Authentication and Authorization Finding Feature Information, page 1 How to Configure Local Authentication and Authorization, page 1 Monitoring Local Authentication and Authorization,
NBAR2 HTTP-Based Visibility Dashboard
The NBAR2 HTTP-based Visibility Dashboard provides a web interface displaying network traffic data and related information. The information is presented in an intuitive, interactive graphical format. Finding
Quality of Service for VPNs
The QoS for VPNs feature provides a solution for making Cisco IOS QoS services operate in conjunction with tunneling and encryption on an interface. Cisco IOS software can classify packets and apply the
Configuring Access Point Groups
Finding Feature Information, page 1 Prerequisites for Configuring AP Groups, page 1 Restrictions for, page 2 Information About Access Point Groups, page 2 How to Configure Access Point Groups, page 4 Additional
SSL VPN - IPv6 Support
The feature implements support for IPv6 transport over IPv4 SSL VPN session between a client, such as Cisco AnyConnect Mobility Client, and SSL VPN. Finding Feature Information, on page 1 Prerequisites
IPv6 Snooping. Finding Feature Information. Restrictions for IPv6 Snooping
The feature bundles several Layer 2 IPv6 first-hop security features, including IPv6 neighbor discovery inspection, IPv6 device tracking, IPv6 address glean, and IPv6 binding table recovery, to provide
Configuring Access Point Groups
Finding Feature Information, page 1 Prerequisites for Configuring AP Groups, page 1 Restrictions for, page 2 Information About Access Point Groups, page 2 How to Configure Access Point Groups, page 3 Additional
SSL VPN - IPv6 Support
The feature implements support for IPv6 transport over IPv4 SSL VPN session between a client, such as Cisco AnyConnect Mobility Client, and SSL VPN. Finding Feature Information, page 1 Prerequisites for,
The MSCHAP Version 2 feature (introduced in Cisco IOS Release 12.2(2)XB5) allows Cisco routers to
The feature (introduced in Cisco IOS Release 12.2(2)XB5) allows Cisco routers to utilize Microsoft Challenge Handshake Authentication Protocol Version 2 (MSCHAP V2) authentication for PPP connections between
IS-IS Inbound Filtering
The Intermediate System-to-Intermediate System (IS-IS) Inbound Filtering feature prevents unwanted IS-IS routes from being installed in a routing table. A user can deny or permit a route from being installed
The ISG RADIUS Proxy Support for Mobile Users Hotspot Roaming and Accounting Start Filtering feature
ISG RADIUS Proxy Support for Mobile Users Hotspot Roaming and Accounting Start Filtering The ISG RADIUS Proxy Support for Mobile Users Hotspot Roaming and Accounting Start Filtering feature allows the
Encrypted Vendor-Specific Attributes
The feature provides users with a way to centrally manage filters at a RADIUS server and supports the following types of string vendor-specific attributes (VSAs): Tagged String VSA, on page 2 (similar
ACL Syslog Correlation
The Access Control List (ACL) Syslog Correlation feature appends a tag (either a user-defined cookie or a device-generated MD5 hash value) to access control entry (ACE) syslog entries. This tag uniquely
IPv6 Snooping. Finding Feature Information. Restrictions for IPv6 Snooping
The feature bundles several Layer 2 IPv6 first-hop security features, including IPv6 neighbor discovery inspection, IPv6 device tracking, IPv6 address glean, and IPv6 binding table recovery, to provide
BGP Route-Map Continue
The feature introduces the continue clause to BGP route-map configuration. The continue clause allows for more programmable policy configuration and route filtering and introduces the capability to execute
EIGRP Route Tag Enhancements
The feature enables you to specify and display route tags in dotted-decimal format, filter routes using the route tag value with wildcard mask, and set a default route tag for all internal Enhanced Interior
Prerequisites for AES and 3-DES Encryption Support for SNMP. Version 3. Finding Feature Information
AES and 3-DES Encryption Support for SNMP Version 3 The AES and 3-DES Encryption Support for SNMP Version 3 feature enhances the encryption capabilities of Simple Network Management Protocol (SNMP) Version
IEEE 802.1X VLAN Assignment
The feature is automatically enabled when IEEE 802.1X authentication is configured for an access port, which allows the RADIUS server to send a VLAN assignment to the device port. This assignment configures
