Reports the type of a configured service: pass-through (no separate auth for that service, the default), tunnel (an L2TP-tunneled service), or proxy (SSG itself performs authentication for that service). This determines how SSG has to handle a session bound to that service: tunnel requires SSG to set up and maintain an L2TP tunnel per session, a much heavier operation than pass-through, so a service mistakenly left as pass-through when it was meant to tunnel traffic will simply route locally instead of tunneling anywhere. A corporate-VPN service meant to backhaul subscriber traffic to a company LNS over L2TP would show cssgServiceType as tunnel(3), distinguishing it from a plain internet-access service that shows passthrough(2).