-
Cisco IOS Wide-Area Networking Command Reference, Release 12.3
-
Introduction
-
Wide-Area Networking Commands: A through B
-
Wide-Area Networking Commands: C
-
Wide-Area Networking Commands: D through E
-
Wide-Area Networking Commands: forward through frame-relay lmi-type
-
Wide-Area Networking Commands: frame-relay local-dlci through fr-atm connect dlci
-
Wide-Area Networking Commands: I through L
-
Wide-Area Networking Commands: M through R
-
Wide-Area Networking Commands: scrambling through show dxi pvc
-
Wide-Area Networking Commands: show frame-relay through show vc-group
-
Wide-Area Networking Commands: show x25 through sscop send-window
-
Wide-Area Networking Commands: ssg through svc
-
Wide-Area Networking Commands: threshold through x25 nvc
-
Wide-Area Networking Commands: x25 ops through xot access-group
-
Table Of Contents
ssg port-map destination access-list
ssg port-map destination range
subscriber authorization enable
ssg accounting interval
To specify the interval at which Service Selection Gateway (SSG) sends accounting updates to the accounting server, use the ssg accounting interval command in global configuration mode. To disable the accounting interval, use the no form of this command.
ssg accounting interval seconds
no ssg accounting interval seconds
Syntax Description
Defaults
600 seconds
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to specify the interval at which accounting updates are sent to the accounting server.
Examples
The following example shows how to specify that SSG will send an accounting update to the accounting server every 60 seconds:
Router(config)# ssg accounting interval 60Related Commands
ssg accounting
To enable Service Selection Gateway (SSG) accounting, use the ssg accounting command in global configuration mode. To disable the SSG accounting, use the no form of this command.
ssg accounting
no ssg accounting
Syntax Description
This command has no arguments or keywords.
Defaults
Accounting is enabled by default.
Command Modes
Global configuration
Command History
Usage Guidelines
The ssg accounting command enables the sending of start, stop, and interim accounting records for hosts and connections.
Examples
The following example shows how to reenable SSG accounting if it has been disabled:
Router(config)# ssg accountingRelated Commands
ssg accounting interval
Specifies the interval at which accounting updates are sent to the accounting server.
ssg auto-domain
To enable Service Selection Gateway (SSG) Autodomain, use the ssg auto-domain command in global configuration mode. To remove all Autodomain configuration from the running configuration and to prevent further activation of autodomains, use the no form of this command.
ssg auto-domain
no ssg auto-domain
Syntax Description
This command has no arguments or keywords.
Defaults
Autodomain is disabled by default.
Command Modes
Global configuration
Command History
12.2(4)B
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
To enable SSG Autodomain, use this command in global configuration mode. SSG must be enabled before the ssg auto-domain command can be entered.
Note
The ssg auto-domain command enables basic Autodomain. In basic Autodomain, the profile downloaded from the AAA server for the Autodomain name is a service profile (either with or without SSG-specific attributes). By default, an attempt is made to find a valid service profile first based on Access Point Name (APN), then based on username. Use the mode extended command to configure Autodomain extended mode.
Use the no ssg auto-domain command to prevent further activations of autodomains and to remove all Autodomain configuration from the running-configuration. Subsequent reissuing of the ssg auto-domain command restores Autodomain to its former state.
Examples
The following example enables basic SSG Autodomain:
ssg enablessg auto-domainRelated Commands
ssg auto-logoff arp
To configure Service Selection Gateway (SSG) to automatically log off hosts that have lost connectivity with SSG and to use the Address Resolution Protocol (ARP) ping mechanism to detect connectivity, use the ssg auto-logoff arp command in global configuration mode. To disable SSG autologoff, use the no form of this command.
ssg auto-logoff arp [interval seconds]
no auto-logoff arp
Syntax Description
Defaults
SSG auto logoff is not enabled.
Default interval is 30 seconds.Command Modes
Global configuration
Command History
12.2(4)B
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
When the ssg auto-logoff arp command is configured, SSG will use the ARP ping mechanism to detect connectivity to hosts.
Note
ARP request packets are smaller than Internet Control Message Protocol (ICMP) ping packets, so it is recommended that you configure SSG auto logoff to use ARP ping in situation sin which hosts are directly connected.
ICMP ping can be used in all types of deployment situations. See the ssg auto-logoff icmp command page for more information about SSG auto logoff using ICMP ping.
ARP ping will work only on hosts that have a MAC address. So, for example, ARP ping will not work for PPP users because they do not have a MAC table entry.
ARP ping does not support overlapping IP addresses.
SSG autologoff that uses the ARP ping mechanism will not work for hosts with static ARP entries.
You can use only one method of SSG autologoff at a time: ARP ping or ICMP ping. If you configure SSG to use ARP ping after ICMP ping has been configured, the ICMP ping function will become disabled.
