Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-4387-02 manual Service Selection Gateway Overview, C H A P T E R

Models: OL-4387-02

1 110

Download 110 pages 54.42 Kb

Page 15

C H A P T E R 1

C H A P T E R 1

Service Selection Gateway Overview

The Service Selection Gateway feature, available in Cisco IOS Release 12.2(16)BX or later, offers a switching solution to service providers. Working in conjunction with the Cisco Subscriber Edge Services Manager (SESM), SSG provides subscriber authentication, service selection, and service connection capabilities to subscribers of Internet services. Subscribers interact with the SESM web application using a standard Internet browser.

This chapter provides an overview of the Service Selection Gateway feature available on the

Cisco 10000 series router.

Service Selection Gateway

The Cisco 10000 series router supports the Service Selection Gateway (SSG) feature in Cisco IOS Release 12.2(16)BX or later. SSG is a switching solution for service providers who offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as digital subscriber lines (DSL) lines, cable modems, or wireless to allow simultaneous access to network services. SSG provides connectivity to corporate networks and differential service selection to users with access to multiple simultaneous services. Users can dynamically connect to and disconnect from any of the services available to them.

Figure 1-1shows an example of an SSG topology. In the figure, a single user connects to the

Cisco 10000 series router using an access protocol such as PPP, RBE, or IP. SSG resides in the router that serves as a broadband aggregator. The router acts as a central control point for Layer 2 and Layer 3 services, including services available through ATM virtual circuits (VCs), virtual private dial-up networks (VPDNs), and normal routing methods. The user can concurrently connect to a number of different services, which can be private or public services. Connections to the services are established using IP.

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

	OL-4387-02	1-1

Image 15

Cisco Systems OL-4387-02 manual Service Selection Gateway Overview, C H A P T E R