Flexible NetFlow - MPLS Support
The feature supports the monitoring of the following MPLS-related fields: MPLS Labels 1-6 (3 bytes -- 20 bits of label, 3 bits of EXP, 1 bit of EOS). Top Label EXP i.e. the EXP field for label 1. Top Label
Object Tracking: IPv6 Route Tracking
The feature expands the Enhanced Object Tracking (EOT) functionality to allow the tracking of IPv6 routes. Finding Feature Information, page 1 Restrictions for, page 1 Information About, page 2 How to
AAA Dead-Server Detection
The feature allows you to configure the criteria to be used to mark a RADIUS server as dead. If no criteria are explicitly configured, the criteria are computed dynamically on the basis of the number of
Enabling ALGs and AICs in Zone-Based Policy Firewalls
Enabling ALGs and AICs in Zone-Based Policy Firewalls Zone-based policy firewalls support Layer 7 application protocol inspection along with application-level gateways (ALGs) and application inspection
DHCP Client. Finding Feature Information. Restrictions for the DHCP Client
The Cisco Dynamic Host Configuration Protocol (DHCP) Client feature allows a Cisco device to act as a host requesting configuration parameters, such as an IP address, from a DHCP server. Finding Feature
IGMP Proxy. Finding Feature Information. Prerequisites for IGMP Proxy
This module describes how to configure IGMP proxy to enable a device to send an IGMP report to a specified destination IP address. Finding Feature Information, page 1 Prerequisites for, page 1 Information
RADIUS Change of Authorization
The (CoA) feature provides a mechanism to change the attributes of an authentication, authorization, and accounting (AAA) session after it is authenticated. When a policy changes for a user or user group
Enabling ALGs and AICs in Zone-Based Policy Firewalls
Enabling ALGs and AICs in Zone-Based Policy Firewalls Zone-based policy firewalls support Layer 7 application protocol inspection along with application-level gateways (ALGs) and application inspection
IP over IPv6 Tunnels. Information About IP over IPv6 Tunnels. GRE IPv4 Tunnel Support for IPv6 Traffic
IPv6 supports IP over IPv6 tunnels, which includes the following: Generic routing encapsulation (GRE) IPv4 tunnel support for IPv6 traffic IPv6 traffic can be carried over IPv4 GRE tunnels using the standard
Auto Identity. Auto Identity. Finding Feature Information. Information About Auto Identity. Auto Identity Overview. Auto Identity, page 1
, page 1 The feature provides a set of built-in policies at global configuration and interface configuration modes. This feature is available only in Class-Based Policy Language (CPL) control policy-equivalent
VLANs over IP Unnumbered SubInterfaces
The VLANs over IP Unnumbered Subinterfaces feature allows IP unnumbered interface support to be configured on Ethernet VLAN subinterfaces. This feature also provides support for DHCP on VLAN subinterfaces.
Configuring WLAN Security
Finding Feature Information, page 1 Prerequisites for Layer 2 Security, page 1 Information About AAA Override, page 2 How to Configure WLAN Security, page 3 Additional References, page 11 Feature Information
Configuring IP SLAs HTTP Operations
This module describes how to configure an IP Service Level Agreements (SLAs) HTTP operation to monitor the response time between a Cisco device and an HTTP server to retrieve a web page. The IP SLAs HTTP
Configuring DHCP Option 60 and Option 82 with VPN-ID Support for Transparent Automatic Logon
Configuring DHCP Option 60 and Option 82 with VPN-ID Support for Transparent Automatic Logon Intelligent Services Gateway (ISG) is a Cisco software feature set that provides a structured framework in which
BGP Support for IP Prefix Export from a VRF Table into the Global Table
BGP Support for IP Prefix Export from a VRF Table into the Global Table This feature allows a network administrator to export IP prefixes from a VRF table into the global routing table. Finding Feature
Configuring Web-Based Authentication
The Web-Based Authentication feature, also known as web authentication proxy, authenticates end users on host systems that do not run the IEEE 802.1x supplicant. Finding Feature Information, on page 1
802.1P CoS Bit Set for PPP and PPPoE Control Frames
802.1P CoS Bit Set for PPP and PPPoE Control The 802.1P CoS Bit Set for PPP and PPPoE Control feature provides the ability to set user priority bits in the IEEE 802.1Q tagged frame to allow traffic prioritization.
