Serving Gateway Configuration

This chapter provides configuration information for the Serving Gateway (S-GW).

IMPORTANT:

Information about all commands in this chapter can be found in the Command Line Interface Reference.

Because each wireless network is unique, the system is designed with a variety of parameters allowing it to perform in various wireless network environments. In this chapter, only the minimum set of parameters are provided to make the system operational. Optional configuration commands specific to the S-GW product are located in the Command Line Interface Reference.

The following procedures are located in this chapter:

Configuring the System as a Standalone eGTP S-GW

This section provides a high-level series of steps and the associated configuration file examples for configuring the system to perform as a eGTP S-GW in a test environment. For a more robust configuration example, refer to the Sample Configuration Files appendix. Information provided in this section includes the following:

Information Required

The following sections describe the minimum amount of information required to configure and make the S-GW operational on the network. To make the process more efficient, you should have this information available prior to configuring the system.

There are additional configuration parameters that are not described in this section. These parameters deal mostly with fine-tuning the operation of the S-GW in the network. Information on these parameters can be found in the appropriate sections of the Command Line Interface Reference.

Required Local Context Configuration Information

The following table lists the information that is required to configure the local context on an eGTP S-GW.


Table 1. Required Information for Local Context Configuration
Required Information Description

Management Interface Configuration

Interface name

An identification string between 1 and 79 characters (alpha and/or numeric) by which the interface will be recognized by the system.

Multiple names are needed if multiple interfaces will be configured.

IP address and subnet

IPv4 addresses assigned to the interface.

Multiple addresses and subnets are needed if multiple interfaces will be configured.

Physical port number

The physical port to which the interface will be bound. Ports are identified by the chassis slot number where the line card resides followed by the number of the physical connector on the card. For example, port 17/1 identifies connector number 1 on the card in slot 17.

A single physical port can facilitate multiple interfaces.

Gateway IP address

Used when configuring static IP routes from the management interface(s) to a specific network.

Security administrator name

The name or names of the security administrator with full rights to the system.

Security administrator password

Open or encrypted passwords can be used.

Remote access type(s)

The type of remote access that will be used to access the system such as telnetd, sshd, and/or ftpd.



Required S-GW Ingress Context Configuration Information

The following table lists the information that is required to configure the S-GW ingress context on an eGTP S-GW.


Table 2. Required Information for S-GW Ingress Context Configuration
Required Information Description

S-GW ingress context name

An identification string from 1 to 79 characters (alpha and/or numeric) by which the S-GW ingress context is recognized by the system.

Accounting policy name

An identification string from 1 to 63 characters (alpha and/or numeric) by which the accounting policy is recognized by the system. The accounting policy is used to set parameters for the Rf (off-line charging) interface.

S1-U/S11 Interface Configuration (To/from eNodeB/MME)

Note:

The configuration provided in this guide assumes a shared S1-U/S11 interface. These interfaces can be separated to support a different network architecture. The information below applies to both.

Interface name

An identification string between 1 and 79 characters (alpha and/or numeric) by which the interface is recognized by the system.

Multiple names are needed if multiple interfaces will be configured.

IP address and subnet

IPv4 or IPv6 addresses assigned to the interface.

Multiple addresses and subnets are needed if multiple interfaces will be configured.

Physical port number

The physical port to which the interface will be bound. Ports are identified by the chassis slot number where the line card resides followed by the number of the physical connector on the card. For example, port 17/1 identifies connector number 1 on the card in slot 17.

A single physical port can facilitate multiple interfaces.

Gateway IP address

Used when configuring static IP routes from the interface(s) to a specific network.

Gateway IP address

Used when configuring static IP routes from the interface(s) to a specific network.

GTP-U Service Configuration

GTP-U service name (for S1-U/S11 interface)

An identification string from 1 to 63 characters (alpha and/or numeric) by which the GTP-U service bound to the S1-U/S11 interface will be recognized by the system.

IP address

S1-U/S11 interface IPv4 or IPv6 address.

S-GW Service Configuration

S-GW service name

An identification string from 1 to 63 characters (alpha and/or numeric) by which the S-GW service is recognized by the system.

Multiple names are needed if multiple S-GW services will be used.

eGTP Ingress Service Configuration

eGTP S1-U/S11 ingress service name

An identification string from 1 to 63 characters (alpha and/or numeric) by which the eGTP S1-U/S11 ingress service is recognized by the system.



Required S-GW Egress Context Configuration Information

The following table lists the information that is required to configure the S-GW egress context on an eGTP S-GW.


