Release Notes for Cisco 6400 for Cisco IOS Release 12.2(4)B6
Available Languages
Table Of Contents
Release Notes for Cisco 6400 for Cisco IOS Release 12.2(4)B6
Determining the Software Version
Upgrading to a New Software Release
New Hardware Features Supported in Release 12.2(4)B6
New Software Features Supported in Release 12.2(4)B6
New Hardware Features Supported in Release 12.2(4)B5
New Software Features Supported in Release 12.2(4)B5
New Hardware Features Supported in Release 12.2(4)B3
New Software Features Supported in Release 12.2(4)B3
DHCP Relay Support for MPLS VPN Suboptions
Encrypted and Tagged VSA Support for RADIUS Attribute 91
Enhancements to DHCP Option 82 Support for RBE
Enhancements to RADIUS VC Logging
Extended Support for RADIUS Attribute 32
PPPoE over Ethernet (FE for NRP-1)
PPPoE over Gigabit Ethernet (GE for NRP-2SV Only)
RADIUS-Based Session/Idle Timeout for LAC
SSG Accounting Update Interval per Service
SSG AutoLogon Using Proxy RADIUS
SSG Support for MAC Addresses in Accounting Records
SSG TCP Redirect for Services (Phase 2)
Support for RADIUS Attributes 52 and 53
Support for RADIUS Attribute 77
New Hardware Features Supported in Release 12.2(2)B5
New Software Features Supported in Release 12.2(2)B5
New Hardware Features Supported in Release 12.2(2)B4
New Software Features Supported in Release 12.2(2)B4
New Hardware Features Supported in Release 12.2(2)B3
New Software Features Supported in Release 12.2(2)B3
New Hardware Features Supported in Release 12.2(2)B2
New Software Features Supported in Release 12.2(2)B2
Upgrading from Cisco IOS Release 12.2(2)B to Cisco IOS Release 12.2(4)B6
Session and Tunnel Scalability
NRP-2SV Scalability Tuning Parameters
NRP-1 Scalability Tuning Parameters
Open Caveats—Release 12.2(4)B6
Closed and Resolved Caveats—Release 12.2(4)B6
Open Caveats—Release 12.2(4)B5
Closed and Resolved Caveats—Release 12.2(4)B5
Open Caveats—Release 12.2(4)B3
Closed and Resolved Caveats—Release 12.2(4)B3
Open Caveats—Release 12.2(2)B5
Closed or Resolved Caveats—Release 12.2(2)B5
Open Caveats—Release 12.2(2)B4
Closed or Resolved Caveats—Release 12.2(2)B4
Open Caveats—Release 12.2(2)B3
Closed or Resolved Caveats—Release 12.2(2)B3
Open Caveats—Release 12.2(2)B2
Closed and Resolved Caveats—Release 12.2(2)B2
Cisco IOS Release 12.2 Documentation Set
Obtaining Technical Assistance
Release Notes for Cisco 6400 for Cisco IOS Release 12.2(4)B6
October 2002
Cisco IOS Release 12.2(4)B6
OL-2951-02
These release notes for the Cisco 6400 Carrier-Class Broadband Aggregator describe the enhancements provided in Cisco IOS Release 12.2(4)B6. These release notes are updated as needed.
For a list of the software caveats that apply to Cisco IOS Release 12.2(4)B6, see the "Software Caveats" section, and Caveats for Cisco IOS Release 12.2T. The caveats document is updated for every maintenance release and is located on Cisco.com and the Documentation CD-ROM.
Contents
These release notes describe the following topics:
•
Obtaining Technical Assistance
System Requirements
This section describes the system requirements for Cisco IOS Release 12.2(4)B6 and includes the following sections:
•
•
Memory Recommendations
Table 1 lists the memory recommendations for the Cisco 6400.
Table 1 Memory Recommendations for the Cisco 6400
NRP
Boot image
c6400r-boot-mz
—
—
NRP-2 and NRP-2SV
IOS NRP-2 base
IOS NRP-2 mutlidomain
IOS NRP-2 web selectionc6400r2sp-g4p5-mz
256 MB for up to 6500 sessions.
512 MB for over 6500 sessions.
—
NRP-1
IOS NRP-1 base
IOS NRP-1 multidomain
IOS NRP-1 web selectionc6400r-g4p5-mz
64 MB for up to 750 sessions.
128 MB for over 750 sessions.
8 MB
NSP
c6400s-wp-mz
c6400s-html.tarThe standard 64 MB DRAM memory configuration supports up to 12K virtual circuits (VCs).
128 MB DRAM is recommended for supporting up to 32K VCs or for using ATM RMON or ATM Accounting.
128 MB DRAM is also recommended if you are upgrading from an earlier release to Cisco IOS Release 12.1(5)DB.20 MB or 32 MB 1
350 MB recommended for NRP-2 configurations
1 The 20-MB Flash disk is no longer available; the 32-MB Flash disk is now the default Flash configuration.
Note
Note
Note
Supported Hardware
Cisco IOS Release 12.2(4)B6 supports the Cisco 6400 NRP-1, NRP-2, NRP-2SV, NSP, and NSP-S3B modules. The NSP-S3B, otherwise identical to the NSP, is required if you want to use the Building Integrated Timing Supply (BITS) Network Clocking software feature.
Software Compatibility
For NRP-Service Selection Gateway (SSG) users, Cisco IOS Release 12.2(4)B6 works with the Cisco Service Selection Dashboard (SSD) Releases 2.5(1) and 3.0(1), and Subscriber Edge Services Manager (SESM) Release 3.1(1).
Determining the Software Version
To determine the version of Cisco IOS software currently running on the Cisco 6400 NRP, log in to the NRP and enter the show version EXEC command:
Router> show versionCisco Internetwork Operating System SoftwareIOS (tm) C6400R Software (C6400R-G4P5-M), Version 12.2(4)B6To determine the version of Cisco IOS software currently running on the Cisco 6400 NSP, log in to the NSP and enter the show version EXEC command:
Router> show versionCisco Internetwork Operating System SoftwareIOS (tm) C6400 Software (C6400S-WP-M), Version 12.2(4)B6The output from these commands includes additional information, including processor revision numbers, memory amounts, hardware IDs, and partition information.
Upgrading to a New Software Release
For information about upgrading software on the Cisco 6400, including upgrading a single- or dual-NRP system to a new software release, see the Cisco 6400 Software Setup Guide located at
http://www.cisco.com/univercd/cc/td/doc/product/dsl_prod/6400/sw_setup/index.htmFor general information about upgrading to a new software release, see the product bulletin Cisco IOS Upgrade Ordering Instructions located at
http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/957_pp.htmIf you do not have an account on Cisco.com and want general information about upgrading to a new software release, see the product bulletin Cisco IOS Software Release 11.3 Upgrade Paths and Packaging Simplification (#703: 12/97) on Cisco.com at:
Technical Documents > Product Bulletins > Software > Cisco IOS 11.3 >
Cisco IOS Software Release 11.3 Upgrade Paths No. 703Feature Set Tables
The Cisco IOS software is packaged in software images. Each image contains a set of Cisco IOS features.
Table 2 lists the features supported by the Cisco 6400 NRP images in this release. Table 3 lists the features supported by the Cisco 6400 NSP images in this release. These tables also include features supported by earlier releases.