AAA Support for IPv6
Authentication, authorization, and accounting (AAA) support for IPv6 is in compliance with RFC 3162. This module provides information about how to configure AAA options for IPv6. Finding Feature Information,
Configuring System MTU
Restrictions for System MTU, on page 1 Information About the MTU, on page 1 How to Configure MTU, on page 2 Configuration Examples for System MTU, on page 4 Additional References for System MTU, on page
SSH Algorithms for Common Criteria Certification
The feature provides the list and order of the algorithms that are allowed for Common Criteria Certification. This module describes how to configure the encryption, Message Authentication Code (MAC), and
Flow-Based per Port-Channel Load Balancing
Flow-Based per Load Balancing The Flow-Based per Load Balancing feature allows different flows of traffic over a Ten Gigabit EtherChannel (GEC) interface to be identified based on the packet header and
Network Edge Authentication Topology
The Network Edge Access Topology (NEAT) feature enables extended secure access in areas outside the wiring closet (such as conference rooms). This secure access allows any type of device to authenticate
BGP mvpn BGP safi IPv4
The BGP mvpn BGP safi 129 IPv4 feature provides the capability to support multicast routing in the service provider s core IPv4 network This feature is needed to support BGP-based MVPNs BGP MVPN provides
Match-in-VRF Support for NAT
The feature supports Network Address Translation (NAT) of packets that communicate between two hosts within the same VPN routing and forwarding (VRF) instance. In intra-vpn NAT, both the local and global
Object Groups for ACLs
The feature lets you classify users, devices, or protocols into groups and apply those groups to access control lists (ACLs) to create access control policies for those groups. This feature lets you use
Controlling Switch Access with Passwords and Privilege Levels
Controlling Switch Access with Passwords and Privilege Levels Finding Feature Information, page 1 Restrictions for Controlling Switch Access with Passwords and Privileges, page 1 Information About Passwords
Password Strength and Management for Common Criteria
Password Strength and Management for Common Criteria The Password Strength and Management for Common Criteria feature is used to specify password policies and security mechanisms for storing, retrieving,
Flexible NetFlow Full Flow support
Flexible NetFlow Full Flow support Last Updated: January 29, 2013 The Flexible NetFlow - Full Flow support feature enables Flexible NetFlow to collect flow records for every packet. Finding Feature Information,
Configurable Number of Simultaneous Packets per Flow
Configurable Number of Simultaneous Packets per Flow In zone-based policy firewalls, the number of simultaneous packets per flow is restricted to 25 and packets that exceed the limit are dropped. The dropping
Using Flexible NetFlow Flow Sampling
This document contains information about and instructions for configuring sampling to reduce the CPU overhead of analyzing traffic with Flexible NetFlow. NetFlow is a Cisco technology that provides statistics
RADIUS Change of Authorization Support
The RADIUS Change of Authorization (CoA) provides a mechanism to change the attributes of an authentication, authorization, and accounting (AAA) session after it is authenticated Identity-Based Networking
Using Flexible NetFlow Flow Sampling
This document contains information about and instructions for configuring sampling to reduce the CPU overhead of analyzing traffic with Flexible NetFlow. NetFlow is a Cisco technology that provides statistics
Network Admission Control Agentless Host Support
Network Admission Control Agentless Host Support Last Updated: October 10, 2012 The Network Admission Control: Agentless Host Support feature allows for an exhaustive examination of agentless hosts (hosts
Flexible NetFlow IPFIX Export Format
The feature enables sending export packets using the IPFIX export protocol. The export of extracted fields from NBAR is only supported over IPFIX. Finding Feature Information, page 1 Information About,
Controlling Switch Access with Passwords and Privilege Levels
Controlling Switch Access with Passwords and Privilege Levels Finding Feature Information, page 1 Restrictions for Controlling Switch Access with Passwords and Privileges, page 1 Information About Passwords
IP Multicast Optimization: IGMP State Limit
Finding Feature Information, page 1 Prerequisites for IGMP State Limit, page 1 Restrictions for IGMP State Limit, page 2 Information About IGMP State Limit, page 2 How to Configure IGMP State Limit, page
Configuring Secure Shell (SSH)
Prerequisites for Configuring Secure Shell, page 1 Restrictions for Configuring Secure Shell, page 2 Information About Configuring Secure Shell, page 2 How to Configure Secure Shell, page 4 Monitoring
Add Path Support in EIGRP
The feature enables hubs in a single Dynamic Multipoint VPN (DMVPN) domain to advertise multiple best paths to connected spokes when the Enhanced Interior Gateway Routing Protocol (EIGRP) is the routing
DHCPv6 Individual Address Assignment
The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Individual Address Assignment feature manages nonduplicate address assignment in the correct prefix based on the network where the host is connected.
