topic Cisco ASA 8.6.1 Shape Command Invalid in Network Security

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Mon, 11 Mar 2019 23:29:34 GMT

Tried setting up a Shape Policy and it states its invalid. Worked fine on my 5520, just curious if anyone else might know why its coming as invalid now

ciscoasa(config-pmap-c)# shape

ERROR: % Invalid input detected at '^' marker.

ciscoasa(config-pmap-c)# shape ?

ERROR: % Unrecognized command

Re: Cisco ASA 8.6.1 Shape Command Invalid

Karsten Iwen — Wed, 11 Jul 2012 06:34:48 GMT

Are you in the class-default while you try to apply shaping? It's only supported in that class.

Sent from Cisco Technical Support iPad App

Re: Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Wed, 11 Jul 2012 11:18:33 GMT

100% sure, this is on asa 8.6.1

ciscoasa(config)# policy-map shaper
ciscoasa(config-pmap)# policy-map shaper
ciscoasa(config-pmap)# class class-default
ciscoasa(config-pmap-c)# ?

MPF policy-map class configuration commands:
exit             Exit from MPF class action configuration mode
help             Help for MPF policy-map class/match submode commands
no               Negate or set default values of a command
police           Rate limit traffic for this class
priority         Strict scheduling priority for this class
quit             Exit from MPF class action configuration mode
set              Set connection values
user-statistics configure user statistics for identity firewall

csc              Content Security and Control service module
flow-export      Configure filters for NetFlow events
inspect          Protocol inspection services
ips              Intrusion prevention services
ciscoasa(config-pmap-c)# shape average ?
ERROR: % Unrecognized command
ciscoasa(config-pmap-c)# shape average
                           ^
ERROR: % Invalid input detected at '^' marker.
ciscoasa(config-pmap-c)#

The downfall here for me is that I need to use shape for outgoing traffic and limit it, the connect speed with the fiber box is 100Mbit, police polocy doesnt work, using police people downloading off the FTP server get under 1KB per second (Acts like a duplex issue), using shaper always made it work perfect by limiting the upload to 60MBit

Re: Cisco ASA 8.6.1 Shape Command Invalid

Karsten Iwen — Wed, 11 Jul 2012 13:18:37 GMT

Strange, the shaper is documented not to work on the ASA 5580, but you probably have one of the newer ASA 5500-X. I'm not aware of any more restrictions there. Perhaps someone at Cisco can take over ...

Re: Cisco ASA 8.6.1 Shape Command Invalid

Ramraj Sivagnanam Sivajanam — Mon, 23 Jul 2012 04:22:34 GMT

Hi Bro

Based on the Cisco's Configuration Guide, this should work. http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html#wp1112081

By any chance, is your Cisco ASA FW running in multiple context mode or transparent firewall mode?

Cisco ASA 8.6.1 Shape Command Invalid

shellstorm — Tue, 18 Sep 2012 14:44:37 GMT

Same problem here.

I use an ASA 5545, routed and single context mode.

According to documentation that feature should be supported.

I follow the documentation (use class-default) and i cannot define a shaping policy.

Is it a bug ? Does a software upgrade is needed to fix the problem ? I actually use :

asamaster# show version

Cisco Adaptive Security Appliance Software Version 8.6(1)2

Device Manager Version 6.6(1)

Compiled on Fri 01-Jun-12 02:16 by builders

System image file is "disk0:/asa861-2-smp-k8.bin"

Any help would be very appreciated

Cisco ASA 8.6.1 Shape Command Invalid

Craig Sposito — Fri, 28 Sep 2012 04:53:20 GMT

I am actually having the same issue with my ASA 5515X. The shape command just seems to be missing. Has anyone contacted Cisco yet about this issue?