Examples
The following example shows how to enable SSG autologoff. SSG will use ARP ping to detect connectivity to hosts.
Router(config)# ssg auto-logoff arp interval 60Related Commands
ssg auto-logoff icmp
Configures the SSG to automatically log off hosts that have lost connectivity with SSG and to use the ICMP ping mechanism to detect connectivity.
ssg auto-logoff icmp
To configure Service Selection Gateway (SSG) to automatically log off hosts that have lost connectivity with SSG and to use the Internet Control Message Protocol (ICMP) ping mechanism to detect connectivity, use the ssg auto-logoff icmp command in global configuration mode. To disable SSG autologoff, use the no form of this command.
ssg auto-logoff icmp [timeout milliseconds] [packets number] [interval seconds]
no auto-logoff icmp
Syntax Description
Defaults
SSG autologoff is not enabled.
Interval: 30 seconds
Timeout: 500 milliseconds
Number of packets: 2 packetsCommand Modes
Global configuration
Command History
12.2(4)B
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
When the ssg auto-logoff icmp command is specified, SSG will use the ICMP ping mechanism to detect connectivity to hosts.
Note
ICMP ping supports overlapping IP addresses.
If a user is not reachable, a configured number of packets (p) will be sent, and each packet will be timed out (t). The user will be logged off in p * t milliseconds after the first pinging attempt. If p * t milliseconds is greater than the configured pinging interval, then the time taken to log off the host after connectivity is lost will be greater than the configured autologoff interval. If parameters are configured this way, the following warning will be issued: "Hosts will be auto-logged off (p * t) msecs after connectivity is lost." When the pinging interval is less than p * t, the timeout process for a host that has become unreachable will be invoked when the pinging to that host is still occurring. However, because the timeout process will check the status of the host object and find that it is in a pinging state, the host will not be pinged again.
You can use only one method of SSG autologoff at a time: Address Resolution Protocol (ARP) ping or ICMP ping. If you configure SSG to use ARP ping after ICMP ping has been configured, the ICMP ping function will become disabled.
Default values will be applied if a value of zero is configured for any parameters.
The ssg auto-logoff arp command will configure SSG to use the ARP ping mechanism to detect connectivity to hosts. ARP ping should be used only in deployment situations in which all hosts are directly connected to the SSG through a broadcast interface such as an Ethernet interface or a bridged interface such as a routed bridge encapsulation or an integrated routing and bridging interface.
ARP request packets are smaller than ICMP ping packets, so it is recommended that you configure SSG autologoff to use ARP ping in situations in which hosts are directly connected. For more information about SSG autologoff that uses ARP ping, see the ssg auto-logoff arp command reference page.
Examples
The following example shows how to enable SSG autologoff. SSG will use ICMP ping to detect connectivity to hosts.
Router(config)# ssg auto-logoff icmp interval 60 timeout 300 packets 3Related Commands
ssg auto-logoff arp
Configures the SSG to automatically log off hosts that have lost connectivity with SSG and to use the ARP ping mechanism to detect connectivity.
ssg bind direction
To specify an interface as a downlink or uplink interface, use the ssg bind direction command in global configuration mode. To disable the directional specification for the interface, use the no form of this command.
ssg bind direction {downlink | uplink} {ATM atm-interface | Async async-interface | BVI bvi-interface | Dialer dialer-interface | Ethernet ethernet-interface | FastEthernet fastethernet-interface | Group-Async group-async-interface | Lex lex-interface | Loopback loopback-interface | Multilink multilink-interface | Null null-interface | Port-channel port-channel-interface | Tunnel tunnel-interface | Virtual-Access virtual-access-interface | Virtual-Template virtual-template-interface | Virtual-TokenRing virtual-tokenring-interface}
no ssg bind direction {downlink | uplink} {ATM atm-interface | Async async-interface | BVI bvi-interface | Dialer dialer-interface | Ethernet ethernet-interface | FastEthernet fastethernet-interface | Group-Async group-async-interface | Lex lex-interface | Loopback loopback-interface | Multilink multilink-interface | Null null-interface | Port-channel port-channel-interface | Tunnel tunnel-interface | Virtual-Access virtual-access-interface | Virtual-Template virtual-template-interface | Virtual-TokenRing virtual-tokenring-interface}
Syntax Description
Defaults
All interfaces are configured as uplink interfaces by default.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to specify an interface as downlink or uplink. An uplink interface is an interface to services; a downlink interface is an interface to subscribers.