Contents

800 553-NETS Fax 408 JanuaryCorporate Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CACopyright 2004, Cisco Systems, Inc All rights reserved Audience Service Selection Gateway OverviewDefault Network C O N T E N T SConfiguration of SSG Autologoff Configuration Example for SSG AutoDomainConfiguration Example for SSG Prepaid Configuration Examples for Account Login and LogoutService-Defined Cookie Configuration Example for SSG Open GardenConfiguration of Mutually Exclusive Service Selection Service ProfilesLimiting Redirection for Unauthenticated Users Configuration of VPI/VCI Static Binding to a Service ProfileInterface Configuration Configuring Port-Based Redirection for Unauthenticated UsersService Translation SSG UnconfigPer-Service Statistics Restrictions for SSG Unconfigviii ContentsOL-4387-02 Chapter About This GuideAudience Document OrganizationDescription Document ConventionsChapter TitleObtaining Documentation Cisco 10000 Series Router Feature MapCisco 10000 Series Router Software Configuration Guides Related DocumentationOrdering Documentation Documentation FeedbackObtaining Technical Assistance Documentation CD-ROMhttp//tools.cisco.com/RPF/register/register.do Cisco TAC WebsiteOpening a TAC Case TAC Case Priority DefinitionsObtaining Additional Publications and Information Service Selection Gateway Overview Service Selection GatewayC H A P T E R Figure 1-1 SSG Topology Example Packets from the Default Network and Destined for an SSG User Default NetworkAccess Protocols Packets from a User and Destined for the Default NetworkService Profiles and Cached Service Profiles, page Supported SSG FeaturesSSG Logon and Logoff, page Authentication and Accounting, page Service Selection Methods, page Service Connection, pageAny interface requiring tunneling for example, L2TP or GRE tunneling Gaming SSG PrerequisitesSSG Architecture Model InternetIn Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices such as a desktop computer over DSL. The Cisco 10000 series router the SSG node forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network OL-4387-02 Chapter 1 Service Selection Gateway Overview SSG Architecture ModelScalability and Performance Limitations and RestrictionsC H A P T E R Best-Access to network B at rate Good-Access to network B at rate Prerequisites for Single Host Logon SSG Prepaid Idle Timeout, page SSG Session and Idle Timeout, pageSSG Logon and Logoff Single Host LogonARP ping Configuration of SSG AutologoffSSG Autologoff Restrictions for SSG AutologoffConfiguration Example for SSG Autologoff SSG Prepaid Idle TimeoutService Reauthorization Service AuthorizationConfiguration Example for SSG Prepaid Idle Timeout Restrictions for SSG Prepaid Idle TimeoutPrerequisites for SSG Prepaid Idle Timeout Configuration of SSG Prepaid Idle TimeoutSSG Session and Idle Timeout Restrictions for SSG Full Username RADIUS Attribute Authentication and AccountingConfiguration Examples for SSG Full Username RADIUS Attribute SSG Full Username RADIUS AttributeService Connection and Termination, page Account Login and LogoutConfiguration Examples for Account Login and Logout Account Login and Logout, pageConfiguration Examples for Service Connection and Termination Service Connection and TerminationService-Type-Indicates the type of service PTA-Multidomain Service Selection MethodsWeb Service Selection, page PPP Terminated AggregationRestrictions for PTA-MD Web Service SelectionSESM and SSG Performance OL-4387-02 Chapter 5 Service Selection Methods Web Service SelectionSSG AutoDomain, page SSG Prepaid, page SSG Open Garden, page Service ConnectionMutually Exclusive Service Selection, page SSG AutoDomainConfiguration of SSG AutoDomain Configuration Example for SSG AutoDomainRestrictions for SSG AutoDomain Example 6-1 SSG AutoDomain Example 6-2 AutoDomain Exclude Profile SSG VSA FormatExample 6-3 AutoDomain Exclude File Format Configuration of SSG Prepaid SSG PrepaidRestrictions for SSG Prepaid SSG Open Garden Configuration Example for SSG PrepaidSSG Port-Bundle Host Key Configuration of SSG Open GardenConfiguration Example for SSG Open Garden SSG Open Garden, Release 12.24B feature moduleRestrictions for SSG Port-Bundle Host Key Exclude Networks Mutually Exclusive Service SelectionConfiguration of SSG Port-Bundle Host Key SSG Port-Bundle Host Key, Release 12.24B feature moduleConfiguration of Mutually Exclusive Service Selection Configuration Example for Mutually Exclusive Service SelectionExample 6-5 Configuring a Mutually Exclusive Service Selection Group 6-10 Chapter 6 Service Connection Mutually Exclusive Service SelectionOL-4387-02 Service Profiles and Cached Service Profiles Service ProfilesDownstream Access Control List Service Profiles, page Cached Service Profiles, pageFull Username Upstream Access Control ListService Authentication Type Domain NameService Next-Hop