Table Of Contents
Cisco Unified Wireless Network Solution Components
Upgrading to a New Software Release
VPN Termination Module for the 4400 Series Controllers
New LWAPP Power Injector Commands
Support for WPA1 and WPA2 Hex Keys
FCC Safety Compliance Statement
Controllers Must Run Release 3.2.116.21 to Support -P Regulatory Domain
Access Points Fail to Join Controllers If MTU Setting Is Less Than 1500
Operating Mesh Networks Through Switches and Routers
RADIUS Servers and the Management VLAN
Cisco 7920 Wireless IP Phone Support
Exclusion List (Blacklist) Client Feature
IPSec Clients Supported in This Release
Cisco Aironet 1030 Remote Edge Lightweight Access Points and WPA2-PSK
XAuth Configuration with NetScreen
Rekeys Not Supported with Cisco VPN Client
Management Usernames and Local Netuser Names
802.1x and Microsoft Wireless Configuration Manager
Cisco Aironet 1030 Remote Edge Lightweight Access Point Default Operation
Home Page Retains Web Auth Login with IE 5.x
Features Not Supported on 2000 Series Controllers
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
Pinging from Any Network Device to a Dynamic Interface IP Address Is Not Supported
2006 Image Not Supported for 3504 Controllers
Running a 3504 Image on a 2000 Series Controller
Cisco Lightweight Access Points Fail to Join Cisco Controllers
Upgrading External Web Authentication
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support & Documentation Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 3.2.116.21
March 3, 2006These release notes describe new and changed information as well as open and resolved caveats for operating system release 3.2.116.21 for Cisco 2000, 4100, and 4400 Series Wireless LAN Controllers; Cisco Wireless Services Modules (WiSM); Cisco Wireless LAN Controller Network Modules; and Cisco Aironet 1000, 1130, 1200, 1240, and 1500 Series Lightweight Access Points, which comprise part of the Cisco Unified Wireless Network (Cisco UWN) Solution.
Note
Unless otherwise noted, all of the Cisco wireless LAN controllers are hereafter referred to as controllers, and all of the Cisco lightweight access points are hereafter referred to as access points.
Contents
These release notes contain the following sections:
•
•
•
•
Cisco Unified Wireless Network Solution Components
The following components are part of the Cisco UWN Solution and are compatible in this release:
•
•
•
•
•
•
•
•
Controller Requirements
The controller graphical user interface (GUI) requires the following operating system and web browser:
•
•
Note
Software Release Information
Operating system software is factory installed on your controller and automatically downloaded to the access points after a release upgrade and whenever an access point associates to a controller. As new releases become available for the controllers and their associated access points, consider upgrading.
Note
Finding the Software Release
To find the software release running on your controller, look on the Monitor > Summary page of the controller GUI or enter show sysinfo on the controller command line interface (CLI).
Upgrading to a New Software Release
When a controller is upgraded, the code on its associated access points is also automatically upgraded. When an access point is loading code, each of its lights blinks in succession.
Caution
Cisco recommends the following sequence when performing an upgrade:
1.
2.
3.
http://www.cisco.com/en/US/products/ps6366/products_installation_and_configuration_guides_list.html
4.
Note
New and Changed Information
VPN Termination Module for the 4400 Series Controllers
A virtual private network (VPN) termination hardware module is being released for the 4400 series controllers. As with the VPN termination module available today for the 4100 series controllers, this module enables the 4400 series controllers to terminate VPN client sessions directly on the controller. The module features these capabilities:
•
•
•
•
•
•
•
802.3 Bridging
Cisco 2000 series controllers support 802.3 bridging in software release 3.2.116.21. This feature is disabled by default. However, you can enable or disable it through the controller CLI by entering this command:
config network 802.3-bridging {enable | disable}
When 802.3 bridging is enabled, all of the 802.3 frames are forwarded to or from the client. The original LLC/SNAP and length of the frame is preserved during encapsulation or de-capsulation of the LWAPP data frame. For short frames, the trailer is stripped before adding the LWAPP header. Tunneling of 802.3 frames is not supported.
Note
Configurable DHCP Proxy
DHCP proxy is configurable in software release 3.2.116.21 using the following command:
config dhcp proxy {enable | disable}
Note
New LWAPP Power Injector Commands
Two new LWAPP power injector commands are available in software release 3.2.116.21. These commands are used when the access point is powered by a power injector that is connected to a Cisco pre-Intelligent Power Management (pre-IPM) switch.