Examples
The following example shows how to specify an ATM interface as a downlink interface:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg bind direction downlink ATM 0/0/0.10Related Commands
show ssg binding
Displays service names that have been bound to interfaces and the interfaces to which they have been bound.
ssg bind service
To specify the interface for a service, use the ssg bind service command in global configuration mode. To unbind the service and the interface, use the no form of this command.
ssg bind service service-name {ip-address | ATM atm-interface | Async async-interface | BVI bvi-interface | Dialer dialer-interface | Ethernet ethernet-interface | FastEthernet fastethernet-interface | Group-Async group-async-interface | Lex lex-interface | Loopback loopback-interface | Multilink multilink-interface | Null null-interface | Port-channel port-channel-interface | Tunnel tunnel-interface | Virtual-Access virtual-access-interface | Virtual-Template virtual-template-interface | Virtual-TokenRing virtual-tokenring-interface}
no ssg bind service service-name {ip-address | ATM atm-interface | Async async-interface | BVI bvi-interface | Dialer dialer-interface | Ethernet ethernet-interface | FastEthernet fastethernet-interface | Group-Async group-async-interface | Lex lex-interface | Loopback loopback-interface | Multilink multilink-interface | Null null-interface | Port-channel port-channel-interface | Tunnel tunnel-interface | Virtual-Access virtual-access-interface | Virtual-Template virtual-template-interface | Virtual-TokenRing virtual-tokenring-interface}
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to bind a service to an interface.
Examples
The following example shows the interface for the service defined as "MyService":
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg bind service MyService ATM 0/0/0.10Related Commands
ssg default-network
To specify the default network IP address or subnet and mask, use the ssg default-network command in global configuration mode. To disable the default network IP address and mask, use the no form of this command.
ssg default-network ip-address mask
no ssg default-network ip-address mask
Syntax Description
ip-address
Service Selection Gateway (SSG) default IP address or subnet.
mask
SSG default network destination mask.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to specify the first IP address or subnet that users will be able to access without authentication. This is the address where the Cisco Service Selection Dashboard (SSD) resides. After users enter the URL for the Cisco SSD, they will be prompted for a username and password. A mask provided with the IP address specifies the range of IP addresses that users will be able to access without authentication.
Examples
The following example shows a default network IP address, 192.168.1.2, and mask 255.255.255.255:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg default-network 192.168.1.2 255.255.255.255ssg enable
To enable Service Selection Gateway (SSG), use the ssg enable command in global configuration mode. To disable SSG, use the no form of this command.
ssg enable
no ssg enable
Syntax Description
This command has no arguments or keywords.
Defaults
SSG is disabled.
Command Modes
Global configuration
Command History
Examples
The following example shows how to enable SSG:
Router(config)# ssg enablessg local-forwarding
To enable Service Selection Gateway (SSG) to forward packets locally, use the ssg local-forwarding command in global configuration mode. To disable local forwarding, use the no form of this command.
ssg local-forwarding
no ssg local-forwarding
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled
Command Modes
Global configuration
Command History
Examples
The following example enables local forwarding:
Router(config)# ssg local-forwardingssg maxservice
To set the maximum number of services per user, use the ssg maxservice command in global configuration mode. To reset the maximum number of services per user to the default, use the no form of this command.
ssg maxservice number
no ssg maxservice
Syntax Description
Defaults
The default maximum number of services per user is 20.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to limit the number of services to which a user can be logged on simultaneously.
Examples
The following example shows how to set the maximum number of services per user to 10:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg maxservice 10ssg next-hop download
To download the next-hop table from a RADIUS server, use the ssg next-hop download command in global configuration mode. To remove the command from the configuration, use the no form of this command.
ssg next-hop download [profile-name] [profile-password]
no ssg next-hop download [profile-name] [profile-password]
Syntax Description
Defaults
If no profile name and password are provided, the previous profile specified with this command is downloaded. If no previous profile was specified, an error message is generated.
Command Modes
Global configuration
Command History
Usage Guidelines
When this command is used, an entry is made in the running configuration. When the configuration is reloaded, the next-hop table is automatically downloaded. If the no form of this command is used to remove the command from the running configuration, a next-hop table will not be automatically downloaded when the configuration is reloaded.
Examples
The following example shows how to download the next-hop table called "MyProfile" from a RADIUS server:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg next-hop download MyProfile MyProfilePasswordRelated Commands
clear ssg next-hop
Removes the next-hop table.
show ssg next-hop
Displays the next-hop table.
ssg open-garden
To designate a service as an open garden service, use the ssg open-garden command in global configuration mode. To remove a service from the open garden, use the no form of this command.
ssg open-garden profile-name
no ssg open-garden profile-name
Syntax Description
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to designate a service, defined in a local service profile, as an open garden service.
