Table Of Contents
select
server (SSG)
server-group
server-port
session-identifier
sessions auto cleanup
show ssg auto-domain exclude-profile
show ssg binding
show ssg connection
show ssg dial-out exclude-list
show ssg direction
show ssg host
show ssg interface
show ssg multidomain ppp exclude-list
show ssg next-hop
show ssg open-garden
show ssg pass-through-filter
show ssg pending-command
show ssg port-map ip
show ssg port-map status
show ssg prepaid default-quota
show ssg radius-proxy
show ssg service
show ssg summary
show ssg tcp-redirect group
show ssg user transparent
show ssg user transparent authorizing
show ssg user transparent passthrough
show ssg user transparent suspect
show ssg user transparent unidentified
show ssg vc-service-map
source ip
ssg aaa group prepaid
ssg accounting
ssg attribute 44 suffix host ip
ssg auto-domain
ssg auto-logoff arp
ssg auto-logoff icmp
ssg bind direction
ssg bind service
select
Note
Effective with Cisco IOS Release 15.0(1)M, the select command is not available in Cisco IOS software.
To override the default Autodomain selection algorithm, use the select command in SSG-auto-domain mode. To reenable the default algorithm for selecting the Autodomain, use the no form of this command.
select {username | called-station-id}
no select {username | called-station-id}
Syntax Description
username
|
Configures the algorithm to use only the username to select the Autodomain.
|
called-station-id
|
Configures the algorithm to use only the Access Point Name (APN) Called-Station-ID.
|
Command Default
The algorithm attempts to find a valid Autodomain based on the APN Called-Station-ID and then by username.
Command Modes
SSG-auto-domain
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use the select command to override the default algorithm for selecting the Autodomain. By default, the algorithm attempts to find a valid Autodomain based on APN Called-Station-ID and then by username. Using this command, you can configure the algorithm to use only the APN or only the username.
Note
The Autodomain exclusion list is applied even if the mode is selected using the select command.
Examples
The following example shows how to configure the algorithm to search for a valid Autodomain based only on the username:
download exclude-profile abc password1
The following example shows how to configure the algorithm to search for a valid Autodomain based only on the APN:
Related Commands
Command
|
Description
|
download exclude-profile
|
Adds to the Autodomain download exclusion list.
|
exclude
|
Configures the Autodomain exclusion list.
|
mode extended
|
Enables extended mode for SSG Autodomain.
|
nat user-address
|
Enables NAT on Autodomain tunnel service.
|
show ssg auto-domain exclude-profile
|
Displays the contents of an Autodomain exclude-profile downloaded from the AAA server.
|
ssg auto-domain
|
Enables SSG Autodomain.
|
ssg enable
|
Enables SSG functionality.
|
server (SSG)
Note
Effective with Cisco IOS Release 15.0(1)M, the server (SSG) command is not available in Cisco IOS software.
To add a server to a captive portal group, use the server command in SSG-redirect-group configuration mode. To remove a server from a captive portal group, use the no form of this command.
server ip-address port
no server ip-address port
Syntax Description
ip-address
|
IP address of the server to be added to the captive portal group.
|
port
|
TCP port of the server to be added to the captive portal group.
|
Command Default
No default behavior or values.
Command Modes
SSG-redirect-group configuration
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use the server command in SSG-redirect-group configuration mode to add a server, defined by its IP address and TCP port, to a captive portal group.
Service Selection Gateway (SSG) TCP Redirect for Services provides nonauthorized users access to controlled services within an SSG. Packets sent upstream from an unauthenticated user are forwarded to the captive portal that deals with the packets in a suitable manner, such as routing them to a logon page. You can also use captive portals to handle requests from authorized users who request access to services into which they are not logged.
You must enable SSG using the ssg enable command and SSG TCP Redirect for Services using the ssg tcp-redirect command before you can define a captive portal group. Use the server-group command in SSG-redirect configuration mode to create and name a captive portal group before using the server command to add servers to the captive portal group.
Examples
The following example adds a server at IP address 10.0.0.0 and TCP port 8080 and a server at IP address 10.1.2.3 and TCP port 8081 to a captive portal group named "RedirectServer":
server-group RedirectServer
Related Commands
Command
|
Description
|
server-group
|
Defines the group of one or more servers that make up a named captive portal group and enters SSG-redirect-group configuration mode.
|
show ssg tcp-redirect group
|
Displays information about the captive portal groups and the networks associated with the captive portal groups.
|
show tcp-redirect mappings
|
Displays information about the TCP redirect mappings for hosts within your system.
|
ssg enable
|
Enables SSG.
|
ssg tcp-redirect
|
Enables SSG TCP redirect and enters SSG-redirect mode.
|
server-group
Note
Effective with Cisco IOS Release 15.0(1)M, the server-group command is not available in Cisco IOS software.
To define a group of one or more servers that make up a named captive portal group and enter SSG-redirect-group configuration mode, use the server-group command in SSG-redirect configuration mode. To remove a captive portal group and any servers configured within that portal group, use the no form of this command.
server-group group-name
no server-group group-name
Syntax Description
group-name
|
The name of the captive portal group.
|
Command Default
No default behavior or values.
Command Modes
SSG-redirect configuration
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to define and name a captive portal group. Service Selection Gateway (SSG) TCP Redirect for Services provides nonauthorized users access to controlled services within an SSG. Packets sent upstream from an unauthenticated user are forwarded to the captive portal that deals with the packets in a suitable manner, such as routing them to a logon page. You can also use captive portals to handle requests from authorized users who request access to services into which they are not logged.
After defining a captive portal group with the server-group command, identify individual servers for inclusion in the captive portal group using the server ip-address port command in SSG-redirect-group configuration mode.
You must enable SSG using the ssg enable command and SSG TCP Redirect for Services using the ssg tcp-redirect command before you can define a captive portal group.
Note
This command, along with the server command, replaces the ssg http-redirect group group-name server ip-address port command.
Examples
The following example defines a captive portal group named "RedirectServer":
server-group RedirectServer
Related Commands
Command
|
Description
|
server (SSG)
|
Adds a server to a captive portal group.
|
show ssg tcp-redirect group
|
Displays information about the captive portal groups and the networks associated with the captive portal groups.
|
show tcp-redirect mappings
|
Displays information about the TCP redirect mappings for hosts within your system.
|
ssg enable
|
Enables SSG.
|
ssg tcp-redirect
|
Enables SSG TCP redirect and enters SSG-redirect mode.
|
server-port
Note
Effective with Cisco IOS Release 15.0(1)M, the server-port command is not available in Cisco IOS software.
To configure the ports on which Service Selection Gateway (SSG) listens for RADIUS-requests from configured RADIUS clients, use the server-port command in SSG-radius-proxy configuration mode. To stop SSG from listening for RADIUS requests from configured RADIUS clients on a port, use the no form of this command.
server-port [auth auth-port] [acct acct-port]
no server-port [auth auth-port] [acct acct-port]
Syntax Description
auth
|
(Optional) RADIUS authentication port.
|
auth-port
|
(Optional) Port number to be used for RADIUS authentication. The default is 1645.
|
acct
|
(Optional) RADIUS accounting port.
|
acct-port
|
(Optional) Port number to be used for RADIUS accounting. The default is 1646.
|
Command Default
Port 1645 is the default RADIUS authentication port.
Port 1646 is the default RADIUS accounting port.
Command Modes
SSG-radius-proxy configuration
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to configure the authentication and accounting ports for the SSG Autologon Using Proxy RADIUS feature. Ports configured with this command are global parameters that apply to all proxy clients in the SSG.
Examples
The following example shows how to configure port 23 as the RADIUS authentication port and port 45 as the RADIUS accounting port:
server-port auth 23 acct 45
Related Commands
Command
|
Description
|
address-pool
|
Defines local IP pools to be used by SSG to assign IP addresses to users for which SSG is acting as a RADIUS client.
|
clear ssg radius-proxy client-address
|
Clears all hosts connected to a specific RADIUS client.
|
clear ssg radius-proxy nas-address
|
Clears all hosts connected to a specific NAS.
|
forward accounting-start-stop
|
Proxies accounting start, stop, and update packets generated by any RADIUS clients to the AAA server.
|
idle-timeout (SSG)
|
Configures a host object timeout value.
|
show ssg tcp-redirect group
|
Displays the pool of IP addresses configured for a router or for a specific domain.
|
ssg enable
|
Enables SSG.
|
ssg radius-proxy
|
Enables SSG RADIUS Proxy.
|
session-identifier
Note
Effective with Cisco IOS Release 15.0(1)M, the session-identifier command is not available in Cisco IOS software.
To override Service Selection Gateway (SSG) automatic RADIUS client session identification and to configure SSG to identify the specified client session by a specific type of ID attribute, use the session-identifier command in SSG-radius-proxy-client mode. To configure SSG to perform user identification only by the username without using a session identification, use the no form of this command.
session-identifier [auto | msid | correlation-id | acct-sess-id]
no session-identifier [auto | msid | correlation-id | acct-sess-id]
Syntax Description
auto
|
Automatically determines the session identifier.
|
msid
|
Uses the MSID as the client session identifier.
|
correlation-id
|
Uses the Correlation-ID as the client session identifier.
|
acct-sess-id
|
Uses the Accounting-Session-ID as a client session identifier.
|
Command Default
SSG selects the attribute used for session identification according to the type of client device.
Command Modes
SSG-radius-proxy-client
Command History
Release
|
Modification
|
12.2(15)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
By default, SSG automatically selects the attribute to use for session identification according to the type of RADIUS client device. This attribute is used in the SSG Proxy RADIUS logon table. SSG assigns the following vendor-specific attributes (VSAs) to identify client sessions:
•
3GPP2-Correlation-ID for Packet Data Serving Nodes (PDSNs)
•
Accounting-Session-ID for Home Agents (HAs)
•
Calling-Station-ID (MSID) for non-CDMA2000 devices such as a general packet radio system (GPRS)
Use the session-identifier command to override the automatic session identification. Use the auto keyword to return to automatic session identification.