Note
Table 2 Features Supported by the Cisco 6400 NRP in Cisco IOS Release 12.2(4)B6
Enhancements to DHCP Option 82 Support for RBE
12.2(4)B3
12.2(4)B3
12.2(4)B3
Integrated Routing and Bridging (IRB)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Multilink Point-to-Point Protocol (MLPPP or MLP)
12.1(3)DC
12.1(4)DC
12.2(2)B1
Per-VC1 Traffic Shaping
12.0(3)DC
—
12.2(2)B1
12.0(5)DC
12.1(4)DC
12.2(2)B1
PPPoE over Ethernet (FE4 for NRP-1)
12.2(4)B3
—
—
PPPoE over Ethernet (GE for NRP-2SV only)
—
—
12.2(4)B3
PPP over ATM5 (PPPoA) Terminated
12.0(3)DC
12.1(4)DC
12.2(2)B1
PPP over Ethernet (PPPoE) Terminated
12.0(3)DC
12.1(4)DC
12.2(2)B1
PPPoEoE with VLAN
12.2(4)B3
—
12.2(4)B3
PPPoA/PPPoE Autosense on ATM VC with SNAP6 Encapsulation
12.1(1)DC
12.1(5)DC
12.2(2)B1
Remote Access into MPLS VPN
12.2(2)B
—
—
Routed Bridge Encapsulation (RBE)
12.0(5)DC
12.1(4)DC
12.2(2)B1
RBE Subinterface Grouping
12.1(4)DC
12.1(4)DC
12.2(2)B1
RBE Unnumbered DHCP7
12.1(1)DC
12.1(4)DC
12.2(2)B1
RBE with DHCP
12.0(5)DC
12.1(4)DC
12.2(2)B1
RBE with DHCP Option 82
12.1(5)DC
12.1(5)DC
12.2(2)B1
RFC 1483 Bridging
12.0(3)DC
12.1(4)DC
12.2(2)B1
RFC 1483 Routing
12.0(3)DC
12.1(4)DC
12.2(2)B1
DHCP Relay Support for MPLS VPN Suboptions
12.2(4)B3
12.2(4)B3
12.2(4)B3
IP8 Overlapping Address Pools (OAP)
12.1(5)DC
Not yet supported
Not yet supported
L2TP9 Multi-Hop
12.1(1)DC
12.1(4)DC
12.2(2)B1
L2TP Tunnel Service Authorization Enhancement
12.1(1)DC
12.1(4)DC
12.2(2)B1
L2TP Tunnel Sharing
12.1(1)DC
12.1(4)DC
12.2(2)B1
L2TP Tunnel Switching10
12.1(1)DC
12.1(4)DC
12.2(2)B1
MPLS11 Edge Label Switch Router (Edge LSR)
12.0(7)DC
Not yet supported
Not yet supported
MPLS Label Distribution Protocol
12.2(2)B
12.2(2)B
12.2(2)B1
MPLS Label Switch Controller (LSC) for BPX
12.0(7)DC
Not yet supported
Not yet supported
MPLS VPNs12
12.0(7)DC
12.2(2)B
12.2(2)B1
MPLS VPN ID
12.2(4)B3
12.2(4)B3
12.2(4)B3
PPPoA Tunneled into L2TP
12.0(5)DC
12.1(4)DC
12.2(2)B1
PPPoE Tunneled into L2TP
12.0(5)DC
12.1(4)DC
12.2(2)B1
Remote Access into MPLS VPN
12.1(5)DC
Not yet supported
Not yet supported
RFC 1577
12.0(3)DC
12.1(4)DC
12.2(2)B1
Session Limit per VRF
12.2(4)B3
12.2(4)B3
12.2(4)B3
12.0(3)DC
12.1(4)DC
12.2(2)B1
VLAN (802.1q) on NRP-2 GE15
—
12.1(5)DC
12.2(2)B1
ATM OAM Ping
12.2(4)B3
12.2(4)B3
12.2(4)B3
ATM PVC16 Range Command
12.1(4)DC
12.1(4)DC
12.2(2)B1
Per VC Error Display
12.1(3)DC
12.1(5)DC
12.2(2)B1
ATM (OC-3, OC-12, DS3) Interfaces
12.0(3)DC
12.1(4)DC
12.2(2)B1
FE Interface: 10/100 Auto-negotiation, Auto-sensing
12.0(3)DC
—
—
GE Interface
—
12.1(5)DC
12.2(2)B1
Network Management Ethernet (NME)
12.0(5)DC
12.1(4)DC
12.2(2)B1
NRP 1+1 Redundancy
12.0(3)DC
Not yet supported
Not yet supported
Address Resolution Protocol (ARP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Border Gateway Protocol Version 4 (BGP4)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Enhanced Interior Gateway Routing Protocol (EIGRP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Generic Routing Encapsulation (GRE)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Internet Group Management Protocol (IGMP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Internet Protocol (IP) Forwarding
12.0(3)DC
12.1(4)DC
12.2(2)B1
IP Multicast
12.0(3)DC
12.1(4)DC
12.2(2)B1
IP QoS—Policing, Marking, and Classification
12.2(2)B
12.2(2)B
12.2(2)B1
Intermediate System-to-Intermediate System (IS-IS)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Network Address Translation (NAT) Support for NetMeeting Directory
12.0(3)DC
12.1(4)DC
12.2(2)B1
NetFlow for RFC1483 into MPLS VPN
12.1(5)DC
Not yet supported
Not yet supported
Open Shortest Path First (OSPF)
12.0(3)DC
12.1(4)DC
12.2(2)B1
PIM17 Dense Mode and Sparse Mode
12.0(3)DC
12.1(4)DC
12.2(2)B1
Routing Information Protocol (RIP)/RIP v2
12.0(3)DC
12.1(4)DC
12.2(2)B1
Transmission Control Protocol (TCP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Telnet
12.0(3)DC
12.1(4)DC
12.2(2)B1
Trivial File Transfer Protocol (TFTP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Transparent Bridging
12.0(3)DC
12.1(4)DC
12.2(2)B1
User Datagram Protocol (UDP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Web Cache Coordination Protocol (WCCP) Version 1
12.0(3)DC
12.1(4)DC
12.2(2)B1
WCCP (v2)
12.0(7)DC
12.1(4)DC
12.2(2)B1
IP QoS Dynamic Bandwidth Selection: IP Policing/Marking via CAR
12.2(2)B
12.2(2)B
12.2(2)B1
PPPoE Session Count MIB
12.2(2)B
12.2(2)B
12.2(2)B1
NRP: QoS
Simple Network Management Protocol (SNMP) (v1, v2, and v3)
12.0(3)DC
12.1(4)DC
12.2(2)B1
SNMPv3 Proxy Forwarder
—
12.1(4)DC
12.2(2)B1
Encrypted and Tagged VSA Support for RADIUS Attribute 91
12.2(4)B3
12.2(4)B3
12.2(4)B3
Enhancements to RADIUS VC Logging
12.2(4)B3
12.2(4)B3
12.2(4)B3
Extended Support for RADIUS Attribute 32
12.2(4)B3
12.2(4)B3
12.2(4)B3
Framed Route VRF Aware
12.2(4)B3
12.2(4)B3
12.2(4)B3
Password Authentication Protocol (PAP)/Challenge Handshake Authentication Protocol (CHAP)
12.0(3)DC
12.1(4)DC
12.2(2)B1
Per VRF AAA
12.2(4)B3
12.2(4)B3
12.2(4)B3
Remote Authentication Dial-In User Service (RADIUS)
12.0(3)DC
12.1(4)DC
12.2(2)B1
RADIUS Attribute 8 (Framed-IP-Address) in Access Requests (IP Hint)
12.1(3)DC
12.1(4)DC
12.2(2)B1
RADIUS-based Session/Idle Timeout for LAC
12.2(4)B3
12.2(4)B3
12.2(4)B3
Support for RADIUS Attribute 77
12.2(4)B3
12.2(4)B3
12.2(4)B3
Support for RADIUS Attributes 52 and 53
12.2(4)B3
12.2(4)B3
12.2(4)B3
Terminal Access Controller Access Control System Plus (TACACS+) (admin login only)
12.0(3)DC
12.1(4)DC
12.2(2)B1
12.0(3)DC
12.1(5)DC
12.2(2)B1
VPI/VCI in RADIUS Request and RADIUS Accounting for PPPoE
12.1(1)DC
12.1(5)DC
12.2(2)B1
GRE Cisco Express Forwarding (CEF)
12.1(1)DC
12.1(5)DC
12.2(2)B1
LAC20 CEF Switching
12.1(3)DC
12.1(4)DC
12.2(2)B1
L2TP Sessions per Tunnel Limiting
12.1(1)DC
12.1(4)DC
12.2(2)B1
NAT CEF Switching
12.1(1)DC
12.1(4)DC
12.2(2)B1
Per VC Buffer Management
12.1(1)DC
12.1(4)DC
12.2(2)B1
PPPoA CEF
12.1(1)DC
12.1(4)DC
12.2(2)B1
PPPoE Fast Switching for Multicast
12.1(1)DC
12.1(5)DC
12.2(2)B1
RBE CEF Switching
12.1(5)DC
12.1(5)DC
12.2(2)B1
PPP Aggregation Termination over Multiple Domains (PTA-MD)
12.0(3)DC
12.1(4)DC
12.2(2)B1
RADIUS Interim Accounting
12.0(5)DC
12.1(4)DC
12.2(2)B1
SSG AAA Server Group for Proxy RADIUS
12.2(2)B
12.2(2)B
12.2(2)B1
SSG Accounting Update Interval Per Service
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG AutoDomain
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG Auto Logoff
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG Autologon Using Proxy RADIUS
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG Automatic Service Logon
12.0(3)DC
12.1(4)DC
12.2(2)B1
SSG CEF Switching
12.0(5)DC
12.1(4)DC
12.2(2)B1
SSG Default Network
12.0(3)DC
12.1(4)DC
12.2(2)B1
SSG DNS21 Fault Tolerance
12.0(3)DC
12.1(4)DC
12.2(2)B1
SSG Enable (default is disabled)
12.0(7)DC
12.1(4)DC
12.2(2)B1
SSG Full Username RADIUS Attribute
12.1(3)DC
12.1(4)DC
12.2(2)B1
SSG Hierarchical Policing
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG Host Key
12.2(2)B
12.2(2)B
12.2(2)B1
SSG HTTP22 Redirect (Phase 1)
12.1(5)DC
12.1(5)DC
12.2(2)B1
SSG Cisco IOS NAT Support
12.0(5)DC
12.1(4)DC
12.2(2)B1
SSG Local Forwarding
12.1(1)DC
12.1(5)DC
12.2(2)B1
SSG Open Garden
12.2(2)B1
12.2(2)B1
12.2(2)B1
SSG Passthrough and Proxy Service
12.0(3)DC
12.1(4)DC
12.2(2)B1
SSG Prepaid Billing
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG Sequential and Concurrent Service
12.0(3)DC
12.1(4)DC
12.2(2)B1
SSG Service Defined Cookie
12.1(3)DC
12.1(4)DC
12.2(2)B1
SSG Single Host Logon
12.1(3)DC
12.1(4)DC
12.2(2)B1
SSG Support for MAC Addresses in Accounting Records
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG TCP Redirect for Services (Phase 2)
