Chapter 1. Infrastructure

AVC Visibility

Band Select

Disable Aironet IE

Fast SSID

HTTPs for Management

Local Profiling

NTP

WLAN not on Management VLAN

Chapter 2. Security

Client Exclusion

Legacy IDS

Local Management Password Policies

Minimum Rogue RSSI Threshold

Rogue Policies

SSH/Telnet Access

User login policies

WLAN with 802.1X

WLAN with WPA2 and AES Policy

Chapter 3. RF Management

Auto Coverage Hole Detection

Auto Dynamic Channel Assignment

Auto Transmit Power Control

Best Channel Width

CleanAir Detection

Client Bandselect

Event Driven RRM

High SSID Counts

Copyright Page

Chapter 1. Infrastructure

Cisco Mobility Express enables all options under Best Practices except those that need manual configuration, for example, NTP, WLAN with 802.1x/WPA2, and High SSID counts.

- AVC Visibility

- Band Select

- Disable Aironet IE

- Fast SSID

- HTTPs for Management

- Local Profiling

- NTP

- WLAN not on Management VLAN

AVC Visibility

- Description—Application Visibility and Control (AVC) classifies applications using Cisco's deep packet inspection techniques with a Network-Based Application Recognition (NBAR2) engine and provides application-level visibility and control into a Wi-Fi network. After recognizing the applications, the AVC visibility feature allows you to either drop or mark traffic.

AVC visibility is enabled by default on all WLANs in the Cisco Mobility Express. Using AVC visibility, the Cisco Mobility Express virtual controller can detect more than 1000 applications.

- Status:

- Selected—Enabled on one or more WLANs.

- Unselected—Disabled on all WLANs.

- CLI Option—Enable AVC visibility on a WLAN by entering this command:

(Cisco Controller) >config flexconnect group default-flexgroup avc wlan-id visibility enable

Band Select

- Description—Allows dual-band clients to move to the less congested 5-GHz band. It is not recommended for Voice deployments.

- Status:

- Selected—Band select is enabled on one or more WLANs.

- Unselected—Band select is not enabled on any WLAN.

- CLI Option—Enable band select by entering this command:

(Cisco Controller) >config wlan band-select allow enable wlan-id

Disable Aironet IE

- Description— Aironet IE is a Cisco proprietary attribute used by Cisco devices for better connectivity. It contains information, such as the access point name, load, number of associated clients, and so on sent out by the access point (AP) in the beacon and probe responses of the Cisco Mobility Express controller. The Cisco Client Extensions (CCX) clients use this information to choose the best AP with which to associate.

The CCX software is licensed to manufacturers and vendors of third-party client devices. The CCX code resident on these clients enables them to communicate wirelessly with Cisco APs and to support Cisco features that other client devices do not. The features are related to increased security, enhanced performance, fast roaming, and power management.

Aironet IE is optional for CCX based clients, however it can cause compatibility issues with some types of wireless clients. The recommendation is to enable for WGB and Cisco voice, but for general production network, it can be beneficial to disable Aironet IE after testing.

CCX Aironet IE feature should be disabled.

- Status:

- Selected—CCX Aironet IE disabled on all WLANs.

- Unselected—CCX Aironet IE enabled on all WLANs.

- CLI Option—Disable support for Aironet IEs for a particular WLAN by entering this command:

(Cisco Controller) >config wlan ccx aironetIeSupport disable wlan-id

Fast SSID

- Description—When fast SSID changing is enabled, the controller allows clients to move faster between SSIDs. When fast SSID is enabled, the client entry is not cleared and the delay is not enforced. This is very important for supporting Apple IOS devices.

Fast SSID should be enabled.

- Status:

- Selected—Enabled

- Unselected—Disabled

- CLI Option—Enable fast SSID by entering this command:

(Cisco Controller) >config network fast-ssid-change enable

HTTPs for Management

- Description—HTTPs for management provides greater security by allowing secure access.