Examples
The following example shows how to configure SSG to use the Correlation-ID to identify the specified client session:
session-identifier correlation-id
The following example shows how to configure the RADIUS client to proxy all requests from IP address 172.16.0.0 to the RADIUS server, to assign the shared secret "cisco" to the client, and to use the Accounting-Session-ID attribute to identify the specified client session:
client-address 172.16.0.0
session-identifier acct-session-id
Related Commands
Command
|
Description
|
client-address
|
Configures the RADIUS client to proxy requests from the specified IP address to the RADIUS server and enters SSG-radius-proxy-client mode.
|
key (SSG-radius-proxy-client)
|
Configures a shared secret between SSG and a RADIUS client.
|
sessions auto cleanup
Note
Effective with Cisco IOS Release 15.0(1)M, the sessions auto-cleanup command is not available in Cisco IOS software.
To configure an aggregation device to attempt to recover PPP over Ethernet (PPPoE) sessions that failed after reload by notifying customer premises equipment (CPE) devices about the PPPoE session failures, use the sessions auto cleanup command in BBA group configuration mode. To disable PPPoE session recovery after reload, use the no form of this command.
sessions auto cleanup
no sessions auto cleanup
Syntax Description
This command has no arguments or keywords.
Command Default
PPPoE session recovery after reload is not enabled.
Command Modes
BBA group configuration
Command History
Release
|
Modification
|
12.3(2)T
|
This command was introduced.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
12.2(28)SB
|
This command was integrated into Cisco IOS Release 12.2(28)SB.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
If the PPP keepalive mechanism is disabled on a CPE device, the CPE device has no way to detect link or peer device failures over PPPoE connections. When an aggregation device that serves as the PPPoE session endpoint reloads, the CPE will assume that the link is up and will continue to send traffic to the aggregation device. The aggregation device will drop the traffic for the failed PPPoE session.
The sessions auto cleanup command enables an aggregation device to attempt to recover PPPoE sessions that existed before a reload. When the aggregation device detects a PPPoE packet for a "half-active" PPPoE session (a PPPoE session that is active on the CPE end only), the device notifies the CPE of the PPPoE session failure by sending a PPPoE active discovery terminate (PADT) packet. The CPE device is expected to respond to the PADT packet by taking failure recovery action.
The sessions auto cleanup command must be configured in a PPPoE profile. This command enables PPPoE session recovery after reload on all ingress ports that use the PPPoE profile.
Examples
In the following example, PPPoE session recovery after reload is configured in PPPoE profile "group1".
Related Commands
Command
|
Description
|
bba-group pppoe
|
Creates a PPPoE profile.
|
show ssg auto-domain exclude-profile
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg auto-domain exclude-profile command is not available in Cisco IOS software.
To display the contents of an Autodomain exclude profile downloaded from the AAA server, use the show ssg auto-domain exclude-profile command in global configuration mode.
show ssg auto-domain exclude-profile
Syntax Description
This command has no arguments or keywords.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command in global configuration mode to display the contents of an Autodomain exclude-profile downloaded from the AAA server. If any exclude entries downloaded from the AAA server are removed by the no exclude {apn | domain} name command, these entries will not be displayed by the show ssg auto-domain exclude-profile command.
Examples
The following sample displays the contents of an Autodomain exclude profile downloaded from the AAA server. The report is self-explanatory.
Router# show ssg auto-domain exclude-profile
Exclude APN Entries Downloaded:
Exclude Domain Entries Downloaded:
Related Commands
Command
|
Description
|
exclude
|
Configures the Autodomain exclusion list.
|
mode extended
|
Enables extended mode for SSG Autodomain.
|
nat user-address
|
Enables NAT on Autodomain tunnel service.
|
select
|
Configures the Autodomain selection mode.
|
show ssg auto-domain exclude-profile
|
Adds to the Autodomain download exclusion list.
|
ssg enable
|
Enables SSG functionality.
|
show ssg binding
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg binding command is not available in Cisco IOS software.
To display service names that have been bound to interfaces and the IP addresses to which they have been bound, use the show ssg binding command in privileged EXEC mode.
show ssg binding [begin expression | exclude expression | include expression]
Syntax Description
begin
|
(Optional) Begin with the line that contains expression.
|
expression
|
(Optional) Word or phrase used to determine what lines will be shown.
|
exclude
|
(Optional) Exclude lines that contain expression.
|
include
|
(Optional) Include lines that contain expression.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display services and the interfaces to which they have been bound.
Examples
The following example shows all service names that have been bound to interfaces:
WhipitNet -> 192.168.1.1 (NHT)
Service1.com -> 192.168.1.2 (NHT)
Service2.com -> 192.168.1.3 (NHT)
Service3.com -> 192.168.1.4 (NHT)
Related Commands
Command
|
Description
|
clear ssg service
|
Removes a service.
|
show ssg service
|
Displays the information for a service.
|
ssg bind service
|
Specifies the interface for a service.
|
show ssg connection
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg connection command is not available in Cisco IOS software.
To display the connections of a given Service Selection Gateway (SSG) host and a service name, use the show ssg connection command in privileged EXEC mode.
show ssg connection {ip-address | network-id subnet-mask} service-name [interface]
Syntax Description
ip-address
|
The IP address of an active SSG connection. This is always a subscribed host.
|
network-id
|
The IP network ID of an active SSG connection. This is always a subscribed host.
|
subnet-mask
|
The IP subnet mask of the subnet-based subscribed host.
|
service-name
|
Name of an active SSG connection.
|
interface
|
(Optional) IP address through which the host is connected.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(2)B
|
The interface argument was added for the SSG Host Key feature.
|
12.2(4)B
|
This command was modified to display information about SSG prepaid billing.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.2(13)T
|
The modifications from Release 12.2(4)B were integrated into Cisco IOS Release 12.2(13)T.
|
12.3(1a)BW
|
This command was modified to display the MSISDN (Calling Station ID) used for service logon.
|
12.3(3)B
|
The modifications from Release 12.3(1a)BW were integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
The modifications from Release 12.3(1a)BW were integrated into Cisco IOS Release 12.3(7)T.
|
12.3(14)T
|
The network-id and subnet-mask arguments were added.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Examples
Prepaid Service Based on Volume: Example
The following example displays the SSG connection for a prepaid service that uses a volume-based quota:
Router# show ssg connection 10.10.1.1 InstMsg
------------------------ConnectionObject Content -----------------------
Associated Service:InstMsg
Connection Started since:*00:25:58.000 UTC Tue Oct 23 2001
User last activity at:*00:25:59.000 UTC Tue Oct 23 2001
Connection Traffic Statistics:
Input Bytes = 0, Input packets = 0
Output Bytes = 0, Output packets = 0
Quota Type = 'VOLUME', Quota Value = 100
Session policing disabled
Prepaid Service Based on Time: Example
The following example displays the SSG connection for a prepaid service that uses a time-based quota:
Router# show ssg connection 10.10.1.2 Prepaid-internet
------------------------ConnectionObject Content -----------------------
Associated Service:Prepaid-internet
Connection Started since:*00:34:06.000 UTC Tue Oct 23 2001
User last activity at:*00:34:07.000 UTC Tue Oct 23 2001
Connection Traffic Statistics:
Input Bytes = 0, Input packets = 0
Output Bytes = 0, Output packets = 0
Quota Type = 'TIME', Quota Value = 100
Session policing disabled
Autologin Service: Example
The following example shows the service connection for the autologon service to host 10.3.6.1:
Router# show ssg connection 10.3.6.1 autologin
------------------------ ConnectionObject Content -----------------------
Associated Service:autologin
Connection Started since:
*20:41:26.000 UTC Fri Jul 27 2001
User last activity at:*20:41:26.000 UTC Fri Jul 27 2001
Connection Traffic Statistics:
Input Bytes = 0 (HI = 0), Input packets = 0
Output Bytes = 0 (HI = 0), Output packets = 0
MSISDN: Example
The following sample output for the show ssg connection command shows the MSISDN that is used for service logon:
Router# show ssg connection 10.0.1.1 proxy2
------------------------ConnectionObject Content -----------------------
Associated Service: proxy2
Calling station id: 12345
Connection Started since: *17:44:59.000 GMT Sun Jul 6 2003
User last activity at: *17:44:59.000 GMT Sun Jul 6 2003
Connection Traffic Statistics:
Input Bytes = 0, Input packets = 0
Output Bytes = 0, Output packets = 0
Session policing disabled
Subnet-Based Subscriber: Example
The following sample output for the show ssg connection command shows the subnet mask of the subscribed host:
Router# show ssg connection 10.0.1.1 255.255.255.0 passthru
------------------------ConnectionObject Content -----------------------
Owner Host: 10.0.1.1 (Mask : 255.255.255.0)
Associated Service: passthru1
Calling station id: 00d0.792f.8054
Connection Started since: *17:44:59.000 GMT Sun Jul 6 2004
User last activity at: *17:44:59.000 GMT Sun Jul 6 2004
Connection Traffic Statistics:
Input Bytes = 0, Input packets = 0
Output Bytes = 0, Output packets = 0
Table 9 describes the significant fields shown in the displays.
Table 9 show ssg connection Field Descriptions
Field
|
Description
|
User Name
|
Subscriber name supplied at authentication.
|
Owner Host
|
IP address and subnet mask of the subscribed host.
|
Associated Service
|
Service name of the connected service.
|
Calling station id
|
MSISDN used for service logon.
|
Connection State
|
State of activation (active or inactive).
|
Connection Started since
|
Time of host connection to the associated service.
|
User last activity at
|
Time of last data packet sent over this connection.
|
Input Bytes
|
Number of bytes received on this connection.
|
Input packets
|
Number of packets received on this connection.
|
Output Bytes
|
Number of bytes sent on this connection.
|
Output packets
|
Number of packets sent on this connection.
|
Quota Type
|
Form in which the quota value is expressed (time or volume).
|
Quota Value
|
Value of the quota (in bytes for volume or seconds for time).
|
Related Commands
Command
|
Description
|
clear ssg connection
|
Removes the connections of a given host and a service name.
|
show ssg dial-out exclude-list
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg dial-out exclude-list command is not available in Cisco IOS software.
To display information about the Dialed Number Identification Service (DNIS) prefix profile and the DNIS exclusion list, use the show ssg dial-out exclude-list command in privileged EXEC mode.
show ssg dial-out exclude-list
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(15)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display the DNIS profile name and all DNIS entries configured via CLI or downloaded from a authentication, authorization, and accounting (AAA) server.
