Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-4387-02 manual Interface Configuration, Transparent Passthrough, C H A P T E R

Models: OL-4387-02

1 110

Download 110 pages 54.42 Kb

Page 59

Interface Configuration

C H A P T E R 9

Interface Configuration

When an interface is configured as an SSG uplink or downlink interface, non-SSG traffic is not allowed to pass through the interface. You configure interfaces that are connected to services as uplink interfaces by using the ssg direction uplink command in interface configuration mode. If you use PPP to connect subscribers to SSG, you do not have to configure any downlink interfaces. If you use non-PPP connections, such as bridging or LAN, you must configure at least one downlink interface by using the ssg direction downlink command in interface configuration mode.

For more information, refer to the Service Selection Gateway, Release 12.2(15)B feature module.

The Cisco 10000 series router supports the following features for interfaces:

•Transparent Passthrough, page 9-1

•Multicast Protocols on SSG Interfaces, page 9-3This chapter describes the SSG features for interfaces.

Transparent Passthrough

The Transparent Passthrough feature allows unauthenticated traffic to pass through an interface. Interfaces configured as transparent passthrough are treated as Cisco IOS interfaces and not SSG interfaces. The Cisco 10000 series router can receive transparent passthrough traffic on both the access side and the network side. When an interface is configured as transparent passthrough, SSG does not process the traffic to and from the interface or apply SSG features. Instead, Cisco IOS software processes the traffic and applies Cisco IOS features.

Note The transparent passthrough feature is supported only for traffic to the host. The feature is not supported for traffic from the host; instead, you can configure an Open Garden network to allow SSG hosts access to certain networks. The default is to allow non-SSG hosts (on non-SSG interfaces) access to Internet services that are reachable through an uplink interface.

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

	OL-4387-02	9-1

Image 59

Cisco Systems OL-4387-02 manual Interface Configuration, Transparent Passthrough, page, C H A P T E R

