Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-4387-02 manual Restrictions for Service Translation, 11-9

Models: OL-4387-02

1 110

Download 110 pages 54.42 Kb

Page 79

Restrictions for Service Translation

Chapter 11 Miscellaneous SSG Features

SSG Enhancements for Overlapping Services

The service translation mechanism then internally converts the services to the following sets:

Service Bronze_256

Set1

Service Silver_512

Set1 and set2

The service translation mechanism also provides for the translation of services that are complete subsets of one another. For example, consider the following service definitions:

ssg bind service A_1 <next hop ssg> 10.58.253.0/255.255.255.0

ssg bind service B_256 <next hop ssg> 10.58.0.0/255.255.0.0

Based on the service definitions, service A_1 is a subset of service B_256. Therefore, the service translation mechanism creates the following two sets and internally converts the services to sets:

Set1

10.58.253.0/255.255.255.0

Set2

10.58.0.0/255.255.0.0

Service A_1

Set1

Service B_256

Set1 and set2

Assume that user1 is subscribed to service B_256 at 256 Kbps and user2 is subscribed to service A_1 at 1 Mbps. Internally, user1 is subscribed to both set1 and set2. However, policing of the aggregate traffic to either set1 or set2 is at an aggregate rate of 256 Kbps because policing of user traffic is based on the service to which the user is assigned. User1 is subscribed to service B_256; therefore, policing is at a rate of 256 Kbps.

Restrictions for Service Translation

Service translation has the following restrictions:

•Network sets for services must be unique.

•If the service definitions from SESM change, the user must be disconnected and then reconnected before the service translation mechanism can properly translate the new service definitions.

Prerequisites for Service Translation

Enable service translation before SESM downloads overlapping service definitions.

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

	OL-4387-02	11-9

Image 79

Cisco Systems OL-4387-02 manual Restrictions for Service Translation, Prerequisites for Service Translation, 11-9