•
This command is recommended when the customer's network contains any older Cisco 6-Watt switches that could be accidentally overloaded if connected directly to the 12-Watt access point. The access point remembers that a power injector is connected to this particular switch port. If the access point is relocated, this command must be re-issued after the presence of a new power injector is verified.
•
This command is acceptable to use when the customer's network does not contain any older Cisco 6-Watt switches that could be overloaded if connected directly to the 12-Watt access point. The access point assumes that a power injector is always connected. If the access point is relocated, it continues to assume that a power injector is present.
Support for WPA1 and WPA2 Hex Keys
Cisco controllers support WPA1 and WPA2 hex keys in software release 3.2.116.21. You can specify these keys through the controller CLI by entering these commands:
config wlan security wpa1 pre-shared-key {enable | disable} wlan_id {ascii | hex} key
config wlan security wpa2 pre-shared-key {enable | disable} wlan_id {ascii | hex} key
Installation Notes
This section contains important information to keep in mind when installing your controllers and access points.
Warnings
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Safety Information
Follow the guidelines in this section to ensure proper operation and safe use of the controllers and access points.
FCC Safety Compliance Statement
FCC Compliance with its action in ET Docket 96-8, has adopted a safety standard for human exposure to RF electromagnetic energy emitted by FCC certified equipment. When used with approved Cisco Aironet antennas, Cisco Aironet products meet the uncontrolled environmental limits found in OET-65 and ANSI C95.1, 1991. Proper operation of this radio device according to the instructions in this publication results in user exposure substantially below the FCC recommended limits.
Safety Precautions
Each year hundreds of people are killed or injured when attempting to install an antenna. In many of these cases, the victim was aware of the danger of electrocution but did not take adequate steps to avoid the hazard.
For your safety, and to help you achieve a good installation, read and follow these safety precautions. They may save your life!
1.
2.
3.
4.
5.
a.
b.
c.
6.
7.
8.
Installation Instructions
Refer to the appropriate Quick Start Guide or Hardware Installation Guide for instructions on installing your controllers and access points.
Note
Personnel installing the controllers and access points must understand wireless techniques and grounding methods. Access points with internal antennas can be installed by an experienced IT professional.
The controller must be installed by a network administrator or qualified IT professional, and the proper country code must be selected. Following installation, access to the controller should be password protected by the installer to maintain compliance with regulatory requirements and ensure proper unit functionality.
Important Notes
This section describes important information about the controllers and access points.
FIPS 140-2
The Cisco 4400 Series Controllers are on the NIST FIPS 140-2 Pre-Validation List.
Controllers Must Run Release 3.2.116.21 to Support -P Regulatory Domain
To support access points configured for use in Japan, you must upgrade the controller software to release 3.2.116.21. Earlier releases do not support access points configured for use in Japan (regulatory domain -P).
Access Points Fail to Join Controllers If MTU Setting Is Less Than 1500
When the network path between access points and the controller is configured for an MTU size less than 1500, the controller does not receive join requests from access points in local mode. (MTU settings less than 1500 are common when you use tunneling protocols such as IPsec VPN, GRE, and MPLS.) The access point join request is larger than 1500 bytes, so the request is fragmented. The size of the first fragment is 1500 bytes (including IP and UDP header) and the second fragment is 54 bytes (including IP and UDP header).
Access points in REAP mode are not affected by this limitation, and the problem is resolved in the 4.0 release train because the LWAPP tunnel can reassemble up to 4 fragments. The problem occurs when all four of these conditions exist on your network:
•
•
•
•
Workarounds
Use one of these workarounds to resolve the problem on your network:
•
•
•
Voice WLAN Configuration
Cisco recommends that load balancing always be turned off in any wireless LAN that is supporting voice, regardless of vendor. When load balancing is turned on, voice clients can hear an audible artifact when roaming, and the handset is refused at its first reassociation attempt.
Inter-Subnet Roaming
Currently, multicast traffic cannot be passed during inter-subnet roaming.
Operating Mesh Networks Through Switches and Routers
In mesh networks that operate through low-speed switches and routers, access points can disconnect from the controller, causing the controller to generate alerts.
Heavily Loaded Controller CPU
When the controller CPU is heavily loaded (for example, when doing file copies or other tasks), it does not have time to process all of the ACKs that the NPU sends in response to configuration messages. When this happens, the CPU generates error messages. However, the error messages do not impact service or functionality.
