Cisco Service Gateway (SG)

Purpose and Functionality

The Cisco Service Gateway functions as the bridge between the customer’s network and the cloud service, facilitating seamless integration and secure communication. Deployed as a Cisco router running IOS-XE, it sits within the network traffic flow to enable cloud services on existing infrastructure from multiple vendors.

Guest & BYOD devices

→

Cisco Service Gateway Cisco router · routing, PBR, NAT, TrustSec

Internet client breakout

FlexVPN / IPSec⇄

Netgraph Sign In cloud · captive portal, DHCP, DNS

The Service Gateway is a Cisco router (for example ISR 1100/4400 or Catalyst 8000) that connects to the platform over a FlexVPN (IKEv2/IPSec) tunnel and provides BGP routing and VRF-based tenant isolation. DHCP, DNS, and the captive portal are served from the Netgraph cloud. An unauthenticated client is steered up to the cloud for captive-portal sign-in; once signed in, the client's internet traffic breaks out locally at the Service Gateway and does not pass back through the Netgraph cloud.

Key Features

Secure Communication

Encrypted tunnel using FlexVPN between cloud service and gateway
Redundancy options through hot standby or load balancing

Integration

Positioned between guest network (inside) and internet (outside)
Can deploy behind customer firewall for additional security

Vendor Compatibility

Works with existing LAN and wireless networks from any vendor

Scalability

Organizations select appropriate Cisco router model based on performance and business requirements

Advanced Capabilities

Policy-Based Routing (PBR) — Efficient traffic handling using predefined policies
Dynamic Segmentation — SGT/SXP tunnels with SGT-to-IP mapping
Logical Independence — Each instance operates within isolated VRF framework

Supported Router Models

The following Cisco router series are verified compatible:

Router Series	Required License	Feature Utilization	Support Status
Cisco ISR 1100 Series	Security (SEC/K9) + AppX	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco ISR 4400 Series	Security (SEC/K9) + AppX	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8100 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8200 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8300 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8400 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported
Cisco Catalyst 8500 Series	DNA Essentials/Routing Advantage	Cisco TrustSec (CTS), PBR/ePBR, NBAR, IPSec (FlexVPN), NAT, BGP, VRF	Supported

Note

Require Cisco IOS XE 17.3.8a or later.

SG — Service Provider

The multi-tenant Service Gateway Service Provider (SG-SP) serves as bridge between the customer's network and the cloud service, providing seamless integration and secure communication.

Cisco SD-WAN

Cisco SD-WAN (Viptela) functions as a Service Gateway (SG), providing scalable cloud connectivity with vManage-driven provisioning, local internet breakout, and centralized monitoring.