This chapter provides information for monitoring service status and performance using the show commands found in the Command Line Interface (CLI). These command have many related keywords that allow them to provide useful information on all aspects of the system ranging from current software configuration through call activity and status.
The selection of keywords described in this chapter is intended to provided the most useful and in-depth information for monitoring the system. For additional information on these and other show command keywords, refer to the Command Line Interface Reference.
In addition to the CLI, the system supports the sending of Simple Network Management Protocol (SNMP) traps that indicate status and alarm conditions. Refer to the SNMP MIB Reference for a detailed listing of these traps.
This section contains commands used to monitor the status of tasks, managers, applications and other software components in the system. Output descriptions for most of the commands are located in the Counters and Statistics Reference.
|
context egress_pgw_context_name
|
|
|
context ingress_pgw_context_name
|
|
|
context egress_pgw_context_name
|
|
|
context egress_pgw_context_name
|
|
|
show lma-service statistics lma-service service_name
|
|
|
context ingress_pgw_context_name
|
|
 Important: Refer to the System Software Task and Subsystem Descriptions appendix in the System Administration Guide for additional information on the Session subsystem and its various manager tasks. |
|
|
show subscriber full username user_name
|
|
|
show subscribers lma-service service_name
|
|
|
show subscribers configuration username subscriber_name
|
|
|
show subscribers aaa-configuration username subscriber_name
|
|
|
show subscriber pgw-only imsi ue_imsi
show lma-service session username user_name
|
|
Statistics and counters can be cleared using the CLI clear command. Refer to the Command Line Reference for detailed information on using this command.
Appendix A
Direct Tunnel
Direct Tunnel
Important: Direct tunnel is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.The direct tunnel architecture allows the establishment of a direct user plane (GTP-U) tunnel between the radio access network equipment (RNC) and the GGSN/P-GW.
Once a direct tunnel is established, the SGSN/S-GW continues to handle the control plane (RANAP/GTP-C) signaling and retains the responsibility of making the decision to establish direct tunnel at PDN context activation.
|
•
|
3G network: The SGSN establishes a user plane (GTP-U) tunnel directly between the RNC and the GGSN, using an Updated PDN Context Request toward the GGSN.
|
|
•
|
LTE network: When Gn/Gp interworking with pre-release 8 (3GPP) SGSNs is enabled, the GGSN service on the P-GW supports direct tunnel functionality. The SGSN establishes a user plane (GTP-U) tunnel directly between the RNC and the GGSN/P-GW, using an Update PDN Context Request toward the GGSN/P-GW.
|
|
•
|
LTE network: The SGSN establishes a user plane tunnel (GTP-U tunnel over an S12 interface) directly between the RNC and the S-GW, using an Update PDN Context Request toward the S-GW.
|
|
•
|
disallowed on the SGSN/S-GW
|
|
•
|
allowed on the GGSN/P-GW.
|
For more information about operator policies and configuration details, refer to the Operator Policy chapter also in this guide.
Important: If direct tunnel is allowed in the default operator policy, then any incoming call that does not have an applicable operator policy configured will have direct tunnel allowed.Before beginning any of the following procedures, you must have completed (1) the basic service configuration for the SGSN, as described in the Cisco ASR Serving GPRS Support Node Administration Guide, and (2) the creation and configuration of a valid operator policy, as described in the Operator Policy chapter in this guide.
|
Step 1
|
Configure the SGSN to setup GTP-U direct tunnel between an RNC and an access gateway by applying the example configuration presented in the Enabling Setup of GTP-U Direct Tunnels section below.
|
|
Step 2
|
Configure the SGSN to allow GTP-U direct tunnels to an access gateway, for a call filtered on the basis of the APN, by applying the example configuration presented in the Enabling Direct Tunnel per APN section below.
|
Important: It is only necessary to complete either step 2 or step 3 as a direct tunnel can not be setup on the basis of call filtering matched with both an APN profile and an IIMEI profile.|
Step 3
|
Configure the SGSN to allow GTP-U direct tunnels to a GGSN, for a call filtered on the basis of the IMEI, by applying the example configuration presented in the Enabling Direct Tunnel per IMEI section below.
|
|
Step 4
|
Configure the SGSN to allow GTP-U direct tunnel setup from a specific RNC by applying the example configuration presented in the Enabling Direct Tunnel to Specific RNCs section below.
|
|
Step 5
|
(Optional) Configure the SGSN to disallow direct tunnel setup to a single GGSN that has been configured to allow it in the APN profile. This command allows the operator to restrict use of a GGSN for any reason, such as load balancing. Refer to the direct-tunnel-disabled-ggsn command in the SGTP Service Configuration Mode chapter of the Command Line Interface Reference.
|
|
Step 6
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
Step 7
|
Check that your configuration changes have been saved by using the sample configuration found in the Verifying the SGSN Direct Tunnel Configuration section in this chapter.
|
call-control-profile <policy_name>
|
•
|
By default, APN-based direct tunnel functionality is allowed so any existing direct tunnel configuration must be removed to return to default and to ensure that the setup has not been restricted.
apn-profile <profile_name>
|
•
|
By default, direct tunnel functionality is enabled for all RNCs.
imei-profile <profile_name>
|
•
|
By default, direct tunnel functionality is enabled for all RNCs.
context <ctx_name>
iups-service <service_name>
rnc id <rnc_id>
|
•
|
Command details for configuration can be found in the Command Line Interface Reference.
|
show operator-policy full name <policy_name>
Operator Policy Name = oppolicy1
Call Control Profile Name : ccprofile1
IMEI Profile Name : imeiprofile1
APN Profile Name : apnprofile1
APN NI visitors2
APN Profile Name : apnprofile2
|
•
|
The operator policy itself will only be valid if one or more IMSI ranges have been associated with it - refer to the Operator Policy chapter, in this guide, for details.
|
show call-control-profile full name <profile_name>
Call Control Profile Name = ccprofile1
show apn-profile full name <profile_name>
Call Control Profile Name = apnprofile1
Use the following command to display and verify the direct tunnel configuration in the IMEI profile:
show imei-profile full name <profile_name>
IMEI Profile Name = imeiprofile1
show iups-service name <service_name>
context <egress_context_name> -noconfirm
interface <s12_interface_name>
ip address <s12_ipv4_address_primary>
ip address <s12_ipv4_address_secondary>
context <egress_context_name> -noconfirm
gtpu-service <s12_gtpu_egress_service_name>
bind ipv4-address <s12_interface_ip_address>
egtp-service <s12_egtp_egress_service_name>
associate gtpu-service <s12_gtpu_egress_service_name>
gtpc bind address <s12_interface_ip_address>
sgw-service <sgw_service_name> -noconfirm
associate egress-proto gtp egress-context <egress_context_name> egtp-service <s12_egtp_egress_service_name>
|
•
|
The S12 interface IP address(es) can also be specified as IPv6 addresses using the ipv6 address command.
|
Appendix B
GRE Protocol Interface
GRE Protocol Interface
Important: GRE protocol interface support is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: Commands used in the configuration samples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands.
GRE protocol interface support is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: This section provides the minimum instruction set to enable the GRE Protocol Interface support functionality on a GGSN or P-GW. Commands that configure additional functions for this feature are provided in the Command Line Interface Reference.These instructions assume that you have already configured the system level configuration as described in System Administration Guide and specific product Administration Guide.
|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
|
Step 5
|
|
Step 6
|
|
Step 7
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
Step 8
|
Verify configuration of GRE and VRF related parameters by applying the commands provided in the Verifying Your Configuration section of this chapter.
|
context <vpn_context_name> -noconfirm ]
ip vrf <vrf_name>
ip maximum-routes <max_routes>
|
•
|
<vpn_context_name> is the name of the system context you want to use for VRF. For more information, refer System Administration Guide.
|
|
•
|
|
•
|
<vrf_name> is name of the VRF which is to be associated with various interfaces.
|
|
•
|
context <vpn_context_name>
ip interface <intfc_name> tunnel
ip vrf forwarding <vrf_name>
ip address <internal_ip_address/mask>
source interface <non_tunn_intfc_to_corp>
destination address <global_ip_address>
|
•
|
<vpn_context_name> is the name of the system context you want to use for GRE interface configuration. For more information, refer Command Line Interface Reference.
|
|
•
|
<intfc_name> is name of the IP interface which is defined as a tunnel type interface and to be used for GRE tunnel interface.
|
|
•
|
<vrf_name> is the name of the VRF which is preconfigured in context configuration mode.
|
|
•
|
<internal_ip_address/mask> is the network IP address with sub-net mask to be used for VRF forwarding.
|
|
•
|
<non_tunn_intfc_to_corp> is the name a non-tunnel interface which is required by system as source interface and preconfigured. For more information on interface configuration refer System Administration Guide.
|
|
•
|
<global_ip_address> is a globally reachable IP address to be used as a destination address.
|
context <vpn_context_name>
ip vrf <vrf_name>
network <internal_ip_address/mask>
|
•
|
<vpn_context_name> is the name of the system context you want to use for OSPF routing. For more information, refer Routing in this guide.
|
|
•
|
<vrf_name> is the name of the VRF which is preconfigured in context configuration mode.
|
|
•
|
<internal_ip_address/mask> is the network IP address with sub-net mask to be used for OSPF routing.
|
context <vpn_context_name>
aaa group <aaa_server_group>
ip vrf <vrf_name>
|
•
|
<vpn_context_name> is the name of the system context you want to use for IP pool and AAA server group.
|
|
•
|
<ip_pool_name> is name of a preconfigured IP pool. For more information refer System Administration Guide.
|
|
•
|
<aaa_server_group> is name of a preconfigured AAA server group. For more information refer AAA Interface Administrtion and Reference.
|
|
•
|
<vrf_name> is the name of the VRF which is preconfigured in context configuration mode.
|
|
•
|
<internal_ip_address/mask> is the network IP address with sub-net mask to be used for IP pool.
|
context <vpn_context_name>
ip address pool name <ip_pool_name>
|
•
|
<vpn_context_name> is the name of the system context you want to use for APN configuration.
|
|
•
|
<ip_pool_name> is name of a preconfigured IP pool. For more information refer System Administration Guide.
|
|
•
|
<aaa_server_group> is name of a preconfigured AAA server group. For more information refer AAA Interface Administrtion and Reference.
|
|
•
|
<vrf_name> is the name of the VRF which is preconfigured in context configuration mode.
|
context <vpn_context_name>
|
•
|
<vpn_context_name> is the name of the system context you want to use for static route configuration.
|
|
•
|
<internal_ip_address/mask> is the network IP address with sub-net mask to be used as static route.
|
|
•
|
<tunnel_intfc_name> is name of a predefined tunnel type IP interface which is to be used for GRE tunnel interface.
|
|
•
|
<vrf_name> is the name of the VRF which is preconfigured in context configuration mode.
|
This section explains how to display and review the configurations after saving them in a .cfg file as described in the System Administration Guide and also to retrieve errors and warnings within an active configuration for a service.
