Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-4387-02 manual Appendix B SSG Implementation Notes

Models: OL-4387-02

1 110

Download 110 pages 54.42 Kb

Page 96

Manual background

Appendix B SSG Implementation Notes

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

	B-4	OL-4387-02

Image 96

Cisco Systems OL-4387-02 manual Appendix B SSG Implementation Notes

Contents

January Corporate HeadquartersCisco Systems, Inc 170 West Tasman Drive San Jose, CA 800 553-NETS Fax 408Copyright 2004, Cisco Systems, Inc All rights reserved Service Selection Gateway Overview Default NetworkC O N T E N T S AudienceConfiguration Example for SSG AutoDomain Configuration Example for SSG PrepaidConfiguration Examples for Account Login and Logout Configuration of SSG AutologoffConfiguration Example for SSG Open Garden Configuration of Mutually Exclusive Service SelectionService Profiles Service-Defined CookieConfiguration of VPI/VCI Static Binding to a Service Profile Interface ConfigurationConfiguring Port-Based Redirection for Unauthenticated Users Limiting Redirection for Unauthenticated UsersSSG Unconfig Per-Service StatisticsRestrictions for SSG Unconfig Service Translationviii ContentsOL-4387-02 About This Guide AudienceDocument Organization ChapterDocument Conventions ChapterTitle DescriptionCisco 10000 Series Router Feature Map Cisco 10000 Series Router Software Configuration GuidesRelated Documentation Obtaining DocumentationDocumentation Feedback Obtaining Technical AssistanceDocumentation CD-ROM Ordering DocumentationCisco TAC Website Opening a TAC CaseTAC Case Priority Definitions http//tools.cisco.com/RPF/register/register.doObtaining Additional Publications and Information Service Selection Gateway Overview Service Selection GatewayC H A P T E R Figure 1-1 SSG Topology Example Default Network Access ProtocolsPackets from a User and Destined for the Default Network Packets from the Default Network and Destined for an SSG UserSupported SSG Features SSG Logon and Logoff, page Authentication and Accounting, pageService Selection Methods, page Service Connection, page Service Profiles and Cached Service Profiles, pageAny interface requiring tunneling for example, L2TP or GRE tunneling SSG Prerequisites SSG Architecture ModelInternet GamingIn Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices such as a desktop computer over DSL. The Cisco 10000 series router the SSG node forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network Chapter 1 Service Selection Gateway Overview SSG Architecture Model OL-4387-02Scalability and Performance Limitations and RestrictionsC H A P T E R Best-Access to network B at rate Good-Access to network B at rate SSG Prepaid Idle Timeout, page SSG Session and Idle Timeout, page SSG Logon and LogoffSingle Host Logon Prerequisites for Single Host LogonConfiguration of SSG Autologoff SSG AutologoffRestrictions for SSG Autologoff ARP pingSSG Prepaid Idle Timeout Configuration Example for SSG AutologoffService Authorization Service ReauthorizationRestrictions for SSG Prepaid Idle Timeout Prerequisites for SSG Prepaid Idle TimeoutConfiguration of SSG Prepaid Idle Timeout Configuration Example for SSG Prepaid Idle TimeoutSSG Session and Idle Timeout Authentication and Accounting Configuration Examples for SSG Full Username RADIUS AttributeSSG Full Username RADIUS Attribute Restrictions for SSG Full Username RADIUS AttributeAccount Login and Logout Configuration Examples for Account Login and LogoutAccount Login and Logout, page Service Connection and Termination, pageService Connection and Termination Configuration Examples for Service Connection and TerminationService-Type-Indicates the type of service Service Selection Methods Web Service Selection, pagePPP Terminated Aggregation PTA-MultidomainWeb Service Selection Restrictions for PTA-MDSESM and SSG Performance Chapter 5 Service Selection Methods Web Service Selection OL-4387-02Service Connection Mutually Exclusive Service Selection, pageSSG AutoDomain SSG AutoDomain, page SSG Prepaid, page SSG Open Garden, pageConfiguration of SSG AutoDomain Configuration Example for SSG AutoDomainRestrictions for SSG AutoDomain Example 6-1 SSG AutoDomain Example 6-2 AutoDomain Exclude Profile SSG VSA FormatExample 6-3 AutoDomain Exclude File Format Configuration of SSG Prepaid SSG PrepaidRestrictions for SSG Prepaid Configuration Example for SSG Prepaid SSG Open GardenConfiguration of SSG Open Garden Configuration Example for SSG Open GardenSSG Open Garden, Release 12.24B feature module SSG Port-Bundle Host KeyRestrictions for SSG Port-Bundle Host Key Mutually Exclusive Service Selection Configuration of SSG Port-Bundle Host KeySSG Port-Bundle Host Key, Release 12.24B feature module Exclude NetworksConfiguration of Mutually Exclusive Service Selection Configuration Example for Mutually Exclusive Service SelectionExample 6-5 Configuring a Mutually Exclusive Service Selection Group 6-10 Chapter 6 Service Connection Mutually Exclusive Service SelectionOL-4387-02 Service Profiles Downstream Access Control ListService Profiles, page Cached Service Profiles, page Service