Secure Web Access (HTTPS) should be enabled for managing the Cisco Mobility Express controller. Web Access (HTTP) should be disabled.

- Status:

- Selected—HTTPS enabled; HTTP disabled

- Unselected—HTTPS enabled, HTTP enabled or HTTPS disabled, HTTP enabled

- CLI Options:

- Disable the web mode to deny users to access the controller GUI using http://ip-address, by entering this command:

(Cisco Controller) >config network webmode disable

- Enable Secure Web Access mode to allow users to access the controller GUI using https://ip-address, by entering this command:

(Cisco Controller) >config network secureweb enable

Local Profiling

- Description—The virtual controller in Cisco Mobility Express-enabled APs can determine the client type from the information received when a client device associates with the controller. This virtual controller acts as the collector of the information, and either displays the information directly on the Cisco Mobility Express GUI dashboard or sends required data to the ISE optimally.

Local profiling (DHCP/HTTP) should be enabled on the Cisco Mobility Express controller. This may impact service at the time.

- Status:

- Selected—Enabled on all WLANs. It is shown in Green state if RADIUS profiling is enabled

- Unselected—Disabled

- CLI Option—Enable local profiling (DHCP/HTTP) on all WLANs by entering this command:

(Cisco Controller) >config wlan profiling local all enable

NTP

- Description—Network Time Protocol (NTP) is very important for several features. It is mandatory to use NTP synchronization on the Cisco Mobility Express virtual controller if you use any of these features: Location, SNMPv3, access point authentication, or MFP. The controller supports synchronization with NTP .

The NTP server is used to sync the Cisco Mobility Express virtual controller's time.

- Status—If disabled, click Manual Configuration to manually configure the syncing with the NTP server.

- Selected—NTP is configured on the Cisco Mobility Express controller.

- Unselected—NTP is not configured on the Cisco Mobility Express controller.

- CLI Option:

- Enable NTP server by entering this command:

(Cisco Controller) >config time ntp server ntp-server-index ntp-server-ip-address

WLAN not on Management VLAN

- Description—We recommend that you have WLANs that are not mapped to the management VLANs.

- Status—If disabled, click Manual Configuration to manually configure non-management WLANs.

- Selected—No WLAN is mapped to the management VLAN.

- Unselected—One or more WLANs are mapped to the management VLAN.

- CLI Option—Configure WLAN not on Management VLAN by entering this command:

(Cisco Controller) >config flexconnect group default-flexgroup wlan-vlan wlan wlan-id add vlan vlan-id

Chapter 2. Security

Cisco Mobility Express enables all options under Best Practices except those that need manual configuration, for example, NTP, WLAN with 802.1x/WPA2, and High SSID counts.

- Client Exclusion

- Legacy IDS

- Local Management Password Policies

- Minimum Rogue RSSI Threshold

- Rogue Policies

- SSH/Telnet Access

- User login policies

- WLAN with 802.1X

- WLAN with WPA2 and AES Policy

Client Exclusion

- Description—When the user fails to authenticate, the controller excludes the client. The client cannot connect to the network until the exclusion timer expires or is manually overridden by the administrator.

Client exclusion detects authentication attempts made by a single device. When the device exceeds a maximum number of failures, that MAC address is not allowed to associate any longer to the controller.

Client exclusion is enabled by default on the master AP allowing it to exclude clients from joining the controller during the above events.

- Status:

- Selected—Client exclusion is enabled for all events

- Unselected—Client exclusion is disabled for all events

- CLI Option—Enable client exclusion for all events by entering this command:

(Cisco Controller) >config wps client-exclusion all enable

Legacy IDS

- Description—The Cisco Mobility Express controller performs WLAN IDS analysis using all the connected APs and reports detected attacks on to the virtual controller. The Wireless IDS analysis is complementary to any analysis that may otherwise be performed by a wired network IDS system. The embedded Wireless IDS capability of the Cisco Mobility Express controller analyzes 802.11- and Cisco Mobility Express controller-specific information that is not available to a wired network IDS system.

