Table of ContentsRelease Notes for Cisco Secure Access Control Server for Windows Server Version 3.1.2
New and Changed Features in 3.1.1
Changed Features in 3.1.2
Changes to Token Server Support
Changes to CiscoSecure Database Replication
Changes to Inter-Cisco Secure ACS Communication
Limitations and Restrictions
Supported Upgrade Versions
Supported Operating System
Upgrading from Windows NT 4.0
EAP-TLS Authentication with Active Directory
Tested EAP-TLS Dialup with IOS
Tested Certificate Servers
Supported Web Browser Versions
Tested Token Server Versions
Tested LDAP Server
Tested Novell NDS and Novell Clients
Tested Windows User Databases
Tested Platforms for CiscoSecure Authentication Agent
Cisco Catalyst Switches
Cisco Secure PIX Firewall
Cisco VPN 3000 Concentrator
Cisco VPN 5000 Concentrator
Resolved Caveats—Version 3.1.1
Open Caveats—Version 3.1.2
Obtaining Technical Assistance
Obtaining Additional Publications and Information
- Documentation Roadmap
- New and Changed Features in 3.1.1
- Changed Features in 3.1.2
- Installation Notes
- Changes to Token Server Support
- Changes to CiscoSecure Database Replication
- Changes to Inter-Cisco Secure ACS Communication
- Evaluation Version
- Limitations and Restrictions
- Obtaining Documentation
- Obtaining Technical Assistance
- Obtaining Additional Publications and Information
Cisco Secure ACS provides authentication, authorization, and accounting (AAA—pronounced "triple A") services to network devices that function as AAA clients, such as a network access server, PIX Firewall, or router. A AAA client is any such device that provides AAA client functionality and uses one of the AAA protocols supported by Cisco Secure ACS. For a general description of Cisco Secure ACS and its features, see User Guide for Cisco Secure ACS for Windows Server.
With the exception of online documentation, all Cisco Secure ACS documentation is available in PDF format on the product CD. The documentation directory on the CD also contains a white paper about Cisco Secure ACS and related products and technologies.
- Installation Guide for Cisco Secure ACS for Windows Server (DOC-7814713=)—Contains information and procedures required for installing Cisco Secure ACS.
- User Guide for Cisco Secure ACS for Windows Server (DOC=7814696=)—Contains concepts about Cisco Secure ACS and procedures for using all Cisco Secure ACS features.
- Installation and User Guide for Cisco Secure ACS User-Changeable Passwords—Contains procedures for installing and using the User-Changeable Password utility for Cisco Secure ACS.
- Online Documentation—In addition to the abbreviated help that appears adjacent to every page in the Cisco Secure ACS HTML interface, the online documentation contains the same information as User Guide for Cisco Secure ACS for Windows Server.
- PEAP Support—PEAP provides stronger security, greater extensibility, and support for one-time token authentication and password aging. The goal of our PEAP implementation is to replace LEAP client/server user authentication services with the standards-based, non-proprietary PEAP protocol for wireless user authentication. PEAP provides enhanced security and richer extensibility of end-user databases than can be provided with LEAP.
- SSL Support for Administrative Access—Administrative access to the Cisco Secure ACS HTML interface can be secured with SSL. This security enhancement provides both certificate-based server authentication and encrypted tunnel support so that administrative access is encrypted with SSL.
- CHPASS Improvements—Cisco Secure ACS allows you to control whether network administrators can change passwords during Telnet sessions hosted by TACACS+ AAA clients.
- Improved IP Pool Addressing—Cisco Secure ACS uses the IETF RADIUS Class attribute as an additional index for user sessions. This reduces the possibility of allocating an IP address that is already in use but incorrectly reported to Cisco Secure ACS as released.
- Network Device Search—You can search for a configured network device based on the device name, IP address, type (AAA client or AAA server), and network device group. This feature is particularly useful if you are managing several network devices.
- Improved PKI Support—During EAP-TLS authentication, Cisco Secure ACS can perform binary comparison of the certificate received from an end-user client to user certificates stored in LDAP directories.