Examples
The following example shows sample output for the show ssg dial-out exclude-list command:
Router# show ssg dial-out exclude-list
Exclude DNIS prefixes downloaded from profile exclude_dnis_aaa
Related Commands
Command
|
Description
|
dnis-prefix all service
|
Configures the dial-out global service.
|
download exclude-profile (ssg dial-out)
|
Downloads the DNIS exclusion list locally or from a AAA server.
|
exclude dnis-prefix
|
Configures the DNIS filter by adding a DNIS prefix to the DNIS exclusion list.
|
ssg dial-out
|
Enters SSG dial-out configuration mode.
|
show ssg direction
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg direction command is not available in Cisco IOS software.
To display the direction of all interfaces for which a direction has been specified, use the show ssg direction command in privileged EXEC mode.
show ssg direction [begin expression | exclude expression | include expression]
Syntax Description
begin
|
(Optional) Begin with the line that contains expression.
|
expression
|
(Optional) Word or phrase used to determine what lines will be shown.
|
exclude
|
(Optional) Exclude lines that contain expression.
|
include
|
(Optional) Include lines that contain expression.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to show all interfaces that have been specified as uplinks or downlinks.
Examples
The following example shows the direction of all interfaces that have been specified as uplinks or downlinks.
Router# show ssg direction
FastEthernet0/0/0: Uplink
Related Commands
Command
|
Description
|
ssg bind direction
|
Specifies an interface as a downlink or uplink interface.
|
show ssg host
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg host command is not available in Cisco IOS software.
To display information about a Service Selection Gateway (SSG) subscriber and the current connections of the subscriber, use the show ssg host command in privileged EXEC mode. The command syntax of the show ssg host command depends on whether the SSG Port-Bundle Host Key feature is enabled.
When SSG Port-Bundle Host Key Is Not Enabled
show ssg host [ip-address | count | username [subnet-mask]]
When SSG Port-Bundle Host Key Is Enabled
show ssg host [ip-address | count | username] [interface [username] [subnet-mask]]
Syntax Description
ip-address
|
(Optional) Host IP address.
|
count
|
(Optional) Displays host object count, including inactive hosts.
|
username
|
(Optional) Displays all host usernames and IP addresses.
|
interface
|
(Optional) Downlink interface through which the host or subscriber is connected, such as ATM, Fast Ethernet, or Virtual-Access. For more information, use the question mark (?) online help function.
|
subnet-mask
|
(Optional) The IP subnet mask of the subnet-based subscribed host.
|
Command Default
If no argument is provided, all current connections are displayed.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 Node Route Processor (NRP).
|
12.2(2)B
|
The interface argument was added.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.2(15)B
|
This command was modified as follows:
• Introduced syntax dependence on SSG host key.
• Introduced count keyword.
• Added fields to the output to display additional information about the status of hosts.
|
12.3(4)T
|
The modifications made in Cisco IOS Release 12.2(15)B were integrated into Cisco IOS Release 12.3(4)T.
|
12.3(11)T
|
The output was enhanced to show information about the VPN routing/forwarding instance (VRF) that is associated with a host.
|
12.3(14)T
|
The subnet-mask argument was added.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
You can specify the Service Selection Gateway (SSG) downlink interface only when the SSG Port-Bundle Host Key feature is enabled. To enable the host key, enter the ssg port-map command in global configuration mode. To disable the host key, enter the no ssg port-map command.
Examples
Display All Active Hosts: Example
The following example shows all active hosts:
1:10.3.1.1 [Host-Key 70.13.60.3:64]
2:10.3.6.1 [Host-Key 70.13.60.3:65]
### Active HostObject Count:2
Simple IP Host: Example
The following example shows information about a simple IP host with an IP address of 10.0.0.0:
Router# show ssg host 10.0.0.0
------------------------ HostObject Content -----------------------
Proxy logon from client IP: 10.0.48.3
Maximum Session Timeout: 0 seconds
Host Idle Timeout: 60000 seconds
User logged on since: *05:59:46.000 UTC Fri May 3 2002
User last activity at: *05:59:52.000 UTC Fri May 3 2002
Initial TCP captivate: NO
TCP Advertisement captivate: NO
DNS Default Service: NONE
Active Services: internet-blue;
AutoService: internet-blue;
Subscribed Services: internet-blue; iptv; games; distlearn; corporate; shop; banking;
vidconf;
Subscribed Service Groups: NONE
Mobile IP Host: Example
The following example shows information about a mobile IP host with an IP address of 10.0.0.0:
Router# show ssg host 10.0.0.0
------------------------ HostObject Content -----------------------
Proxy logon from client IP: 10.0.48.4
Maximum Session Timeout: 0 seconds
Host Idle Timeout: 60000 seconds
User logged on since: *06:01:02.000 UTC Fri May 3 2002
User last activity at: *06:01:09.000 UTC Fri May 3 2002
Initial TCP captivate: NO
TCP Advertisement captivate: NO
DNS Default Service: NONE
Active Services: internet-blue;
AutoService: internet-blue;
Subscribed Services: internet-blue; iptv; games; distlearn; corporate; shop; banking;
vidconf;
Subscribed Service Groups: NONE
Two Hosts with the Same IP Address: Examples
The following example shows two host objects with the same IP address:
Router# show ssg host 10.3.1.1
SSG:Overlapping hosts for IP 10.3.1.1 at interfaces:FastEthernet0/0/0
In this case, use the interface argument to uniquely identify the host:
Router# show ssg host 10.3.1.1 FastEthernet0/0/0
Note
Note that the output produced by this command is the same as that produced by the command without the interface argument. The interface argument is used to uniquely identify a host only when there are overlapping host IP addresses.
The following example shows the usernames logged in to the active hosts:
Router# show ssg host username
1:10.3.1.1 (active) Host name:pppoauser
2:10.3.6.1 (active) Host name:ssguser2
### Total HostObject Count(including inactive hosts):2
Host Associated with a VRF: Example
The following sample output for the show ssg host command shows a VRF called "BLUE" associated with a host that has the IP address 10.0.0.2:
Router# show ssg host 10.0.0.2
------------------------ HostObject Content ----------------------
Interface: Ethernet1/0 VRF Name: BLUE
Subnet-Based Subscriber: Example
The following example shows information about a subnet-based subscriber with an IP address of 10.0.0.0 and a subnet mask of 255.255.255.0:
Router# show ssg host 10.0.0.0 255.255.255.0
------------------------ HostObject Content -----------------------
Maximum Session Timeout: 0 seconds
Host Idle Timeout: 60000 seconds
User logged on since: *05:59:46.000 UTC Fri May 3 2004
User last activity at: *05:59:52.000 UTC Fri May 3 2004
Initial TCP captivate: NO
TCP Advertisement captivate: NO
DNS Default Service: NONE
Subscribed Services: passthru1; proxynat1; tunnel1; proxy1
Subscribed Service Groups: NONE
Table 10 describes the significant fields shown in the displays.
Table 10 show ssg host Field Descriptions
Field
|
Description
|
Activated:
|
State of host object. Can be activated or inactivated.
Activated—IP address has been assigned to the host, and the host object was created successfully
Inactivated—A host is inactivated in the following situations:
• When SSG, acting as a RADIUS proxy, is waiting for the IP address of the host, the host object is created, but the state is inactive.
• If a host that is using PPP logs off from SSG, but the virtual-access interface of that PPP host is still up, SSG moves the host object to the inactivated state.
|
Interface:
|
The interface on the SSG device from which the SSG host is routable.
|
User Name:
|
Username that is used to authenticate the host at the authentication, authorization, and accounting (AAA) server.
|
VRF Name:
|
VRF associated with the interface for the host.
|
Owner Host:
|
IP address and subnet mask assigned to host object.
|
Msg IP:
|
IP address of the messaging server. SSG notifies the messaging server of events such as the logging off of a host, an idle-timeout expiration, and a session-timeout expiration. The default messaging server is Subscriber Edge Services Manager (SESM).
|
Host DNS IP:
|
IP address of the Domain Name System (DNS) server of the host. This server will be used only if DNS queries cannot be forwarded to a DNS server for the services that are subscribed to by the host.
|
Device:
|
Type of device. Device types can be a home agent (HA), Packet Data Serving Node (PDSN), or Generic (for non-CDMA2000 devices).
|
SessID:
|
A numeric string derived from the attribute specified as the Session-Identifier.
|
Timer:
|
Timer type can be None, Wait for IP, Hand-off, or Wait for MSID.
|
Maximum Session Timeout:
|
Session timeout value (RADIUS attribute 27) defined in the user profile. The session timeout value is the amount of time for which the user will stay active after logging on. After this timer expires, the host object is deleted.
|
Host Idle Timeout:
|
Maximum amount of time that a host can stay idle (not forwarding any traffic) before the host is deleted from SSG.
|
Class Attr:
|
Class attribute (RADIUS attribute 25) defined in the user profile. The class attribute is sent in all host accounting records. This attribute is used by some accounting servers.
|
User logged on since:
|
Time at which the user logged on to SSG.
|
User last activity at:
|
Last time the user forwarded traffic via SSG.
|
Default Service:
|
This field is not currently supported.
|
DNS Default Service:
|
This field is not currently supported.
|
Active Services:
|
List of services to which the host has logged on.
|
AutoService:
|
List of services to which the host logged on at the time of SSG host logon. These services are defined in the user profile, and the user can access these services after logging on to SSG.
|
Subscribed Services:
|
List of services to which the host is able to log on.
|
Related Commands
Command
|
Description
|
clear ssg host
|
Removes a host object or a range of host objects.
|
ssg port-map
|
Enables the SSG port-bundle host key.
|
show ssg interface
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg interface command is not available in Cisco IOS software.
To display information about Service Selection Gateway (SSG) interfaces, use the show ssg interface command in user EXEC or privileged EXEC mode.
show ssg interface [interface | brief]
Syntax Description
interface
|
(Optional) Specific interface for which to display information.
|
brief
|
(Optional) Gives brief information about each of the SSG interfaces and their usage.
|
Command Modes
User EXEC (>)
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(16)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command without any keywords or arguments to display information about all SSG interfaces.
