- Overview of ISG
- Configuring ISG Control Policies
- Configuring ISG Access for PPP Sessions
- Configuring ISG Access for IP Subscriber Sessions
- Configuring MQC Support for IP Sessions
- Configuring ISG Port-Bundle Host Key
- Configuring ISG as a RADIUS Proxy
- Configuring RADIUS-Based Policing
- Configuring Ambiguous VLAN support for IP sessions over ISG
- Configuring ISG Policies for Automatic Subscriber Logon
- Configuring DHCP Option 60 and Option 82 with VPN-ID Support for Transparent Automatic Logon
- Enabling ISG to Interact with External Policy Servers
- Configuring ISG Subscriber Services
- ISG Subscriber Aware Ethernet
- Configuring ISG Network Forwarding Policies
- Configuring ISG Accounting
- Configuring ISG Support for Prepaid Billing
- Configuring ISG Policies for Session Maintenance
- Redirecting Subscriber Traffic Using ISG Layer 4 Redirect
- Configuring ISG Policies for Regulating Network Access
- ISG Support for SAMI Blade
- Configuring ISG Integration with SCE
- Service Gateway Interface
- Troubleshooting ISG with Session Monitoring and Distributed Conditional Debugging
- Configuring ISG Troubleshooting Enhancements
- Finding Feature Information
- Prerequisites for ISG Control Policies
- Restrictions for ISG Control Policies
- Information About ISG Control Policies
- How to Configure an ISG Control Policy
- Configuration Examples for ISG Control Policies
- Additional References
- Feature Information for ISG Control Policies
Configuring ISG Control Policies
Intelligent Services Gateway (ISG) is a Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. ISG control policies are a means of defining the actions the system will take in response to specified conditions and events. A wide variety of system actions, conditions, and events can be combined using a consistent policy language, providing a flexible and precise way of configuring ISG. This module provides information about how to configure ISG control policies.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for ISG Control Policies
Authentication, authorization, and accounting (AAA) method lists must be configured prior to defining authentication and authorization actions.
Restrictions for ISG Control Policies
Control policies are activated for specific contexts, not directly on sessions. Control policies apply to all sessions hosted on the context.
Only one control policy map may be applied to a given context.
Control policies can be defined only through the router's command-line interface (CLI).
Not all actions may be associated with all events.
A new control class may not be inserted between existing control classes once a control policy map has been defined.
Information About ISG Control Policies
Control Policies
Control policies define the actions that the system will take in response to specified events and conditions. For example, a control policy can be configured to authenticate specific subscribers and then provide them with access to specific services.
A control policy is made of one or more control policy rules. A control policy rule is an association of a control class and one or more actions. The control class defines the conditions that must be met before the actions will be executed.
Three steps are involved in defining a control policy:
- Create one or more control class maps--A control class map specifies the conditions that must be met for a policy to be activated, and, optionally, the event that causes the class to be evaluated. A control class map may contain multiple conditions, each of which will evaluate to either true or false. Match directives can be used to specify whether all, any, or none of the individual conditions must evaluate true in order for the class to evaluate true.
- Create a control policy map--A control policy map contains one or more control policy rules. A control policy rule associates a control class map with one or more actions. Actions are numbered and executed sequentially.
- Apply the control policy map--A control policy map is activated by applying it to a context. A control policy map can be applied to one or more of the following types of contexts. In the following list, the context types are listed in order of precedence. For example, a control policy map that is applied to a PVC takes precedence over a control policy map that is applied to an interface.
In general, control policy maps that are applied to more specific contexts take precedence over policy maps applied to more general contexts.
Note |
Traffic policies are another type of policy used by ISG. Traffic policies define the handling of data packets and are configured in service policy maps or service profiles. For more information about traffic policies, see the "Configuring ISG Subscriber Services" module. |
Differentiated Initial Policy Control
Authentication failure for a subscriber may happen for an access-reject (which means a RADIUS server responded with a Reject) or due to an access request timeout (RADIUS server is unreachable).
Using ISG control policies, and actions configured for the 'radius-timeout' and 'access-reject' events, the system can distinguish between the different reasons for an authentication failure. Different events are thrown by the system (for example, a received authentication reject or an unavailable RADIUS server event). This allows the control policy to specify different actions for each type of authentication failure. For example, if the RADIUS server is down or unreachable, temporary access can be given to subscribers.
This feature is available only for IP-based sessions for subscriber authentication. This feature does not support the Point-to-Point Protocol over Ethernet (PPPoE) sessions.