- EAP Proxy Enhancements—Cisco Secure ACS supports LEAP and EAP-TLS proxy to other RADIUS or external databases using EAP over standard RADIUS. Previous versions of Cisco Secure ACS relied on LEAP proxy using MSCHAP over RADIUS proxy, making it more difficult to scale over an extended range of external user databases.
- Cisco Management Center Application Support—Cisco Secure ACS provides a consolidated administrative TACACS+ control framework for many Cisco security management tools, such as CiscoWorks VPN/Security Management Solution (VMS) and CiscoWorks Management Centers.
- New CSMon test for the internal database—CSMon periodically tests the internal database to determine if database reads function properly. If not, CSMon restarts CSAuth automatically.
- Updated Cisco VPN 3000 RADIUS dictionary—The Cisco VPN 3000 RADIUS vendor-specific attributes (VSAs) in Table 1 have been changed.
With the exception of RSA SecurID token servers, Cisco Secure ACS supports token servers using RADIUS. This is a change from earlier versions, which used vendor-proprietary interfaces for token servers. Beginning with Cisco Secure ACS 3.0.1, we supported CRYPTOCard token servers using a standard RADIUS interface. Cisco Secure ACS 3.1 extends the use of RADIUS to all token servers except RSA SecurID. For RSA SecurID, the vendor-proprietary interface is used.
If you upgrade to Cisco Secure ACS 3.1, the installation program may prompt you for information about token servers, depending on the version of Cisco Secure ACS you are upgrading from and the token server databases detected by the upgrade process.
With this information, the installation program replaces the older token server configuration with a new one that uses the RADIUS interface of the token server. For more information about RADIUS support by your token server, see the applicable token server documentation.
|Note If a RADIUS-based token server, such as CRYPTOCard, runs on the same computer as Cisco Secure ACS, make sure that the token server uses UDP ports different from the ports used by Cisco Secure ACS to receive RADIUS requests. For information about RADIUS ports used by Cisco Secure ACS, see User Guide for Cisco Secure ACS for Windows Server. For information about RADIUS ports used by a token server, see the applicable token server documentation.|
We enhanced the CiscoSecure Database Replication feature to require a handshake between primary and secondary Cisco Secure ACSes. The handshake is based upon the shared secret of the primary Cisco Secure ACS.
Each Cisco Secure ACS has a AAA Servers table that lists itself and the other Cisco Secure ACSes that it is configured to communicate with. Each entry in the AAA Servers table records a shared secret for the Cisco Secure ACS that the list entry represents. The shared secret for the primary Cisco Secure ACS is defined in the AAA Servers table entry that the primary Cisco Secure ACS has for itself.
Each secondary Cisco Secure ACS must have a AAA Servers table entry for the primary Cisco Secure ACS. The shared secret in that entry must be identical to the shared secret in the AAA Servers table entry that the primary Cisco Secure ACS has for itself. When this is true, replication succeeds.
If a secondary Cisco Secure ACS has a AAA Servers table entry for the primary Cisco Secure ACS and the shared secret in that entry does not match the shared secret that the primary Cisco Secure ACS records for itself, replication fails.
|Note We do not support replication through gateway devices performing NAT. The pre-replication shared secret handshake does not permit replication when either the primary or secondary Cisco Secure ACS is behind a device performing NAT.|
|Tip If you are upgrading to Cisco Secure ACS version 3.1 and you use CiscoSecure Database Replication, we recommend that you verify that primary Cisco Secure ACSes and all their secondary Cisco Secure ACSes record identical shared secrets for the primary Cisco Secure ACS.|
- Remote logging with Cisco Secure ACS 3.1 can only occur with other Cisco Secure ACSes that run version 3.1.
- The only version of the web-based User-Changeable Passwords (UCP) application that works with Cisco Secure ACS 3.1 is the version of UCP distributed with Cisco Secure ACS 3.1. If you are upgrading to Cisco Secure ACS 3.1 and you use UCP, you must upgrade UCP, too.
The evaluation version of Cisco Secure ACS 3.1 provides full functionality for 90 days after the date of installation. This allows you to use all features of Cisco Secure ACS 3.1 while determining if it suits your needs. The evaluation version of Cisco Secure ACS 3.1 will be available within 30 days after the release of the commercial version of Cisco Secure ACS 3.1.
