A P P E N D I X B
SSG Implementation Notes
Table
Table
SSG Feature | Implementation Notes |
ACLs and QoS | ACL and QoS are applied even if the traffic is to or from an Open Garden or the |
| default network (when |
| Service ACLs cannot be applied to a connection. The connection will remain |
| active, but the ACLs will have no effect. |
| Modular QoS CLI (MQC) is not supported on SSG interfaces. If an MQC service |
| policy is configured on an SSG interface, SSG ignores the policy. |
| See the “Restrictions for SSG Hierarchical Policing” section on page |
| additional implementation information. |
|
|
AutoDomain | You must enable Cisco Express Forwarding (CEF) before you enable SSG |
| functionality. |
| Passthrough services are available only for services that perform authentication |
| (for example, proxy or VPDN services). This is because AutoDomain bypasses |
| the local authentication that is performed at the network access server (NAS). |
| DHCP requests for IP address assignment must be done before RADIUS |
| negotiation. |
| If an |
| |
| |
|
|
L2TP | Not supported. |
| SSG attempts to set up the tunnel, but does not set up the VRF for tunnel services. |
| Therefore, traffic is not forwarded to the tunnel. The same applies to L2TP dialout. |
|
|
Logon | A user cannot log on to services on different uplink interfaces. All services that |
| the user connects to must be on the same interface. This is because a user can |
| connect to only one VRF, and in SSG one VRF is used for each uplink interface. |
| To connect to a different service, the user has to logoff from the current service, |
| and log on to the other service. |
|
|
Cisco 10000 Series Router Service Selection Gateway Configuration Guide
| ||
|