Important: All commands listed here are under Exec mode. Not all commands are available on all platforms.|
Step 1
|
The output of this command displays the configuration of the all interfaces configured in a context.
|
Step 2
|
Appendix C
Gx Interface Support
Gx Interface Support
|
•
|
|
•
|
Important: In addition to standard Gx interface functionality, the Gx interface implemented here provides support of SBLP with additional AVPs in custom DPCA dictionaries. For more information on customer-specific support contact your local technical support representative. In view of required flow bandwidth and QoS, the system provides enhanced support for use of Service Based Local Policy (SBLP) to provision and control the resources used by the IMS subscriber. SBLP is based on the dynamic parameters such as the media/traffic flows for data transport, network conditions and static parameters, such as subscriber configuration and category. It also provides Flow-based Charging (FBC) mechanism to charge the subscriber dynamically based on content usage. With this additional functionality, the Cisco Systems Gateway can act as an Enhanced Policy Decision Function (E-PDF).The Rel. 6 Gx interface support is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
The Rel 6. Gx interface support is based on the following standards and request for comments (RFCs):
|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 5
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: Commands used in the configuration examples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands. context <context_name>
ims-auth-service <imsa_service_name>
p-cscf table { 1 | 2 } row-precedence <precedence_value> { address <ip_address> | ipv6-address <ipv6_address> }
diameter origin endpoint <endpoint_name>
diameter dictionary <dictionary>
failure-handling cc-request-type { any-request | initial-request | terminate-request | update-request } { diameter-result-code { any-error | <result_code> [ to <end_result_code> ] } } { continue | retry-and-terminate | terminate }
diameter host-select row-precedence <precedence_value> table { 1 | 2 } host <host_name> [ realm <realm_name> ] [ secondary host <host_name> [ realm <realm_name> ] ]
diameter host-select table { 1 | 2 } algorithm { ip-address-modulus | msisdn-modulus | round-robin }
|
•
|
<context_name> must be the name of the context where you want to enable IMS Authorization Service.
|
|
•
|
<imsa_service_name> must be the name of the IMS Authorization Service to be configured for the Gx interface authentication.
|
|
•
|
Secondary P-CSCF IP address can be configured in the P-CSCF table. Refer to the Command Line Interface Reference for more information on the p-cscf table command.
|
|
•
|
Optional: To configure the quality of service (QoS) update timeout for a subscriber, in the IMS Authorization Service Configuration Mode, enter the following command:
|
qos-update-timeout <timeout_duration>
|
•
|
Optional: To configure signalling restrictions, in the IMS Authorization Service Configuration Mode, enter the following commands:
|
signaling-flow permit server-address <ip_address> [ server-port { <port_number> | range <start_number> to <end_number> } ] [ description <string> ]
|
•
|
Optional: To configure action on packets that do not match any policy gates in the general purpose PDP context, in the IMS Authorization Service Configuration Mode, enter the following command:
|
|
•
|
Optional: To configure the algorithm to select Diameter host table, in the Policy Control Configuration Mode, enter the following command:
|
diameter host-select table { 1 | 2 } algorithm { ip-address-modulus | msisdn-modulus | round-robin }
|
Step 1
|
context <context_name>
show ims-authorization service name <imsa_service_name>
context <context_name>
apn <apn_name>
ims-auth-service <imsa_service_name>
|
•
|
<context_name> must be the name of the context in which the IMS Authorization service was configured.
|
|
•
|
<imsa_service_name> must be the name of the IMS Authorization Service configured for IMS authentication in the context.
|
show subscribers ims-auth-service <imsa_service_name>
<imsa_service_name> must be the name of the IMS Authorization Service configured for IMS authentication.
|
•
|
|
•
|
The Rel. 7 Gx interface support is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
|
•
|
Binding: Binding is the generation of an association between a Service Data Flow (SDF) and the IP CAN bearer (for GPRS a PDP context) transporting that SDF.
|
|
•
|
Gating Control: Gating control is the blocking or allowing of packets, belonging to an SDF, to pass through to the desired endpoint. A gate is described within a PCC rule and gating control is applied on a per SDF basis. The commands to open or close the gate leads to the enabling or disabling of the passage for corresponding IP packets. If the gate is closed, all packets of the related IP flows are dropped. If the gate is opened, the packets of the related IP flows are allowed to be forwarded.
|
|
•
|
Event Reporting: Event reporting is the notification of and reaction to application events to trigger new behavior in the user plane as well as the reporting of events related to the resources in the Gateway (PCEF).
|
Important: In this release, event triggers “IP-CAN_CHANGE” and “MAX_NR_BEARERS_REACHED” are not supported.|
•
|
QoS Control: QoS control is the authorization and enforcement of the maximum QoS that is authorized for a SDF or an IP-CAN bearer or a QoS Class Identifier (QCI). In case of an aggregation of multiple SDFs (for GPRS a PDP context), the combination of the authorized QoS information of the individual SDFs is provided as the authorized QoS for this aggregate.
|
Important: In this release, QoS Resource Reservation is not supported.
Important: In this release, coordination of authorized QoS scopes in mixed mode (BCM = UE_NW) is not supported.
Important: In 11.0 and later releases, Rule-Activation-Time / Rule-Deactivation-Time / Revalidation-Time AVP is successfully parsed only if its value corresponds to current time or a later time than the current IPSG time, else the AVP and entire message is rejected. In earlier releases the AVP is successfully parsed only if its value corresponds to a later time than the current IPSG time, else the AVP and entire message is rejected.
Important: In this release, provisioning of primary or secondary charging collection function name (Offline Charging Server (OFCS) addresses) over Gx is not supported.
Important: A third type of rule, the static PCC rule can be preconfigured in the chassis by the operators. Static PCC rules are not explicitly known in the PCRF, and are not under control of the PCRF. Static PCC rules are bound to general purpose bearer with no Gx control.
Important: In earlier releases, ECS used only the Priority-Level part of ARP byte for bearer binding, (along with QCI). Now the entire ARP byte is used for bearer binding (along with QCI). Since the capability and vulnerability bits are optional in a dynamic rule, if a dynamic rule is received without these flags, it is assumed that the capability bit is set to 1 (disabled) and vulnerability bit is set to 0 (enabled). For predefined rules, currently configuring these two flags is not supported, so as of now all predefined rules are assumed to have capability bit set to 1 (disabled) and vulnerability bit set to 0 (enabled).
Important: In this release, configuring the Metering Method and Reporting Level for dynamic PCC rules is not supported.
Important: In 11.0 and later releases, the maximum valid length for a charging rule name is 63 bytes. When the length of the charging rule name is greater than 63 bytes, a charging rule report with RESOURCES_LIMITATION as Rule-Failure-Code is sent. This charging rule report is sent only when the length of the rule name is lesser than 128 characters. When the charging rule name length is greater than or equal to 128 characters no charging rule report will be sent. In earlier releases, the length of the charging rule name constructed by PCRF was limited to 32 bytes.
Important: When a PCRF-provided PCC rule and a predefined PCC rule have the same precedence, the uplink SDF filters of the PCRF-provided PCC rule is applied first.
Important: In 11.0 and later releases, IMSA and ECS allow the PCRF to install two (or more) dynamic rules with the same precedence value. In earlier releases, for two distinct dynamic rules having the same precedence the second rule used to be rejected.
Important: When a PCRF-provided PCC rule and a predefined PCC rule have the same precedence, the downlink SDF filters of the PCRF-provided PCC rule are applied first.The Volume Reporting over Gx is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: Volume Reporting over Gx is applicable only for volume quota.
Important: In release 10.0, only total data usage reporting is supported, uplink/downlink level reporting is not supported. In 10.2 and later releases, it is supported.
Important: The PCEF only reports the accumulated usage since the last report for usage monitoring and not from the beginning.
Important: If the usage threshold is set to zero (infinite threshold), no further threshold events will be generated by PCEF, but monitoring of usage will continue and be reported at the end of the session.
Important: In 12.2 and later releases, usage reporting on bearer termination is supported.
Important: The Usage Reporting on Revalidation Timeout feature is available by default in non-standard implementation of Volume Reporting over Gx. In 10.2 and later releases, this is configurable in the standard implementation. This is not supported in 10.0 release for standard based volume reporting.For information on how to configure the Volume Reporting over Gx feature, see the Configuring Volume Reporting over Gx section.
|
Step 1
|
|
Step 3
|
|
Step 5
|
Optional: Configure the Volume Reporting over Gx feature as described in the Configuring Volume Reporting over Gx section.
|
|
Step 6
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: Commands used in the configuration examples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands. context <context_name>
ims-auth-service <imsa_service_name>
p-cscf table { 1 | 2 } row-precedence <precedence_value> { address <ip_address> | ipv6-address <ipv6_address> } [ secondary { address <ip_address> | ipv6-address <ipv6_address> } ]
diameter origin endpoint <endpoint_name>
diameter dictionary <dictionary>
diameter request-timeout <timeout_duration>
diameter host-select row-precedence <precedence_value> table { { { 1 | 2 } host <host_name> [ realm <realm_id> ] [ secondary host <host_name> [ realm <realm_id> ] ] } | { prefix-table { 1 | 2 } msisdn-prefix-from <msisdn_prefix_from> msisdn-prefix-to <msisdn_prefix_to> host <host_name> [ realm <realm_id> ] [ secondary host <sec_host_name> [ realm <sec_realm_id> ] algorithm { active-standby | round-robin } ] } } [ -noconfirm ]
failure-handling cc-request-type { any-request | initial-request | terminate-request | update-request } { diameter-result-code { any-error | <result_code> [ to <end_result_code> ] } } { continue | retry-and-terminate | terminate }
|
•
|
<context_name> must be the name of the context where you want to enable IMS Authorization service.
|
|
•
|
<imsa_service_name> must be the name of the IMS Authorization service to be configured for Rel. 7 Gx interface authentication.
|
To enable the Gx interface to connect to a specific PCRF for a range of subscribers configure msisdn-prefix-from <msisdn_prefix_from> and msisdn-prefix-to <msisdn_prefix_to> with the starting and ending MSISDNs respectively.
