Cisco Firepower 4100 Series Installation manual

Cisco Firepower 4100/9300 FXOS Command Reference
First Published: 2017-08-28
Last Modified: 2019-01-15
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com
go trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any
other company. (1721R)
©2017–2019 Cisco Systems, Inc. All rights reserved.

About the FXOS CLI Command Reference Guide
This guide represents an on-going effort to document the many CLI commands in FXOS, and as such, should
be viewed as a work-in-progress. The guide will be republished periodically as new command descriptions
are added and existing descriptions updated or corrected.
Cisco Firepower 4100/9300 FXOS Command Reference
1

Cisco Firepower 4100/9300 FXOS Command Reference
2
About the FXOS CLI Command Reference Guide

CLI Overview
•Managed Objects, on page 4
•Command Modes, on page 5
•Object Commands, on page 7
•Complete a Command, on page 8
•Command History, on page 9
•Commit, Discard, and View Pending Commands, on page 10
•Inline Help for the CLI, on page 11
•CLI Session Limits, on page 12
Cisco Firepower 4100/9300 FXOS Command Reference
3

Managed Objects
The Firepower eXtensible Operating System (FXOS) uses a managed object model, where managed objects
are abstract representations of physical or logical entities that can be managed. For example, chassis, security
modules, network modules, ports, and processors are physical entities represented as managed objects, and
licenses, user roles, and platform policies are logical entities represented as managed objects.
Managed objects may have one or more associated properties that can be configured.
Cisco Firepower 4100/9300 FXOS Command Reference
4
CLI Overview
Managed Objects

Command Modes
The CLI is organized into a hierarchy of command modes, with EXEC mode being the highest-level mode
of the hierarchy. Higher-level modes branch into lower-level modes. You use create,enter, and scope
commands to move from higher-level modes to modes in the next lower level, and you use the up command
to move up one level in the mode hierarchy. You can also use the top command to move to the top level in
the mode hierarchy.
Most command modes are associated with managed objects, so you must create an object before you can
access the mode associated with that object. You use create and enter commands to create managed objects
for the modes being accessed. The scope commands do not create managed objects and can only access modes
for which managed objects already exist.
Note
Each mode contains a set of commands that can be entered in that mode. Most of the commands available in
each mode pertain to the associated managed object.
The CLI prompt for each mode shows the full path down the mode hierarchy to the current mode. This helps
you to determine where you are in the command mode hierarchy, and it can be an invaluable tool when you
need to navigate through the hierarchy.
The following table lists the main command modes, the commands used to access each mode, and the CLI
prompt associated with each mode.
Table 1: Main Command Modes and Prompts
Mode PromptCommands Used to AccessMode Name
#top command from any modeEXEC
/adapter #scope adapter command from EXEC modeAdapter
/cabling #scope cabling command from EXEC modeCabling
/chassis #scope chassis command from EXEC modeChassis
/eth-server #scope eth-server command from EXEC
mode; this command and all subcommands
are currently not supported
Ethernet server domain
/eth-uplink #scope eth-uplink command from EXEC
mode
Ethernet uplink
/fabric-interconnect #scope fabric-interconnect command from
EXEC mode
Fabric interconnect
/firmware #scope firmware command from EXEC
mode
Firmware
Cisco Firepower 4100/9300 FXOS Command Reference
5
CLI Overview
Command Modes

Mode PromptCommands Used to AccessMode Name
/host-eth-if #scope host-eth-if command from EXEC
mode
This command and all
subcommands are not supported
at this level; the Host Ethernet
interface commands are available
in /adapter # mode.
Note
Host Ethernet interface
/license #scope license command from EXEC modeLicense
/monitoring #scope monitoring command from EXEC
mode
Monitoring
/org #scope org command from EXEC modeOrganization
/packet-capture #scope packet-capture command from
EXEC mode
Packet capture
/security #scope security command from EXEC modeSecurity
/server #scope server command from EXEC modeServer
/service-profile #scope service-profile command from EXEC
mode
Do not alter or configure service
profiles; that is, do not use the
create,set, or delete
subcommand sets.
Note
Service profile
/ssa #scope ssa command from EXEC modeSSA
/system #scope system command from EXEC modeSystem
/vhba #scope vhba command from EXEC mode
This command and all
subcommands are currently not
supported.
Note
Virtual HBA
/vnic #scope vnic command from EXEC modeVirtual NIC
Cisco Firepower 4100/9300 FXOS Command Reference
6
CLI Overview
Command Modes

