HA Overview

 

The Home Agent (HA) allows mobile nodes to be reached, or served, by their home network through its home address even when the mobile node is not attached to its home network. The HA performs this function through interaction with a Foreign Agent (FA) that the mobile node is communicating with using the Mobile IP (MIP) standard. Such transactions are performed through the use of virtual private networks that create MIP tunnels between the HA and FA.

When functioning as an HA, the system can either be located within the carrier’s 3G network or in an external enterprise or ISP network. Regardless, the FA terminates the mobile subscriber’s PPP session, and then routes data to and from the appropriate HA on behalf of the subscriber.

This chapter includes the following sections:

•	Product Specifications

•	Network Deployment Configurations

•	Understanding Mobile IP

Product Specifications

The following application and line cards are required to support CDMA2000 wireless data services on the system:

Hardware Requirements

Platforms

The Home Agent service runs on a Cisco® ASR 5x00 chassis running StarOS. The chassis can be configured with a variety of components to meet specific network deployment requirements. For additional information, refer to the Installation Guide for the chassis and/or contact your Cisco account representative.

Components

The following application and line cards are required to support HA functionality on an ASR 5x00 platform:

•	System Management Cards (SMCs): Provides full system control and management of all cards within the ASR 5x00 platform. Up to two SMC can be installed; one active, one redundant.

•	Packet Processing Cards (PSC, PSC2, PPC): Within the ASR 5x00 platform, packet processing cards provide high-speed, multi-threaded PPP processing capabilities to support HA services. Up to 14 packet processing cards can be installed, allowing for multiple active and/or redundant cards.

•	Switch Processor Input/Outputs (SPIO): Installed in the upper-rear chassis slots directly behind the SMCs, SPIOs provide connectivity for local and remote management, Central Office (CO) alarms. Up to two SPIOs can be installed; one active, one redundant.

•

Ethernet 10/100 and/or Ethernet 1000/Quad Ethernet 1000 Line Cards: Installed directly behind processing cards, these cards provide the RP, AAA, PDN, and Pi interfaces to elements in the data network. Up to 26 line cards should be installed for a fully loaded system with 13 active processing cards, 13 in the upper-rear slots and 13 in the lower-rear slots for redundancy. Redundant processing cards do no not require line cards.

•

Redundancy Crossbar Cards (RCCs): Installed in the lower-rear chassis slots directly behind the SMCs, RCCs utilize 5 Gbps serial links to ensure connectivity between Ethernet 10/100 or Ethernet 1000/Quad Ethernet 1000 line cards and every processing card in the system for redundancy. Two RCCs can be installed to provide redundancy for all line cards and processing cards.

Important: Additional information pertaining to each of the application and line cards required to support CDMA2000 wireless data services is located in the Product Overview Guide.

Operating System Requirements

The HA is available for all Cisco ASR 5x00 platforms running StarOS Release 10.0 or later.

MPLS Forwarding with LDP

Multi Protocol Label Switching (MPLS) is an operating scheme or a mechanism that is used to speed up the flow of traffic on a network by making better use of available network paths. It works with the routing protocols like BGP and OSPF and therefore it is not a routing protocol.

It generates a fixed-length label to attach or bind with the IP packet's header to control the flow and destination of data. The binding of the labels to the IP packets is done by the label distribution protocol (LDP). All the packets in a forwarding equivalence class (FEC) are forwarded by a label-switching router (LSR) which is also called an MPLS node. The LSR uses the LDP in order to signal its forwarding neighbors and distribute its labels for establishing a labelswitching path (LSP).

In order to support the increasing number of corporate APNs which have a number of different addressing models and requirements, MPLS is deployed to fulfill at least following two requirements:

•	The corporate APN traffic must remain segregated from other APNs for security reasons.

•	Overlapping of IP addresses in different APNs.

When deployed, MPLS backbone automatically negotiates the routes using the labels binded with the IP packets. Cisco GGSN as an LSR learns the default route from the connected provider edge (PE) while the PE populates its routing table with the routes provided by the GGSN.