Examples
The following example shows the show ssg interface brief command:
Router# show ssg interface brief
Interface Direction bindingtype Status
ATM3/0.1 Uplink Dynamic Up
ATM3/0.2 Downlink Static Down
Related Commands
Command
|
Description
|
show ssg binding
|
Displays service names that have been bound to interfaces and the IP addresses to which they have been bound.
|
show ssg direction
|
Displays the direction of all interfaces for which a direction has been specified.
|
show ssg summary
|
Displays a summary of the SSG configuration.
|
show ssg multidomain ppp exclude-list
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg multidomain ppp exclude-list command is not available in Cisco IOS software.
To display the contents of a PPP Termination Aggregation-Multidomain (PTA-MD) exclusion list, use the show ssg multidomain ppp exclude-list command in privileged EXEC mode.
show ssg multidomain ppp exclude-list
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(15)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
This command is used to verify the contents of a PTA-MD exclusion list.
Examples
Adding Domains to an Existing PTA-MD Exclusion List
In the following example, a PTA-MD exclusion list that already includes "cisco", "motorola", "nokia", and "voice-stream" is downloaded from the authentication, authorization, and accounting (AAA) server. After the exclusion list is downloaded, "microsoft" and "sun" are added to the exclusion list.
The exclusion list currently on the AAA server includes "cisco", "motorola", "nokia", and "voice-stream":
user = pta_md{
profile_id = 119
profile_cycle = 2
member = SSG-DEV
radius=6510-SSG-v1.1 {
check_items= {
2=cisco
}
reply_attributes= {
9,253="XPcisco"
9,253="XPmotorola"
9,253="XPnokia"
9,253="XPvoice-stream"
In the following example, the PTA-MD exclusion list is downloaded to the router from the AAA server. The password to download the exclusion list is "cisco". After the PTA-MD exclusion list is downloaded, "microsoft" and "sun" are added to the list using the router command-line interface (CLI).
download exclude-profile pta_md cisco
The enhancements to the exclusion list are then verified:
Router# show ssg multidomain ppp exclude-list
Related Commands
Command
|
Description
|
download exclude-profile (SSG PTA-MD)
|
Downloads the PTA-MD exclusion list from the AAA server to the router.
|
exclude (SSG PTA-MD)
|
Adds a domain name to the existing PTA-MD exclusion list.
|
ssg multidomain ppp
|
Enters PTA-MD configuration mode.
|
show ssg next-hop
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg next-hop command is not available in Cisco IOS software.
To display the next-hop table, use the show ssg next-hop command in privileged EXEC mode.
show ssg next-hop [begin expression | exclude expression | include expression]
Syntax Description
begin
|
(Optional) Displays lines beginning with the line that contains expression.
|
expression
|
(Optional) Word or phrase used to determine what lines will be shown.
|
exclude
|
(Optional) Excludes lines that contain expression.
|
include
|
(Optional) Includes lines that contain expression.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display all next-hop IP addresses.
Examples
The following example shows the next-hop table:
Router# show ssg next-hop
Next hop table loaded from profile prof-nhg:
Service1.com -> 192.168.1.3
Service2.com -> 192.168.1.2
Service3.com -> 192.168.1.1
Related Commands
Command
|
Description
|
clear ssg next-hop
|
Removes the next-hop table.
|
ssg next-hop download
|
Downloads the next-hop table from a RADIUS server.
|
show ssg open-garden
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg open-garden command is not available in Cisco IOS software.
To display a list of all configured open garden services, use the show ssg open-garden command in privileged EXEC mode.
show ssg open-garden
Syntax Description
This command has no keywords or arguments.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.1(5)DC
|
This command was introduced on the Cisco 6400 series node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Examples
In the following example, all configured open garden services are displayed:
Router# show ssg open-garden
Related Commands
Command
|
Description
|
local-profile
|
Configures a local service profile.
|
ssg open-garden
|
Designates a service, defined in a local service profile, as an open garden service.
|
ssg service-search-order
|
Specifies the order in which SSG searches for a service profile.
|
show ssg pass-through-filter
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg pass-through-filter command is not available in Cisco IOS software.
To display the downloaded filter for transparent pass-through, use the show ssg pass-through-filter command in privileged EXEC mode.
show ssg pass-through-filter [begin expression | exclude expression | include expression]
Syntax Description
begin
|
(Optional) Begin with the line that contains expression.
|
expression
|
(Optional) Word or phrase used to determine what lines will be shown.
|
exclude
|
(Optional) Exclude lines that contain expression.
|
include
|
(Optional) Include lines that contain expression.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display the downloaded transparent pass-through filter. The filter prevents pass-through traffic from accessing the specified IP address and subnet mask combinations. The filter is set using the ssg pass-through command.
To display a filter defined on the command line, use the show running-config command.
Examples
The following example shows the pass-through filter:
Router# show ssg pass-through-filter
Extended IP access list (SSG ACL)
permit tcp 172.16.6.0 0.0.0.255 any eq telnet
permit tcp 172.16.6.0 0.0.0.255 192.168.250.0 0.0.0.255 eq ftp
Related Commands
Command
|
Description
|
clear ssg pass-through-filter
|
Removes the downloaded filter for transparent pass-through.
|
ssg pass-through
|
Enables transparent pass-through.
|
show ssg pending-command
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg pending-command command is not available in Cisco IOS software.
To display current pending commands, such as next-hop or filters, use the show ssg pending-command command in privileged EXEC mode.
show ssg pending-command
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display the current pending commands.
Examples
The following example shows the pending commands:
Router# show ssg pending-command
SSG pending command list:
ssg bind service Service1.com 192.168.103.1
ssg bind service Perftest206 192.168.104.5
Related Commands
Command
|
Description
|
clear ssg pending-command
|
Removes all pending commands.
|
show ssg port-map ip
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg port-map ip command is not available in Cisco IOS software.
To display information about a particular port bundle, use the show ssg port-map ip command in privileged EXEC mode.
show ssg port-map ip ip-address port port-number
Syntax Description
ip-address
|
IP address used to identify the port bundle.
|
port port-number
|
TCP port number used to identify the port bundle.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(2)B
|
This command was introduced on the Cisco 6400 series.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.3(11)T
|
This command was modified to display the downlink VRF associated with the port bundle.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
This command displays the following information about a port bundle:
•
Port maps in the port bundle
•
IP address of the subscriber
•
Interface through which the subscriber is connected
•
Downlink VRF
Examples
The following is sample output for the show ssg port-map ip command:
Router# show ssg port-map ip 192.168.0.1 port 64
Subscriber Address = 10.1.1.1
Downlink Interface = Ethernet1/0
Subscriber Port: 1 Mapped Port: 1039
Table 11 describes the significant fields shown in the display.
Table 11 show ssg port-map ip Field Descriptions
Field
|
Description
|
State
|
Port bundle status.
|
Subscriber Address
|
Subscriber IP address.
|
Downlink Interface
|
Interface through which the subscriber is connected.
|
Downlink VRF
|
VRF associated with the port bundle.
|
Port-mappings
|
Port maps in the port bundle.
|
Subscriber Port
|
Subscriber port number.
|
Mapped Port
|
Port assigned by SSG.
|
Related Commands
Command
|
Description
|
show ssg port-map status
|
Displays information on port bundles.
|
show ssg port-map status
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg port-map status command is not available in Cisco IOS software.
To display information on port bundles, use the show ssg port-map status command in privileged EXEC mode.
show ssg port-map status [free | reserved | inuse]
Syntax Description
free
|
(Optional) Lists the port bundles that are in the "free" state for each bundle group.
|
reserved
|
(Optional) Lists the port bundles that are in the "reserved" state for each bundle group. Also displays the associated subscriber IP address and interface for each port bundle.
|
inuse
|
(Optional) Lists the port bundles that are in the "inuse" state for each bundle group. Also displays the associated subscriber IP address and interface for each port bundle.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(2)B
|
This command was introduced on the Cisco 6400 series.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Entered without any keywords, the command displays a summary of all port-bundle groups, including the following information:
•
A list of port-bundle groups
•
Port-bundle length
•
Number of free, reserved, and in-use port bundles in each group
Examples
Display All Bundles Example
The following example shows output for the show ssg port-map status command with no keywords:
Router# show ssg port-map status
IP Address Free Bundles Reserved Bundles In-use Bundles
Table 12 describes the significant fields shown in the display.
Table 12 show ssg port-map status Field Descriptions
Field
|
Description
|
Bundle-length
|
The bundle-length value indicates the number of ports per bundle and the number of bundles per bundle group.
|
Bundle-groups
|
List of bundle groups.
|
IP Address
|
IP address of a bundle group.
|
Free Bundles
|
Number of free bundles in the specified bundle group.
|
Reserved Bundles
|
Number of reserved bundles in the specified bundle group.
|
In-use Bundles
|
Number of in-use bundles in the specified bundle group.
|
Display In-Use Bundles Example
The following example shows output for the show ssg port-map status command with the inuse keyword:
Router# show ssg port-map status inuse
Bundle-group 10.13.60.2 has the following in-use port-bundles:-
Port-bundle Subscriber Address Interface
64 10.10.3.1 Virtual-Access2
Table 13 describes the significant fields shown in the display.
Table 13 show ssg port-map status inuse Field Descriptions
Field
|
Description
|
Port-bundle
|
Port-bundle number.
|
Subscriber Address
|
Subscriber IP address of the subscriber.
|
Interface
|
Interface through which the subscriber is connected.
|
Related Commands
Command
|
Description
|
show ssg port-map ip
|
Displays information on a particular port bundle.
|
show ssg prepaid default-quota
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg prepaid default-quota command is not available in Cisco IOS software.
To display the values of the Service Selection Gateway (SSG) prepaid default quota counters, use the show ssg prepaid default-quota command in privileged EXEC mode.
show ssg prepaid default-quota
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.3(11)T
|
This command was introduced.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
SSG maintains two counters to keep track of the number of times the SSG prepaid default quota has been allotted. One counter is for the total number of default quotas allotted by SSG (irrespective of how many times the prepaid server has become available and unavailable). The other counter keeps track of the number of default quotas allotted by SSG during the latest instance of prepaid server unavailability.
Note that the value of the counter for currently allocated default quotas will be zero when the prepaid billing server is available. The counter for currently allocated default quotas restarts at 1 each time the prepaid billing server becomes unavailable.
The clear ssg prepaid default-quota command clears the SSG default quota counters.
Examples
The following example shows sample output for the show ssg prepaid default-quota command:
Router# show ssg prepaid default-quota
### Total default quotas allocated since this counter was last cleared:10
Default Quota Threshold:100
Currently allocated Default Quotas:4
Table 14 describes the significant fields shown in the display.