To enable the Gx interface to connect to a specific PCRF for a specific subscriber, configure both msisdn-prefix-from <msisdn_prefix_from> and msisdn-prefix-to <msisdn_prefix_to> with the same MSISDN.
|
•
|
Optional: To configure the Quality of Service (QoS) update timeout for a subscriber, in the IMS Authorization Service Configuration Mode, enter the following command:
|
qos-update-timeout <timeout_duration>
|
•
|
Optional: To configure signalling restrictions, in the IMS Authorization Service Configuration Mode, enter the following commands:
|
signaling-flow permit server-address <ip_address> [ server-port { <port_number> | range <start_number> to <end_number> } ] [ description <string> ]
|
•
|
Optional: To configure action on packets that do not match any policy gates in the general purpose PDP context, in the IMS Authorization Service Configuration Mode, enter the following command:
|
|
•
|
To configure the PCRF host destinations configured in the GGSN/PCEF, use the diameter host-select CLI commands.
|
|
•
|
To configure the GGSN/PCEF to use a pre-defined rule when the Gx fails, set the failure-handling cc-request-type CLI to continue. Policies available/in use will continue to be used and there will be no further interaction with the PCRF.
|
active-charging service <ecs_service_name>
charging-action <charging_action_name>
active-charging service <ecs_service_name>
rulebase <rulebase_name>
|
Step 1
|
context <context_name>
show ims-authorization service name <imsa_service_name>
Use the following example to apply IMS Authorization service functionality to a previously configured APN within the context configured in the Configuring Rel. 7 Gx Interface section.
context <context_name>
apn <apn_name>
ims-auth-service <imsa_service_name>
active-charging rulebase <rulebase_name>
|
•
|
<context_name> must be the name of the context in which the IMS Authorization service was configured.
|
|
•
|
<imsa_service_name> must be the name of the IMS Authorization service configured for IMS authentication in the context.
|
show subscribers ims-auth-service <imsa_service_name>
<imsa_service_name> must be the name of the IMS Authorization service configured for IMS authentication.
active-charging service <ecs_service_name>
rulebase <rulebase_name>
action priority <priority> dynamic-only ruledef <ruledef_name> charging-action <charging_action_name> monitoring-key <monitoring_key>
context <context_name>
ims-auth-service <imsa_service_name>
|
•
|
The event-update CLI which enables volume usage report to be sent in event updates is available only in 10.2 and later releases. The optional keyword reset-usage enables to support delta reporting wherein the usage is reported and reset at PCEF. If this option is not configured, the behavior is to send the usage information as part of event update but not reset at PCEF.
|
The HA/PDSN Rel. 8 Gx interface support is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
|
•
|
Important: Unconditional reporting of event triggers from PCRF to PCEF when PCEF has not requested for is not supported.
Important: In the HA/PDSN Rel. 8 Gx implementation, only the AN_GW_CHANGE (21) event trigger is supported.
Important: In the HA/PDSN Rel. 8 Gx implementation, only authorized IP-CAN Session is supported. Provisioning of authorized QoS per IP-CAN bearer, policy enforcement for authorized QoS per QCI, and coordination of authorized QoS scopes in mixed mode are not applicable.|
•
|
Important: In the HA/PDSN Rel. 8 Gx implementation, offline charging is not supported.
Important: In the HA/PDSN Rel. 8 Gx implementation, provisioning of primary or secondary charging collection function name (Offline Charging Server (OFCS) addresses) over Gx is not supported.
Important: A third kind of rule, the static PCC rule can be preconfigured in the chassis by the operators. Static PCC rules are not explicitly known in the PCRF, and are not under control of the PCRF. Static PCC rules are bound to general purpose bearer with no Gx control.
Important: Configuring the Metering Method and Reporting Level for dynamic PCC rules is not supported.
Important: When a PCRF-provided PCC rule and a predefined PCC rule have the same precedence, the uplink SDF filters of the PCRF-provided PCC rule is applied first.
Important: When a PCRF-provided PCC rule and a predefined PCC rule have the same precedence, the downlink SDF filters of the PCRF-provided PCC rule are applied first.
|
3.
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: Commands used in the configuration examples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands. context <context_name>
ims-auth-service <imsa_service_name>
diameter origin endpoint <endpoint_name>
diameter dictionary <dictionary>
diameter request-timeout <timeout_duration>
diameter host-select row-precedence <precedence_value> table { 1 | 2 } host <primary_host_name> [ realm <primary_realm_id> ] [ secondary host <secondary_host_name> [ realm <secondary_realm_id> ] ] [ -noconfirm ]
failure-handling cc-request-type { any-request | initial-request | terminate-request | update-request } { diameter-result-code { any-error | <result_code> [ to <end_result_code> ] } } { continue | retry-and-terminate | terminate }
origin realm <realm_name>
response-timeout <timeout_duration>
connection timeout <timeout_duration>
connection retry-timeout <timeout_duration>
peer <secondary_peer_name> [ realm <secondary_realm_name> ] address <ip_address> [ port <port_number> ]
|
•
|
<context_name> must be the name of the context where you want to enable IMSA service.
|
|
•
|
<imsa_service_name> must be the name of the IMSA service to be configured for Rel. 8 Gx interface authentication.
|
|
•
|
To configure the PCEF to use a pre-defined rule when the Gx fails, set the failure-handling cc-request-type CLI to continue. Policies available/in use will continue to be used and there will be no further interaction with the PCRF.
|
context <context_name>
show ims-authorization service name <imsa_service_name>
context <context_name>
encrypted password <encrypted_password>
ims-auth-service <imsa_service_name>
ip context-name <context_name>
mobile-ip home-agent <ip_address>
active-charging rulebase <rulebase_name>
|
•
|
<context_name> must be the name of the context in which the IMSA service was configured.
|
|
•
|
<imsa_service_name> must be the name of the IMSA service configured for IMS authentication in the context.
|
show subscribers ims-auth-service <imsa_service_name>
<imsa_service_name> must be the name of the IMSA service configured for IMS authentication.
The Volume Reporting over Gx is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: Volume Reporting over Gx is applicable only for volume quota.
Important: In release 10.0, only total data usage reporting is supported, uplink/downlink level reporting is not supported. In 10.2 and later releases, it is supported.
Important: The PCEF only reports the accumulated usage since the last report for usage monitoring and not from the beginning.
Important: If the usage threshold is set to zero (infinite threshold), no further threshold events will be generated by PCEF, but monitoring of usage will continue and be reported at the end of the session.
Important: In 12.2 and later releases, usage reporting on bearer termination is supported.
Important: The Usage Reporting on Revalidation Timeout feature is available by default in non-standard implementation of Volume Reporting over Gx. In 10.2 and later releases, this is configurable in the standard implementation. This is not supported in 10.0 release for standard based volume reporting.For information on how to configure the Volume Reporting over Gx feature, see the Configuring Volume Reporting over Gx section.
The Volume Reporting over Gx is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: Volume Reporting over Gx is applicable only for volume quota.
Important: In release 10.0, only total data usage reporting is supported, uplink/downlink level reporting is not supported. In 10.2 and later releases, it is supported.
Important: The PCEF only reports the accumulated usage since the last report for usage monitoring and not from the beginning.
Important: If the usage threshold is set to zero (infinite threshold), no further threshold events will be generated by PCEF, but monitoring of usage will continue and be reported at the end of the session.
Important: In 12.2 and later releases, usage reporting on bearer termination is supported.
Important: The Usage Reporting on Revalidation Timeout feature is available by default in non-standard implementation of Volume Reporting over Gx. In 10.2 and later releases, this is configurable in the standard implementation. This is not supported in 10.0 release for standard based volume reporting.For information on how to configure the Volume Reporting over Gx feature, see the Configuring Volume Reporting over Gx section.
Appendix D
Gy Interface Support
Gy Interface Support
|
•
|
|
•
|
|
•
|
|
•
|
|
•
|
The Gy interface support is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: Online charging for events (“Immediate Event Charging” and “Event Charging with Reservation”) is not supported. Only “Session Charging with Reservation” is supported.
Important: Decentralized Rating is not supported in this release. Decentralized Unit determination is done using CLI configuration.
Important: Immediate Event Charging is not supported in this release. “Reserve Units Request” and “Reserve Units Response” are done for Session Charging and not for Event Charging.
Important: Cost-Information, Remaining-Balance, and Low-Balance-Indication AVPs are not supported.
Important: Acct-Application-Id is not parsed and if sent will be ignored by the PCEF/GW. In case the Result-Code is not DIAMETER_SUCCESS, the connection to the peer is closed.
Important: DWR is sent only after Tw expiry after the last message that came from the server. Say if there is continuous exchange of messages between the peers, DWR might not be sent if (Current Time - Last message received time from server) is less than Tw.
Important: Restricting usages based on CC-Input-Octets and CC_Output-Octets is not supported in this release.If the MSCC AVP is missing in CCA-Update it is treated as invalid CCA and the session is terminated.
Important: In this release, Gy triggers are not supported for HA.
Important: In this release, Gy does not support UNIT_INDETERMINATE value.
Important: FUI AVP at command level is only supported for Terminate action.|
•
|
For more information on recovery mechanisms, please refer to the System Administration Guide.
|
•
|
|
•
|
|
•
|
|
•
|
|
•
|
|
•
|
|
3.
