The Cisco® ASR
5x00 provides wireless carriers with a flexible solution that functions
as a System Architecture Evolution (SAE) Gateway with Packet Data
Network (PDN) Gateway (P-GW) and Serving Gateway (S-GW) functions
in LTE-SAE (3GPP2 Long Term Evolution-System Architecture Evolution)
wireless data networks.
S-GW Features and
Functionality - Base Software
IMPORTANT:
The
SAEGW supports all of these features if an S-GW service is assigned
to the SAEGW service.
This section describes
the features and functions supported by default in the base software for
the S-GW service and do not require any additional licenses to implement
the functionality.
IMPORTANT:
To configure the basic
service and functionality on the system for the S-GW service, refer
to the configuration examples provided in the Serving Gateway Administration
Guide.
The following features
are supported and brief descriptions are provided in this section:
ANSI T1.276 Compliance
ANSI T1.276 specifies
security measures for Network Elements (NE). In particular it specifies
guidelines for password strength, storage, and maintenance security measures.
ANSI T1.276 specifies
several measures for password security. These measures include:
-
Password strength
guidelines
-
Password storage guidelines
for network elements
-
Password maintenance,
e.g. periodic forced password changes
These measures are
applicable to the ASR 5x00 Platform and the Web Element Manager since
both require password authentication. A subset of these guidelines
where applicable to each platform will be implemented. A known subset
of guidelines, such as certificate authentication, are not applicable
to either product. Furthermore, the platforms support a variety
of authentication methods such as RADIUS and SSH which are dependent
on external elements. ANSI T1.276 compliance in such cases will
be the domain of the external element. ANSI T1.276 guidelines will only
be implemented for locally configured operators.
APN-level Traffic
Policing
The S-GW now
supports traffic policing for roaming scenarios where the foreign
P-GW does not enforce traffic classes. Traffic policing is used
to enforce bandwidth limitations on subscriber data traffic. It
caps packet bursts and data rates at configured burst size and data
rate limits respectively for given class of traffic.
Traffic Policing is
based on RFC2698- A Two Rate Three Color Marker (trTCM) algorithm.
The trTCM meters an IP packet stream and marks its packets green, yellow,
or red. A packet is marked red if it exceeds the Peak Information
Rate (PIR). Otherwise it is marked either yellow or green depending
on whether it exceeds or doesn't exceed the Committed Information
Rate (CIR). The trTCM is useful, for example, for ingress policing
of a service, where a peak rate needs to be enforced separately
from a committed rate.
Bulk Statistics
Support
The system's
support for bulk statistics allows operators to choose to view not
only statistics that are of importance to them, but also to configure
the format in which it is presented. This simplifies the post-processing
of statistical data since it can be formatted to be parsed by external,
back-end processors.
When used in conjunction
with the Web Element Manager, the data can be parsed, archived,
and graphed.
The system can be
configured to collect bulk statistics (performance data) and send
them to a collection server (called a receiver). Bulk statistics
are statistics that are collected in a group. The individual statistics
are grouped by schema. Following is a partial list of supported schemas:
-
System: Provides
system-level statistics
-
Card: Provides
card-level statistics
-
Port: Provides
port-level statistics
-
MAG: Provides
MAG service statistics
-
S-GW: Provides
S-GW node-level service statistics
-
IP Pool: Provides
IP pool statistics
-
APN: Provides
Access Point Name statistics
The system supports
the configuration of up to four sets (primary/secondary)
of receivers. Each set can be configured with to collect specific
sets of statistics from the various schemas. Statistics can be pulled
manually from the system or sent at configured intervals. The bulk statistics
are stored on the receiver(s) in files.
The format of the
bulk statistic data files can be configured by the user. Users can
specify the format of the file name, file headers, and/or
footers to include information such as the date, system host name,
system uptime, the IP address of the system generating the statistics
(available for only for headers and footers), and/or the
time that the file was generated.
The Cisco Web Element
Manager is capable of further processing the statistics data through XML
parsing, archiving, and graphing.
The Bulk Statistics
Server component of the Web Element Manager parses collected statistics
and stores the information in its PostgreSQL database. It can also
generate XML output and can send it to a Northbound NMS or an alternate
bulk statistics server for further processing.
Additionally, the Bulk
Statistics server can archive files to an alternative directory
on the server. The directory can be on a local file system or on
an NFS-mounted file system on the Web Element Manager server.
IMPORTANT:
For more information
on bulk statistic configuration, refer to the Configuring and Maintaining
Bulk Statistics chapter in the System Administration Guide.
Circuit Switched
Fall Back (CSFB) Support
Circuit Switched
Fall Back (CSFB) enables the UE to camp on an EUTRAN cell and originate
or terminate voice calls through a forced switchover to the circuit
switched (CS) domain or other CS-domain services (for example, Location
Services (LCS) or supplementary services). Additionally, SMS delivery
via the CS core network is realized without CSFB. Since LTE EPC
networks were not meant to directly anchor CS connections, when
any CS voice services are initiated, any PS based data activities
on the EUTRAN network will be temporarily suspended (either the
data transfer is suspended or the packet switched connection is
handed over to the 2G/3G network).
CSFB provides an interim
solution for enabling telephony and SMS services for LTE operators
that do not plan to deploy IMS packet switched services at initial service
launch.
The S-GW supports CSFB
messaging over the S11 interface over GTP-C. Supported messages
are:
The S-GW forwards Suspend
Notification messages towards the P-GW to suspend downlink data
for non-GBR traffic; the P-GW then drops all downlink packets. Later, when
the UE finishes with CS services and moves back to E-UTRAN, the
MME sends a Resume Notification message to the S-GW which forwards
the message to the P-GW. The downlink data traffic then resumes.
Closed Subscriber Group
Support
The S-GW supports
the following Closed Subscriber Group (CSG) Information Elements (IEs)
and Call Detail Record:
- User CSG Information (UCI)
IE in S5/S8
- CSG Information Reporting
Action IE and functionality in S5/S8
- An SGW-CDR that includes
a CSG record
Congestion Control
The congestion
control feature allows you to set policies and thresholds and specify
how the system reacts when faced with a heavy load condition.
Congestion control
monitors the system for conditions that could potentially degrade
performance when the system is under heavy load. Typically, these
conditions are temporary (for example, high CPU or memory utilization)
and are quickly resolved. However, continuous or large numbers of
these conditions within a specific time interval may have an impact
the system’s ability to service subscriber sessions. Congestion
control helps identify such conditions and invokes policies for
addressing the situation.
Congestion control operation
is based on configuring the following:
-
Congestion Condition
Thresholds: Thresholds dictate the conditions for which congestion
control is enabled and establish limits for defining the state of
the system (congested or clear). These thresholds function in a
way similar to operational thresholds that are configured for the
system as described in the
Thresholding
Configuration Guide. The primary difference is that when congestion
thresholds are reached, a service congestion policy and an SNMP
trap, starCongestion, are generated.
A threshold tolerance
dictates the percentage under the configured threshold that must
be reached in order for the condition to be cleared. An SNMP trap,
starCongestionClear, is then triggered.
-
Port Utilization Thresholds:
If you set a port utilization threshold, when the average utilization
of all ports in the system reaches the specified threshold, congestion
control is enabled.
-
Port-specific Thresholds:
If you set port-specific thresholds, when any individual port-specific
threshold is reached, congestion control is enabled system-wide.
-
Service Congestion
Policies: Congestion policies are configurable for each service.
These policies dictate how services respond when the system detects
that a congestion condition threshold has been crossed.
IMPORTANT:
For more information
on congestion control, refer to the Congestion Control appendix
in the System Administration Guide.
Downlink Delay Notification
This feature is
divided between the following:
- Value Handling
- Throttling
Value Handling
This feature provides
for the handling of delay value information elements (IEs) at the
S-GW. When a delay value is received at the S-GW from a particular
MME, the S-GW delays sending data notification requests for all
idle calls belonging to that particular MME. Once the timer expires,
requests can be sent. The delay value at the S-GW is determined
by the factor received in the delay value IE (as a part of either
a Modify Bearer Request or a Data Downlink Notification Request)
and a hard-coded base factor of 50 ms at the S-GW
Throttling
This feature provides
additional controls allowing the S-GW to set factors that “throttle” the continuous
sending and receiving of DDN messages. A single command configures
the throttling parameters supporting this feature,
A description of the ddn throttle command
is located in the S-GW Service Configuration Mode Commands chapter
in the eHRPD/LTE
Command Line Interface Reference.
Dynamic GTP Echo Timer
The Dynamic GTP
Echo Timer enables the eGTP and GTP-U services to better manage
GTP paths during network congestion. As opposed to the default echo
timer which uses fixed intervals and retransmission timers, the
dynamic echo timer adds a calculated round trip timer (RTT) that
is generated once a full request/response procedure has
completed. A multiplier can be added to the calculation for additional support
during congestion periods.
Event Reporting
The S-GW can
be configured to send a stream of user event data to an external
server. As users attach, detach, and move throughout the network,
they trigger signaling events, which are recorded and sent to an
external server for processing. Reported data includes failure reasons,
nodes selected, user information (IMSI, IMEI, MSISDN), APN, failure
codes (if any) and other information on a per PDN-connection level.
Event data is used to track the user status via near real time monitoring
tools and for historical analysis of major network events.
The S-GW Event Reporting appendix
at the end of this guide describes the trigger mechanisms and event
record elements used for event reporting.
The SGW sends each
event record in comma separated values (CSV) format. The record
for each event is sent to the external server within 60 seconds
of its occurrence. The session-event-module command
in the Context Configuration mode allows an operator to set the
method and destination for transferring event files, as well as the
format and handling characteristics of event files. For a detailed
description of this command, refer to the Command Line Interface
Reference.
A sample configuration
sequence for enabling S-GW event reporting is provided in the Serving Gateway Configuration chapter
of this guide.
Idle-mode Signaling
Reduction Support
The S-GW now supports
Idle-mode Signaling Reduction (ISR) allowing for a control connection
to exist between an S-GW and an MME and S4-SGSN. The S-GW stores
mobility management parameters from both nodes while the UE stores
session management contexts for both the EUTRAN and GERAN/UTRAN.
This allows a UE, in idle mode, to move between the two network
types without needing to perform racking area update procedures,
thus reducing the signaling previously required. ISR support on the
S-GW is embedded and no configuration is required however, an optional
feature license is required to enable this feature.
ISR support on the S-GW
is embedded and no configuration is required, however, an optional
feature license must be purchased to enable this feature.
IP Access Control
Lists
IP access control
lists allow you to set up rules that control the flow of packets
into and out of the system based on a variety of IP packet parameters.
IP access lists, or
Access Control Lists (ACLs) as they are commonly referred to, control
the flow of packets into and out of the system. They are configured on
a per-context basis and consist of “rules” (ACL
rules) or filters that control the action taken on packets that
match the filter criteria. Once configured, an ACL can be applied
to any of the following:
-
-
All traffic facilitated
by a context (known as a policy ACL)
-
-
All subscriber sessions
facilitated by a specific context
IMPORTANT:
The S-GW supports
interface-based ACLs only. For more information on IP access control lists,
refer to the IP Access
Control Lists appendix in the System Administration Guide.
IPv6 Capabilities
IPv6 enables
increased address efficiency and relieves pressures caused by rapidly
approaching IPv4 address exhaustion problem.
The S-GW platform
offers the following IPv6 capabilities:
IPv6 Connections to
Attached Elements
IPv6 transport and
interfaces are supported on all of the following connections:
-
Diameter Gxc policy
signaling interface
-
Diameter Rf offline
charging interface
-
Lawful Intercept (X1,
X2 interfaces)
Routing and Miscellaneous
Features
-
-
-
IPv6 flows (Supported
on all Diameter QoS and Charging interfaces as well as Inline Services
(for example, ECS, P2P detection, Stateful Firewall, etc.)
Location Reporting
Location reporting
can be used to support a variety of applications including emergency calls,
lawful intercept, and charging. This feature reports both user location
information (ULI).
ULI data reported in
GTPv2 messages includes:
-
TAI-ID: Tracking
Area Identity
-
MCC: MNC: Mobile
Country Code, Mobile Network Code
-
The S-GW stores the
ULI and also reports the information to the accounting framework.
This may lead to generation of Gz and Rf Interim records. The S-GW
also forwards the received ULI to the P-GW. If the S-GW receives
the UE time zone IE from the MME, it forwards this IE towards the
P-GW across the S5/S8 interface.
Management System
Overview
The system's
management capabilities are designed around the Telecommunications
Management Network (TMN) model for management - focusing on providing
superior quality Network Element (NE) and element management system
(Web Element Manager) functions. The system provides element management
applications that can easily be integrated, using standards-based
protocols (CORBA and SNMPv1, v2), into higher-level management systems
- giving wireless operators the ability to integrate the system
into their overall network, service, and business management systems.
In addition, all management is performed out-of-band for security
and to maintain system performance.
Cisco's O+M
module offers comprehensive management capabilities to the operators
and enables them to operate the system more efficiently. There are multiple
ways to manage the system either locally or remotely using its out-of-band
management interfaces.
These include:
-
Using the Command
Line Interface (CLI)
-
Remote login using
Telnet, and Secure Shell (SSH) access to CLI through SPIO card's Ethernet
management interfaces
-
Local login through
the console port on the SPIO card via an RS-232 serial connection
-
Using the Web Element
Manager application
-
Supports communications
through 10 Base-T, 100 Base-TX, 1000 Base-TX, or
-
1000Base-SX (optical
gigabit Ethernet) Ethernet management interfaces on the SPIO
-
Client-Server model
supports any browser (such as, Microsoft Internet Explorer v6.0 and
above or others)
-
Supports Common Object
Request Broker Architecture (CORBA) protocol and Simple Network
Management Protocol version 1 (SNMPv1) for fault management
-
Provides complete
Fault, Configuration, Accounting, Performance, and Security (FCAPS)
capabilities
-
Can be easily integrated
with higher-level network, service, and business layer applications
using the Object Management Group's (OMG’s) Interface Definition
Language (IDL)
The following figure
demonstrates these various element management options and how they can
be utilized within the wireless carrier network.
Figure 12. Element Management
Methods
IMPORTANT:
P-GW management functionality
is enabled by default for console-based access. For GUI-based management
support, refer to the
Web Element Manager section
in this chapter.
IMPORTANT:
For more information
on command line interface based management, refer to the Command Line Interface
Reference and P-GW
Administration Guide.
Multiple PDN Support
Enables an
APN-based user experience that enables separate connections to be
allocated for different services including IMS, Internet, walled
garden services, or offdeck content services.
The Mobile Access Gateway
(MAG) function on the S-GW can maintain multiple PDN or APN connections
for the same user session. The MAG runs a single node level Proxy
Mobile IPv6 (PMIP) tunnel for all user sessions toward the Local
Mobility Anchor (LMA) function of the P-GW.
When a user wants to
establish multiple PDN connections, the MAG brings up the multiple PDN
connections over the same PMIPv6 session to one or more P-GW LMAs.
The P-GW in turn allocates separate IP addresses (Home Network Prefixes)
for each PDN connection and each one can run one or multiple EPC
default and dedicated bearers. To request the various PDN connections,
the MAG includes a common MN-ID and separate Home Network Prefixes,
APNs and a Handover Indication Value equal to one in the PMIPv6
Binding Updates.
IMPORTANT:
Up to 11 multiple PDN
connections are supported.
Online/Offline
Charging
The Cisco EPC
platforms support offline charging interactions with external OCS
and CGF/CDF servers. To provide subscriber level accounting,
the Cisco EPC platform supports integrated Charging Transfer Function
(CTF) and Charging Data Function (CDF) / Charging Gateway
Function (CGF). Each gateway uses Charging-IDs to distinguish between
default and dedicated bearers within subscriber sessions.
