Cisco Systems OL-4387-02 Any interface requiring tunneling for example, L2TP or GRE tunneling

Chapter 1 Service Selection Gateway Overview

SSG Restrictions

•The Cisco 10000 router’s SSG software and forwarding software handle multiple users attached to a single Cisco IOS software interface in different ways, which could result in users receiving services that they did not select. After the first user logs on, all subsequent user logon attempts are rejected.

Although the logon is rejected and thus the ability to select services, all users can access the services to which the first user is subscribed. User traffic is not rejected, only the user’s authorization attempt. The traffic from all users is logged in the statistics of the first user. The traffic to the user is treated as transparent passthrough and is forwarded to the user, but it does not affect SSG accounting. If you enter the ssg show host command, statistics are displayed for the first user only.

•For users attached to multipoint interfaces on the access side, the Cisco 10000 router authorizes the first user and then rejects the authorization attempts of subsequent users. The router only rejects the authorization attempts, not the user traffic. The router treats all subsequent users as the first user logged on, allowing access to the services to which the first user is subscribed. However, subsequent users cannot select services. The traffic from all users is logged in the statistics of the first user. Traffic to the second and subsequent users is treated as transparent passthrough and is forwarded to these users, but it does not affect the SSG accounting. The ssg show host command displays the first user.

•Each private service is associated with its own VRF; global services are associated with the same VRF. The default network and Open Garden network are typically added to all VRFs, except if the network addresses overlap addresses in the private IP network or the Open Garden network is explicitly bound to an uplink interface. The default network addresses must also be associated with the global Cisco IOS VRF.

•You can apply a service to a next-hop address or to an interface. The interface must be a non-broadcast interface. For example, an interface with multipoint PVCs or Ethernet without VLANs is not supported.

•You can apply services with overlapping addresses to the same next-hop address. Services that have overlapping addresses cannot be bound to different next-hop addresses if the next-hop addresses resolve to the same interface.

•All services that share an uplink interface must not have overlapping addresses. Normally, a service defined to include a route of 0.0.0.0 with a subnet mask of 0.0.0.0 overlaps with any other possible service. Therefore, the Cisco 10000 series router treats the route 0.0.0.0 with a subnet mask of 0.0.0.0 as a default route.

•You cannot configure the following interface types as an SSG uplink interface:

–Any interface requiring tunneling (for example, L2TP or GRE tunneling)

–Multilink PPP (MLPPP) interfaces

–Tag interfaces

–Load balanced interfaces

•For RBE and IP users, the addresses of services that share an uplink interface cannot overlap.

For information about the restrictions for a specific SSG feature, see the appropriate chapter in this guide.

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

OL-4387-02 1-5