RADIUS Servers and the Management VLAN
The RADIUS server can be on any subnet as long as it can be reached by the management VLAN subnet.
The controllers can be managed via the management VLAN subnet from any other subnet that can reach the management VLAN subnet.
Cisco 7920 Wireless IP Phone Support
When using Cisco 7920 Wireless IP Phones with controllers, make sure that the phones and controllers are configured as follows:
•
•
–
Note
–
–
–
–
Note
–
•
•
•
Exclusion List (Blacklist) Client Feature
If a client is not able to connect to an access point and the security policy for the WLAN and/or client is correct, the client has probably been disabled. In the controller GUI, you can view the client's status on the Monitor > Summary page under Client Summary. If the client is disabled, click Remove to clear the disabled state for that client. The client automatically comes back and, if necessary, reattempts authentication.
Automatic disabling happens as a result of too many failed authentications. Clients disabled due to failed authorization do not appear on the permanent disable display. This display is only for those MACs that are set as permanently disabled by the administrator.
IPSec Clients Supported in This Release
This operating system release has been tested with the following IPSec clients:
•
•
•
•
Note
Maximum MAC Filter Entries
The controller database can contain up to 2048 MAC filter entries for local netusers.
Client Channel Changes
Cisco access points are known to go off channel for up to 30 seconds while identifying rogue access point threats. This activity can cause occasional dropped client connections.
Cisco Aironet 1030 Remote Edge Lightweight Access Points and WPA2-PSK
Cisco Aironet 1030 Remote Edge Lightweight Access Points do not support WPA2-PSK in REAP standalone mode.
XAuth Configuration with NetScreen
To initiate an XAuth session, configure XAuth on the controller and enable extended authentication on the NetScreen client.
Rekeys Not Supported with Cisco VPN Client
If a rekey occurs, clients must reauthenticate. To mitigate this problem, navigate to the WLANs > Edit page in the controller GUI, choose IPsec from the Layer 3 Security drop-down box, and change the Lifetime setting at the bottom of the page to a large value, such as 28800 seconds (this is the default value), depending upon your security requirements.
RADIUS Servers
This product has been tested with the following RADIUS servers:
•
•
•
•
Management Usernames and Local Netuser Names
Management usernames and local netuser names must be unique because they are stored in the same database. That is, you cannot assign the same name to a management user and a local netuser.
802.1x and Microsoft Wireless Configuration Manager
Clients using the Microsoft Wireless Configuration Manager and 802.1x must use WLANs configured for 40- or 104-bit key length. Configuring for 128-bit key length results in clients that can associate but not authenticate.
Cisco Aironet 1030 Remote Edge Lightweight Access Point Default Operation
When a controller reboots, dropped Cisco Aironet 1030 Remote Edge Lightweight Access Points attempt to associate to any available controller. If the access points cannot contact a controller, they continue to offer 802.11a/b/g service on WLAN 1 only.
WEP Keys
This release supports four separate WEP index keys. These keys cannot be duplicated between WLANs. At most, four WEP WLANs can be configured on a controller. Each of these WLANs must use a different key index.
Using the Backup Image
The controller bootloader (ppcboot) stores a copy of the active primary image and the backup image. If the primary image becomes corrupted, you can use the bootloader to boot with the backup image.
With the backup image stored before rebooting, be sure to choose Option 4: Change Active Boot Image from the boot menu to set the backup image as the active boot image. Otherwise, when the controller resets, it again boots off the corrupted primary image.
After the controller boots, the active boot image can be changed to the backup image using the config boot backup command.
Home Page Retains Web Auth Login with IE 5.x
Due to a caching issue in the Internet Explorer 5.x browser, the home page retains the web authentication login. To correct this issue, clear the history or upgrade your workstation to Internet Explorer 6.x.
RLDP Enable/Disable
The RLDP protocol detects rogues on your wired network. When RLDP is enabled, the controller reports a threat alarm for each rogue detected on the wired network. When RLDP is disabled, rogues detected on the wired network are shown in the Alert state.
Disabling RLDP stops the controller from detecting rogues on the wired network. Rogues can be manually contained by changing the status of the detected rogues. When rogues are being contained, you must manually disable containment for each rogue individually.