12.2(4)B3
12.2(4)B3
12.2(4)B3
SSG with GRE
12.0(3)DC
12.1(5)DC
12.2(2)B1
SSG with Multicast
12.0(3)DC
12.1(4)DC
12.2(2)B1
SSG with L2TP Service Type
12.0(7)DC
12.1(4)DC
12.2(2)B1
TCP Redirect—Logon
12.1(5)DC
12.1(5)DC
12.2(2)B1
VPI/VCI Static Binding to a Service Profile
12.0(5)DC
12.1(4)DC
12.2(2)B1
WebSelection
12.0(3)DC
12.1(4)DC
12.2(2)B1
Segmentation and Reassembly Buffer Management Enhancements
12.1(1)DC
—
—
Session Scalability Enhancements
12.1(1)DC
12.1(4)DC
12.2(2)B1
1 VC = virtual circuit.
2 PPP = Point-to-Point Protocol.
3 IPCP = Internet Protocol Control Protocol.
4 FE = Fast Ethernet.
5 ATM = Asynchronous Transfer Mode.
6 SNAP = Subnetwork Access Protocol.
7 DHCP = Dynamic Host Configuration Protocol.
8 IP = Internet Protocol.
9 L2TP = Layer 2 Tunneling Protocol.
10 In Cisco IOS Release 12.1(5)DC, L2TP tunnel switching for the NRP-2 has been tested and is supported at the same session and tunnel levels as the NRP-1. For more information, see Table 6.
11 MPLS = Multiprotocol Label Switching.
12 VPN = Virtual Private Network.
13 VLAN = Virtual LAN.
14 ISL = Inter-Switch Link.
15 GE = Gigabit Ethernet.
16 PVC = permanent virtual circuit.
17 PIM = Protocol Independent Multicast.
18 VPI = virtual path identi fier.
19 VCI = virtual channel identifier.
20 LAC = L2TP Access Concentrator.
21 DNS = Domain Name System.
22 HTTP = Hypertext Transfer Protocol.
The Cisco IOS software is packaged in software images. Each image contains a specific set of Cisco IOS features. Table 3 lists the features supported by the Cisco 6400 NSP image called c6400s-wp-mz in Cisco IOS Release 12.2(4)B6. The table indicates the release in which each feature was originally introduced. All features supported in previous releases are included in Release 12.2(4)B6.
Note
Table 3 Features Supported by the Cisco 6400 NSP in Cisco IOS Release 12.2(4)B6
F4 and F5 Operation, Administration, and Maintenance (OAM) Cell Segment and End-to-End Flows
12.0(4)DB
Hierarchical Virtual Private (VP) Tunnels
12.0(4)DB
Logical Multicast Support (up to 254 leaves per output port, per point-to-multipoint virtual circuits)
12.0(4)DB
Multipoint-to-Point User-Network Interface (UNI) Signaling
12.0(4)DB
Point-to-Point and Point-to-Multipoint VCs
12.0(4)DB
Permanent Virtual Circuit (PVC), Soft PVC, Soft Permanent Virtual Path (PVP), and Switched Virtual Circuit (SVC)
12.0(4)DB
Soft Virtual Channel Connections (VCCs) and Virtual Path Connections (VPCs)
12.0(4)DB
VC Merge
12.0(4)DB
VP and VC Switching
12.0(4)DB
VP Multiplexing
12.0(4)DB
VP Tunneling
12.0(4)DB
LAN Emulation Server (LES) and LAN Emulation Configuration Server (LECS)
12.0(4)DB
RFC 1577 (Classical IP over ATM) ATM Address Resolution Protocol (ARP) Server/Client
12.0(4)DB
Dual Leaky Bucket Policing (ITU-T I.371 and ATM Forum UNI specifications)
12.0(4)DB
Intelligent Early Packet Discard (EPD)
12.0(4)DB
Intelligent Partial (Tail) Packet Discard
12.0(4)DB
Multiple, Weighted (Dynamic) Thresholds for Selective Packet Marking and Discard
12.0(4)DB
Per-VC or per-VP Output Queuing
12.0(4)DB
Strict Priority, Rate, or Weighted Round Robin Scheduling Algorithms
12.0(4)DB
Available Bit Rate (ABR) (EFCI1 + RR2 ) + Minimum Cell Rate (MCR)
12.0(4)DB
Constant Bit Rate (CBR)
12.0(4)DB
Per-VC or per-VP CBR Traffic Shaping
12.0(4)DB
Shaped CBR VP Tunnels (up to 128)
12.0(4)DB
Substitution of Other Service Categories in Shaped VP Tunnels
12.0(4)DB
Support for Non-Zero MCR on ABR Connections
12.0(4)DB
Unspecified Bit Rate (UBR)
12.0(4)DB
UBR + MCR
12.0(4)DB
Variable Bit Rate Non-Real Time (VBR-NRT)
12.0(4)DB
VBR Real Time (VBR-RT)
12.0(4)DB
ATM Access Lists on Interim Local Management Interface (ILMI) Registration
12.0(4)DB
ATM Soft Restart
12.0(4)DB
PCMCIA3 Disk Mirroring
12.1(5)DB
Per-VC or per-VP Nondisruptive Port Snooping
12.0(4)DB
1+1 Slot Redundancy (EHSA4 )
12.0(4)DB
Network Management Ethernet (NME)
12.0(5)DB
NRP-2 Support
12.1(4)DB
NSP 1+1 Redundancy
12.0(4)DB
Synchronous Optical Network (SONET) Automatic Protection Switching (APS) Support
12.0(4)DB
Stratum 3/BITS
12.0(7)DB
Telco Alarms
12.0(4)DB
Dynamic Host Configuration Protocol (DHCP) Client Support
12.0(4)DB
Internet Protocol (IP)
12.0(4)DB
Network Time Protocol (NTP)
12.0(4)DB
Telnet
12.0(4)DB
ATM Accounting Enhancements
12.0(4)DB
ATM Accounting Management Information Base (MIB)
12.0(4)DB
ATM Remote Monitoring (RMON) MIB
12.0(4)DB
Signaling Diagnostics and MIB
12.0(4)DB
Simple Network Management Protocol (SNMP)
12.0(4)DB
Web Console
12.0(4)DB
ATM Policing by Service Category for SVC/Soft PVC
12.2(4)B3
Terminal Access Controller Access Control System Plus (TACACS+) (admin login only)
12.0(4)DB
Capability to View Used/Unused Input Translation Table (ITT) Blocks
12.1(4)DB
Fragmentation Minimization
12.1(4)DB
ITT Block Shrinking
12.1(4)DB
ATM Network Service Access Point (NSAP) and Left-Justified E.164 Address Support
12.0(4)DB
Closed User Groups (CUGs) for ATM VPNs
12.0(4)DB
E.164 Address Translation and Autoconversion
12.0(4)DB
Hierarchical Private Network Node Interface (PNNI)
12.0(4)DB
Interim-Interswitch Signaling Protocol (IISP)
12.0(4)DB
ILMI 4.0
12.0(4)DB
VPI/VCI 5 Range Support in ILMI 4.0
12.0(4)DB
UNI 3.0, UNI 3.1, and UNI 4.0
12.0(4)DB
1 EFCI = Explicit Forward Congestion Indication.
2 RR = relative rate.
3 PCMCIA = Personal Computer Memory Card International Association.
4 EHSA = Enhanced High System Availability.
5 VPI/VCI = Virtual Path Identifier/Virtual Channel Identifier.
New and Changed Information
This section describes new features available in Cisco IOS Release 12.2(4)B6 and enhancements to existing features offered in prior releases.
New Hardware Features Supported in Release 12.2(4)B6
There are no new hardware features supported by the Cisco 6400 in Release 12.2(4)B6.
New Software Features Supported in Release 12.2(4)B6
There are no new software features supported by the Cisco 6400 in Release 12.2(4)B6.
New Hardware Features Supported in Release 12.2(4)B5
There are no new hardware features supported by the Cisco 6400 in Release 12.2(4)B5.
New Software Features Supported in Release 12.2(4)B5
There are no new software features supported by the Cisco 6400 in Release 12.2(4)B5.
New Hardware Features Supported in Release 12.2(4)B3
There are no new hardware features supported by the Cisco 6400 in Release 12.2(4)B3.
New Software Features Supported in Release 12.2(4)B3
This section lists the new software features supported by the Cisco 6400 in Release 12.2(4)B3.
ATM OAM Ping
The ATM OAM Ping feature modifies the ping atm interface atm and ping (privileged) commands, which can be used to send an Operation, Administration, and Maintenance (OAM) packet and to display success when the response is received.
This feature provides two ATM OAM ping options:
•
•
DHCP Relay Support for MPLS VPN Suboptions
The DHCP relay agent information option (option 82) enables a Dynamic Host Configuration Protocol (DHCP) relay agent to include information about itself when it forwards client-originated DHCP packets to a DHCP server. The DHCP server can use this information to implement IP address or other parameter-assignment policies. The DHCP relay agent option is organized as a single DHCP option that contains one or more suboptions that convey information known by the relay agent.
