Table of Contents
Advertisement
SSG Implementation Notes
Table B-1
additional information about general SSG limitations, see the
"SSG Prerequisites" section on page
Table B-1
SSG Feature
ACLs and QoS
AutoDomain
L2TP
Logon
OL-4387-02
provides information about how SSG is implemented on the Cisco 10000 series router. For
1-6, and also see
SSG Implementation Notes for the Cisco 10000 Router
Implementation Notes
ACL and QoS are applied even if the traffic is to or from an Open Garden or the
default network (when port-bundle host key is not enabled).
Service ACLs cannot be applied to a connection. The connection will remain
active, but the ACLs will have no effect.
Modular QoS CLI (MQC) is not supported on SSG interfaces. If an MQC service
policy is configured on an SSG interface, SSG ignores the policy.
See the
"Restrictions for SSG Hierarchical Policing" section on page 8-2
additional implementation information.
You must enable Cisco Express Forwarding (CEF) before you enable SSG
functionality.
Passthrough services are available only for services that perform authentication
(for example, proxy or VPDN services). This is because AutoDomain bypasses
the local authentication that is performed at the network access server (NAS).
DHCP requests for IP address assignment must be done before RADIUS
negotiation.
If an Access-Request does not contain an IP address, you must configure a local
per-domain or global IP address pool.
"Virtual-user" profiles can contain only one AutoLogon service.
Not supported.
SSG attempts to set up the tunnel, but does not set up the VRF for tunnel services.
Therefore, traffic is not forwarded to the tunnel. The same applies to L2TP dialout.
A user cannot log on to services on different uplink interfaces. All services that
the user connects to must be on the same interface. This is because a user can
connect to only one VRF, and in SSG one VRF is used for each uplink interface.
To connect to a different service, the user has to logoff from the current service,
and log on to the other service.
Cisco 10000 Series Router Service Selection Gateway Configuration Guide
A P P E N D I X
"SSG Restrictions" section on page
Chapter 2, "Scalability and Performance."
B
1-4, the
for
B-1
Advertisement
Table of Contents