Examples
In the following example, the service called "fictitiousname.com" is defined in a local service profile and added to the open garden:
Router(config)# local-profile cisco.comRouter(config-prof)# attribute 26 9 251 "Oopengarden1.com"Router(config-prof)# attribute 26 9 251 "D10.13.1.5"Router(config-prof)# attribute 26 9 251 "R10.1.1.0;255.255.255.0"Router(config-prof)# exitRouter(config)# ssg open-garden fictitiousname.comRelated Commands
ssg pass-through
To enable transparent pass-through, use the ssg pass-through command in global configuration mode. To disable transparent pass-through, use the no form of this command
ssg pass-through [filter {ip-access-list | ip-extended-access-list | access-list-name | download [profile-name | profile-name profile-password]} [downlink | uplink]}]
no ssg pass-through [filter {ip-access-list | ip-extended-access-list | access-list-name | download [profile-name | profile-name profile-password]} [downlink | uplink]}]
Syntax Description
Defaults
Transparent pass-through is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to enable transparent pass-through if you want to allow unauthenticated traffic to pass through the Service Selection Gateway (SSG) in either direction without modification. If you want all traffic to be authenticated by the SSG, use this command to disable transparent pass-through. You can use the filter option to prevent pass through traffic from accessing the specified IP address and subnet mask combinations.
Use the no form of this command to remove a transparent pass-through filter that was configured at the command line. This will also remove it from the running configuration.
Examples
The following example shows how to enable SSG transparent pass-through and download a pass-through filter from the AAA server called "filter01":
Router# configure terminalEnter configuration commands, one per line. End with CNTL/ZRouter(config)# ssg pass-throughRouter(config)# ssg pass-through filter download filter01 ciscoRadius reply received:Created Upstream acl from it.Loading default pass-through filter succeeded.Related Commands
clear ssg pass-through-filter
Removes the downloaded filter for transparent pass-through.
show ssg pass-through-filter
Displays the downloaded filter for transparent pass-through.
ssg port-map destination access-list
To identify packets for port-mapping by specifying an access list to compare against the subscriber traffic, use the ssg port-map destination access-list command in global configuration mode. To remove this specification, use the no form of this command.
ssg port-map destination access list access-list-number
no ssg port-map destination access list access-list-number
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
When the ssg port-map destination access list command is configured, any traffic going to the default network and matching the access list will be port-mapped.
Note
You can use multiple entries of the ssg port-map destination access-list command. The access lists are checked against the subscriber traffic in the order in which they are defined.
Examples
In the following example, packets permitted by access list 100 will be port-mapped:
ssg port-map enablessg port-map destination access-list 100ssg port-map source ip Ethernet0/0/0!...!access-list 100 permit ip 10.0.0.0 0.255.255.255 host 10.13.6.100access-list 100 deny ip any anyRelated Commands
ssg port-map destination range
Identifies packets for port-mapping by specifying the TCP port range to compare against the subscriber traffic.
ssg port-map destination range
To identify packets for port-mapping by specifying the TCP port range to compare against the subscriber traffic, use the ssg port-map destination range command in global configuration mode. To remove this specification, use the no form of this command.
ssg port-map destination range from port-number-1 to port-number-2 [ip ip-address]
no ssg port-map destination range from port-number-1 to port-number-2 [ip ip-address]
Syntax Description
Defaults
If an IP address is not specified, Service Selection Gateway (SSG) will allow any destination IP address in the subscriber traffic to be port-mapped, as long as the packets match the specified port ranges.
Command Modes
Global configuration
Command History
Usage Guidelines
If the destination IP address is not configured, a default network must be configured and routable from SSG in order for this command to be effective.
If the destination IP address is not configured, any traffic going to the default network with the destination port will fall into the destination port range and will be port-mapped.
You can use multiple entries of the ssg port-map destination range command. The port ranges are checked against the subscriber traffic in the order in which they were defined.
Examples
In the following example, packets that are going to the default network and have a destination port within the range 8080 to 8081 will be port-mapped:
Router(config)# ssg port-map destination range from 8080 to 8081Related Commands
ssg port-map destination access-list
Identifies packets for port-mapping by specifying an access list to compare against the subscriber traffic.
ssg port-map enable
To enable the Service Selection Gateway (SSG) port-bundle host key, use the ssg port-map enable command in global configuration mode. To disable the SSG port-bundle host key, use the no form of this command.
ssg port-map enable
no ssg port-map enable
Syntax Description
This command has no arguments or keywords.
Defaults
SSG port-bundle host key is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
This command will not take effect until the router has been reloaded.
The SSG Port-Bundle Host Key feature requires Cisco Service Selection Dashboard (SSD) Release 3.0(1) or Cisco Subscriber Edge Services Manager (SESM) Release 3.1(1). If you are using an earlier release of SSD, use the no ssg port-map enable command to disable the SSG Port-Bundle Host Key feature.