In some environments, a relay agent resides in a network element that also has access to one or more MPLS Virtual Private Networks (VPNs). If a DHCP server wants to offer service to DHCP clients on those different VPNs, the DHCP server needs to know the VPN in which each client resides. The network element that contains the relay agent typically knows about the VPN association of the DHCP client and includes this information in the relay agent information option.
The DHCP relay agent forwards this necessary VPN-related information to the DHCP server using the following three suboptions of the DHCP relay agent information option:
•
•
•
The VPN identifier suboption is used by the relay agent to tell the DHCP server the VPN for every DHCP that the relay agent passes on to the DHCP server. It is also used for the proper forwarding of any DHCP reply that the DHCP server sends back to the relay agent.
The subnet selection option allows the separation of the subnet from the IP address used to communicate with the relay agent. In typical DHCP processing, the gateway address specifies both the subnet on which a DHCP client resides and the IP address that the server can use to communicate with the relay agent. Situations exist where the relay agent needs to specify a subnet on which a DHCP client resides that is different from the IP address that the server can use to communicate with the relay agent. The subnet selection suboption is included in the relay information option and is passed on to the DHCP server. The gateway address is changed to the outgoing interface of the relay agent used by the DHCP server. The DHCP server uses this gateway address to send reply packets back to the relay agent.
The server identifier override suboption value is copied in the reply packet from the DHCP server instead of the normal server ID address. Using this information, the DHCP relay agent then sends the response back to the DHCP client on the correct VPN. The server identifier override suboption contains the incoming interface IP address, which is the IP address of the relay agent that is accessible from the client.
After adding these suboptions to the DHCP relay information option, the DHCP server changes the gateway address to the outgoing interface of the relay agent used by the DHCP server. When the packets are returned from the DHCP server, the relay agent removes all options and forwards the packets to the DHCP client on the correct VPN.
Encrypted and Tagged VSA Support for RADIUS Attribute 91
The Encrypted and Tagged VSA Support for RADIUS Attribute 91 feature adds support for encrypted and tagged Cisco vendor-specific attribute (VSA) 91. Attribute 91 can be both encrypted and tagged.
The RADIUS attribute 91 feature allows you to specify a name (other than the default) of the tunnel terminator. It thus supports the provision of compulsory tunneling in virtual private networks (VPNs). Also, by specifying a name, you can establish a higher level of security when you are setting up VPN tunneling.
Once a NAS has set up communication with a RADIUS server, you can enable a tunneling protocol. Some applications of tunneling protocols are voluntary, but others involve compulsory tunneling; that is, a tunnel is created without any action from the user and without allowing the user any choice in the matter. In those cases, new RADIUS attributes are needed to carry the tunneling information from the NAS to the RADIUS server to establish authentication. The new RADIUS attribute for attribute 91 are listed in Table 4.
Note
Note
The following section describes the specifics of an encrypted and tagged VSA.
Encrypted String and Tagged VSA
The encrypted string and tagged VSA is identical to the encrypted string VSA except for the addition of the Tag field before the Salt field. An encrypted string and tagged VSA must have the following field values:
•
•
•
•
•
The following illustrates the format of the encrypted string and tagged VSA:
0 1 2 30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Type (26) | Length | Vendor-Id (9)+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Vendor-Id (cont) |Vendor type(36)| Vendor length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|0 Tag |1 Salt | Salt(Cont) | String ....+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Note
Enhancements to DHCP Option 82 Support for RBE
The DHCP Option 82 Support for Routed Bridge Encapsulation (RBE) feature provides support for the DHCP relay agent information option when ATM routed bridge encapsulation is used.
The DHCP relay agent information option (option 82) enables a Dynamic Host Configuration Protocol (DHCP) relay agent to include information about itself when it forwards client-originated DHCP packets to a DHCP server. The DHCP server can use this information to implement IP address or other parameter-assignment policies.
This feature communicates information to the DHCP server using a suboption of the DHCP relay agent information option (option 82) called agent remote ID. The information sent in the Agent Remote ID includes an IP address identifying the relay agent and information about the ATM interface and the PVC over which the DHCP request came in. The DHCP server can use this information to make IP address assignments and security policy decisions.
When the Cisco 6400 is used as the DHCP relay agent, the IP address used in the agent remote ID is always the network management Ethernet (NME) interface of the Cisco 6400 NSP.
Note
Service providers are increasingly using ATM routed bridge encapsulation to configure digital subscriber line (DSL) access. The DHCP Option 82 Support for RBE feature enables those service providers to use DHCP to assign IP addresses and DHCP option 82 to implement security and IP address assignment policies, such as limiting the number of IP addresses on specific ports or ATM VCs.
As an enhancement to this feature, for soft permanent virtual circuits (PVCs), the Cisco 6400—functioning as the DHCP relay agent—uses the egress slot/subslot/port and VPI/VCI information in the agent remote ID.
For more information on this feature, refer to the "DHCP Option 82 Support for Routed Bridge Encapsulation" feature module at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t2/ftrbeo82.htm
Enhancements to RADIUS VC Logging
RADIUS Virtual Circuit (VC) Logging allows the Cisco 6400 Universal Access Concentrator to accurately record the virtual path interface (VPI) and virtual circuit interface (VCI) of an incoming subscriber session. With RADIUS VC Logging enabled, the RADIUS network access server (NAS) port field is extended and modified to carry VPI/VCI information. This information is logged in the RADIUS accounting record that was created at session startup.
When using soft permanent virtual circuits (PVCs), as opposed to regular PVCs, the Cisco 6400 returns the egress slot/subslot/port and VPI/VCI information.
For more information on this feature, refer to the "Miscellaneous Features" chapter of the Cisco 6400 Feature Guide—Release 12.2(2)B at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/dsl_prod/6400/feat_gd/12_2_2/index.htm
Extended Support for RADIUS Attribute 32
The Extended Support for RADIUS Attribute 32 feature adds attribute 32 support from RADIUS tunnel attribute extensions to IOS RADIUS. The NAS is now identifiable to the RADIUS server, whether the NAS is a Cisco component or not.
Framed Route VRF Aware
The Framed-Route VRF Aware feature introduces Virtual Route Forwarding support for RADIUS Attribute 22 (Framed-Route), Attribute 8 (Framed-IP-Address), and Attribute 9 (Framed-IP-Netmask). With this feature, static IP routes can be applied to a particular VRF table rather than to the global routing table.
MPLS VPN ID
Multiple VPNs can be configured in a router. You can use a VPN name (a unique ASCII string) to reference a specific VPN configured in the router. Alternatively, you can use a VPN ID to identify a particular VPN in the router. The VPN ID follows a standard specification (RFC 2685). To ensure that the VPN has a consistent VPN ID, assign the same VPN ID to all of the routers in the service provider network that services that VPN.
You can use several applications to manage VPNs by VPN ID. For more details on how server applications use the VPN ID, refer to the "Why Is a VPN ID Useful?" section.
Note
What Is a VRF?
For each VPN that is configured in a router, the router creates a Virtual Route Forwarding instance. The VRF instance contains the routing information that defines the customer VPN site that is attached to a provider edge (PE) router. A VRF instance consists of the following elements:
•
•
•
•
An IP routing table and the CEF table store packet forwarding information for each VRF. Another routing table and CEF table for each VRF prevent information from being forwarded outside a VPN and prevent packets that are outside a VPN from being forwarded to a router within the VPN.
Components of the VPN ID
Each VPN ID defined by RFC 2685 consists of the following elements:
•
The IEEE Registration Authority assigns OUIs to any company that manufactures components under the ISO/IEC 8802 standard. The OUI is used to generate universal LAN MAC addresses and protocol identifiers for use in local and metropolitan area network applications. For example, an OUI for Cisco Systems is 00-03-6B (hex).
•
Use the vpn id command and specify the VPN ID in the following format:
vpn id oui:vpn-indexIn the command, a colon separates the OUI from the VPN index. See the vpn id command for more information.
Why Is a VPN ID Useful?
Remote access applications, such as the Remote Authentication Dial-In User Service (RADIUS) and Dynamic Host Configuration Protocol (DHCP), can use the MPLS VPN ID feature to identify a VPN. RADIUS can use the VPN ID to assign dial-in users to the proper VPN, based on the user authentication information.
DHCP
Using DHCP, network administrators can centrally manage and automate the assignment of IP addresses in an organization's network. The DHCP application uses the VPN ID as follows:
1.
2.
3.
4.
5.
RADIUS
A RADIUS server (or daemon) provides authentication and accounting services to one or more client NAS devices. RADIUS servers authenticate users and return all configuration information necessary for the client to deliver service to the users.
Typically, a user login consists of a query (Access-Request) from the NAS to the RADIUS server and a corresponding response (Access-Accept or Access-Reject) from the server.
•
•
Per VRF AAA
Using the Per VRF AAA feature, Internet Service Providers (ISPs) can partition authentication, authorization, and accounting (AAA) services based on Virtual Route Forwarding (VRF). This permits the Virtual Home Gateway (VHG) to communicate directly with the customer RADIUS server associated with the customer VPN, without having to go through a RADIUS proxy. Thus, ISPs can scale their VPN offerings more efficiently because they no longer need to proxy AAA to provide their customers the flexibility demanded.