Table 14 show ssg prepaid default-quota Field Descriptions
Field
|
Description
|
Total default quotas allocated since this counter was last cleared
|
Total number of default quotas allocated by SSG since the last time the clear ssg prepaid default-quota command was entered.
|
Default Quota Threshold
|
The maximum number of default quotas that SSG will allocate each time the prepaid billing server is unavailable. This value can be configured by using the ssg prepaid threshold command.
|
Currently allocated Default Quotas
|
Number of default quotas allocated by SSG during the current instance of prepaid billing server unavailability.
|
Related Commands
Command
|
Description
|
clear ssg prepaid default-quota
|
Clears the SSG prepaid default quota counters.
|
ssg prepaid threshold
|
Configures an SSG prepaid threshold value.
|
show ssg radius-proxy
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg radius-proxy command is not available in Cisco IOS software.
To display a list of all RADIUS proxy clients, details of a particular RADIUS proxy client, or the pool of IP addresses configured for a router or for a specific domain, use the show ssg radius-proxy command in privileged EXEC mode.
show ssg radius-proxy [ip-address [vrf vrf-name]] | [address-pool [domain domain-name] [free |
inuse]]
Syntax Description
ip-address
|
(Optional) Details for the RADIUS proxy client at this IP address.
|
vrf vrf-name
|
(Optional) Details for the RADIUS proxy client associated with the specified VPN routing/forwarding (VRF) instance.
|
address-pool
|
(Optional) IP addresses configured in an IP pool.
|
domain
|
(Optional) IP addresses configured for a specific domain.
|
domain-name
|
(Optional) Name of the domain to display.
|
free
|
(Optional) IP addresses currently available in the free pool.
|
inuse
|
(Optional) IP addresses currently in use.
|
Command Default
Displays a list of RADIUS proxy clients.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.2(15)B
|
This command was enhanced to allow display of a list of RADIUS proxy clients.
|
12.3(4)T
|
The enhancements from Cisco IOS Release 12.2(15)B were integrated into Cisco IOS Release 12.3(4)T.
|
12.3(11)T
|
This command was enhanced to display information about VRFs associated with RADIUS proxy clients.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use the show ssg radius-proxy command without any keywords or arguments to display a list of RADIUS proxy clients. This command also displays the IP addresses, device types, timers, and the number of proxy users for each proxy client. Use the ip-address argument to display the full list of proxy users for the specified RADIUS proxy client.
Use the address-pool keyword to display the IP address pools configured for a router or for a specific domain. You can also display which IP addresses are available or are in use.
Examples
The following example shows how to display a list of RADIUS proxy clients:
Router# show ssg radius-proxy
::::: SSG RADIUS CLIENT TABLE :::::
Client IP VRF Device type Users
The following example shows how to display details about the RADIUS proxy client at IP address 172.16.0.0:
Router# show ssg radius-proxy 172.16.0.0
::::: SSG RADIUS PROXY LOGON TABLE :::::
User SessionID Host IP Timer IP Tech
user1 12345678 50.0.0.100 None Simple
user1 12345679 (no host) None Mobile
The following example shows how to display information for IP addresses in the IP address pool:
Router# show ssg radius-proxy address-pool
Global Pool: Free Addresses= 10234 Inuse Addresses= 0
The following example shows how to display information about the IP addresses in the IP address pool in the domain called "ssg.com":
Router# show ssg radius-proxy address-pool domain ssg.com
Domain Pool(ssg.com): Free Addresses= 20 Inuse Addresses= 10
The following example shows how to display information about the IP addresses in the IP address pool for the domain called "ssg.com" that are currently in use:
Router# show ssg radius-proxy address-pool domain ssg.com inuse
Inuse Addresses in Domain Pool(ssg.com):10
The following example shows how to display information about the IP addresses in the IP
address pool for the domain called "ssg.com" that are currently available:
Router# show ssg radius-proxy address-pool domain ssg.com free
Free Addresses in Domain Pool(ssg.com):20
Table 15 describes significant fields shown in the displays.
Table 15 show ssg radius-proxy Field Descriptions
Field
|
Description
|
Client IP
|
IP address of the client device.
|
VRF
|
Name of the VRF associated with a RADIUS proxy client. The value "Global" indicates that the client is not associated with a VRF.
|
Device type
|
Type of client device. Device types can be PDSN, HA, or Generic (for non-CDMA2000 devices).
|
Users
|
Number of users connected to client device.
|
User
|
The user name for the end user.
|
SessionID
|
A numeric string derived from the attribute specified as the "Session-Identifier".
|
Host IP
|
IP address of the user.
|
Timer
|
Timer type can be "None", "Wait for IP", "Hand-off" or "Wait for MSID".
|
IP Tech
|
IP technology: simple or mobile.
|
Related Commands
Command
|
Description
|
debug radius
|
Displays information associated with RADIUS.
|
debug ssg ctrl-errors
|
Displays all error messages for control modules.
|
debug ssg ctrl-event
|
Displays all event messages for control modules.
|
debug ssg ctrl-packet
|
Displays packet contents handled by control modules.
|
debug ssg data
|
Displays all data-path packets.
|
show ssg binding
|
Displays service names that have been bound to interfaces and the interfaces to which they have been bound.
|
show ssg connection
|
Displays the connections of a given host and a service name.
|
show ssg service
|
Displays the information for a service.
|
show ssg service
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg service command is not available in Cisco IOS software.
To display the information for a Service Selection Gateway (SSG) service, use the show ssg service command in privileged EXEC mode.
show ssg service [service-name [begin expression | exclude expression | include expression]]
Syntax Description
service-name
|
(Optional) Name of an active Service Selection Gateway (SSG) service.
|
begin
|
(Optional) Begin with the line that contains expression.
|
expression
|
(Optional) Word or phrase used to determine what lines will be shown.
|
exclude
|
(Optional) Exclude lines that contain expression.
|
include
|
(Optional) Include lines that contain expression.
|
Command Default
If no service name is provided, the command displays information for all services.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(3) DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.1(1) DC1
|
The output of this command was modified on the Cisco 6400 node route processor to display the following Service-Info Attributes when they are present in the proxy RADIUS service profile:
• Service-Defined Cookie
• Full Username Attribute
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.3(1a)BW
|
This command was modified to display the attribute filter that is set in the service profile.
|
12.3(3)B
|
The modifications in Release 12.3(1a)BW were integrated into Cisco IOS Release 12.3(3)B. The output for this command was modified to display information about default DNS redirection.
|
12.3(7)T
|
The modifications in Release 12.3(3)B were integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display connection information for a service.
Examples
L2TP Tunnel Service: Example
The following example shows the information for the L2TP tunnel service called "tunnel1". The attribute filter that is set in the service profile can be seen in the output.
Router# show ssg service tunnel1
------------------------ ServiceInfo Content -----------------------
Service Session Timeout: 0 seconds
Service Idle Timeout: 0 seconds
Service refresh timeleft: 99 minutes
No Authorization Required
Authentication Type: CHAP
Session policing disabled
No Radius server group created. No remote Radius servers.
HomeGateway Addresses: 172.0.0.1
Domain List: Included Network Segments:
1 : RealIP=172.0.1.1, Subscriber=10.0.1.1
------------------------ End of ServiceInfo Content ----------------
Proxy Service: Example
The following example shows information for the proxy service called "serv1-proxy":
Router# show ssg service serv1-proxy
------------------------ ServiceInfo Content -----------------------
Service Session Timeout:0 seconds
Service Idle Timeout:0 seconds
Next Hop Gateway Key:my-key
DNS Server(s):Primary:10.13.1.5
Radius Server:IP=10.13.1.2, authPort=1645, acctPort=1646, secret=my-secret
Included Network Segments:
Excluded Network Segments:
Service Defined Cookie exist
Domain List:service1.com;
1 :Virtual=255.255.255.255, Subscriber=10.20.10.2
------------------------ End of ServiceInfo Content ----------------
Table 16 describes the significant fields shown in the display.
Table 16 show ssg service Field Descriptions
Field
|
Description
|
Uplink IDB
|
Interface through which the service is reachable.
|
Name
|
Service name.
|
Type
|
Type of service.
|
Mode
|
One of the following values:
Concurrent—user can log into this service and other services simultaneously.
Sequential—user cannot log into this service simultaneously with other services.
|
Service Session Timeout
|
Period of time after which the session (SSG connection) will be terminated.
|
Service Idle Timeout
|
If the session (SSG connection) is idle for this many seconds, the session will be terminated.
|
Service refresh timeleft
|
Amount of time after which SSG will refresh the service profile.
|
Authentication Type
|
Type of authentication that will be used for proxy or tunnel services. Values are PAP and CHAP.
|
Attribute Filter
|
RADIUS attribute that is being filtered out from user authentication.
|
Next Hop Gateway Key
|
Defines the next-hop binding. Services can be bound to the next hop using next-hop gateways. The key to next-hop-gateway mapping is present in the next-hop profile.
|
DNS Server(s)
|
DNS server used for this service.
|
TunnelId
|
ID for tunneling services.
|
TunnelPassword
|
Password for tunneling services.
|
HomeGateway Addresses
|
IP address of the LNS.
|
Radius Server:
IP authPort acctPort secret
|
Information about the RADIUS server where proxy users are authenticated for service connectivity.
|
Included Network Segments
|
IP address subnets that form the service network.
|
Excluded Network Segments
|
IP address subnets that are excluded from the service network.
|
Full User Name Used
|
Indicates that the RADIUS authentication and accounting requests use the full username (user@service).
|
Service Defined Cookie exist
|
Indicates that user-defined information is included in RADIUS authentication and accounting requests.
|
Domain List
|
List of domain names that belong to the service and can be resolved by the DNS server specified for this service.
|
Active Connections
Virtual Subscriber
|
Lists the host IP address for active connections. The subscriber IP address is the IP address of the host. In cases where there is a service-defined NAT, the virtual IP address is not zero and is the IP address given by the service.
|
Related Commands
Command
|
Description
|
clear ssg service
|
Removes a service.
|
show ssg binding
|
Displays service names that have been bound to interfaces and the interfaces to which they have been bound.
|
ssg bind service
|
Specifies the interface for a service.
|
show ssg summary
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg summary command is not available in Cisco IOS software.
