Cisco Systems OL-4387-02 manual SSG Prepaid Idle Timeout, Configuration Example for SSG Autologoff

Chapter 3 SSG Logon and Logoff

SSG Prepaid Idle Timeout

Configuration Example for SSG Autologoff

Example 3-1shows how to enable autologoff with ARP ping.

Example 3-1 SSG Autologoff Using ARP Ping

ssg auto-logoff arp interval 60

Example 3-2shows how to enable autologoff with ICMP ping.

Example 3-2 SSG Autologoff Using ICMP Ping

ssg auto-logoff icmp interval 60 packet 2 timeout 500

SSG Prepaid Idle Timeout

The SSG Prepaid Idle Timeout feature enhances the SSG and the SSG Prepaid feature by doing the following:

•Enables SSG to return residual quotas (allotments of prepaid credit) to the billing server from services that a user is logged into but not actively using. The quota that is returned to the billing center can be applied to the quota for the services the user is actively using.

•Enables a user’s connection to services to be open even when the billing server returns a zero quota. The connection’s status depends on the combination of the quota and the idle timeout value returned. Depending on the connection service, SSG requests the quota for a connection from the billing server at the following times:

–After the user starts using a particular service

–When the user runs out of quota

–After the configured idle timeout value expires

•Enables SSG to reauthorize a user before the user completely consumes the allocated quota. You can also configure SSG to not pass traffic during reauthorization, thus preventing revenue leaks in the event the billing server returns a zero quota for the user.

•Enhances the handling of a returned zero quota from the billing server. If the billing server returns a zero quota and a nonzero idle timeout, the user has run out of credit for a service. When a user runs out of credit, the user is redirected to the billing server to replenish the quota. When the user is redirected to the billing server, the user’s connection to the original service or services remains up, but any traffic passing through the connection is dropped. This enables the user to replenish the quota on the billing server without losing connections to services or having to perform additional service logons.

•Enables SSG to notify the billing server when a connection fails. This enables the billing server to free quota that was reserved for the failed connection and to apply the quota immediately to some other active connection.

Without the SSG Prepaid Idle Timeout feature, traffic passed during reauthorization represents a revenue leak if the billing server returns a zero quota for the user. A configurable threshold value is used to prevent this. This value causes SSG to reauthorize a user’s connection before the user completely consumes the allocated quota for a service.

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

OL-4387-02 3-3