Table Of Contents
Cisco IOS Mobile Wireless Commands
access-violation deactivate-pdp-context
cdma pdsn a10 init-ppp-after-airlink-start airlink-start-timeout
cdma pdsn a11 dormant ppp-idle-timeout send-termreq
cdma pdsn a11 mandate presence airlink-setup
cdma pdsn accounting local-timezone
cdma pdsn accounting send cdma-ip-tech
cdma pdsn accounting time-of-day
cdma pdsn cluster controller session-high
cdma pdsn cluster controller session-low
cdma pdsn compliance iosv4.1 session-reference
cdma pdsn compliance is835a esn-optional
cdma pdsn ingress-address-filtering
cdma pdsn mobile-advertisement-burst
cdma pdsn retransmit a11-update
cdma pdsn selection load-balancing
cdma pdsn selection session-table-size
cdma pdsn timeout mobile-ip-registration
clear cdma pdsn cluster controller session records age
clear gprs access-point statistics
clear gprs gtp-director statistics
clear ip rtp header-compression
gprs canonical-qos best-effort bandwidth-factor
gprs canonical-qos gsn-resource-factor
gprs canonical-qos premium mean-throughput-deviation
Cisco IOS Mobile Wireless Commands
This book documents all of the Cisco IOS software commands in Cisco IOS Release 12.3(11)T for the Gateway GPRS Support Node (GGSN), GTP Director Module (GDM), and Packet Data Serving Node (PDSN), in alphabetical order.
aaa-accounting
To enable or disable accounting for a particular access point on the GGSN, use the aaa-accounting access-point configuration command.
aaa-accounting [enable | disable | interim update]
Syntax Description
Defaults
enable—For non-transparent APNs
disable—For transparent APNs
Interim accounting is disabled.
Command Modes
Access-point configuration
Command History
Usage Guidelines
You can configure AAA accounting services at an access point. However, for accounting to occur, you also must complete the configuration by specifying the following other configuration elements on the GGSN:
•
Enable AAA services using the aaa new-model global configuration command.
•
•
–
–
–
•
•
Note
You can verify whether AAA accounting services are configured at an APN using the show gprs access-point command.
There is not a no form of this command.
Enabling and Disabling Accounting Services for an Access Point
The Cisco Systems GGSN has different defaults for enabling and disabling accounting services for transparent and non-transparent access points:
•
•
To selectively disable accounting at specific APNs where you do not want that service, use the aaa-accounting disable access-point configuration command.
Configuring Interim Accounting for an Access Point
Using the aaa-accounting interim access-point configuration command, you can configure the GGSN to send Interim-Update Accounting requests to the AAA server when a routing area update (resulting in an SGSN change) or QoS change has occurred for a PDP context. These changes are conveyed to the GGSN by an Update PDP Context request.
Note
There is not a no form of this command.
Examples
Example 1
The following configuration example disables accounting at access-point 1:
interface virtual-template 1gprs access-point-list abc!gprs access-point-list abcaccess-point 1access-point-name gprs.pdn.com access-mode non-transparentaaa-accounting disableExample 2
The following configuration example enables accounting on transparent access-point 4. Accounting is disabled on access-point 5 because it is configured for transparent mode and the aaa-accounting enable command is not explicitly configured.
Accounting is automatically enabled on access-point 1 because it has been configured for non-transparent access mode. Accounting is explicitly disabled at access-point 3, because accounting is automatically enabled for non-transparent access mode.
An example of some of the AAA and RADIUS global configuration commands are also shown:
aaa new-model!aaa group server radius fooserver 10.2.3.4server 10.6.7.8aaa group server radius foo1server 10.10.0.1aaa group server radius foo2server 10.2.3.4server 10.10.0.1aaa group server foo3server 10.6.7.8server 10.10.0.1!aaa authentication ppp foo group fooaaa authentication ppp foo2 group foo2aaa authorization network default group radiusaaa accounting exec default start-stop group fooaaa accounting network foo1 start-stop group foo1aaa accounting network foo2 start-stop group foo2!gprs access-point-list gprsaccess-point 1access-mode non-transparentaccess-point-name www.pdn1.comaaa-group authentication foo!access-point 3access-point-name www.pdn2.comaccess-mode non-transparentaaa-accounting disableaaa-group authentication foo!access-point 4access-point-name www.pdn3.comaaa-accounting enableaaa-group accounting foo1!access-point 5access-point-name www.pdn4.com!gprs default aaa-group authentication foo2gprs default aaa-group accounting foo3!radius-server host 10.2.3.4 auth-port 1645 acct-port 1646 non-standardradius-server host 10.6.7.8 auth-port 1645 acct-port 1646 non-standardradius-server host 10.10.0.1 auth-port 1645 acct-port 1646 non-standardradius-server key ggsntelRelated Commands
aaa-group
To specify a AAA server group and assign the type of AAA services to be supported by the server group for a particular access point on the GGSN, use the aaa-group access-point configuration command. To remove a AAA server group, use the no form of this command.