Uses of Control Policies
Use control policies to configure an ISG to perform specific actions in response to specific events and conditions. For example, control policies could be used for the following purposes:
- To activate a default service when a subscriber session is first detected
- To sequence the gathering of subscriber identity, where a control protocol exists on the access side
- To determine how the system responds to an idle timeout or to a subscriber who has run out of credit
- To enable transparent automatic login, which enables authorization on the basis of an IP address or MAC address
- To configure the maximum amount of time a session can remain unauthenticated
- To send periodic session state information to other devices
How to Configure an ISG Control Policy
- Configuring a Control Class Map
- Configuring a Control Policy Map
- Applying the Control Policy Map
- Monitoring and Maintaining ISG Control Policies
Configuring a Control Class Map
A control class map contains conditions that must be met for a control policy to be executed. A control class map can contain one or more conditions. Perform this task to configure a control class map.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# class-map type control match-all class1 |
Creates or modifies a control class map, which defines the conditions under which the actions of a control policy map will be executed, and enters control class map mode. |
|
Example: Router(config-control-classmap)# available nas-port |
(Optional) Creates a condition that evaluates true if the specified subscriber identifier is locally available. |
|
Example: Router(config-control-classmap)# greater-than nas-port type atm vpi 200 vci 100 |
(Optional) Creates a condition that evaluates true if the subscriber network access server (NAS) port identifier is greater than the specified value. |
|
Example: Router(config-control-classmap)# greater-than-or-equal nas-port vlan 10 |
(Optional) Creates a condition that evaluates true if the specified subscriber NAS port identifier is greater than or equal to the specified value.
|
|
Example: Router(config-control-classmap)# less-than nas-port type atm vpi 200 vci 105 |
(Optional) Creates a condition that evaluates true if the specified subscriber NAS port identifier is less than the specified value. |
|
Example: Router(config-control-classmap)# less-than-or-equal nas-port ipaddr 10.10.10.10 |
(Optional) Creates a condition that evaluates true if the specified subscriber NAS port identifier is less than or equal to the specified value. |
|
Example: Router(config-control-classmap)# match authen-status authenticated |
(Optional) Creates a condition that evaluates true if a subscriber's authentication status matches the specified authentication status. |
|
Example: Router(config-control-classmap)# match authenticated-domain cisco.com |
(Optional) Creates a condition that evaluates true if a subscriber's authenticated domain matches the specified domain. |
|
Example: Router(config-control-classmap)# match authenticated-username regexp "admin@.*com" |
(Optional) Creates a condition that evaluates true if a subscriber's authenticated username matches the specified username. |
|
Example: Router(config-control-classmap)# match dnis reg-exp 5551212 |
(Optional) Creates a condition that evaluates true if a subscriber's Dialed Number Identification Service number (DNIS number, also referred to as called-party number) matches the specified DNIS number. |
|
Example: Router(config-control-classmap)# match media atm |
(Optional) Creates a condition that evaluates true if a subscriber's access media type matches the specified media type. |
|
Example: Router(config-control-classmap)# match mlp-negotiated yes |
(Optional) Creates a condition that evaluates true or false depending on whether the subscriber's session was established using multilink PPP negotiation.
|
|
Example: Router(config-control-classmap)# match nas-port type ether slot 3 |
(Optional) Creates a condition that evaluates true if a subscriber's NAS port identifier matches the specified value. |
|
Example: Router(config-control-classmap)# match no-username yes |
(Optional) Creates a condition that evaluates true or false depending on whether or not a subscriber's username is available.
|
|
Example: Router(config-control-classmap)# match protocol ip |
(Optional) Creates a condition that evaluates true if a subscriber's access protocol type matches the specified protocol type. |
|
Example: Router(config-control-classmap)# match service-name service1 |
(Optional) Creates a condition that evaluates true if the service name associated with a subscriber matches the specified service name. |
|
Example: Router(config-control-classmap)# match source-ip-address 10.10.10.10 255.255.255.255 |
(Optional) Creates a condition that evaluates true if a subscriber's source IP address matches the specified IP address. |
|
Example: Router(config-control-classmap)# match timer TIMERA |
(Optional) Creates a condition that evaluates true upon expiry of a specified policy timer. |
|
Example: Router(config-control-classmap)# match tunnel-name regexp L.* |
(Optional) Creates a condition that evaluates true if a subscriber's virtual private dialup network (VPDN) tunnel name matches the specified tunnel name. |
|
Example: Router(config-control-classmap)# match unauthenticated-domain example.com |
(Optional) Creates a condition that evaluates true if a subscriber's unauthenticated domain name matches the specified domain name. |
|
Example: Router(config-control-classmap)# match unauthenticated-username regexp examplename1 |
(Optional) Creates a condition that evaluates true if a subscriber's unauthenticated username matches the specified username. |
|
Example: Router(config-control-classmap)# match vrf regexp examplename2 |
(Optional) Creates a condition that evaluates true if a subscriber's VPN routing and forwarding (VRF) matches the specified VRF. |
Configuring a Control Policy Map
A control policy map contains one or more control policy rules that associate a control class with one or more actions. Perform this task to configure a control policy map.