Examples
The following example shows how to enable the SSG port-bundle host key:
Router(config)# ssg port-map enableRelated Commands
ssg port-map length
To modify the port-bundle length upon the next Service Selection Gateway (SSG) reload, use the ssg port-map length command in global configuration mode. To return the port-bundle length to the default value, use the no form of this command.
ssg port-map length bits
no ssg port-map length bits
Syntax Description
Defaults
4 bits
Command Modes
Global configuration
Command History
Usage Guidelines
The port-bundle length is used to determine the number of bundles in one group and the number of ports in one bundle. By default, the port-bundle length is 4 bits. The maximum port-bundle length is 10 bits. See Table 66 for available port-bundle length values and the resulting port-per-bundle and bundle-per-group values. Increasing the port-bundle length can be useful when you see frequent error messages about running out of ports in a port bundle, but note that the new value does not take effect until SSG next reloads and Cisco Service Selection Dashboard (SSD) restarts.
Note
Examples
The following example results in 64 ports per bundle and 1008 bundles per group:
Router(config)# ssg port-map length 6Related Commands
show ssg port-map status
Displays information on port bundles, including the port-bundle length.
ssg port-map source ip
To specify Service Selection Gateway (SSG) source IP addresses to which to map the destination IP addresses in subscriber traffic, use the ssg port-map source ip command in global configuration mode. To remove this specification, use the no form of this command.
ssg port-map source ip {ip-address | interface}
no ssg port-map source ip {ip-address | interface}
Syntax Description
ip-address
SSG source IP address.
interface
Interface whose main IP address is used as the SSG source IP address.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
With the SSG Port-Bundle Host Key feature, SSG maps the destination IP addresses in subscriber traffic to specified SSG source IP addresses.
All SSG source IP addresses configured with the ssg port-map source ip command must be routable in the management network where the Cisco SSD resides.
If the interface for the source IP address is deleted, the port-map translations will not work correctly.
Because a subscriber can have several simultaneous TCP sessions when accessing a web page, SSG assigns a bundle of ports to each subscriber. Because the number of available port bundles is limited, you can assign multiple SSG source IP addresses (one for each group of port bundles). By default, each group has 4032 bundles, and each bundle has 16 ports. To modify the number of bundles per group and the number of ports per bundle, use the ssg port-map length global configuration command.
Examples
The following example shows the SSG source specified with an IP address and with specific interfaces:
Router(config)# ssg port-map source ip 10.0.50.1Router(config)# ssg port-map source ip Ethernet 0/0/0Router(config)# ssg port-map source ip Loopback 1Related Commands
ssg profile-cache
To enable caching of user profiles for non-PPP users, use the ssg profile-cache command in global configuration mode. To disable caching of user profiles, use the no form of this command.
ssg profile-cache
no ssg profile-cache
Syntax Description
This command has no arguments or keywords.
Defaults
User-profile caching is not enabled.
Command Modes
Global configuration
Command History
12.2(2)B
This command was introduced.
12.2(4)B
This command was integrated into Cisco IOS Release 12.2(4)B.
12.2(8)T
This command was integrated into Cisco IOS Release 12.2(8)T.
Usage Guidelines
The ssg profile-cache command allows Service Selection Gateway (SSG) to cache the user profiles of non-PPP users. User profiles of PPP and RADIUS proxy users are always cached by SSG by default. In situations in which the user profile is not available from other sources, SSG user-profile caching makes the user profile available for RADIUS status queries, providing support for single-sign-on functionality and for failover from one Subscriber Edge Services Manager (SESM) to another.
In order for a user profile to be cached, the ssg profile-cache command must be configured before account login occurs. Once the user authentication has been done (as part of the account login), the host object is created, and the user profile is cached.
Note
Examples
The following example shows how to enable user-profile caching:
Router(config)# ssg profile-cachessg qos police
To enable the limiting transmission rates for an Service Selection Gateway (SSG) subscriber or for a service being used by an SSG subscriber, use the ssg qos police command in global configuration mode. To disable the limiting of transmission rates, use the no form of this command.
ssg qos police [user | session]
no ssg qos police [user | session]
Syntax Description
Defaults
Traffic is forwarded with no SSG policing restrictions if the ssg qos police command is disabled.
Command Modes
Global configuration
Command History
12.2(4)B
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
This command enables the SSG Hierarchical Policing feature, which is used to limit the output transmission rate for a subscriber or for a specific SSG service used by a subscriber. The parameters used to police traffic (committed rate, normal burst, and excess burst) are configured in a RADIUS user profile (per-user policing) or a RADIUS service profile (per-session policing) by using the Q option.