Ad-Hoc Rogue Containment
Client card implementations may mitigate the effectiveness of ad hoc containment.
Apple iBook
Some Apple operating systems require shared key authentication for WEP. Other releases of the operating system do not work with shared key WEP unless the client saves the key in its key ring. How you should configure your controller is based on the client mix you expect to use. Cisco recommends testing these configurations before deployment.
Features Not Supported on 2000 Series Controllers
These hardware features are not supported on 2000 series controllers:
•
•
These software features are not supported on 2000 series controllers:
•
•
•
•
•
•
•
•
•
•
•
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
In a crowded RF environment, clients may not be able to detect the desired SSID because of internal table limitations. Sometimes disabling and then enabling the client interface forces a rescan. Your RF environment needs to be controlled. Cisco UWN rogue access point detection and containment can help you to enforce RF policies in your buildings and campuses.
Pinging from Any Network Device to a Dynamic Interface IP Address Is Not Supported
Clients on the WLAN associated with the interface pass traffic normally.
2006 Image Not Supported for 3504 Controllers
The 2006 controller image is supported for use with only 2000 series controllers. Do not install the 2006 image on a 3504 controller. Otherwise, errors may occur. Install only the 3504 image on a 3504 controller.
Running a 3504 Image on a 2000 Series Controller
It is possible to run a 3504 controller image on a 2000 series controller, but Cisco Aironet 1130, 1200, and 1240 series access points will not be able to connect to the controller.
Cisco Lightweight Access Points Fail to Join Cisco Controllers
When a Cisco lightweight access point is connected to a terminal server port and reboots because of a join failure or timeout, this sequence repeats until the access point returns to the boot prompt and remains there. This condition occurs when there is no telnet session to the access point's console port and when the controller is not responding to the access point's join response.
Workaround: Disconnect the access point's console port from the terminal server. Reprogram the controller to have it respond to the access point's join request. Power cycle the access point to force a restart.
Upgrading External Web Authentication
When upgrading a controller from operating system release 2.0 or 2.2.127.4 to release 3.2.116.21, update the external web authentication configuration as follows:
1.
config custom-web ext-webserver add IP-address
Note
2.
<html><head><meta http-equiv="Pragma" content="no-cache"> <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <title>Web Authentication</title> <script>function submitAction(){var link = document.location.href;var searchString = "redirect=";var equalIndex = link.indexOf(searchString);var redirectUrl = "";var urlStr = "";if(equalIndex > 0) {equalIndex += searchString.length;urlStr = link.substring(equalIndex);if(urlStr.length > 0){redirectUrl += urlStr;if(redirectUrl.length > 255)redirectUrl = redirectUrl.substring(0,255);document.forms[0].redirect_url.value = redirectUrl;}}document.forms[0].buttonClicked.value = 4;document.forms[0].submit();}function loadAction(){var url = window.location.href;var args = new Object();var query = location.search.substring(1);var pairs = query.split("&");for(var i=0;i<pairs.length;i++){var pos = pairs[i].indexOf('=');if(pos == -1) continue;var argname = pairs[i].substring(0,pos);var value = pairs[i].substring(pos+1);args[argname] = unescape(value);}//alert( "AP MAC Address is " + args.ap_mac);//alert( "The Switch URL is " + args.switch_url);document.forms[0].action = args.switch_url;// This is the status code returned from webauth login action// Any value of status code from 1 to 5 is error condition and user// should be shown error as below or modify the message as it suits// the customerif(args.statusCode == 1){alert("You are already logged in. No further action is required on your part.");}else if(args.statusCode == 2){alert("You are not configured to authenticate against web portal. No further action is required on your part.");}else if(args.statusCode == 3){alert("The username specified cannot be used at this time. Perhaps the username is already logged into the system?");}else if(args.statusCode == 4){alert("Wrong username and password. Please try again.");}else if(args.statusCode == 5){alert("The User Name and Password combination you have entered is invalid. Please try again.");}}</script></head><body topmargin="50" marginheight="50" onload="loadAction();"> <form method="post"> <input TYPE="hidden" NAME="buttonClicked" SIZE="16" MAXLENGTH="15" value="0"> <input TYPE="hidden" NAME="redirect_url" SIZE="255" MAXLENGTH="255" VALUE=""> <input TYPE="hidden" NAME="err_flag" SIZE="16" MAXLENGTH="15" value="0"><div align="center"><table border="0" cellspacing="0" cellpadding="0"> <tr> <td> </td></tr><tr align="center"> <td colspan="2"><font size="10" color="#336699">Web Authentication</font></td></tr><tr align="center"><td colspan="2"> User Name <input type="TEXT" name="username" SIZE="25" MAXLENGTH="63" VALUE=""> </td> </tr> <tr align="center" > <td colspan="2"> Password <input type="Password" name="password" SIZE="25" MAXLENGTH="24"> </td> </tr><tr align="center"><td colspan="2"><input type="button" name="Submit" value="Submit" class="button" onclick="submitAction();"> </td> </tr> </table> </div></form></body></html>Caveats
This section lists resolved and open caveats in operating system release 3.2.116.21 for Cisco controllers and lightweight access points.