aaa-group {authentication | accounting} server-group
no aaa-group {authentication | accounting} server-group
Syntax Description
Defaults
No default behavior or values.
Command Modes
Access-point configuration
Command History
Usage Guidelines
The Cisco Systems GGSN supports authentication and accounting at APNs using AAA server groups. By using AAA server groups, you gain the following benefits:
•
•
•
The GGSN supports the implementation of AAA server groups at both the global and access-point configuration levels. You can minimize your configuration by specifying the configuration that you want to support across most APNs, at the global configuration level. Then, at the access-point configuration level, you can selectively modify the services and server groups that you want to support at a particular APN. Therefore, you can override the AAA server global configuration at the APN configuration level.
To configure a default AAA server group to be used for all APNs on the GGSN, use the gprs default aaa-group global configuration command. To specify a different AAA server group to be used at a particular APN for authentication or accounting, use the aaa-group access-point configuration command.
If accounting is enabled on the APN, then the GGSN looks for an accounting server group to be used for the APN in the following order:
•
•
•
•
If none of the above commands are configured on the GGSN, then AAA accounting is not performed.
If authentication is enabled on the APN, then the GGSN first looks for an authentication server group at the APN, configured in the aaa-group authentication command. If an authentication server group is not found at the APN, then the GGSN looks for a globally configured, GPRS default authentication server group, configured in the gprs default aaa-group authentication command.
To complete the configuration, you also must specify the following configuration elements on the GGSN:
•
•
•
•
–
–
–
•
–
You can enable or disable accounting services at the APN using the aaa-accounting command.
–
You can verify the AAA server groups that are configured for an APN using the show gprs access-point command.
Note
Examples
The following configuration example defines four AAA server groups on the GGSN: foo, foo1, foo2, and foo3, shown by the aaa group server commands.
Using the gprs default aaa-group command, two of these server groups are globally defined as default server groups: foo2 for authentication, and foo3 for accounting.
At access-point 1, which is enabled for authentication, the default global authentication server group of foo2 is overridden and the server group named foo is designated to provide authentication services on the APN. Notice that accounting services are not explicitly configured at that access point, but are automatically enabled because authentication is enabled. Because there is a globally defined accounting server-group defined, the server named foo3 will be used for accounting services.
At access-point 2, which is enabled for authentication, the default global authentication server group of foo2 is used. Because there is a globally defined accounting server-group defined, the server named foo3 will be used for accounting services.
At access-point 4, which is enabled for accounting using the aaa-accounting enable command, the default accounting server group of foo3 is overridden and the server group named foo1 is designated to provide accounting services on the APN.
Access-point 5 does not support any AAA services because it is configured for transparent access mode, and accounting is not enabled.
aaa new-model!aaa group server radius fooserver 10.2.3.4server 10.6.7.8aaa group server radius foo1server 10.10.0.1aaa group server radius foo2server 10.2.3.4server 10.10.0.1aaa group server foo3server 10.6.7.8server 10.10.0.1!aaa authentication ppp foo group fooaaa authentication ppp foo2 group foo2aaa authorization network default group radiusaaa accounting exec default start-stop group fooaaa accounting network foo1 start-stop group foo1aaa accounting network foo2 start-stop group foo2aaa accounting network foo3 start-stop group foo3!gprs access-point-list gprsaccess-point 1access-mode non-transparentaccess-point-name www.pdn1.comaaa-group authentication foo!access-point 2access-mode non-transparentaccess-point-name www.pdn2.com!access-point 4access-point-name www.pdn4.comaaa-accounting enableaaa-group accounting foo1!access-point 5access-point-name www.pdn5.com!gprs default aaa-group authentication foo2gprs default aaa-group accounting foo3!radius-server host 10.2.3.4 auth-port 1645 acct-port 1646 non-standardradius-server host 10.6.7.8 auth-port 1645 acct-port 1646 non-standardradius-server host 10.10.0.1 auth-port 1645 acct-port 1646 non-standardradius-server key ggsntelRelated Commands
access-mode
To specify whether the GGSN requests user authentication at the access point to a PDN, use the access-mode access-point configuration command. To remove an access mode and return to the default value, use the no form of this command.
