show uauth
To display one or all currently authenticated users, the host IP to which they are bound, and any cached IP and port authorization information, use the show uauth command in privileged EXEC mode.
show uauth [ username ]
Syntax Description
|
username |
(Optional) Specifies, by username, the user authentication and authorization information to display. |
Command Default
Omitting username displays the authorization information for all users.
Command Modes
The following table shows the modes in which you can enter the command:
|
Command Mode |
Firewall Mode |
Security Context |
|||
|---|---|---|---|---|---|
|
Routed |
Transparent |
Single |
Multiple |
||
|
Context |
System |
||||
|
Privileged EXEC |
|
|
— |
— |
|
Command History
|
Release |
Modification |
|---|---|
|
7.0(1) |
This command was added. |
|
7.2(1) |
The idle time was added to the output. |
|
7.2(2) |
The idle time was removed from the output. |
Usage Guidelines
The show uauth command displays the AAA authorization and authentication caches for one user or for all users.
This command is used with the timeout command.
Each user host IP address has an authorization cache attached to it. The cache allows up to 16 address and service pairs for each user host. If the user attempts to access a service that has been cached from the correct host, the ASA considers it preauthorized and immediately proxies the connection. Once you are authorized to access a website, for example, the authorization server is not contacted for each image as it is loaded (assuming the images come from the same IP address). This process significantly increases performance and reduces the load on the authorization server.
The output from the show uauth command displays the username that is provided to the authorization server for authentication and authorization purposes, the IP address to which the username is bound, and if the user is authenticated only or has cached services.
 Note |
When you enable Xauth, an entry is added to the uauth table (as shown by the show uauth command) for the IP address that is assigned to the client. However, when using Xauth with the Easy VPN Remote feature in Network Extension Mode, the IPsec tunnel is created from network to network, so that the users behind the firewall cannot be associated with a single IP address. For this reason, a uauth entry cannot be created upon completion of Xauth. If AAA authorization or accounting services are required, you can enable the AAA authentication proxy to authenticate users behind the firewall. For more information on AAA authentication proxies, see to the aaa commands. |
Use the timeout uauth command to specify how long the cache should be kept after the user connections become idle. Use the clear uauth command to delete all the authorization caches for all the users, which will cause them to have to reauthenticate the next time that they create a connection.
Examples
This example shows sample output from the show uauth command when no users are authenticated and one user authentication is in progress:
ciscoasa(config)# show uauth
Current Most Seen
Authenticated Users 1 1
Authen In Progress 0 1
user 'v039294' at 136.131.178.4, authenticated (idle for 0:00:00)
access-list #ACSACL#-IP-v039294-521b0b8b (*)
absolute timeout: 0:00:00
inactivity timeout: 0:05:00
This example shows sample output from the show uauth command when three users are authenticated and authorized to use services through the ASA:
ciscoasa(config)# show uauth
user ‘pat’ from 209.165.201.2 authenticated
user ‘robin’ from 209.165.201.4 authorized to:
port 192.168.67.34/telnet 192.168.67.11/http 192.168.67.33/tcp/8001
192.168.67.56/tcp/25 192.168.67.42/ftp
user ‘terry’ from 209.165.201.7 authorized to:
port 192.168.1.50/http 209.165.201.8/http
Feedback