The ASR 5x00 platform
offers a local directory to enable temporary file storage and buffer
charging records in persistent memory located on a pair of dual
redundant RAID hard disks. Each drive includes 147GB of storage
and up to 100GB of capacity is dedicated to storing charging records.
For increased efficiency it also possible to enable file compression using
protocols such as GZIP.
The offline charging
implementation offers built-in heart beat monitoring of adjacent
CGFs. If the Cisco P-GW has not heard from the neighboring CGF within
the configurable polling interval, it will automatically buffer
the charging records on the local drives until the CGF reactivates
itself and is able to begin pulling the cached charging records.
Online: Gy Reference
Interface
The P-GW supports
a Policy Charging Enforcement Function (PCEF) to enable Flow Based Bearer
Charging (FBC) via the Gy reference interface to adjunct Online
Charging System (OCS) servers. The Gy interface provides a standardized
Diameter interface for real-time content-based charging of data services.
It is based on the 3GPP standards and relies on quota allocation.
The Gy interface provides an online charging interface that works
with the ECS Deep Packet Inspection feature. With Gy, customer traffic can
be gated and billed. Both time- and volume-based charging models
are supported.
Offline: Gz Reference
Interface
The Cisco P-GW
and S-GW support 3GPP Release 8 compliant offline charging as defined in
TS 32.251,TS 32.297 and 32.298. Whereas the S-GW generates SGW-CDRs
to record subscriber level access to PLMN resources, the P-GW creates
PGW-CDRs to record user access to external networks. Additionally
when Gn/Gp interworking with SGSNs is enabled, the GGSN
service on the P-GW records G-CDRs to record user access to external
networks.
To provide subscriber
level accounting, the Cisco S-GW supports integrated Charging Transfer
Function (CTF) and Charging Data Function (CDF). Each gateway uses
Charging-IDs to distinguish between default and dedicated bearers
within subscriber sessions.
The Gz reference interface
between the CDF and CGF is used to transfer charging records via
the GTPP protocol. In a standards based implementation, the CGF
consolidates the charging records and transfers them via an FTP
or SFTP connection over the Bm reference interface to a back-end
billing mediation server. The Cisco EPC gateways also offer the
ability to transfer charging records between the CDF and CGF serve
via FTP or SFTP. CDR records include information such as Record
Type, Served IMSI, ChargingID, APN Name, TimeStamp, Call Duration,
Served MSISDN, PLMN-ID, etc.
Offline: Rf Reference
Interface
Cisco EPC
platforms also support the Rf reference interface to enable direct
transfer of charging files from the CTF function of the S-GW to
external CDF or CGF servers. This interface uses Diameter Accounting
Requests (Start, Stop, Interim, and Event) to transfer charging
records to the CDF/CGF. Each gateway relies on triggering
conditions for reporting chargeable events to the CDF/CGF.
Typically as EPS bearers are activated, modified or deleted, charging
records are generated. The EPC platforms include information such
as Subscription-ID (IMSI), Charging-ID (EPS bearer identifier) and
separate volume counts for the uplink and downlink traffic.
Operator Policy Support
The operator
policy provides mechanisms to fine tune the behavior of subsets
of subscribers above and beyond the behaviors described in the user
profile. It also can be used to control the behavior of visiting
subscribers in roaming scenarios, enforcing roaming agreements and
providing a measure of local protection against foreign subscribers.
An operator policy associates
APNs, APN profiles, an APN remap table, and a call-control profile
to ranges of IMSIs. These profiles and tables are created and defined
within their own configuration modes to generate sets of rules and
instructions that can be reused and assigned to multiple policies.
In this manner, an operator policy manages the application of rules
governing the services, facilities, and privileges available to
subscribers. These policies can override standard behaviors and
provide mechanisms for an operator to get around the limitations
of other infrastructure elements, such as DNS servers and HSSs.
The operator policy
configuration to be applied to a subscriber is selected on the basis
of the selection criteria in the subscriber mapping at attach time.
A maximum of 1,024 operator policies can be configured. If a UE
was associated with a specific operator policy and that policy is
deleted, the next time the UE attempts to access the policy, it
will attempt to find another policy with which to be associated.
A default operator policy
can be configured and applied to all subscribers that do not match any
of the per-PLMN or IMSI range policies.
The S-GW uses operator
policy to set the Accounting Mode - GTPP (default), RADIUS/Diameter
or none. However, the accounting mode configured for the call-control
profile will override this setting.
Changes to the operator
policy take effect when the subscriber re-attaches and subsequent EPS
Bearer activations.
QoS Bearer Management
Provides a foundation
for contributing towards improved Quality of User Experience (QoE) by
enabling deterministic end-to-end forwarding and scheduling treatments
for different services or classes of applications pursuant to their
requirements for committed bandwidth resources, jitter and delay.
In this way, each application receives the service treatment that
users expect.
An EPS bearer is a
logical aggregate of one or more Service Data Flows (SDFs), running
between a UE and a P-GW in case of GTP-based S5/S8, and
between a UE and HSGW in case of PMIP-based S2a connection. An EPS
bearer is the level of granularity for bearer level QoS control
in the EPC/E-UTRAN. The Cisco P-GW maintains one or more Traffic
Flow Templates (TFTs) in the downlink direction for mapping inbound
Service Data Flows (SDFs) to EPS bearers. The P-GW maps the traffic
based on the downlink TFT to the S5/S8 bearer. The Cisco
P-GW offers all of the following bearer-level aggregate constructs:
QoS Class Identifier
(QCI): An operator provisioned value that controls bearer level
packet forwarding treatments (for example, scheduling weights, admission thresholds,
queue management thresholds, link layer protocol configuration,
etc). Cisco EPC gateways also support the ability to map the QCI
values to DiffServ codepoints in the outer GTP tunnel header of
the S5/S8 connection. Additionally, the platform also provides
configurable parameters to copy the DSCP marking from the encapsulated
payload to the outer GTP tunnel header.
Guaranteed Bit Rate
(GBR): A GBR bearer is associated with a dedicated EPS bearer
and provides a guaranteed minimum transmission rate in order to
offer constant bit rate services for applications such as interactive
voice that require deterministic low delay service treatment.
Maximum Bit Rate (MBR):
The MBR attribute provides a configurable burst rate that limits
the bit rate that can be expected to be provided by a GBR bearer
(e.g. excess traffic may get discarded by a rate shaping function).
The MBR may be greater than or equal to the GBR for a given dedicated
EPS bearer.
Aggregate Maximum Bit
Rate (AMBR): AMBR denotes a bit rate of traffic for a group
of bearers destined for a particular PDN. The Aggregate Maximum
Bit Rate is typically assigned to a group of Best Effort service
data flows over the Default EPS bearer. That is, each of those EPS
bearers could potentially utilize the entire AMBR, e.g. when the
other EPS bearers do not carry any traffic. The AMBR limits the
aggregate bit rate that can be expected to be provided by the EPS
bearers sharing the AMBR (e.g. excess traffic may get discarded
by a rate shaping function). AMBR applies to all Non-GBR bearers
belonging to the same PDN connection. GBR bearers are outside the
scope of AMBR.
Policing: The
Cisco P-GW offers a variety of traffic conditioning and bandwidth management
capabilities. These tools enable usage controls to be applied on
a per-subscriber, per-EPS bearer or per-PDN/APN basis.
It is also possible to apply bandwidth controls on a per-APN AMBR
capacity. These applications provide the ability to inspect and
maintain state for user sessions or Service Data Flows (SDFs) within
them using shallow L3/L4 analysis or high touch deep packet
inspection at L7. Metering of out-of-profile flows or sessions can
result in packet discards or reducing the DSCP marking to Best Effort
priority.
Rf Diameter Accounting
Provides the
framework for offline charging in a packet switched domain. The
gateway support nodes use the Rf interface to convey session related,
bearer related or service specific charging records to the CGF and
billing domain for enabling charging plans.
The Rf reference interface
enables offline accounting functions on the HSGW in accordance with
3GPP Release 8 specifications. In an LTE application the same reference
interface is also supported on the S-GW and P-GW platforms. The
Cisco gateways use the Charging Trigger Function (CTF) to transfer
offline accounting records via a Diameter interface to an adjunct
Charging Data Function (CDF) / Charging Gateway Function
(CGF). The HSGW and Serving Gateway collect charging information
for each mobile subscriber UE pertaining to the radio network usage
while the P-GW collects charging information for each mobile subscriber
related to the external data network usage.
The S-GW collects
information per-user, per IP CAN bearer or per service. Bearer charging
is used to collect charging information related to data volumes
sent to and received from the UE and categorized by QoS traffic
class. Users can be identified by MSISDN or IMSI.
Flow Data Records (FDRs)
are used to correlate application charging data with EPC bearer usage
information. The FDRs contain application level charging information
like service identifiers, rating groups, IMS charging identifiers
that can be used to identify the application. The FDRs also contain
the authorized QoS information (QCI) that was assigned to a given
flow. This information is used correlate charging records with EPC bearers.
Subscriber Level
Trace
Provides a 3GPP
standards-based session level trace function for call debugging
and testing new functions and access terminals in an LTE environment.
As a complement to
Cisco's protocol monitoring function, the S-GW supports 3GPP standards
based session level trace capabilities to monitor all call control events
on the respective monitored interfaces including S1-U, S11, S5/S8,
and Gxc. The trace can be initiated using multiple methods:
-
Management initiation
via direct CLI configuration
-
Management initiation
at HSS with trace activation via authentication response messages
over S6a reference interface
-
Signaling based activation
through signaling from subscriber access terminal
Note: Once the trace
is provisioned it can be provisioned through the access cloud via various
signaling interfaces.
The session level trace
function consists of trace activation followed by triggers. The
EPC network element buffers the trace activation instructions for
the provisioned subscriber in memory using camp-on monitoring. Trace
files for active calls are buffered as XML files using non-volatile
memory on the local dual redundant hard drives on the ASR 5x00 platform.
The Trace Depth defines the granularity of data to be traced. Six
levels are defined including Maximum, Minimum and Medium with ability
to configure additional levels based on vendor extensions.
All call control activity
for active and recorded sessions is sent to an off-line Trace Collection
Entity (TCE) using a standards-based XML format over an FTP or secure
FTP (SFTP) connection. In the current release the IPv4 interfaces
are used to provide connectivity to the TCE. Trace activation is
based on IMSI or IMEI.
Once a subscriber level
trace request is activated it can be propagated via the S5/S8
signaling to provision the corresponding trace for the same subscriber
call on the P-GW. The trace configuration will only be propagated
if the P-GW is specified in the list of configured Network Element
types received by the S-GW. Trace configuration can be specified
or transferred in any of the following message types:
-
S11: Create Session
Request
-
S11: Trace Session
Activation
-
S11: Modify Bearer
Request
As subscriber level
trace is a CPU intensive activity the maximum number of concurrently monitored
trace sessions per Cisco P-GW or S-GW is 32. Use in a production
network should be restricted to minimize the impact on existing services.
Threshold Crossing
Alerts (TCA) Support
Thresholding
on the system is used to monitor the system for conditions that
could potentially cause errors or outage. Typically, these conditions
are temporary (i.e high CPU utilization, or packet collisions on
a network) and are quickly resolved. However, continuous or large
numbers of these error conditions within a specific time interval
may be indicative of larger, more severe issues. The purpose of thresholding
is to help identify potentially severe conditions so that immediate
action can be taken to minimize and/or avoid system downtime.
The system supports
Threshold Crossing Alerts for certain key resources such as CPU,
memory, IP pool addresses, etc. With this capability, the operator
can configure threshold on these resources whereby, should the resource
depletion cross the configured threshold, a SNMP Trap would be sent.
The following thresholding
models are supported by the system:
-
Alert: A value
is monitored and an alert condition occurs when the value reaches
or exceeds the configured high threshold within the specified polling
interval. The alert is generated then generated and/or
sent at the end of the polling interval.
-
Alarm: Both high
and low threshold are defined for a value. An alarm condition occurs
when the value reaches or exceeds the configured high threshold
within the specified polling interval. The alert is generated then
generated and/or sent at the end of the polling interval.
Thresholding reports
conditions using one of the following mechanisms:
-
SNMP traps: SNMP
traps have been created that indicate the condition (high threshold
crossing and clear) of each of the monitored values.
Generation of specific
traps can be enabled or disabled on the chassis. Ensuring that only important
faults get displayed. SNMP traps are supported in both Alert and
Alarm modes.
-
Logs: The system
provides a facility called threshold for which active and event
logs can be generated. As with other system facilities, logs are
generated Log messages pertaining to the condition of a monitored
value are generated with a severity level of WARNING.
Logs are supported in
both the Alert and the Alarm models.
-
Alarm System:
High threshold alarms generated within the specified polling interval
are considered outstanding until a the condition no longer exists
or a condition clear alarm is generated. Outstanding alarms are
reported to the system's alarm subsystem and are viewable through
the Alarm Management menu in the Web Element Manager.
The Alarm System is
used only in conjunction with the Alarm model.
IMPORTANT:
For more information
on threshold crossing alert configuration, refer to the Thresholding Configuration Guide.
P-GW Features and
Functionality - Base Software
IMPORTANT:
The
SAEGW supports all of these features if a P-GW service is assigned
to the SAEGW service.
This section describes
the features and functions supported by default in the base software for
the P-GW service and do not require any additional licenses to implement
the functionality.
IMPORTANT:
To configure the basic
service and functionality on the system for the P-GW service, refer
to the configuration examples provided in the Packet Data Network Gateway
Administration Guide.
This section describes
the following features:
3GPP R9 Volume Charging
Over Gx
Also known as
accumulated usage tracking over Gx, this 3GPP R9 enhancement provides
a subset of the volume and charging control functions defined in
TS 29.212 based on usage quotas between a P-GW and PCRF. The quotas
can be assigned to the default bearer or any of the dedicated bearers
for the PDN connection.
This feature enables
volume reporting over Gx, which entails usage monitoring and reporting
of the accumulated usage of network resources on an IP-CAN session
or service data flow basis. PCRF subscribes to the usage monitoring
at session level or at flow level by providing the necessary information
to PCEF. PCEF in turn reports the usage to the PCRF when the conditions
are met. Based on the total network usage in real-time, the PCRF
will have the information to enforce dynamic policy decisions.
When usage monitoring
is enabled, the PCEF can monitor the usage volume for the IP-CAN session,
or applicable service data flows, and report accumulated usage to
the PCRF based on any of the following conditions:
-
When a usage threshold
is reached,
-
When all PCC rules
for which usage monitoring is enabled for a particular usage monitoring
key are removed or deactivated,
-
When usage monitoring
is explicitly disabled by the PCRF,
-
When an IP CAN session
is terminated or,
-
When requested by
the PCRF.
Accumulated volume
reporting can be measured by total volume, the uplink volume, or
the downlink volume as requested by the PCRF. When receiving the
reported usage from the PCEF, the PCRF deducts the value of the
usage report from the total allowed usage for that IP-CAN session,
usage monitoring key, or both as applicable.
AAA Server Groups
Value-added feature
to enable VPN service provisioning for enterprise or MVNO customers. Enables
each corporate customer to maintain its own AAA servers with its
own unique configurable parameters and custom dictionaries.
This feature provides
support for up to 800 AAA server groups and 800 NAS IP addresses
that can be provisioned within a single context or across the entire
chassis. A total of 128 servers can be assigned to an individual
server group. Up to 1,600 accounting, authentication and/or
mediation servers are supported per chassis.
ANSI T1.276 Compliance
ANSI T1.276
specifies security measures for Network Elements (NE). In particular
it specifies guidelines for password strength, storage, and maintenance
security measures.