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: Commands used in the configuration examples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands. context <context_name>
diameter endpoint <endpoint_name>
origin realm <realm>
active-charging service <ecs_service_name>
diameter origin endpoint <endpoint_name>
diameter pending-timeout <timeout_period>
diameter dictionary <dictionary>
context <context_name>
apn <apn_name>
ims-auth-service <service>
ip context-name <context_name>
active-charging rulebase <rulebase_name>
credit-control-group <cc_group_name>
|
•
|
For information on configuring IP access lists, refer to the Access Control Lists chapter in the System Administration Guide.
|
|
•
|
For more information on configuring ECS ruledefs, refer to the ACS Ruledef Configuration Mode Commands chapter in the Command Line Interface Reference.
|
|
•
|
For more information on configuring ECS charging actions, refer to the ACS Charging Action Configuration Mode Commands chapter in the Command Line Interface Reference.
|
|
•
|
For more information on configuring ECS rulebases, refer to the ACS Rulebase Configuration Mode Commands chapter in the Command Line Interface Reference.
|
context <context_name>
diameter endpoint <endpoint_name>
origin realm <realm>
active-charging service <ecs_service_name>
ruledef <ruledef_name>
charging-action <charging_action_name>
content-id <content_id>
cca charging credit rating-group <rating_group>
rulebase <rulebase_name>
diameter origin endpoint <endpoint_name>
diameter pending-timeout <timeout>
diameter dictionary <dictionary>
context <context_name>
ip context-name <context_name>
active-charging rulebase <rulebase_name>
credit-control-group <cc_group_name>
|
•
|
For information on configuring IP access lists, refer to the Access Control Lists chapter in the Systems Administration Guide.
|
|
•
|
For more information on configuring ECS ruledefs, refer to the ACS Ruledef Configuration Mode Commands chapter in the Command Line Interface Reference.
|
|
•
|
For more information on configuring ECS charging actions, refer to the ACS Charging Action Configuration Mode Commands chapter in the Command Line Interface Reference.
|
|
•
|
For more information on configuring ECS rulebases, refer to the ACS Rulebase Configuration Mode Commands chapter in the Command Line Interface Reference.
|
|
show active-charging credit-control session-states [ rulebase <rulebase_name> ] [ content-id <content_id> ]
|
Appendix E
ICAP Interface Support
ICAP Interface Support
|
•
|
|
•
|
|
•
|
|
•
|
|
•
|
This feature supports ST16 and Cisco Chassis for the core network services configured on the system.
For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: This section provides the minimum instruction set for configuring external content filtering servers on ICAP interface on the system. For more information on commands that configure additional parameters and options, refer to CFSG Configuration Mode Commands chapter in Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
Optional. Configure the charging action to forward HTTP/WAP GET request to external content filtering servers on ICAP interface in Active Charging Configuration mode by applying the example configuration in the Configuring Charging Action for ICAP Server Group section.
|
|
Step 5
|
|
Step 6
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
origin address <ip_address>
|
•
|
<ip_address> is local IP address of the CFSG endpoint.
|
context <icap_context_name>
content-filtering server-group <icap_server_grp_name>
deny-message <msg_string>
response-timeout <timeout>
connection retry-timeout <retry_timeout>
failure-action {allow | content-insertion <content_string> | discard | redirect-url <url> | terminate-flow}
|
•
|
The maximum outstanding request per ICAP connection configured using the optional max <max_msgs> keyword is limited to one. Therefore, any other value configured using the max keyword will be ignored.
|
|
•
|
Optional. To configure the ICAP URL extraction behavior, in the Content Filtering Server Group configuration mode, enter the following command:
|
content-filtering mode server-group <cf_server_group>
|
•
|
In StarOS 8.1, the optimized-mode keyword enables ACS in the Optimized mode, wherein ACS functionality is managed by SessMgrs. In StarOS 8.1, ACS must be enabled in the Optimized mode.
|
|
•
|
In StarOS 8.3, the optimized-mode keyword is obsolete. With or without this keyword ACS is always enabled in Optimized mode.
|
|
•
|
In StarOS 8.0 and StarOS 9.0 and later, the optimized-mode keyword is not available.
|
active-charging service <acs_svc_name>
Important: All commands listed here are under Exec mode. Not all commands are available on all platforms.The following is a sample output. In this example, an ICAP Content Filtering server group named icap_cfsg1 was configured.
|
Step 2
|
Appendix F
IP Security
IP Security
Important: The IP Security is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Caution: IPSec parameter configurations saved using this release may not function properly with older software releases.|
•
|
|
•
|
PDN Access: Subscriber IP traffic is routed over an IPSec tunnel from the system to a secure gateway on the packet data network (PDN) as determined by access control list (ACL) criteria. This application can be implemented for both core network service and HA-based systems. The following figure shows IPSec configurations.
|
|
•
|
Mobile IP: Mobile IP control signals and subscriber data is encapsulated in IPSec tunnels that are established between foreign agents (FAs) and home agents (HAs) over the Pi interfaces.
|
Important: Once an IPSec tunnel is established between an FA and HA for a particular subscriber, all new Mobile IP sessions using the same FA and HA are passed over the tunnel regardless of whether or not IPSec is supported for the new subscriber sessions. Data for existing Mobile IP sessions is unaffected.|
•
|
L2TP: L2TP-encapsulated packets are routed from the system to an LNS/secure gateway over an IPSec tunnel.
|
As described in the IP Access Control Lists chapter of this guide, ACLs on the system define rules, usually permissions, for handling subscriber data packets that meet certain criteria. Crypto ACLs, however, define the criteria that must be met in order for a subscriber data packet to be routed over an IPSec tunnel.
Important: Because manual crypto map configurations require the use of static security keys (associations), they are not as secure as crypto maps that rely on dynamically configured keys. Therefore, it is recommended that they only be configured and used for testing purposes.
Important: These instructions assume that the system was previously configured to support subscriber data sessions either as a core service or an HA. In addition, parameters configured using this procedure must be configured in the same destination context on the system.|
Step 1
|
Configure one or more IP access control lists (ACLs) according to the information and instructions located in IP Access Control Lists chapter of this guide.
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
|
Step 5
|
|
Step 6
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
The FA determines the appropriate crypto map to use for IPSec protection based on the HA address attribute. It does this by comparing the address received to those configured using the isakmp peer-ha command. From the crypto map, the system determines the following:
|
|||
|
|||
|
The HA determines the appropriate crypto map to use for IPSec protection based on the FA’s address. It does this by comparing the address received to those configured using the isakmp peer-fa command. From the crypto map, the system determines the following:
|
|||
Important: Once an IPSec tunnel is established between an FA and HA for a particular subscriber, all new Mobile IP sessions using the same FA and HA are passed over the tunnel regardless of whether or not IPSec is supported for the new subscriber sessions. Data for existing Mobile IP sessions is unaffected.
Important: These instructions assume that the systems were previously configured to support subscriber data sessions either as an FA or an HA.|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
Important: Though the use of DPD is optional, it is recommended in order to ensure service availability.|
Step 5
|
|
Step 6
|
|
Step 7
|
|
Step 8
|
|
Step 9
|
Important: Though the use of DPD is optional, it is recommended in order to ensure service availability.|
Step 11
|
|
Step 12
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions and L2TP tunneling either as a PDSN or an HA. In addition, with the exception of subscriber attributes, all other parameters configured using this procedure must be configured in the same destination context on the system as the LAC service.|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
|
Step 5
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: These instructions assume that the system was previously configured to support PDSN compulsory tunneling subscriber data sessions. In addition, all parameters configured using this procedure must be configured in the same destination context on the system as the LAC service.|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
|
Step 5
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: These instructions assume that the system was previously configured to support subscriber PDP contexts and L2TP tunneling either as a GGSN. In addition, all parameters configured using this procedure must be configured in the same destination context on the system as the LAC service.|
Step 1
|
|
Step 2
|
|
Step 3
|
|
Step 4
|
|
Step 5
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: This section provides the minimum instruction set for configuring transform set on your system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Transform Configuration Mode chapters in the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
crypto ipsec transform-set <transform_name> ah hmac { md5-96 | none |sha1-96 } esp hmac { { md5-96 | none | sha1-96 } { cipher {des-cbc | 3des-cbc | aes-cbc } | none }
|
•
|
<ctxt_name> is the system context in which you wish to create and configure the crypto transform set(s).
|
|
•
|
<transform_name> is the name of the crypto transform set in the current context that you want to configure for IPSec configuration.
|
|
•
|
For more information on parameters, refer to the IPSec Transform Configuration Mode Commands chapter in the Command Line Interface Reference.
|
show crypto transform-set transform_name
Important: This section provides the minimum instruction set for configuring ISAKMP policies on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and ISAKMP Configuration Mode Commands chapters in the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the system context in which you wish to create and configure the ISAKMP policy.
|
|
•
|
<priority> dictates the order in which the ISAKMP policies are proposed when negotiating IKE SAs.
|
|
•
|
For more information on parameters, refer to the ISAKMP Configuration Mode Commands chapter in the Command Line Interface Reference.
|
Caution: Modification(s) to an existing ISAKMP policy configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
Important: This section provides the minimum instruction set for configuring ISAKMP crypto maps on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Map ISAKMP Configuration Mode chapters in the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the system context in which you wish to create and configure the ISAKMP crypto maps.
|
|
•
|
<map_name> is name by which the ISAKMP crypto map will be recognized by the system.
|
|
•
|
<acl_name> is name of the pre-configured ACL. It is used for configurations not implementing the IPSec Tunnel Failover feature and match the crypto map to a previously defined crypto ACL. This is an optional parameter.
|
|
•
|
<group_name> is name of the Crypto group configured in the same context. It is used for configurations using the IPSec Tunnel Failover feature. This is an optional parameter. For more information, refer to the Redundant IPSec Tunnel Fail-Over section of this chapter.
|
|
•
|
For more information on parameters, refer to the Crypto Map ISAKMP Configuration Mode Commands chapter in the Command Line Interface Reference.
|
show crypto map [ tag map_name | type ipsec-isakmp ]
Caution: Modification(s) to an existing ISAKMP crypto map configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
Important: This section provides the minimum instruction set for configuring dynamic crypto maps on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Map Dynamic Configuration Mode chapters in the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the system context in which you wish to create and configure the dynamic crypto maps.
|
|
•
|
<map_name> is name by which the dynamic crypto map will be recognized by the system.
|
|
•
|
For more information on parameters, refer to the Crypto Map Dynamic Configuration Mode Commands chapter in the Command Line Interface Reference.
|
show crypto map [ tag map_name | type ipsec-dynamic ]
Caution: Modification(s) to an existing dynamic crypto map configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
Important: Because manual crypto map configurations require the use of static security keys (associations), they are not as secure as crypto maps that rely on dynamically configured keys. Therefore, it is recommended that they only be configured and used for testing purposes.