Features and Functionality - Inline Service Support

This section describes the features and functions of inline services supported on the HA. These services require additional licenses to implement the functionality.

Content Filtering

The Cisco HA offers two variants of network-controlled content filtering / parental control services. Each approach leverages the native DPI capabilities of the platform to detect and filter events of interest from mobile subscribers based on HTTP URL or WAP/MMS URI requests:

•

Integrated Content Filtering: A turnkey solution featuring a policy enforcement point and category based rating database on the Cisco HA. An offboard AAA or PCRF provides the per-subscriber content filtering information as subscriber sessions are established. The content filtering service uses DPI to extract URL's or URI's in HTTP request messages and compares them against a static rating database to determine the category match. The provisioned policy determines whether individual subscribers are entitled to view the content.

•

Content Filtering ICAP Interface: This solution is appropriate for mobile operators with existing installations of Active Content Filtering external servers. The service continues to harness the DPI functions of the ASR 5000 platform to extract events of interest. However in this case, the extracted requests are transferred via the Integrated Content Adaptation Protocol (ICAP) with subscriber identification information to the external ACF server which provides the category rating database and content decision functions.

Integrated Adult Content Filter

Provides a value-added service to prevent unintended viewing of objectionable content that exploits underage children. Content Filtering offers mobile operators a way to increase data ARPU and subscriber retention through a network-based solution for parental controls and content filtering. The integrated solution enables a single policy decision and enforcement point thereby streamlining the number of signaling interactions with external AAA/Policy Manager servers. When used in parallel with other services such as Enhanced Content Charging (ECS) it increases billing accuracy of charging records by insuring that mobile subscribers are only charged for visited sites they are allowed to access.

The Integrated Adult Content Filter is a subscriber-aware inline service provisioned on an ASR 5000 running HA services. Integrated Content Filtering utilizes the local DPI engine and harnesses a distributed software architecture that scales with the number of active HA sessions on the system.

Content Filtering policy enforcement is the process of deciding if a subscriber should be able to receive some content. Typical options are to allow, block, or replace/redirect the content based on the rating of the content and the policy defined for that content and subscriber. The policy definition is transferred in an authentication response from a AAA server or Diameter policy message via the Gx reference interface from an adjunct PCRF. The policy is applied to subscribers through rulebase or APN/Subscriber configuration. The policy determines the action to be taken on the content request on the basis of its category. A maximum of one policy can be associated with a rulebase.

ICAP Interface

Provides a value-added service to prevent unintended viewing of objectionable content that exploits underage children. Content Filtering offers mobile operators a way to increase data ARPU and subscriber retention through a network-based solution for parental controls and content filtering. The Content Filtering ICAP solution is appropriate for operators with existing installations of Active Content Filtering servers in their networks.

The Enhanced Charging Service (ECS) provides a streamlined Internet Content Adaptation Protocol (ICAP) interface to leverage the Deep Packet Inspection (DPI) to enable external Application Servers to provide their services without performing the DPI functionality and without being inserted in the data flow. The ICAP interface may be attractive to mobile operators that prefer to use an external Active Content Filtering (ACF) Platform. If a subscriber initiates a WAP (WAP1.x or WAP2.0) or Web session, the subsequent GET/POST request is detected by the deep packet inspection function. The URL of the GET/POST request is extracted by the local DPI engine on the ASR 5000 platform and passed, along with subscriber identification information and the subscriber request, in an ICAP message to the Application Server (AS). The AS checks the URL on the basis of its category and other classifications like, type, access level, content category and decides if the request should be authorized, blocked or redirected by answering the GET/POST message. Depending upon the response received from the ACF server, the HA either passes the request unmodified or discards the message and responds to the subscriber with the appropriate redirection or block message.