ANSI T1.276 specifies
several measures for password security. These measures include:
-
Password strength guidelines
-
Password storage guidelines
for network elements
-
Password maintenance,
e.g. periodic forced password changes
These measures are
applicable to the ASR 5x00 and the Web Element Manager since both require
password authentication. A subset of these guidelines where applicable
to each platform will be implemented. A known subset of guidelines,
such as certificate authentication, are not applicable to either
product. Furthermore, the platforms support a variety of authentication methods
such as RADIUS and SSH which are dependent on external elements.
ANSI T1.276 compliance in such cases will be the domain of the external
element. ANSI T1.276 guidelines will only be implemented for locally
configured operators.
APN Support
The P-GW's Access Point
Name (APN) support offers several benefits:
-
Extensive parameter
configuration flexibility for the APN.
-
Creation of subscriber
tiers for individual subscribers or sets of subscribers within the APN.
-
Virtual APNs to allow
differentiated services within a single APN.
In StarOS v12.x and
earlier, up to 1024 APNs can be configured in the P-GW.
In StarOS v14.0 and later,
up to 2048 APNs can be configured in the P-GW. An APN may be
configured for any type of PDP context, i.e., PPP, IPv4, IPv6 or
both IPv4 and IPv6. Many dozens of parameters may be configured
independently for each APN.
Here are a few highlights
of what may be configured:
-
Accounting: RADIUS,
GTPP or none. Server group to use. Charging characteristics. Interface
with mediation servers.
-
Authentication:
Protocol, such as, CHAP or PAP or none. Default username/password.
Server group to use. Limit for number of PDP contexts.
-
Enhanced Charging:
Name of rulebase to use, which holds the enhanced charging configuration
(e.g., eG-CDR variations, charging rules, prepaid/postpaid
options, etc.).
-
IP: Method for
IP address allocation (e.g., local allocation by P-GW, Mobile IP,
DHCP, etc.). IP address ranges, with or without overlapping ranges
across APNs.
-
Tunneling: PPP
may be tunneled with L2TP. IPv4 may be tunneled with GRE, IP-in-IP
or L2TP. Load-balancing across multiple tunnels. IPv6 is tunneled
in IPv4. Additional tunneling techniques, such as, IPsec and VLAN
tagging may be selected by the APN, but are configured in the P-GW
independently from the APN.
-
QoS: IPv4 header
ToS handling. Traffic rate limits for different 3GPP traffic classes.
Mapping of R98 QoS attributes to work around particular handset
defections. Dynamic QoS renegotiation (described elsewhere).
After an APN is determined
by the P-GW, the subscriber may be authenticated/authorized with
an AAA server. The P-GW allows the AAA server to return VSAs (Vendor
Specific Attributes) that override any/all of the APN configuration.
This allows different subscriber tier profiles to be configured
in the AAA server, and passed to the P-GW during subscriber authentication/authorization.
Assume Positive for
Gy-based Quota Tracking
In the current
implementation, the PCEF uses a Diameter based Gy interface to interact
with the OCS and obtain quota for each subscriber's data session.
Now, the PCEF can retry the OCS after a configured amount of quota
has been utilized or after a configured amount of time. The quota
value would be part of the dcca-service configuration, and would
apply to all subscribers using this dcca-service. The temporary
quota will be specified in volume (MB) and/or time (minutes)
to allow for enforcement of both quota tracking mechanisms, individually
or simultaneously.
When a user consumes
the interim total quota or time configured for use during failure
handling scenarios, the PCEF shall retry the OCS server to determine
if functionality has been restored. In the event that services have
been restored, quota assignment and tracking will proceed as per
standard usage reporting procedures. Data used during the outage will
be reported to the OCS. In the event that the OCS services have
not been restored, the PCEF should reallocate with the configured
amount of quota and time assigned to the user. The PCEF should report
all accumulated used data back to OCS when OCS is back online. If
multiple retries and interim allocations occur, the PCEF shall report
quota used during all allocation intervals.
When the Gy interface
is unavailable, the P-GW shall enter “assume positive” mode.
Unique treatment is provided to each subscriber type. Each functional
application shall be assigned unique temporary quota volume amounts
and time periods based on a command-level AVP from the PCRF on the
Gx interface. In addition, a configurable option has been added
to disable assume positive functionality for a subscriber group
identified by a command-level AVP sent on the Gx interface by the
PCRF.
Bulk Statistics
Support
The system's
support for bulk statistics allows operators to choose to view not
only statistics that are of importance to them, but also to configure
the format in which it is presented. This simplifies the post-processing
of statistical data since it can be formatted to be parsed by external,
back-end processors.
When used in conjunction
with the Web Element Manager, the data can be parsed, archived,
and graphed.
The system can be configured
to collect bulk statistics (performance data) and send them to a
collection server (called a receiver). Bulk statistics are statistics
that are collected in a group. The individual statistics are grouped
by schema. Following is a list of supported schemas for P-GW:
-
APN: Provides Access
Point Name statistics
-
Card: Provides
card-level statistics
-
Context: Provides
context service statistics
-
Diameter-acct:
Provides Diameter Accounting statistics
-
Diameter-auth:
Provides Diameter Authentication statistics
-
ECS: Provides Enhanced
Charging Service statistics
-
EGTPC: Provides
Evolved GPRS Tunneling Protocol - Control message statistics
-
FA: Provides FA
service statistics
-
GTPC: Provides
GPRS Tunneling Protocol - Control message statistics
-
GTPP: Provides
GPRS Tunneling Protocol - Prime message statistics
-
GTPU: Provides
GPRS Tunneling Protocol - User message statistics
-
HA: Provides HA
service statistics
-
IMSA: Provides
IMS Authorization service statistics
-
IP Pool: Provides
IP pool statistics
-
LMA: Provides Local
Mobility Anchor service statistics
-
P-GW: Provides
P-GW node-level service statistics
-
Port: Provides
port-level statistics
-
PPP: Provides Point-to-Point
Protocol statistics
-
RADIUS: Provides
per-RADIUS server statistics
-
System: Provides
system-level statistics
The system supports
the configuration of up to 4 sets (primary/secondary) of receivers.
Each set can be configured with to collect specific sets of statistics
from the various schemas. Statistics can be pulled manually from
the system or sent at configured intervals. The bulk statistics
are stored on the receiver(s) in files.
The format of the bulk
statistic data files can be configured by the user. Users can specify
the format of the file name, file headers, and/or footers
to include information such as the date, system host name, system
uptime, the IP address of the system generating the statistics (available for
only for headers and footers), and/or the time that the
file was generated.
When the Web Element
Manager is used as the receiver, it is capable of further processing the
statistics data through XML parsing, archiving, and graphing.
The Bulk Statistics
Server component of the Web Element Manager parses collected statistics
and stores the information in the PostgreSQL database. If XML file
generation and transfer is required, this element generates the
XML output and can send it to a Northbound NMS or an alternate bulk
statistics server for further processing.
Additionally, if archiving
of the collected statistics is desired, the Bulk Statistics server writes
the files to an alternative directory on the server. A specific
directory can be configured by the administrative user or the default
directory can be used. Regardless, the directory can be on a local
file system or on an NFS-mounted file system on the Web Element
Manager server.
IMPORTANT:
For more information
on bulk statistic configuration, refer to the Configuring and Maintaining
Bulk Statistics chapter in the System Administration Guide.
Congestion Control
The congestion
control feature allows you to set policies and thresholds and specify
how the system reacts when faced with a heavy load condition.
Congestion control monitors
the system for conditions that could potentially degrade performance
when the system is under heavy load. Typically, these conditions are
temporary (for example, high CPU or memory utilization) and are
quickly resolved. However, continuous or large numbers of these
conditions within a specific time interval may have an impact the
system’s ability to service subscriber sessions. Congestion
control helps identify such conditions and invokes policies for
addressing the situation.
Congestion control
operation is based on configuring the following:
-
Congestion Condition
Thresholds: Thresholds dictate the conditions for which congestion
control is enabled and establishes limits for defining the state
of the system (congested or clear). These thresholds function in
a way similar to operation thresholds that are configured for the
system as described in the Thresholding Configuration Guide. The
primary difference is that when congestion thresholds are reached,
a service congestion policy and an SNMP trap, starCongestion, are
generated.
A threshold tolerance
dictates the percentage under the configured threshold that must
be reached in order for the condition to be cleared. An SNMP trap,
starCongestionClear, is then triggered.
-
Port Utilization Thresholds:
If you set a port utilization threshold, when the average utilization
of all ports in the system reaches the specified threshold, congestion
control is enabled.
-
Port-specific Thresholds:
If you set port-specific thresholds, when any individual port-specific
threshold is reached, congestion control is enabled system-wide.
-
Service Congestion
Policies: Congestion policies are configurable for each service.
These policies dictate how services respond when the system detects
that a congestion condition threshold has been crossed.
IMPORTANT:
For more information
on congestion control, refer to the Congestion Control chapter
in the System Administration
Guide.
Default and Dedicated
EPC Bearers
Provides a foundation
for contributing towards improved Quality of User Experience (QoE) by
enabling deterministic end-to-end forwarding and scheduling treatments
for different services or classes of applications pursuant to their
requirements for committed bandwidth resources, jitter and delay.
In this way, each application receives the service treatment that
users expect.
In the StarOS 9.0 release,
the Cisco EPC core platforms support one or more EPS bearers (default
plus dedicated). An EPS bearer is a logical aggregate of one or
more Service Data Flows (SDFs), running between a UE and a P-GW
in the case of a GTP-based S5/S8 interface, and between
a UE and HSGW (HRPD Serving Gateway) in case of a PMIP-based S2a interface.
In networks where GTP is used as the S5/S8 protocol, the
EPS bearer constitutes a concatenation of a radio bearer, S1-U bearer
and an S5/S8 bearer anchored on the P-GW. In cases where
PMIPv6 is used the EPS bearer is concatenated between the UE and
HSGW with IP connectivity between the HSGW and P-GW.
Note: This release
supports only GTP-based S5/S8 and PMIPv6 S2a capabilities with
no commercial support for PMIPv6 S5/S8.
An EPS bearer uniquely
identifies traffic flows that receive a common QoS treatment between
a UE and P-GW in the GTP-based S5/S8 design, and between
a UE and HSGW in the PMIPv6 S2a approach. If different QoS scheduling
priorities are required between Service Data Flows, they should
be assigned to separate EPS bearers. Packet filters are signalled
in the NAS procedures and associated with a unique packet filter
identifier on a per-PDN connection basis.
One EPS bearer is established
when the UE connects to a PDN, and that remains established throughout
the lifetime of the PDN connection to provide the UE with always-on
IP connectivity to that PDN. That bearer is referred to as the default
bearer. A PDN connection represents a traffic flow aggregate between
a mobile access terminal and an external Packet Data Network (PDN) such
as an IMS network, a walled garden application cloud or a back-end
enterprise network. Any additional EPS bearer that is established
to the same PDN is referred to as a dedicated bearer. The EPS bearer
Traffic Flow Template (TFT) is the set of all 5-tuple packet filters
associated with a given EPS bearer. The EPC core elements assign
a separate bearer ID for each established EPS bearer. At a given
time a UE may have multiple PDN connections on one or more P-GWs.
DHCP Support
The P-GW supports
dynamic IP address assignment to subscriber IP PDN contexts using
the Dynamic Host Control Protocol (DHCP), as defined by the following
standards:
-
RFC 2131, Dynamic Host
Configuration Protocol
-
RFC 2132, DHCP Options
and BOOTP Vendor Extensions
The method by which
IP addresses are assigned to a PDN context is configured on an APN-by-APN
basis. Each APN template dictates whether it will support static
or dynamic addresses. Dynamically assigned IP addresses for subscriber
PDN contexts can be assigned through the use of DHCP.
The P-GW acts as a
DHCP server toward the UE and a DHCP client toward the external DHCP
server. The DHCP server function and DHCP client function on the
P-GW are completely independent of each other; one can exist without
the other.
The P-GW does not
support DHCP-relay.
IMPORTANT:
Currently, the P-GW
only supports DHCP with IPv4 addresses. IPv6 address support is planned
at a later date.
Deferred IPv4 Address
Allocation
Apart from obtaining
IP addresses during initial access signalling, a UE can indicate
via PCO options that it prefers to obtain IP address and related
configuration via DHCP after default bearer has been established.
This is also know as Deferred Address Allocation.
IPv4 addresses are
becoming an increasingly scarce resource. Since 4G networks like
LTE are always on, scarce resources such as IPv4 addresses cannot/should
not be monopolized by UEs when they are in an ECM-IDLE state.
PDN-type IPv4v6 allows
a dual stack implementing. The P-GW allocates an IPv6 address only
by default for an IPv4v6 PDN type. The UE defers the allocation
of IPv4 addresses based upon its needs, and relinquishes any IPv4
addresses to the global pool once it is done. The P-GW may employ
any IPv4 address scheme (local pool or external DHCP server) when
providing an IPv4 address on demand.
DHCPv6 Support
The Dynamic
Host Configuration Protocol (DHCP) for IPv6 enables the DHCP servers
to pass the configuration parameters, such as IPv6 network addresses
to IPv6 nodes. It offers the capability of allocating the reusable
network addresses and additional configuration functionality automatically.
The DHCPv6 support does
not just feature the address allocation, but also fulfills the requirements
of Network Layer IP parameters. Apart from these canonical usage
modes, DHCPv6's Prefix-Delegation (DHCP-PD) has also been standardized
by 3GPP (Rel 10) for “network-behind-ue” scenarios.
P-GW manages IPv6 prefix life-cycle just like it manages IPv4 addresses,
thus it is responsible for allocation, renew, and release of these
prefixes during the lifetime of a call. IPv6 prefixes may be obtained
from either local-pool, AAA (RADIUS/DIAMETER) or external
DHCPv6 servers. Stateless DHCPv6 procedures are used to supply higher
layer IP parameters to the end host.
DHCPv6 support for P-GW
covers the following requirements:
-
RFC 3633, prefix delegation
and Stateless services (primarily via the INFORMATION-REQUEST) mechanism
-
RFC 2132, DHCP Options
and BOOTP Vendor Extensions
-
RFC 4039, Rapid Commit
Support
IMPORTANT:
For more information
on DHCPv6 service configuration, refer to the DHCPv6 Configuration section
of the PDN Gateway
Configuration chapter.
Direct Tunnel Support
When Gn/Gp
interworking with pre-release SGSNs is enabled, the GGSN service
on the P-GW supports direct tunnel functionality.
Direct tunnel improves
the user experience (e.g. expedited web page delivery, reduced round trip
delay for conversational services, etc.) by eliminating SGSN tunnel “switching” latency
from the user plane. An additional advantage of direct tunnel from
an operational and capital expenditure perspective is that direct
tunnel optimizes the usage of user plane resources by removing the
requirement for user plane processing on the SGSN.
The direct tunnel architecture
allows the establishment of a direct user plane tunnel between the
RAN and the GGSN, bypassing the SGSN. The SGSN continues to handle
the control plane signalling and typically makes the decision to
establish direct tunnel at PDP Context Activation. A direct tunnel
is achieved at PDP context activation by the SGSN establishing a
user plane (GTP-U) tunnel directly between RNC and GGSN (using an
Update PDP Context Request toward the GGSN).
A major consequence of
deploying direct tunnel is that it produces a significant increase
in control plane load on both the SGSN and GGSN components of the
packet core. It is therefore of paramount importance to a wireless
operator to ensure that the deployed GGSNs are capable of handling
the additional control plane loads introduced of part of direct
tunnel deployment. The Cisco GGSN and SGSN offer massive control
plane transaction capabilities, ensuring system control plane capacity
will not be a capacity limiting factor once direct tunnel is deployed.
Domain Based Flow
Definitions
This solution
provides improved flexibility and granularity in obtaining geographically
correct exact IP entries of the servers by snooping DNS responses.