Important: This section provides the minimum instruction set for configuring manual crypto maps on the system. For more information on commands that configure additional parameters and options, refer to the Context Configuration Mode Commands and Crypto Map Manual Configuration Mode chapters in the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
set session-key { inbound | outbound } { ah <ah_spi> [ encrypted ] key <ah_key> | esp <esp_spi> [ encrypted ] cipher <encryption_key> [ encrypted ] authenticator <auth_key> }
|
•
|
<ctxt_name> is the system context in which you wish to create and configure the manual crypto maps.
|
|
•
|
<map_name> is name by which the manual crypto map will be recognized by the system.
|
|
•
|
<acl_name> is name of the pre-configured ACL. It is used for configurations not implementing the IPSec Tunnel Failover feature and match the crypto map to a previously defined crypto ACL. This is an optional parameter.
|
|
•
|
<group_name> is name of the Crypto group configured in the same context. It is used for configurations using the IPSec Tunnel Failover feature. This is an optional parameter.
|
|
•
|
For more information on parameters, refer to the Crypto Map Manual Configuration Mode Commands chapter in the Command Line Interface Reference.
|
show crypto map [ tag map_name | type ipsec-manual ]
Caution: Modification(s) to an existing manual crypto map configuration will not take effect until the related security association has been cleared. Refer to the clear crypto security-association command located in the Exec Mode Commands chapter of the Command Line Interface Reference for more information.
Important: This section provides the minimum instruction set for applying manual or ISAKMP crypto maps to an interface on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.|
Step 2
|
|
Step 3
|
|
Step 4
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the system context in which the interface is configured to apply crypto map.
|
|
•
|
<interface_name> is the name of a specific interface configured in the context to which the crypto map will be applied.
|
|
•
|
<map_name> is name of the preconfigured ISAKMP or a manual crypto map.
|
interface 20/6
Important: This section provides the minimum instruction set for configuring an FA service to support IPSec on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the system context in which the FA service is configured to support IPSec.
|
|
•
|
<fa_svc_name> is name of the FA service for which you are configuring IPSec.
|
|
•
|
<ha_address> is IP address of the HA service to which FA service will communicate on IPSec.
|
|
•
|
<map_name> is name of the preconfigured ISAKMP or a manual crypto map.
|
Important: This section provides the minimum instruction set for configuring an HA service to support IPSec on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the system context in which the FA service is configured to support IPSec.
|
|
•
|
<ha_svc_name> is name of the HA service for which you are configuring IPSec.
|
|
•
|
<fa_address> is IP address of the FA service to which HA service will communicate on IPSec.
|
|
•
|
<aaa_ctxt_name> name of the context through which the HA service accesses the HAAA server to fetch the IKE S Key and S Lifetime parameters.
|
|
•
|
<map_name> is name of the preconfigured ISAKMP or a manual crypot map.
|
As described in the How the IPSec-based Mobile IP Configuration Works section of this chapter, the system uses attributes stored in a subscriber’s RADIUS profile to determine how IPSec should be implemented.
|
•
|
|
•
|
|
3 : Enables IPSec for tunnels and registration messages
4 : Disables IPSec
|
||
Important: These instructions are required for compulsory tunneling. They should only be performed for attribute-based tunneling if the Tunnel-Service-Endpoint, the SN1-Tunnel-ISAKMP-Crypto-Map, or the SN1 -Tunnel-ISAKMP-Secret are not configured in the subscriber profile.
Important: This section provides the minimum instruction set for configuring an LAC service to support IPSec on the system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
peer-lns <ip_address> [encrypted] secret <secret> [crypto-map <map_name> { [encrypted] isakmp-secret <secret> } ] [ description <text> ] [ preference <integer>]
|
•
|
<ctxt_name> is the destination context where the LAC service is configured to support IPSec.
|
|
•
|
<lac_svc_name> is name of the LAC service for which you are configuring IPSec.
|
|
•
|
<lns_address> is IP address of the LNS node to which LAC service will communicate on IPSec.
|
|
•
|
<aaa_ctxt_name> name of the context through which the HA service accesses the HAAA server to fetch the IKE S Key and S Lifetime parameters.
|
|
•
|
<map_name> is name of the preconfigured ISAKMP or a manual crypot map.
|
In addition to the subscriber profile attributes listed in the RADIUS and Subscriber Profile Attributes Used section of the L2TP Access Concentrator chapter in this guide, the table below lists the attributes required to support IPSec for use with attribute-based L2TP tunneling.
|
•
|
This section provides the minimum instruction set for configuring an L2TP service on the PDSN system. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference.
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <ctxt_name>
pdsn-service <pdsn_svc_name>
ppp tunnel-context <lac_ctxt_name>
|
•
|
<ctxt_name> is the destination context where the PDSN service is configured.
|
|
•
|
<pdsn_svc_name> is name of the PDSN service for which you are configuring attribute-based L2TP tunneling.
|
|
•
|
<lac_ctxt_name> is the name of the destination context where the LAC service is located.
|
context <ctxt_name>
|
•
|
<ctxt_name> is the destination context where the PDSN service is configured.
|
|
•
|
<pdsn_svc_name> is name of the PDSN service for which you are configuring attribute-based L2TP tunneling.
|
|
•
|
<lac_ctxt_name> is name of the destination context where the LAC service is located.
|
Important: The peer security gateway must support RFC 3706 in order for this functionality to function properly.|
•
|
Primary Tunnel is down: A primary tunnel that was previously "up" is now "down" representing an error condition.
|
|
•
|
Primary Tunnel is up: A primary tunnel that was previously "down" is now "up".
|
|
•
|
Secondary tunnel is down: A secondary tunnel that was previously "up" is now "down" representing an error condition.
|
|
•
|
Secondary Tunnel is up: A secondary tunnel that was previously "down" is now "up".
|
|
•
|
Fail-over successful: The switchover of user traffic was successful. This is generated for both primary-to-secondary and secondary-to-primary switchovers.
|
|
•
|
Unsuccessful fail-over: An error occurred when switching user traffic from either the primary to secondary tunnel or the secondary to primary tunnel.
|
|
•
|
Important: Parameters configured using this procedure must be configured in the same context on the system.
Important: The system supports a maximum of 32 crypto groups per context. However, configuring crypto groups to use the same loopback interface for secondary IPSec tunnels is not recommended and may compromise redundancy on the chassis.
Important: This section provides the minimum instruction set for configuring crypto groups on the system. For more information on commands that configure additional parameters and options, refer Command Line Interface Reference.|
Step 2
|
|
Step 3
|
|
Step 4
|
|
Step 5
|
|
Step 6
|
|
Step 7
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the destination context where the Crypto Group is to be configured.
|
|
•
|
<group_name> is name of the Crypto group you want to configure for IPSec tunnel failover support.
|
|
•
|
<acl_name> is name of the pre-configured crypto ACL. It is used for configurations not implementing the IPSec Tunnel Failover feature and match the crypto map to a previously defined crypto ACL. For more information on crypto ACL, refer Crypto Access Control List (ACL) section of this chapter.
|
|
•
|
<ctxt_name> is the system context in which you wish to create and configure the ISAKMP crypto maps.
|
|
•
|
<group_name> is name of the Crypto group configured in the same context for IPSec Tunnel Failover feature.
|
|
•
|
<map_name1> is name of the preconfigured ISAKMP crypto map to match with crypto group as primary.
|
|
•
|
<map_name2> is name of the preconfigured ISAKMP crypto map to match with crypto group as secondary.
|
DPD is configured at the context level and is used in support of the IPSec Tunnel Failover feature (refer to the Redundant IPSec Tunnel Fail-Over section) and/or to help prevent tunnel state mismatches between an FA and HA when IPSec is used for Mobile IP applications. When used with Mobile IP applications, DPD ensures the availability of tunnels between the FA and HA. (Note that the starIPSECDynTunUp and starIPSECDynTunDown SNMP traps are triggered to indicate tunnel state for the Mobile IP scenario.)
Regardless of the application, DPD must be supported/configured on both security peers. If the system is configured with DPD but it is communicating with a peer that does not have DPD configured, IPSec tunnels still come up. However, the only indication that the remote peer does not support DPD exists in the output of the show crypto isakmp security-associations summary command.
Important: If DPD is enabled while IPSec tunnels are up, it will not take affect until all of the tunnels are cleared.
Important: DPD must be configured in the same context on the system as other IPSec Parameters.|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
<ctxt_name> is the destination context where the Crypto Group is to be configured.
|
Important: This section provides the minimum instruction set for configuring an APN template to support L2TP for APN. For more information on commands that configure additional parameters and options, refer to the Command Line Interface Reference. To configure the APN to support L2TP:|
Step 1
|
|
Step 2
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
tunnel l2tp [ peer-address <lns_address> [ [ encrypted ] secret <l2tp_secret> ] [ preference <num> ] [ tunnel-context <tunnel_ctxt_name> ] [ local-address <agw_ip_address> ] [ crypto-map <map_name> { [ encrypted ] isakmp-secret <crypto_secret> } ]
|
•
|
<ctxt_name> is the system context in which the APN template is configured.
|
|
•
|
<apn_name> is name of the preconfigured APN template in which you want to configure L2TP support.
|
|
•
|
<lns_address> is IP address of the LNS node to which this APN will communicate.
|
|
•
|
<tunnel_ctxt_name> is the L2TP context in which the L2TP tunnel is configured.
|
|
•
|
<agw_ip_address> is the local IP address of the GGSN in which this APN template is configured.
|
|
•
|
<map_name> is the preconfigured crypto map (ISAKMP or manual) which is to use for L2TP.
|
For more information on ACLs, see the System Administration Guide.
|
•
|
PSK (Pre-Shared Key) Authentication: A pre-shared key is a shared secret that was previously shared between two network nodes. IPSec for LTE/SAE supports PSK such that both IPSec nodes must be configured to use the same shared secret.
|
|
•
|
X.509 Certificate-based Peer Authentication: IPSec for LTE/SAE supports X.509 certificate-based peer authentication and CA (Certificate Authority) certificate authentication as described below.
|
|
•
|
Idle Tunnel Termination: When a session manager for a service detects that all subscriber sessions using a given IPSec tunnel have terminated, the IPSec tunnel also gets terminated after a timeout period.
|
|
•
|
Service Termination: When a service running on a network node is brought down for any reason, all corresponding IPSec tunnels get terminated. This may be caused by the interface for a service going down, a service being stopped manually, or a task handling an IPSec tunnel restarting.
|
|
•
|
Unreachable Peer: If a network node detects an unreachable peer via Dead Peer Detection (DPD), the IPSec tunnel between the nodes gets terminated. DPD can be enabled per P-GW, S-GW, and MME service via the system CLI during crypto template configuration.
|
|
•
|
E-UTRAN Handover Handling: Any IPSec tunnel that becomes unusable due to an E-UTRAN network handover gets terminated, while the network node to which the session is handed initiates a new IPSec tunnel for the session.
|
Appendix G
L2TP Access Concentrator
L2TP Access Concentrator
Important: The L2TP Access Concentrator is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.