Contents

800 553-NETS Fax 408 JanuaryCorporate Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CACopyright 2004, Cisco Systems, Inc All rights reserved Audience Service Selection Gateway OverviewDefault Network C O N T E N T SConfiguration of SSG Autologoff Configuration Example for SSG AutoDomainConfiguration Example for SSG Prepaid Configuration Examples for Account Login and LogoutService-Defined Cookie Configuration Example for SSG Open GardenConfiguration of Mutually Exclusive Service Selection Service ProfilesLimiting Redirection for Unauthenticated Users Configuration of VPI/VCI Static Binding to a Service ProfileInterface Configuration Configuring Port-Based Redirection for Unauthenticated UsersService Translation SSG UnconfigPer-Service Statistics Restrictions for SSG UnconfigOL-4387-02 viiiContents Chapter About This GuideAudience Document OrganizationDescription Document ConventionsChapter TitleObtaining Documentation Cisco 10000 Series Router Feature MapCisco 10000 Series Router Software Configuration Guides Related DocumentationOrdering Documentation Documentation FeedbackObtaining Technical Assistance Documentation CD-ROMhttp//tools.cisco.com/RPF/register/register.do Cisco TAC WebsiteOpening a TAC Case TAC Case Priority DefinitionsObtaining Additional Publications and Information C H A P T E R Service Selection Gateway OverviewService Selection Gateway Figure 1-1 SSG Topology Example Packets from the Default Network and Destined for an SSG User Default NetworkAccess Protocols Packets from a User and Destined for the Default NetworkService Profiles and Cached Service Profiles, page Supported SSG FeaturesSSG Logon and Logoff, page Authentication and Accounting, page Service Selection Methods, page Service Connection, pageAny interface requiring tunneling for example, L2TP or GRE tunneling Gaming SSG PrerequisitesSSG Architecture Model InternetIn Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices such as a desktop computer over DSL. The Cisco 10000 series router the SSG node forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network OL-4387-02 Chapter 1 Service Selection Gateway Overview SSG Architecture ModelC H A P T E R Scalability and PerformanceLimitations and Restrictions Best-Access to network B at rate Good-Access to network B at rate Prerequisites for Single Host Logon SSG Prepaid Idle Timeout, page SSG Session and Idle Timeout, pageSSG Logon and Logoff Single Host LogonARP ping Configuration of SSG AutologoffSSG Autologoff Restrictions for SSG AutologoffConfiguration Example for SSG Autologoff SSG Prepaid Idle TimeoutService Reauthorization Service AuthorizationConfiguration Example for SSG Prepaid Idle Timeout Restrictions for SSG Prepaid Idle TimeoutPrerequisites for SSG Prepaid Idle Timeout Configuration of SSG Prepaid Idle TimeoutSSG Session and Idle Timeout Restrictions for SSG Full Username RADIUS Attribute Authentication and AccountingConfiguration Examples for SSG Full Username RADIUS Attribute SSG Full Username RADIUS AttributeService Connection and Termination, page Account Login and LogoutConfiguration Examples for Account Login and Logout Account Login and Logout, pageConfiguration Examples for Service Connection and Termination Service Connection and TerminationService-Type-Indicates the type of service PTA-Multidomain Service Selection MethodsWeb Service Selection, page PPP Terminated AggregationRestrictions for PTA-MD Web Service SelectionSESM and SSG Performance OL-4387-02 Chapter 5 Service Selection Methods Web Service SelectionSSG AutoDomain, page SSG Prepaid, page SSG Open Garden, page Service ConnectionMutually Exclusive Service Selection, page SSG AutoDomainRestrictions for SSG AutoDomain Configuration of SSG AutoDomainConfiguration Example for SSG AutoDomain Example 6-3 AutoDomain Exclude File Format Example 6-1 SSG AutoDomainExample 6-2 AutoDomain Exclude Profile SSG VSA Format Restrictions for SSG Prepaid Configuration of SSG PrepaidSSG Prepaid SSG Open Garden Configuration Example for SSG PrepaidSSG Port-Bundle Host Key Configuration of SSG Open GardenConfiguration Example for SSG Open Garden SSG Open Garden, Release 12.24B feature moduleRestrictions for SSG Port-Bundle Host Key Exclude Networks Mutually Exclusive Service SelectionConfiguration of SSG Port-Bundle Host Key SSG Port-Bundle Host Key, Release 12.24B feature moduleExample 6-5 Configuring a Mutually Exclusive Service Selection Group Configuration of Mutually Exclusive Service SelectionConfiguration Example for Mutually Exclusive Service Selection OL-4387-02 6-10Chapter 6 Service Connection Mutually Exclusive Service Selection Service Profiles and Cached Service Profiles Service ProfilesDownstream Access Control List Service Profiles, page Cached Service Profiles, pageFull Username Upstream Access Control ListService Authentication Type Domain NameService Next-Hop