Note |
The actions that can be configured in a policy rule depend on the type of event that is specified by the class type control command. For example, if the account-logoff event is specified, the only action that can be configured in that policy rule is service. The procedure in this section shows all actions that can be configured in a policy map. |
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# policy-map type control MY-POLICY |
Creates or modifies a control policy map, which is used to define a control policy. |
|
Example: Router(config-control-policymap)# class type control always event session-start |
Specifies a control class for which actions may be configured.
|
|
Example: Router(config-control-policymap-class-control)# 1 authenticate aaa list LIST1 |
(Optional) Initiates an authentication request. |
|
Example: Router(config-control-policymap-class-control)# 1 authorize identifier source-ip-address |
(Optional) Initiates a request for authorization on the basis of the specified identifier. |
|
Example: Router(config-control-policymap-class-control)# 1 collect identifier authen-status |
(Optional) Collects the specified subscriber identifier from the access protocol. |
|
Example: Router(config-control-policymap-class-control)# 2 if upon network-service-found stop |
(Optional) Specifies whether the system should continue processing policy rules once the subscriber's network service has been identified. |
|
Example: Router(config-control-policymap-class-control)# 1 proxy accounting aaa list default |
(Optional) Specifies the list that the request should be proxied to. |
|
Example: Router(config-control-policymap-class-control)# 3 service disconnect |
(Optional) Specifies a network service type for PPP sessions. |
|
Example: Router(config-control-policymap-class-control)# service-policy type control domain based access |
(Optional) Nests the specified control policy map within a parent control policy map. |
|
Example: Router(config-control-policymap-class-control)# 1 service-policy type service aaa list LISTA name REDIRECT |
(Optional) Activates an ISG service.
|
|
Example: Router(config-control-policymap-class-control)# 1 set APJ identifier authen-status |
(Optional) Sets a variable name. |
|
Example: Router(config-control-policymap-class-control)# 1 set-timer TIMERA 5 |
(Optional) Starts a named policy timer.
|
|
Example: Router(config-control-policymap-class-control)# 1 substitute TPK SUBA SUBB |
(Optional) Substitutes a matching pattern in variable content by a rewrite pattern. |
|
Example: Router(config-control-policymap-class-control)# end |
(Optional) Ends the current configuration session and returns to privileged EXEC mode. |
Applying the Control Policy Map
A control policy map must be activated by applying it to a context. Perform one or more of the following tasks to apply a control policy to a context:
- Applying a Control Policy Map Globally on the Router
- Applying an ISG Control Policy Map to an Interface or Subinterface
- Applying an ISG Control Policy Map to a Virtual Template
- Applying an ISG Control Policy Map to an ATM VC Class
- Applying a Control Policy Map to an ATM PVC
Applying a Control Policy Map Globally on the Router
Perform this task to apply a control policy globally.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# service-policy type control policy1 |
Applies a control policy. |
Applying an ISG Control Policy Map to an Interface or Subinterface
Perform this task to apply an ISG control policy to an interface or subinterface.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# interface gigabitethernet 0/1.1 |
Specifies an interface and enters interface configuration mode. |
|
Example: Router(config-if)# service-policy type control policy1 |
Applies a control policy. |
Applying an ISG Control Policy Map to a Virtual Template
Perform this task to apply an ISG control policy map to a virtual template.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# interface virtual-template0 |
Creates a virtual template interface and enters interface configuration mode. |
|
Example: Router(config-if)# service-policy type control policy1 |
Applies a control policy. |
Applying an ISG Control Policy Map to an ATM VC Class
A VC class is a set of preconfigured VC parameters that are configured and applied to a particular VC or ATM interface. Perform this task to apply an ISG control policy map to an ATM VC class.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# vc-class atm class1 |
Creates an ATM VC class and enters ATM VC class configuration mode.