Object Commands
Four general commands are available for object management:
•create object
•delete object
•enter object
•scope object
You can use the scope command with any managed object, whether a permanent object or a user-instantiated
object. The other commands allow you to create and manage user-instantiated objects. For every create object
command, a corresponding delete object and enter object command exists.
In the management of user-instantiated objects, the behavior of these commands depends on whether the
object exists, as described in the following tables:
Table 2: Command Behavior If The Object Does Not Exist
BehaviorCommand
The object is created and its configuration mode, if applicable, is entered.
create object
An error message is generated.
delete object
The object is created and its configuration mode, if applicable, is entered.
enter object
An error message is generated.
scope object
Table 3: Command Behavior If The Object Exists
BehaviorCommand
An error message is generated.
create object
The object is deleted.
delete object
The configuration mode, if applicable, of the object is entered.
enter object
The configuration mode of the object is entered.
scope object
Cisco Firepower 4100/9300 FXOS Command Reference
7
CLI Overview
Object Commands

Complete a Command
You can use the Tab key in any mode to complete a command. Partially typing a command name and pressing
Tab causes the command to be displayed in full or to the point where you must enter another keyword or an
argument value.
Cisco Firepower 4100/9300 FXOS Command Reference
8
CLI Overview
Complete a Command

Command History
The CLI stores all commands used in the current session. You can step through the previously used commands
by using the up-arrow or down-arrow keys. The up-arrow key moves to the previous command in the history,
and the down-arrow key moves to the next command in the history. When you get to the end of the history,
pressing the down-arrow key does nothing.
You can enter any command in the history again by stepping through the history to recall that command and
then pressing Enter. The command is entered as if you had manually typed it. You can also recall a command
and change it before you press Enter.
Cisco Firepower 4100/9300 FXOS Command Reference
9
CLI Overview
Command History

Commit, Discard, and View Pending Commands
When you enter a configuration command in the CLI, the command is not applied until you enter the
commit-buffer command. Until committed, a configuration command is pending and can be discarded by
entering a discard-buffer command.
You can accumulate pending changes in multiple command modes and apply them together with a single
commit-buffer command. You can view the pending commands by entering the show configuration pending
command in any command mode.
All pending commands are checked for validity. However, if any queued command fails during commit, the
remaining commands are applied; failed commands are reported in an error message.
Note
While any commands are pending, an asterisk (*) appears before the command prompt. The asterisk disappears
when you enter the commit-buffer command.
The following example shows how the prompts change during the command entry process:
Firepower# scope system
Firepower /system # scope services
Firepower /system/services # create ntp-server 192.168.200.101
Firepower /system/services* # show configuration pending
scope services
+ create ntp-server 192.168.200.101
exit
Firepower /system/services* # commit-buffer
Firepower /system/services #
Cisco Firepower 4100/9300 FXOS Command Reference
10
CLI Overview
Commit, Discard, and View Pending Commands

Inline Help for the CLI
At any time, you can enter the ?character to display the options available at the current state of the command
syntax.
If you have not entered anything at the prompt, entering ?lists all available commands for the mode you are
in. With a partially entered command, entering ?lists all keywords and arguments available at your current
position in the command syntax.
Cisco Firepower 4100/9300 FXOS Command Reference
11
CLI Overview
Inline Help for the CLI

CLI Session Limits
FXOS limits the number of CLI sessions that can be active at one time to 32 total sessions. This value is not
configurable.
Cisco Firepower 4100/9300 FXOS Command Reference
12
CLI Overview
CLI Session Limits

Filter and Save Show Output
•Save and Filter Show Command Output, on page 14
Cisco Firepower 4100/9300 FXOS Command Reference
13