Network Address Translation (NAT)

NAT translates non-routable private IP address(es) to routable public IP address(es) from a pool of public IP addresses that have been designated for NAT. This enables to conserve on the number of public IP addresses required to communicate with external networks, and ensures security as the IP address scheme for the internal network is masked from external hosts, and each outgoing and incoming packet goes through the translation process.

NAT works by inspecting both incoming and outgoing IP datagrams and, as needed, modifying the source IP address and port number in the IP header to reflect the configured NAT address mapping for outgoing datagrams. The reverse NAT translation is applied to incoming datagrams.

NAT can be used to perform address translation for simple IP and mobile IP. NAT can be selectively applied/denied to different flows (5-tuple connections) originating from subscribers based on the flows' L3/L4 characteristics—Source-IP, Source-Port, Destination-IP, Destination-Port, and Protocol.

NAT supports the following mappings:

•	One-to-One

•	Many-to-One

Important: For more information on NAT, refer to the Cisco ASR 5000 Series Network Address Translation Administration Guide.

Personal Stateful Firewall

The Personal Stateful Firewall is an in-line service feature that inspects subscriber traffic and performs IP session-based access control of individual subscriber sessions to protect the subscribers from malicious security attacks.

The Personal Stateful Firewall supports stateless and stateful inspection and filtering based on the configuration.

In stateless inspection, the firewall inspects a packet to determine the 5-tuple—source and destination IP addresses and ports, and protocol—information contained in the packet. This static information is then compared against configurable rules to determine whether to allow or drop the packet. In stateless inspection the firewall examines each packet individually, it is unaware of the packets that have passed through before it, and has no way of knowing if any given packet is part of an existing connection, is trying to establish a new connection, or is a rogue packet.

In stateful inspection, the firewall not only inspects packets up through the application layer / layer 7 determining a packet's header information and data content, but also monitors and keeps track of the connection's state. For all active connections traversing the firewall, the state information, which may include IP addresses and ports involved, the sequence numbers and acknowledgement numbers of the packets traversing the connection, TCP packet flags, etc. is maintained in a state table. Filtering decisions are based not only on rules but also on the connection state established by prior packets on that connection. This enables to prevent a variety of DoS, DDoS, and other security violations. Once a connection is torn down, or is timed out, its entry in the state table is discarded.

The Enhanced Charging Service (ECS) / Active Charging Service (ACS) in-line service is the primary vehicle that performs packet inspection and charging. For more information on ECS, see the Cisco ASR 5000 Series Enhanced Charging Service Administration Guide.

Important: For more information on Personal Stateful Firewall, refer to the Cisco ASR 5000 Series Personal Stateful Firewall Administration Guide.

Traffic Performance Optimization (TPO)

Though TCP is a widely accepted protocol in use today, it is optimized only for wired networks. Due to inherent reliability of wired networks, TCP implicitly assumes that any packet loss is due to network congestion and consequently invokes congestion control measures. However, wireless links are known to experience sporadic and usually temporary losses due to several reasons, including the following, which also trigger TCP congestion control measures resulting in poor TCP performance.

Reasons for delay variability over wireless links include:

•	Channel fading effect, subscriber mobility, and other transient conditions

•	Link-layer retransmissions

•	Handoffs between neighboring cells

•	Intermediate nodes, such as SGSN and e-NodeB, implementing scheduling polices tuned to deliver better QoS for select services; resulting is variable delay in packet delivery for other services

The TPO inline service uses a combination of TCP and HTTP optimization techniques to improve TCP performance over wireless links.

Important: For more information on TPO, refer to the Cisco ASR 5000 Series Traffic Performance Optimization Administration Guide.

Supported Standards

The system supports the following industry standards for 1x/CDMA2000/EV-DO devices.