Enables wireless IDS feature and 17 built-in signatures to avoid intrusion attacks.

- Status:

- Selected—All standard signature check is enabled

- Unselected—All standard signature check is disabled

- CLI Option—Enable signature check by entering this command:

(Cisco Controller) >config wps signature enable

Local Management Password Policies

- Description—You must enforce a strong password. The password policies allow enforcement of strong password checks on newly created passwords for additional management users of controller and access point. The following are the requirements enforced on the new password:

- When the controller is upgraded from an old version, all the old passwords are maintained even though the passwords are weak. After the system upgrade, if the strong password checks are enabled, the same is enforced from that time and the strength of previously added passwords will not be checked or altered.

- Depending on the settings done in the Password Policy page, the local management and access point user configuration is affected.

Strong password policies should be enforced. They include:

- case-check—Checks the occurrence of same character thrice consecutively

- consecutive-check—Checks the default values or its variants are being used

- default-check—Checks either username or its reverse is being used

- all-checks—Enables/disables all the strong password checks

- position-check—Checks four-character range from old password

- case-digit-check—Checks all four combinations to be present: lower, upper, digits, and special characters

- Status:

- Selected—All strong password policies are enabled

- Unselected—Some or no password policies are enabled

- CLI Option—Enable all strong password policies by entering this command:

(Cisco Controller) >config switchconfig strong-pwd all-checks enable

Minimum Rogue RSSI Threshold

- Description—This criterion normally indicates that unknown rogue APs are inside the facility perimeters, and can cause potential interference to the wireless network.

This rule is not recommended for retail customers or venues that are shared by various tenants, where WiFi signals from all parties normally bleed into each other.

Specifies the minimum RSSI value that rogues should have for APs to detect them and for the rogue entries to be created in the controller. Recommended value is –80 dBm.

- Status:

- Selected—Set to –80 dBm.

- Unselected—Set to less than –80 dBm.

- CLI Option—Set the minimum RSSI value that rogues should have by entering this command:

(Cisco Controller) >config rogue detection min-rssi rssi-in-dBm

Rogue Policies

- Description—Rogue wireless devices are an ongoing threat to corporate wireless networks. Network owners need to do more than just scanning the unknown devices. They must be able to detect, disable, locate, and manage rogue/intruder threats automatically and in real time.

Rogue APs can disrupt wireless LAN operations by hijacking legitimate clients and using plain text, denial-of-service attacks, or man-in-the-middle attacks. That is, a hacker can use a rogue AP to capture sensitive information, such as passwords and usernames. The hacker can then transmit a series of clear-to-send (CTS) frames, which mimics an AP informing a particular wireless LAN client adapter to transmit and instruct all others to wait. This scenario results in legitimate clients being unable to access the wireless LAN resources. Thus, wireless LAN service providers look for banning rogue APs from the air space.

The best practice is to use rogue detection to minimize security risks, for example, in a corporate environment. However, there are certain scenarios in which rogue detection is not needed, for example, in OEAP deployment, open venues/stadium, citywide, and outdoors. Using outdoor mesh APs to detect rogues would provide little value while incurring resources to analyze. Finally, it is critical to evaluate (or avoid altogether) rogue auto-containment, as there are potential legal issues and liabilities if left to operate automatically.

Policy should be at least High.

- Status:

- Selected—Policy is set to High or above

- Unselected—Policy is set to Low.

- Set the rogue detection security level to High by entering this command:

(Cisco Controller) >config rogue detection security-level high

SSH/Telnet Access

- Description—SSH to the Cisco Mobility Express controller should be enabled by default. However, Telnet to the Cisco Mobility Express controller is disabled by default.