Currently, it is possible
to configure L7 rules to filter based on domain (m.google.com).
Sometimes multiple servers may serve a domain, each with its own
IP address. Using an IP-rule instead of an http rule will result
in multiple IP-rules; one IP-rule for each server “behind” the
domain, and it might get cumbersome to maintain a list of IP addresses for
domain-based filters.
In this solution,
you can create ruledefs specifying hostnames (domain names) and
parts of hostnames (domain names). Upon the definition of the hostnames/domain
names or parts of them, the P-GW will monitor all the DNS responses
sent towards the UE and will snoop only the DNS response, which
has q-name or a-name as specified in the rules, and identify all
the IP addresses resulted from the DNS responses. DNS snooping will
be done on live traffic for every subscriber.
DSCP Marking
Provides support
for more granular configuration of DSCP marking.
For Interactive Traffic
class, the P-GW supports per-gateway service and per-APN configurable
DSCP marking for Uplink and Downlink direction based on Allocation/Retention
Priority in addition to the current priorities.
The following matrix
may be used to determine the Diffserv markings used based on the configured
traffic class and Allocation/Retention Priority:
Table 1. Default DSCP Value
Matrix
| Allocation
Priority |
1 |
2 |
3 |
| Traffic
Handling Priority |
. |
. |
. |
| 1 |
ef |
ef |
ef |
| 2 |
af21 |
af21 |
af21 |
| 3 |
af21 |
af21 |
af21 |
In
addition, the P-GW allows configuration of diameter packets with
DSCP values.
Dynamic GTP Echo
Timer
The Dynamic GTP
Echo Timer enables the eGTP and GTP-U services to better manage
GTP paths during network congestion. As opposed to the default echo
timer, which uses fixed intervals and retransmission timers, the
dynamic echo timer adds a calculated round trip timer (RTT) that
is generated once a full request/response procedure has
completed. A multiplier can be added to the calculation for additional support
during congestion periods.
Dynamic Policy Charging
Control (Gx Reference Interface)
Dynamic policy
and charging control provides a primary building block toward the
realization of IMS multimedia applications. In contrast to statically
provisioned architectures, the dynamic policy framework provides
a centralized service control layer with global awareness of all
access-side network elements. The centralized policy decision elements
simplify the process of provisioning global policies to multiple
access gateways. Dynamic policy is especially useful in an Always-On
deployment model as the usage paradigm transitions from a short
lived to a lengthier online session in which the volume of data
consumed can be extensive. Under these conditions dynamic policy
management enables dynamic just in-time resource allocation to more
efficiently protect the capacity and resources of the network.
Dynamic Policy Control
represents the ability to dynamically authorize and control services
and application flows between a Policy Charging Enforcement Function
(PCEF) on the P-GW and the PCRF. Policy control enables a centralized
and decoupled service control architecture to regulate the way in
which services are provisioned and allocated at the bearer resource
layer.
The StarOS 9.0 release
included enhancements to conform with 3GPP TS 29.212 and 29.230
functions. The Gx reference interface uses Diameter transport and
IPv6 addressing. The subscriber is identified to the PCRF at session
establishment using IMSI based NAIs within the Subscription-ID AVP.
Additionally the IMEI within the Equipment-Info AVP is used to identify the
subscriber access terminal to the policy server. The Gx reference
interface supports the following capabilities:
-
Authorize the bearer
establishment for a packet flow
-
Dynamic L3/L4
transfer of service data flow filters within PCC rules for selection
and policy enforcement of downlink/uplink IP CAN bearers
-
Support static pre-provisioned
L7 rulebase name attribute as trigger for activating Inline Services
such as Peer-to-Peer Detection
-
Authorize the modification
of a service data flow
-
Revoke the authorization
of a packet flow
-
Provision PCC rules
for service data flows mapped to default or dedicated EPS bearers
-
Support P-GW initiated
event triggers based on change of access network gateway or IP CAN
-
Provide the ability
to set or modify APN-AMBR for a default EPS bearer
-
Create or modify QoS
service priority by including QCI values in PCC rules transmitted
from PCRF to PCEF functions
Enhanced Charging
Service (ECS)
The Enhanced
Charging Service provides an integrated in-line service for inspecting
subscriber data packets and generating detail records to enable
billing based on usage and traffic patterns. Other features include:
The Enhanced Charging
Service (ECS) is an in-line service feature that is integrated within
the system. ECS enhances the mobile carrier's ability to provide
flexible, differentiated, and detailed billing to subscribers by
using Layer 3 through Layer 7 deep packet inspection with the ability
to integrate with back-end billing mediation systems.
ECS interacts with
active mediation systems to provide full real-time prepaid and active
charging capabilities. Here the active mediation system provides
the rating and charging function for different applications.
In addition, ECS also
includes extensive record generation capabilities for post-paid charging
with in-depth understanding of the user session. Refer to the Support
for Multiple Detail Record Types section for more information.
The major components
include:
-
Service Steering:
Directs subscriber traffic into the ECS subsystem. Service Steering
is used to direct selective subscriber traffic flows via an Access
Control List (ACL). It is used for other redirection applications
as well for both internal and external services and servers.
-
Protocol Analyzer:
The software stack responsible for analyzing the individual protocol
fields and states during packet inspection. It performs two types
of packet inspection:
-
Shallow Packet Inspection:
inspection of the layer 3 (IP header) and layer 4 (e.g. UDP or TCP
header) information.
-
Deep Packet Inspection:
inspection of layer 7 and 7+ information. Deep packet inspection
functionality includes:
-
Detection of URI (Uniform
Resource Identifier) information at level 7 (e.g., HTTP, WTP, RTSP
Uniform Resource Locators (URLs)).
-
Identification of true
destination in the case of terminating proxies, where shallow packet
inspection would only reveal the destination IP address / port
number of a terminating proxy.
-
De-encapsulation of
upper layer protocol headers, such as MMS-over-WTP, WSP-over-UDP,
and IP-over GPRS.
-
Verification that traffic
actually conforms to the protocol the layer 4 port number suggests.
-
Rule Definitions:
User-defined expressions, based on protocol fields and/or protocol-states,
which define what actions to take when specific field values are
true. Expressions may contain a number of operator types (string, =,
>, etc.) based on the data type of the operand. Each Ruledef configuration
is consisting of multiple expressions applicable to any of the fields
or states supported by the respective analyzers.
-
Rule Bases: a collection
of rule definitions and their associated billing policy. The rule
base determines the action to be taken when a rule is matched. It
is possible to define a rule definition with different actions.
Mediation and Charging
Methods
To provide maximum
flexibility when integrating with billing mediation systems, ECS supports
a full range of charging and authorization interfaces.
-
Pre-paid: In a
pre-paid environment, the subscribers pay for service prior to use.
While the subscriber is using the service, credit is deducted from
subscriber's account until it is exhausted or call ends. The pre-paid
accounting server is responsible for authorizing network nodes (GGSNs)
to grant access to the user, as well as grant quotas for either time
connected or volume used. It is up to the network node to track
the quota use, and when these use quotas run low, the network node
sends a request to the pre-paid server for more quota.
If the user has not
used up the purchased credit, the server grants quota and if no
credit is available to the subscriber the call will be disconnected.
ECS and DCCA manage this functionality by providing the ability
to setup quotas for different services.
Pre-paid quota in ECS
is implemented using DIAMETER Credit Control Application (DCCA).
DCCA supports the implementation of real-time credit control for
a variety of services, such as networks access, messaging services,
and download services.
In addition to being
a general solution for real-time cost and credit control, DCCA includes these
features:
-
Real-time Rate Service
Information - DCCA can verify when end subscribers' accounts
are exhausted or expired; or deny additional chargeable events.
-
Support for Multiple
Services - DCCA supports the usage of multiple services within
one subscriber session. Multiple Service support includes; 1) ability
to identify and process the service or group of services that are
subject to different cost structures 2) independent credit control
of multiple services in a single credit control sub-session.
-
Post-paid: In a
post-paid environment, the subscribers pay after use of the service.
A AAA server is responsible for authorizing network nodes (GGSNs)
to grant access to the user and a CDR system generates G-CDRs/eG-CDRs/EDRs/UDRs
or Comma Separated Values (CSVs) for billing information on pre-defined
intervals of volume or per time.
IMPORTANT:
Support for the Enhanced
Charging Service requires a service license; the ECS license is included
in the P-GW session use license. For more information on ECS, refer
to the Enhanced Charging
Service Administration Guide.
Content Analysis
Support
The Enhanced Charging
Service is capable of performing content analysis on packets of
many different protocols at different layers of the OSI model.
The ECS content analyzers
are able to inspect and maintain state across various protocols
at all layers of the OSI stack. ECS system supports, inspects, and
analyzes the following protocols:
-
-
-
-
-
-
-
-
-
-
-
-
Real-Time Streaming:
RTP and RTSP
-
-
-
File analysis: examination
of downloaded file characteristics (e.g. file size, chunks transferred,
etc.) from file transfer protocols such as HTTP and FTP.
Traffic analyzers in
enhanced charging subsystem are based on configured rules. Rules
used for Traffic analysis analyze packet flows and form usage records.
Usage records are created per content type and forwarded to a pre-paid
server or to a mediation/billing system. A traffic analyzer
performs shallow (Layer 3 and Layer 4) and deep (above Layer 4)
packet inspection of the IP packet flows.
The Traffic Analyzer
function is able to do a shallow (layer 3 and layer 4) and deep
(above layer 4) packet inspection of IP Packet Flows.
It is able to correlate
all layer 3 packets (and bytes) with higher layer trigger criteria
(e.g. URL detected in a HTTP header) and it is also perform stateful
packet inspection to complex protocols like FTP, RTSP, SIP that
dynamically open ports for the data path and by this way, user plane
payload is differentiated into “categories”.
The Traffic Analyzer
works on the application level as well and performs event based charging
without the interference of the service platforms.
IMPORTANT:
This functionality
is available for use with the Enhanced Charging Service which requires
a session-use license. For more information on ECS, refer to the Enhanced Charging Service Administration
Guide.
Content Service
Steering
Content Service Steering
(CSS) directs selective subscriber traffic into the ECS subsystem
(In-line services internal to the system) based on the content of
the data presented by mobile subscribers.
CSS uses Access Control
Lists (ACLs) to redirect selective subscriber traffic flows. ACLs control
the flow of packets into and out of the system. ACLs consist of “rules” (ACL
rules) or filters that control the action taken on packets matching
the filter criteria.
ACLs are configurable
on a per-context basis and applies to a subscriber through either
a subscriber profile or an APN profile in the destination context.
IMPORTANT:
For more information
on CSS, refer to the Content
Service Steering chapter of the System Administration
Guide.
IMPORTANT:
For more information
on ACLs, refer to the IP
Access Control Lists chapter of the System Administration
Guide.
Support for Multiple
Detail Record Types
To meet the requirements
of standard solutions and at the same time, provide flexible and
detailed information on service usage, the Enhanced Charging Service (ECS)
provides the following type of usage records:
-
Event Detail Records
(EDRs)
-
Usage Detail Records
(UDRs)
ECS provides for the
generation of charging data files, which can be periodically retrieved
from the system and used as input to a billing mediation system
for post-processing. These files are provided in a standard format,
so that the impact on the existing billing/mediation system
is minimal and at the same time, these records contain all the information
required for billing based on the content.
GTPP accounting in ECS
allows the collection of counters for different types of data traffic into
detail records. The following types of detail records are supported:
-
Event Detail Records
(EDRs): An alternative to standard G-CDRs when the information
provided by the G-CDRs is not sufficient to do the content billing.
EDRs are generated according to explicit action statements in rule
commands that are user-configurable. The EDRs are generated in comma
separated values (CSV) format, generated as defined in traffic analysis
rules.
-
User Detail Records
(UDRs): Contain accounting information related to a specific
mobile subscriber. The fields to be reported in them are user-configurable
and are generated on any trigger of time threshold, volume threshold,
handoffs, and call termination. The UDRs are generated in comma
separated values (CSV) format, generated as defined in traffic analysis
rules.
IMPORTANT:
This functionality
is available for use with the Enhanced Charging Service which requires
a session-use license. For more information on ECS, refer to the Enhanced Charging Service Administration
Guide.
Diameter Credit
Control Application
Provides a pre-paid
billing mechanism for real-time cost and credit control based on
the following
standards:
-
RFC 3588, Diameter
Base Protocol, September 2003
-
RFC 4006, Diameter
Credit-Control Application, August 2005
The Diameter Credit
Control Application (DCCA) is used to implement real-time credit-control
for a variety of end user services such as network access, Session
Initiation Protocol (SIP) services, messaging services, download
services etc.
Used in conjunction
with ECS, the DCCA interface uses a mechanism to allow the user
to be informed of the charges to be levied for a requested service.
In addition, there are services such as gaming and advertising that
may credit as well as debit from a user account.
DCCA also supports the
following:
-
Real-time Rate Service
Information: The ability to verify when end subscribers' accounts
are exhausted or expired; or deny additional chargeable events.
-
Support for Multiple
Services: The usage of multiple services within one subscriber
session is supported. Multiple Service support includes:
-
The ability to identify
and process the service or group of services that are subject to
different cost structures.
-
Independent credit control
of multiple services in a single credit control sub-session.
IMPORTANT:
This functionality
is available for use with the Enhanced Charging Service, which requires
a session-use license. For more information on ECS, refer to the Enhanced Charging Service Administration
Guide.
Accept TCP Connections
from DCCA Server
This feature allows
for peer Diameter Credit Control Application servers to initiate
a connection the NGME.
This feature allows
peer diameter nodes to connect to the NGME on TCP port 3868 when the
diameter server is incapable of receiving diameter incoming diameter
requests.
IMPORTANT:
For more information
on Diameter support,
if
you are using StarOS 12.3 or an earlier release, refer to the
AAA and GTPP Interface
Administration and Reference.
If
you are using StarOS 14.0 or a later release, refer to the AAA Interface Administration
and Reference.
Gy Interface Support
The Gy interface enables
the wireless operator to implement a standardized interface for
real time content based charging with differentiated rates for time
based and volume based charging.
As it is based on a
quota mechanism, the Gy interface enables the wireless operator
to spare expensive Prepaid System resources.
As it enables time-,
volume-, and event-based charging models, the Gy interface flexibly enables
the operator to implement charging models tailored to their service strategies.
The Gy interface provides
a standardized Diameter interface for real time content based charging
of data services. It is based on the 3GPP standards and relies on
quota allocation.
It provides an online
charging interface that works with the ECS deep packet inspection feature.
With Gy, customer traffic can be gated and billed in an “online” or “prepaid” style.
Both time- and volume-based charging models are supported. In all
of these models, differentiated rates can be applied to different
services based on shallow or deep packet inspection.
Gy is a Diameter interface.
As such, it is implemented atop, and inherits features from, the Diameter
Base Protocol. The system supports the applicable Base network and
application features, including directly connected, relayed or proxied
DCCA servers using TLS or plaintext TCP.
In the simplest possible
installation, the system exchanges Gy Diameter messages over Diameter
TCP links between itself and one “prepay” server.
For a more robust installation, multiple servers would be used.
These servers may optionally share or mirror a single quota database
so as to support Gy session failover from one server to the other.
For a more scalable installation, a layer of proxies or other Diameter
agents can be introduced to provide features such as multi-path
message routing or message and session redirection features.
The Cisco implementation
is based on the following standards:
-
RFC 4006 generic DCCA,
including:
-
CCR Initial, Update,
and Final signaling
-
ASR and RAR asynchronous
DCCA server messages
-
Time, Total-Octets,
and Service-Specific-Units quota management
-
Multiple independent
quotas using Multiple-Services-Credit-Control
-
Rating-Group for quota-to-traffic
association
-
CC-Failure-Handling
and CC-Session-Failover features
-
Final-Unit-Action TERMINATE
behavior
-
Tariff-Time-Change feature.