Requests for Comments (RFCs)

•	RFC-768, User Datagram Protocol (UPD), August 1980

•	RFC-791, Internet Protocol (IP), September 1982

•	RFC-793, Transmission Control Protocol (TCP), September 1981

•	RFC-894, A Standard for the Transmission of IP Datagrams over Ethernet Networks, April 1984

•	RFC-1089, SNMP over Ethernet, February 1989

•	RFC-1144, Compressing TCP/IP headers for low-speed serial links, February 1990

•	RFC-1155, Structure and Identification of Management Information for TCP/IP-based Internets, May 1990

•	RFC-1157, Simple Network Management Protocol (SNMP) Version 1, May 1990

•	RFC-1212, Concise MIB Definitions, March 1991

•	RFC-1213, Management Information Base for Network Management of TCP/IP-based Internets: MIB-II, March 1991

•	RFC-1215, A Convention for Defining Traps for use with the SNMP, March 1991

•	RFC-1224, Techniques for Managing Asynchronously Generated Alerts, May 1991

•	RFC-1256, ICMP Router Discovery Messages, September 1991

•	RFC-1305, Network Time Protocol (Version 3) Specification, Implementation and Analysis, March 1992

•	RFC-1332, The PPP Internet Protocol Control Protocol (IPCP), May 1992

•	RFC-1398, Definitions of Managed Objects for the Ethernet-Like Interface Types, January 1993

•	RFC-1418, SNMP over OSI, March 1993

•	RFC-1570, PPP LCP Extensions, January 1994

•	RFC-1643, Definitions of Managed Objects for the Ethernet-like Interface Types, July 1994

•	RFC-1661, The Point to Point Protocol (PPP), July 1994

•	RFC-1662, PPP in HDLC-like Framing, July 1994

•	RFC-1701, Generic Routing Encapsulation (GRE), October 1994

•	RFC-1771, A Border Gateway Protocol 4 (BGP-4)

•	RFC-1850, OSPF Version 2 Management Information Base, November 1995

•	RFC-1901, Introduction to Community-based SNMPv2, January 1996

•	RFC-1902, Structure of Management Information for Version 2 of the Simple Network Management Protocol (SNMPv2), January 1996

•	RFC-1903, Textual Conventions for Version 2 of the Simple Network Management Protocol (SNMPv2), January 1996

•	RFC-1904, Conformance Statements for Version 2 of the Simple Network Management Protocol (SNMPv2), January 1996

•	RFC-1905, Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2), January 1996

•	RFC-1906, Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2), January 1996

•	RFC-1907, Management Information Base for Version 2 of the Simple Network Management Protocol (SNMPv2), January 1996

•	RFC-1908, Coexistence between Version 1 and Version 2 of the Internet-standard Network Management Framework, January 1996

•	RFC-1918, Address Allocation for Private Internets, February 1996

•	RFC-1919, Classical versus Transparent IP Proxies, March 1996

•	RFC-1962, The PPP Compression Control Protocol (CCP), June 1996

•	RFC-1974, PPP STAC LZS Compression Protocol, August 1996

•	RFC-2002, IP Mobility Support, May 1995

•	RFC-2003, IP Encapsulation within IP, October 1996

•	RFC-2004, Minimal Encapsulation within IP, October 1996

•	RFC-2005, Applicability Statement for IP Mobility Support, October 1996

•	RFC-2118, Microsoft Point-to-Point Compression (MPPC) Protocol, March 1997

•	RFC-2136, Dynamic Updates in the Domain Name System (DNS UPDATE)

•	RFC-2211, Specification of the Controlled-Load Network Element Service

•	RFC-2246, The Transport Layer Security (TLS) Protocol Version 1.0, January 1999

•	RFC-2290, Mobile IPv4 Configuration Option for PPP IPCP, February 1998

•	RFC-2328, OSPF Version 2, April 1998

•	RFC-2344, Reverse Tunneling for Mobile IP, May 1998

•	RFC-2394, IP Payload Compression Using DEFLATE, December 1998

•	RFC-2401, Security Architecture for the Internet Protocol, November 1998

•	RFC-2402, IP Authentication Header (AH), November 1998

•	RFC-2406, IP Encapsulating Security Payload (ESP), November 1998

•	RFC-2408, Internet Security Association and Key Management Protocol (ISAKMP), November 1998