- Status:

- Selected—SSH enabled; Telnet disabled

- Unselected—SSH enabled and Telnet enabled OR SSH disabled and Telnet enabled

- CLI Option:

- Enable SSH by entering this command:
(Cisco Controller) >config network ssh enable

- Disable Telnet by entering this command:

(Cisco Controller) >config network telnet disable

User login policies

- Description—The user login policies are provided to limit the number of concurrent logins of the local netusers of the controller. You can limit the number of concurrent logins, and the recommendation is greater than default of 0 (unlimited).

- Status:

- Selected—Configured

- Unselected—No user login policies are present

- CLI Option:

- Verify the limit of the netusers by entering this command:

(Cisco Controller) >show netuser summary

- Configure user login policies by entering this command:

(Cisco Controller) >config netuser maxUserLogin count

WLAN with 802.1X

- Description—WLAN should be using 802.1x security. There is a link to the WLAN page to enable this security on the WLAN. Day 0 default does not mandate an 802.1x.

- Status—If disabled, click Manual Configuration to manually configure the WLAN to use 802.1x security.

- Selected—Enabled on one or more WLANs with 802.1x security.

- Unselected—802.1x security is not enabled on any WLAN.

WLAN with WPA2 and AES Policy

- Description—WPA2 with AES provides greater security compared to WPA with AES which has been deprecated.

- Status:

- Selected—WLAN with WPA and AES policy is enabled on one or more WLANs.

- Unselected—No WLAN with WPA2 and AES security policy.

- CLI Option—Use the following CLI to enable WPA2+AES:

(Cisco Controller) >config wlan security wpa enable wlan-id

Chapter 3. RF Management

Cisco Mobility Express enables all options under Best Practices except those that need manual configuration, for example, NTP, WLAN with 802.1x/WPA2, and High SSID counts.

- Auto Coverage Hole Detection

- Auto Dynamic Channel Assignment

- Auto Transmit Power Control

- Best Channel Width

- CleanAir Detection

- Client Bandselect

- Event Driven RRM

- High SSID Counts

Auto Coverage Hole Detection

- Description—Auto CHD should be enabled.

The controller uses the quality of client signal levels reported by the APs to determine if the power level of that AP needs to be increased. Coverage Hole Detection (CHD) is controller independent, so the RF group leader is not involved in those calculations. The controller knows how many clients are associated with a particular AP and what are the signal-to-noise ratio (SNR) values for each client.

If a client SNR drops below the configured threshold value on the controller, the AP increases its power level to try to compensate for the client. The SNR threshold is based on the transmit power of the AP and the coverage profile settings on the controller.

For instructions on how to configure auto CHD, see the Cisco Mobility Express User Guide.

- Status:

- Selected—CHD enabled

- Unselected— None or one enabled

- CLI Option—Enable auto CHD by entering this command:

(Cisco Controller) >config advanced 802.11{a|b} coverage enable

Auto Dynamic Channel Assignment

- Description—Auto DCA should be enabled to allow RRM to select best channels for each radio.

When a wireless network is first initialized, all radios participating require a channel assignment to operate without interference - optimizing the channel assignments to allow for interference free operation is DCA's job. Wireless network does this using the air metrics reported by each radio on every possible channel, and providing a solution that maximizes channel bandwidth and minimizes RF interference from all sources - Self (signal), other networks (foreign interference), Noise (everything else).

DCA is enabled by default and provides a global solution to channel planning for your network.

- Status:

- Selected—DCA is enabled for 802.11a/b

- Unselected—None or one is enabled

- CLI Option—Enable auto DCA by entering this command:

(Cisco Controller) >config 802.11a channel global auto

(Cisco Controller) >config 802.11b channel global auto

Auto Transmit Power Control

- Description—The controller dynamically controls the access point transmit power based on real-time wireless LAN conditions. You can choose between two versions of transmit power control: TPCv1 and TPCv2. With TPCv1, power can be kept low to gain extra capacity and reduce interference. With TPCv2, transmit power is dynamically adjusted with the goal of minimum interference. TPCv2 is suitable for dense networks. In this mode, there could be higher roaming delays and coverage hole incidents.

Auto TPC is enabled by default to allow RRM to select best transmit power for each radio.

