Cisco 10000 Series Internet Router Service Selection Gateway Configuration Guide - Service Selection Gateway Overview [Cisco 10000 Series Routers]

Table Of Contents

Service Selection Gateway Overview

Service Selection Gateway

Default Network

Access Protocols

Supported SSG Features

SSG Restrictions

SSG Prerequisites

SSG Architecture Model

Service Selection Gateway Overview

The Service Selection Gateway feature, available in Cisco IOS Release 12.2(16)BX or later, offers a switching solution to service providers. Working in conjunction with the Cisco Subscriber Edge Services Manager (SESM), SSG provides subscriber authentication, service selection, and service connection capabilities to subscribers of Internet services. Subscribers interact with the SESM web application using a standard Internet browser.

This chapter provides an overview of the Service Selection Gateway feature available on the Cisco 10000 series router.

Service Selection Gateway

The Cisco 10000 series router supports the Service Selection Gateway (SSG) feature in Cisco IOS Release 12.2(16)BX or later. SSG is a switching solution for service providers who offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as digital subscriber lines (DSL) lines, cable modems, or wireless to allow simultaneous access to network services. SSG provides connectivity to corporate networks and differential service selection to users with access to multiple simultaneous services. Users can dynamically connect to and disconnect from any of the services available to them.

Figure 1-1 shows an example of an SSG topology. In the figure, a single user connects to the Cisco 10000 series router using an access protocol such as PPP, RBE, or IP. SSG resides in the router that serves as a broadband aggregator. The router acts as a central control point for Layer 2 and Layer 3 services, including services available through ATM virtual circuits (VCs), virtual private dial-up networks (VPDNs), and normal routing methods. The user can concurrently connect to a number of different services, which can be private or public services. Connections to the services are established using IP.

Figure 1-1 SSG Topology Example

Note The Cisco 10000 series router does not support tunneling of SSG users.

The Cisco 10000 series router adds the Open Garden and default networks to all SSG VRFs, providing reachability information to the Open Garden and default networks for all services both public and private. However, access is restricted for the following conditions:

•If the Open Garden and default network addresses overlap within the service definition, the traffic destined for either network is subject to the rules of the default network.

•If the Open Garden network is bound to a specific interface and a VRF is also applied to the interface, the Open Garden network is accessible to users whose sessions are established using the applied VRF.

The SSG feature communicates with the authentication, authorization, and accounting (AAA) management network that includes RADIUS and Dynamic Host Configuration Protocol (DHCP) servers. SSG connects to the service provider network, which can connect to the Internet service provider (ISP) network and corporate networks.

The Cisco 10000 series router supports the Cisco Subscriber Edge Services Manager (SESM), which provides subscriber authentication, service selection, and service connection capabilities to subscribers of Internet services. Subscribers interact with the SESM web application using a standard Internet browser. The SESM functionality provides a flexible and convenient graphical user interface (GUI) for subscribers and enables service providers to bill subscribers for connection time and services used, rather than charging a flat rate.

Default Network

The default network is a location that SSG allows unauthenticated users to access. The default network is a single IP address or subnet, typically the IP address of the SESM application although other types of servers can also be defined as the default network. The default network supports the port-bundle host key.

The default network enables special processing of traffic to and from the default network. Because traffic to and from SESM requires special processing and the Cisco 10000 series router cannot distinguish between SESM and non-SESM traffic, we recommend that you define the SESM server as the default network and place other servers in the Open Garden network.

Note Traffic to and from a non-SESM server does not require special processing.

The SSG typically forwards packets to and from the default network through the router's PXF forwarding engine. However, SSG also forwards default network traffic through the route processor (RP) as follows:

Packets from a User and Destined for the Default Network

If the port-bundle host key is:

•Enabled—SSG forwards the packets through the RP.

•Disabled—SSG forwards the packets through the PXF forwarding engine.

Packets from the Default Network and Destined for an SSG User

•SSG forwards the packets through the RP if either of the following conditions are met:

–The port-bundle host key is enabled.

–The port-bundle host key is disabled, TCP is the transport protocol, and the packets are associated with an active TCP redirect mapping.

•Otherwise, SSG forwards the packets through the PXF forwarding engine.