•	RFC-2409, The Internet Key Exchange (IKE), November 1998

•	RFC-2474, Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers, December 1998

•	RFC-2475, An Architecture for Differentiated Services, December 1998

•	RFC-2484, PPP LCP Internationalization Configuration Option, January 1999

•	RFC-2486, The Network Access Identifier (NAI), January 1999

•	RFC-2571, An Architecture for Describing SNMP Management Frameworks, April 1999

•	RFC-2572, Message Processing and Dispatching for the Simple Network Management Protocol (SNMP), April 1999

•	RFC-2573, SNMP Applications, April 1999

•	RFC-2574, User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3), April 1999

•	RFC-2597, Assured Forwarding PHB Group, June 1999

•	RFC2598 - Expedited Forwarding PHB, June 1999

•	RFC-2618, RADIUS Authentication Client MIB, June 1999

•	RFC-2620, RADIUS Accounting Client MIB, June 1999

•	RFC-2661, Layer Two Tunneling Protocol “L2TP”, August 1999

•	RFC-2697, A Single Rate Three Color Marker, September 1999

•	RFC-2698, A Two Rate Three Color Marker, September 1999

•	RFC-2784, Generic Routing Encapsulation (GRE) - March 2000, IETF

•	RFC-2794, Mobile IP Network Access Identifier Extension for IPv4, March 2000

•	RFC-2809, Implementation of L2TP Compulsory Tunneling via RADIUS, April 2000

•	RFC-2845, Secret Key Transaction Authentication for DNS (TSIG), May 2000

•	RFC-2865, Remote Authentication Dial In User Service (RADIUS), June 2000

•	RFC-2866, RADIUS Accounting, June 2000

•	RFC-2867, RADIUS Accounting Modifications for Tunnel Protocol Support, June 2000

•	RFC-2868, RADIUS Attributes for Tunnel Protocol Support, June 2000

•	RFC-2869, RADIUS Extensions, June 2000

•	RFC-3007, Secure Domain Name System (DNS) Dynamic Update, November 2000

•	RFC-3012, Mobile IPv4 Challenge/Response Extensions, November 2000

•	RFC-3095, Robust Header Compression (ROHC): Framework and four profiles: RTP, UDP, ESP and uncompressed, July 2001

•	RFC-3101, OSPF NSSA Option, January 2003.

•	RFC-3141, CDMA2000 Wireless Data Requirements for AAA, June 2001

•	RFC-3143, Known HTTP Proxy/Caching Problems, June 2001

•	RFC-3193, Securing L2TP using IPSEC, November 2001

•	RFC-3241 Robust Header Compression (ROHC) over PPP, April 2002

•	RFC-3409, Lower Layer Guidelines for Robust (RTP/UDP/IP) Header Compression, December 2002

•	RFC-3519, NAT Traversal for Mobile IP, April 2003

•	RFC-3543, Registration Revocation in Mobile IPv4, August 2003

•	RFC 3576 - Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS), July 2003

•	RFC-3706, A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers, February 2004

•	RFC-3759, Robust Header Compression (ROHC): Terminology and Channel Mapping Examples, April 2004

•	RFC-3588, Diameter Based Protocol, September 2003

•	RFC-4005, Diameter Network Access Server Application, August 2005

•	RFC-4006, Diameter Credit-Control Application, August 2005

•	Draft, Generalized Key Distribution Extensions for Mobile IP

•	Draft, AAA Keys for Mobile IP

Network Deployment Configurations

This section provides examples of how the system can be deployed within a wireless carrier’s network. As noted previously in this chapter, the system can be deployed in standalone configurations, serving as a Home Agent (HA) and a Packet Data Serving Node/Foreign Agent (PDSN/FA), or in a combined PDSN/FA/HA configuration providing all services from a single chassis.

Standalone PDSN/FA and HA Deployments

The following figure depicts a sample network configuration wherein the HA and the PDSN/FA are separate systems.