Contents

800 553-NETS Fax 408 JanuaryCorporate Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CACopyright 2004, Cisco Systems, Inc All rights reserved Audience Service Selection Gateway OverviewDefault Network C O N T E N T SConfiguration of SSG Autologoff Configuration Example for SSG AutoDomainConfiguration Example for SSG Prepaid Configuration Examples for Account Login and LogoutService-Defined Cookie Configuration Example for SSG Open GardenConfiguration of Mutually Exclusive Service Selection Service ProfilesLimiting Redirection for Unauthenticated Users Configuration of VPI/VCI Static Binding to a Service ProfileInterface Configuration Configuring Port-Based Redirection for Unauthenticated UsersService Translation SSG UnconfigPer-Service Statistics Restrictions for SSG UnconfigContents viiiOL-4387-02 Chapter About This GuideAudience Document OrganizationDescription Document ConventionsChapter TitleObtaining Documentation Cisco 10000 Series Router Feature MapCisco 10000 Series Router Software Configuration Guides Related DocumentationOrdering Documentation Documentation FeedbackObtaining Technical Assistance Documentation CD-ROMhttp//tools.cisco.com/RPF/register/register.do Cisco TAC WebsiteOpening a TAC Case TAC Case Priority DefinitionsObtaining Additional Publications and Information Service Selection Gateway Service Selection Gateway OverviewC H A P T E R Figure 1-1 SSG Topology Example Packets from the Default Network and Destined for an SSG User Default NetworkAccess Protocols Packets from a User and Destined for the Default NetworkService Profiles and Cached Service Profiles, page Supported SSG FeaturesSSG Logon and Logoff, page Authentication and Accounting, page Service Selection Methods, page Service Connection, pageAny interface requiring tunneling for example, L2TP or GRE tunneling Gaming SSG PrerequisitesSSG Architecture Model InternetIn Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices such as a desktop computer over DSL. The Cisco 10000 series router the SSG node forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network OL-4387-02 Chapter 1 Service Selection Gateway Overview SSG Architecture ModelLimitations and Restrictions Scalability and PerformanceC H A P T E R Best-Access to network B at rate Good-Access to network B at rate Prerequisites for Single Host Logon SSG Prepaid Idle Timeout, page SSG Session and Idle Timeout, pageSSG Logon and Logoff Single Host LogonARP ping Configuration of SSG AutologoffSSG Autologoff Restrictions for SSG AutologoffConfiguration Example for SSG Autologoff SSG Prepaid Idle TimeoutService Reauthorization Service AuthorizationConfiguration Example for SSG Prepaid Idle Timeout Restrictions for SSG Prepaid Idle TimeoutPrerequisites for SSG Prepaid Idle Timeout Configuration of SSG Prepaid Idle TimeoutSSG Session and Idle Timeout Restrictions for SSG Full Username RADIUS Attribute Authentication and AccountingConfiguration Examples for SSG Full Username RADIUS Attribute SSG Full Username RADIUS AttributeService Connection and Termination, page Account Login and LogoutConfiguration Examples for Account Login and Logout Account Login and Logout, pageConfiguration Examples for Service Connection and Termination Service Connection and TerminationService-Type-Indicates the type of service PTA-Multidomain Service Selection MethodsWeb Service Selection, page PPP Terminated AggregationRestrictions for PTA-MD Web Service SelectionSESM and SSG Performance OL-4387-02 Chapter 5 Service Selection Methods Web Service SelectionSSG AutoDomain, page SSG Prepaid, page SSG Open Garden, page Service ConnectionMutually Exclusive Service Selection, page SSG AutoDomainConfiguration Example for SSG AutoDomain Configuration of SSG AutoDomainRestrictions for SSG AutoDomain Example 6-2 AutoDomain Exclude Profile SSG VSA Format Example 6-1 SSG AutoDomainExample 6-3 AutoDomain Exclude File Format SSG Prepaid Configuration of SSG PrepaidRestrictions for SSG Prepaid SSG Open Garden Configuration Example for SSG PrepaidSSG Port-Bundle Host Key Configuration of SSG Open GardenConfiguration Example for SSG Open Garden SSG Open Garden, Release 12.24B feature moduleRestrictions for SSG Port-Bundle Host Key Exclude Networks Mutually Exclusive Service SelectionConfiguration of SSG Port-Bundle Host Key SSG Port-Bundle Host Key, Release 12.24B feature moduleConfiguration Example for Mutually Exclusive Service Selection Configuration of Mutually Exclusive Service SelectionExample 6-5 Configuring a Mutually Exclusive Service Selection Group Chapter 6 Service Connection Mutually Exclusive Service Selection 6-10OL-4387-02 Service Profiles and Cached Service Profiles Service ProfilesDownstream Access Control List Service Profiles, page Cached Service Profiles, pageFull Username Upstream Access Control ListService Authentication Type Domain NameService Next-Hop