To support Per VRF AAA, AAA must be VRF aware. ISPs must define multiple instances of the same operational parameters—such as AAA server groups, method lists, system accounting, and protocol-specific parameters—and associate the parameters with the VRF partitions.
If an AAA configuration, such as a method list, is uniquely defined many times across the NAS, the specification of an AAA server that is based on IP addresses and port numbers might create an overlapping of private addresses between VRF configurations. Associating AAA method lists with VRF partitions can be accomplished from one or more of the following sources:
•
•
•
Note
AAA Server Configurations
To prevent possible overlapping of private addresses between VRFs, AAA servers must be defined in a single global pool that is to be used in the server groups. Servers can no longer be uniquely identified by IP addresses and port numbers.
Private servers (servers with private addresses within the default server group that contains all the servers) can be defined within the server group and remain hidden from other groups. The list of servers in server groups includes references to the hosts in the global configuration as well as the definitions of private servers.
Note
All server operational parameters can be configured per host, per server group, or globally. Per-host configurations have precedence over per-server group configurations. Per-server group configurations have precedence over global configurations.
PPPoE over Ethernet (FE for NRP-1)
PPPoE over Ethernet enhances PPPoE functionality by adding direct connection to actual Ethernet and FastEthernet interfaces. PPPoE over Ethernet provides service-provider digital subscriber line (DSL) support by enabling multiple hosts on a shared Ethernet interface to open PPP sessions to multiple destinations with one or more bridging modems.
Note
PPPoE over Ethernet with VLAN
PPPoE over Ethernet can be used with virtual LANs (VLANs).
For more information on PPPoE over Ethernet, refer to the "Configuring PPPoE over Ethernet" chapter in the "Configuring Broadband Access: PPP and Routed Bridge Encapsulation" section of the Cisco IOS Wide-Area Networking Configuration Guide, Release 12.2 at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fwan_c/wcfppp.htm#xtocid15
For more information on virtual LANs, refer to the Cisco IOS Switching Services Configuration Guide, Release 12.2 at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fswtch_c/swprt6/index.htm
PPPoE over Gigabit Ethernet (GE for NRP-2SV Only)
The PPPoE over Gigabit Ethernet feature enhances PPP over Ethernet (PPPoE) functionality by adding support for PPPoE and PPPoE over IEEE 802.1Q VLANs on Gigabit Ethernet interfaces. The PPPoE over Gigabit Ethernet feature is supported on Cisco 6400 chassis that have Gigabit Ethernet line cards.
RADIUS-Based Session/Idle Timeout for LAC
The RADIUS-based Session/Idle Timeout for L2TP Access Concentrator (LAC) feature enables the LAC to receive the session timeout from RADIUS Attribute 27 and the idle timeout from RADIUS Attribute 28. The LAC should disconnect the session based on these timeouts.
If you have configured the idle timeout locally below the selected virtual template, and the LAC receives a session/idle timeout through RADIUS, the values received through RADIUS must override the local configuration. After the time of the idle or session timeout has expired, the LAC should send out a PADT towards the PPPoE client and the LNS to terminate the session.
Session Limit per VRF
The Session Limit per VRF feature enables session limits to be applied on all VPDN groups associated with a common VPDN virtual template. Before the implementation of Session Limit per VRF, a single default template carrying the configuration values of a subset of VPDN group commands was associated with all VPDN groups configured on the router. Session Limit per VRF enables you to create, define, and name multiple VPDN templates. You can then associate a specific template with a VPDN group. You can configure a session limit at the VPDN template level to specify a combined session limit for all VPDN groups associated with the configured VPDN template.
The benefit of the Session Limit per VRF feature is that it controls the resources consumed by a single customer account by limiting the number of concurrent sessions terminating in a single VRF.
For more information on this feature, refer to the Session Limit per VRF feature module at the following URL:
http://lbj.cisco.com/push_targets1/ucdit/cc/td/doc/product/software/ios122/122newft/122limit/122b/122b_4/12b_vrf.htm
Restrictions
Nesting of VPDN templates is not supported. A single VPDN group can be associated with only one template at a time.
SSG Accounting Update Interval per Service
The Service Selection Gateway (SSG) Accounting Update Interval per Service feature enhances SSG accounting by allowing users to configure an interval for reporting of accounting information. Without this feature, all accounting information is sent simultaneously. With the SSG Accounting Update Interval per Service feature, accounting information for a particular SSG service can be sent at separate, independent intervals.
SSG Accounting sends information such as billing, auditing, and reporting, so the SSG Accounting feature allows for more granular accounting interval options for all of these functions.
SSG Autodomain
When you configure SSG Autodomain, users can automatically connect to a service based on either access point name (APN) or the domain part of the structured username specified in an Access-Request. When SSG Autodomain is configured, user authentication is not performed at the NAS AAA. Instead it is performed at the server for the service (for example, at an AAA server within a corporate network).
Access Point Names
An Access Point Name (APN) identifies a Packet Data Network (PDN) that is configured on and accessible from a Gateway General Packet Radio Service (GPRS) Support Node. (GGSN). An access point is identified by its APN name. The Global System for Mobile Communication (GSM)
standard 03.03 defines the following two parts of an APN:•
•
The APN Network Identifier is mandatory. The name of an access point in the form of an APN Network Identifier must correspond to the fully-qualified name in the Domain Name System (DNS) configuration for that network, and it must also match the name specified for the access point in the GGSN configuration. The GGSN also uniquely identifies an APN by an index number. The APN operator identifier is an optional name that consists of the fully qualified DNS name, with the ending ".gprs."
The access points that are supported by the GGSN are preconfigured on the GGSN. When a user requests a connection in the GPRS network, the APN is included in the Create Packet Data Protocol (PDP) Request message. The Create PDP Request message is a GPRS Tunneling Protocol (GTP) message that establishes a connection between the Serving GPRS Support Node (SGSN) and the GGSN.
An APN has several attributes associated with its configuration that define how users can access the network at that entry point. For more information about configuring APNs, see the APN Manager Application Programming Guide.
SSG Autodomain
When using SSG Autodomain, you can automatically log in a user to a service based on either the APN or a structured username. Users can bypass the Service Selection Dashboard (SSD) and access a service, such as a corporate intranet.
SSG Autodomain makes it possible to log in a user to either Layer 2 Tunnel Protocol (L2TP) or proxy services. The username and password used to log in a user with Autodomain are the username and password provided by the user when the user logs in to the GPRS network. This password can be dynamically generated.
SSG Autodomain does not require SSG vendor-specific attributes (VSAs) when using a domain name as a means to log a user in to a particular service.
Autodomain uses a heuristic to determine the service into which the user is logged. When using Autodomain, the host object is not activated until successfully authenticated with the service. If the auto-service connection fails for any reason, the user login is rejected and an Access-Reject is returned to the GGSN.
Autodomain service checks for an APN (Called-Station-ID) and then for a structured username.
If Autodomain is enabled and the received Access-Request specifies an APN, then this APN is used for Autodomain selection unless it is a member of the APN Autodomain exclusion list. If an Autodomain is not selected based on APN, then the structured username is used. If a structured username is not supplied, or the supplied structured username is a member of the domain name exclusion list, then no Autodomain is selected and normal SSG user login proceeds. You can override these Autodomain selection defaults by using the ssg auto-domain select command. You can define the APN Autodomain exclusion list and the domain name exclusion list with the ssg auto-domain exclude command.
When Autodomain is enabled, an Autodomain profile is downloaded from the local AAA server. This profile is specified as an outbound service and the password is the globally configured service password.
You can configure SSG Autodomain in basic or extended mode. In basic mode, the Autodomain profile downloaded from the AAA server is a service profile. In extended Autodomain mode, the profile downloaded from the AAA server is a "virtual user" profile which contains one auto-service for an authenticated service such as a proxy or a tunnel. The "virtual user" profile defines the Autodomain service. Connection to this auto-service occurs as it does for basic Autodomain, where the host object is not activated until the user is authenticated at the proxy or tunnel service. The presence of the SSD in extended Autodomain mode enables the user to access any other service in the specified user profile. If the "virtual user" profile does not have exactly one auto-service or the auto-service is not authenticated, the Autodomain login is rejected.
The Autodomain service profile can be a proxy or tunnel service. If the downloaded Autodomain service profile is a proxy service, the access-request is proxied to the appropriate domain AAA server. If the downloaded Autodomain service profile is a tunnel service, a PPP session is regenerated into an L2TP tunnel for the selected service. If no SSG-specific attributes are returned indicating the type of service required, the SSG uses a default set of attributes to regenerate the PPP session for the specified service.
SSG Autodomain attempts to log the user on to the remote service using the username and password specified in the original Access-Request. For structured usernames, only the "user" part of the name is used unless the "X" attribute is present in the service profile. For VPDN-only type services (where no SSG attributes are present), you cannot specify use of the full structured username.
If you configure basic SSG Autodomain with a nonauthenticated service type such as passthrough, SSG rejects the login request because Autodomain bypasses user authentication at the local AAA server and requires that authentication be performed elsewhere.
SSG Autologoff
The SSG Autologoff feature enables the Cisco Service Selection Gateway (SSG) to verify connectivity with each host or user at configured intervals. If SSG detects that the connection has terminated, SSG automatically initiates the logoff for that host or user.