PDSN/FA and HA Network Deployment Configuration Example

The HA allows mobile nodes to be reached, or served, by their home network through its home address even when the mobile node is not attached to its home network. The HA performs this function through interaction with an FA that the mobile node is communicating with using the Mobile IP protocol. Such transactions are performed through the use of virtual private networks that create Mobile IP tunnels between the HA and FA.

Interface Descriptions

This section describes the primary interfaces used in a CDMA2000 wireless data network deployment.

Pi Interfaces

The Pi interface provides connectivity between the HA and its corresponding FA. The Pi interface is used to establish a Mobile IP tunnels between the PDSN/FA and HA.

PDN Interfaces

PDN interface provide connectivity between the PDSN and/or HA to packet data networks such as the Internet or a corporate intranet.

AAA Interfaces

Using the LAN ports located on the Switch Processor I/O (SPIO) and Ethernet line cards, these interfaces carry AAA messages to and from RADIUS accounting and authentication servers. The SPIO supports RADIUS-capable management interfaces using either copper or fiber Ethernet connectivity through two auto-sensing 10/100/1000 Mbps Ethernet interfaces or two SFP optical gigabit Ethernet interfaces. User-based RADIUS messaging is transported using the Ethernet line cards.

While most carriers will configure separate AAA interfaces to allow for out-of-band RADIUS messaging for system administrative users and other operations personnel, it is possible to use a single AAA interface hosted on the Ethernet line cards to support a single RADIUS server that supports both management users and network users.

Important: Subscriber AAA interfaces should always be configured using Ethernet line card interfaces for the highest performance. The local context should not be used for service subscriber AAA functions.

Co-Located Deployments

An advantage of the system is its ability to support both high-density HA and PDSN/FA configurations within the same chassis. The economies of scale presented in this configuration example provide for both improved session handling and reduced cost in deploying a CDMA2000 data network.

The following figure depicts a sample co-located deployment.

Co-located PDSN/FA and HA Configuration Example

It should be noted that all interfaces defined within the 3GPP2 standards for 1x deployments exist in this configuration as they are described in the two previous sections. This configuration can support communications to external, or standalone, HAs and/or PDSNs/FAs using all prescribed standards.

Mobile IP Tunneling Methods

Tunneling by itself is a technology that enables one network to send its data via another network's connections. Tunneling works by encapsulating a network protocol within a packet, carried by the second network. Tunneling is also called encapsulation. Service providers typically use tunneling for two purposes; first, to transport otherwise un-routable packets across the IP network and second, to provide data separation for Virtual Private Networking (VPN) services. In Mobile IP, tunnels are used to transport data packets between the FA and HA.

The system supports the following tunneling protocols, as defined in the IS-835-A specification and the relevant Request For Comments (RFCs) for Mobile IP:

IP in IP tunnels

IP in IP tunnels basically encapsulate one IP packet within another using a simple encapsulation technique. To encapsulate an IP datagram using IP in IP encapsulation, an outer IP header is inserted before the datagram's existing IP header. Between them are other headers for the path, such as security headers specific to the tunnel configuration. Each header chains to the next using IP Protocol values. The outer IP header Source and Destination identify the “endpoints” of the tunnel. The inner IP header Source and Destination identify the original sender and recipient of the datagram, while the inner IP header is not changed by the encapsulator, except to decrement the TTL, and remains unchanged during its delivery to the tunnel exit point. No change to IP options in the inner header occurs during delivery of the encapsulated datagram through the tunnel. If needed, other protocol headers such as the IP Authentication header may be inserted between the outer IP header and the inner IP header.

The Mobile IP working group has specified the use of encapsulation as a way to deliver datagrams from an MN's HA to an FA, and conversely from an FA to an HA, that can deliver the data locally to the MN at its current location.

GRE tunnels

The Generic Routing Encapsulation (GRE) protocol performs encapsulation of IP packets for transport across disparate networks. One advantage of GRE over earlier tunneling protocols is that any transport protocol can be encapsulated in GRE. GRE is a simple, low overhead approach—the GRE protocol itself can be expressed in as few as eight octets as there is no authentication or tunnel configuration parameter negotiation. GRE is also known as IP Protocol 47.