-
3GPP TS 32.299 online
mode “Gy” DCCA, including:
-
Final-Unit-Action REDIRECT
behavior
-
Quota-Holding-Time:
This defines a user traffic idle time, on a per category basis, after
which the usage is returned and no new quota is explicitly requested
-
Quota-Thresholds: These
AVPs define a low value watermark at which new quota will be sought
before the quota is entirely gone; the intent is to limit interruption
of user traffic.
These AVPs exist for
all quota flavors, for example “Time-Quota-Threshold”.
-
Trigger-Type: This AVP
defines a set of events which will induce a re-authentication of
the current session and its quota categories.
Gn/Gp
Handoff Support
In LTE deployments,
smooth handover support is required between 3G/2G and LTE
networks, and Evolved Packet Core (EPC) is designed to be a common
packet core for different access technologies. P-GW supports handovers
as user equipment (UE) moves across different access technologies.
Cisco's P-GW supports
inter-technology mobility handover between 4G and 3G/2G
access. Interworking is supported between the 4G and 2G/3G
SGSNs, which provide only Gn and Gp interfaces but no S3, S4 or
S5/S8 interfaces. These Gn/Gp SGSNs provide no
functionality introduced specifically for the evolved packet system
(EPS) or for interoperation with the E-UTRAN. These handovers are
supported only with a GTP-based S5/S8 and P-GW supports
handoffs between GTPv2 based S5/S8 and GTPv1 based Gn/Gp
tunneled connections. In this scenario, the P-GW works as an IP
anchor for the EPC.
IMPORTANT:
To support the seamless
handover of a session between GGSN and P-GW, the two independent
services must be co-located on the same node and configured within
the same context for optimum interoperation.
IMPORTANT:
For more information
on Gn/GP handoffs, refer to Gn/Gp GGSN/SGSN
(GERAN/UTRAN) in the Supported Logical
Network Interfaces (Reference Points) section in this chapter.
IMS Emergency Bearer
Handling
With this support,
a UE is able to connect to an emergency PDN and make Enhanced 911 (E911)
calls while providing the required location information to the Public
Safety Access Point (PSAP).
E911 is a telecommunications-based
system that is designed to link people who are experiencing an emergency
with the public resources that can help. This feature supports E911-based
calls across the LTE and IMS networks. In a voice over LTE scenario,
the subscriber attaches to a dedicated packet data network (PDN)
called EPDN (Emergency PDN) in order to establish a voice over IP
connection to the PSAP. Signaling either happens on the default emergency
bearer, or signaling and RTP media flow over separate dedicated
emergency bearers. Additionally, different than normal PDN attachment
that relies on AAA and PCRF components for call establishment, the
EPDN attributes are configured locally on the P-GW, which eliminates the
potential for emergency call failure if either of these systems
is not available.
Emergency bearer services
are provided to support IMS emergency sessions. Emergency bearer
services are functionalities provided by the serving network when
the network is configured to support emergency services. Emergency
bearer services are provided to normally attached UEs and to UEs
that are in a limited service state (depending on local service regulations,
policies, and restrictions). Receiving emergency services in limited
service state does not require a subscription.
The standard (refer
to 3GPP TS 23.401) has identified four behaviors that are supported:
-
-
-
MSI required, authentication
optional
-
To request emergency
services, the UE has the following two options:
-
UEs that are in a limited
service state (due to attach reject from the network, or since no
SIM is present), initiate an ATTACH indicating that the ATTACH is
for receiving emergency bearer services. After a successful attach,
the services that the network provides the UE is solely in the context
of Emergency Bearer Services.
-
UEs that camp normally
on a cell initiates a normal ATTACH if it requires emergency services.
Normal attached UEs initiated a UE Requested PDN Connectivity procedure
to request Emergency Bearer Services.
IP Access Control
Lists
IP access control
lists allow you to set up rules that control the flow of packets
into and out of the system based on a variety of IP packet parameters.
IP access lists, or
access control lists (ACLs) as they are commonly referred to, are
used to control the flow of packets into and out of the system.
They are configured on a per-context basis and consist of “rules” (ACL
rules) or filters that control the action taken on packets that
match the filter criteria. Once configured, an ACL can be applied
to any of the following:
-
-
All traffic facilitated
by a context (known as a policy ACL)
-
-
All subscriber sessions
facilitated by a specific context
IMPORTANT:
For more information
on IP access control lists, refer to the IP Access Control Lists chapter
in the System Administration
Guide.
IP Address Hold
Timers
Also known as
address quarantining, this subscriber-level CLI introduces an address
hold timer to temporarily buffer a previously assigned IP address
from an IP address pool to prevent it from being recycled and reassigned
to a new subscriber session. It is especially useful during inter-RAT
handovers that sometimes lead to temporary loss of the mobile data
session.
This feature provides
a higher quality user experience for location-based services where
the remote host server needs to reach the mobile device.
IPv6 Capabilities
Enables increased
address efficiency and relieves pressures caused by rapidly approaching IPv4
address exhaustion problem.
The P-GW offers the
following IPv6 capabilities:
Native IPv6 and IPv6
transport
-
Support for any combination
of IPv4, IPv6 or dual stack IPv4/v6 address assignment
from dynamic or static address pools on the P-GW.
-
Support for native
IPv6 transport and service addresses on PMIPv6 S2a interface. Note that
transport on GTP S5/S8 connections in this release is IPv4
based.
-
Support for IPv6 transport
for outbound traffic over the SGi reference interface to external
Packet Data Networks.
IPv6 Connections to
Attached Elements
IPv6 transport and
interfaces are supported on all of the following connections:
-
Diameter Gx policy
signaling interface
-
Diameter Gy online
charging reference interface
-
S6b authentication
interface to external 3GPP AAA server
-
Diameter Rf offline
charging interface
-
Lawful Intercept (X1,
X2 interfaces)
Routing and Miscellaneous
Features
-
-
-
IPv6 flows (Supported
on all Diameter QoS and Charging interfaces as well as Inline Services
(e.g. ECS)
Local Break-Out
Provides a standards-based
procedure to enable LTE operators to generate additional revenues
by accepting traffic from visited subscribers based on roaming agreements
with other mobile operators.
Local Breakout is a
policy-based forwarding function that plays an important role in
inter-provider roaming between LTE service provider networks. Local
Breakout is determined by the SLAs for handling roaming calls between
visited and home networks. In some cases, it is more beneficial
to locally breakout a roaming call on a foreign network to the visited
P-W rather than incur the additional transport costs to backhaul
the traffic to the Home network.
If two mobile operators
have a roaming agreement in place, Local Break-Out enables the visited
user to attach to the V-PLMN network and be anchored by the local
P-GW in the visited network. The roaming architecture relies on
the HSS in the home network and also introduces the concept of the
S9 policy signaling interface between the H-PCRF in the H-PLMN and
the V-PCRF in the V-PLMN. When the user attaches to the EUTRAN cell
and MME (Mobility Management Entity) in the visited network, the
requested APN name in the S6a NAS signaling is used by the HSS in
the H-PLMN to select the local S-GW (Serving Gateway) and P-GWs
in the visited EPC network.
Management System
Overview
The system's
management capabilities are designed around the Telecommunications
Management Network (TMN) model for management - focusing on providing
superior quality network element (NE) and element management system
(Cisco Web Element Manager) functions. The system provides element
management applications that can easily be integrated, using standards-based
protocols (CORBA and SNMPv1, v2), into higher-level management systems
- giving wireless operators the ability to integrate the system
into their overall network, service, and business management systems.
In addition, all management is performed out-of-band for security
and to maintain system performance.
Cisco's O&M module
offers comprehensive management capabilities to the operators and
enables them to operate the system more efficiently. There are multiple
ways to manage the system either locally or remotely using its out-of-band
management interfaces.
These include:
-
Using the command line
interface (CLI)
-
Remote login using
Telnet, and Secure Shell (SSH) access to CLI through SPIO card's Ethernet
management interfaces
-
Local login through
the Console port on SPIO card using an RS-232 serial connection
-
Using the Web Element
Manager application
-
Supports communications
through 10 Base-T, 100 Base-TX, 1000 Base-TX, or 1000
-
Base-SX (optical gigabit
Ethernet) Ethernet management interfaces on the SPIO
-
Client-Server model
supports any browser (i.e. Microsoft Internet Explorer v5.0 and above
or Netscape v4.7 or above, and others)
-
Supports Common Object
Request Broker Architecture (CORBA) protocol and Simple Network
Management Protocol version 1 (SNMPv1) for fault management
-
Provides complete Fault,
Configuration, Accounting, Performance, and Security (FCAPS) capabilities
-
Can be easily integrated
with higher-level network, service, and business layer applications
using the Object Management Group's (OMG’s) Interface Definition
Language (IDL)
The following figure
demonstrates these various element management options and how they can
be utilized within the wireless carrier network.
Figure 13. Element Management
Methods
IMPORTANT:
P-GW management functionality
is enabled by default for console-based access. For GUI-based management
support, refer to the
Web Element Management
System section in this chapter.
IMPORTANT:
For more information
on command line interface based management, refer to the Command Line Interface
Reference.
Mobile IP Registration
Revocation
Mobile IP registration
revocation functionality provides the following benefits:
-
Timely release of Mobile
IP resources at the HSGW and/or P-GW
-
-
Timely notification
to mobile node of change in service
Registration Revocation
is a general mechanism whereby either the P-GW or the HSGW providing
Mobile IP functionality to the same mobile node can notify the other
mobility agent of the termination of a binding. Mobile IP Registration
Revocation can be triggered at the HSGW by any of the following:
-
Session terminated
with mobile node for whatever reason
-
-
Administrative clearing
of calls
-
Session Manager software
task outage resulting in the loss of HSGW sessions (sessions that
could not be recovered)
IMPORTANT:
Registration Revocation
functionality is also supported for Proxy Mobile IP. However, only the
P-GW can initiate the revocation for Proxy-MIP calls.
Multiple PDN Support
Enables an APN-based
user experience that enables separate connections to be allocated
for different services including IMS, Internet, walled garden services,
or off-deck content services.
The MAG function on
the S-GW can maintain multiple PDN or APN connections for the same
user session. The MAG runs a single node level Proxy Mobile IPv6
tunnel for all user sessions toward the LMA function of the P-GW.
When a user wants to establish multiple PDN connections, the MAG
brings up the multiple PDN connections over the same PMIPv6 session
to one or more P-GW LMA's. The P-GW in turn allocates separate IP addresses
(Home Network Prefixes) for each PDN connection and each one can
run one or multiple EPC default & dedicated bearers. To request
the various PDN connections, the MAG includes a common MN-ID and
separate Home Network Prefixes, APNs and a Handover Indication Value
equal to one in the PMIPv6 Binding Updates.
IMPORTANT:
Up to 11 multiple PDN
connections are supported.
Non-Optimized e-HRPD
to Native LTE (E-UTRAN) Mobility Handover
This feature
enables a seamless inter-technology roaming capability in support
of dual mode e-HRPD/e-UTRAN access terminals.
The non-optimized
inter-technology mobility procedure is rooted at the P-GW as the
mobility anchor point for supporting handovers for dual radio technology
e-HRPD/E-UTRAN access terminals. To support this type of
call handover, the P-GW supports handoffs between the GTP-based
S5/S8 (GTPv2-C / GTPv1-U) and PMIPv6 S2a tunneled connections.
It also provisions IPv4, IPv6, or dual stack IPv4/IPv6
PDN connections from a common address pool and preserves IP addresses
assigned to the UE during inter-technology handover. In the current
release, the native LTE (GTP-based) P-GW service address is IPv4-based,
while the e-HRPD (PMIP) address is an IPv6 service address.
During the initial
network attachment for each APN that the UE connects to, the HSS
returns the FQDN of the P-GW for the APN. The MME uses DNS to resolve
the P-GW address. When the PDN connection is established in the
P-GW, the P-GW updates the HSS with the IP address of the P-GW on
PDN establishment through the S6b authentication process. When the
mobile user roams to the e-HRPD network, the HSS returns the IP
address of the P-GW in the P-GW Identifier through the STa interface
and the call ends up in the same P-GW. The P-GW is also responsible
for initiating the session termination on the serving access connection
after the call handover to the target network.
During the handover
procedure, all dedicated EPS bearers must be re-established. On
LTE- handovers to a target e-HRPD access network, the dedicated
bearers are initiated by the mobile access terminal. In contrast,
on handovers in the opposite direction from e-HRPD to LTE access networks,
the dedicated bearers are network initiated through Gx policy interactions
with the PCRF server.
Finally, in order
to support the inter-technology handovers, the P-GW uses common interfaces
and Diameter endpoint addresses for the various reference points:
-
S6b: Non-3GPP authentication
-
Gx: QoS Policy and
Charging
-
All three types of
sessions are maintained during call handovers. The bearer binding
will be performed by the HSGW during e-HRPD access and by the P-GW
during LTE access. Thus, the Bearer Binding Event Reporting (BBERF)
function needs to migrate between the P-GW and the HSGW during the
handover. The HSGW establishes a Gxa session during e-HRPD access
for bearer binding and releases the session during LTE access. The
HSGW also maintains a limited context during the e-HRPD <->LTE
handover to reduce latency in the event of a quick handover from
the LTE RAN back to the e-HRPD network.
IMPORTANT:
For more information
on handoff interfaces, refer to the Supported Logical
Network Interfaces (Reference Points) section in this chapter.
Online/Offline
Charging
The Cisco EPC
platform offers support for online and offline charging interactions
with external OCS and CGF/CDF servers.
Online Charging
Gy/Ro Reference
Interfaces
The StarOS 9.0 online
prepaid reference interface provides compatibility with the 3GPP
TS 23.203, TS 32.240, TS 32.251 and TS 32.299 specifications. The
Gy/Ro reference interface uses Diameter transport and IPv6
addressing. Online charging is a process whereby charging information
for network resource usage must be obtained by the network in order
for resource usage to occur. This authorization is granted by the
Online Charging System (OCS) upon request from the network. The
P-GW uses a charging characteristics profile to determine whether
to activate or deactivate online charging. Establishment, modification
or termination of EPS bearers is generally used as the event trigger
on the PCRF to activate online charging PCC rules on the P-GW.
When receiving a network
resource usage request, the network assembles the relevant charging
information and generates a charging event towards the OCS in real-time.
The OCS then returns an appropriate resource usage authorization
that may be limited in its scope (e.g. volume of data or duration
based). The OCS assigns quotas for rating groups and instructs the
P-GW whether to continue or terminate service data flows or IP CAN
bearers.
The following Online
Charging models and functions are supported:
-
-
-
Volume and time based
charging
-
Final Unit Indication
and termination or redirection of service data flows when quota
is consumed
-
Reauthorization triggers
to rearm quotas for one or more rating groups using multi-service
credit control (MSCC) instances
-
-
Billing cycle bandwidth
rate limiting: Charging policy is enforced through interactions between
the PDN GW and Online Charging Server. The charging enforcement
point periodically conveys accounting information for subscriber
sessions to the OCS and it is debited against the threshold that
is established for the charging policy. Subscribers can be assigned
a max usage for their tier (gold, silver, bronze for example), the
usage can be tracked over a month, week, day, or peak time within
a day. When the subscriber exceeds the usage limit, bandwidth is
either restricted for a specific time period, or dropped depending
on their tier of service.
-
Offline Charging
Ga/Gz Reference
Interfaces
The Cisco P-GW supports
3GPP-compliant offline charging as defined in TS 32.251,TS 32.297
and 32.298. Whereas the S-GW generates SGW-CDRs to record subscriber
level access to PLMN resources, the P-GW creates PGW-CDRs to record
user access to external networks. Additionally, when Gn/Gp
interworking with pre-release SGSNs is enabled, the GGSN service
on the P-GW records G-CDRs to record user access to external networks.
