Cisco 7600 Wireless Security Gateway

Cisco Wireless Security Gateway R2

  • Viewing Options

  • PDF (414.6 KB)
  • Feedback

Product Overview

The Cisco ® Wireless Security Gateway (WSG) is a highly scalable solution for tunneling femtocell, Unlicensed Mobile Access (UMA)/Generic Access Network (GAN), and 3G/4G macrocell voice and data traffic over fixed broadband networks back to the mobile operator's core network. In a femtocell deployment, the Cisco WSG uses IP Security (IPsec) to secure the connection between the mobile operator's core network and the "Home Node B" (3G femtocell access point) located at the subscriber's home. In this environment the Cisco WSG provides security for trusted hosts (femtocell access points) when they communicate across an external untrusted broadband network such as the Internet (see Figure 1).
The Cisco WSG adheres to the latest 3rd Generation Partnership Project (3GPP) standards for secure remote access over untrusted networks. In addition to femtocell deployments, the Cisco WSG can also secure UMA/GAN traffic where the subscriber has a UMA-capable mobile handset that communicates via a Wi-Fi access point over an untrusted network and back to the mobile operator's data center. It can also be deployed to secure 3G/4G base stations that are connected to the mobile operator's network through a third party's carrier Ethernet service. The Cisco WSG plays an important role in cost-effectively securing backhaul networks for mobile operators, helping to reduce backhaul costs, which represent a significant part of their operating expenses (OpEx).

Figure 1. Cisco Wireless Security Gateway at Service Provider Network

The Cisco WSG is built on the Cisco Service and Application Module for IP (SAMI) for the Cisco 7600 Series Router. Each Cisco SAMI blade with Cisco WSG software can support up to 100,000 IPsec sessions using Internet Key Exchange (IKE) Version 1 or Version 2. IKEv2 has been specified by the 3GPP for use in UMA/GAN, femtocell, and Long-Term Evolution (LTE) applications. IKEv1 is available to support legacy solutions that have not migrated to IKEv2. An optimally configured Cisco 7613 Series Router with ten SAMI blades can support 1,000,000 IPsec sessions.

Cisco 7600 Series Router

The Cisco 7600 Series Router delivers robust, high-performance IP/MPLS features for a range of service provider edge applications. The physical interfaces supported on the Cisco 7600 Series platform include Fast Ethernet and Gigabit Ethernet, FlexWAN (ATM and Frame Relay), and the new line of Cisco shared port adapter (SPA) and SPA interface processor (SIP) line cards. Each Cisco 7600 Series Router provides Layer 2 connectivity and Layer 3 routing services and can host a variety of specialized applications on the Cisco SAMI module.

Figure 2. Cisco 7600 Series Router with SAMI Blade


The Cisco WSG in a Femtocell Deployment

As the build-out of the mobile Internet accelerates, technology such as femtocells has moved to the forefront as a way to cost-effectively scale mobile capacity to meet the expected 66-fold growth in mobile data traffic over the next few years (source: Cisco Visual Networking Index - Forecast, 2008-2013). The Cisco WSG will play a critical role in enabling femtocell deployments. Figure 3 provides an example of how a Cisco WSG can be deployed.

Figure 3. Cisco WSG in an End-to-End Femtocell Architecture

Features and Benefits

Table 1. Cisco Wireless Security Gateway Features




Standards compliance

• Complies with IETF RFCs
• Provides interoperability with other standards-compliant components


• Endpoint authentications with PKI Certificates and EAP Protocol
• Allows users to uniquely authenticate using X.509 certificate
• Support of EAP facilitates Radius based
• Authentication

Address allocation

• IP local pool
• Increases flexibility of network design and address allocation
• Uses local pools for user address assignments
• Enhances end-node address management efficiency, and minimizes provisioning

IPsec and other security services

• Handling of IKE initialization request from endpoints with PKI
• Supports IKEv1 and IKEv2
• Creation of IPsec ESP tunnels
• Cryptographic algorithm negotiations
• Packet encryption/decryption: AES/AES-CBC 128 bits, DES, 3DES
• Hash algorithms: MD5, SHA-1, SHA-2 (256, 384 and 512), and XCBC-AES
• Diffie-Hellman Groups: 1 (768 bit), 2 (1024 bit), 5 (1536 bit)
• Rekeying
• Support of X.509 certificates
• Traffic selector negotiations
• Anti-replay
• Pre-shared keys
• Extended Sequence Number (ESN)
• IKE CAC (Call Admission Control) mechanism
• CRL, CMPv2 and OCSP Certificate management protocol Support
• Protects data flow between Home Node B or eNode B and WSG
• Offers security services at IP level
• Provides secure tunnel between Home Node B or eNode B and WSG
• Protects data confidentiality, integrity, and authentication


• Dead Peer Detection (DPD) for IKE transactions
• Facilitates faster failover

Redundancy and load balancing

• 1+1 inter- or intra-chassis redundancy
• N+1 inter- or intra-chassis redundancy
• ACE HW Module based Server Load Balancing
• PBR (Packet Based Routing) Based Server Load Balancing
• Peace of mind
• Service availability
• Minimum user disruption