Gateway Service-Defined CookieService Description Service ModeService Profile Example Cached Service ProfilesType of Service Configuration of Cached Service Profiles OL-4387-02 Chapter 7 Service Profiles and Cached Service ProfilesCached Service Profiles C H A P T E R SSG Hierarchical PolicingSSG Hierarchical Policing Overview SSG Hierarchical Policing Token Bucket SchemeRestrictions for SSG Hierarchical Policing SSG Hierarchical Policing ConfigurationRouterconfig-prof# attribute 26 9 1 “QU1600030004000D2400040008000” Configuration Examples for SSG Hierarchical PolicingConfiguration Examples for SSG Hierarchical Policing Routerconfig# local-profile cisco.comOL-4387-02 Configuration Examples for SSG Hierarchical PolicingChapter 8 SSG Hierarchical Policing C H A P T E R Interface ConfigurationTransparent Passthrough Transparent Passthrough, pageAccess Side Interfaces Restrictions of Transparent Passthrough Configuration of Transparent PassthroughMulticast Protocols on SSG Interfaces Network Side InterfacesConfiguration of Multicast Protocols on SSG Interfaces SSG TCP Redirect Redirection for Unauthenticated UsersRedirection for Unauthenticated Users, page Redirection for Unauthorized Services, page Initial Captivation, pagegroup-name Redirection for Unauthorized Services10-2 10-3 Initial Captivation10-4 Configuration of SSG TCP RedirectRestrictions for SSG TCP Redirect Prerequisites for SSG TCP RedirectConfiguration Considerations for SSG TCP Redirect, page Configuration Considerations for SSG TCP RedirectConfiguring Port-Based Redirection for Unauthenticated Users Limiting Redirection for Unauthenticated Users10-6 Configuring SSG TCP RedirectCommand PurposeConfiguration Example for Server Groups, page Configuration Examples for SSG TCP RedirectConfiguration Example for Server Groups Configuration Example for Network ListsChapter 10 SSG TCP Redirect Configuration Example for Port Lists10-8 Example 10-5 Defining Port ListsConfiguration of VPI/VCI Static Binding to a Service Profile Miscellaneous SSG FeaturesVPI/VCI Static Binding to a Service Profile Restrictions for VPI/VCI Static Binding to a Service ProfileRADIUS Virtual Circuit Logging AAA Server Group Support for Proxy ServicesConfiguration of RADIUS Virtual Circuit Logging Restrictions for AAA Server Group Support for Proxy ServicesUpstream Access Control List-inacl, page Configuration of AAA Server Group Support for Proxy ServicesConfiguration Example for AAA Server Group Support for Proxy Services Downstream Access Control List-outacl, page11-4 Downstream Access Control List-outaclUpstream Access Control List-inacl Restrictions for Packet FilteringRestrictions for SSG Unconfig SSG UnconfigConfiguration of Packet Filtering Configuration Example for Packet Filtering11-6 Prerequisites for SSG UnconfigConfiguration of SSG Unconfig Configuration Examples for SSG Unconfig11-7 SSG Enhancements for Overlapping ServicesService Translation Service Translation, page Expansion of Service IDs, pageSet1 0.0.0.0/0.0.0.0 Set2 10.58.253.0/255.255.255.0 Set3 11-811-9 Restrictions for Service TranslationPrerequisites for Service Translation Service Definitions Configuration of Service TranslationConfiguration Example for Service Translation Enables service translation and indicates to the router to use the11-11 Expansion of Service IDsRestrictions for Expansion of Service IDs Configuration Example for Expansion of Service IDs11-12 Network SetsC H A P T E R Monitoring and Maintaining SSG12-1 CommandRemoves the specified service Troubleshooting RADIUSPer-Service Statistics Restrictions for Per-Service StatisticsCommand Monitoring the Parallel Express Forwarding EngineReference Guide 12-3OL-4387-02 12-4Chapter 12 Monitoring and Maintaining SSG Monitoring the Parallel Express Forwarding EngineA P P E N D I X A SSG Configuration ExampleAppendix A SSG Configuration Example Example A-1 Cisco 10000 Router SSG ConfigurationOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration Exampleexec-timeout 0 0 password lab ntp clock-period 17181406 ntp update-calendarImplementation Notes SSG FeatureSSG Implementation Notes A P P E N D I X BImplementation Notes SSG FeatureImplementation Notes Also see the “Restrictions for SSG TCP Redirect” section on pageSSG Feature OL-4387-02 Appendix B SSG Implementation NotesGL-1 G L O S S A R YDigital Subscriber Line GL-2 GL-3 GL-4 GL-5 OL-4387-02 GL-6xDSL GlossaryIN-1 I N D ESee CEF inacl attribute IN-2idle timeout Idle Timeout Attribute 28 3-4IN-3 See PXFSee PPP Exclude Networks 6-8 See RBEIN-4 AutoDomainIN-5 virtual channel identifier See VCI virtual circuit See VC See VPIIN-6 VC G-5 VCI G-5 vendor-specific attributes definition G-5VRF G-5 VSA definition G-5 IN-7VPI G-5 VPI/VCI implementation notes B-3 service profiles subscriber web service selection 5-2 web sites accessing through Open Garden 6-5OL-4387-02 IN-8Index