When the evaluation period has elapsed, the CSRadius and CSTacacs services fail to start. You will receive a message upon accessing the HTML Cisco Secure ACS HTML interface notifying you that your evaluation period has elapsed.
Please contact your Cisco Sales Representative(s) to inquire about purchasing the commercial version of Cisco Secure ACS. To purchase the commercial version of Cisco Secure ACS 3.1 online, use Part Number CSACS-3.1-WIN-K9 at the following URL:
After purchasing a commercial version of Cisco Secure ACS 3.1, you can upgrade your Cisco Secure ACS server from the evaluation version to the commercial version by installing the commercial version over the evaluation version. For information on installing Cisco Secure ACS 3.1, follow the instructions in Installation Guide for Cisco Secure ACS for Windows Server, version 3.1.
The next release of Cisco Secure ACS 3.2 includes expanded support for downloadable ACLs. With Cisco Secure ACS 3.2, you can use downloadable ACLs with Cisco VPN 3000-series concentrators that use version 4.0 or greater of the VPN 3000 operating system.
Cisco Secure ACS 3.1.1 supports downloadable ACLs only with Cisco PIX devices using a version of the PIX operating system capable of supporting downloadable ACLs. With Cisco Secure ACS 3.1.2, the Downloadable PIX ACLs feature remains limited to PIX devices.
|Tip An easy way to distinguish whether a version of Cisco Secure ACS supports only Cisco PIX devices with downloadable ACLs is to determine the name of the downloadable ACL feature in the Shared Profile Components section of the Cisco Secure ACS HTML interface. In Cisco Secure ACS 3.0 and 3.1, that feature is named "Downloadable PIX ACLs", indicating the limitation of support to PIX devices. In Cisco Secure ACS 3.2, the corresponding feature is named "Downloadable IP ACLs", reflecting the expanded support.|
|Note The Downloadable PIX ACL feature is not compatible with Cisco IOS lock-and-key security or the dynamic ACLs used with the lock-and-key feature of Cisco IOS.|
Cisco Secure ACS has not been interoperability tested with other Cisco software. Other than for the software and operating system versions listed in this document, we performed no interoperability testing. Using untested software with Cisco Secure ACS may cause undesired results. For the best performance of Cisco Secure ACS, we recommend that you use the versions of software and operating systems listed in this document.
We tested Cisco Secure ACS 3.1.2 with the English-language version of Windows 2000 Service Pack 4 and with Microsoft patch MS03-026 applied.
|Note Windows 2000 Advanced Server and Windows 2000 Datacenter Server are not supported operating systems.|
Cisco Secure ACS 3.1 runs only on Windows 2000 Server (for operating system requirements, see Installation Guide for Cisco Secure ACS for Windows Server. If you are upgrading from a previous version of Cisco Secure ACS that is running on Windows NT 4.0, you cannot upgrade the operating system to Windows 2000 Server. This is because the setup program for previous versions of Cisco Secure ACS detected which Windows operating system the computer used and customized Cisco Secure ACS for that operating system. As a result, upgrading the operating system to Windows 2000 Server without taking the necessary steps causes Cisco Secure ACS to fail.
- External Databases Only—PEAP only supports external user databases. The CiscoSecure user database cannot support PEAP authentication; therefore, only users who have an account in a supported external user database can authenticate with PEAP.
- Unknown User Processing—Enabling unknown user processing is strictly required to support PEAP authentication. Cisco Secure ACS uses unknown user processing during phase 1 of PEAP authentication, when the username is not known to Cisco Secure ACS. For more information about the Unknown User Policy, see User Guide for Cisco Secure ACS for Windows Server.
|Tip Unknown user processing can introduce large latencies during authentication. Be sure to configure the Unknown User Policy page to account for this possibility. For more information, see User Guide for Cisco Secure ACS for Windows Server.|
|Note Cisco Secure ACS 3.2 implements PEAP without the limitations imposed by Cisco Secure ACS 3.1.2.|
To perform EAP-TLS authentication using Active Directory as the external user database, Cisco Secure ACS must run on a domain controller. EAP-TLS authentication using Active Directory fails when Cisco Secure ACS runs on a member server.