Table 3. Required Information for S-GW Egress Context Configuration
Required Information Description

S-GW egress context name

An identification string from 1 to 79 characters (alpha and/or numeric) by which the S-GW egress context is recognized by the system.

S5/S8 Interface Configuration (To/from P-GW)

Interface name

An identification string between 1 and 79 characters (alpha and/or numeric) by which the interface is recognized by the system.

Multiple names are needed if multiple interfaces will be configured.

IP address and subnet

IPv4 or IPv6 addresses assigned to the interface.

Multiple addresses and subnets are needed if multiple interfaces will be configured.

Physical port number

The physical port to which the interface will be bound. Ports are identified by the chassis slot number where the line card resides followed by the number of the physical connector on the card. For example, port 17/1 identifies connector number 1 on the card in slot 17.

A single physical port can facilitate multiple interfaces.

Gateway IP address

Used when configuring static IP routes from the interface(s) to a specific network.

GTP-U Service Configuration

GTP-U service name (for S5/S8 interface)

An identification string from 1 to 63 characters (alpha and/or numeric) by which the GTP-U service bound to the S5/S8 interface will be recognized by the system.

IP address

S5/S8 interface IPv4 or IPv6 address.

eGTP Egress Service Configuration

eGTP Egress Service Name

An identification string from 1 to 63 characters (alpha and/or numeric) by which the eGTP egress service is recognized by the system.



How This Configuration Works

The following figure and supporting text describe how this configuration with a single ingress and egress context is used by the system to process a subscriber call.


Figure 1. eGTP S-GW Call Processing Using a Single Ingress and Egress Context
  1. A subscriber session from the MME is received by the S-GW service over the S11 interface.
  2. The S-GW service determines which context to use to access PDN services for the session. This process is described in the How the System Selects Contexts section located in the Understanding the System Operation and Configuration chapter of the System Administration Guide.
  3. S-GW uses the configured egress context to determine the eGTP service to use for the outgoing S5/S8 connection.
  4. The S-GW establishes the S5/S8 connection by sending a create session request message to the P-GW.
  5. The P-GW responds with a Create Session Response message that includes the PGW S5/S8 Address for control plane and bearer information.
  6. The S-GW conveys the control plane and bearer information to the MME in a Create Session Response message.
  7. The MME responds with a Create Bearer Response and Modify Bearer Request message.
  8. The S-GW sends a Modify Bearer Response message to the MME.

eGTP S-GW Configuration

To configure the system to perform as a standalone eGTP S-GW, review the following graphic and subsequent steps.


Figure 2. eGTP S-GW Configurable Components
  1. Set system configuration parameters such as activating PSCs by applying the example configurations found in the System Administration Guide.
  2. Set initial configuration parameters such as creating contexts and services by applying the example configurations found in the Initial Configuration section of this chapter.
  3. Configure the system to perform as an eGTP S-GW and set basic S-GW parameters such as eGTP interfaces and an IP route by applying the example configurations presented in the eGTP Configuration section.
  4. Verify and save the configuration by following the instruction in the Verifying and Saving the Configuration section.

Initial Configuration

  1. Set local system management parameters by applying the example configuration in the Modifying the Local Context section.
  2. Create an ingress context where the S-GW and eGTP ingress service will reside by applying the example configuration in the Creating an S-GW Ingress Context section.
  3. Create an eGTP ingress service within the newly created ingress context by applying the example configuration in the Creating an eGTP Ingress Service section.
  4. Create an S-GW egress context where the eGTP egress services will reside by applying the example configuration in the Creating an S-GW Egress Context section.
  5. Create an eGTP egress service within the newly created egress context by applying the example configuration in the Creating an eGTP Egress Service section.
  6. Create a S-GW service within the newly created ingress context by applying the example configuration in the Creating an S-GW Service section.