To display a summary of the Service Selection Gateway (SSG) configuration, use the show ssg summary command in user EXEC or privileged EXEC mode.
show ssg summary
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(16)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display information such as which SSG features are enabled, how many users are active, how many services are active, and what filters are active.
Examples
The following example shows the show ssg summary command:
TCP Redirect: Unauthenticated, Service, Captive portal.
QOS: User policing, Session Policing.
Related Commands
Command
|
Description
|
show ssg binding
|
Displays service names that have been bound to interfaces and the IP addresses to which they have been bound.
|
show ssg direction
|
Displays the direction of all interfaces for which a direction has been specified.
|
show ssg interface
|
Displays information about SSG interfaces.
|
show ssg tcp-redirect group
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg tcp-redirect group command is not available in Cisco IOS software.
To display information about the captive portal groups and the networks associated with those portal groups, use the show ssg tcp-redirect group command in privileged EXEC mode.
show ssg tcp-redirect group [group-name]
Syntax Description
group-name
|
(Optional) The previously defined name for the captive portal group.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced. This command replaced the show ssg http-redirect group command.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.3(1a)BW
|
This command was modified to display the access lists that are associated with TCP redirection.
|
12.3(3)B
|
The modifications in Release 12.3(1a)BW were integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
The modifications in Release 12.3(3)B were integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display information about the captive portal groups and their associated networks as defined in your system.
If you omit the optional group-name argument, this command displays a list of all defined captive portal groups. If you specify the group-name argument, this command displays information about that group and its associated networks.
Examples
The following example shows how to display a list of all of the defined captive portal groups:
Router# show ssg tcp-redirect group
Current TCP redirect groups:
Default unauthenticated user redirect group: None Set
Default service redirect group: None Set
Prepaid user default redirect group: None Set
SMTP forwarding group: None Set
Default initial captivation group: None Set
Default advertising captivation group: None Set
Table 17 describes the significant fields shown in the display.
Table 17 show ssg tcp-redirect group Field Descriptions
Field
|
Description
|
Current TCP redirect groups
|
List of all TCP-redirect groups.
|
Default access-list
|
Name of the default access-list.
|
Default unauthenticated user redirect group
|
Name of the captivation group to which unauthenticated users are redirected.
|
Default service redirect group
|
Default service redirect group.
|
Prepaid user default redirect group
|
Name of the captivation group to which prepaid users are redirected.
|
SMTP forwarding group
|
SMTP redirection settings.
|
Default initial captivation group
|
Name of the default initial captivation group and duration of captivation.
|
Default advertising captivation group
|
Name of the default advertising captivation group and duration and frequency of advertising captivation.
|
The following example shows how to display a detailed description of the captive portal group called "RedirectServer":
Router# show ssg tcp-redirect group RedirectServer
TCP redirect group RedirectServer:
Showing all TCP servers (Address, Port):
10.2.36.253, 8080, FastEthernet0/0
Networks to redirect to (network-list RedirectNw):
Table 18 describes the significant fields shown in the display.
Table 18 show ssg tcp-redirect group group-name Field Descriptions
Field
|
Description
|
Showing all TCP servers (Address, Port)
|
List of all servers.
|
10.2.36.253
|
Server IP address.
|
8080
|
Server port number.
|
FastEthernet0/0
|
Interface on which this server is reachable.
|
Networks to redirect to
|
List of networks.
|
(network-list RedirectNw)
|
Network list name.
|
TCP port to redirect
|
Name of port list (if port list is used).
|
Related Commands
Command
|
Description
|
debug ssg tcp-redirect
|
Turns on debug information for the SSG TCP Redirect for Services feature.
|
network (ssg-redirect)
|
Adds an IP address to a named network list.
|
network-list
|
Defines a list of one or more IP networks that make up a named network list.
|
port (ssg-redirect)
|
Adds a TCP port to a named port list.
|
port-list
|
Defines a list of one or more TCP ports that make up a named port list and enters SSG-redirect-port configuration mode.
|
redirect captivate advertising default group
|
Configures the default captive portal group and duration and frequency for advertising.
|
redirect captivate initial default group duration
|
Selects a default captive portal group and duration of the initial captivation of users on account logon.
|
redirect port to
|
Marks a TCP port or named TCP port list for SSG TCP redirection.
|
redirect smtp group
|
Selects a captive portal group for redirection of SMTP traffic.
|
redirect unauthenticated-user to
|
Redirects the traffic from authenticated users to a specified captive portal group.
|
redirect unauthorized-service to
|
Sets a list of destination IP networks that can be redirected by a specified named captive portal group.
|
server (SSG)
|
Adds a server to a captive portal group.
|
server-group
|
Defines the group of one or more servers that make up a named captive portal group and enters SSG-redirect-group configuration mode.
|
show tcp-redirect mappings
|
Displays information about the TCP redirect mappings for hosts within your system.
|
ssg tcp-redirect
|
Enables SSG TCP redirect and enters SSG-redirect mode.
|
show ssg user transparent
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg user transparent command is not available in Cisco IOS software.
To display a list of all the Service Selection Gateway (SSG) transparent autologon users, use the show ssg user transparent command in privileged EXEC mode.
show ssg user transparent
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.3(1a)BW
|
This command was introduced.
|
12.3(3)B
|
This command was integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
This command was integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display the IP addresses and the states of all transparent autologon users that are active on SSG. The transparent autologon user states are passthrough (TP), suspect (SP), unidentified (NR), and waiting for authorization (WA).
Examples
The following is sample output from the show ssg user transparent command:
Router# show ssg user transparent
10.120.120.120 Authorizing
### Total number of transparent users: 3
Related Commands
Command
|
Description
|
ssg login transparent
|
Enables the SSG Transparent Autologon feature.
|
show ssg user transparent authorizing
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg user transparent authorizing command is not available in Cisco IOS software.
To display a list of all Service Selection Gateway (SSG) transparent autologon users for whom authorization is in progress and who are waiting for authentication, authorization, and accounting (AAA) server response, use the show ssg user transparent authorizing command in privileged EXEC mode.
show ssg user transparent authorizing [count]
Syntax Description
count
|
(Optional) Displays the number of authorizing users.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.3(1a)BW
|
This command was introduced.
|
12.3(3)B
|
This command was integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
This command was integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display all SSG transparent autologon users that are waiting for authorization (WA).
Examples
The following is sample output from the show ssg user transparent authorizing command with the count keyword:
Router# show ssg user transparent authorizing count
### Total number of WA users : 1
Related Commands
Command
|
Description
|
ssg login transparent
|
Enables the SSG Transparent Autologon feature.
|
show ssg user transparent passthrough
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg user transparent passthrough command is not available in Cisco IOS software.
To display information about Service Selection Gateway (SSG) transparent autologon pass-through users, use the show ssg user transparent passthrough command in privileged EXEC mode.
show ssg user transparent passthrough [ip-address | count]
Syntax Description
ip-address
|
(Optional) Display details for specified user IP address.
|
count
|
(Optional) Displays the number of pass-through users.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.3(1a)BW
|
This command was introduced.
|
12.3(3)B
|
This command was integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
This command was integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display all SSG transparent autologon pass-through (TP) users that are active on SSG.
Examples
The following is sample output from the show ssg user transparent passthrough command for the user having IP address 10.10.10.10:
Router# show ssg user transparent passthrough 10.10.10.10
User IP Address : 10.10.10.10
Session Timeout : 200 (seconds)
Idle Timeout : 100 (seconds)
User logged on since : *16:33:57.000 GMT Mon May 19 2003
User last activity at : *16:33:57.000 GMT Mon May 19 2003
Current Time : *16:35:17.000 GMT Mon May 19 2003
Related Commands
Command
|
Description
|
ssg login transparent
|
Enables the SSG Transparent Autologon feature.
|
show ssg user transparent suspect
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg user transparent suspect command is not available in Cisco IOS software.
To display a list of all Service Selection Gateway (SSG) transparent autologon suspect (SP) user IP addresses, use the show ssg user transparent suspect command in privileged EXEC mode.
show ssg user transparent suspect [count]
Syntax Description
count
|
(Optional) Displays the number of suspect users.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.3(1a)BW
|
This command was introduced.
|
12.3(3)B
|
This command was integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
This command was integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
An SSG transparent autologon suspect user is a user whose authentication, authorization, and accounting (AAA) authorization resulted in an Access Reject.
Examples
The following is sample output from the show ssg user transparent suspect command with and without the count keyword:
Router# show ssg user transparent suspect count
### Total number of SP users : 1
Router# show ssg user transparent suspect
### Total number of SP users : 1
Related Commands
Command
|
Description
|
ssg login transparent
|
Enables the SSG Transparent Autologon feature.
|
show ssg user transparent unidentified
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg user transparent unidentified command is not available in Cisco IOS software.
display a list of Service Selection Gateway (SSG) transparent autologon users for whom there is no response from the authentication, authorization, and accounting (AAA) server to an authorization request (unidentified users), use the show ssg user transparent unidentified command in privileged EXEC mode.
show ssg user transparent unidentified [count]
Syntax Description
count
|
(Optional) Displays the number of unidentified (NR) users.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.3(1a)BW
|
This command was introduced.
|
12.3(3)B
|
This command was integrated into Cisco IOS Release 12.3(3)B.
|
12.3(7)T
|
This command was integrated into Cisco IOS Release 12.3(7)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display all SSG transparent autologon unidentified (NR) users that are active on the SSG.
Examples
The following is sample output from the show ssg user transparent unidentified command with and without the count keyword:
Router# show ssg user transparent unidentified count
### Total number of NR (Unidentified) users : 1
Router# show ssg user transparent unidentified
### Total number of NR (Unidentified) users : 1
Related Commands
Command
|
Description
|
ssg login transparent
|
Enables the SSG Transparent Autologon feature.
|
show ssg vc-service-map
Note
Effective with Cisco IOS Release 15.0(1)M, the show ssg vc-service-map command is not available in Cisco IOS software.