Examples
The following is an example of a user profile with the SSG Hierarchical Policing enabled for downstream traffic. In this example, an excess burst size is set at 0 so all dropped packets are tail-dropped. In this particular profile, only downstream traffic is policed (although it is important to note that an upstream token bucket algorithm would operate identically to the downstream policing algorithm).
user = johndoe radius = 7200-SSG-v1.1 check_items= { 2 = cisco}reply_attributes={ 9,250="Nproxy_ser" 9,250="Ntunnel_ser" 9,250="QD8000;2000;0"Per-user policing must be enabled on the router before the traffic directed to the subscriber is policed. Per-user policing is enabled on the router by entering the following global configuration command:
Router(config)# ssg qos police user
Note
The token bucket starts at 1000 tokens. Although the committed rate is specified in bits per seconds, the token bucket operates based on bytes. 8000 bits is equal to 1000 bytes, so a full token bucket has 1000 tokens. The normal burst parameter is set at 2000. For the sake of the example, no actual debt has been accrued before the arrival of the first packet.
•
–
–
–
–
–
Because tokens are greater than the actual debt, the user has been idle for a sufficient amount of time and the packet is transmitted.
•
–
–
–
–
–
–
–
–
•
–
–
–
–
–
–
–
Future packets will be policed similarly on the basis of this algorithm.
Related Commands
ssg radius-helper
To enable communications with the Cisco Service Selection Dashboard (SSD) and specify port numbers and secret keys for receiving packets, use the ssg radius-helper command in global configuration mode. To disable communications with the Cisco SSD, use the no form of this command.
ssg radius-helper [acct-port port-number | auth-port port-number | key key]
no ssg radius-helper [acct-port port-number | auth-port port-number | key key]
Syntax Description
acct-port port-number
(Optional) UDP1 destination port for RADIUS accounting requests; the host is not used for accounting if set to 0. The default is 1646.
auth-port port-number
(Optional) UDP destination port for RADIUS authentication requests; the host is not used for authentication if set to 0. The default is 1645.
key key
(Optional) Key shared with the RADIUS clients
1 UDP = User Datagram Protocol
Defaults
The default port number for acct-port is 1646.
The default port number for auth-port is 1645.Command Modes
Global configuration
Command History
Usage Guidelines
You must use this command to specify a key so that SSG can communicate with the Cisco SSD.
Examples
The following example shows how to enable communication with the Cisco SSD:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg radius-helper acct-port 1646 auth-port 1645Router(config)# ssg radius-helper key MyKeyssg radius-proxy
To enable SSG RADIUS Proxy, use the ssg radius-proxy command in global configuration mode. To prevent further connection of proxy users, use the no form of this command
ssg radius-proxy
no ssg radius-proxy
Syntax Description
This command has no arguments or keywords.
Defaults
SSG RADIUS Proxy is not enabled by default.
Command Modes
Global configuration
Command History
12.2(4)B
This command was introduced.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
Use this command to enable SSG RADIUS Proxy.
This command also enables SSG-radius-proxy configuration mode. You must enable SSG with the ssg enable command before you can enter the ssg radius-proxy command. If you do not enter the ssg radius-proxy command, SSG continues to proxy RADIUS packets containing SSG vendor-specific attributes (VSAs) received from the Service Selection Dashboard (SSD), but does not act as a generic RADIUS proxy.
The no ssg radius-proxy command does not log off RADIUS client hosts that are already logged in.
If you configure the no ssg radius-proxy command, no further connections of proxy users are allowed, but hosts from already configured RADIUS clients remain connected. If you subsequently configure the ssg radius-proxy command, the previous RADIUS proxy configuration is restored.
Examples
The following example enables SSG RADIUS Proxy:
ssg enablessg radius-proxyRelated Commands
ssg service-password
To specify the password for downloading a service profile, use the ssg service-password command in global configuration mode. To disable the password, use the no form of this command.
ssg service-password password
no ssg service-password password
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
This command sets the password required to authenticate with the authentication, authorization, and accounting (AAA) server and download a service profile.
Examples
The following example shows how to set the password for downloading a service profile:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg service-password MyPasswordssg service-search-order
To specify the order in which Service Selection Gateway (SSG) searches for a service profile, use the ssg service-search-order command in global configuration mode. To disable the search order, use the no form of this command.
ssg service-search-order {local | remote | local remote | remote local}
no ssg service-search-order {local | remote | local remote | remote local}
Syntax Description
Defaults
The default search order is remote; that is, SSG searches for service profiles on the RADIUS server.
Command Modes
Global configuration
Command History
Usage Guidelines
SSG can search for service profiles in local Flash memory, on a remote RADIUS server, or both. The possible search orders are:
•
•
•
•
Examples
The following example shows how to set the search order to local remote, so that SSG will always look for service in Flash memory first, then on the RADIUS server:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg service-search-order local remoteRelated Commands
ssg tcp-redirect
To enable SSG TCP redirection and SSG-redirect mode, use the ssg tcp-redirect command in global configuration mode. To disable SSG TCP redirection, use the no form of this command.
ssg tcp-redirect
no ssg tcp-redirect
Syntax Description
SSG TCP redirect is not enabled.