Important: The LAC service uses UDP ports 13660 through 13668 as the source port for sending packets to the LNS.|
•
|
Attribute-based tunneling: This method is used to encapsulate PPP packets for only specific users, identified during authentication. In this method, the LAC service parameters and allowed LNS nodes that may be communicated with are controlled by the user profile for the particular subscriber. The user profile can be configured locally on the system or remotely on a RADIUS server.
|
|
•
|
PDSN Service-based compulsory tunneling: This method of tunneling is used to encapsulate all incoming PPP traffic from the R-P interface coming into a PDSN service, and tunnel it to an LNS peer for authentication. It should be noted that this method does not consider subscriber configurations, since all authentication is performed by the peer LNS.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions as a PDSN.|
Step 1
|
Configure the subscriber profiles according to the information and instructions located in the Configuring Subscriber Profiles for L2TP Support section of this chapter.
|
|
Step 2
|
Configure one or more LAC services according to the information and instructions located in the Configuring LAC Services section of this chapter.
|
|
Step 3
|
Configure the PDSN service(s) with the tunnel context location according to the instructions located in the Modifying PDSN Services for L2TP Support section of this chapter.
|
|
Step 4
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
2.
|
The PDSN service detects its tunnel-type parameter is configured to L2TP and its tunnel-context parameter is configured to the Destination context.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions as a PDSN.|
Step 1
|
Configure one or more LAC services according to the information and instructions located in the Configuring LAC Services section of this chapter.
|
|
Step 2
|
Configure the PDSN service(s) according to the instructions located in the Modifying PDSN Services for L2TP Support section of this chapter.
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
|
•
|
Transparent IP: The APN template’s L2TP parameter settings will be applied to the session.
|
|
•
|
Non-transparent IP: Since authentication is required, L2TP parameter attributes in the subscriber profile (if configured) will take precedence over the settings in the APN template.
|
|
•
|
PPP: The APN template’s L2TP parameter settings will be applied and all of the subscriber’s PPP packets will be forwarded to the specified LNS.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions as a GGSN or P-GW.|
1.
|
Configure the APN template to support L2TP tunneling according to the information and instructions located in the Modifying APN Templates to Support L2TP section of this chapter.
|
Important: L2TP tunneling can be configured within individual subscriber profiles as opposed/or in addition to configuring support with an APN template. Subscriber profile configuration is described in the Configuring Subscriber Profiles for L2TP Support section of this chapter.|
2.
|
Configure one or more LAC services according to the information and instructions located in the Configuring LAC Services section of this chapter.
|
|
3.
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions as an HA.|
Step 1
|
Configure the subscriber profiles according to the information and instructions located in the Configuring Subscriber Profiles for L2TP Support section of this chapter.
|
|
Step 2
|
Configure one or more LAC services according to the information and instructions located in the Configuring LAC Services section of this chapter.
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: Since the instructions for configuring subscribers differ between RADIUS server applications, this section only provides the individual attributes that can be added to the subscriber profile. Refer to the documentation that shipped with your RADIUS server for instructions on configuring subscribers.
 Important: If the LAC service and egress interface are configured in the same context as the core service or HA service, this attribute is not needed. |
|||||||||
 Important: This attribute is only used when the loadbalance-tunnel-peers parameter or SN-Tunnel-Load-Balancing attribute configured to prioritized. |
|||||||||
|
|||||||||
Important: The configuration of RADIUS-based subscriber profiles is not discussed in this document. Please refer to the documentation supplied with your RADIUS server for further information.
Important: This section provides the minimum instruction set for configuring local subscriber profile for L2TP support on the system. For more information on commands that configure additional parameters and options, refer to the LAC Service Configuration Mode Commands chapter in the Command Line Interface Reference.|
Step 1
|
Configure the “Local” subscriber with L2TP tunnel parameters and the load balancing parameters with action by applying the example configuration in the Configuring Local Subscriber section.
|
|
Step 2
|
Verify your L2TP configuration by following the steps in the Verifying the L2TP Configuration section.
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <ctxt_name> [-noconfirm]
subscriber name <subs_name>
tunnel l2tp peer-address <lns_ip_address> [ preference <integer> | [ encrypted ] secret <secret_string> | tunnel-context <context_name> | local-address <local_ip_address> }
|
•
|
<ctxt_name> is the system context in which you wish to configure the subscriber profile.
|
|
•
|
<lns_ip_address> is the IP address of LNS server node and <local_ip_address> is the IP address of system which is bound to LAC service.
|
show subscriber configuration username user_name
Important: Not all commands, keywords and functions may be available. Functionality is dependent on platform and license(s).
Important: This section provides the minimum instruction set for configuring LAC service support on the system. For more information on commands that configure additional parameters and options, refer to the LAC Service Configuration Mode Commands chapter in the Command Line Interface Reference.|
Step 1
|
Configure the LAC service on system and bind it to an IP address by applying the example configuration in the Configuring LAC Service section.
|
|
Step 2
|
Optional. Configure LNS peer information if the Tunnel-Service-Endpoint attribute is not configured in the subscriber profile or PDSN compulsory tunneling is supported by applying the example configuration in the Configuring LNS Peer section.
|
|
Step 4
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <dst_ctxt_name> [-noconfirm]
lac-service <service_name>
bind address <ip_address>
|
•
|
<dst_ctxt_name> is the destination context where you want to configure the LAC service.
|
context <dst_ctxt_name> [ -noconfirm ]
lac-service <service_name>
peer-lns <ip_address> [encrypted] secret <secret> [crypto-map <map_name> {[encrypted] isakmp-secret <secret> }] [description <text>] [ preference <integer>]
|
•
|
<dst_ctxt_name> is the destination context where the LAC service is configured.
|
show lac-service name service_name
Important: This section provides the minimum instruction set for modifying PDSN service for L2TP support on the system. For more information on commands that configure additional parameters and options, refer to the LAC Service Configuration Mode Commands chapter in the Command Line Interface Reference.|
Step 1
|
|
Step 2
|
Verify your configuration to modify PDSN service by following the steps in the Verifying the PDSN Service for L2TP Support section.
|
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <source_ctxt_name> [ -noconfirm ]
pdsn-service <pdsn_service_name>
ppp tunnel-context <lac_context_name>
|
•
|
<source_ctxt_name> is the name of the source context containing the PDSN service, which you want to modify for L2TP support.
|
|
•
|
<pdsn_service_name> is the name of the pre-configured PDSN service, which you want to modify for L2TP support.
|
|
•
|
<lac_context_name> is typically the destination context where the LAC service is configured.
|
show pdsn-service name pdsn_service_name
Important: This section provides the minimum instruction set for configuring LAC service support on the system. For more information on commands that configure additional parameters and options, refer to the LAC Service Configuration Mode Commands chapter in the Command Line Interface Reference.|
Step 1
|
Modify the APN template to support L2TP with LNS server address and other parameters by applying the example configuration in the Assigning LNS Peer Address in APN Template section.
|
|
Step 2
|
Optional. If L2TP will be used to tunnel transparent IP PDP contexts, configure the APN’s outbound username and password by applying the example configuration in the Configuring Outbound Authentication section.
|
|
Step 3
|
Verify your APN configuration by following the steps in the Verifying the APN Configuration section.
|
|
Step 4
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <dst_ctxt_name> [-noconfirm]
apn <apn_name>
tunnel l2tp [ peer-address <lns_address> [ [ encrypted ] secret <l2tp_secret> ] [ preference <integer> ] [ tunnel-context <l2tp_context_name> ] [ local-address <local_ip_address> ] [ crypto-map <map_name> { [ encrypted ] isakmp-secret <crypto_secret> } ]
|
•
|
<dst_ctxt_name> is the name of system destination context in which the APN is configured.
|
|
•
|
<apn_name> is the name of the pre-configured APN template which you want to modify for the L2TP support.
|
|
•
|
<lns_address> is the IP address of LNS server node and <local_ip_address> is the IP address of system which is bound to LAC service.
|
context <dst_ctxt_name> [ -noconfirm ]
apn <apn_name>
|
•
|
<dst_ctxt_name> is the destination context where APN template is is configured.
|
|
•
|
<apn_name> is the name of the pre-configured APN template which you want to modify for the L2TP support.
|
show apn name apn_name
Appendix H
Mobile IP Registration Revocation
Mobile IP Registration Revocation
Important: This license is enabled by default; however, not all features are supported on all platforms and other licenses may be required for full functionality as described in this chapter.
Important: Registration Revocation functionality is also supported for Proxy Mobile IP. However, only the HA can initiate the revocation for Proxy-MIP calls.
Important: The Revocation Support Extension in the RRQ or RRP must be protected by the FA-HA Authentication Extension. Therefore, an FA-HA SPI must be configured at the FA and the HA for this to succeed.|
•
|
FA service(s): Registration Revocation must be enabled and operational parameters optionally configured.
|
|
•
|
HA service(s): Registration Revocation must be enabled and operational parameters optionally configured.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions for a core network service with FA and/or an HA according to the instructions described in the respective product Administration Guide.
