Access Side Interfaces - Cisco OL-4387-02 Configuration Manual

Transparent Passthrough

Access Side Interfaces

For access side interfaces, the interface type determines the method used to indicate an interface as SSG
or transparent passthrough. If you enable SSG globally, SSG automatically configures PPP users as SSG
downlink users. To configure a PPP user as a transparent passthrough user, configure the Cisco 10000
router in one of the following ways:
•
•
•
To configure a non-PPP user as an SSG user, bind the interface as downlink or uplink by using the
ssg direction command in subinterface configuration mode. The command syntax is:
ssg direction {uplink | downlink}
For example:
Router(config)# interface atm 5/0/1.15
Router(config-subif)# ssg direction downlink
Router(config-subif)# interface atm 5/0/1.16
Router(config-subif)# ssg direction uplink
The ssg direction command also applies to range commands.
Note
When you bind an interface to a direction, traffic is routed through SSG features and processing. If you
do not bind an interface to a direction, the interface is a transparent passthrough interface and traffic is
routed through normal Cisco IOS features processing.
Cisco 10000 Series Router Service Selection Gateway Configuration Guide
9-2
Do not enable SSG globally on the router. If SSG is not globally enabled, traffic is routed through
normal Cisco IOS processing.
Configure the router as a LAC. The LAC uses L2TP to directly tunnel PPP traffic to the LNS. The
LAC does not terminate the PPP traffic; it uses normal Cisco IOS processing to forward the traffic.
The LAC uses the following mechanisms to determine that a session should be LAC switched:
The VPI/VCI can be configured with a specific domain. Using a conventional Cisco IOS
–
configuration, the domain indicates how to LAC switch the session.
If no domain information is configured specifically on the VC, RADIUS authentication is
–
attempted. If the RADIUS server does not return any SSG vendor specific attributes (VSAs),
then normal Cisco IOS processing occurs.
– If the user signals a domain, but that domain is part of a PTA-MD exclusion list, the session is
processed by the VPDN software.
– A specific domain can be installed on the VPI/VCI by using the VPI/VCI Index to a Service
Profile feature. This domain must be on the PTA-MD exclusion list.
Configure the router as an LNS. The LNS terminates the PPP traffic on the LNS side of the tunnel
and uses normal Cisco IOS processing to forward the traffic. This configuration requires that you
use a PTA-MD exclusion list.
Chapter 9 Interface Configuration
OL-4387-02