Defaults
This command has no default behavior.
Command Modes
Global configuration
Command History
12.2(4)B
This command was introduced. This command replaces the ssg http-redirect group command.
12.2(13)T
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
Use this command to enable SSG TCP redirection. This command also enables SSG-redirect mode. The no ssg tcp-redirect command disables SSG TCP Redirect and removes all configurations created in the SSG-redirect mode. You must enable SSG by issuing the ssg enable command before you can configure SSG TCP redirect.
Examples
The following example shows how to select a captive portal group for redirection of traffic from unauthorized users. In the following example, traffic from unauthorized users is redirected to the captive portal group named "RedirectServer":
ssg enablessg tcp-redirectredirect unauthenticated-user to RedirectServerThe following example shows how to define a port list named "WebPorts" and adds TCP ports 80 and 8080 to the port list. Port 8080 is configured to be redirected by the captive portal group named "Redirect Server":
ssg enablessg tcp-redirectport-list WebPortsport 80port 8080exitredirect port 8080 to RedirectServerRelated Commands
ssg vc-service-map
To map virtual circuits (VCs) to service names, use the ssg vc-service-map command in global configuration mode. To disable VC-to-service-name mapping, use the no form of this command.
ssg vc-service-map service-name [interface interface-number] start-vpi | start-vpi/vci [end-vpi | end-vpi/vci] exclusive | non-exclusive
no ssg vc-service-map service-name [interface slot-module-port] start-vpi | start-vpi/vci [end-vpi | end-vpi/vci] exclusive | non-exclusive
Syntax Description
Defaults
The service mapping is non-exclusive by default.
Command Modes
Global configuration
Command History
Usage Guidelines
Use this command to map VCs to service names. If you specify a VC-to-service-name mapping as exclusive, specifying a username will log you in to the mapped service. However, specifying username@service will not log you in. If you specify a mapping as nonexclusive, specifying a username will log you in to the mapped service. However, username@service1 will log you in to service1.
Examples
The following example shows how to map all users coming into SSG on VPI/VCI 3/33 to the service "Worldwide" exclusively:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ssg vc-service-map Worldwide 3/33 exclusiveRelated Commands
subscriber access
To configure a network access server (NAS) to enable Subscriber Service Switch (SSS) to preauthorize the NAS port identifier (NAS-Port-ID) string before authorizing the domain name, use the subscriber access command in global configuration mode. To disable SSS preauthorization, use the no form of this command.
subscriber access {pppoe | pppoa} pre-authorize nas-port-id [default | list-name] [send username]
no subscriber access {pppoe | pppoa} pre-authorize nas-port-id
Syntax Description
Defaults
Preauthorization is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
The NAS-Port-ID string is used to locate the first service record, which may contain one of three attributes, as follows:
•
This filtered service key then locates the final service. See the vpdn authorize domain command for more information.
•
•
Once NAS port authorization has taken place, normal authorization, which is usually the domain authorization, continues.
Logical Line ID
The LLID is an alphanumeric string of from 1 to 253 characters that serves as the logical identification of a subscriber line. LLID is maintained in a RADIUS server customer profile database and enables users to track their customers on the basis of the physical lines on which customer calls originate. Downloading the LLID is also referred to as "preauthorization" because it occurs before normal virtual private dialup network (VPDN) authorization downloads L2TP tunnel information.
This command enables LLID and SSS querying only for PPP over Ethernet over ATM (PPPoEoATM) and PPP over Ethernet over VLAN (PPPoEoVLAN or Dot1Q) calls; all other calls, such as ISDN, are not supported.
Per-NAS-Port Session Limits for PPPoE
Use this command to configure SSS preauthorization on the LAC so that the PPPoE per-NAS-port session limit can be downloaded from the customer profile database. To use PPPoE per-NAS-port session limits, you must also configure the PPPoE Session-Limit per NAS-Port Cisco attribute-value pair in the user profile.