Gateway Service-Defined CookieService Description Service ModeType of Service Cached Service ProfilesService Profile Example Configuration of Cached Service Profiles Cached Service Profiles Chapter 7 Service Profiles and Cached Service ProfilesOL-4387-02 C H A P T E R SSG Hierarchical PolicingSSG Hierarchical Policing Overview SSG Hierarchical Policing Token Bucket SchemeRestrictions for SSG Hierarchical Policing SSG Hierarchical Policing ConfigurationRouterconfig-prof# attribute 26 9 1 “QU1600030004000D2400040008000” Configuration Examples for SSG Hierarchical PolicingConfiguration Examples for SSG Hierarchical Policing Routerconfig# local-profile cisco.comChapter 8 SSG Hierarchical Policing Configuration Examples for SSG Hierarchical PolicingOL-4387-02 C H A P T E R Interface ConfigurationTransparent Passthrough Transparent Passthrough, pageAccess Side Interfaces Restrictions of Transparent Passthrough Configuration of Transparent PassthroughMulticast Protocols on SSG Interfaces Network Side InterfacesConfiguration of Multicast Protocols on SSG Interfaces SSG TCP Redirect Redirection for Unauthenticated UsersRedirection for Unauthenticated Users, page Redirection for Unauthorized Services, page Initial Captivation, page10-2 Redirection for Unauthorized Servicesgroup-name 10-3 Initial Captivation10-4 Configuration of SSG TCP RedirectRestrictions for SSG TCP Redirect Prerequisites for SSG TCP RedirectConfiguration Considerations for SSG TCP Redirect, page Configuration Considerations for SSG TCP RedirectConfiguring Port-Based Redirection for Unauthenticated Users Limiting Redirection for Unauthenticated Users10-6 Configuring SSG TCP RedirectCommand PurposeConfiguration Example for Server Groups, page Configuration Examples for SSG TCP RedirectConfiguration Example for Server Groups Configuration Example for Network ListsChapter 10 SSG TCP Redirect Configuration Example for Port Lists10-8 Example 10-5 Defining Port ListsConfiguration of VPI/VCI Static Binding to a Service Profile Miscellaneous SSG FeaturesVPI/VCI Static Binding to a Service Profile Restrictions for VPI/VCI Static Binding to a Service ProfileRADIUS Virtual Circuit Logging AAA Server Group Support for Proxy ServicesConfiguration of RADIUS Virtual Circuit Logging Restrictions for AAA Server Group Support for Proxy ServicesUpstream Access Control List-inacl, page Configuration of AAA Server Group Support for Proxy ServicesConfiguration Example for AAA Server Group Support for Proxy Services Downstream Access Control List-outacl, page11-4 Downstream Access Control List-outaclUpstream Access Control List-inacl Restrictions for Packet FilteringRestrictions for SSG Unconfig SSG UnconfigConfiguration of Packet Filtering Configuration Example for Packet Filtering11-6 Prerequisites for SSG UnconfigConfiguration of SSG Unconfig Configuration Examples for SSG Unconfig11-7 SSG Enhancements for Overlapping ServicesService Translation Service Translation, page Expansion of Service IDs, pageSet1 0.0.0.0/0.0.0.0 Set2 10.58.253.0/255.255.255.0 Set3 11-8Prerequisites for Service Translation Restrictions for Service Translation11-9 Service Definitions Configuration of Service TranslationConfiguration Example for Service Translation Enables service translation and indicates to the router to use the11-11 Expansion of Service IDsRestrictions for Expansion of Service IDs Configuration Example for Expansion of Service IDs11-12 Network SetsC H A P T E R Monitoring and Maintaining SSG12-1 CommandRemoves the specified service Troubleshooting RADIUSPer-Service Statistics Restrictions for Per-Service StatisticsCommand Monitoring the Parallel Express Forwarding EngineReference Guide 12-3OL-4387-02 12-4Chapter 12 Monitoring and Maintaining SSG Monitoring the Parallel Express Forwarding EngineA P P E N D I X A SSG Configuration ExampleAppendix A SSG Configuration Example Example A-1 Cisco 10000 Router SSG ConfigurationOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration Exampleexec-timeout 0 0 password lab ntp clock-period 17181406 ntp update-calendarImplementation Notes SSG FeatureSSG Implementation Notes A P P E N D I X BImplementation Notes SSG FeatureSSG Feature Also see the “Restrictions for SSG TCP Redirect” section on pageImplementation Notes OL-4387-02 Appendix B SSG Implementation NotesDigital Subscriber Line G L O S S A R YGL-1 GL-2 GL-3 GL-4 GL-5 OL-4387-02 GL-6xDSL GlossarySee CEF I N D EIN-1 inacl attribute IN-2idle timeout Idle Timeout Attribute 28 3-4See PPP See PXFIN-3 Exclude Networks 6-8 See RBEIN-4 AutoDomainIN-5 virtual channel identifier See VCI virtual circuit See VC See VPIIN-6 VC G-5 VCI G-5 vendor-specific attributes definition G-5VRF G-5 VSA definition G-5 IN-7VPI G-5 VPI/VCI implementation notes B-3 service profiles subscriber web service selection 5-2 web sites accessing through Open Garden 6-5Index IN-8OL-4387-02