|
|
Example: Router(config-vc-class)# service-policy type control policy1 |
Applies a control policy. |
Applying a Control Policy Map to an ATM PVC
Perform this task to apply an ISG control policy to an ATM PVC.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# interface atm 5/0.1 multipoint |
Specifies an ATM interface or subinterface and enters interface configuration mode. |
|
Example: Router(config-if)# pvc 2/101 |
Creates an ATM PVC and enters ATM virtual circuit configuration mode. |
|
Example: Router(config-if-atm-vc)# service-policy type control policy1 |
Applies a control policy. |
Monitoring and Maintaining ISG Control Policies
Optionally, you can perform this task to monitor and maintain ISG control policy operation. Steps can be performed in any order.
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# show class-map type control |
Displays information about ISG control class maps.
|
|
Example: Router# show policy-map type control |
Displays information about ISG control policy maps.
|
|
Example: Router# clear class-map control |
Clears the control class map counters. |
|
Example: Router# clear policy-map control |
Clears the control policy map counters. |
Configuration Examples for ISG Control Policies
- Control Policy for Layer 2 Access and Service Provisioning Example
- Control Policy for Restricting Access on the Basis of Interface and Access Media Example
- Control Policy for ISG Prepaid Billing Support Example
- Control Policies for Automatic Subscriber Login Example
Control Policy for Layer 2 Access and Service Provisioning Example
The following example shows how to configure a control policy that produces the following results:
- VPDN forwarding is applied to anyone dialing in from "example1.com".
- Access to locally terminated Layer 3 network resources is provided to anyone dialing in from "example2.com".
- Anyone else is barred.
! Configure the control class maps. class-map type control match-all MY-FORWARDED-USERS match unauthenticated-domain "example1.com" !
class-map type control match-all MY-LOCAL-USERS match unauthenticated-domain "example2.com" ! ! Configure the control policy map. policy-map type control MY-POLICY class type control MY-FORWARDED-USERS event session-start 1 service-policy type service identifier nas-port 2 service local ! class type control MY-LOCAL-USERS event session-start 1 service local ! class type control always event session-start 2 service disconnect ! ! Apply the control policy to dialer interface 1. interface Dialer1 service-policy type control MY-POLICY
Control Policy for Restricting Access on the Basis of Interface and Access Media Example
This example shows how to configure a control policy to allow access only to users who enter the router from a particular interface and access type. In this case, only PPPoE users will be allowed; everyone else is barred.
The first condition class map "MATCHING-USERS" evaluates true only if all of the lines within it also evaluate true; however, within "MATCHING-USERS" is a nested class map (second condition), "NOT-ATM". This nested class map represents a subcondition that must also evaluate to true. Note that the class map "NOT-ATM" specifies "match-none". This means that "NOT-ATM" evaluates to true only if every condition line within it evaluates to false.
The third condition specifies matching on the NAS port associated with this subscriber. Specifically, only subscribers that arrive on a Gigabit Ethernet interface and on slot 3 will evaluate to true.
! Configure the control class maps. class-map type control match-all MATCHING-USERS class type control NOT-ATM match media ether match nas-port type ether slot 3 ! class-map type control match-none NOT-ATM match media atm !
If the conditions in the class map "MATCHING-USERS" evaluate to true, the first action to be executed is to authenticate the user. If authentication is successful, the service named "service1" will be downloaded and applied. Finally, a Layer 3 service is provided.
If "MATCHING-USERS" is not evaluated as true, the "always" class will apply, which results in barring anyone who does not match "MATCHING-USERS".
! Configure the control policy map. policy-map type control my-pppoe-rule class type control MATCHING-USERS event session-start 1 authenticate aaa list XYZ 2 service-policy type service service1 3 service local !
class type control always
1 service disconnect ! ! Apply the control policy to an interface. interface gigabitethernet3/0/0 service-policy type control my-pppoe-rule
Finally, the policy is associated with an interface.