We tested the HTML interface of Cisco Secure ACS 3.1.2 using an Microsoft Internet Explorer version 6.0. For administration of Cisco Secure ACS 3.1.2, we support only this browser, with the following additional restrictions:
|Note Cisco Secure ACS 3.1.2 uses a RADIUS interface to support all token servers, with the exception of RSA ACE/Server. For more information, see Changes to Token Server Support.|
We used Netware 6.0 to test Novell NDS v8.6 external user databases. We tested Cisco Secure ACS 3.1.2 with the Novell Requestor software found in Novell Client version 4.8.3 SP2 for Windows 2000. If you want to authenticate users with a Novell NDS external user database, you must install the Novell Requestor software on the computer that runs Cisco Secure ACS.
We have not tested CiscoSecure Authentication Agent specifically with Cisco Secure ACS 3.1.2; however, with Cisco Secure ACS 3.1.1, we tested CiscoSecure Authentication Agent on the following client platform operating systems:
|Note Caveats are printed word-for-word as they appear in our caveat tracking system.|
- CSCdx66485: discrepancies with Logged-in users report for Aironet users
- CSCdx81108: LDAP registry error
- CSCdy39914: wireless client cannot EAP login when max session limit is 1
- CSCdz48094: CSRadius preventing wlan APs failing over
- CSCdz90720: Replicated password changes do not work on the slave
- CSCea00643: eap-tls with dialup to IOS failing
- CSCea01192: SPC crash on open
- CSCea14558: call back fails when callback string is specified in active directory
- CSCea19930: Leak in CSAuth when using IP based NARs
- CSCea35303: Change of NDG for NAS isnt applied until CSAuth is restarted manual
- CSCea44596: Need to reboot ACS server before modified user detail are recognised
- CSCea54293: CSMon can crash when processing logging messages from other services
- CSCea65978: EAP compliance issues with ACS v3.1
- CSCea67792: Change of NDG for NAS isnt applied until CSAuth is restarted manual
- CSCea75293: Leak in CSAuth when using IP based NARs
- CSCea75308: Need to reboot ACS server before modified user detail are recognised
- CSCea87470: Unknown user policy with ACE has returned inconsistent group inform
- CSCeb11686: restarting the services does not unlock locked object
- CSCeb11691: SPC names are limited to 31 characters in size
- CSCeb34958: ACS CPU utilization 100% causes no authen after all
- CSCeb47081: Using VOIP accounting with CID as user names cause to problem
- CSCeb48341: duplicate selections from pull down menu of downloadable acl
- CSCeb63027: duplicate selections from pull down menu of downloadable acl
- CSCeb63031: SPC names are limited to 31 characters in size
- CSCeb63035: restarting the services does not unlock locked object
- CSCeb64302: Network Model within ACS Registry grows in accounting
- CSCeb64317: Network Model within ACS Registry grows in accounting
- CSCeb77357: ACS strips off CN from DN for GroupObjectType
- CSCec04053: CSAdmin and CSAuth could not start with DrWatson
- CSCec19050: Incorrect behavior under stress of EndPoint.dll
|Note Caveats are printed word-for-word as they appear in our caveat tracking system.|
- CSCdy65014: CSauth lockup during replication
- CSCdy50199: Restart condition for CSMon
- CSCdy50140: ACS backup routine does not erase all temporary created files
- CSCdy32890: Can not define multiple instances of cisco-ssg-control-info
- CSCdy19385: Whitespace only entries in Groupmap javacontol hang browser
- CSCdy18833: Auth. fails when ACS/NT 3.0 is auth. to Windows Active Directory
- CSCdy16496: T+ Hang when Varsdb breaks
- CSCdy16493: NDS does not auth FQ usernames if they begin with . [dot]
- CSCdy15215: Character in hostname crashes ACS
- CSCdy14582: Minimum account rights needed to start/stop CiscoSecure services
- CSCdy11858: When passwords are limited to alphanumeric, all CSMon tests fail
- CSCdy11740: Database replication partner order not saved
- CSCdy11718: Unable to add renamed user-defined attributes ito Radius accounting