Cisco Adaptive Security Appliance Software Version 8.6(1)

Device Manager Version 6.6(1)

Compiled on Fri 18-Nov-11 21:21 by builders

System image file is "disk0:/asa861-smp-k8.bin"

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Fri, 28 Sep 2012 11:35:11 GMT

Theres a bug opened on it, just waiting for a reply. I currently use the Police Method as a work around

Cisco ASA 8.6.1 Shape Command Invalid

Hytrust NetworkAdmin — Mon, 15 Oct 2012 23:02:35 GMT

Same problem with ASA5515 running 8.6.1. Command appears not present. Ethan, what did Cisco suggest to workaround/solve the issue? Thanks.

Cisco ASA 8.6.1 Shape Command Invalid

Miguel Angel Tipte Apari — Thu, 06 Dec 2012 02:11:03 GMT

Parece que es un bug de la version 8.6.1 actualizar a la version 9.

Cisco Adaptive Security Appliance Software Version 9.0(1)

FW-5510(config)# policy-map shape

FW-5510(config-pmap)# class class-default

FW-5510(config-pmap-c)# ?

MPF policy-map class configuration commands:

exit Exit from MPF class action configuration mode

help Help for MPF policy-map class/match submode commands

no Negate or set default values of a command

police Rate limit traffic for this class

priority Strict scheduling priority for this class

quit Exit from MPF class action configuration mode

service-policy Configure QoS Service Policy

set Set connection values

shape Traffic Shaping

user-statistics configure user statistics for identity firewall

csc Content Security and Control service module

flow-export Configure filters for NetFlow events

inspect Protocol inspection services

ips Intrusion prevention services

FW-5510(config-pmap-c)#

FW-5510(config-pmap-c)# shape average ?

mpf-policy-map-class mode commands/options:

<64000-154400000> Target Bit Rate (bits per second), the value needs to be

multiple of 8000

FW-5510(config-pmap-c)# shape average

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Tue, 11 Dec 2012 12:54:52 GMT

Nothing, your left using the Police Command, however in my case I setup a router to do outbound Shaping.

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Tue, 11 Dec 2012 12:55:40 GMT

I already know how to setup a shape command, problem is on the newer -X firewalls the commands isnt present for some reason, on my 5510 and 5520 its there

Cisco ASA 8.6.1 Shape Command Invalid

feene1 — Fri, 19 Jul 2013 15:50:30 GMT

Shaping is not supported on newer X ASAs. We need to know if this is going to be on the roadmap. Shaping is pretty vital.

Cisco ASA 8.6.1 Shape Command Invalid

aaron.storey — Fri, 30 Aug 2013 14:47:29 GMT

I'm running into the same issue on the newer ASAs. Not sure why the shaping command is missing or removed, but it needs to be available, especially for sub-rate ethernet connections.

Cisco ASA 8.6.1 Shape Command Invalid

feene1 — Fri, 30 Aug 2013 14:55:45 GMT

Same situation we are seeing. 50Mbps Ethernet DIA and PTP connections with no shaping. I dont want to have to spend even more money for a switch or router to provide the shaping. Unacceptable.

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Fri, 30 Aug 2013 14:57:41 GMT

I already have an open ticket with engineering, at least I'm told I do lol

Yeah ended up doing it with the router infront of the firewall to handle things with a shaper policy

Cisco ASA 8.6.1 Shape Command Invalid

Harvey Ortiz — Sat, 31 Aug 2013 04:44:45 GMT

Hi Ethan,

Please check this link:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html#wp1234392

Regards,

Harvey

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Sat, 18 Jan 2014 03:39:15 GMT

That works fine on the old ASAs, not on the new ones. Other people have reported the same issue and a bug was opened.

Cisco ASA 8.6.1 Shape Command Invalid

feene1 — Wed, 22 Jan 2014 18:35:52 GMT

Cisco,

Is shaping on the roadmap for the "Next Gen" ASAs?

Cisco ASA 8.6.1 Shape Command Invalid

TechDude — Sun, 26 Jan 2014 03:36:28 GMT

Its still an open bug so not sure, youd think theyd add that by now