When SSG autologoff is configured, the SSG checks the status of the connection with each host at configured intervals. If SSG finds that a host has been disconnected, SSG automatically initiates the logoff of that host. SSG has two methods of checking the connectivity of hosts: ARP ping and ICMP ping.
ARP Ping
The Address Resolution Protocol (ARP) is an Internet protocol used to map IP addresses to MAC addresses in directly connected devices. A router that uses ARP broadcasts ARP requests for IP address information. When an IP address is successfully associated with a MAC address, the router stores the information in the ARP cache.
When SSG autologoff is configured to use ARP ping, SSG periodically checks the ARP cache tables. If a table entry for a host is found, SSG forces ARP to refresh the entry and checks the entry again after some configured interval. If a table entry is not found, SSG initiates autologoff for the host.
Note
We recommend using ARP ping when possible because ARP entries are refreshed whenever there is network activity. In addition, ARP request packets are smaller than ICMP ping packets.
ICMP Ping
The Internet Control Message Protocol (ICMP) is a network layer Internet protocol that reports errors and provides other information relevant to IP packet processing. An ICMP ping consists of the echo message and the echo-reply message used to check for connectivity between devices.
When SSG autologoff is configured to use the ICMP ping mechanism, SSG invokes the callback function for successful pings or timeouts. In the case of timeout or ping error, the callback function checks the number of retries remaining and initiates ping again. If all of the retries are used up, SSG initiates logoff for the host. If the ping is successful, SSG makes no more ping attempts until the next ping interval.
ICMP ping works in all types of deployment scenarios and supports overlapping IP users.
SSG AutoLogon Using Proxy RADIUS
Before the introduction of the SSG AutoLogon Using Proxy RADIUS feature, the SSG effectively acted as a RADIUS proxy for the Service Selection Dashboard (SSD). In this mode, when SSD needs to authenticate a user, it forwards an Access-Request to the SSG. The Access-Request uses the IP address and port number configured for RADIUS authentication on the SSG as well as the configured shared secret between the SSG and the SSD. When SSG receives a request from the SSD to authenticate a user, the SSG uses AAA to construct an Access-Request and send it to the AAA server. When SSG receives the Access-Accept, it processes it and forwards it to the SSD. In this implementation, SSG is far from acting as a generic RADIUS proxy and standard RADIUS protocol must be extended by the use of Vender Service Attributes (VSAs) to provide a control plane between the SSG and SSD. Without the VSA in the Access-Request, SSG does not function as a RADIUS proxy.
The SSG AutoLogon Using Proxy RADIUS feature enables the SSG to act as a RADIUS proxy for non-SSD clients whose Access-Requests do not contain VSAs. Non-SSD Access-Requests must originate from configured, trusted, downstream NAS IP addresses that share a RADIUS secret key with the SSG. This shared secret key is a different secret than the one shared between SSG and the SSD. You must configure the IP addresses for each router for which SSG is acting as a RADIUS proxy. Packets received from unrecognized sources are discarded.
When the SSG receives a valid Access-Request, it forwards it to the RADIUS server. The SSG performs a full, transparent proxy of the Access-Request to the RADIUS server, faithfully reproducing the attributes provided originally by the RADIUS client. If the Access-Request is successful, the AAA server responds with an Access-Accept and an SSG host object is created.
RADIUS Authentication and Authorization
A RADIUS client can be configured to use a RADIUS AAA server for user authentication. Using a Cisco RADIUS client, you can configure the RADIUS server as a global AAA server for GPRS, or individual servers per Access Point Name (APN). The RADIUS client sends an Access-Request to the AAA server to authenticate a user. The Access-Request contains attributes depending on whether the router is using Challenge Handshake Authentication Protocol (CHAP), Password Authentication Protocol (PAP).
After a successful authentication, the RADIUS AAA server responds to the Access-Request by sending an Access-Accept containing a RADIUS attribute.
The RADIUS attributes are part of the user database held on the RADIUS AAA server and can be modified or extended as required. You can configure the AAA server to select a user profile based on Called-Station-ID (Access Point Name [APN]) or Calling-Station-ID (Mobile Station ISDN [MSISDN] header field type for wireless clients using the Wireless Application Protocol [WAP]).
If the AAA is configured to select profiles based on Called-Station-ID, all users connecting to the same APN are given the same profile even though they have different assigned IP addresses.
The supplied username does not have to be unique for WAP users on the RADIUS client. These users are granted anonymous access and all have the same username and password.
AAA authorization involves extracting all of the parameters needed to create the Packet Data Protocol (PDP) context. The authorization extracts the Framed-IP-Address and the Framed-IP-Netmask.
SSG Vendor-Specific Attributes
The SSG uses vendor-specific RADIUS attributes. If you are using the SSG with Cisco User Control Point (UCP) software, specify settings that allow processing of the SSG attributes. You can specify these setting when you configure the CiscoSecure Access Control Server (ACS) component. If you are using another AAA server, you must customize that server RADIUS dictionary to incorporate the SSG vendor-specific attributes.
SSG Hierarchical Policing
The Service Selection Gateway (SSG) feature is a switching solution for service providers who offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as xDSL, cable modems, or wireless to allow simultaneous access to network services.
SSG allows subscribers to choose one or more types of services. Each type of service has its own bandwidth requirements. SSG, therefore, requires a mechanism for ensuring that bandwidth is distributed properly for customers using different types of services.
Traffic policing is the concept of limiting the rate at which traffic enters or leaves a node. In SSG, Traffic policing can be used to allocate bandwidth between subscribers and between services to a subscriber to ensure that all types of services are allocated a proper amount of bandwidth. SSG uses per-user and per-user per-service policing to ensure bandwidth is distributed properly between subscribers (per-user policing) and between services to a particular subscriber (per-user per-service policing). Because these policing techniques are hierarchical in nature (bandwidth can be first policed between users and then policed again between services to a particular user), this complete feature is called SSG Hierarchical Policing.
Per-user policing is used to police the aggregated traffic destined for or sent from a particular subscriber. You can use it to police the bandwidth allocated to a subscriber. Per-user policing cannot identify services to a particular subscriber and it therefore cannot allocate bandwidth between these services.
Per-user per-service policing is used to police the types of services available to a subscriber. Per-user per-service policing is useful when an SSG subscriber subscribes to more than one service and the multiple services are allocated different amounts of bandwidth. Per-user per-service policing provides a mechanism for identifying the types of services (such as video or Internet access) and allocating a proper amount of bandwidth to each service.
Hierarchical Policing for SSG Token Bucket Scheme
The Hierarchical Policing for SSG feature limits the input or output transmission rate of traffic based on a token bucket algorithm.
The token bucket algorithm used in SSG Hierarchical Policing analyzes a packet and determines whether the packet should be forwarded to its destination or dropped. The amount of available tokens in the token bucket determine whether a packet is forwarded or dropped. If enough tokens are available, the tokens are removed from the token bucket and the packet is forwarded. If the token bucket does not have enough tokens available for the packet, the packet is dropped. Tokens are replenished in the token bucket at regular intervals.
SSG Prepaid Billing
The SSG Prepaid feature expands SSG accounting features to allow service providers to offer prepaid billing for their services.
How SSG Prepaid Works
The SSG Prepaid feature allows SSG to use a subscriber's credit allotment to determine whether to connect the subscriber to a service and for how long. The credit, also called quota, is measured in either seconds for time or bytes for volume.
To obtain the quota for a connection, SSG submits an authorization request to the AAA server. The AAA server contacts the prepaid billing server which forwards the quota values to SSG. SSG then monitors the connection to track the quota usage. When the quota runs out, SSG performs reauthorization. During reauthorization, the billing server provides SSG with more quota if it is available; if the quota has run out, SSG logs the user off.
The following sections describe in more detail how authorization and reauthorization work.
Service Authorization
SSG differentiates prepaid services from postpaid services by the presence of a vendor specific attribute (VSA) called the Service Authorization VSA in the service profile. The presence of this attribute in the service profile means that SSG needs to perform authorization to get the quota values for the connection. Once a prepaid service has been identified, SSG generates an Access-Request called a Service Authorization Request.
In a mobile wireless scenario, where SSG is acting as a RADIUS proxy to the gateway GPRS support node (GGSN), the calling-station ID of the user is sent in the authorization request to the AAA server. In a non-RADIUS proxy environment where the access technology might not provide an MSISDN, SSG copies the value from the User-Name attribute into the Calling-Station-ID attribute field in the authorization request. The AAA server uses the Calling-Station-ID attribute in the Access-Request to perform authorization and return the quota parameters for that connection.
If a non-zero quota is returned, SSG creates a connection to the service with the initial quota value. The units for the quotas are seconds for time and bytes for volume. A value of zero in a quota means the user has insufficient credit and is not authorized to use that service and the connection is not made. If the Quota attribute is not present in the authorization response, SSG treats the connection as postpaid. However, if SSG receives an access reject or a quota of zero, SSG does not allow any further connection to that service.
Service Reauthorization
During the connection, if the quota is based on volume, SSG decrements the available quota until it runs out. If the quota is based on time, the connection is allowed to proceed for the quota duration. When the quota reaches zero, SSG issues a Service Reauthorization Request to the billing server. The Service Reauthorization Request includes a new SSG VSA called Quota Used.