Access Protocols

On the subscriber side of the network, the Cisco 10000 series router supports SSG features for the following protocols and encapsulations:

•PPPoE

•PPPoA

•RBE

•RFC 2684 IP

On the network side, the router supports receiving SSG traffic on the following interface types:

•ATM PVCs and subinterfaces

•Ethernet interfaces and subinterfaces

•POS interfaces

•Serial and channelized interfaces

Supported SSG Features

The Cisco 10000 series router supports the following SSG features and functionality:

•SSG Logon and Logoff

•Authentication and Accounting

•Service Selection Methods

•Service Connection

•Service Profiles and Cached Service Profiles

•SSG Hierarchical Policing

•Interface Configuration

•SSG TCP Redirect

•VPI/VCI Static Binding to a Service Profile

•RADIUS Virtual Circuit Logging

•AAA Server Group Support for Proxy Services

•Packet Filtering

•SSG Unconfig

For more information about the SSG features, refer to the Service Selection Gateway, Release 12.2(15)B feature module.

For information about SSG features supported in a specific Cisco IOS release, refer to the Cisco 10000 Series Router Feature Map.

SSG Restrictions

The SSG feature has the following restrictions:

•When using SSG hierarchical policing on Cisco 10000 Series routers, a maximum of 8 policing rates can be used per uplink interface and R attribute combination. Of these 8 rates, 1 is reserved for "no policing", leaving 7 different police rates available per uplink interface and R attribute combination For example, if eight SSG services are bound to the same SSG next-hop and all eight services carry an R attribute of "R0.0.0.0;0.0.0.0", the ninth service will fail to acquire correct policing rates and this error message may appear:
%GENERAL-3-EREVENT: C10KSSG: Vi2.8 svc_bitmap 0x2 Unable to set connection rate

•Network address translation (NAT) functionality is not supported. This means that the router does not support concurrent access to multiple services for which the services, not the access provider, must assign the user's IP address. For example, this restriction applies to concurrent access to a private service and SESM or the Open Garden network, or concurrent access to a tunnel service and SESM or the Open Garden network.

•The Cisco 10000 series router adds reachability information to the Open Garden and default networks for all services, both public and private. Because NAT is not supported, the addresses for the Open Garden and default networks cannot overlap addresses defined within the service definition.

•To restrict access to the Open Garden network by private services, you must specifically bind the Open Garden to the uplink interfaces. Do not bind the Open Garden to the interface used by the private service.

•The Cisco 10000 router's SSG software and forwarding software handle multiple users attached to a single Cisco IOS software interface in different ways, which could result in users receiving services that they did not select. After the first user logs on, all subsequent user logon attempts are rejected. Although the logon is rejected and thus the ability to select services, all users can access the services to which the first user is subscribed. User traffic is not rejected, only the user's authorization attempt. The traffic from all users is logged in the statistics of the first user. The traffic to the user is treated as transparent passthrough and is forwarded to the user, but it does not affect SSG accounting. If you enter the ssg show host command, statistics are displayed for the first user only.

•For users attached to multipoint interfaces on the access side, the Cisco 10000 router authorizes the first user and then rejects the authorization attempts of subsequent users. The router only rejects the authorization attempts, not the user traffic. The router treats all subsequent users as the first user logged on, allowing access to the services to which the first user is subscribed. However, subsequent users cannot select services. The traffic from all users is logged in the statistics of the first user. Traffic to the second and subsequent users is treated as transparent passthrough and is forwarded to these users, but it does not affect the SSG accounting. The ssg show host command displays the first user.

•Each private service is associated with its own VRF; global services are associated with the same VRF. The default network and Open Garden network are typically added to all VRFs, except if the network addresses overlap addresses in the private IP network or the Open Garden network is explicitly bound to an uplink interface. The default network addresses must also be associated with the global Cisco IOS VRF.

•You can apply a service to a next-hop address or to an interface. The interface must be a non-broadcast interface. For example, an interface with multipoint PVCs or Ethernet without VLANs is not supported.

•You can apply services with overlapping addresses to the same next-hop address. Services that have overlapping addresses cannot be bound to different next-hop addresses if the next-hop addresses resolve to the same interface.

