Names the TCP Redirect Group that unauthenticated users' matching traffic gets redirected to. This is the specific redirect-group name that ties an otherwise-abstract 'redirect unauthenticated traffic' rule to a concrete set of destination networks/ports defined elsewhere, so a typo'd or stale name here means unauthenticated users get no redirect at all even though the feature looks enabled. An operator would set cssgCfgTCPRedirGrpForUnAuthUsers to a group named 'login-portal' pointing at their captive-portal server, so a new subscriber's first web request lands on the login page instead of the intended destination.