Table of Contents
Advertisement
Chapter 1
Service Selection Gateway Overview
The Cisco 10000 router's SSG software and forwarding software handle multiple users attached to a
•
single Cisco IOS software interface in different ways, which could result in users receiving services
that they did not select. After the first user logs on, all subsequent user logon attempts are rejected.
Although the logon is rejected and thus the ability to select services, all users can access the services
to which the first user is subscribed. User traffic is not rejected, only the user's authorization attempt.
The traffic from all users is logged in the statistics of the first user. The traffic to the user is treated as
transparent passthrough and is forwarded to the user, but it does not affect SSG accounting. If you enter
the ssg show host command, statistics are displayed for the first user only.
For users attached to multipoint interfaces on the access side, the Cisco 10000 router authorizes the
•
first user and then rejects the authorization attempts of subsequent users. The router only rejects the
authorization attempts, not the user traffic. The router treats all subsequent users as the first user
logged on, allowing access to the services to which the first user is subscribed. However, subsequent
users cannot select services. The traffic from all users is logged in the statistics of the first user.
Traffic to the second and subsequent users is treated as transparent passthrough and is forwarded to
these users, but it does not affect the SSG accounting. The ssg show host command displays the first
user.
•
Each private service is associated with its own VRF; global services are associated with the same
VRF. The default network and Open Garden network are typically added to all VRFs, except if the
network addresses overlap addresses in the private IP network or the Open Garden network is
explicitly bound to an uplink interface. The default network addresses must also be associated with
the global Cisco IOS VRF.
You can apply a service to a next-hop address or to an interface. The interface must be a
•
non-broadcast interface. For example, an interface with multipoint PVCs or Ethernet without
VLANs is not supported.
You can apply services with overlapping addresses to the same next-hop address. Services that have
•
overlapping addresses cannot be bound to different next-hop addresses if the next-hop addresses
resolve to the same interface.
•
All services that share an uplink interface must not have overlapping addresses. Normally, a service
defined to include a route of 0.0.0.0 with a subnet mask of 0.0.0.0 overlaps with any other possible
service. Therefore, the Cisco 10000 series router treats the route 0.0.0.0 with a subnet mask of
0.0.0.0 as a default route.
You cannot configure the following interface types as an SSG uplink interface:
•
–
–
–
–
For RBE and IP users, the addresses of services that share an uplink interface cannot overlap.
•
For information about the restrictions for a specific SSG feature, see the appropriate chapter in this
guide.
OL-4387-02
Any interface requiring tunneling (for example, L2TP or GRE tunneling)
Multilink PPP (MLPPP) interfaces
Tag interfaces
Load balanced interfaces
Cisco 10000 Series Router Service Selection Gateway Configuration Guide
SSG Restrictions
1-5
Advertisement
Table of Contents