access-mode {transparent | non-transparent}
no access-mode {transparent | non-transparent}
Syntax Description
Defaults
transparent
Command Modes
Access-point configuration
Command History
Usage Guidelines
Use the access-mode command to specify whether users accessing a PDN through a particular access point associated with the virtual template interface have transparent or non-transparent access to the network.
Transparent access means that users who access the PDN through the current virtual template are granted access without further authentication.
Non-transparent access means that users who access the PDN through the current virtual template must be authenticated by the GGSN. You must configure non-transparent access to support RADIUS services at an access point. Authentication is performed by the GGSN while establishing the PDP context.
Examples
Example 1
The following example specifies non-transparent access to the PDN, gprs.pdn.com, through access-point 1:
interface virtual-template 1gprs access-point-list abc!gprs access-point-list abcaccess-point 1access-point-name gprs.pdn.com access-mode non-transparentExample 2
The following example specifies transparent access to the PDN, gprs.pdn2.com, through access-point 2:
interface virtual-template 1gprs access-point-list abc!gprs access-point-list abcaccess-point 2access-point-name gprs.pdn2.com
Note
Related Commands
access-point
To specify an access point number and enter access-point configuration mode, use the access-point access-point list configuration command. To remove an access point number, use the no form of this command.
access-point access-point-index
no access-point access-point-index
Syntax Description
Defaults
No default behavior or values.
Command Modes
Access-point list configuration
Command History
12.1(1)GA
This command was introduced.
12.1(5)T
This command was integrated in Cisco IOS Release 12.1(5)T.
12.2(4)MX
This command was incorporated in Cisco IOS Release 12.2(4)MX.
Usage Guidelines
Use the access-point command to create an access point to a PDN.
To configure an access point, first set up an access-point list using the gprs access-point-list command and then add the access point to the access-point list.
You can specify access point numbers in any sequence.
Note
Examples
The following example configures an access point with an index number of 7 in an access-point-list named "abc" on the GGSN:
gprs access-point-list abcaccess-point 7Related Commands
access-point-name
To specify the network (or domain) name for a PDN that users can access from the GGSN at a defined access point, use the access-point-name access-point configuration command. To remove an access point name, use the no form of this command.
access-point-name apn-name
no access-point-name apn-name
Syntax Description
apn-name
Specifies the network or domain name of the private data network that can be accessed through the current access point.
Defaults
There is no default value for this command.
Command Modes
Access-point configuration
Command History
Usage Guidelines
Use the access-point-name command to specify the PDN name of a network that can be accessed through a particular access point. An access-point name is mandatory for each access point.
To configure an access point, first set up an access-point list using the gprs access-point-list command and then add the access point to the access-point list.
The access-point name typically is the domain name of the service provider that users access, for example, www.isp.com.
Examples
The following example specifies the access-point name for a network:
access-point 1access-point-name www.isp.comexitRelated Commands
access-type
To specify whether an access point is real or virtual on the GGSN, use the access-type access-point configuration command. To return to the default value, use the no form of this command.
access-type {virtual | real}
no access-type {virtual | real}
Syntax Description
Defaults
real
Command Modes
Access-point configuration
Command History
Usage Guidelines
Use the access-type command to specify whether an access point is real or virtual on the GGSN. You only need to configure this command for virtual access types.
Virtual access types are used to configure virtual APN support on the Cisco Systems GGSN to minimize provisioning issues in other GPRS network entities that require configuration of APN information. Using the virtual APN feature on the Cisco Systems GGSN, HLR subscription data can simply provide the name of the virtual APN. User's can still request access to specific target networks that are accessible by the GGSN without requiring each of those destination APNs to be provisioned at the HLR.
The default keyword, real, identifies a physical target network that the GGSN can reach. Real APNs must always be configured on the GGSN to reach external networks. Virtual APNs can be configured in addition to real access points to ease provisioning in the GPRS PLMN.