Save and Filter Show Command Output
You can save the output of show commands by redirecting the output to a text file. You can filter the output
of show commands by piping the output to filtering commands.
Saving and filtering output are available with all show commands but are most useful when dealing with
commands that produce a lot of text.
Filter Show Command Output
To filter the output of a show command, use the following subcommands. Note that in the following syntax
description, the initial vertical bar |after the show command is the pipe character and is part of the command,
not part of the syntax description. The filtering options are entered after the command’s initial |character.
show command |{begin expression|count|cut expression|egrep expression|end expression|exclude
expression|grep expression|head|include expression|last|less|no-more|sort expression|tr
expression|uniq expression|wc}
Filtering Options
These are the filtering subcommands:
•begin—Finds the first line that includes the specified pattern, and display that line and all subsequent
lines.
•count—Counts the number of lines.
•cut—Removes (“cut”) portions of each line.
•egrep—Displays only those lines that match the extended-type pattern.
•end—Ends with the line that matches the pattern.
•exclude—Excludes all lines that match the pattern and show all other lines.
•grep—Displays only those lines that match the pattern.
•head—Displays the first lines.
•include—Displays only those lines that match the pattern.
•last—Displays the last lines.
•less—Filters for paging.
•no-more—Turns off pagination for command output.
•sort—Sorts the lines (stream sorter).
•tr—Translates, squeezes, and/or deletes characters.
•uniq—Discards all but one of successive identical lines.
•wc—Displays a count of lines, words, and characters.
expression
Cisco Firepower 4100/9300 FXOS Command Reference
14
Filter and Save Show Output
Save and Filter Show Command Output

An expression, or pattern, is typically a simple text string. Do not enclose the expression in single or
double-quotes—these will be seen as part of the expression. Also, trailing spaces will be included in the
expression.
Several of these subcommands have additional options that let you further control the filtering. For example,
with show configuration | head and show configuration | last, you can use the lines keyword to change the
number of lines displayed; the default is 10. As another example, with show configuration | sort, you can
add the option -u to remove duplicate lines from the output. (Complete descriptions of these options is beyond
the scope of this document; refer to the FXOS help output for the various commands, and to the appropriate
Linux help, for more information.)
Note
Examples
The following example shows how to determine the number of lines currently in the system event log:
FP9300-A# show sel 1/1 | count
3008
FP9300-A#
The following example shows how to display lines from the system event log that include the string “error”:
FP9300-A# show sel 1/1 | include error
968 | 05/15/2016 16:46:25 | CIMC | System Event DDR4_P2_H2_EC
C #0x99 | Upper critical - going high | Asserted | Reading 20
000 >= Threshold 20000 error
FP9300-A#
Related Topics
Save Show Command Output, on page 15
Save Show Command Output
You can save the output of show commands by redirecting the output to a text file.
show command [>{ftp:|scp:|sftp:|tftp:|volatile: |workspace:}]|[ >> {volatile: |workspace:}]
Syntax Description Redirects the show command output to a specified text file
using the selected transport protocol.
After you enter the command, you are queried for remote
server name or IP address, user name, file path, and so on.
If you press Enter at this point, the output is saved locally.
>{ftp:|scp:|sftp:|tftp:|volatile:
|workspace:}
Appends the show command output to the appropriate text
file, which must already exist.
>> {volatile: |workspace:}
Example
The following example attempts to save the current configuration to the system workspace; a configuration
file already exists, which you can choose to overwrite or not.
Cisco Firepower 4100/9300 FXOS Command Reference
15
Filter and Save Show Output
Save Show Command Output

FP9300-A# show configuration > workspace
File already exists, overwrite (y/n)?[n]n
Reissue command with >> if you want to append to existing file
FP9300-A#
Related Topics
Filter Show Command Output, on page 14
Cisco Firepower 4100/9300 FXOS Command Reference
16
Filter and Save Show Output
Save Show Command Output

Unsupported and Restricted Commands
•Unsupported Commands, on page 18
•Restricted Commands, on page 22
Cisco Firepower 4100/9300 FXOS Command Reference
17

Unsupported Commands
The following commands, while visible in the CLI, are not supported. Entering any of these commands has
no effect.
EXEC (Top-level) Commands
#restore-check
#scope eth-server (and all subcommands)
#scope host-eth-if (the host-eth-if subcommands are available in /adapter mode)
#scope nh-test (and all subcommands)
#set nh-test
#show nh-test
#show registry-repository
#show ucspe-tech-support
#ucspe-copy
#vhba (and all subcommands)
Chassis Mode Commands
/chassis # scope iom
/chassis # show iom
/chassis # show post
Fabric Interconnect Mode Commands
/fabric-interconnect # scope fan
/fabric-interconnect # scope fan-module
/fabric-interconnect # scope psu
/fabric-interconnect # scope sw-uplink
/fabric-interconnect # show fan
/fabric-interconnect # show fan-module
/fabric-interconnect # show lan-neighbors
/fabric-interconnect # show psu
/fabric-interconnect # show san-neighbors
/fabric-interconnect # show sw-uplink
Organization Mode Commands
/org # scope auth-profile
Cisco Firepower 4100/9300 FXOS Command Reference
18
Unsupported and Restricted Commands
Unsupported Commands