Resolved Caveats
These caveats are resolved in operating system release 3.2.116.21.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
http://www.cisco.com/en/US/products/products_security_advisory09186a0080572f55.shtml
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Open Caveats
These caveats are open in operating system release 3.2.116.21.
•
Workaround: Make sure that the anchor controller is a mobility group member.
•
Workaround: Manually configure the correct time on the controller (config time manual date time) or reconfigure the NTP server entry on the controller (config time ntp server inxex IP-address). The second option triggers the controller to connect to the NTP server and synchronize its time.
•
Workaround: None at this time.
•
Workaround: Use the controller CLI to view all the Local Net User entries.
•
Workaround: This problem can cause some inconvenience, and the user may prefer to use the CLI configuration wizard instead to avoid it.
•
Workaround: Reboot the controller through the CLI to access the wizard again.
•
Workaround: Do not configure the service VLAN as one of the VLANs on a data port.
•
Workaround: Make sure that wireless LANs with a large number of clients associated are not deleted or disabled.
•
Workaround: Use 9-character bridge group names.
•
Workaround: None at this time.
Note
•
Workaround: None in this release.
•
Workaround: Set the time on the controller before allowing the access points to connect to the controller.
•
debug dot1x events enable
In the body of the trace that follows authentication by an affected client, the following messages appear:
Fri Jun 3 07:29:59 2005: Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx
Fri Jun 3 07:29:59 2005: Received EAPOL-key message with invalid version number from mobile xx:xx:xx:xx:xx:xx
Workaround: Configure WMM policy to be allowed for the wireless LAN on the controller. To do this on the GUI, browse to the WLANs > Edit page for the appropriate WPA1 wireless LAN, and choose Allowed or Required in the WMM Policy drop-down box. The Allowed option means that both WMM and non-WMM clients can authenticate and receive an IP address (for example, both Aironet ACU 6.5/6.4 and 6.3 clients could authenticate and receive an IP address). The Required option means that only WMM clients can authenticate (that is, only ACU 6.5/6.4 clients).
•
Workaround: None at this time.
•
Workaround: None for this release.
•
Workaround: Leave the WiSM management interface as tagged or untagged.
•
Workaround: None for this release.
•
Workaround: Ignore the prompt and exit as usual.
•
Workaround: Download new code images to the WiSM at times when there are no clients to be affected.
•
Workaround: None for this release.
•
Workaround: None for this release.
•
Workaround: None for this release.
•
Workaround: None for this release.
•
Workaround: Reset the system through IOS or power the device off and on if necessary.
•
Workaround: Download new code images to the WiSM a second time.
•
Workaround: None for this release.
•
Workaround: None for this release.
•
Workaround: Apply the Microsoft KB 883659 patch to IAS. The Microsoft patch may or may not work. There is no workaround on the controller.
•
Workaround: None for this release.
•
Workaround: Do not assign VPN passthrough along with web policy.
•
Workaround: None for this release.
•
Workaround: In order to set the 802.11a radio to channel 165 when using the -A SKU, set the country code of the controller to USX. For the -N SKU, please select one of the available channels.
•
Workaround: Under investigation.
•
Workaround: None for this release.
•
Workaround: Disabling CDP resolves this issue.
•
Workaround: Before deleting a mobility member, first delete the controller to which it is mapped from the WLAN.
•
Workaround: Use WCS to view the correct values.
•
Workaround: None for this release.
•
Workaround: Under investigation.
