Configuring X.25 closed user group

Closed User Group (CUG) is a call restriction service provided by X.25 among all its optional services. It governs call receiving and initiating capabilities of users (DTEs), allowing users in the same CUG to call each other and forbidding users in different CUGs to do so. This allows a private data communication subnet to form over public X.25 data communications networks for an organization.

A user can belong to multiple CUGs. When the user calls another user in a CUG, the CUG number is included in its capability negotiation message. The user can also be configured not to belong to any CUG, in which case the capability message does not carry CUG information.

When used as DCE, the CUG function is shown in Figure 129.

The calls in Figure 129 are described as follows:

• Call 1—DTE originates a call, but outgoing capability is barred, so the call is removed by DCE with CUG enabled.

• Call 2—DCE receives a call request and requests a connection with DTE. CUG function is enabled on DCE and the incoming capability is barred, so the call is removed by DCE.

1. CUG function

   You must enable CUG function first before configuring it, which is not enabled by default.

   After CUG function is enabled, all calls, including those with or without CUG facilities are suppressed. You can also define some suppression policies for CUG to process calls in different ways.

   Two types of CUG suppression policies are available. One is to suppress all incoming calls, where the system removes the CUG facilities of all incoming calls with CUG facilities. The other is to suppress the incoming calls matching the mapping specified as the preference rule, where the system removes the CUG facilities only of those incoming calls matching the mapping specified as preference rule, but let other incoming calls with CUG facilities pass through. The details are as follows:

   • Incoming suppression policy—The system lets the incoming calls without CUG facilities pass through, but suppresses the incoming calls with CUG facilities but without access configuration configured by the CUG mapping rule.

   • Outgoing suppression policy—The system lets the outgoing calls without CUG facilities pass through, but suppresses the outgoing calls with CUG facilities but without access configuration configured by the CUG mapping rule.

   • All suppression policy—The system removes CUG facilities (if any) and makes call processing for all incoming calls. This policy is ineffective on outgoing calls.

   • Preference mapping suppressing policy—The system removes CUG facilities and makes call processing for the incoming calls with CUG facilities and with preference mapping rule, but lets the incoming calls without preference mapping rule pass through. This policy is ineffective on outgoing calls.

   You can only configure the CUG function on an X.25 interface operating as DCE, and you must specify the serial interface as DCE when specifying the X.25 protocol on it.

2. CUG mapping and suppression rule

   CUG mapping refers to CUG number conversation from local end (DTE) to network end (X.25) during CUG call processing. For example, when processing the call from the DTE with CUG 10 to DTE with CUG 20, the system first searches the mapping table for this mapping entry: if the table has this entry, it forwards the packets, if not, it denies the forwarding.

   You can define the following suppression rules in configuring CUG mapping:

   • Outgoing call restriction

   • Incoming call restriction

   • Specifying as the preference rule

   Specifying as the preference rule depends on the CUG suppression policy. If the suppression policy is configured as only suppressing the CUG of preference mapping, the system removes the CUG facilities in the incoming call packet of this mapping and makes call processing.

   You must configure CUG function on X.25 DCE interface, and you must specify it as DCE end when enabling X.25 encapsulation on serial interface.

To configure CUG:

The x25 cug-service and x25 local-cug commands are supported only on the X.25 DCE interface. Specify the interface as DCE when enabling X.25 encapsulation on the serial interface.