No other access-point configuration commands are applicable if the access type is virtual.
Examples
The following example shows configuration of a virtual access point type and a real access point type:
access-point 1access-point-name corporateaccess-type virtualexitaccess-point 2access-point-name corporatea.comip-address-pool dhcp-clientdhcp-server 10.21.21.1Related Commands
access-violation deactivate-pdp-context
To specify that a user's session be ended and the user packets discarded when a user attempts unauthorized access to a PDN through an access point, use the access-violation deactivate-pdp-context command. To return to the default value, use the no form of this command.
access-violation deactivate-pdp-context
no access-violation deactivate-pdp-context
Syntax Description
This command has no arguments or keywords.
Defaults
The user's session remains active and the user packets are discarded.
Command Modes
Access-point configuration
Command History
Usage Guidelines
Use the access-violation deactivate-pdp-context command to specify the action that is taken if a user attempts unauthorized access through the specified access point.
The default is that the GGSN simply drops user packets when an unauthorized access is attempted. However, if you specify access-violation deactivate-pdp-context, the GGSN terminates the user's session in addition to discarding the packets.
Examples
The following example shows deactivation of a user's access in addition to discarding the user packets:
access-point 1access-point-name pdn.aaaa.comip-access-group 101 inaccess-violation deactivate-pdp-contextexitRelated Commands
Specifies the network (or domain) name for a PDN that users can access from the GGSN at a defined access point.
aggregate
To configure the GGSN to create an aggregate route in its IP routing table, when receiving PDP requests from MSs on the specified network, for a particular access point on the GGSN, use the aggregate access-point configuration command. To remove an aggregate route, use the no form of this command.
aggregate {auto | ip-network-prefix{/mask-bit-length | ip-mask}}
no aggregate {auto | ip-network-prefix{/mask-bit-length | ip-mask}}
Syntax Description
Defaults
No default behavior or values.
Command Modes
Access-point configuration
Command History
Usage Guidelines
The GGSN uses a static host route to forward user data packets received from the Gi interface to the Gn interface using the virtual template interface of the GTP tunnel.
Without the aggregate command or gprs default aggregate command, the GGSN creates a static host route for each PDP context. For example, for 45,000 PDP contexts supported, the GGSN creates 45,000 static host routes in its IP routing table.
You can use the aggregate command to reduce the number of static routes implemented by the GGSN for PDP contexts at a particular access point. The aggregate command allows you to specify an IP network prefix to combine the routes of PDP contexts from the same network as a single route on the GGSN.
To configure the GGSN to automatically aggregate routes that are returned by a DHCP or RADIUS server, use the aggregate auto command at the APN. Automatic route aggregation can be configured at the access-point configuration level only on the GGSN. The gprs default aggregate global configuration command does not support the auto option; therefore, you cannot configure automatic route aggregation globally on the GGSN.
You can specify multiple aggregate commands at each access point to support multiple network aggregates. However, if you use the aggregate auto command at the APN, you cannot specify any other aggregate route ranges at the APN. If you need to handle other static route cases at the APN, then you will have to use the gprs default aggregate global configuration command.
To globally define an aggregate IP network address range for all access points on the GGSN for statically derived addresses, you can use the gprs default aggregate command. Then, you can use the aggregate command to override this default address range at a particular access point.
The GGSN responds in the following manner to manage routes for MSs through an access point, when route aggregation is configured in the following scenarios:
•
•
–
–
•
–
–
–
•
–
–
Use care when assigning IP addresses to an MS before you configure the aggregation ranges on the GGSN. A basic guideline is to aggregate as many addresses as possible, but to minimize your use of aggregation with respect to the total amount of IP address space being used by the access point.
Note
Use the show gprs access-point command to display information about the aggregate routes that are configured on the GGSN. The aggregate output field appears only when aggregate routes have been configured on the GGSN, or the auto option is configured.
Use the show ip route command to verify whether the static route is in the current IP routing table on the GGSN. The static route created for any PDP requests (aggregated or non-aggregated) appears with the code "U" in the routing table indicating a per-user static route.
Note
Examples
Example 1
The following example specifies two aggregate network address ranges for access point 8. The GGSN will create aggregate routes for PDP context requests received from MSs with IP addresses on the networks 172.16.0.0 and 10.0.0.0:
gprs access-point-list gprsaccess-point 8access-point-name pdn.aaaa.comaggregate 172.16.0.0/16aggregate 10.0.0.0/8
Note
Example 2
The following example shows a route aggregation configuration for access point 8 using DHCP on the GGSN, along with the associated output from the show gprs gtp pdp-context all command and the show ip route commands.