To provide subscriber
level accounting, the Cisco S-GW and P-GWs support integrated Charging
Transfer Functions (CTF) and Charging Data Functions (CDF). Each
gateway uses Charging-ID's to distinguish between default and dedicated
bearers within subscriber sessions. The Ga/Gz reference
interface between the CDF and CGF is used to transfer charging records
via the GTPP protocol. In a standards based implementation, the
CGF consolidates the charging records and transfers them via an
FTP/S-FTP connection over the Bm reference interface to
a back-end billing mediation server. The Cisco EPC gateways also
offer the ability to FTP/S-FTP charging records between
the CDF and CGF server. CDR records include information such as Record
Type, Served IMSI, ChargingID, APN Name, TimeStamp, Call Duration,
Served MSISDN, PLMN-ID, etc. The ASR 5x00 platform offers a local
directory to enable temporary file storage and buffer charging records
in persistent memory located on a pair of dual redundant RAID hard
disks. Each drive includes 147GB of storage and up to 100GB of capacity
is dedicated to storing charging records. For increased efficiency
it also possible to enable file compression using protocols such
as GZIP. The Offline Charging implementation offers built-in heart
beat monitoring of adjacent CGFs. If the Cisco P-GW has not heard
from the neighbor CGF within the configurable polling interval,
they will automatically buffer the charging records on the local drives
until the CGF reactivates itself and is able to begin pulling the
cached charging records.
The P-GW supports a
Policy Charging Enforcement Function (PCEF) to enable Flow Based Bearer
Charging (FBC) via the Gy reference interface to adjunct OCS servers
(See Online Charging description above).
Rf Reference Interface
The Cisco EPC platforms
also support the Rf reference interface to enable direct transfer
of charging files from the CTF function of the P-GW to external
CDF/CGF servers. This interface uses Diameter Accounting
Requests (Start, Stop, Interim, and Event) to transfer charging
records to the CDF/CGF. Each gateway relies on triggering
conditions for reporting chargeable events to the CDF/CGF.
Typically as EPS bearers are activated, modified or deleted, charging
records are generated. The EPC platforms include information such
as Subscription-ID (IMSI), Charging-ID (EPS bearer identifier) and
separate volume counts for the uplink and downlink traffic.
Proxy Mobile IPv6
(S2a)
Provides a mobility
management protocol to enable a single LTE-EPC core network to provide
the call anchor point for user sessions as the subscriber roams
between native EUTRAN and non-native e-HRPD access networks
S2a represents the trusted
non-3GPP interface between the LTE-EPC core network and the evolved
HRPD network anchored on the HSGW. In the e-HRPD network, network-based
mobility provides mobility for IPv6 nodes without host involvement. Proxy
Mobile IPv6 extends Mobile IPv6 signaling messages and reuses the
HA function (now known as LMA) on the P-GW. This approach does not
require the mobile node to be involved in the exchange of signaling
messages between itself and the Home Agent. A proxy mobility agent (e.g.
MAG function on HSGW) in the network performs the signaling with
the home agent and does the mobility management on behalf of the
mobile node attached to the network.
The S2a interface uses
IPv6 for both control and data. During the PDN connection establishment
procedures the P-GW allocates the IPv6 Home Network Prefix (HNP) via
Proxy Mobile IPv6 signaling to the HSGW. The HSGW returns the HNP
in router advertisement or based on a router solicitation request
from the UE. PDN connection release events can be triggered by either
the UE, the HSGW or the P-GW.
In Proxy Mobile IPv6
applications the HSGW (MAG function) and P-GW (LMA function) maintain
a single shared tunnel and separate GRE keys are allocated in the
PMIP Binding Update and Acknowledgement messages to distinguish
between individual subscriber sessions. If the Proxy Mobile IP signaling
contains Protocol Configuration Options (PCOs) it can also be used
to transfer P-CSCF or DNS server addresses
QoS Bearer Management
Provides a foundation
for contributing towards improved Quality of User Experience (QoE) by
enabling deterministic end-to-end forwarding and scheduling treatments
for different services or classes of applications pursuant to their
requirements for committed bandwidth resources, jitter and delay.
In this way, each application receives the service treatment that
users expect.
An EPS bearer is a logical
aggregate of one or more Service Data Flows (SDFs), running between
a UE and a P-GW in case of GTP-based S5/S8, and between
a UE and HSGW in case of PMIP-based S2a connection. An EPS bearer
is the level of granularity for bearer level QoS control in the
EPC/E-UTRAN. The Cisco P-GW maintains one or more Traffic
Flow Templates (TFT's) in the downlink direction for mapping inbound
Service Data Flows (SDFs) to EPS bearers. The P-GW maps the traffic
based on the downlink TFT to the S5/S8 bearer. The Cisco
PDN GW offers all of the following bearer-level aggregate constructs:
QoS Class Identifier
(QCI): An operator provisioned value that controls bearer level
packet forwarding treatments (e.g. scheduling weights, admission
thresholds, queue management thresholds, link layer protocol configuration,
etc). The Cisco EPC gateways also support the ability to map the
QCI values to DiffServ code points in the outer GTP tunnel header
of the S5/S8 connection. Additionally, the platform also
provides configurable parameters to copy the DSCP marking from the
encapsulated payload to the outer GTP tunnel header.
Guaranteed Bit Rate
(GBR): A GBR bearer is associated with a dedicated EPS bearer
and provides a guaranteed minimum transmission rate in order to
offer constant bit rate services for applications such as interactive
voice that require deterministic low delay service treatment.
Maximum Bit Rate (MBR):
The MBR attribute provides a configurable burst rate that limits
the bit rate that can be expected to be provided by a GBR bearer
(e.g. excess traffic may get discarded by a rate shaping function).
The MBR may be greater than or equal to the GBR for a given Dedicated
EPS bearer.
Aggregate Maximum Bit
Rate (AMBR): AMBR denotes a bit rate of traffic for a group
of bearers destined for a particular PDN. The Aggregate Maximum
Bit Rate is typically assigned to a group of Best Effort service
data flows over the Default EPS bearer. That is, each of those EPS
bearers could potentially utilize the entire AMBR, e.g. when the
other EPS bearers do not carry any traffic. The AMBR limits the
aggregate bit rate that can be expected to be provided by the EPS
bearers sharing the AMBR (e.g. excess traffic may get discarded
by a rate shaping function). AMBR applies to all Non-GBR bearers
belonging to the same PDN connection. GBR bearers are outside the
scope of AMBR.
Policing: The Cisco
P-GW offers a variety of traffic conditioning and bandwidth management
capabilities. These tools enable usage controls to be applied on
a per-subscriber, per-EPS bearer or per-PDN/APN basis.
It is also possible to apply bandwidth controls on a per-APN AMBR
capacity. These applications provide the ability to inspect and
maintain state for user sessions or Service Data Flows (SDFs) within
them using shallow L3/L4 analysis or high touch deep packet
inspection at L7. Metering of out-of-profile flows or sessions can
result in packet discards or reducing the DSCP marking to Best Effort priority.
RADIUS Support
Provides a mechanism
for performing authorization, authentication, and accounting (AAA)
for subscriber PDP contexts based on the following standards:
-
RFC-2618, RADIUS Authentication
Client MIB, June 1999
-
RFC-2620, RADIUS Accounting
Client MIB, June 1999
-
RFC-2865, Remote Authentication
Dial In User Service (RADIUS), June 2000
-
RFC-2866, RADIUS Accounting,
June 2000
-
RFC-2867, RADIUS Accounting
Modifications for Tunnel Protocol Support, June 2000
-
RFC-2868, RADIUS Attributes
for Tunnel Protocol Support, June 2000
-
RFC-2869, RADIUS Extensions,
June 2000
The Remote Authentication
Dial-In User Service (RADIUS) protocol is used to provide AAA functionality
for subscriber PDP contexts. (RADIUS accounting is optional since GTPP
can also be used.)
Within contexts configured
on the system, there are AAA and RADIUS protocol-specific parameters
that can be configured. The RADIUS protocol-specific parameters
are further differentiated between RADIUS Authentication server
RADIUS Accounting server interaction.
Among the RADIUS parameters
that can be configured are:
-
Priority: Dictates
the order in which the servers are used allowing for multiple servers
to be configured in a single context.
-
Routing Algorithm:
Dictate the method for selecting among configured servers. The specified
algorithm dictates how the system distributes AAA messages across
the configured AAA servers for new sessions. Once a session is established
and an AAA server has been selected, all subsequent AAA messages
for the session will be delivered to the same server.
In the event that
a single server becomes unreachable, the system attempts to communicate with
the other servers that are configured. The system also provides
configurable parameters that specify how it should behave should
all of the RADIUS AAA servers become unreachable.
The system provides
an additional level of flexibility by supporting the configuration RADIUS
server groups. This functionality allows operators to differentiate
AAA services for subscribers based on the APN used to facilitate
their PDP context.
In general, 128 AAA
Server IP address/port per context can be configured on
the system and it selects servers from this list depending on the
server selection algorithm (round robin, first server). Instead
of having a single list of servers per context, this feature provides
the ability to configure multiple server groups. Each server group,
in turn, consists of a list of servers.
This feature works
in following way:
-
All RADIUS authentication/accounting
servers configured at the context-level are treated as part of a
server group named “default”. This default server
group is available to all subscribers in that context through the
realm (domain) without any configuration.
-
It provides a facility
to create “user defined” RADIUS server groups,
as many as 399 (excluding “default” server group),
within a context. Any of the user defined RADIUS server groups are
available for assignment to a subscriber through the APN configuration
within that context.
Since the configuration
of the APN can specify the RADIUS server group to use as well as IP
address pools from which to assign addresses, the system implements
a mechanism to support some in-band RADIUS server implementations
(i.e. RADIUS servers which are located in the corporate network,
and not in the operator's network) where the NAS-IP address is part
of the subscriber pool. In these scenarios, the P-GW supports the
configuration of the first IP address of the subscriber pool for
use as the RADIUS NAS-IP address.
IMPORTANT:
For more information
on RADIUS AAA configuration,
if
you are using StarOS 12.3 or an earlier release, refer to the
AAA and GTPP Interface
Administration and Reference.
If
you are using StarOS 14.0 or a later release, refer to the AAA Interface Administration
and Reference.
Source IP Address
Validation
Insures integrity
between the attached subscriber terminal and the PDN GW by mitigating the
potential for unwanted spoofing or man-in-the-middle attacks.
The P-GW includes local
IPv4/IPv6 address pools for assigning IP addresses to UEs
on a per-PDN basis. The P-GW defends its provisioned address bindings
by insuring that traffic is received from the host address that
it has awareness of. In the event that traffic is received from
a non-authorized host, the P- GW includes the ability to block the
non-authorized traffic. The P-GW uses the IPv4 source address to
verify the sender and the IPv6 source prefix in the case of IPv6.
Subscriber Level
Trace
Provides a 3GPP
standards-based session level trace function for call debugging
and testing new functions and access terminals in an LTE environment.
As a complement to Cisco's
protocol monitoring function, the P-GW supports 3GPP standards based
session level trace capabilities to monitor all call control events
on the respective monitored interfaces including S5/S8,
S2a, SGi, and Gx. The trace can be initiated using multiple methods:
-
Management initiation
via direct CLI configuration
-
Management initiation
at HSS with trace activation via authentication response messages
over S6a reference interface
-
Signaling based activation
through signaling from subscriber access terminal
IMPORTANT:
Once the trace is provisioned,
it can be provisioned through the access cloud via various signaling
interfaces.
The session level trace
function consists of trace activation followed by triggers. The
time between the two events is treated much like Lawful Intercept
where the EPC network element buffers the trace activation instructions
for the provisioned subscriber in memory using camp-on monitoring.
Trace files for active calls are buffered as XML files using non-volatile
memory on the local dual redundant hard drives on the ASR 5x00 platform.
The Trace Depth defines the granularity of data to be traced. Six
levels are defined including Maximum, Minimum and Medium with ability
to configure additional levels based on vendor extensions.
All call control activity
for active and recorded sessions is sent to an off-line Trace Collection
Entity (TCE) using a standards-based XML format over a FTP or secure
FTP (SFTP) connection. In the current release the IPv4 interfaces
are used to provide connectivity to the TCE. Trace activation is
based on IMSI or IMEI. Once a subscriber level trace request is
activated it can be propagated via the S5/S8 signaling
to provision the corresponding trace for the same subscriber call
on the P-GW. The trace configuration will only be propagated if
the P-GW is specified in the list of configured Network Element
types received by the S-GW. Trace configuration can be specified
or transferred in any of the following message types:
-
S5/S8: Create
Session Request
-
S5/S8: Modify
Bearer Request
-
S5/S8: Trace
Session Activation (New message defined in TS 32.422)
Performance Goals:
As subscriber level trace is a CPU intensive activity the max number
of concurrently monitored trace sessions per Cisco P-GW is 32. Use
in a production network should be restricted to minimize the impact
on existing services.
Threshold Crossing
Alerts (TCA) Support
Thresholding
on the system is used to monitor the system for conditions that
could potentially cause errors or outage. Typically, these conditions
are temporary (i.e high CPU utilization, or packet collisions on
a network) and are quickly resolved. However, continuous or large
numbers of these error conditions within a specific time interval
may be indicative of larger, more severe issues. The purpose of thresholding
is to help identify potentially severe conditions so that immediate
action can be taken to minimize and/or avoid system downtime.
The system supports
Threshold Crossing Alerts for certain key resources such as CPU,
memory, IP pool addresses, etc. With this capability, the operator
can configure threshold on these resources whereby, should the resource
depletion cross the configured threshold, a SNMP Trap would be sent.
The following thresholding
models are supported by the system:
-
Alert: A value
is monitored and an alert condition occurs when the value reaches
or exceeds the configured high threshold within the specified polling
interval. The alert is generated then generated and/or
sent at the end of the polling interval.
-
Alarm: Both high
and low threshold are defined for a value. An alarm condition occurs
when the value reaches or exceeds the configured high threshold
within the specified polling interval. The alert is generated then
generated and/or sent at the end of the polling interval.
Thresholding reports
conditions using one of the following mechanisms:
-
SNMP traps: SNMP
traps have been created that indicate the condition (high threshold
crossing and/or clear) of each of the monitored values.
Generation of specific
traps can be enabled or disabled on the chassis. Ensuring that only important
faults get displayed. SNMP traps are supported in both Alert and
Alarm modes.
-
Logs: The system
provides a facility called threshold for which active and event
logs can be generated. As with other system facilities, logs are
generated Log messages pertaining to the condition of a monitored
value are generated with a severity level of WARNING.
Logs are supported in
both the Alert and the Alarm models.
-
Alarm System: High
threshold alarms generated within the specified polling interval
are considered “outstanding” until a the condition
no longer exists or a condition clear alarm is generated. “Outstanding” alarms
are reported to the system's alarm subsystem and are viewable through
the Alarm Management menu in the Web Element Manager.
The Alarm System is
used only in conjunction with the Alarm model.
IMPORTANT:
For more information
on threshold crossing alert configuration, refer to the Thresholding Configuration
Guide.
UE Time Zone Reporting
This feature
enables time-based charging for specialized service tariffs, such
as super off-peak billing plans
Time Zone of the UE
is associated with UE location (Tracking Area/Routing Area).
The UE Time Zone Information Element is an attribute the MME tracks
on a Tracking Area List basis and propagates over S11 and S5/S8
signalling to the P-GW.
Time zone reporting
can be included in billing records or conveyed in Gx/Gy
signaling to external PCRF and OCS servers.
Virtual APN Support
Virtual APNs
allow differentiated services within a single APN.