- CSCdy02582: user CLID gets truncated after exporting into 3.0
- CSCdx92037: Configuring CSNT to use port 2002 only results in gui lockout
- CSCdx91072: ODBC Authentication with CHAP/MSCHAP1/2
- CSCdx62520: When passwords are limited to alphanumeric, all CSMon tests fail
- CSCdx29451: DB updates via RDBMS Sync do not cause replication
- CSCdx29446: unauthorized disclosure of data can be achieved using crafted URL
- CSCdx29403: CSRadius fails to restart properly on Submit & Restart
- CSCdx29400: CSRadius fails to restart properly on Submit & Restart
- CSCdx29389: NAR doesn't match with wildcards in NAS definition
- CSCdx29383: ODBC Authentication with CHAP/MSCHAP1/2
- CSCdx29378: Distribution table and test accounts
- CSCdx29377: GlobalAuthenticationConfiguration should be added as per adm privilege
- CSCdx29374: sending crafted URL can cause CSADMIN to crash or exec user code
- CSCdx29372: Radius Proxy of accounting packets kill CSRadius
- CSCdx29370: T+ crashes under load
- CSCdx29368: ACS 3.0 crash with Dr Watson Accounting request has no status type
- CSCdx21407: Allow anonymous administrator username and password for LDAP
- CSCdx19053: User guide wrongly states that reboot.bat exists
- CSCdx16701: CSNT variable lengths (groups, NASs restrictions, etc.) undocumented
- CSCdw86405: ResetCounters and Quota assignment Action codes are swapped
- CSCdw64726: Embedded Documentation on Replication Configuration vague
- CSCdw51174: Replication log message shows error on successful completion
- CSCdw48049: Docs need clarification regarding Windows authentication
- CSCdw45665: Docs inaccurate and incomplete regarding max number of AAA clients
- CSCdw27571: GlobalAuthenticationConfiguration should be added as per adm privele
- CSCdw19605: ACS 2.6(3) stops authenticating under heavy load - NDS
- CSCdw09587: acs with external database DB2,not send foreign IP
- CSCdw07015: Class attribute missing from Radius Accounting section
- CSCdv62731: Docs wrong about Domain List effect on failed Win DB logins
- CSCdv47186: Unable to add renamed user-defined attribute ito Radius accounting
- CSCdu39662: ERROR_EXPORT_DISK_TOO_LOW error when upgrading to CSNT 2.6
- CSCdp40874: CSNT refuse/allow new behavior undocumented
|Note Caveats are printed word-for-word as they appear in our caveat tracking system.|
A PPTP tunnel using a Cisco VPN 3000-series concentrator and MS-CHAP version 2 fails. The VPN concentrator indicates that authentication passed; however, tunnel establishment fails. When using the MS-CHAP version 1 method with the same configuration, tunnel establishment succeeds. When using the concentrator's internal user database with MS-CHAP version 2, tunnel establishment succeeds.
Setup two users at least on Cisco Secure ACS, one as a tunnel user and the others as the authenticated users. The tunnel user and its password should be the same as the tunnel group name on the concentrator and its password.
- In "IETF RADIUS Attributes" check the " Class" attribute and the following value should be entered in the text box: "ou=groupname;" where groupname is the name of the tunnel user name previously configured.
- In "Microsoft RADIUS Attributes", select the "[311\012] MS-CHAP-MPPE-Keys" check box.
- Add a group name similar to the tunnel users name, and in the "Cisco VPN 3000 Concentrator RADIUS Attributes" select the [3076\011] CVPN3000-Tunneling-Protocols check box and the [3076\020] CVPN3000-PPTP-Encryption check box.
- Select the [3076\011] CVPN3000-Tunneling-Protocols check box, then select PPTP from the corresponding list.
- Select the [3076\020] CVPN3000-PPTP-Encryption check box, then select 128-bit or lower from the corresponding list, according to the client encryption capability
When a Novell NDS database configuration in Cisco Secure ACS has a context list greater than 4095 characters long, editing the NDS configuration page results in incorrect HTMLin the browser interface.