Modifying the Local Context

Use the following example to set the default subscriber and configure remote access capability in the local context:

configure
   context
local
      interface <lcl_cntxt_intrfc_name>
         ip
address <ip_address> <ip_mask>
         exit
      server
ftpd
         exit
      server
telnetd
         exit
      subscriber
default
         exit
      administrator
<name>
encrypted password <password>
ftp
      ip
route <ip_addr/ip_mask> <next_hop_addr> <lcl_cntxt_intrfc_name>
      exit
   port
ethernet <slot#/port#>
      no
shutdown
      bind
interface <lcl_cntxt_intrfc_name>
local
      end

Creating an S-GW Ingress Context

Use the following example to create an S-GW ingress context and Ethernet interfaces to an MME and eNodeB, and bind the interfaces to configured Ethernet ports.

configure
   context
<ingress_context_name>
-noconfirm
      subscriber
default
         exit
      interface
<s1u-s11_interface_name>
         ip
address <ipv4_address_primary>
         ip
address <ipv4_address_secondary>
         exit
      ip
route 0.0.0.0 0.0.0.0 <next_hop_address> <sgw_interface_name>
      exit
   port
ethernet <slot_number/port_number>
      no
shutdown
      bind
interface <s1u-s11_interface_name> <ingress_context_name>
      end

Notes:

  • This example presents the S1-U/S11 connections as a shared interface. These interfaces can be separated to support a different network architecture.
  • The S1-U/S11 interface IP address(es) can also be specified as IPv6 addresses using the ipv6 address command.

Creating an eGTP Ingress Service

Use the following configuration example to create an eGTP ingress service:

configure
   context <ingress_context_name>
      egtp-service <egtp_ingress_service_name>
-noconfirm
         end

Creating an S-GW Egress Context

Use the following example to create an S-GW egress context and Ethernet interface to a P-GW and bind the interface to configured Ethernet ports.

configure
   context
<egress_context_name>
-noconfirm
      interface
<s5s8_interface_name> tunnel
         ipv6
address <address>
            tunnel-mode
ipv6ip
               source
interface <name>
               destination
address <ipv4
or ipv6 address>
               end
configure
   port
ethernet <slot_number/port_number>
      no
shutdown
      bind
interface <s5s8_interface_name> <egress_context_name>
      end

Notes:

  • The S5/S8 interface IP address can also be specified as an IPv4 address using the ip address command.

Creating an eGTP Egress Service

Use the following configuration example to create an eGTP egress service in the S-GW egress context:

configure
   context <egress_context_name>
      egtp-service <egtp_egress_service_name>
-noconfirm
         end

Creating an S-GW Service

Use the following configuration example to create the S-GW service in the ingress context:

configure
   context <ingress_context_name>
      sgw-service
<sgw_service_name>
-noconfirm
         end

eGTP Configuration

  1. Set the system’s role as an eGTP S-GW and configure eGTP service settings by applying the example configuration in the Setting the Systems Role as an eGTP S-GW and Configuring GTP-U and eGTP Service Settings section.
  2. Configure the S-GW service by applying the example configuration in the Configuring the S-GW Service section.
  3. Specify an IP route to the eGTP Serving Gateway by applying the example configuration in the Configuring an IP Route section.

Setting the System’s Role as an eGTP S-GW and Configuring GTP-U and eGTP Service Settings

Use the following configuration example to set the system to perform as an eGTP S-GW and configure the GTP-U and eGTP services:

configure
   context <sgw_ingress_context_name>
      gtpp
group default
         exit
      gtpu-service <gtpu_ingress_service_name>
         bind
ipv4-address <s1-u_s11_interface_ip_address>
         exit
      egtp-service <egtp_ingress_service_name>
         interface-type
interface-sgw-ingress
         validation-mode
default
         associate
gtpu-service <gtpu_ingress_service_name>
         gtpc
bind address <s1u-s11_interface_ip_address>
         exit
      exit
   context <sgw_egress_context_name>
      gtpu-service <gtpu_egress_service_name>
         bind
ipv4-address <s5s8_interface_ip_address>
         exit
      egtp-service <egtp_egress_service_name>
         interface-type
interface-sgw-egress
         validation-mode
default
         associate
gtpu-service <gtpu_egress_service_name>
         gtpc
bind address <s5s8_interface_ip_address>
         end

Notes:

  • The bind command in the GTP-U ingress and egress service configuration can also be specified as an IPv6 address using the ipv6-address command.

Configuring the S-GW Service

Use the following example to configure the S-GW service:

configure
   context <ingress_context_name>
      sgw-service
<sgw_service_name>
-noconfirm
         associate
ingress egtp-service <egtp_ingress_service_name>
         associate
egress-proto gtp egress-context <egress_context_name>
         qci-qos-mapping <map_name>
         end

Configuring an IP Route

Use the following example to configure an IP Route for control and user plane data communication with an eGTP PDN Gateway:

configure
   context <egress_context_name>
      ip
route <pgw_ip_addr/mask> <sgw_next_hop_addr> <sgw_intrfc_name>
      end

Verifying and Saving the Configuration

Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.