The Virtual APN feature
allows a carrier to use a single APN to configure differentiated
services. The APN that is supplied by the MME is evaluated by the
P-GW in conjunction with multiple configurable parameters. Then,
the P-GW selects an APN configuration based on the supplied APN
and those configurable parameters.
APN configuration
dictates all aspects of a session at the P-GW. Different policies
imply different APNS. After basic APN selection, however, internal
re-selection can occur based on the following parameters:
-
-
-
-
Domain name part of
username (user@domain)
-
P-GW Features and
Functionality - Inline Service Support
This section
describes the features and functions of inline services supported
on the P-GW. These services require additional licenses to implement
the functionality.
IMPORTANT:
The
SAEGW supports all of these features if a P-GW service is assigned
to the SAEGW service.
This section describes
the following features:
Content Filtering
The Cisco P-GW
offers two variants of network-controlled content filtering / parental
control services. Each approach leverages the native DPI capabilities
of the platform to detect and filter events of interest from mobile
subscribers based on HTTP URL or WAP/MMS URI requests:
-
Integrated Content Filtering:
A turnkey solution featuring a policy enforcement point and category
based rating database on the Cisco P-GW. An offboard AAA or PCRF
provides the per-subscriber content filtering information as subscriber sessions
are established. The content filtering service uses DPI to extract
URLs or URIs in HTTP request messages and compares them against
a static rating database to determine the category match. The provisioned
policy determines whether individual subscribers are entitled to
view the content.
-
Content Filtering ICAP
Interface: This solution is appropriate for mobile operators with
existing installations of Active Content Filtering external servers.
The service continues to harness the DPI functions of the ASR 5x00
platform to extract events of interest. However in this case, the
extracted requests are transferred via the Integrated Content Adaptation
Protocol (ICAP) with subscriber identification information to the
external ACF server which provides the category rating database
and content decision functions.
Integrated Adult
Content Filter
Provides a value-added
service to prevent unintended viewing of objectionable content that exploits
underage children. Content Filtering offers mobile operators a way
to increase data ARPU and subscriber retention through a network-based
solution for parental controls and content filtering. The integrated solution
enables a single policy decision and enforcement point thereby streamlining
the number of signaling interactions with external AAA/Policy
Manager servers. When used in parallel with other services such as
Enhanced Content Charging (ECS) it increases billing accuracy of
charging records by insuring that mobile subscribers are only charged
for visited sites they are allowed to access.
The Integrated Adult
Content Filter is a subscriber-aware inline service provisioned
on an ASR 5x00 running P-GW services. Integrated Content Filtering
utilizes the local DPI engine and harnesses a distributed software
architecture that scales with the number of active P-GW sessions
on the system.
Content Filtering policy
enforcement is the process of deciding if a subscriber should be
able to receive some content. Typical options are to allow, block,
or replace/redirect the content based on the rating of
the content and the policy defined for that content and subscriber. The
policy definition is transferred in an authentication response from
a AAA server or Diameter policy message via the Gx reference interface
from an adjunct PCRF. The policy is applied to subscribers through
rulebase or APN/Subscriber configuration. The policy determines
the action to be taken on the content request on the basis of its
category. A maximum of one policy can be associated with a rulebase.
ICAP Interface
Provides a value-added
service to prevent unintended viewing of objectionable content that exploits
underage children. Content Filtering offers mobile operators a way
to increase data ARPU and subscriber retention through a network-based
solution for parental controls and content filtering. The Content Filtering
ICAP solution is appropriate for operators with existing installations
of Active Content Filtering servers in their networks.
The Enhanced Charging
Service (ECS) for the P-GW provides a streamlined Internet Content
Adaptation Protocol (ICAP) interface to leverage the Deep Packet Inspection
(DPI) to enable external Application Servers to provide their services
without performing the DPI functionality and without being inserted
in the data flow. The ICAP interface may be attractive to mobile
operators that prefer to use an external Active Content Filtering
(ACF) Platform. If a subscriber initiates a WAP (WAP1.x or WAP2.0)
or Web session, the subsequent GET/POST request is detected
by the deep packet inspection function. The URL of the GET/POST
request is extracted by the local DPI engine on the ASR 5x00 platform
and passed, along with subscriber identification information and
the subscriber request, in an ICAP message to the Application Server
(AS). The AS checks the URL on the basis of its category and other classifications
like, type, access level, content category and decides if the request
should be authorized, blocked or redirected by answering the GET/POST
message. Depending upon the response received from the ACF server,
the P-GW either passes the request unmodified or discards the message
and responds to the subscriber with the appropriate redirection
or block message.
Header Enrichment:
Header Insertion and Encryption
Header enrichment
provides a value-added capability for mobile operators to monetize
subscriber intelligence to include subscriber-specific information
in the HTTP requests to application servers.
Extension header fields
(x-header) are the fields that can be added to headers of a protocol
for a specific purpose. The enriched header allows additional entity-header fields
to be defined without changing the protocol, but these fields cannot
be assumed to be recognizable by the recipient. Unrecognized fields
should be ignored by the recipient and must be forwarded by transparent
proxies.
Extension headers can
be supported in HTTP/WSP GET and POST request packets.
The Enhanced Charging Service (ECS) for the P-GW offers APN-based
configuration and rules to insert x-headers in HTTP/WSP
GET and POST request packets. The charging action associated with
the rules will contain the list of x-headers to be inserted in the
packets. Protocols supported are HTTP, WAP 1.0 and WAP 2.0 GET,
and POST messages.
IMPORTANT:
For more information
on ECS, see the Enhanced
Charging Service Administration Guide.
The data passed in the
inserted HTTP header attributes is used by end application servers (also
known as Upsell Servers) to identify subscribers and session information.
These servers provide information customized to that specific subscriber.
The Cisco P-GW can
include the following information in the http header:
-
User-customizable,
arbitrary text string
-
Subscriber's MSISDN
(the RADIUS calling-station-id, in clear text)
-
-
-
S-GW IP address (in
clear text)
X-Header encryption
enhances the header enrichment feature by increasing the number
of fields that can be supported and through encryption of the fields
before inserting them.
The following limitations
to insertion of x-header fields in WSP headers apply:
-
x-header fields are
not inserted in IP fragmented packets
before StarOS v14.0.
-
In case of concatenated
request, x-header fields are only inserted in first GET or POST request
(if rule matches for the same). X-header fields are not inserted
in the second or later GET/POST requests in the concatenated
requests. For example, if there is ACK+GET in packet, x-header
is inserted in the GET packet. However, if GET1+GET2 is
present in the packet and rule matches for GET2 and not GET1 x-header
is still inserted in GET2. In case of GET+POST also, x-header
is not inserted in POST.
-
In case of CO, x-header
fields are not inserted if the WTP packets are received out of order
(even after proper reordering).
-
If route to MMS is
present, x-headers are not inserted.
-
x-headers are not
inserted in WSP POST packet when header is segmented. This is because
POST contains header length field which needs to be modified after
addition of x-headers. In segmented WSP headers, header length field
may be present in one packet and header may complete in another
packet.
Mobile Video Gateway
The Cisco ASR
5x00 chassis provides mobile operators with a flexible solution
that functions as a Mobile Video Gateway in 2.5G, 3G, and 4G wireless
data networks.
The Cisco Mobile Video
Gateway consists of new software for the ASR 5x00. The Mobile Video
Gateway is the central component of the Cisco Mobile Videoscape. It
employs a number of video optimization techniques that enable mobile
operators to enhance the video experience for their subscribers
while optimizing the performance of video content transmission through
the mobile network.
The Mobile Video Gateway
features and functions include:
-
DPI (Deep Packet Inspection)
to identify subscriber requests for video vs. non-video content
-
Transparent video re-addressing
to the Cisco CAE (Content Adaptation Engine) for retrieval of optimized
video content
-
CAE load balancing
of HTTP video requests among the CAEs in the server cluster
-
Video optimization
policy control for tiered subscriber services
-
Video white-listing,
which excludes certain video clips from video optimization
-
Video pacing for “just
in time” video downloading
-
-
Dynamic inline transrating
-
Dynamically-enabled
TCP proxy
-
Traffic performance
optimization
-
-
SNMP traps and alarms
(threshold crossing alerts)
-
-
Bulk statistics for
mobile video
The Cisco CAE is an
optional component of the Cisco Mobile Videoscape. It runs on the Cisco
UCS (Unified Computing System) platform and functions in a UCS server
cluster to bring additional video optimization capabilities to the
Mobile Videoscape. For information about the features and functions
of the Cisco CAE, see the CAE product documentation.
IMPORTANT:
For more information
on the Mobile Video Gateway, refer to the Mobile Video Gateway Administration
Guide.
Network Address Translation
(NAT)
NAT translates
non-routable private IP address(es) to routable public IP address(es)
from a pool of public IP addresses that have been designated for
NAT. This enables to conserve on the number of public IP addresses
required to communicate with external networks, and ensures security
as the IP address scheme for the internal network is masked from
external hosts, and each outgoing and incoming packet goes through
the translation process.
NAT works by inspecting
both incoming and outgoing IP datagrams and, as needed, modifying
the source IP address and port number in the IP header to reflect
the configured NAT address mapping for outgoing datagrams. The reverse
NAT translation is applied to incoming datagrams.
NAT can be used to perform
address translation for simple IP and mobile IP. NAT can be selectively
applied/denied to different flows (5-tuple connections)
originating from subscribers based on the flows' L3/L4
characteristics—Source-IP, Source-Port, Destination-IP,
Destination-Port, and Protocol.
NAT supports the following
mappings:
IMPORTANT:
For more information
on NAT, refer to the Network
Address Translation Administration Guide.
NAT64 Support
This feature
helps facilitate the co-existence and gradual transition to IPv6
addressing scheme in the networks. Use of NAT64 requires that a
valid license key be installed. Contact your Cisco account representative
for information on how to obtain a license.
With the dwindling
IPv4 public address space and the growing need for more routable
addresses, service providers and enterprises will continue to build
and roll out IPv6 networks. However, because of the broad scale
IPv4 deployment, it is not practical that the world changes to IPv6
overnight. There is need to protect the IPv4 investment combined
with the need to expand and grow the network will force IPv4 and
IPv6 networks to co-exist together for a considerable period of
time and keep end-user experience seamless.
The preferred approaches
are to run dual stacks (both IPv4 and IPv6) on the end hosts, dual stack
routing protocols, and dual stack friendly applications. If all
of the above is available, then the end hosts will communicate natively
using IPv6 or IPv4 (using NAT). Tunneling through the IPv4 or IPv6
is the next preferred method to achieve communication wherever possible.
When all these options fail, translation is recommended.
Stateful NAT64 is
a mechanism for translating IPv6 packets to IPv4 packets and vice-versa. The
system supports a Stateful NAT64 translator based on IETF Behave
WG drafts whose framework is described in draft-ietf-behave-v6v4-framework-10.
Stateful NAT64 is available as part of the existing NAT licenses
from the current system implementation. The NAT44 and NAT64 will
co-exist on the chassis and share the resources needed for NATing.
Peer-to-Peer Detection
Allows operators
to identify P2P traffic in the network and applying appropriate
controlling functions to ensure fair distribution of bandwidth to
all subscribers.
Peer-to-Peer (P2P) is
a term used in two slightly different contexts. At a functional
level, it means protocols that interact in a peering manner, in
contrast to client-server manner. There is no clear differentiation
between the function of one node or another. Any node can function
as a client, a server, or both—a protocol may not clearly
differentiate between the two. For example, peering exchanges may
simultaneously include client and server functionality, sending
and receiving information.
Detecting peer-to-peer
protocols requires recognizing, in real time, some uniquely identifying
characteristic of the protocols. Typical packet classification only
requires information uniquely typed in the packet header of packets
of the stream(s) running the particular protocol to be identified.
In fact, many peer-to-peer protocols can be detected by simple packet header
inspection. However, some P2P protocols are different, preventing
detection in the traditional manner. This is designed into some
P2P protocols to purposely avoid detection. The creators of these
protocols purposely do not publish specifications. A small class
of P2P protocols is stealthier and more challenging to detect. For
some protocols no set of fixed markers can be identified with confidence
as unique to the protocol.
Operators care about
P2P traffic because of the behavior of some P2P applications (for example,
Bittorrent, Skype, and eDonkey). Most P2P applications can hog the
network bandwidth such that 20% P2P users can generate
as much as traffic generated by the rest 80% non-P2P users. This
can result into a situation where non-P2P users may not get enough
network bandwidth for their legitimate use because of excess usage
of bandwidth by the P2P users. Network operators need to have dynamic
network bandwidth / traffic management functions in place
to ensure fair distributions of the network bandwidth among all
the users. And this would include identifying P2P traffic in the
network and applying appropriate controlling functions to the same
(for example, content-based premium billing, QoS modifications,
and other similar treatments).
Cisco’s P2P
detection technology makes use of innovative and highly accurate
protocol behavioral detection techniques.
IMPORTANT:
For more information
on peer-to-peer detection, refer to the Application Detection
and Control Administration Guide.
Personal Stateful
Firewall
The Personal
Stateful Firewall is an in-line service feature that inspects subscriber
traffic and performs IP session-based access control of individual
subscriber sessions to protect the subscribers from malicious security
attacks.
The Personal Stateful
Firewall supports stateless and stateful inspection and filtering
based on the configuration.
In stateless inspection,
the firewall inspects a packet to determine the 5-tuple—source
and destination IP addresses and ports, and protocol—information
contained in the packet. This static information is then compared
against configurable rules to determine whether to allow or drop
the packet. In stateless inspection the firewall examines each packet
individually, it is unaware of the packets that have passed through
before it, and has no way of knowing if any given packet is part of
an existing connection, is trying to establish a new connection,
or is a rogue packet.
In stateful inspection,
the firewall not only inspects packets up through the application
layer / layer 7 determining a packet's header information
and data content, but also monitors and keeps track of the connection's
state. For all active connections traversing the firewall, the state information,
which may include IP addresses and ports involved, the sequence
numbers and acknowledgement numbers of the packets traversing the
connection, TCP packet flags, etc. is maintained in a state table.
Filtering decisions are based not only on rules but also on the connection
state established by prior packets on that connection. This enables
to prevent a variety of DoS, DDoS, and other security violations.
Once a connection is torn down, or is timed out, its entry in the
state table is discarded.
The Enhanced Charging
Service (ECS) / Active Charging Service (ACS) in-line service
is the primary vehicle that performs packet inspection and charging.
For more information on ECS, see the Enhanced Charging Service
Administration Guide.
IMPORTANT:
For more information
on Personal Stateful Firewall, refer to the Personal Stateful Firewall
Administration Guide.
Traffic Performance
Optimization (TPO)
Though TCP is
a widely accepted protocol in use today, it is optimized only for
wired networks. Due to inherent reliability of wired networks, TCP
implicitly assumes that any packet loss is due to network congestion
and consequently invokes congestion control measures. However, wireless
links are known to experience sporadic and usually temporary losses
due to several reasons, including the following, which also trigger
TCP congestion control measures resulting in poor TCP performance.
Reasons for delay variability
over wireless links include:
-
Channel fading effect,
subscriber mobility, and other transient conditions
-
Link-layer retransmissions
-
Handoffs between neighboring
cells
-
Intermediate nodes,
such as SGSN and e-NodeB, implementing scheduling polices tuned
to deliver better QoS for select services; resulting is variable
delay in packet delivery for other services
The TPO inline service
uses a combination of TCP and HTTP optimization techniques to improve
TCP performance over wireless links.
IMPORTANT:
For more information
on TPO, refer to the Traffic
Performance Optimization Administration Guide.
S-GW Features and
Functionality - Optional Enhanced Feature Software
This section
describes the optional enhanced features and functions for the S-GW
service.
IMPORTANT:
The
SAEGW supports all of these features if an S-GW service is assigned
to the SAEGW service.