•All services that share an uplink interface must not have overlapping addresses. Normally, a service defined to include a route of 0.0.0.0 with a subnet mask of 0.0.0.0 overlaps with any other possible service. Therefore, the Cisco 10000 series router treats the route 0.0.0.0 with a subnet mask of 0.0.0.0 as a default route.

•You cannot configure the following interface types as an SSG uplink interface:

–Any interface requiring tunneling (for example, L2TP or GRE tunneling)

–Multilink PPP (MLPPP) interfaces

–Tag interfaces

–Load balanced interfaces

•For RBE and IP users, the addresses of services that share an uplink interface cannot overlap.

For information about the restrictions for a specific SSG feature, see the appropriate chapter in this guide.

SSG Prerequisites

The SSG feature has the following prerequisites:

•The Cisco 10000 series router must be running Cisco IOS Release 12.2(16)BX or later.

•The performance routing engine (PRE), part number ESR-PRE2 must be installed in the router chassis. The PRE performs all Layer 2 and Layer 3 packet manipulation related to routing and forwarding operations. Use the show version command to verify that you have the correct PRE version installed.

•If you want to perform Layer 3 service selection, you must install and configure the Cisco Subscriber Edge Services Manager (SESM) as described in the Cisco Subscriber Edge Services Manager and Subscriber Policy Engine Installation and Configuration Guide, Release 3.1(1).

For information about the prerequisites for a specific SSG feature, see the appropriate chapter in this guide.

SSG Architecture Model

Figure 1-2 shows a Service Selection Gateway (SSG) model.

Figure 1-2 Service Selection Gateway Topology

In Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices (such as a desktop computer over DSL). The Cisco 10000 series router (the SSG node) forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network.

As the gateway to service selection, subscribers can use SESM to manager their accounts, subscribe to new services, and select those services that they want to use. Service providers can use SESM to offer and advertise value-added services and to associate these services with their brand identities.