Configuring Optional Features on the eGTP S-GW

The configuration examples in this section are optional and provided to cover the most common uses of the eGTP S-GW in a live network. The intent of these examples is to provide a base configuration for testing.

Configuring X.509 Certificate-based Peer Authentication

The configuration example in this section enables X.509 certificate-based peer authentication, which can be used as the authentication method for IP Security on the S-GW.

IMPORTANT:

Use of the IP Security feature requires that a valid license key be installed. Contact your local Sales or Support representative for information on how to obtain a license.

The following configuration example enables X.509 certificate-based peer authentication on the S-GW.

In Global Configuration Mode, specify the name of the X.509 certificate and CA certificate, as follows:

configure
   certificate
name <cert_name>
pem url <cert_pem_url>
private-key pem url <private_key_url>
   ca-certificate
name <ca_cert_name> pem
url <ca_cert_url>
   end
Notes:
  • The certificate name and ca-certificate list ca-cert-name commands specify the X.509 certificate and CA certificate to be used.
  • The PEM-formatted data for the certificate and CA certificate can be specified, or the information can be read from a file via a specified URL as shown in this example.

When creating the crypto template for IPSec in Context Configuration Mode, bind the X.509 certificate and CA certificate to the crypto template and enable X.509 certificate-based peer authentication for the local and remote nodes, as follows:

configure
   context <sgw_context_name>
      crypto
template <crypto_template_name>
ikev2-dynamic
         certificate
name <cert_name>
         ca-certificate
list ca-cert-name <ca_cert_name>
         authentication
local certificate
         authentication
remote certificate
         end
Notes:
  • A maximum of sixteen certificates and sixteen CA certificates are supported per system. One certificate is supported per service, and a maximum of four CA certificates can be bound to one crypto template.
  • The certificate name and ca-certificate list ca-cert-name commands bind the certificate and CA certificate to the crypto template.
  • The authentication local certificate and authentication remote certificate commands enable X.509 certificate-based peer authentication for the local and remote nodes.

Configuring Dynamic Node-to-Node IP Security on the S1-U and S5 Interfaces

The configuration example in this section creates IPSec/IKEv2 dynamic node-to-node tunnel endpoints on the S1-U and S5 interfaces.

IMPORTANT:

Use of the IP Security feature requires that a valid license key be installed. Contact your local Sales or Support representative for information on how to obtain a license.

Creating and Configuring an IPSec Transform Set

The following example configures an IPSec transform set, which is used to define the security association that determines the protocols used to protect the data on the interface:

configure
   context <sgw_context_name>
      ipsec
transform-set <ipsec_transform-set_name>
         encryption
aes-cbc-128
         group
none
         hmac
sha1-96
         mode
tunnel
         end
Notes:
  • The encryption algorithm, aes-cbc-128, or Advanced Encryption Standard Cipher Block Chaining, is the default algorithm for IPSec transform sets configured on the system.
  • The group none command specifies that no crypto strength is included and that Perfect Forward Secrecy is disabled. This is the default setting for IPSec transform sets configured on the system.
  • The hmac command configures the Encapsulating Security Payload (ESP) integrity algorithm. The sha1-96 keyword uses a 160-bit secret key to produce a 160-bit authenticator value. This is the default setting for IPSec transform sets configured on the system.
  • The mode tunnel command specifies that the entire packet is to be encapsulated by the IPSec header, including the IP header. This is the default setting for IPSec transform sets configured on the system.

Creating and Configuring an IKEv2 Transform Set

The following example configures an IKEv2 transform set:

configure
   context <sgw_context_name>
      ikev2-ikesa
transform-set <ikev2_transform-set_name>
         encryption
aes-cbc-128
         group
2
         hmac
sha1-96
         lifetime <sec>
         prf
sha1
         end
Notes:
  • The encryption algorithm, aes-cbc-128, or Advanced Encryption Standard Cipher Block Chaining, is the default algorithm for IKEv2 transform sets configured on the system.
  • The group 2 command specifies the Diffie-Hellman algorithm as Group 2, indicating medium security. The Diffie-Hellman algorithm controls the strength of the crypto exponentials. This is the default setting for IKEv2 transform sets configured on the system.
  • The hmac command configures the Encapsulating Security Payload (ESP) integrity algorithm. The sha1-96 keyword uses a 160-bit secret key to produce a 160-bit authenticator value. This is the default setting for IKEv2 transform sets configured on the system.
  • The lifetime command configures the time the security key is allowed to exist, in seconds.
  • The prf command configures the IKE Pseudo-random Function, which produces a string of bits that cannot be distinguished from a random bit string without knowledge of the secret key. The sha1 keyword uses a 160-bit secret key to produce a 160-bit authenticator value. This is the default setting for IKEv2 transform sets configured on the system.

