Filter
Top Products
B-1
Cisco 10000 Series Router Service Selection Gateway Configuration Guide
OL-4387-02
APPENDIX
B
SSG Implementation Notes
Table B-1 provides information about how SSG is implemented on the Cisco 10000 series router. For
additional information about general SSG limitations, see the “SSG Restrictions” section on page 1-4, the
“SSG Prerequisites” section on page 1-6, and also see Chapter 2, “Scalability and Performance.”
Table B-1 SSG Implementation Notes for the Cisco 10000 Router
SSG Feature Implementation Notes
ACLs and QoS ACL and QoS are applied even if the traffic is to or from an Open Garden or the
default network (when port-bundle host key is not enabled).
Service ACLs cannot be applied to a connection. The connection will remain
active, but the ACLs will have no effect.
Modular QoS CLI (MQC) is not supported on SSG interfaces. If an MQC service
policy is configured on an SSG interface, SSG ignores the policy.
See the “Restrictions for SSG Hierarchical Policing” section on page 8-2 for
additional implementation information.
AutoDomain You must enable Cisco Express Forwarding (CEF) before you enable SSG
functionality.
Passthrough services are available only for services that perform authentication
(for example, proxy or VPDN services). This is because AutoDomain bypasses
the local authentication that is performed at the network access server (NAS).
DHCP requests for IP address assignment must be done before RADIUS
negotiation.
If an Access-Request does not contain an IP address, you must configure a local
per-domain or global IP address pool.
“Virtual-user” profiles can contain only one AutoLogon service.
L2TP Not supported.
SSG attempts to set up the tunnel, but does not set up the VRF for tunnel services.
Therefore, traffic is not forwarded to the tunnel. The same applies to L2TP dialout.
Logon A user cannot log on to services on different uplink interfaces. All services that
the user connects to must be on the same interface. This is because a user can
connect to only one VRF, and in SSG one VRF is used for each uplink interface.
To connect to a different service, the user has to logoff from the current service,
and log on to the other service.