 Feedback
|
Table Of Contents
SSG—Limiting the Number of Sessions and Services
Configuring SSG to Limit Sessions and Services
Limit the Number of Host Objects on an SSG Device
Limit the Number of Transparent Autologon Users
Limit the Number of User Services
Configuration Example for SSG-Limiting the Number of Sessions and Services
SSG—Limiting the Number of Sessions and Services
This feature allows you to limit the number of user sessions and services allowed on a Service Selection Gateway (SSG) device. A Cisco device that is running a Cisco IOS image with SSG is referred to as an SSG.
You can set limits for:
•
The number of host objects that can be activated on the SSG device
•
•
Setting any of these limits helps to ensure that the SSG device's resources are not exhausted during extreme network loads.
History for the SSG-Limiting the Number of Sessions and Services Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
This document includes the following topics:
•
•
Prerequisites
Before you can use this SSG feature to limit sessions and services, you must:
•
•
•
•
Restrictions
The following restriction applies to this SSG feature:
•
Configuring SSG to Limit Sessions and Services
To configure this SSG feature to limit sessions and services, perform the following tasks:
•
•
•
Limit the Number of Host Objects on an SSG Device
This section describes how you can use the ssg maximum host command to limit the number of host objects that can be enabled on an SSG device. Using this command helps to prevent a router from experiencing resource exhaustion when the number of logon-requests exceed the router's limitations.
This section includes the following topics:
•
SUMMARY STEPS
This section lists the command sequence required to limit the number of host objects that can be enabled on an SSG device.
For a detailed summarization of the command sequence, with examples, refer to DETAILED STEPS, next.
1.
2.
3.
4.
DETAILED STEPS
This section provides a detailed summarization of the command sequence, with examples, required to limit the number of host objects that can be enabled on an SSG device.
What Happens When a Router Reaches the Maximum Number of Host Connections
After a router reaches the maximum number of allowable host connections, it does not accept any new connections. When it receives a new connection request, the router replies with an Access-Reject message, which indicates the router has reached the maximum number of allowable host connections (refer to Figure 1).
The method of informing users depends on the type of user login:
•
•
•
Figure 1 Access-Reject message
Limit the Number of Transparent Autologon Users
The SSG Transparent Autologon (TAL) feature allows users with authorized IP addresses to "pass through" to an SSG device. Allowing an unlimited number of TAL users on an SSG device can cause resource exhaustion. To help preserve router resources, you can use the user passthrough maximum command to limit the number of TAL users.
This section includes the following topics:
•
SUMMARY STEPS
This section lists the command sequence required to limit the number of TAL users on an SSG device.
For a detailed summarization of the command sequence, with examples, refer to DETAILED STEPS, next.
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
This section provides a detailed summarization of the command sequence, with examples, required to limit the number of TAL users on an SSG device.
What Happens When the Number of TAL Users Reaches the Specified Limit
When a router reaches the limit of TAL users, SSG does not allow transparent authorization of new IP addresses. All new users are marked as unidentified. The following error message is also displayed on the SSG router console (refer to Figure 2):
Figure 2 Max_TAL error message
Limit the Number of User Services
You can use the ssg maximum service command to limit the number of services available to each user. Limiting the number of services available to each user, helps prevent a router from experiencing resource exhaustion.
Note
This section includes the following topics:
•
SUMMARY STEPS
This section lists the command sequence required to limit the number of services available to each user on an SSG device.
For a detailed summarization of the command sequence, with examples, refer to DETAILED STEPS, next.
1.
2.
3.
4.
DETAILED STEPS
This section provides a detailed summarization of the command sequence, with examples, required to limit the number of services available to each user on an SSG device.
What Happens When Users Attempt to Exceed the Maximum Number of Services
When a user attempts to exceed the maximum number of services (as specified in the command), those services do not become available.
Configuration Example for SSG-Limiting the Number of Sessions and Services
In the following configuration example, all three feature options (ssg maximum host, ssg maximum service, and user passthrough maximum) are configured on an SSG device. In this configuration example, host objects and user services are limited to 10, and TAL users are limited to 100.
Router> enableRouter# configure terminalRouter(config)# ssg maximum host 10Router(config)# ssg maximum service 10Router(config)# ssg login transparentRouter(config-login-transparent)# user passthrough maximum 100Additional References
The following sections provide references related to SSG-Limiting the Number of Sessions and Services.
Related Documents
Standards
MIBs
RFCs
Technical Assistance
Command Reference
This section documents new commands only.
ssg maximum host
To limit the number of user connections (hosts) allowed on a Service Selection Gateway (SSG) device, use the ssg maximum host command in global configuration mode. To remove the limitation on the number of hosts, use the no form of this command.
ssg maximum host number-of-hosts
no ssg maximum host number-of-hosts
Syntax Description
Command Default
Unlimited hosts are allowed on an SSG device.
Command Modes
Global configuration
Command History
Usage Guidelines
This command prevents resource exhaustion on a router by limiting the number of host connections. When the router reaches the maximum number of connections, it refuses any new connections. As users log out, new users are allowed to connect.
This command limits only the number of host connections; it does not limit the number of services available to users.
Examples
The following example limits the number of host connections to 1,000:
Router(config)# ssg maximum host 1000Related Commands
ssg maximum service
Limits the number of services available to SSG users.
user passthrough maximum
Limits the number of SSG transparent autologon users on an SSG device.
ssg maximum service
To limit the number of services available to a user on a Service Selection Gateway (SSG) device, use the ssg maximum service command in global configuration mode. To remove the limitation on the number of services, use the no form of this command.
ssg maximum service number-of-services
no ssg maximum service number-of-services
Syntax Description
number-of-services
Limits the number of services available to a user on an SSG device. The valid range of services is 1 to 20.
Command Default
Users have up to 20 services available.
Command Modes
Global configuration
Command History
Usage Guidelines
This command enables you to limit the number of services available to a user. This command replaces the ssg maxservice command. If you issue the ssg maxservice command and save your configuration, the saved configuration shows the ssg maximum service command.
Examples
The following example limits the number of user services to 10:
Router(config)# ssg maximum service 10Related Commands
user passthrough maximum
To limit the number of Service Selection Gateway (SSG) transparent autologon (TAL) users on an SSG device, use the user passthrough maximum command in SSG login transparent submode. To remove the limitation on the number of SSG TAL users, use the no form of this command.
user passthrough maximum number-of-users
no user passthrough maximum number-of-users
Syntax Description
Command Default
Unlimited TAL users can access an SSG device.
Command Modes
SSG login transparent submode
Command History
Usage Guidelines
This command prevents resource exhaustion on a router by limiting the number of SSG TAL users on a device. When the router reaches the maximum number of users, it refuses any new connections.
Examples
The following example limits the number of SSG TAL users to 400:
Router(config)# ssg logon transparentRouter(config-login-transparent)# user passthrough maximum 400Related Commands
ssg maximum host
Limits the number of host connections on an SSG device.
ssg maximum service
Limits the number of services available to a user on an SSG device.
© 2005 Cisco Systems, Inc. All rights reserved.