Network Address Translation (NAT) traversal

• Supports an intermediate device performing NAT
• Allows the home/mobile node to be behind a NAT entity address
• Offers increased flexibility of network design and address allocation

Quality of service (QoS)

• Reflects inner-to-outer type of service/differentiated services code point (ToS/DSCP) marking
• Supports the appropriate QoS and class of service (CoS) for application


• High end based on Cisco 7600 Series and SAMI
• Network Equipment Building Standards (NEBS) 3-compliant
• Flexibility of choice for better offering
• Distributed, not centralized
• Feature-rich line card for 10G and 4G needs


• High throughput per application blade
• Right subscriber density per blade for 3G/4G nodes
• Load-balancing mechanism
• Up to 270 tunnels per second
• Up to 2 Gbps per blade for small packets - voice
• Up to 5 Gbps per blade for large packets - data
• Up to 50 Gbps per chassis
• Up to 100,000 subs per blade
• Up to 1,000,000 subs per chassis

Co-Location of Hardware/Software

• Co-Location of other wireless Services in the same chassis, i.e. IP-RAN and other wireless Gateways can co-exist in the same chassis
• Facilitates use of existing 7600 Platform
• Provides a more competitive solution

Standard Cisco hardware and software platforms

• Multiple service modules (such as Cisco Application Control Engine [ACE], SAMI, and Firewall Service Module [FWSM]) can be integrated in the same chassis
• Cisco hardware platforms are proven in some of the largest networks in the world
• Cisco devices run with the standard Cisco IOS ® Software feature set, which includes rich IP, security, mobile IP, and voice and data integration capability
• Minimizes risk; speeds deployment of network
• Helps accelerate time to market with advanced features

Configuration and Performance

Cisco 7600 Series with SAMI provides:

• Up to 100,000 Home Node B's per Cisco WSG module in a femtocell deployment (up to 100,000 dual-mode phones in a UMA/GAN deployment)

• Up to ten Cisco SAMI blades with Wireless Security Gateway can be installed in a Cisco 7613 Series Router

• Up to 2-Gbps bandwidth per module for small packets - voice

• Up to 5-Gbps bandwidth per module for large packets - data

• Chassis throughput of 20 Gbps (10 x 2 Gbps) for voice and 50 Gbps (10 x 5 Gbps) for large packets

Cisco 7600 Series Platform Requirements

• All Cisco 7600 Series chassis are supported: Cisco 7604, 7606, 7609, and 7613, with a minimum Cisco IOS® Software release requirement of 12.2(33)SRC2

• Supported supervisor engines: Cisco 7600 Series Supervisor Engine 720 and Route Switch Processor 720

• Single or redundant supervisor engine configurations are permitted

• No restriction on other cards (such as service and network modules) on the chassis

Ordering Information

Table 2 lists the product numbers for the Cisco WSG right-to-use (RTU) licenses, subscriber licenses, and SAMI hardware. The software license provides for unlimited use of features in the release with a defined number of connected subscribers, which may be limited by hardware resource capacity and traffic mix. The Cisco WSG subscriber license allows for increasing the number of connected subscribers in increments of 10,000 connected subscribers.

Table 2. Cisco WSG Ordering Information for Cisco 7600 Series

Product Number


SAMI Module


Service Application Module for IP 6 x PPC w/ 1GB (Crypto)


Service Application Module for IP 6 x PPC w/ 1GB Spare (Crypto)


SAMI 6xPPCs with 2GB per PPC Memory Option


SAMI 6xPPCs with 2GB per PPC Memory Option

Software RTU Licenses*


SAMI Wireless Security Gateway R2.0 RTU License


SAMI Wireless Security Gateway R2.0 RTU License (Spare)

Connected Tunnel Licenses, per Chassis for active WSG


SAMI Wireless Security Gateway 10K connected tunnel license


SAMI Wireless Security Gateway 10K connected tunnel license (Spare)

* One RTU license is required per software module.

Service and Support

Cisco offers a wide range of service programs to accelerate customer success. These innovative service programs are delivered through a unique combination of people, processes, tools, and partners, resulting in high levels of customer satisfaction. Cisco services help you to protect your network investment, optimize network operations, and prepare your network for new applications to extend network intelligence and the power of your business. For more information about Cisco Services, see Cisco Technical Support Services or Cisco Advanced Services.

Additional Information

Cisco Service and Application Module for IP (SAMI)
Cisco ACE Application Control Engine Solution for High Availability
Cisco Firewall Services Module for Cisco Catalyst 6500 and Cisco 7600 Series
Cisco AAA and Cisco Network Registrar ®
Cisco 7600 Series Router
For more information about Cisco mobile wireless products and solutions, visit
For more information about Mobile Wireless Center for the Cisco Service Exchange Framework, visit or contact your Cisco account manager.