Default Method Lists
If you specify the default method list for any of the control policy actions, the default list will not display in the output from the show running-config command. For example, if you configure the following command:
Router(config-control-policymap-class-control)# 1 authenticate aaa list default
The following will display in the output from the show running-config command:
1 authenticate
Control Policy for ISG Prepaid Billing Support Example
The following example shows a control policy configured to redirect subscriber packets to the server group "redirect-sg" when the credit-exhausted event occurs:
service-policy type control RULEA ! policy-map type control RULEA class type control always event credit-exhausted 1 service-policy type service redirectprofile ! policy-map type service redirectprofile class type traffic CLASS-ALL redirect to group redirect-sg policy-map type service mp3 class type traffic CLASS-ACL-101 authentication method-list cp-mlist accounting method-list cp-mlist prepaid conf-prepaid subscriber feature prepaid conf-prepaid threshold time 20 threshold volume 0 method-list accounting ap-mlist method-list authorization default
password cisco
Control Policies for Automatic Subscriber Login Example
In the following example, if the client is from the a subnet, automatic subscriber login is applied and an authorization request is sent to the list TALLIST with the subscriber's source IP address as the username. If the authorization request is successful, any automatic activation services specified in the returned user profile are activated for the session and the execution of rules within the control policy stops. If the authorization is not successful, the rule execution proceeds, and the subscriber is redirected to the policy server to log in. If the subscriber does not log in within five minutes, the session is disconnected.
interface GigabitEthernet0/0/0 service-policy type control RULEA aaa authentication login TALLIST group radius aaa authentication login LOCAL local access-list 100 permit ip any any class-map type traffic match-any all-traffic match access-group input 100 match access-group output 100
policy-map type service redirectprofile
class type traffic all-traffic redirect to ip 10.0.0.148 port 8080 class-map type control match-all CONDA match source-ip-address 209.165.201.1 255.255.255.0 ! class-map type control match-all CONDF match timer TIMERB match authen-status unauthenticated policy-map type control RULEA class type control CONDA event session-start 1 authorize aaa list TAL_LIST password cisco identifier source-ip-address 2 apply aaa list LOCAL service redirectprofile 3 set-timer TIMERB 5 minutes class type control CONDF event timed-policy-expiry
1 service disconnect
Additional References
Related Documents
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
ISG commands |
|
HA commands |
|
HA configuration |
Cisco IOS High Availability Configuration Guide |
Traffic Policies |
"Configuring ISG Subscriber Services" module in this guide |
Technical Assistance
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
Feature Information for ISG Control Policies
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 | Feature Information for ISG Control Policies |
Feature Name |
Releases |
Feature Configuration Information |
---|---|---|
ISG: Policy Control: Policy: Domain Based (Autodomain, Proxy) |
12.2(28)SB 12.2(33)SRC 15.0(1)S |
ISG control policies manage the primary services and rules used to enforce particular contracts. These policies include programmable interfaces to dynamic triggers and conditional logic to be applied to flows within a session, or other characteristics of a session, upon meeting the policy criteria. Policies can be configured to interpret the domain as a request to activate the service associated with that domain name, allowing users to automatically receive services in accordance with the domain to which they are attempting to connect. In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router. |
ISG: Policy Control: Policy: Triggers |
12.2(28)SB 12.2(33)SRC 15.0(1)S |
ISG control policies can be configured with time-based, volume-based, and duration-based policy triggers. Time-based triggers use an internal clock, allowing policies to be applied at specific times. Volume-based triggers are based on packet count; when the packet count reaches a specified value, the specified policy is applied. Duration-based triggers are based on an internal timer. Upon expiration of the timer, the specified policy is applied. In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router. |
ISG: Policy Control: Multidimensional Identity per Session |
12.2(28)SB 12.2(33)SRC 15.0(1)S |
ISG control policies provide a flexible way to collect pieces of subscriber identity information during session establishment. Control policies also allow session policy to be applied iteratively as more elements of identity information become available to the system. In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router. |
ISG: Policy Control: Cisco Policy Language |
12.2(28)SB 12.2(33)SRC |
ISG control policies are a structured replacement for feature-specific configuration commands and allow configurable functionality to be expressed in terms of an event, a condition, and an action. Control policies provide an intuitive and extensible framework, with a consistent set of CLI commands, for specifying system behavior. In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router. |
ISG: Policy Control: Differentiated Initial Policy Control |
12.2(33)SRE 12.2(33)XNE |
This features provides the ability to distinguish RADIUS authentication rejects from RADIUS server unavailability. It allows minimal or temporary network access to the subscribers when the RADIUS servers are down or cannot be accessed because of network issues or when an authentication reject is received for a subscriber. In Cisco IOS Release 12.2(33)XNE, support was added for the Cisco 10000 Series Routers. The following command was introduced or modified: class type control |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.