Examples
The following example signals SSS to preauthorize the NAS-Port-ID string before authorizing the domain name. This policy applies only to sessions that have a PPPoE access type.
aaa new-modelaaa group server radius sg_llidserver 172.20.164.106 auth-port 1645 acct-port 1646aaa group server radius sg_groupserver 172.20.164.106 auth-port 1645 acct-port 1646aaa authentication ppp default group radiusaaa authorization confg-commandsaaa authorization network default group sg_groupaaa authorization network mlist_llid group sg_llidaaa session-id common!username s7200_2 password 0 labusername s5300 password 0 labusername sg_group password 0 labvpdn enable!vpdn-group 2request-dialinprotocol 12tpdomain group.cominitiate-to ip 10.1.1.1local name s7200_2!vpdn-group 3accept dialinprotocol pppoevirtual-template 1!! Signals Subscriber Service Switch to preauthorize the NAS-Port-ID string before! authorizing the domain name.subscriber access pppoe pre-authorize nas-port-id mlist_llid!interface Loopback0ip address 10.1.1.2 255.255.255.0!interface Loopback1ip address 10.1.1.1 255.255.255.0!interface Ethernet1/0ip address 10.2.2.2 255.255.255.0 secondaryip address 10.0.58.111 255.255.255.0no cdp enable!interface ATM4/0no ip addressno atm ilmi-keepalive!interface ATM4/0.1 point-to-pointpvc 1/100encapsulation aa15snapprotocol pppoe!interface virtual-template1no ip unnumbered Loopback0no peer default ip addressppp authentication chap!radius-server host 172.20.164.120 auth-port 1645 acct-port 1646 key rad123radius-server host 172.20.164.106 auth-port 1645 acct-port 1646 key rad123ip radius source-interface Loopback1The following example is identical to the previous example except that it also adds support for sending the PPP authenticating username with the preauthorization in the Connect-Info attribute. This example also includes command line interface (CLI) suppression on the LLID if the username that is used to authenticate has a domain that includes #184.
aaa new-modelaaa group server radius sg_llidserver 172.31.164.106 auth-port 1645 acct-port 1646aaa group server radius sg_groupserver 172.31.164.106 auth-port 1645 acct-port 1646aaa authentication ppp default group radiusaaa authorization confg-commandsaaa authorization network default group sg_groupaaa authorization network mlist_llid group sg_llidaaa session-id common!username s7200_2 password 0 labusername s5300 password 0 labusername sg_group password 0 labvpdn enable!vpdn-group 2request-dialinprotocol 12tpdomain group.comdomain group.com#184initiate-to ip 10.1.1.1local name s7200_2l2tp attribute clid mask-method right * 255 match #184!vpdn-group 3accept dialinprocotol pppoevirtual-template 1!subscriber access pppoe pre-authorize nas-port-id mlist_llid send username!Related Commands
subscriber authorization enable
To enable Subscriber Service Switch type authorization, use the subscriber authorization enable command in global configuration mode. To disable the Subscriber Service Switch authorization, use the no form of this command.
subscriber authorization enable
no subscriber authorization enable
Syntax Description
This command has no arguments or keywords.
Defaults
Authorization is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
The subscriber authorization enable command triggers Subscriber Service Switch type authorization for local termination, even if virtual private dialup network (VPDN) and Stack Group Bidding Protocol (SGBP) are disabled.
Examples
The following example enables Subscriber Service Switch type authorization:
subscriber authorization enableRelated Commands
subscriber access
Enables Subscriber Service Switch preauthorization.
vpdn authorize domain
Enables domain preauthorization on a NAS.
svc
To create an ATM switched virtual circuit (SVC) and specify the destination network service access point (NSAP) address on a main interface or subinterface, use the svc interface configuration command. To disable the SVC, use the no form of this command.
svc [name] [nsap address] [ces]
no svc [name] [nsap address] [ces]
Syntax Description
Defaults
No NSAP address is defined.
Command Modes
Interface configuration
Command History
Usage Guidelines
After configuring the parameters for an ATM SVC, you must exit the interface-ATM-VC or interface-CES-VC configuration mode in order to enable the SVC settings.
Once you specify a name for an SVC, you can reenter the interface-ATM-VC or interface-CES-VC configuration mode by simply entering svc name.
You can remove an NSAP address and any associated parameters by entering no svc name or no svc nsap address.
Creating an SVC without a specific NSAP address will allow a router to accept calls from any ATM address, and allow multiple VCs to be set up using the same configuration.
Use the ces keyword to configure an active or passive CES SVC. An active CES SVC can originate and terminate SVC calls. A passive CES SVC can only terminate calls.
Note
Examples
SVC Example
The following example creates an SVC called "chicago" on ATM interface 2/0/0:
interface atm 2/0/0svc chicagoSVC with NSAP Address Example
The following example creates an SVC with the name "lion" and specifies the 40-digit hexadecimal destination ATM NSAP address:
svc lion nsap 47.0091.81.000000.0040.0B0A.2501.ABC1.3333.3333.05Active CES SVC Example
The following example creates an active CES SVC named "ces1":
interface atm 1/0svc ces1 nsap 47.00.00.000000.0040.0B0A.2501.ABC1.01.01.00 cesPassive CES SVC Example
The following example creates a passive CES SVC named "ces2":
interface atm 1/0svc ces2 ces