To display virtual circuit (VC)-to-service-name mappings, use the show ssg vc-service-map command in privileged EXEC mode.
show ssg vc-service-map [vpi/vci | service service-name]
Syntax Description
vpi/vci
|
(Optional) Virtual path identifier (VPI)/virtual channel identifier (VCI) value, including the slash; for example, 3/33.
|
service
|
(Optional) Displays the VCs mapped to a service name.
|
service-name
|
(Optional) Service name.
|
Command Modes
Privileged EXEC (#)
Command History
Release
|
Modification
|
12.0(5)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to display VC-to-service-name mappings.
Examples
The following example shows the VCs mapped to the service name "Worldwide":
Router# show ssg vc-service-map service Worldwide
Interface From To Service Name Type
All 3 /33 None Worldwide non-exclusive
Related Commands
Command
|
Description
|
ssg vc-service-map
|
Maps VCs to service names.
|
source ip
Note
Effective with Cisco IOS Release 15.0(1)M, the source ip command is not available in Cisco IOS software.
To specify Service Selection Gateway (SSG) source IP addresses to which to map the destination IP addresses in subscriber traffic, use the source ip command in SSG portmap configuration mode. To remove this specification, use the no form of this command.
source ip {ip-address | interface}
no source ip {ip-address | interface}
Syntax Description
ip-address
|
SSG source IP address.
|
interface
|
Interface whose main IP address is used as the SSG source IP address.
|
Command Default
No default behavior or values.
Command Modes
SSG portmap configuration
Command History
Release
|
Modification
|
12.2(16)B
|
This command was introduced. This command replaces the ssg port-map source ip command.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
With the SSG Port-Bundle Host Key feature, SSG maps the destination IP addresses in subscriber traffic to specified SSG source IP addresses.
All SSG source IP addresses configured with the source ip command must be routable in the management network where the Cisco Service Selection Dashboard (SSD) or Subscriber Edge Services Manager (SESM) resides.
If the interface for the source IP address is deleted, the port-map translations will not work correctly.
Because a subscriber can have several simultaneous TCP sessions when accessing a web page, SSG assigns a bundle of ports to each subscriber. Because the number of available port bundles is limited, you can assign multiple SSG source IP addresses (one for each group of port bundles). By default, each group has 4032 bundles, and each bundle has 16 ports. To modify the number of bundles per group and the number of ports per bundle, use the length command.
Examples
The following example shows the SSG source IP address specified with an IP address and with specific interfaces:
ssg port-map source ip Loopback 1
Related Commands
Command
|
Description
|
length (SSG)
|
Modifies the port-bundle length upon the next SSG reload.
|
ssg port-map
|
Enables the SSG port-bundle host key and enters SSG portmap configuration mode.
|
ssg aaa group prepaid
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg aa group prepaid command is not available in Cisco IOS software.
To specify the server group to be used for Service Selection Gateway (SSG) prepaid authorization, use the ssg aaa group prepaid command in global configuration mode. To remove this specification, use the no form of this command.
ssg aaa group prepaid server-group
no ssg aaa group prepaid server-group
Syntax Description
server-group
|
Name of the server group to be used for SSG prepaid authorization.
|
Command Default
If a server group is not specified by using the ssg aaa group prepaid command, the default RADIUS server configured on the router will be used for SSG prepaid authorization.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.2(16)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
The ssg aaa group prepaid command allows you to configure a global server for SSG prepaid authorization. Configure the global server group by using the aaa group server radius command. Use the ssg aaa group prepaid command to attach the server group to SSG for SSG prepaid authorization.
Examples
The following example shows how to configure a global SSG prepaid authorization server:
aaa group server radius ssg_prepaid
server 10.2.3.4 auth-port 1645 acct-port 1646
ssg aaa group prepaid ssg_prepaid
Related Commands
Command
|
Description
|
aaa group server radius
|
Groups different RADIUS server hosts into distinct lists and distinct methods.
|
ssg accounting
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg accounting command is not available in Cisco IOS software.
To enable Service Selection Gateway (SSG) accounting, use the ssg accounting command in global configuration mode. To disable SSG accounting, use the no form of this command.
ssg accounting [per-host] [per-service] [interval seconds] [{stop rate-limit records}]
no ssg accounting [per-host] [per-service] [interval seconds] [{stop rate-limit records}]
Syntax Description
per-host
|
(Optional) Enables the sending of per-host accounting records only.
|
per-service
|
(Optional) Enables the sending of per-service accounting records only.
|
interval
|
(Optional) Specifies the interval at which accounting updates are sent to the accounting server.
|
seconds
|
(Optional) Number of seconds after which an accounting update will be sent to the accounting server. The range is from 60 to 2,147,483,647 seconds, in increments of 60 seconds. The value entered will be rounded up to the next multiple of 60. Default is 600.
|
stop
|
(Optional) Enables rate-limiting of SSG accounting records.
|
rate-limit
|
(Optional) Specifies the number of accounting records sent per second.
|
records
|
(Optional) Number of accounting stop records sent per second. The range is from 10 to 5000.
|
Command Default
Accounting is enabled.
The interval is set at 600 seconds.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.0(5)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.2(16)B
|
The per-host and per-service keywords were added.
|
12.3(4)T
|
The per-host and per-service keywords were integrated into Cisco IOS Release 12.3(4)T.
|
12.3(14)T
|
The stop and rate-limit keywords and the records argument were integrated into Cisco IOS Release 12.3(14)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
The ssg accounting command enables the sending of start, stop, and interim accounting records for hosts and connections.
Examples
The following example shows how to enable the sending of per-host SSG accounting records at intervals of 60 seconds:
ssg accounting per-host interval 60
ssg attribute 44 suffix host ip
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg attribute 44 suffix host ip command is not available in Cisco IOS software.
To enable the appending of a client IP address to an accounting session ID to create a unique SSG accounting session ID, use the ssg attribute 44 suffix host ip command in global configuration mode. To disable the appending of the IP address, use the no form of this command.
ssg attribute 44 suffix host ip
no ssg attribute 44 suffix host ip
Syntax Description
This command has no arguments or keywords.
Command Default
SSG does not append the client IP address to the accounting session ID.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.2(16)B
|
This command was introduced.
|
12.3(4)T
|
This command was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use the ssg attribute 44 suffix host ip command to create a unique session ID by appending the client's IP address to the RADIUS accounting session number (acct-session-id). This functionality applies to accounting packets generated by SSG for host accounting or connection accounting records.
Examples
The following example enables the SSG unique session ID:
ssg attribute 44 suffix host ip
Related Commands
Command
|
Description
|
ssg accounting
|
Enables SSG accounting.
|
ssg auto-domain
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg auto-domain command is not available in Cisco IOS software.
To enable Service Selection Gateway (SSG) Autodomain, use the ssg auto-domain command in global configuration mode. To remove all Autodomain configuration from the running configuration and to prevent further activation of autodomains, use the no form of this command.
ssg auto-domain
no ssg auto-domain
Syntax Description
This command has no arguments or keywords.
Command Default
Autodomain is disabled by default.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
To enable SSG Autodomain, use this command in global configuration mode. SSG must be enabled before the ssg auto-domain command can be entered.
Note
The ssg auto-domain command enables basic Autodomain. In basic Autodomain, the profile downloaded from the AAA server for the Autodomain name is a service profile (either with or without SSG-specific attributes). By default, an attempt is made to find a valid service profile first based on Access Point Name (APN), then based on username. Use the mode extended command to configure Autodomain extended mode.
Use the no ssg auto-domain command to prevent further activations of autodomains and to remove all Autodomain configuration from the running-configuration. Subsequent reissuing of the ssg auto-domain command restores Autodomain to its former state.
Examples
The following example enables basic SSG Autodomain:
Related Commands
Command
|
Description
|
download exclude-profile
|
Adds to the Autodomain download exclusion list.
|
exclude
|
Configures the Autodomain exclusion list.
|
mode extended
|
Enables extended mode for SSG Autodomain.
|
nat user-address
|
Enables NAT on Autodomain tunnel service.
|
select
|
Configures the Autodomain selection mode.
|
show ssg auto-domain exclude-profile
|
Displays the contents of an Autodomain exclude-profile downloaded from the AAA server.
|
ssg enable
|
Enables SSG functionality.
|
ssg auto-logoff arp
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg auto-logoff arp command is not available in Cisco IOS software.
To configure Service Selection Gateway (SSG) to automatically log off hosts that have lost connectivity with SSG and to use the Address Resolution Protocol (ARP) ping mechanism to detect connectivity, use the ssg auto-logoff arp command in global configuration mode. To disable SSG Autologoff, use the no form of this command.
ssg auto-logoff arp [match-mac-address] [interval seconds]
no ssg auto-logoff arp
Syntax Description
match-mac-address
|
(Optional) Configures SSG to check the MAC address of a host each time that host performs an ARP ping.
|
interval seconds
|
(Optional) ARP ping interval, in seconds. The interval specified is rounded to the nearest multiple of 30. An interval of less than 30 is rounded up to 30 seconds. The default interval is 30 seconds.
|
Command Default
SSG autologoff is not enabled by default.
The default ARP ping interval is 30 seconds.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.2(15)B
|
The match-mac-address keyword was added.
|
12.3(4)T
|
The match-mac-address keyword was integrated into Cisco IOS Release 12.3(4)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use the ssg auto-logoff arp command to configure SSG to use the ARP ping mechanism to detect connectivity to hosts. Use the optional match-mac-address keyword to configure SSG to check the MAC address of a host each time that host performs an ARP ping. If the SSG finds that the MAC address of the host has changed, SSG automatically initiates the logoff of that host.
Note
ARP ping should be used only in deployments in which all hosts are directly connected to SSG through a broadcast interface (such as an Ethernet interface) or a bridged interface (such as a routed bridge encapsulation (RBE) or an integrated routing and bridging (IRB) interface).
ARP request packets are smaller than Internet Control Message Protocol (ICMP) ping packets, so it is recommended that you configure SSG autologoff to use ARP ping in cases in which hosts are directly connected.
ICMP ping can be used in all types of deployments. Refer to the ssg auto-logoff icmp command reference page for more information about SSG autologoff using ICMP ping.
ARP ping will work only on hosts that have a MAC address. ARP ping will not work for PPP users because they do not have a MAC table entry.
ARP ping does not support overlapping IP addresses.
SSG autologoff that uses the ARP ping mechanism will not work for hosts with static ARP entries.
You can use only one method of SSG autologoff at a time: ARP ping or ICMP ping. If you configure SSG to use ARP ping after ICMP ping has been configured, the ICMP ping function will become disabled.
