Cisco Cisco IOS Software Release 12.2(16)B

User authentication is attempted by SSG using RADIUS 
protocol. To configure SSG to intercept user PPP 
authentication requests, you must configure PPP 
authentication. You do not need to specify RADIUS as the 
authentication protocol.

Router(config)# aaa authentication ppp default 

Router(config)# aaa authorization network default 

In the preceding configuration, SSG still sends an 
authentication request to the RADIUS server for a PPP 
user, even though a local authentication is specified in the 
CLI. 

User authentication is done by Cisco IOS PPP leveraging AAA 
RADIUS protocol for authenticating all PPP users. Using 
12.2(2)B configuration, PPP will attempt to find the user 
configuration on the router itself.

You must issue the following command in global configuration 
mode for authentication to be attempted:

Router(config)# aaa authentication ppp default group 

The debug ssg http-redirect command is available.

The debug ssg http-redirect command is not available and has 
been replaced by the debug ssg tcp-redirect options command to 
debug issues related to redirection.

SSG does not leverage Cisco IOS CEF and does not 
create CEF tables.

SSG leverages Cisco IOS CEF for data forwarding. This 
necessitates the use of CEF tables for data path switching. SSG 
creates and maintains a CEF table on each service (uplink) 
interface or subinterface. This is a VRF scalability issue, whereby 
the number of CEF tables that SSG can create and support is 
limited by VRF scalability on a given platform or NRP card. For 
example, if GRE tunnels are configured on the service side, SSG 
attempts to create a CEF table per GRE tunnel, which, due to 
memory resource limitation on the router, may prevent SSG from 
creating CEF tables.