Turns on SSG's TCP-redirect feature, which intercepts matching TCP packets and redirects them to a captive-portal destination instead of letting them reach their original destination. This is the switch that makes captive-portal login pages actually appear: with it off, an unauthenticated subscriber's browser requests just pass through or get dropped instead of being rewritten to land on the login page defined by the redirect-group objects. A hotspot operator would enable cssgCfgTcpRedirectEnabled so a new guest's first HTTP request gets silently redirected to the Wi-Fi login portal instead of returning a connection timeout.