Service Gateway - Service Provider (SG-SP)

Overview

The multi-tenant Service Gateway Service Provider (SG-SP) functions as a bridge connecting customer networks to cloud services. It is deployed as a centralized cluster within the service provider’s infrastructure, supporting multiple tenants through Virtual Routing and Forwarding (VRF) technology.

Telco MPLS IP-VPN backbone

Customer A
Customer B
Customer C

MPLS→

Cisco Service Gateway one gateway · VRF per tenant

VRF A
VRF B
VRF C

Internet shared breakout, per-tenant NAT

FlexVPN / IPSec⇄

Netgraph Sign In per-tenant cloud

Customer A
Customer B
Customer C

In the Service Provider model, one Cisco Service Gateway serves many customers reached over a Telco MPLS / IP-VPN backbone. Each customer runs in its own VRF on the shared gateway and connects over FlexVPN (IKEv2/IPSec) to its own cloud instance of Netgraph Sign In, which serves that tenant's captive portal, DHCP, and DNS. All tenants share the gateway's local internet breakout, each behind its own NAT network, so one customer's traffic stays isolated from another's.

Core Functionality

Purpose

The SG-SP integrates with existing LAN and WLAN infrastructures from any vendor, utilizing an IP-VPN backbone to extend the cloud service to one or multiple sites. Any Cisco router running IOS-XE can function in this role.

Deployment for Service Providers

Centralized cluster architecture within service provider infrastructure
Multi-tenant capability for scalability
IP-VPN or SD-WAN connectivity to customer networks

Security Features

Encrypted Communication: communication between the cloud service and the SG-SP is secured via an encrypted FlexVPN tunnel.

Redundancy Options:

Hot standby for failover
Load balancing for performance optimization

Key Technical Capabilities

Policy-Based Routing — Traffic management via predefined policies
Dynamic Segmentation — SGT/SXP tunnels and SGT-to-IP mapping
Logical Independence — VRF ensures operational separation per tenant

ServiceGateway Router Support Matrix

The table below lists the Cisco router series that are verified and fully compatible with the Sign In ServiceGateway integration. The specified license levels are required to enable the features utilized by the integration.

Router Series	Required License	Feature Utilization	Support Status
Cisco ISR 1100 Series	Security (SEC/K9) + AppX	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco ISR 4400 Series	Security (SEC/K9) + AppX	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8100 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8200 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8300 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8400 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8500 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported

Note

Require Cisco IOS XE 17.3.8a or later.

Cisco SD-WAN

Cisco SD-WAN (Viptela) functions as a Service Gateway (SG), providing scalable cloud connectivity with vManage-driven provisioning, local internet breakout, and centralized monitoring.

Cisco Meraki

Cisco Meraki (ME) – This solution seamlessly integrates with the customer’s Cisco Meraki cloud instance. The setup involves configuring a splash-page redirect in conjunction with RADIUS authenticat…