Important: Commands used in the configuration samples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands.Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
Appendix I
Proxy-Mobile IP
Proxy-Mobile IP
|
•
|
Important: Proxy Mobile IP is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.|
•
|
Scenario 1: The AAA server that authenticates the MN at the PDSN allocates an IP address to the MN. Note that the PDSN does not allocate an address from its IP pools.
|
|
•
|
Scenario 2: The HA assigns an IP address to the MN from one of its locally configured dynamic pools.
|
|
•
|
Scenario 1: The AAA server that authenticates the MN at the ASN GW allocates an IP address to the MN. Note that the ASN GW does not allocate an address from its IP pools.
|
|
•
|
Scenario 2: The HA assigns an IP address to the MN from one of its locally configured dynamic pools.
|
|
a. If PDIF service does not support Multiple-Authentication and ANOTHER_AUTH_FOLLOWS Notify payload is received, then PDIF sends IKE_AUTH Response with appropriate error and terminate the IKEv2 session by sending INFORMATIONAL (Delete) Request.b. If ANOTHER_AUTH_FOLLOWS Notify payload is not present in the IKE_AUTH Request, PDIF allocates the IP address from the locally configured pools. However, if proxy-mip-required is enabled, then PDIF initiates Proxy-MIP setup to HA by sending P-MIP RRQ. When PDIF receives the Proxy-MIP RRP, it takes the Home Address (and DNS addresses if any) and sends the IKE_AUTH Response back to MS by including CP payload with Home Address and DNS addresses. In either case, IKEv2 setup will finish at this stage and IPSec tunnel gets established with a Tunnel Inner Address (TIA).
|
|
|
PDIF checks the validity of the AUTH payload and initiates Proxy-MIP setup request to the Home Agent if proxy-mip-required is enabled. The HA address may be received from the RADIUS server in the Access Accept (Step 16) or may be locally configured. PDIF may also remember the HA address from the first authentication received in the final DEA message.
|
|
|
If proxy-mip-required is disabled, PDIF assigns the IP address from the local pool.
|
|
Important: For Proxy-MIP call setup using PAP, the first 14 steps are the same as for CHAP authentication. However, here they deviate because the MS does not support EAP-MD5 authentication, but EAP-GTC. In response to the EAP-MD5 challenge, the MS instead responds with legacy-Nak with EAP-GTC. The diagram below picks up at this point.
Important: Not all commands and keywords/variables may be supported. This depends on the platform type and the installed license(s).|
•
|
FA service(s): Proxy Mobile IP must be enabled, operation parameters must be configured, and FA-HA security associations must be specified.
|
|
•
|
HA service(s): FA-HA security associations must be specified.
|
|
•
|
Subscriber profile(s): Attributes must be configured to allow the subscriber(s) to use Proxy Mobile IP. These attributes can be configured in subscriber profiles stored locally on the system or remotely on a RADIUS AAA server.
|
|
•
|
APN template(s): Proxy Mobile IP can be supported for every subscriber IP PDP context facilitated by a specific APN template based on the configuration of the APN.
|
Important: These instructions assume that the system was previously configured to support subscriber data sessions as a core network service and/or an HA according to the instructions described in the respective product administration guide. fa-ha-spi remote-address { ha_ip_address | ip_addr_mask_combo } spi-number number { encrypted secret enc_secret | secret secret } [ description string ][ hash-algorithm { hmac-md5 | md5 | rfc2002-md5 } | replay-protection { timestamp | nonce } | timestamp-tolerance tolerance ]
|
•
|
The proxy-mip max-retransmissions command configures the maximum number re-try attempts that the FA service is allowed to make when sending Proxy Mobile IP Registration Requests to the HA.
|
|
•
|
proxy-mip retransmission-timeout configures the maximum amount of time allowed by the FA for a response from the HA before re-sending a Proxy Mobile IP Registration Request message.
|
|
•
|
proxy-mip renew-percent-time configures the amount of time that must pass prior to the FA sending a Proxy Mobile IP Registration Renewal Request.
|
If the advertisement registration lifetime configured for the FA service is 900 seconds and the renew-time is configured to 50%, then the FA requests a lifetime of 900 seconds in the Proxy MIP registration request. If the HA grants a lifetime of 600 seconds, then the FA sends the Proxy Mobile IP Registration Renewal Request message after 300 seconds have passed.
|
•
|
Use the fa-ha-spi remote-addresscommand to modify configured FA-HA SPIs to support Proxy Mobile IP. Refer to the Command Line Interface Reference for the full command syntax.
|
Important: Note that FA-HA SPIs must be configured for the Proxy-MIP feature to work, while it is optional for regular MIP.|
•
|
Use the authentication mn-ha allow-noauth command to configure the FA service to allow communications from the HA without authenticating the HA.
|
show fa-service name <fa_service_name>
|
•
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Proceed to the optional Configuring Proxy MIP HA Failover section to configure Proxy MIP HA Failover support or skip to the Configuring HA Services section to configure HA service support for Proxy Mobile IP.
Important: This configuration in this section is optional. proxy-mip ha-failover [ max-attempts <max_attempts> | num-attempts-before-switching <num_attempts> | timeout <seconds> ]
|
•
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: Note that FA-HA SPIs must be configured for the Proxy MIP feature to work while it is optional for regular MIP. Also note that the above syntax assumes that FA-HA SPIs were previously configured as part of the HA service as described in respective product Administration Guide. The replay-protection and timestamp- tolerance keywords should only be configured when supporting Proxy Mobile IP. fa-ha-spi remote-address <fa_ip_address> spi-number <number> { encrypted secret <enc_secret> | secret <secret> } [ description <string> ] [ hash-algorithm { hmac-md5 | md5 | rfc2002-md5 } ] replay-protection { timestamp | nonce } | timestamp-tolerance <tolerance> ]
|
•
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <context_name>
Important: Instructions for configuring RADIUS-based subscriber profiles are not provided in this document. Please refer to the documentation supplied with your server for further information.|
For Proxy Mobile IP, this attribute must be set to Simple IP.
|
|
|||||
|
This attribute must be enabled to support Proxy Mobile IP.
|
|
|||||
 Important: Regardless of the configuration of this attribute, the FA facilitating the Proxy Mobile IP session will not allow simultaneous Simple IP and Mobile IP sessions for the MN. |
||||||
show subscribers configuration username <subscriber_name>
|
•
|
Optional: If you have enabled the Proxy-MIP HA Failover feature, use the mobile-ip home-agent ha_address alternate command to specify the secondary, or alternate HA.
|
|
•
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
subscriber_name is the name of the subscriber and can be from 1 to 127 alpha and/or numeric characters and is case sensitive.
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
Important: This is an optional configuration. In addition, attributes returned from the subscriber’s profile for non-transparent IP PDP contexts take precedence over the configuration of the APN.[local]host_name#
[local]host_name(config)#
context <context_name>
context_name is the name of the system destination context designated for APN configuration. The name must be from 1 to 79 alpha and/or numeric characters and is case sensitive.The following prompt appears:
apn <apn_name>
apn_name is the name of the APN that is being configured. The name must be from 1 to 62 alpha and/or numeric characters and is not case sensitive. It may also contain dots (.) and/or dashes (-).The following prompt appears:
|
Step 5
|
Optional. GGSN/FA MN-NAI extension can be skipped in MIP Registration Request by entering following command:
|
[local]host_name#
|
Step 7
|
show apn { all | name <apn_name> }
|
Step 9
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Appendix J
Traffic Policing and Shaping
Traffic Policing and Shaping
Important: Traffic Policing and Shaping is a licensed Cisco feature. A separate feature license may be required. Contact your Cisco account representative for detailed information on specific licensing requirements. For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.|
•
|
|
•
|
Committed Data Rate (CDR): The guaranteed rate (in bits per second) at which packets can be transmitted/received for the subscriber during the sampling interval.
|
|
•
|
Peak Data Rate (PDR): The maximum rate (in bits per second) that subscriber packets can be transmitted/received for the subscriber during the sampling interval.
|
|
•
|
Burst-size: The maximum number of bytes that can be transmitted/received for the subscriber during the sampling interval for both committed (CBS) and peak (PBS) rate conditions. This represents the maximum number of tokens that can be placed in the subscriber’s “bucket”. Note that the committed burst size (CBS) equals the peak burst size (PBS) for each subscriber.
|
|
•
|
Drop: The offending packet is discarded.
|
|
•
|
Transmit: The offending packet is passed.
|
|
•
|
Lower the IP Precedence: The packet’s ToS bit is set to “0”, thus downgrading it to Best Effort, prior to passing the packet. Note that if the packet’s ToS bit was already set to “0”, this action is equivalent to “Transmit”.
|
Important: In 3GPP service attributes received from the RADIUS server supersede the settings in the APN.
Important: Commands used in the configuration samples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands.
Important: Instructions for configuring RADIUS-based subscriber profiles are not provided in this document. Please refer to the documentation supplied with your server for further information. context <context_name>
subscriber name <user_name>
context <context_name>
subscriber name <user_name>
|
•
|
There are numerous keyword options associated with the qos traffic-police direction { downlink | uplink } command.
|
Important: If the exceed/violate action is set to “lower-ip-precedence”, the TOS value for the outer packet becomes “best effort” for packets that exceed/violate the traffic limits regardless of what the ip user-datagram-tos-copy command in the Subscriber Configuration mode is configured to. In addition, the “lower-ip-precedence” option may also override the configuration of the ip qos-dscp command (also in the Subscriber Configuration mode). Therefore, it is recommended that command not be used when specifying this option.context <context_name>
show subscriber configuration username <user_name>
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <context_name>
apn <apn_name>
context <context_name>
apn <apn_name>
|
•
|
There are numerous keyword options associated with qos rate-limit { downlink | uplink } command.
|
|
•
|
Optionally, configure the maximum number of PDP contexts that can be facilitated by the APN to limit the APN’s bandwidth consumption by entering the following command in the configuration:
|
Important: If a “subscribed” traffic class is received, the system changes the class to background and sets the following: The uplink and downlink guaranteed data rates are set to 0. If the received uplink or downlink data rates are 0 and traffic policing is disabled, the default of 64 kbps is used. When enabled, the APN configured values are used. If the configured value for downlink max data rate is larger than can fit in an R4 QoS profile, the default of 64 kbps is used. If either the received uplink or downlink max data rates is non-zero, traffic policing is employed if enabled for the background class. The received values are used for responses when traffic policing is disabled.show apn { all | name <apn_name> }
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
Important: In 3GPP, service attributes received from the RADIUS server supersede the settings in the APN.
Important: Commands used in the configuration samples in this section provide base functionality to the extent that the most common or likely commands and/or keyword options are presented. In many cases, other optional commands and/or keyword options are available. Refer to the Command Line Interface Reference for complete information regarding all commands.