Gateway Service-Defined CookieService Description Service ModeCached Service Profiles Type of ServiceService Profile Example Configuration of Cached Service Profiles Chapter 7 Service Profiles and Cached Service Profiles Cached Service ProfilesOL-4387-02 C H A P T E R SSG Hierarchical PolicingSSG Hierarchical Policing Overview SSG Hierarchical Policing Token Bucket SchemeRestrictions for SSG Hierarchical Policing SSG Hierarchical Policing ConfigurationRouterconfig-prof# attribute 26 9 1 “QU1600030004000D2400040008000” Configuration Examples for SSG Hierarchical PolicingConfiguration Examples for SSG Hierarchical Policing Routerconfig# local-profile cisco.comConfiguration Examples for SSG Hierarchical Policing Chapter 8 SSG Hierarchical PolicingOL-4387-02 C H A P T E R Interface ConfigurationTransparent Passthrough Transparent Passthrough, pageAccess Side Interfaces Restrictions of Transparent Passthrough Configuration of Transparent PassthroughMulticast Protocols on SSG Interfaces Network Side InterfacesConfiguration of Multicast Protocols on SSG Interfaces SSG TCP Redirect Redirection for Unauthenticated UsersRedirection for Unauthenticated Users, page Redirection for Unauthorized Services, page Initial Captivation, pageRedirection for Unauthorized Services 10-2group-name 10-3 Initial Captivation10-4 Configuration of SSG TCP RedirectRestrictions for SSG TCP Redirect Prerequisites for SSG TCP RedirectConfiguration Considerations for SSG TCP Redirect, page Configuration Considerations for SSG TCP RedirectConfiguring Port-Based Redirection for Unauthenticated Users Limiting Redirection for Unauthenticated Users10-6 Configuring SSG TCP RedirectCommand PurposeConfiguration Example for Server Groups, page Configuration Examples for SSG TCP RedirectConfiguration Example for Server Groups Configuration Example for Network ListsChapter 10 SSG TCP Redirect Configuration Example for Port Lists10-8 Example 10-5 Defining Port ListsConfiguration of VPI/VCI Static Binding to a Service Profile Miscellaneous SSG FeaturesVPI/VCI Static Binding to a Service Profile Restrictions for VPI/VCI Static Binding to a Service ProfileRADIUS Virtual Circuit Logging AAA Server Group Support for Proxy ServicesConfiguration of RADIUS Virtual Circuit Logging Restrictions for AAA Server Group Support for Proxy ServicesUpstream Access Control List-inacl, page Configuration of AAA Server Group Support for Proxy ServicesConfiguration Example for AAA Server Group Support for Proxy Services Downstream Access Control List-outacl, page11-4 Downstream Access Control List-outaclUpstream Access Control List-inacl Restrictions for Packet FilteringRestrictions for SSG Unconfig SSG UnconfigConfiguration of Packet Filtering Configuration Example for Packet Filtering11-6 Prerequisites for SSG UnconfigConfiguration of SSG Unconfig Configuration Examples for SSG Unconfig11-7 SSG Enhancements for Overlapping ServicesService Translation Service Translation, page Expansion of Service IDs, pageSet1 0.0.0.0/0.0.0.0 Set2 10.58.253.0/255.255.255.0 Set3 11-8Restrictions for Service Translation Prerequisites for Service Translation11-9 Service Definitions Configuration of Service TranslationConfiguration Example for Service Translation Enables service translation and indicates to the router to use the11-11 Expansion of Service IDsRestrictions for Expansion of Service IDs Configuration Example for Expansion of Service IDs11-12 Network SetsC H A P T E R Monitoring and Maintaining SSG12-1 CommandRemoves the specified service Troubleshooting RADIUSPer-Service Statistics Restrictions for Per-Service StatisticsCommand Monitoring the Parallel Express Forwarding EngineReference Guide 12-3OL-4387-02 12-4Chapter 12 Monitoring and Maintaining SSG Monitoring the Parallel Express Forwarding EngineA P P E N D I X A SSG Configuration ExampleAppendix A SSG Configuration Example Example A-1 Cisco 10000 Router SSG ConfigurationOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration Exampleexec-timeout 0 0 password lab ntp clock-period 17181406 ntp update-calendarImplementation Notes SSG FeatureSSG Implementation Notes A P P E N D I X BImplementation Notes SSG FeatureAlso see the “Restrictions for SSG TCP Redirect” section on page SSG FeatureImplementation Notes OL-4387-02 Appendix B SSG Implementation NotesG L O S S A R Y Digital Subscriber LineGL-1 GL-2 GL-3 GL-4 GL-5 OL-4387-02 GL-6xDSL GlossaryI N D E See CEFIN-1 inacl attribute IN-2idle timeout Idle Timeout Attribute 28 3-4See PXF See PPPIN-3 Exclude Networks 6-8 See RBEIN-4 AutoDomainIN-5 virtual channel identifier See VCI virtual circuit See VC See VPIIN-6 VC G-5 VCI G-5 vendor-specific attributes definition G-5VRF G-5 VSA definition G-5 IN-7VPI G-5 VPI/VCI implementation notes B-3 service profiles subscriber web service selection 5-2 web sites accessing through Open Garden 6-5IN-8 IndexOL-4387-02