Creating and Configuring a Crypto Template

The following example configures an IKEv2 crypto template:

configure
   context <sgw_context_name>
      crypto
template <crypto_template_name>
ikev2-dynamic
         ikev2-ikesa
transform-set list <name1>
. . . <name6>
         ikev2-ikesa
rekey
         payload
<name>
match childsa match ipv4
            ipsec
transform-set list <name1>
. . . <name4>
            rekey
            end
Notes:
  • The ikev2-ikesa transform-set list command specifies up to six IKEv2 transform sets.
  • The ipsec transform-set list command specifies up to four IPSec transform sets.

Binding the S1-U and S5 IP Addresses to the Crypto Template

The following example configures the binding of the S1-U and S5 interfaces to the crypto template.

configure
   context <sgw_ingress_context_name>
      gtpu-service <gtpu_ingress_service_name>
         bind
ipv4-address <s1-u_interface_ip_address>
crypto-template <enodeb_crypto_template>
         exit
      egtp-service <egtp_ingress_service_name>
         interface-type
interface-sgw-ingress
         associate
gtpu-service <gtpu_ingress_service_name>
         gtpc
bind address <s1u_interface_ip_address>
         exit
      exit
   context <sgw_egress_context_name>
      gtpu-service <gtpu_egress_service_name>
         bind
ipv4-address <s5_interface_ip_address>
crypto-template <enodeb_crypto_template>
         exit
      egtp-service <egtp_egress_service_name>
         interface-type
interface-sgw-egress
         associate
gtpu-service <gtpu_egress_service_name>
         gtpc
bind address <s5_interface_ip_address>
         exit
      exit
   context <sgw_ingress_context_name>
      sgw-service
<sgw_service_name>
-noconfirm
         egtp-service
ingress service <egtp_ingress_service_name>
         egtp-service
egress context <sgw_egress_context_name>
         end
Notes:
  • The bind command in the GTP-U ingress and egress service configuration can also be specified as an IPv6 address using the ipv6-address command.

Configuring ACL-based Node-to-Node IP Security on the S1-U and S5 Interfaces

The configuration example in this section creates IKEv2/IPSec ACL-based node-to-node tunnel endpoints on the S1-U and S5 interfaces.

IMPORTANT:

Use of the IP Security feature requires that a valid license key be installed. Contact your local Sales or Support representative for information on how to obtain a license.

Creating and Configuring a Crypto Access Control List

The following example configures a crypto ACL (Access Control List), which defines the matching criteria used for routing subscriber data packets over an IPSec tunnel:

configure
   context <sgw_context_name>
      ip
access-list <acl_name>
         permit
tcp host <source_host_address>
host <dest_host_address>
         end
Notes:
  • The permit command in this example routes IPv4 traffic from the server with the specified source host IPv4 address to the server with the specified destination host IPv4 address.

Creating and Configuring an IPSec Transform Set

The following example configures an IPSec transform set which is used to define the security association that determines the protocols used to protect the data on the interface:

configure
   context <sgw_context_name>
      ipsec
transform-set <ipsec_transform-set_name>
         encryption
aes-cbc-128
         group
none
         hmac
sha1-96
         mode
tunnel
         end
Notes:
  • The encryption algorithm, aes-cbc-128, or Advanced Encryption Standard Cipher Block Chaining, is the default algorithm for IPSec transform sets configured on the system.
  • The group none command specifies that no crypto strength is included and that Perfect Forward Secrecy is disabled. This is the default setting for IPSec transform sets configured on the system.
  • The hmac command configures the Encapsulating Security Payload (ESP) integrity algorithm. The sha1-96 keyword uses a 160-bit secret key to produce a 160-bit authenticator value. This is the default setting for IPSec transform sets configured on the system.
  • The mode tunnel command specifies that the entire packet is to be encapsulated by the IPSec header including the IP header. This is the default setting for IPSec transform sets configured on the system.