Important: Instructions for configuring RADIUS-based subscriber profiles are not provided in this document. Please refer to the documentation supplied with your server for further information. context <context_name>
subscriber name <user_name>
context <context_name>
subscriber name <user_name>
|
•
|
There are numerous keyword options associated with qos traffic-shape direction { downlink | uplink } command.
|
Important: If the exceed/violate action is set to “lower-ip-precedence”, the TOS value for the outer packet becomes “best effort” for packets that exceed/violate the traffic limits regardless of what the ip user-datagram-tos-copy command in the Subscriber Configuration mode is configured to. In addition, the “lower-ip-precedence” option may also override the configuration of the ip qos-dscp command (also in the Subscriber Configuration mode). Therefore, it is recommended that command not be used when specifying this option.context <context_name>
show subscriber configuration username <user_name>
|
Step 3
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
context <context_name>
subscriber name <user_name>
context <context_name>
apn <apn_name>
|
Step 2
|
Optional. Configure the maximum number of PDP contexts that can be facilitated by the APN to limit the APN’s bandwidth consumption by entering the following command in the configuration:
|
context <context_name>
apn <apn_name>
|
•
|
There are numerous keyword options associated with qos rate-limit direction { downlink | uplink } command.
|
For more information on commands, refer Command Line Interface Reference
|
•
|
If the exceed/violate action is set to lower-ip-precedence, this command may override the configuration of the ip qos-dscp command in the GGSN service configuration mode for packets from the GGSN to the SGSN. In addition, the GGSN service ip qos-dscp command configuration can override the APN setting for packets from the GGSN to the Internet. Therefore, it is recommended that command not be used in conjunction with this action.
|
show apn { all | name <apn_name> }
|
Step 4
|
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode command save configuration. For additional information on how to verify and save configuration files, refer to the System Administration Guide and the Command Line Interface Reference.
|
The RADIUS attributes listed in the following table are used to configure Traffic Policing for CDMA subscribers (PDSN, HA) configured on remote RADIUS servers. More information on these attributes can be found in the AAA Interface Administration and Reference.
|
NOTE: It is recommended that this parameter be configured to at least the greater of the following two values: 1) 3 times greater than packet MTU for the subscriber connection, OR 2) 3 seconds worth of token accumulation within the “bucket” for the configured peak-data-rate.
|
|
|
NOTE: It is recommended that this parameter be configured to at least the greater of the following two values: 1) 3 times greater than packet MTU for the subscriber connection, OR 2) 3 seconds worth of token accumulation within the “bucket” for the configured peak-data-rate.
|
|
The RADIUS attributes listed in the following table are used to configure Traffic Policing for UMTS subscribers configured on remote RADIUS servers. More information on these attributes can be found in the AAA Interface Administration and Reference.
Appendix K
Sample Configuration Files
Sample Configuration Files
configure /flash/flashconfig/<pgw_license_name>.cfg
card <slot_number>
card <slot_number>
interface <name>
port ethernet <slot#/port#>
bind interface <lcl_cntxt_intrfc_name> local
server <ip_address>
snmp heartbeat interval <minutes>
snmp community <string> read-write
system contact <string>
system location <string>
context <pgw_context_name>
interface <s5s8_interface_name>
ip address <ipv4_address>
ipv6 address <address>
gtpp charging-agent address <gx_ipv4_address>
gtpp echo-interval <seconds>
gtpp dictionary <name>
policy accounting <rf_policy_name> -noconfirm
accounting-level {level_type}
operator-string <string>
cc profile <index>
apn <rf_acct_apn_name>
associate accounting-policy <rf_policy_name>
ims-auth-service <gx_ims_service_name>
aaa group <rf-radius_group_name>
dns primary <ipv4_address>
dns secondary <ipv4_address>
ip access-group <name> in
ip access-group <name> out
mediation-device context-name <pgw_context_name>
ip context-name <pdn_context_name>
ipv6 access-group <name> in
ipv6 access-group <name> out
aaa group <gz_acct_apn_name>
gtpp group default accounting-context <aaa_context_name>
ims-auth-service <gx_ims_service_name>
ip access-group <name> in
ip access-group <name> out
ip context-name <pdn_context_name>
active-charging rulebase <gz_rulebase_name>
radius attribute nas-ip-address address <ipv4_address>
diameter authentication endpoint <s6b_cfg_name>
diameter accounting endpoint <rf_cfg_name>
egtp-service <egtp_service_name> -noconfirm
associate gtpu-service <gtpu_service_name>
gtpc bind address <s5s8_interface_ip_address>
gtpu-service <gtpu_service_name>
bind ipv4-address <s5s8_interface_ip_address>
bind ipv6-address <s5s8_interface_ip_address>
pgw-servers <pgw_service_name> -noconfirm
associate egtp-service <egtp_service_name>
context <pdn_context_name> -noconfirm
interface <pdn_sgi_ipv4_interface_name>
ip address <ipv4_address>
interface <pdn_sgi_ipv6_interface_name>
ipv6 address <address>
ip access-list <name>
redirect css service <name> any
ipv6 access-list <name>
redirect css service <name> any
ruledef <name>
<rule_definition>
<rule_definition>
ruledef icmp-pkts
ruledef qci3
ruledef static
charging-action <name>
<action>
<action>
charging-action icmp
charging-action qci3
content-id <id>
allocation-retention-priority <priority>
tft-packet-filter qci3
charging-action static
allocation-retention-priority <priority>
tft-packet-filter qci3
rulebase <name>
<rule_base>
<rule_base>
rulebase <gx_rulebase_name>
egcdr threshold interval <interval>
context <aaa_context_name> -noconfirm
interface <gx_interface_name>
ipv6 address <address>
ip address <ipv4_address>
interface <gy_interface_name>
ipv6 address <address>
ip address <ipv4_address>
interface <gz_interface_name>
ip address <ipv4_address>
interface <rf_interface_name>
ip address <ipv4_address>
ipv6 address <address>
ims-auth-service <gx_ims_service_name>
p-cscf discovery table <#> algorithm round-robin
diameter origin endpoint <gx_cfg_name>
diameter host-select table <#> algorithm round-robin
diameter endpoint <gx_cfg_name>
origin realm <realm_name>
route-entry peer <gx_cfg_name>
diameter endpoint <gy_cfg_name>
origin realm <realm_name>
route-entry peer <gy_cfg_name>
diameter endpoint <rf_cfg_name>
origin realm <realm_name>
route-entry peer <rf_cfg_name>
port ethernet <slot_number/port_number>
port ethernet <slot_number/port_number>
port ethernet <slot_number/port_number>
port ethernet <slot_number/port_number>
qci-qos-mapping <name>
configure /flash/flashconfig/<pgw_license_name>.cfg
card <slot_number>
card <slot_number>
interface <name>
port ethernet <slot#/port#>
bind interface <lcl_cntxt_intrfc_name> local
server <ip_address>
snmp heartbeat interval <minutes>
snmp community <string> read-write
system contact <string>
system location <string>
context <pgw_context_name>
interface <s2a_interface_name>
ipv6 address <ipv6_address>
source interface <name>
destination address <ipv4_or_ipv6_address>
policy accounting <rf_policy_name> -noconfirm
accounting-level {level_type}
operator-string <string>
apn <name>
associate accounting-policy <rf_policy_name>
ims-auth-service <gx_ims_service_name>
aaa group <rf-radius_group_name>
dns primary <ipv4_address>
dns secondary <ipv4_address>
ip access-group <name> in
ip access-group <name> out
mediation-device context-name <pgw_context_name>
ip context-name <pdn_context_name>
ipv6 access-group <name> in
ipv6 access-group <name> out
aaa group <rf-radius_group_name>
radius dictionary <name>
diameter authentication endpoint <s6b_cfg_name>
diameter accounting endpoint <rf_cfg_name>
radius attribute nas-ip-address address <ipv4_address>
diameter authentication endpoint <s6b_cfg_name>
diameter accounting endpoint <rf_cfg_name>
lma-service <lma_service_name> -noconfirm
bind address <s2a_interface_ipv6_address>
pgw-service <pgw_service_name>
associate lma-service <lma_service_name>
context <pdn_context_name> -noconfirm
interface <pdn_sgi_ipv4_interface_name>
ip address <ipv4_address>
interface <pdn_sgi_ipv6_interface_name>
ipv6 address <address>
ip access-list <name>
redirect css service <name> any
ipv6 access-list <name>
redirect css service <name> any
ruledef <name>
<rule_definition>
<rule_definition>
ruledef <name>
<rule_definition>
<rule_definition>
charging-action <name>
<action>
<action>
charging-action <name>
<action>
<action>
rulebase <name>
<rule_base>
<rule_base>
context <aaa_context_name> -noconfirm
interface <gx_interface_name>
ipv6 address <address>
ip address <ipv4_address>
interface <gy_interface_name>
ipv6 address <address>
ip address <ipv4_address>
interface <s6b_interface_name>
ip address <ipv4_address>
ipv6 address <address>
interface <rf_interface_name>
ip address <ipv4_address>
ipv6 address <address>
ims-auth-service <gx_ims_service_name>
p-cscf discovery table <#> algorithm round-robin
diameter origin endpoint <gx_cfg_name>
diameter host-select table <#> algorithm round-robin
diameter endpoint <gx_cfg_name>
origin realm <realm_name>
route-entry peer <gx_cfg_name>
diameter endpoint <gy_cfg_name>
origin realm <realm_name>
route-entry peer <gy_cfg_name>
diameter endpoint <s6b_cfg_name>
origin realm <realm_name>
route-entry peer <s6b_cfg_name>
diameter endpoint <rf_cfg_name>
origin realm <realm_name>
route-entry peer <rf_cfg_name>
port ethernet <slot_number/port_number>
port ethernet <slot_number/port_number>
port ethernet <slot_number/port_number>
port ethernet <slot_number/port_number>
qci-qos-mapping <name>
Appendix L
P-GW Engineering Rules
P-GW Engineering Rules
|
•
|
Caution: Large numbers of services greatly increase the complexity of management and may impact overall system performance (i.e. resulting from such things as system handoffs). Therefore, it is recommended that a large number of services only be configured if your application absolutely requires it. Please contact your local service representative for more information.