Profiles and Cached Service ProfilesUpstream Access Control List Service Authentication TypeDomain Name Full UsernameService-Defined Cookie Service DescriptionService Mode Service Next-Hop GatewayCached Service Profiles Type of ServiceService Profile Example Configuration of Cached Service Profiles Chapter 7 Service Profiles and Cached Service Profiles Cached Service ProfilesOL-4387-02 SSG Hierarchical Policing SSG Hierarchical Policing OverviewSSG Hierarchical Policing Token Bucket Scheme C H A P T E RSSG Hierarchical Policing Configuration Restrictions for SSG Hierarchical PolicingConfiguration Examples for SSG Hierarchical Policing Configuration Examples for SSG Hierarchical PolicingRouterconfig# local-profile cisco.com Routerconfig-prof# attribute 26 9 1 “QU1600030004000D2400040008000”Configuration Examples for SSG Hierarchical Policing Chapter 8 SSG Hierarchical PolicingOL-4387-02 Interface Configuration Transparent PassthroughTransparent Passthrough, page C H A P T E RAccess Side Interfaces Configuration of Transparent Passthrough Multicast Protocols on SSG InterfacesNetwork Side Interfaces Restrictions of Transparent PassthroughConfiguration of Multicast Protocols on SSG Interfaces Redirection for Unauthenticated Users Redirection for Unauthenticated Users, pageRedirection for Unauthorized Services, page Initial Captivation, page SSG TCP RedirectRedirection for Unauthorized Services 10-2group-name Initial Captivation 10-3Configuration of SSG TCP Redirect Restrictions for SSG TCP RedirectPrerequisites for SSG TCP Redirect 10-4Configuration Considerations for SSG TCP Redirect Configuring Port-Based Redirection for Unauthenticated UsersLimiting Redirection for Unauthenticated Users Configuration Considerations for SSG TCP Redirect, pageConfiguring SSG TCP Redirect CommandPurpose 10-6Configuration Examples for SSG TCP Redirect Configuration Example for Server GroupsConfiguration Example for Network Lists Configuration Example for Server Groups, pageConfiguration Example for Port Lists 10-8Example 10-5 Defining Port Lists Chapter 10 SSG TCP RedirectMiscellaneous SSG Features VPI/VCI Static Binding to a Service ProfileRestrictions for VPI/VCI Static Binding to a Service Profile Configuration of VPI/VCI Static Binding to a Service ProfileAAA Server Group Support for Proxy Services Configuration of RADIUS Virtual Circuit LoggingRestrictions for AAA Server Group Support for Proxy Services RADIUS Virtual Circuit LoggingConfiguration of AAA Server Group Support for Proxy Services Configuration Example for AAA Server Group Support for Proxy ServicesDownstream Access Control List-outacl, page Upstream Access Control List-inacl, pageDownstream Access Control List-outacl Upstream Access Control List-inaclRestrictions for Packet Filtering 11-4SSG Unconfig Configuration of Packet FilteringConfiguration Example for Packet Filtering Restrictions for SSG UnconfigPrerequisites for SSG Unconfig Configuration of SSG UnconfigConfiguration Examples for SSG Unconfig 11-6SSG Enhancements for Overlapping Services Service TranslationService Translation, page Expansion of Service IDs, page 11-711-8 Set1 0.0.0.0/0.0.0.0 Set2 10.58.253.0/255.255.255.0 Set3Restrictions for Service Translation Prerequisites for Service Translation11-9 Configuration of Service Translation Configuration Example for Service TranslationEnables service translation and indicates to the router to use the Service DefinitionsExpansion of Service IDs Restrictions for Expansion of Service IDsConfiguration Example for Expansion of Service IDs 11-11Network Sets 11-12Monitoring and Maintaining SSG 12-1Command C H A P T E RTroubleshooting RADIUS Per-Service StatisticsRestrictions for Per-Service Statistics Removes the specified serviceMonitoring the Parallel Express Forwarding Engine Reference Guide12-3 Command12-4 Chapter 12 Monitoring and Maintaining SSGMonitoring the Parallel Express Forwarding Engine OL-4387-02SSG Configuration Example A P P E N D I X AExample A-1 Cisco 10000 Router SSG Configuration Appendix A SSG Configuration ExampleAppendix A SSG Configuration Example OL-4387-02Appendix A SSG Configuration Example OL-4387-02Appendix A SSG Configuration Example OL-4387-02Appendix A SSG Configuration Example exec-timeout 0 0 password labntp clock-period 17181406 ntp update-calendar OL-4387-02SSG Feature SSG Implementation NotesA P P E N D I X B Implementation NotesSSG Feature Implementation NotesAlso see the “Restrictions for SSG TCP Redirect” section on page SSG FeatureImplementation Notes Appendix B SSG Implementation Notes OL-4387-02G L O S S A R Y Digital Subscriber LineGL-1 GL-2 GL-3 GL-4 GL-5 GL-6 xDSLGlossary OL-4387-02I N D E See CEFIN-1 IN-2 idle timeoutIdle Timeout Attribute 28 3-4 inacl attributeSee PXF See PPPIN-3 See RBE IN-4AutoDomain Exclude Networks 6-8IN-5 See VPI IN-6VC G-5 VCI G-5 vendor-specific attributes definition G-5 virtual channel identifier See VCI virtual circuit See VCIN-7 VPI G-5 VPI/VCI implementation notes B-3 service profiles subscriberweb service selection 5-2 web sites accessing through Open Garden 6-5 VRF G-5 VSA definition G-5IN-8 IndexOL-4387-02