Creating and Configuring an IKEv2 Transform Set

The following example configures an IKEv2 transform set:

configure
   context <sgw_context_name>
      ikev2-ikesa
transform-set <ikev2_transform-set_name>
         encryption
aes-cbc-128
         group
2
         hmac
sha1-96
         lifetime <sec>
         prf
sha1
         end
Notes:
  • The encryption algorithm, aes-cbc-128, or Advanced Encryption Standard Cipher Block Chaining, is the default algorithm for IKEv2 transform sets configured on the system.
  • The group 2 command specifies the Diffie-Hellman algorithm as Group 2, indicating medium security. The Diffie-Hellman algorithm controls the strength of the crypto exponentials. This is the default setting for IKEv2 transform sets configured on the system.
  • The hmac command configures the Encapsulating Security Payload (ESP) integrity algorithm. The sha1-96 keyword uses a 160-bit secret key to produce a 160-bit authenticator value. This is the default setting for IKEv2 transform sets configured on the system.
  • The lifetime command configures the time the security key is allowed to exist, in seconds.
  • The prf command configures the IKE Pseudo-random Function which produces a string of bits that cannot be distinguished from a random bit string without knowledge of the secret key. The sha1 keyword uses a 160-bit secret key to produce a 160-bit authenticator value. This is the default setting for IKEv2 transform sets configured on the system.

Creating and Configuring a Crypto Map

The following example configures an IKEv2 crypto map and applies it to the S1-U interface:

configure
   context <sgw_ingress_context_name>
      crypto
map <crypto_map_name> ikev2-ipv4
         match
address <acl_name>
         peer <ipv4_address>
         authentication
local pre-shared-key key <text>
         authentication
remote pre-shared-key key <text>
         ikev2-ikesa
transform-set list <name1>
. . . <name6>
         payload
<name>
match ipv4
            lifetime <seconds>
            ipsec
transform-set list <name1>
. . . <name4>
            exit
         exit
      interface
<s1-u_intf_name>
         ip
address <ipv4_address>
         crypto-map <crypto_map_name>
         exit
      exit
   port
ethernet <slot_number/port_number>
      no
shutdown
      bind
interface <s1_u_intf_name> <sgw_ingress_context_name>
      end
Notes:
  • The type of crypto map used in this example is IKEv2-IPv4 for IPv4 addressing. An IKEv2-IPv6 crypto map can also be used for IPv6 addressing.
  • The ipsec transform-set list command specifies up to four IPSec transform sets.

The following example configures an IKEv2 crypto map and applies it to the S5 interface:

configure
   context <sgw_egress_context_name>
      crypto
map <crypto_map_name> ikev2-ipv4
         match
address <acl_name>
         peer <ipv4_address>
         authentication
local pre-shared-key key <text>
         authentication
remote pre-shared-key key <text>
         payload
<name>
match ipv4
            lifetime <seconds>
            ipsec
transform-set list <name1>
. . . <name4>
            exit
         exit
      interface <s5_intf_name>
         ip
address <ipv4_address>
         crypto
map <crypto_map_name>
         exit
      exit
   port
ethernet <slot_number/port_number>
      no
shutdown
      bind
interface <s5_intf_name> <sgw_egress_context_name>
      end
Notes:
  • The type of crypto map used in this example is IKEv2-IPv4 for IPv4 addressing. An IKEv2-IPv6 crypto map can also be used for IPv6 addressing.
  • The ipsec transform-set list command specifies up to four IPSec transform sets.

Configuring S4 SGSN Handover Capability

This configuration example configures an S4 interface supporting inter-RAT handovers between the S-GW and a S4 SGSN.

Use the following example to configure this feature:

configure
   context
<ingress_context_name>
-noconfirm
      interface <s4_interface_name>
         ip
address <ipv4_address_primary>
         ip
address <ipv4_address_secondary>
         exit
      exit
   port
ethernet <slot_number/port_number>
      no
shutdown
      bind
interface <s4_interface_name> <ingress_context_name>
      exit
   context
<ingress_context_name>
-noconfirm
      gtpu-service <s4_gtpu_ingress_service_name>
         bind
ipv4-address <s4_interface_ip_address>
         exit
      egtp-service <s4_egtp_ingress_service_name>
         interface-type
interface-sgw-ingress
         validation-mode
default
         associate
gtpu-service <s4_gtpu_ingress_service_name>
         gtpc
bind address <s4_interface_ip_address>
         exit
      sgw-service
<sgw_service_name>
-noconfirm
         associate
ingress egtp-service <s4_egtp_ingress_service_name>
      end
Notes:
  • The S4 interface IP address(es) can also be specified as IPv6 addresses using the ipv6 address command.