	Cisco 10000 Series Internet Router Service Selection Gateway Configuration Guide
	Service Selection Gateway Overview
Cisco 10000 Series Internet Router Service Selection Gateway Configuration Guide About This Guide Service Selection Gateway Overview Scaling and Performance SSG Logon and Logoff Authentication and Accounting Service Selection Methods Service Connection Service Profiles and Cached Service Profiles SSG Hierarchical Policing Interface Configuration SSG TCP Redirect Miscellaneous SSG Features Monitoring and Maintaining SSG SSG Implementation Notes Configuration Example for SSG Glossary Index	Download this chapter Service Selection Gateway Overview Download the complete book Cisco 10000 Series Router Service Selection Gateway Configuration Guide (PDF - 1 MB) Table Of Contents Service Selection Gateway Overview Service Selection Gateway Default Network Access Protocols Supported SSG Features SSG Restrictions SSG Prerequisites SSG Architecture Model Service Selection Gateway Overview The Service Selection Gateway feature, available in Cisco IOS Release 12.2(16)BX or later, offers a switching solution to service providers. Working in conjunction with the Cisco Subscriber Edge Services Manager (SESM), SSG provides subscriber authentication, service selection, and service connection capabilities to subscribers of Internet services. Subscribers interact with the SESM web application using a standard Internet browser. This chapter provides an overview of the Service Selection Gateway feature available on the Cisco 10000 series router. Service Selection Gateway The Cisco 10000 series router supports the Service Selection Gateway (SSG) feature in Cisco IOS Release 12.2(16)BX or later. SSG is a switching solution for service providers who offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as digital subscriber lines (DSL) lines, cable modems, or wireless to allow simultaneous access to network services. SSG provides connectivity to corporate networks and differential service selection to users with access to multiple simultaneous services. Users can dynamically connect to and disconnect from any of the services available to them. Figure 1-1 shows an example of an SSG topology. In the figure, a single user connects to the Cisco 10000 series router using an access protocol such as PPP, RBE, or IP. SSG resides in the router that serves as a broadband aggregator. The router acts as a central control point for Layer 2 and Layer 3 services, including services available through ATM virtual circuits (VCs), virtual private dial-up networks (VPDNs), and normal routing methods. The user can concurrently connect to a number of different services, which can be private or public services. Connections to the services are established using IP. Figure 1-1 SSG Topology Example Note The Cisco 10000 series router does not support tunneling of SSG users. The Cisco 10000 series router adds the Open Garden and default networks to all SSG VRFs, providing reachability information to the Open Garden and default networks for all services both public and private. However, access is restricted for the following conditions: •If the Open Garden and default network addresses overlap within the service definition, the traffic destined for either network is subject to the rules of the default network. •If the Open Garden network is bound to a specific interface and a VRF is also applied to the interface, the Open Garden network is accessible to users whose sessions are established using the applied VRF. The SSG feature communicates with the authentication, authorization, and accounting (AAA) management network that includes RADIUS and Dynamic Host Configuration Protocol (DHCP) servers. SSG connects to the service provider network, which can connect to the Internet service provider (ISP) network and corporate networks. The Cisco 10000 series router supports the Cisco Subscriber Edge Services Manager (SESM), which provides subscriber authentication, service selection, and service connection capabilities to subscribers of Internet services. Subscribers interact with the SESM web application using a standard Internet browser. The SESM functionality provides a flexible and convenient graphical user interface (GUI) for subscribers and enables service providers to bill subscribers for connection time and services used, rather than charging a flat rate. Default Network The default network is a location that SSG allows unauthenticated users to access. The default network is a single IP address or subnet, typically the IP address of the SESM application although other types of servers can also be defined as the default network. The default network supports the port-bundle host key. The default network enables special processing of traffic to and from the default network. Because traffic to and from SESM requires special processing and the Cisco 10000 series router cannot distinguish between SESM and non-SESM traffic, we recommend that you define the SESM server as the default network and place other servers in the Open Garden network. Note Traffic to and from a non-SESM server does not require special processing. The SSG typically forwards packets to and from the default network through the router's PXF forwarding engine. However, SSG also forwards default network traffic through the route processor (RP) as follows: Packets from a User and Destined for the Default Network If the port-bundle host key is: •Enabled—SSG forwards the packets through the RP. •Disabled—SSG forwards the packets through the PXF forwarding engine. Packets from the Default Network and Destined for an SSG User •SSG forwards the packets through the RP if either of the following conditions are met: –The port-bundle host key is enabled. –The port-bundle host key is disabled, TCP is the transport protocol, and the packets are associated with an active TCP redirect mapping. •Otherwise, SSG forwards the packets through the PXF forwarding engine. Access Protocols On the subscriber side of the network, the Cisco 10000 series router supports SSG features for the following protocols and encapsulations: •PPPoE •PPPoA •RBE •RFC 2684 IP On the network side, the router supports receiving SSG traffic on the following interface types: •ATM PVCs and subinterfaces •Ethernet interfaces and subinterfaces •POS interfaces •Serial and channelized interfaces Supported SSG Features The Cisco 10000 series router supports the following SSG features and functionality: •SSG Logon and Logoff •Authentication and Accounting •Service Selection Methods •Service Connection •Service Profiles and Cached Service Profiles •SSG Hierarchical Policing •Interface Configuration •SSG TCP Redirect •VPI/VCI Static Binding to a Service