Examples
The following example shows how to enable SSG autologoff and to configure SSG to use ARP ping to detect connectivity to hosts:
ssg auto-logoff arp interval 60
The following example shows how to enable SSG MAC address checking for autologoff:
ssg auto-logoff arp match-mac-address
The following example shows how to enable SSG MAC address checking for autologoff and to specify an ARP ping interval of 60 seconds:
ssg auto-logoff arp match-mac-address interval 60
Related Commands
Command
|
Description
|
ssg auto-logoff icmp
|
Configures the SSG to automatically log off hosts that have lost connectivity with SSG and to use the ICMP ping mechanism to detect connectivity.
|
ssg auto-logoff icmp
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg auto-logoff icmp command is not available in Cisco IOS software.
To configure Service Selection Gateway (SSG) to automatically log off hosts that have lost connectivity with SSG and to use the Internet Control Message Protocol (ICMP) ping mechanism to detect connectivity, use the ssg auto-logoff icmp command in global configuration mode. To disable SSG autologoff, use the no form of this command.
ssg auto-logoff icmp [timeout milliseconds] [packets number] [interval seconds]
no auto-logoff icmp
Syntax Description
timeout milliseconds
|
(Optional) ICMP ping response timeout. The default is 500 milliseconds.
|
packets number
|
(Optional) Number of ICMP ping packets that will be sent after a ping packet indicates that a host is unreachable. The default is 2 packets.
|
interval seconds
|
(Optional) ICMP ping interval, in seconds. The interval specified will be rounded to the nearest multiple of 30. An interval less than 30 will be rounded up to 30 seconds. The default interval is 30 seconds.
|
Command Default
SSG autologoff is not enabled.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.2(4)B
|
This command was introduced.
|
12.2(13)T
|
This command was integrated into Cisco IOS Release 12.2(13)T.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
When the ssg auto-logoff icmp command is specified, SSG will use the ICMP ping mechanism to detect connectivity to hosts.
Note
ICMP ping may be used in all types of deployment situations.
ICMP ping supports overlapping IP addresses.
If a user is not reachable, a configured number of packets (p) will be sent, and each packet will be timed out (t). The user will be logged off in p * t milliseconds after the first pinging attempt. If p * t milliseconds is greater than the configured pinging interval, then the time taken to log off the host after connectivity is lost will be greater than the configured autologoff interval. If parameters are configured this way, the following warning will be issued: "Hosts will be auto-logged off (p * t) msecs after connectivity is lost." When the pinging interval is less than p * t, the timeout process for a host that has become unreachable will be invoked when the pinging to that host is still occurring. However, because the timeout process will check the status of the host object and find that it is in a pinging state, the host will not be pinged again.
You can use only one method of SSG autologoff at a time: Address Resolution Protocol (ARP) ping or ICMP ping. If you configure SSG to use ARP ping after ICMP ping has been configured, the ICMP ping function will become disabled.
Default values will be applied if a value of zero is configured for any parameters.
The ssg auto-logoff arp command will configure SSG to use the ARP ping mechanism to detect connectivity to hosts. ARP ping should be used only in deployment situations in which all hosts are directly connected to the SSG through a broadcast interface such as an Ethernet interface or a bridged interface such as a routed bridge encapsulation or an integrated routing and bridging interface.
ARP request packets are smaller than ICMP ping packets, so it is recommended that you configure SSG autologoff to use ARP ping in situations in which hosts are directly connected. For more information about SSG autologoff that uses ARP ping, see the ssg auto-logoff arp command reference page.
Examples
The following example shows how to enable SSG autologoff. SSG will use ICMP ping to detect connectivity to hosts.
Router(config)# ssg auto-logoff icmp interval 60 timeout 300 packets 3
Related Commands
Command
|
Description
|
ssg auto-logoff arp
|
Configures the SSG to automatically log off hosts that have lost connectivity with SSG and to use the ARP ping mechanism to detect connectivity.
|
ssg bind direction
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg bind direction command is not available in Cisco IOS software.
Note
Effective with Cisco IOS Release 12.2(16)B, this command was replaced by the ssg direction command. The ssg bind direction command is still supported for backward compatibility, but support for this command may be removed in a future Cisco IOS release.
To specify an interface as a downlink or uplink interface, use the ssg bind direction command in global configuration mode. To disable the directional specification for the interface, use the no form of this command.
ssg bind direction {downlink | uplink} {ATM atm-interface | Async async-interface | BVI
bvi-interface | Dialer dialer-interface | Ethernet ethernet-interface | FastEthernet
fastethernet-interface | Group-Async group-async-interface | Lex lex-interface | Loopback
loopback-interface | Multilink multilink-interface | Null null-interface | Port-channel
port-channel-interface | Tunnel tunnel-interface | Virtual-Access virtual-access-interface |
Virtual-Template virtual-template-interface | Virtual-TokenRing
virtual-tokenring-interface}
no ssg bind direction {downlink | uplink} {ATM atm-interface | Async async-interface | BVI
bvi-interface | Dialer dialer-interface | Ethernet ethernet-interface | FastEthernet
fastethernet-interface | Group-Async group-async-interface | Lex lex-interface | Loopback
loopback-interface | Multilink multilink-interface | Null null-interface | Port-channel
port-channel-interface | Tunnel tunnel-interface | Virtual-Access virtual-access-interface |
Virtual-Template virtual-template-interface | Virtual-TokenRing
virtual-tokenring-interface}
Syntax Description
downlink
|
Specifies interface direction as downlink.
|
uplink
|
Specifies interface direction as uplink.
|
ATM
|
Indicates that the interface is ATM.
|
atm-interface
|
ATM interface.
|
Async
|
Indicates that the interface is asynchronous.
|
async-interface
|
Async interface.
|
BVI
|
Indicates that the interface is BVI.
|
bvi-interface
|
Bridge-Group Virtual Interface.
|
Dialer
|
Indicates that the interface is dialer.
|
dialer-interface
|
Dialer interface.
|
Ethernet
|
Indicates that the interface is IEEE 802.3 Ethernet.
|
ethernet-interface
|
Ethernet interface.
|
FastEthernet
|
Indicates that the interface is IEEE 802.3 Fast Ethernet.
|
fastethernet-interface
|
Fast Ethernet interface.
|
Group-Async
|
Indicates that the interface is group async.
|
group-async-interface
|
Group async interface.
|
Lex
|
Indicates that the interface is lex.
|
lex-interface
|
Lex interface.
|
Loopback
|
Indicates that the interface is loopback.
|
loopback-interface
|
Loopback interface.
|
Multilink
|
Indicates that the interface is multilink.
|
multilink-interface
|
Multilink interface.
|
Null
|
Indicates that the interface is null.
|
null-interface
|
Null interface.
|
Port-channel
|
Indicates that the interface is port channel.
|
port-channel-interface
|
Port channel interface.
|
Tunnel
|
Indicates that the interface is tunnel.
|
tunnel-interface
|
Tunnel interface.
|
Virtual-Access
|
Indicates that the interface is virtual access.
|
virtual-access-interface
|
Virtual access interface.
|
Virtual-Template
|
Indicates that the interface is virtual template.
|
virtual-template-interface
|
Virtual template interface.
|
Virtual-TokenRing
|
Indicates that the interface is virtual token ring.
|
virtual-tokenring-interface
|
Virtual token ring interface.
|
Command Default
All interfaces are configured as uplink interfaces by default.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.2(16)B
|
This command was replaced by the ssg direction command.
|
12.3(4)T
|
This command was replaced by the ssg direction command.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to specify an interface as downlink or uplink. An uplink interface is an interface to services; a downlink interface is an interface to subscribers.
Examples
The following example shows how to specify an ATM interface as a downlink interface:
Enter configuration commands, one per line. End with CNTL/Z.
ssg bind direction downlink ATM 0/0/0.10
Related Commands
Command
|
Description
|
show ssg binding
|
Displays service names that have been bound to interfaces and the interfaces to which they have been bound.
|
ssg bind service
Note
Effective with Cisco IOS Release 15.0(1)M, the ssg bind service command is not available in Cisco IOS software.
To specify the interface for a service, use the ssg bind service command in global configuration mode. To unbind the service and the interface, use the no form of this command.
ssg bind service service-name {ip-address | interface-type interface-number} [distance-metric]
no ssg bind service service-name {ip-address | interface-type interface-number} [distance-metric]
Syntax Description
service-name
|
Service name.
|
ip-address
|
IP address of the next-hop router.
|
interface-type
|
Type of interface.
|
interface-number
|
Number of the interface.
|
distance-metric
|
(Optional) Metric to be used to determine the path for upstream traffic. The range is from 1 to 255. Default is 0.
|
Command Default
A service is not bound to an interface.
Command Modes
Global configuration (config)
Command History
Release
|
Modification
|
12.0(3)DC
|
This command was introduced on the Cisco 6400 node route processor.
|
12.2(4)B
|
This command was integrated into Cisco IOS Release 12.2(4)B.
|
12.2(8)T
|
This command was integrated into Cisco IOS Release 12.2(8)T.
|
12.3(8)T
|
This command was modified to enable the configuration of interface redundancy for a service, and the distance-metric argument was added.
|
12.4
|
This command was integrated into Cisco IOS Release 12.4.
|
15.0(1)M
|
This command was removed.
|
Usage Guidelines
Use this command to bind a service to an interface. You can enter this command more than once in order to bind a service to more than one interface for interface redundancy.
Use the distance-metric argument to control the routing of upstream traffic. If more than one entry of the ssg bind service command for a service have the same metric, the upstream traffic will be load-balanced.
If a service is configured for multiple uplink interfaces, downstream traffic will be allowed on all the interfaces for any service bound to even one of those interfaces.
Examples
The following example shows the interface for the service defined as "MyService":
ssg bind service MyService ATM 0/0/0.10
The following example shows uplink interface redundancy configured for the service "sample-service". ATM interface 1/0.1 is configured as the primary interface and ATM interface 1/0.2 as the secondary interface.
ssg bind service sample-service atm 1/0.1
ssg bind service sample-service atm 1/0.2 100
Related Commands
Command
|
Description
|
clear ssg service
|
Removes a service.
|
show ssg binding
|
Displays service names that have been bound to interfaces and the interfaces to which they have been bound.
|
show ssg service
|
Displays the information for a service.
|