The Transmit Power Control (TPC) algorithm increases and decreases the power of an access poin (AP) in response to changes in the RF environment. In most instances, TPC seeks to lower the power of the AP to reduce interference. But, in the case of a sudden change in the RF coverage-for example, if the AP fails or becomes disabled-TPC can also increase power of the surrounding APs. This feature is different from coverage hole detection, which is primarily concerned with clients. TPC provides enough RF power to achieve desired coverage levels while avoiding channel interference between APs.

Note

For optimal performance, use the Automatic setting to allow best transmit power for each radio.

- Status:

- Selected—TPC enabled for 802.11a/b

- Unselected—None or one enabled

- CLI Option—Enable Auto TPC by entering this command:

(Cisco Controller) >config 802.11a txPower global auto

(Cisco Controller) >config 802.11b txPower global auto

Best Channel Width

- Description—Dynamic bandwidth selection selects the widest channel width with the highest client data rates and lowest channel utilization per radio. This minimizes data retries and CRC errors on the 5 GHz band while avoiding rogue APs and CleanAir Interferers.

- Status:

- Selected—Channel width is selected as Best on both bands.

- Unselected—Channel width is not selected as Best on both bands.

- CLI Option—Enable best channel width by entering this command:

(Cisco Controller) >config advanced 802.11a channel dca chan-width best

CleanAir Detection

- Description—CleanAir should be enabled.

To effectively detect and mitigate RF interference, enable CleanAir whenever possible. There are recommendations to various sources of interference to trigger security alerts, such as generic DECT phones, jammer, and so on.

[1]

- Status:

- Selected—Enabled

- Unselected—Disabled

- CLI Option:

- Verify CleanAir configuration on a network by entering this command:

(Cisco Controller) >show 802.11{a|b} cleanair config

- Enable CleanAir functionality on a network by entering this command:

(Cisco Controller) >config 802.11{a|b} cleanair enable network

- Configure to enable interference detection for specifically jammer by entering this command:

(Cisco Controller) >config 802.11{a|b} cleanair device enable jammer

[1] All Cisco Access Points do not support CleanAir. However, it is recommended to enable CleanAir Detection as Cisco Mobility Express is used to manage multiple types of Cisco access points.

Client Bandselect

- Description—Band Selection should be enabled.

Band selection enables client radios that are capable of dual-band (2.4 and 5 GHz) operation to move to a less congested 5 GHz AP. The 2.4 GHz band is often congested. Clients on this band typically experience interference from Bluetooth devices, microwave ovens, and cordless phones as well as co-channel interference from other APs because of the 802.11b/g limit of three non-overlapping channels. To prevent these sources of interference and improve overall network performance, you can configure band selection on controller:

- Band selection is enabled globally by default.

- Band selection works by regulating probe responses to clients. It makes 5 GHz channels more attractive to clients by delaying probe responses to clients on 2.4 GHz channels.

- Evaluate band selection for voice, particularly focusing on roaming performance. See below for further explanation.

- Most newer model clients prefer 5 GHz by default if the 5 GHz signal of the AP is equal to or stronger than the 2.4-GHz signal.

- Band select should be enabled for high-density designs

Also, in high-density designs, the study of available UNII-2 channels should be made. Those channels that are unaffected by Radar and also usable by the client base should be added to the RRM DCA list as usable channels.

Dual-band roaming can be slow depending on the client. If a majority of the base of voice clients exhibits a slow roaming behavior, it is more likely that the client sticks to 2.4 GHz. In this case, it has scanning issues on 5 GHz. Generally when a client decides to roam, it scans its current channel and band first. The clients generally scan for an AP that has a significantly better signal level, maybe as much as 20 dB and/or a significantly better SNR. Failing such available connection, the client may remain with its current AP. In this case, if the CU on 2.4 GHz is low and the call quality is not poor, then disabling the selected band maybe fine. However, the preferred design is to enable band selection on 5 GHz with all data rates enabled and 6 Mbps as mandatory. Then, set the 5 GHz RRM minimum Tx power level 6 dBm higher than the average 2.4 GHz power level set by RRM.