Changes to user-defined fields in user records do not appear to replicate. After the user-defined fields are changed in the Interface Configuration section on the primary Cisco Secure ACS server and replication succeeds, the secondary Cisco Secure ACS server does not display the changes to the user-defined fields in the HTML interface.
Changes to HTTP Port Allocation settings do not appear to replicate. After the HTTP Port Allocation settings are changed on the Access Policy Setup page in the Administration Control section on the primary Cisco Secure ACS server and replication succeeds, the secondary Cisco Secure ACS server does not display the changes to the HTTP Port Allocation settings in the HTML interface.
In the System Configuration section, settings made on the VoIP Account Configuration page are not restored from backup. Neither are these settings preserved during reinstallation of Cisco Secure ACS 3.0 or upgrading to a later build of Cisco Secure ACS 3.0.
When using the "Use certificate from storage" option on the ACS Certificate Setup page in System Configuration, the error message "Cannot find certificate with specified common name in the ACS storage" occurs even though the server certificate was installed in the operating system local machine storage.
Workaround/Solution: To install a server certificate in local machine storage so that Cisco Secure ACS can find it, follow the instructions in "Extensible Authentication Protocol Transport Layer Security Deployment Guide for Wireless LAN Networks", available at:
If you use implement HTTPS transport for access to the Cisco Secure ACS HTML interface and you use Netscape Communicator version 6.2.3 running on Windows 2000 Professional with Windows Service Pack 2, Cisco Secure ACS does not present the Navigation Bar that usually displays the section buttons on the left side of the page.
Workaround/Solution: When you delete a shared profile component, such as a network access restriction, command authorization set, or downloadable PIX ACL, be sure that no user or group profiles reference the component you want to delete.
Each time that you rename a "Network Device Group", the system is unable to keep track and to update the association that there is between the renamed group and the command set that is applied on that devices.
Workaround/Solution: You must manually delete the association between the old-named device group and the command set and add manually a new association with the renamed device group and the same command set.
The group list in Group Setup has inaccurate numbers of users if you reload the internal user database using CSUtil.exe. This can also occur after upgrading if you preserve the existing configuration during the upgrade process.
The problem occurs for TACACS+ with ActivCard token server as an external user database. If the asynchronous (challenge/response) OTP authentication mode is used, and users enter a wrong response, they cannot authenticate for the next 2-3 minutes. Authentication requests are denied even if the correct credentials are entered.
When using TACACS+ login and a static shell password prompt defined on "TACACS+ Shell configuration" for RADIUS OTP external databases the user OTP password (fixed or dynamic) is always echoed on TACACS+ AAA client input.
The problem occurs for TACACS+ with Vasco token server as an external user database. If the asynchronous (challenge/response) OTP authentication mode is used, and users enter a wrong response, they cannot authenticate for the next 2-3 minutes. Authentication requests are denied even if the correct credentials are entered.
table in Network Configuration if the Synchronize"= list under Synchronization Partners on the RDBMS Synchronization Setup page is empty. An error message "x.x.x.x can not be deleted since it is an synchronization partner" appears.
Workaround/Solution: Locate deployment guides at http://www.cisco.com/warp/public/cc/pd/sqsw/sq/tech/index.shtml if there is one for the task in question.
With AAA Accounting for exec sessions configured on a NAS, a user shows up in the Logged-In User report on ACS. With Accounting also configured for going into enable mode, the user no longer appears in the Logged-In User report after authenticating successfully.
When using the User changeable passwords utility to change the passwords for the usernames which contain dot (".") character, after clicking on one of the links on the top, the links at the top in the subsequent screen contain only the part of the username before the dot.
With multi-administrator tries to add/edit/delete downloadable acl under the shared profile components, after the first admin submitted any changes, the other administrator's ACS session got locked up.
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription.
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance.
The Cisco TAC website (http://www.cisco.com/tac ) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year.
The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen ) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information). After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer.
For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly.
Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
- Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:
- Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL:
This document is to be used in conjunction with the documents listed in the "Obtaining Documentation" section.