If service reauthorization is unsuccessful, the billing server responds to the Service Reauthorization Request with an Access-Accept that containins a quota of zero. SSG terminates the connection to the service at this point. If service reauthorization is successful, the billing server returns more quota to SSG and the connection is allowed to continue.
SSG Support for MAC Addresses in Accounting Records
The SSG Support for MAC Addresses in Accounting Records feature allows SSG to include the user's MAC address in RADIUS attribute 31 (Calling-Station-ID) in accounting records. The following restrictions apply to this feature:
•
•
•
SSG TCP Redirect for Services (Phase 2)
Subscribers need both user authentication and authentication for the services they are trying to access within the SSG. If both these conditions are not met, the request packet is discarded. Rather than dropping these packets, the SSG HTTP Redirect (Phase 1) feature allowed unauthenticated TCP traffic to be redirected to a default portal, such as SSD. The SSG TCP Redirect for Services (Phase 2) feature expands this capability to allow for an authenticated subscriber, who might not be authorized for a particular service, to be redirected to a list of captive portals.
The purpose of the Phase 2 feature is to implement redirection for services. After SSG authenticates a subscriber, the subscriber is offered a list of services that he or she is subscribed to. The subscriber might have to log in separately to these services depending on the type of service. At this point, when the subscriber sends an upstream packet that has not been explicitly authorized by the service, the packet is redirected to a list of captive portals for a set duration. The portal group can consist of one or more configured servers, arranged in the order in which they have been added.
Therefore, subscribers trying to access a TCP port on a network for a service to which they do not have access are redirected to one of the servers in the portal group. The subscribers' request packets coming in are TCP-redirected in a round robin fashion. You can configure which portal group can be used as the destination for various packets, based on the packet destination address or the service that the subscriber is trying to access.
In addition, the default service redirect group redirects packets from a subscriber attempting to access a network for a service that has not been defined by one of the service redirect groups. In this case, subscribers attempting to access an unauthorized location receive readable messages, as opposed to a standard "404, page not found" error message.
Similarly, SSG can be configured for TCP redirection to advertisement portals on a periodic basis. Any SMTP traffic from a user can be redirected to a configured group of SMTP forwarding agents.
The format of the Cisco IOS CLI configuration commands in SSG TCP Redirect for Services Phase 2 is changed. The configuration commands have been grouped into one submode. Phase 2 CLI commands start with ssg tcp-redirect instead of ssg http-redirect.
Support for RADIUS Attributes 52 and 53
The RADIUS Attributes 52 and 53 feature introduces support for Attribute 52 (Acct-Input-Gigawords) and Attribute 53 (Acct-Output-Gigawords). Attribute 52 keeps track of the number of times the Acct-Input-Octets counter has rolled over the 32-bit integer throughout the course of the provided service; Attribute 53 keeps track of the number of times the Acct-Output-Octets counter has rolled over the 32-bit integer throughout the delivery of service. Both attributes can be present only in Accounting-Request records where the Acct-Status-Type is set to "Stop" or "Interim-Update." These attributes can be used to keep accurate track of bill for usage.
Support for RADIUS Attribute 77
The RADIUS Attribute 77 feature introduces support for Attribute 77 (Connect-Info) to carry the textual name of the virtual circuit class associated with the given permanent virtual circuit (PVC). (Although attribute 77 does not carry the unspecified bit rate (UBR), the UBR can be inferred from the class name used if one UBR is set up on each class.) Attribute 77 is sent from the NAS to the RADIUS server in Accounting-Request and Accounting-Response packets.
New Hardware Features Supported in Release 12.2(2)B5
There are no new hardware features supported by the Cisco 6400 in Release 12.2(2)B5.
New Software Features Supported in Release 12.2(2)B5
There are no new software features supported by the Cisco 6400 in Release 12.2(2)B5.
New Hardware Features Supported in Release 12.2(2)B4
There are no new hardware features supported by the Cisco 6400 in Release 12.2(2)B4.
New Software Features Supported in Release 12.2(2)B4
There are no new software features supported by the Cisco 6400 in Release 12.2(2)B4.
New Hardware Features Supported in Release 12.2(2)B3
There are no new hardware features supported by the Cisco 6400 in Release 12.2(2)B3.
New Software Features Supported in Release 12.2(2)B3
There are no new software features supported by the Cisco 6400 in Release 12.2(2)B3.
New Hardware Features Supported in Release 12.2(2)B2
There are no new hardware features supported by the Cisco 6400 in Release 12.2(2)B2.
New Software Features Supported in Release 12.2(2)B2
There are no new software features supported by the Cisco 6400 in Release 12.2(2)B2.
Limitations and Restrictions
•
•
•
Important Notes
The following sections contain important notes about Cisco IOS Release 12.2(4)B6 that can apply to the Cisco 6400.
Upgrading from Cisco IOS Release 12.2(2)B to Cisco IOS Release 12.2(4)B6
If you currently have a Cisco 6400 broadband aggregator running Cisco IOS Release 12.2(2)B, and you are upgrading to Cisco IOS Release 12.2(4)B6, please note the differences detailed in Table 5.
Session and Tunnel Scalability
Table 6 shows the number of sessions and tunnels supported for the NRP modules in Cisco IOS Release 12.2(4)B6. If you are using the NRP-SSG, Cisco IOS Release 12.2(4)B6 supports the number of sessions and tunnels shown in Table 7.
Note
Note
NRP-2SV Scalability Tuning Parameters
Following are scalability tuning parameter values used during testing for 6000 PPPoA sessions and 2000 L2TP tunnels. These parameters prevent known issue CSCdu86416 from occuring. (8K/2K L2TP sessions/tunnels don't come up even after a long wait.)
interface Virtual-Template1keepalive 200ppp timeout retry 25ppp timeout authentication 20vpdn-group 1l2tp tunnel hello 150l2tp tunnel receive-window 500l2tp tunnel nosession-timeout 20l2tp tunnel retransmit retries 12l2tp tunnel retransmit timeout min 4l2tp tunnel retransmit timeout max 6Following is the hold-queue CLI used during testing.
interface ATM0/0/0no ip addressload-interval 30atm vc-per-vp 2048no atm ilmi-keepalivehold-queue 4096 inhold-queue 4096 outend
Tip
interface Virtual-Template1
ppp timeout ncp 60
There is a potential negative impact on PPPoX termination scenarios. The default is no time-out at all. Configuring ppp timeout ncp 60 tells the router if NCP cannot be established within 60 seconds to tear down LCP and start all over again.
Configure ppp timeout ncp 60 only if you encounter the IP address allocation problem described here. Do not configure the timeout indiscriminately or to any local termination PPPoA/PPPoE deployment.
Note
Note
NRP-1 Scalability Tuning Parameters
This section describes the scalability tuning parameters that should be used for running large numbers of sessions on the NRP-1.
interface ATM0/0/0hold-queue 1000 inhold-queue 1000 out!interface Virtual-Template1keepalive 120ppp max-configure 255ppp timeout retry 15ppp timeout authentication 15Field Notices and Bulletins
•
•
•
•
Software Caveats
Caveats describe unexpected behavior in Cisco IOS software releases. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious. Severity 3 caveats are moderate caveats, and only select severity 3 caveats are included in the caveats document.
All caveats in Cisco IOS Release 12.2(4)T1 are also in Cisco IOS Release 12.2(4)B6.
For information on caveats in Cisco IOS Release 12.2(4)T1, see the Caveats for Cisco IOS Release 12.2 T, which lists severity 1 and 2 caveats and select severity 3 caveats and is located on Cisco.com and the Documentation CD-ROM.
Note
Caveat numbers and brief descriptions are listed in the tables in this section. For details about a particular caveat, go to Bug Toolkit at:
http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl
To access this location, you must have an account on Cisco.com. For information about how to obtain an account, go to the "Feature Navigator" section.
Note
Open Caveats—Release 12.2(4)B6
All the caveats listed in Table 8 are open in Cisco IOS Release 12.2(4)B6 for the Cisco 6400 NRP-1, NRP-2, NRP-2SV, and NSP. This table lists only severity 1 and 2 caveats and select severity 3 caveats.
Table 9 lists open caveats that pertain to MIB files for the Cisco 6400 for Release 12.2(4)B6.
Table 9 Open Caveats for Cisco 6400 MIBs for Release 12.2(4)B6
CSCdw67048
ciscoDslProvisionMIB takes too long to timeout.
Closed and Resolved Caveats—Release 12.2(4)B6
All the caveats listed in Table 10 are closed or resolved in Cisco IOS Release 12.2(4)B6 for the Cisco 6400 NRP-1, NRP-2, NRP-2SV, and the NSP. This table lists only severity 1 and 2 caveats and select severity 3 caveats.
Open Caveats—Release 12.2(4)B5
All the caveats listed in Table 11 are open in Cisco IOS Release 12.2(4)B5 for the Cisco 6400 NRP-1, NRP-2, NRP-2SV, and NSP. This table lists only severity 1 and 2 caveats and select severity 3 caveats.
Table 12 lists open caveats that pertain to MIB files for the Cisco 6400 for Release 12.2(4)B5.
