![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241691.webp)
1-57
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
To delete all default domain names, enter the
no default-domain
command without arguments. This
command deletes all configured default domain names, including a null list if you created one by
entering the
default-domain
command with the
none
keyword. The
no
form allows inheriting a domain
name.
The following example shows how to set a default domain name of FirstDomain for the group policy
named
FirstGroup:
hostname(config)#
group-policy FirstGroup attributes
hostname(config-group-policy)#
default-domain value FirstDomain
Defining a List of Domains for Split Tunneling
Enter a list of domains to be resolved through the split tunnel. Enter the
split-dns
command in
group-policy configuration mode. To delete a list, enter the
no
form of this command.
When there are no split tunneling domain lists, users inherit any that exist in the default group policy.
To prevent users from inheriting such split tunneling domain lists, enter the
split-dns
command with the
none
keyword.
To delete all split tunneling domain lists, enter the
no split-dns
command without arguments. This
deletes all configured split tunneling domain lists, including a null list created by issuing the
split-dns
command with the
none
keyword.
The parameter
value
domain-name
provides a domain name that the ASA resolves through the split
tunnel. The
none
keyword indicates that there is no split DNS list. It also sets a split DNS list with a null
value, thereby disallowing a split DNS list, and prevents inheriting a split DNS list from a default or
specified group policy. The syntax of the command is as follows:
hostname(config-group-policy)#
split-dns
{
value
domain-name1
[
domain-name2...
domain-nameN
] |
none
}
hostname(config-group-policy)#
no split-dns
[
domain-name domain-name2 domain-nameN
]
Enter a single space to separate each entry in the list of domains. There is no limit on the number of
entries, but the entire string can be no longer than 255 characters. You can use only alphanumeric
characters, hyphens (-), and periods (.). If the default domain name is to be resolved through the tunnel,
you must explicitly include that name in this list.
The following example shows how to configure the domains Domain1, Domain2, Domain3, and
Domain4 to be resolved through split tunneling for the group policy named
FirstGroup:
hostname(config)#
group-policy FirstGroup attributes
hostname(config-group-policy)#
split-dns value Domain1 Domain2 Domain3 Domain4
Configuring DHCP Intercept
A Microsoft XP anomaly results in the corruption of domain names if split tunnel options exceed 255
bytes. To avoid this problem, the ASA limits the number of routes it sends to 27 to 40 routes, with the
number of routes dependent on the classes of the routes.
DHCP Intercept lets Microsoft Windows XP clients use split-tunneling with the ASA. The ASA replies
directly to the Microsoft Windows XP client DHCP Inform message, providing that client with the
subnet mask, domain name, and classless static routes for the tunnel IP address. For Windows clients
prior to Windows XP, DHCP Intercept provides the domain name and subnet mask. This is useful in
environments in which using a DHCP server is not advantageous.
The
intercept-dhcp
command enables or disables DHCP intercept.
hostname(config-group-policy)#
intercept-dhcp
netmask
{
enable | disable
}
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......