Controls whether SSG is allowed to switch packets directly between two subscribers attached to it, instead of always sending traffic up through a service leg for forwarding. With this enabled, two authenticated subscribers on the same SSG can exchange traffic without it ever leaving the box to hit an upstream service, which changes both the latency and what shows up in per-service traffic counters for that exchange. A broadband provider troubleshooting why two neighboring subscribers can reach each other despite no shared service being configured would check cssgCfgLocalForwardingEnabled and find it set to true, explaining the direct subscriber-to-subscriber path.