Table 12 Open Caveats for Cisco 6400 MIBs for Release 12.2(4)B5
CSCdw67048
ciscoDslProvisionMIB takes too long to timeout.
Closed and Resolved Caveats—Release 12.2(4)B5
All the caveats listed in Table 13 are closed or resolved in Cisco IOS Release 12.2(4)B5 for the Cisco 6400 NRP-1, NRP-2, NRP-2SV, and the NSP. This table lists only severity 1 and 2 caveats and select severity 3 caveats.
Open Caveats—Release 12.2(4)B3
All the caveats listed in Table 14 are open in Cisco IOS Release 12.2(4)B3 for the Cisco 6400 NRP-1, NRP-2, NRP-2SV, and NSP. This table lists only severity 1 and 2 caveats and select severity 3 caveats.
Table 15 lists open caveats that pertain to MIB files for the Cisco 6400 for Release 12.2(4)B3.
Table 15 Open Caveats for Cisco 6400 MIBs for Release 12.2(4)B3
CSCdw67048
ciscoDslProvisionMIB takes too long to timeout.
Closed and Resolved Caveats—Release 12.2(4)B3
All the caveats listed in Table 16 are closed or resolved in Cisco IOS Release 12.2(4)B3 for the Cisco 6400 NRP-1, NRP-2, NRP-2SV, and the NSP. This table lists only severity 1 and 2 caveats and select severity 3 caveats.
Table 17 lists resolved caveats that pertain to MIB files for the Cisco 6400 for Release 12.2(4)B3.
Open Caveats—Release 12.2(2)B5
No severity 1 or severity 2 open caveats exist for Cisco IOS Release 12.2(2)B5 for the Cisco 6400 NRP-2, Cisco 6400 NRP-2SV, Cisco 6400 NRP-1, and the Cisco 6400 NSP. For information about any open caveats in Cisco IOS Release 12.2(4) T1, see the Caveats for Cisco IOS Release 12.2T, which is located on Cisco.com and the Documentation CD-ROM.
Closed or Resolved Caveats—Release 12.2(2)B5
All the caveats listed in Table 18 are closed or resolved in Cisco IOS Release 12.2(2)B5 for the Cisco 6400 NRP-2, Cisco 6400 NRP-2SV, Cisco 6400 NRP-1, and the Cisco 6400 NSP.
Open Caveats—Release 12.2(2)B4
No severity 1 or severity 2 open caveats exist for Cisco IOS Release 12.2(2)B4 for the Cisco 6400 NRP-2, Cisco 6400 NRP-2SV, Cisco 6400 NRP-1, and the Cisco 6400 NSP. For information about any open caveats in Cisco IOS Release 12.2(4)T1, see the Caveats for Cisco IOS Release 12.2T, which is located on Cisco.com and the Documentation CD-ROM.
Closed or Resolved Caveats—Release 12.2(2)B4
All the caveats listed in Table 19 are closed or resolved in Cisco IOS Release 12.2(2)B4 for the Cisco 6400 NRP-2, Cisco 6400 NRP-2SV, Cisco 6400 NRP-1, and the Cisco 6400 NSP.
Open Caveats—Release 12.2(2)B3
All the caveats listed in Table 20 are open in Cisco IOS Release 12.2(2)B3 for the Cisco 6400 NRP-2 and NRP-2SV.
Closed or Resolved Caveats—Release 12.2(2)B3
All the caveats listed in Table 21 are closed or resolved in Cisco IOS Release 12.2(2)B3 for the Cisco 6400 NRP-2 and NRP-2SV.
Open Caveats—Release 12.2(2)B2
All the caveats listed in Table 22 are open in Cisco IOS Release 12.2(2)B2 for the Cisco 6400 NRP-1, NRP-2, and NRP-2SV. All the caveats listed in Table 23 are open in Cisco IOS Release 12.2(2)B2 for the Cisco 6400 NSP. These tables list only severity 1 and 2 caveats and select severity 3 caveats. Table 24 lists caveats that pertain to MIB files for the Cisco 6400 for Release 12.2(2)B2.
Closed and Resolved Caveats—Release 12.2(2)B2
All the caveats listed in Table 25 are closed or resolved in Cisco IOS Release 12.2(2)B2 for the Cisco 6400 NRP-1 and NRP-2. All the caveats listed in Table 26 are closed or resolved in Cisco IOS Release 12.2(2)B2 for the Cisco 6400 NSP. These tables list only severity 1 and 2 caveats and select severity 3 caveats.
Related Documentation
The following sections describe the documentation available for the Cisco 6400. Documentation is available on Cisco.com and on the Documentation CD-ROM.
•
Release-Specific Documents
The following documents are specific to Cisco IOS Release 12.2T and are located on Cisco.com and the Documentation CD-ROM:
•
On Cisco.com at:
Technical Documents > Documentation Home Page > Cisco IOS Software Configuration: Cisco IOS Release 12.2T > Release Notes
On the Documentation CD-ROM at:
Cisco IOS Software Configuration > Cisco IOS Release 12.2T > Release Notes
•
Technical Documents
•
As a supplement to the caveats listed in the "Software Caveats" section in these release notes, see Caveats for Cisco IOS Release 12.2 and Caveats for Cisco IOS Release 12.2T, which contain caveats applicable to all platforms for all maintenance releases of Release 12.2.
On Cisco.com:
Technical Documents > Documentation Home Page > Cisco IOS Software Configuration > Cisco IOS Release 12.2: Release Notes > Caveats
On the Documentation CD-ROM:
Cisco Product Documentation > Cisco IOS Software Configuration > Cisco IOS Release 12.2 > Caveats
Note
Platform-Specific Documents
The documents listed in this section are available for the Cisco 6400 on Cisco.com and the Documentation CD-ROM.
To access Cisco 6400 documentation on Cisco.com, follow this path:
Technical Documents > Documentation Home Page > Aggregation Solutions > Cisco 6400 Carrier-Class Broadband Aggregator
To access Cisco 6400 documentation on the Documentation CD-ROM, follow this path:
Aggregation Solutions > Cisco 6400 Carrier-Class Broadband Aggregator
Platform-Specific Documents
•
•
•
•
•
•
•
Feature Navigator
Feature Navigator is a web-based tool that enables you to quickly determine which Cisco IOS software images support a particular set of features and which features are supported in a particular Cisco IOS image.
Feature Navigator is available 24 hours a day, 7 days a week. To access Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, e-mail the Contact Database Administration group at cdbadmin@cisco.com. If you do not have an account on Cisco.com, go to http://www.cisco.com/register and follow the directions to establish an account.
To use Feature Navigator, you must have a JavaScript-enabled web browser such as Netscape 3.0 or later, or Internet Explorer 4.0 or later. Internet Explorer 4.0 always has JavaScript enabled. To enable JavaScript for Netscape 3.x or Netscape 4.x, follow the instructions provided with the web browser. For JavaScript support and enabling instructions for other browsers, check with the browser vendor.
Feature Navigator is updated when major Cisco IOS software releases and technology releases occur. It contains feature information about mainline-, T-, S-, and P-trains. You can access Feature Navigator at the following URL:
http://www.cisco.com/go/fn
Cisco IOS Release 12.2 Documentation Set
Table 27 lists the contents of the Cisco IOS Release 12.2 software documentation set, which is available in both electronic and printed form.
Note
On Cisco.com at:
Technical Documents > Documentation Home Page > Cisco IOS Software Configuration > Cisco IOS Release 12.2
On the Documentation CD-ROM at:
Cisco Product Documentation > Cisco IOS Software Configuration > Cisco IOS Release 12.2
Obtaining Documentation
The following sections explain how to obtain documentation from Cisco Systems.
World Wide Web
You can access the most current Cisco documentation on the World Wide Web at the following URL:
Translated documentation is available at the following URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation CD-ROM
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which is shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.
Ordering Documentation
You can order Cisco documentation in these ways:
•
http://www.cisco.com/cgi-bin/order/order_root.pl
•
http://www.cisco.com/go/subscription
•
Documentation Feedback
You can submit comments electronically on Cisco.com. In the Cisco Documentation home page, click the Fax or Email option in the "Leave Feedback" section at the bottom of the page.
You can e-mail your comments to bug-doc@cisco.com.
You can submit your comments by mail by using the response card behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883Obtaining Technical Assistance
Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from online tools by using the Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC Web Site.
Cisco.com
Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.
Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a broad range of features and services to help you with these tasks:
•
•
•
•
•
If you want to obtain customized information and service, you can self-register on Cisco.com. To access Cisco.com, go to this URL:
Technical Assistance Center
The Cisco Technical Assistance Center (TAC) is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC Web Site and the Cisco TAC Escalation Center.
Cisco TAC inquiries are categorized according to the urgency of the issue:
•
•
•
•
The Cisco TAC resource that you choose is based on the priority of the problem and the conditions of service contracts, when applicable.
Cisco TAC Web Site
You can use the Cisco TAC Web Site to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC Web Site, go to this URL:
All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC Web Site. The Cisco TAC Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:
http://www.cisco.com/register/
If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC Web Site, you can open a case online by using the TAC Case Open tool at this URL:
http://www.cisco.com/tac/caseopen
If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC Web Site.
Cisco TAC Escalation Center
The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.
To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.
Feedback