The goal of this configuration recommendation is to enable the client to obtain a band and channel with better SNR and Tx power initially. As already stated, generally when a client decides to roam, it scans its current channel and band first. So, if the client initially joins the 5 GHz band, then it is more likely to stay on the band if there are good power levels on 5 GHz. SNR levels on 5 GHz are generally better than 2.4 GHz because 2.4 GHz has only three Wi-Fi channels and is more susceptible to interference such as Bluetooth, iBeacons, and microwave signals.

802.11k is recommended to be enabled with dual-band reporting. This enables all 11k enabled clients to have the benefit of assisted roaming. With dual-band reporting enabled, the client receives a list of the best 2.4-GHz and 5-GHz APs upon a directed request from the client. Here, the client most likely looks at the top of the list for an AP on the same channel, and then on the same band as the client is currently on. This logic reduces scan times and saves battery power. Having 802.11k enabled on the WLC does not have a downside effect for non-802.11k clients.

- Status:

- Selected—Enabled on all WLANs

- Unselected—Disabled

- CLI Option:

- Verify Band Select by entering this command:

(Cisco Controller) >show band-select

- Enable Band Select on a WLAN by entering this command:

(Cisco Controller) >config wlan band-select allow enable wlan-id

Event Driven RRM

- Description—Spontaneous interference is interference that appears suddenly on a network, perhaps jamming a channel or a range of channels completely. The Cisco CleanAir spectrum event-driven radio resource management (RRM) feature allows you to set a threshold for air quality (AQ) that, if exceeded, triggers an immediate channel change for the affected access point. Most RF management systems can avoid interference, but this information takes time to propagate through the system. Cisco CleanAir relies on AQ measurements to continuously evaluate the spectrum and can trigger a move within 30 seconds. For example, if an access point detects interference from a video camera, it can recover by changing channels within 30 seconds of the camera becoming active. Cisco CleanAir also identifies and locates the source of interference so that more permanent mitigation of the device can be performed at a later time.

Note

Spectrum EDRRM can be triggered, to detect a significant level of interference, only by Cisco CleanAir-enabled access points in local mode.

Event driven RRM is enabled by default.

- Status:

- Selected—Enabled

- Unselected—Disabled

- CLI Option—Enable Cisco CleanAir spectrum event-driven RRM by entering this command:

(Cisco Controller) >config advanced 802.11{a|b} channel cleanair-event enable

High SSID Counts

- Description—Number of WLANs should be less than 4.

We recommend limiting the number of service set identifiers (SSIDs) configured at the controller. You can configure 16 simultaneous SSIDs (per radio on each AP), but as each WLAN/SSID needs separate probe responses and beaconing, the RF pollution increases as more SSIDs are added. Furthermore, some smaller wireless stations like PDA, WiFi Phones, and barcode scanners cannot cope with a high number of basic SSID (BSSID) information. This results in lockups, reloads, or association failures. Also the more SSIDs, the more beaconing needed, so less RF time is available for real data transmits. Cisco recommends one to three SSIDs for corporate, and one SSID for high-density designs. AAA override can be leveraged for per user VLAN/ settings on a single SSID scenario.

The AP must beacon at the lowest mandatory speed set for each WLAN, in order to be able to reach the farthest stations irrespective of their location. If they can hear the AP’s beacon, it considerably reduces the general traffic.

- Status—Click Manual Configuration to manually configure the number of service set identifiers (SSIDs) configured at the controller.

- Selected—Active SSID count is 4 or less.

- Unselected—Active SSID count is more than 4.

- CLI Option:

- Verify the number of WLANs by entering this command:

(Cisco Controller) >show wlan summary

- Disable unwanted WLANs by entering this command:

(Cisco Controller) >config wlan disable wlan-id

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: Click Here . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)