Important: The chassis simultaneously supports GRE protocols with key in accordance with RFC-1701/RFC-2784 and “Legacy” GRE protocols without key in accordance to RFC-2002.

Another advantage of GRE tunneling over IP-in-IP tunneling is that GRE tunneling can be used even when conflicting addresses are in use across multiple contexts (for the tunneled data).

Communications between the FA and HA can be done in either the forward or reverse direction using the above protocols. Additionally, another method of routing information between the FA and various content servers used by the HA exists. This method is called Triangular Routing. Each of these methods is explained below.

Forward Tunneling

In the wireless IP world, forward tunneling is a tunnel that transports packets from the packet data network towards the MN. It starts at the HA and ends at the MN's care-of address. Tunnels can be as simple as IP-in-IP tunnels, GRE tunnels, or even IP Security (IPSec) tunnels with encryption. These tunnels can be started automatically, and are selected based on the subscriber's user profile.

 

Reverse Tunneling

A reverse tunnel starts at the MN's care-of address, which is the FA, and terminates at the HA.

When an MN arrives at a foreign network, it listens for agent advertisements and selects an FA that supports reverse tunnels. The MN requests this service when it registers through the selected FA. At this time, the MN may also specify a delivery technique such as Direct or the Encapsulating Delivery Style.

Using the Direct Delivery Style, which is the default mode for the system, the MN designates the FA as its default router and sends packets directly to the FA without encapsulation. The FA intercepts them, and tunnels them to the HA.

Using the Encapsulating Delivery Style, the MN encapsulates all its outgoing packets to the FA. The FA then de-encapsulates and re-tunnels them to the HA, using the FA's care-of address as the entry-point for this new tunnel.

Following are some of the advantages of reverse tunneling:

•	All datagrams from the mobile node seem to originate from its home network

•	The FA can keep track of the HA that the mobile node is registered to and tunnel all datagrams from the mobile node to its HA

Triangular Routing

Triangular routing is the path followed by a packet from the MN to the Correspondent Node (CN) via the FA. In this routing scenario, the HA receives all the packets destined to the MN from the CN and redirects them to the MN's care-of-address by forward tunneling. In this case, the MN sends packets to the FA, which are transported using conventional IP routing methods.

A key advantage of triangular routing is that reverse tunneling is not required, eliminating the need to encapsulate and de-capsulate packets a second time during a Mobile IP session since only a forward tunnel exists between the HA and PDSN/FA.

A disadvantage of using triangular routing is that the HA is unaware of all user traffic for billing purposes. Also, both the HA and FA are required to be connected to a private network. This can be especially troublesome in large networks, serving numerous enterprise customers, as each FA would have to be connected to each private network.

The following figure shows an example of how triangular routing is performed.

Mobile IP, FA and HA Tunneling/Transport Methods.

As described earlier, Mobile IP uses three basic communications protocols; PPP, IP, and Tunneled IP in the form of IP-in-IP or GRE tunnels. The following figure depicts where each of these protocols are used in a basic Mobile IP call.

Mobile IP Protocol Usage.

As depicted above, PPP is used to establish a communications session between the MN and the FA. Once a PPP session is established, the MN can communicate with the HA, using the FA as a mediator or broker. Data transport between the FA and HA use tunneled IP, either IP-in-IP or GRE tunneling. Communication between the HA and End Host can be achieved using the Internet or a private IP network and can use any IP protocol.

The following figure provides a high-level view of the steps required to make a Mobile IP call that is initiated by the MN to a HA. The following table explains each step in detail. Users should keep in mind that steps in the call flow related to the Radio Access Node (RAN) functions are intended to show a high-level overview of radio communications iterations, and as such are outside the scope of packet-based communications presented here.