•
These levels correspond to -6, -9, and (in the case of 5500 to 5700 MHz) -12 dB from the maximum power, respectively. Power levels 1, 2, and (in the case of 5500 to 5700 MHz) 3 are supported, which correspond to maximum power for the particular data rate and channel, and -3 dB relative to this maximum, at which these adjustment levels provide little or no further reduction in transmit power output.
Workaround: Set the transmit power level to either 1 or 2 for 5745 to 5825 MHz. Set the transmit power level to either 1, 2, or 3 for all other bands.
•
Workaround: Under investigation.
•
Workaround: Configure the access point as a rooftop access point using the controller CLI.
•
Workaround: Configure the controller using this command: config network allow-old-bridge-aps disable.
•
Workaround: Configure Auto mode on all RAPs and PAPs.
•
Workaround: None at this time.
•
Workaround: Use the non-keywrap method.
•
Workaround: Configure the access points for local mode.
•
Workaround: Set the WMM Policy parameter to either Allowed or Required.
•
Workaround: Before upgrading the controller software, enter the show acl detailed acl_name command on the controller CLI to see the details of the configured ACL. Then manually apply the ACL after the upgrade.
Troubleshooting
For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at
http://www.cisco.com/en/US/support/index.html
Click Product Support > Wireless. Then choose your product and Troubleshooting to find information on the problem you are experiencing.
Related Documentation
For additional information on the Cisco controllers and lightweight access points, refer to these documents:
•
•
•
•
•
•
You can access these documents from this link:
http://www.cisco.com/en/US/products/hw/wireless/tsd_products_support_category_home.html
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/techsupport
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Product Documentation DVD
The Product Documentation DVD is a comprehensive library of technical product documentation on a portable medium. The DVD enables you to access multiple versions of installation, configuration, and command guides for Cisco hardware and software products. With the DVD, you have access to the same HTML documentation that is found on the Cisco website without being connected to the Internet. Certain products also have .PDF versions of the documentation available.
The Product Documentation DVD is available as a single unit or as a subscription. Registered Cisco.com users (Cisco direct customers) can order a Product Documentation DVD (product number DOC-DOCDVD= or DOC-DOCDVD=SUB) from Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
Ordering Documentation
Registered Cisco.com users may order Cisco documentation at the Product Documentation Store in the Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
Nonregistered Cisco.com users can order technical documentation from 8:00 a.m. to 5:00 p.m. (0800 to 1700) PDT by calling 1 866 463-3487 in the United States and Canada, or elsewhere by calling 011 408 519-5055. You can also order documentation by e-mail at tech-doc-store-mkpl@external.cisco.com or by fax at 1 408 519-5001 in the United States and Canada, or elsewhere at 011 408 519-5001.
Documentation Feedback
You can rate and provide feedback about Cisco technical documents by completing the online feedback form that appears with the technical documents on Cisco.com.
You can submit comments about Cisco documentation by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you will find information about how to:
•
•
•
A current list of security advisories, security notices, and security responses for Cisco products is available at this URL:
To see security advisories, security notices, and security responses as they are updated in real time, you can subscribe to the Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed. Information about how to subscribe to the PSIRT RSS feed is found at this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you have identified a vulnerability in a Cisco product, contact PSIRT:
•
An emergency is either a condition in which a system is under active attack or a condition for which a severe and urgent security vulnerability should be reported. All other conditions are considered nonemergencies.
•
In an emergency, you can also reach PSIRT by telephone:
•
•
Tip
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
The link on this page has the current PGP key ID in use.
If you do not have or use PGP, contact PSIRT at the aforementioned e-mail addresses or phone numbers before sending any sensitive material to find other means of encrypting the data.
Obtaining Technical Assistance
Cisco Technical Support provides 24-hour-a-day award-winning technical assistance. The Cisco Technical Support & Documentation website on Cisco.com features extensive online support resources. In addition, if you have a valid Cisco service contract, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not have a valid Cisco service contract, contact your reseller.
Cisco Technical Support & Documentation Website
The Cisco Technical Support & Documentation website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support & Documentation website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests, or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—An existing network is down, or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of the network is impaired, while most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
•
http://www.cisco.com/go/marketplace/
•
•
•
http://www.cisco.com/go/iqmagazine
or view the digital edition at this URL:
http://ciscoiq.texterity.com/ciscoiq/sample/
•
•
http://www.cisco.com/en/US/products/index.html
•
http://www.cisco.com/discuss/networking
•
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0601R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006 Cisco Systems, Inc. All rights reserved.
Guest