Notice that the aggregate auto command is configured at the access point where DHCP is being used. The dhcp-gateway-address command specifies the subnet addresses to be returned by the DHCP server. This address should match the IP address of a loopback interface on the GGSN. In addition, to accommodate route aggregation for another subnet 10.80.0.0, the gprs default aggregate global configuration command is used.
In this example, the GGSN aggregates routes for dynamically derived addresses for MSs through access point 8 based upon the address and mask returned by the DHCP server. For PDP context requests received for statically derived addresses on the 10.80.0.0 network, the GGSN also implements an aggregate route into its routing table, as configured by the gprs default aggregate command.
interface Loopback0ip address 10.80.0.1 255.255.255.255!interface Loopback2ip address 10.88.0.1 255.255.255.255!gprs access-point-list gprsaccess-point 8access-point-name pdn.aaaa.comip-address-pool dhcp-proxy-clientaggregate autodhcp-server 172.16.43.35dhcp-gateway-address 10.88.0.1exit!gprs default aggregate 10.80.0.0 255.255.255.0In the following output for the show gprs gtp pdp-context all command, 5 PDP context requests are active on the GGSN for pdn.aaaa.com from the 10.88.0.0/24 network:
router# show gprs gtp pdp-context allTID MS Addr Source SGSN Addr APN6161616161610001 10.88.0.1 DHCP 172.16.123.1 pdn.aaaa.com6161616161610002 10.88.0.2 DHCP 172.16.123.1 pdn.aaaa.com6161616161610003 10.88.0.3 DHCP 172.16.123.1 pdn.aaaa.com6161616161610004 10.88.0.4 DHCP 172.16.123.1 pdn.aaaa.com6161616161610005 10.88.0.5 DHCP 172.16.123.1 pdn.aaaa.comThe following output for the show ip route command shows a single static route in the IP routing table for the GGSN, which routes the traffic for the 10.88.0.0/24 subnet through the virtual template (or Virtual-Access1) interface:
Router# show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS interarea* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not set10.80.0.0/16 is subnetted, 1 subnetsC 10.80.0.0 is directly connected, Loopback010.113.0.0/16 is subnetted, 1 subnetsC 10.113.0.0 is directly connected, Virtual-Access1172.16.0.0/16 is variably subnetted, 3 subnets, 3 masksC 172.16.43.192/28 is directly connected, FastEthernet0/0S 172.16.43.0/24 is directly connected, FastEthernet0/0S 172.16.43.35/32 is directly connected, Ethernet2/310.0.0.0/8 is variably subnetted, 2 subnets, 2 masksU 10.88.0.0/24 [1/0] via 0.0.0.0, Virtual-Access1C 10.88.0.0/16 is directly connected, Loopback2Related Commands
anonymous user
To configure anonymous user access at an access point, use the anonymous user access-point configuration command. To remove the username configuration, use the no form of this command.
anonymous user username [password]
no anonymous user username [password]
Syntax Description
Defaults
No default behavior or values.
Command Modes
Access-point configuration
Command History
Usage Guidelines
Use this command to allow a mobile station (MS) to access a non-transparent mode APN without supplying the username and password in the GTP protocol configuration option (PCO) information element (IE) of the create PDP context request message. The GGSN will use the username and password configured on the APN for the user session.
This command enables anonymous access, which means that a PDP context can be created by an MS to a specific host without specifying a username and password.
Examples
The following example specifies the username george and the password abcd123 for anonymous access at access point 49:
gprs access-point-list abcaccess-point 49access-point-name www.pdn.comanonymous user george abcd123block count
To lock out group members for a length of time after a set number of incorrect passwords, use the block count command in local RADIUS server group configuration mode. To remove the user block after invalid login attempts, use the no form of this command.
block count count time {seconds | infinite}
no block count count time {seconds | infinite}
Syntax Description
Defaults
No default behavior or values
Command Modes
Local RADIUS server group configuration
Command History
Usage Guidelines
If a setting of infinite is entered, an administrator must manually unblock the locked username.
Examples
The following command locks out group members for 120 seconds after 3 incorrect passwords are entered:
block count 3 time 120Related Commands