HSRP MD5 Authentication
Finding Feature Information, page 1 Information About, page 1 How to Configure, page 2 Configuration Examples for, page 8 Additional References, page 9 Feature Information for, page 10 Finding Feature
DMVPN Event Tracing. Finding Feature Information
The feature provides a trace facility for troubleshooting Cisco IOS Dynamic Multipoint VPN (DMVPN). This feature enables you to monitor DMVPN events, errors, and exceptions. During runtime, the event trace
Configuring Local Policies
Finding Feature Information, on page 1 Restrictions for, on page 1 Information About, on page 2 How to Configure Local Policies, on page 3 Monitoring Local Policies, on page 8 Examples: Local Policies
Extended NAS-Port-Type and NAS-Port Support
Extended NAS-Port-Type and NAS-Port Support Last Updated: April 18, 2012 The Extended NAS-Port-Type and NAS-Port Support feature allows you to identify what service type is taking place on specific ports
Restrictions for Disabling Flow Cache Entries in NAT and NAT64
The feature allows you to disable flow cache entries for dynamic and static Network Address Translation (NAT) translations. Disabling flow cache entries for dynamic and static translations saves memory
Regulating Packet Flow on a Per-Interface Basis Using Generic Traffic Shaping
Regulating Packet Flow on a Per-Interface Basis Using Generic Traffic Shaping Packet flow on a network can be regulated using a traffic shaping mechanism. One such traffic shaping mechanism is a Cisco
Bulk Logging and Port Block Allocation
The feature allocates a block of ports for translation instead of allocating individual ports. This feature is supported only in carrier-grade Network Address Translation (CGN) mode. This module provides
Security Configuration Guide, Cisco IOS XE Everest 16.6.x (Catalyst 9300 Switches)
Security Configuration Guide, Cisco IOS XE Everest 16.6.x (Catalyst 9300 Switches) First Published: 2017-07-31 Last Modified: 2017-11-03 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive
Configuring MAC Authentication Bypass
Configuring MAC Authentication Bypass Last Updated: January 18, 2012 The MAC Authentication Bypass feature is a MAC-address-based authentication mechanism that allows clients in a network to integrate
Object Groups for ACLs
The feature lets you classify users, devices, or protocols into groups and apply those groups to access control lists (ACLs) to create access control policies for those groups. This feature lets you use
HTTP 1.1 Web Server and Client
The feature provides a consistent interface for users and applications by implementing support for HTTP 1.1 in Cisco IOS XE software-based devices. When combined with the HTTPS feature, the feature provides
IPv6 Routing: Route Redistribution
IPv6 route redistribution allows routes to be specified by prefix, using a route-map prefix list, or by tag, using the route-map "match tag" function. Finding Feature Information, page 1 Information About
Restrictions for Secure Copy Performance Improvement
The Protocol (SCP) feature provides a secure and authenticated method for copying router configuration or router image files. SCP relies on Secure Shell (SSH), an application and a protocol that provide
BGP Named Community Lists
The feature allows the network operator to assign meaningful names to community lists and increases the number of community lists that can be configured. Finding Feature Information, page 1 Information
BGP Graceful Shutdown
The feature reduces or eliminates the loss of traffic along a link being shut down for maintenance. Routers always have a valid route available during the convergence process. This feature is used primarily
Configure 802.1x Authentication with PEAP, ISE 2.1 and WLC 8.3
Configure 802.1x Authentication with PEAP, ISE 2.1 and WLC 8.3 Contents Introduction Prerequisites Requirements Components Used Configure Network Diagram Configuration Declare RADIUS Server on WLC Create
Configuring Embedded Resource Manager-MIB
The Embedded Resource Manager (ERM)-MIB feature introduces MIB support for the ERM feature. The ERM feature tracks resource usage information for every registered resource owner and resource user. The
NAC-Auth Fail Open. Prerequisites for NAC-Auth Fail Open. Restrictions for NAC-Auth Fail Open. Information About Network Admission Control
NAC-Auth Fail Open Last Updated: October 10, 2012 In network admission control (NAC) deployments, authentication, authorization, and accounting (AAA) servers validate the antivirus status of clients before
GETVPN CRL Checking. Finding Feature Information. Information About GETVPN CRL Checking
During the Group Encrypted Transport VPN (GET VPN) process, certificates are received from a certificate authority (CA) and used as a proof of identity. Certificates may be revoked for a number of reasons,
Configuring Secure Shell (SSH)
Starting with Cisco IOS XE Denali 16.3.1, Secure Shell Version 1 (SSHv1) is deprecated. Finding Feature Information, on page 1 Prerequisites for Configuring Secure Shell, on page 1 Restrictions for Configuring
Prerequisites for Controlling Switch Access with Terminal Access Controller Access Control System Plus (TACACS+)
Finding Feature Information, page 1 Prerequisites for Controlling Switch Access with Terminal Access Controller Access Control System Plus (TACACS+), page 1 Information About TACACS+, page 3 How to Configure
IP Named Access Control Lists
Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting the access of traffic into a network, restricting
Configuring FlexVPN Spoke to Spoke
Last Published Date: March 28, 2014 The FlexVPN Spoke to Spoke feature enables a FlexVPN client to establish a direct crypto tunnel with another FlexVPN client leveraging virtual tunnel interfaces (VTI),
Configuring ISG Support for Prepaid Billing
Intelligent Services Gateway (ISG) is a software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. ISG prepaid billing support