Mobile IP Call Flow

Mobile IP Call Flow Description

Step	Description
1	Mobile Node (MN) secures a traffic channel over the airlink with the RAN through the BSC/PCF.
2	The PCF and PDSN establish the R-P interface for the session.
3	The PDSN and MN negotiate Link Control Protocol (LCP).
4	The PDSN and MN negotiate the Internet Protocol Control Protocol (IPCP).
5	The PDSN/FA sends an Agent Advertisement to the MN.
6	The MN sends a Mobile IP Registration Request to the PDSN/FA.
7	The PDSN/FA sends an Access Request message to the visitor AAA server.
8	The visitor AAA server proxies the request to the appropriate home AAA server.
9	The home AAA server sends an Access Accept message to the visitor AAA server.
10	The visitor AAA server forwards the response to the PDSN/FA.
11	Upon receipt of the response, the PDSN/FA forwards a Mobile IP Registration Request to the appropriate HA.
12	The HA sends an Access Request message to the home AAA server to authenticate the MN/subscriber.
13	The home AAA server returns an Access Accept message to the HA.
14	Upon receiving response from home AAA, the HA sends a reply to the PDSN/FA establishing a forward tunnel. Note that the reply includes a Home Address (an IP address) for the MN.
15	The PDSN/FA sends an Accounting Start message to the visitor AAA server. The visitor AAA server proxies messages to the home AAA server as needed.
16	The PDSN return a Mobile IP Registration Reply to the MN establishing the session allowing the MN to send/receive data to/from the PDN.
17	Upon session completion, the MN sends a Registration Request message to the PDSN/FA with a requested lifetime of 0.
18	The PDSN/FA forwards the request to the HA.
19	The HA sends a Registration Reply to the PDSN/FA accepting the request.
20	The PDSN/FA forwards the response to the MN.
21	The MN and PDSN/FA negotiate the termination of LCP effectively ending the PPP session.
22	The PCF and PDSN/FA close terminate the R-P session.
23	The HA sends an Accounting Stop message to the home AAA server.
24	The PDSN/FA sends an Accounting Stop message to the visitor AAA server.
25	The visitor AAA server proxies the accounting data to the home AAA server.

‌

Understanding Mobile IP

Mobile IP provides a network-layer solution that allows Mobile Nodes (MNs, i.e. mobile phones, wireless PDAs, and other mobile devices) to receive routed IP packets from their home network while they are connected to any visitor network using their permanent or home IP address. Mobile IP allows mobility in a dynamic method that allows nodes to maintain ongoing communications while changing links as the user traverses the global Internet from various locations outside their home network.

In Mobile IP, the Mobile Node (MN) receives an IP address, either static or dynamic, called the “home address” assigned by its Home Agent (HA). A distinct advantage with Mobile IP is that MNs can hand off between different radio networks that are served by different PDSNs.

In this scenario, the Network Access Function (such as a PDSN) in the visitor network performs as a Foreign Agent (FA), establishing a virtual session with the MN's HA. Each time the MN registers with a different PDSN/FA, the FA assigns the MN a care-of-address. Packets are then encapsulated into IP tunnels and transported between FA, HA, and the MN.

Session Continuity Support for 3GPP2 and WiMAX Handoffs

HA provides this feature for seamless session mobility for WiMAX subscriber and other access technology subscribers as well. By implementation of this feature HA can be configured for:

•	3GPP2 HA Service

•	3GPP HA Service

•	WiMAX HA Service

•	Combination of 3GPP2 and WiMAX HA Services for Dual mode device

The above configurations provide the session continuity capability that enables a dual mode device (a multi radio device) to continue its active data session as it changes its active network attachment from 3GPP2 to Wimax and vice versa with no perceived user impacts from a user experience perspective. This capability brings the following benefits:

•	common billing and customer care

•	accessing home 3GPP2 service through Wimax network and vice versa

•	better user experience with seamless session continuity

 

 

Cisco Systems Inc.

Tel: 408-526-4000

Fax: 408-527-0883