Profile •RADIUS Virtual Circuit Logging •AAA Server Group Support for Proxy Services •Packet Filtering •SSG Unconfig For more information about the SSG features, refer to the Service Selection Gateway, Release 12.2(15)B feature module. For information about SSG features supported in a specific Cisco IOS release, refer to the Cisco 10000 Series Router Feature Map. SSG Restrictions The SSG feature has the following restrictions: •When using SSG hierarchical policing on Cisco 10000 Series routers, a maximum of 8 policing rates can be used per uplink interface and R attribute combination. Of these 8 rates, 1 is reserved for "no policing", leaving 7 different police rates available per uplink interface and R attribute combination For example, if eight SSG services are bound to the same SSG next-hop and all eight services carry an R attribute of "R0.0.0.0;0.0.0.0", the ninth service will fail to acquire correct policing rates and this error message may appear: %GENERAL-3-EREVENT: C10KSSG: Vi2.8 svc_bitmap 0x2 Unable to set connection rate •Network address translation (NAT) functionality is not supported. This means that the router does not support concurrent access to multiple services for which the services, not the access provider, must assign the user's IP address. For example, this restriction applies to concurrent access to a private service and SESM or the Open Garden network, or concurrent access to a tunnel service and SESM or the Open Garden network. •The Cisco 10000 series router adds reachability information to the Open Garden and default networks for all services, both public and private. Because NAT is not supported, the addresses for the Open Garden and default networks cannot overlap addresses defined within the service definition. •To restrict access to the Open Garden network by private services, you must specifically bind the Open Garden to the uplink interfaces. Do not bind the Open Garden to the interface used by the private service. •The Cisco 10000 router's SSG software and forwarding software handle multiple users attached to a single Cisco IOS software interface in different ways, which could result in users receiving services that they did not select. After the first user logs on, all subsequent user logon attempts are rejected. Although the logon is rejected and thus the ability to select services, all users can access the services to which the first user is subscribed. User traffic is not rejected, only the user's authorization attempt. The traffic from all users is logged in the statistics of the first user. The traffic to the user is treated as transparent passthrough and is forwarded to the user, but it does not affect SSG accounting. If you enter the ssg show host command, statistics are displayed for the first user only. •For users attached to multipoint interfaces on the access side, the Cisco 10000 router authorizes the first user and then rejects the authorization attempts of subsequent users. The router only rejects the authorization attempts, not the user traffic. The router treats all subsequent users as the first user logged on, allowing access to the services to which the first user is subscribed. However, subsequent users cannot select services. The traffic from all users is logged in the statistics of the first user. Traffic to the second and subsequent users is treated as transparent passthrough and is forwarded to these users, but it does not affect the SSG accounting. The ssg show host command displays the first user. •Each private service is associated with its own VRF; global services are associated with the same VRF. The default network and Open Garden network are typically added to all VRFs, except if the network addresses overlap addresses in the private IP network or the Open Garden network is explicitly bound to an uplink interface. The default network addresses must also be associated with the global Cisco IOS VRF. •You can apply a service to a next-hop address or to an interface. The interface must be a non-broadcast interface. For example, an interface with multipoint PVCs or Ethernet without VLANs is not supported. •You can apply services with overlapping addresses to the same next-hop address. Services that have overlapping addresses cannot be bound to different next-hop addresses if the next-hop addresses resolve to the same interface. •All services that share an uplink interface must not have overlapping addresses. Normally, a service defined to include a route of 0.0.0.0 with a subnet mask of 0.0.0.0 overlaps with any other possible service. Therefore, the Cisco 10000 series router treats the route 0.0.0.0 with a subnet mask of 0.0.0.0 as a default route. •You cannot configure the following interface types as an SSG uplink interface: –Any interface requiring tunneling (for example, L2TP or GRE tunneling) –Multilink PPP (MLPPP) interfaces –Tag interfaces –Load balanced interfaces •For RBE and IP users, the addresses of services that share an uplink interface cannot overlap. For information about the restrictions for a specific SSG feature, see the appropriate chapter in this guide. SSG Prerequisites The SSG feature has the following prerequisites: •The Cisco 10000 series router must be running Cisco IOS Release 12.2(16)BX or later. •The performance routing engine (PRE), part number ESR-PRE2 must be installed in the router chassis. The PRE performs all Layer 2 and Layer 3 packet manipulation related to routing and forwarding operations. Use the show version command to verify that you have the correct PRE version installed. •If you want to perform Layer 3 service selection, you must install and configure the Cisco Subscriber Edge Services Manager (SESM) as described in the Cisco Subscriber Edge Services Manager and Subscriber Policy Engine Installation and Configuration Guide, Release 3.1(1). For information about the prerequisites for a specific SSG feature, see the appropriate chapter in this guide. SSG Architecture Model Figure 1-2 shows a Service Selection Gateway (SSG) model. Figure 1-2 Service Selection Gateway Topology In Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices (such as a desktop computer over DSL). The Cisco 10000 series router (the SSG node) forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network. As the gateway to service selection, subscribers can use SESM to manager their accounts, subscribe to new services, and select those services that they want to use. Service providers can use SESM to offer and advertise value-added services and to associate these services with their brand identities.
	© 1992-2009 Cisco Systems, Inc. All rights reserved. Terms & Conditions \| Privacy Statement \| Cookie Policy \| Trademarks of Cisco Systems, Inc.