Each of the following
features require the purchase of an additional license to implement
the functionality with the S-GW service.
This section describes
the following features:
Always-On Licensing
Use of Always
On Licensing requires that a valid license key be installed. Contact
your Cisco account representative for information on how to obtain
a license.
Traditionally, transactional
models have been based on registered subscriber sessions. In an “always-on” deployment
model, however, the bulk of user traffic is registered all of the
time. Most of these registered subscriber sessions are idle a majority
of the time. Therefore, Always-On Licensing charges only for connected-active
subscriber sessions.
A connected-active subscriber session
would be in “ECM Connected state,” as specified
in 3GPP TS 23.401, with a data packet sent/received within
the last one minute (on average). This transactional model allows
providers to better manage and achieve more predictable spending
on their capacity as a function of the Total Cost of Ownership (TCO).
Direct Tunnel
In accordance
with standards, one tunnel functionality enables the SGSN to establish
a direct tunnel at the user plane level - a GTP-U tunnel, directly
between the RAN and the S-GW.
Figure 15. GTP-U with Direct Tunnel
In effect, a direct
tunnel reduces data plane latency as the tunnel functionality acts
to remove the SGSN from the data plane and limit the SGSN to the
control plane for processing. This improves the user experience
(for example, expedites web page delivery, reduces round trip delay
for conversational services). Additionally, direct tunnel functionality
implements the standard SGSN optimization to improve the usage of
user plane resources (and hardware) by removing the requirement
from the SGSN to handle the user plane processing.
Typically, the SGSN
establishes a direct tunnel at PDP context activation using an Update PDP
Context Request towards the S-GW. This means a significant increase
in control plane load on both the SGSN and S-GW components of the
packet core. Hence, deployment requires highly scalable S-GWs since
the volume and frequency of Update PDP Context messages to the S-GW will
increase substantially. The ASR 5x00 platform capabilities ensure
control plane capacity will not be a limiting factor with direct
tunnel deployment.
For more information
on Direct Tunnel configuration, refer to the Direct Tunnel Configuration appendix
in this guide.
Inter-Chassis Session
Recovery
The ASR 5x00
platform provide industry leading carrier class redundancy. The
systems protects against all single points of failure (hardware
and software) and attempts to recover to an operational state when
multiple simultaneous failures occur.
The system provides
several levels of system redundancy:
-
Under normal N+1
PSC hardware redundancy, if a catastrophic PSC failure occurs all
affected calls are migrated to the standby PSC if possible. Calls
which cannot be migrated are gracefully terminated with proper call-termination
signaling and accounting records are generated with statistics accurate
to the last internal checkpoint
-
If the Session Recovery
feature is enabled, any total PSC failure will cause a PSC switchover
and all established sessions for supported call-types are recovered
without any loss of session.
Even though Cisco
provides excellent intra-chassis redundancy with these two schemes, certain
catastrophic failures which can cause total chassis outages, such
as IP routing failures, line-cuts, loss of power, or physical destruction
of the chassis, cannot be protected by this scheme. In such cases,
the MME Inter-Chassis Session Recovery (ICSR) feature provides geographic redundancy
between sites. This has the benefit of not only providing enhanced
subscriber experience even during catastrophic outages, but can
also protect other systems such as the RAN from subscriber re-activation
storms.
ICSR allows for continuous
call processing without interrupting subscriber services. This is
accomplished through the use of redundant chassis. The chassis are
configured as primary and backup with one being active and one in
recovery mode. A checkpoint duration timer is used to control when
subscriber data is sent from the active chassis to the inactive
chassis. If the active chassis handling the call traffic goes out
of service, the inactive chassis transitions to the active state
and continues processing the call traffic without interrupting the
subscriber session. The chassis determines which is active through
a propriety TCP-based connection called a redundancy link. This
link is used to exchange Hello messages between the primary and
backup chassis and must be maintained for proper system operation.
Interchassis Communication
Chassis configured to
support ICSR communicate using periodic Hello messages. These messages
are sent by each chassis to notify the peer of its current state.
The Hello message contains information about the chassis such as
its configuration and priority. A dead interval is used to set a
time limit for a Hello message to be received from the chassis'
peer. If the standby chassis does not receive a Hello message from
the active chassis within the dead interval, the standby chassis
transitions to the active state. In situations where the redundancy
link goes out of service, a priority scheme is used to determine
which chassis processes the session. The following priority scheme
is used:
Checkpoint Messages
Checkpoint messages
are sent from the active chassis to the inactive chassis. Checkpoint messages
are sent at specific intervals and contain all the information needed
to recreate the sessions on the standby chassis, if that chassis
were to become active. Once a session exceeds the checkpoint duration,
checkpoint data is collected on the session. The checkpoint parameter determines
the amount of time a session must be active before it is included
in the checkpoint message.
IMPORTANT:
For more information
on inter-chassis session recovery support, refer to the Interchassis Session
Recovery appendix in System
Administration Guide.
IP Security (IPSec)
Encryption
Enables network
domain security for all IP packet switched LTE-EPC networks in order
to provide confidentiality, integrity, authentication, and anti-replay
protection. These capabilities are insured through use of cryptographic
techniques.
The Cisco S-GW supports
IKEv1 and IPSec encryption using IPv4 addressing. IPSec enables
the following two use cases:
-
Encryption of S8 sessions
and EPS bearers in roaming applications where the P-GW is located
in a separate administrative domain from the S-GW
-
IPSec ESP security in
accordance with 3GPP TS 33.210 is provided for S1 control plane,
S1 bearer plane and S1 management plane traffic. Encryption of traffic
over the S1 reference interface is desirable in cases where the
EPC core operator leases radio capacity from a roaming partner's
network.
IMPORTANT:
You must purchase
an IPSec license to enable IPSec. For more information on IPSec support,
refer to the IP Security appendix
in this guide.
Lawful Intercept
The Cisco Lawful
Intercept feature is supported on the S-GW. Lawful Intercept is
a licensed-enabled, standards-based feature that provides telecommunications
service providers with a mechanism to assist law enforcement agencies
in monitoring suspicious individuals for potential illegal activity.
For additional information and documentation on the Lawful Intercept
feature, contact your Cisco account representative.
Layer 2 Traffic
Management (VLANs)
Virtual LANs
(VLANs) provide greater flexibility in the configuration and use
of contexts and services.
VLANs are configured
as tags on a per-port basis and allow more complex configurations
to be implemented. The VLAN tag allows a single physical port to
be bound to multiple logical interfaces that can be configured in
different contexts. Therefore, each Ethernet port can be viewed
as containing many logical ports when VLAN tags are employed.
IMPORTANT:
For more information
on VLAN support, refer to the VLANs appendix in the System Administration
Guide.
Session Recovery
Support
Provides seamless
failover and reconstruction of subscriber session information in
the event of a hardware or software fault within the system preventing
a fully connected user session from being disconnected.
In the telecommunications
industry, over 90 percent of all equipment failures are software-related.
With robust hardware failover and redundancy protection, any card-level
hardware failures on the system can quickly be corrected. However, software
failures can occur for numerous reasons, many times without prior
indication. StarOS has the ability to support stateful intra-chassis
session recovery (ICSR) for S-GW sessions.
When session recovery
occurs, the system reconstructs the following subscriber information:
-
Data and control state
information required to maintain correct call behavior
-
Subscriber data statistics
that are required to ensure that accounting information is maintained
-
A best-effort attempt
to recover various timer values such as call duration, absolute time,
and others
Session recovery is
also useful for in-service software patch upgrade activities. If
session recovery is enabled during the software patch upgrade, it
helps to preserve existing sessions on the active packet services
card during the upgrade process.
IMPORTANT:
For more information
on session recovery support, refer to the Session Recovery appendix
in the System Administration Guide.
P-GW Features and
Functionality - Optional Enhanced Feature Software
This section
describes the optional enhanced features and functions for the P-GW
service.
IMPORTANT:
The
SAEGW supports all of these features if a P-GW service is assigned
to the SAEGW service.
Each of the following
features requires the purchase of an additional license to implement the
functionality with the P-GW service.
IMPORTANT:
For information on installing
and verifying licenses, refer to the Managing License Keys section
of the Software Management
Operations chapter in the System Administration
Guide.
This section describes
the following features:
Always-On Licensing
Use of Always
On Licensing requires that a valid license key be installed. Contact
your Cisco account representative for information on how to obtain
a license.
Traditionally, transactional
models have been based on registered subscriber sessions. In an “always-on” deployment
model, however, the bulk of user traffic is registered all of the
time. Most of these registered subscriber sessions are idle a majority
of the time. Therefore, Always-On Licensing charges only for connected-active
subscriber sessions.
A connected-active subscriber
session would be in “ECM Connected state,” as
specified in 3GPP TS 23.401, with a data packet sent/received
within the last one minute (on average). This transactional model
allows providers to better manage and achieve more predictable spending
on their capacity as a function of the Total Cost of Ownership (TCO).
Dynamic RADIUS Extensions
(Change of Authorization)
Use of Dynamic
RADIUS Extensions (CoA and PoD) requires that a valid license key
be installed. Contact your Cisco account representative for information
on how to obtain a license.
Dynamic RADIUS extension
support provide operators with greater control over subscriber PDP
contexts by providing the ability to dynamically redirect data traffic, and
or disconnect the PDP context.
This functionality
is based on the RFC 3576, Dynamic Authorization Extensions to Remote Authentication
Dial In User Service (RADIUS), July 2003 standard.
The system supports
the configuration and use of the following dynamic RADIUS extensions:
-
Change of Authorization:
The system supports CoA messages from the AAA server to change data
filters associated with a subscriber session. The CoA request message
from the AAA server must contain attributes to identify NAS and
the subscriber session and a data filter ID for the data filter
to apply to the subscriber session.
-
Disconnect Message:
The DM message is used to disconnect subscriber sessions in the
system from a RADIUS server. The DM request message should contain
necessary attributes to identify the subscriber session.
The above extensions
can be used to dynamically re-direct subscriber PDP contexts to
an alternate address for performing functions such as provisioning
and/or account set up. This functionality is referred to
as Session Redirection, or Hotlining.
Session redirection
provides a means to redirect subscriber traffic to an external server
by applying ACL rules to the traffic of an existing or a new subscriber
session. The destination address and optionally the destination
port of TCP/IP or UDP/IP packets from the subscriber
are rewritten so the packet is forwarded to the designated redirected
address.
Return traffic to
the subscriber has the source address and port rewritten to the
original values. The redirect ACL may be applied dynamically by
means of the Radius Change of Authorization (CoA) extension.
GRE Protocol Interface
Support
Use of GRE
Interface Tunneling requires that a valid license key be installed.
Contact your local Sales or Support representative for information
on how to obtain a license.
The P-GW supports GRE
generic tunnel interfaces in accordance with RFC 2784, Generic Routing
Encapsulation (GRE). The GRE protocol allows mobile users to connect
to their enterprise networks through GRE tunnels.
GRE tunnels can be
used by the enterprise customers of a carrier 1) To transport AAA packets
corresponding to an APN over a GRE tunnel to the corporate AAA servers
and, 2) To transport the enterprise subscriber packets over the
GRE tunnel to the corporation gateway.
The corporate servers
may have private IP addresses and hence the addresses belonging
to different enterprises may be overlapping. Each enterprise needs
to be in a unique virtual routing domain, known as VRF. To differentiate
the tunnels between same set of local and remote ends, GRE Key will
be used as a differentiation.
GRE tunneling is a
common technique to enable multi-protocol local networks over a single-protocol
backbone, to connect non-contiguous networks and allow virtual private
networks across WANs. This mechanism encapsulates data packets from
one protocol inside a different protocol and transports the data
packets unchanged across a foreign network. It is important to note
that GRE tunneling does not provide security to the encapsulated
protocol, as there is no encryption involved (like IPSec offers,
for example).
GRE tunneling consists
of three main components:
-
Passenger protocol-protocol
being encapsulated. For example: CLNS, IPv4 and IPv6.
-
Carrier protocol-protocol
that does the encapsulating. For example: GRE, IP-in-IP, L2TP, MPLS
and IPSec.
-
Transport protocol-protocol
used to carry the encapsulated protocol. The main transport protocol
is IP.
Inter-Chassis Session
Recovery
Use of Interchassis
Session Recovery requires that a valid license key be installed.
Contact your local Sales or Support representative for information
on how to obtain a license.
The ASR 5x00 provides
industry leading carrier class redundancy. The systems protects
against all single points of failure (hardware and software) and
attempts to recover to an operational state when multiple simultaneous
failures occur.
The system provides
several levels of system redundancy:
-
Under normal N+1
PSC/PSC2 hardware redundancy, if a catastrophic packet processing
card failure occurs all affected calls are migrated to the standby
packet processing card if possible. Calls which cannot be migrated
are gracefully terminated with proper call-termination signaling
and accounting records are generated with statistics accurate to
the last internal checkpoint
-
If the Session Recovery
feature is enabled, any total PSC/PSC2 failure will cause
a PSC switchover and all established sessions for supported call-types
are recovered without any loss of session.
Even though Cisco provides
excellent intra-chassis redundancy with these two schemes, certain
catastrophic failures which can cause total chassis outages, such
as IP routing failures, line-cuts, loss of power, or physical destruction
of the chassis, cannot be protected by this scheme. In such cases,
the MME Inter-Chassis Session Recovery feature provides geographic
redundancy between sites. This has the benefit of not only providing
enhanced subscriber experience even during catastrophic outages,
but can also protect other systems such as the RAN from subscriber re-activation
storms.
The Interchassis Session
Recovery feature allows for continuous call processing without interrupting
subscriber services. This is accomplished through the use of redundant
chassis. The chassis are configured as primary and backup with one
being active and one in recovery mode. A checkpoint duration timer
is used to control when subscriber data is sent from the active
chassis to the inactive chassis. If the active chassis handling
the call traffic goes out of service, the inactive chassis transitions
to the active state and continues processing the call traffic without
interrupting the subscriber session. The chassis determines which
is active through a propriety TCP-based connection called a redundancy
link. This link is used to exchange Hello messages between the primary
and backup chassis and must be maintained for proper system operation.
-
Interchassis Communication
Chassis configured to
support Interchassis Session Recovery communicate using periodic Hello
messages. These messages are sent by each chassis to notify the
peer of its current state. The Hello message contains information
about the chassis such as its configuration and priority. A dead
interval is used to set a time limit for a Hello message to be received
from the chassis' peer. If the standby chassis does not receive
a Hello message from the active chassis within the dead interval,
the standby chassis transitions to the active state. In situations
where the redundancy link goes out of service, a priority scheme
is used to determine which chassis processes the session. The following
priority scheme is used:
-
Checkpoint messages
are sent from the active chassis to the inactive chassis. Checkpoint messages
are sent at specific intervals and contain all the information needed
to recreate the sessions on the standby chassis, if that chassis
were to become active. Once a session exceeds the checkpoint duration,
checkpoint data is collected on the session. The checkpoint parameter determines
the amount of time a session must be active before it is included
in the checkpoint message.
IMPORTANT:
For more information
on inter-chassis session recovery support, refer to the Interchassis Session
Recovery chapter in the System
Administration Guide.
IP Security (IPSec)
Encryption
Use of Network
Domain Security requires that a valid license key be installed.
Contact your local Sales or Support representative for information
on how to obtain a license.
IPSec encryption enables
network domain security for all IP packet switched LTE-EPC networks
in order to provide confidentiality, integrity, authentication,
and anti-replay protection. These capabilities are insured through
use of cryptographic techniques.
The Cisco P-GW supports
IKEv1 and IPSec encryption using IPv4 addressing. IPSec enables
the following two use cases:
-
Encryption of S8 sessions
and EPS bearers in roaming applications where the P-GW is located
in a separate administrative domain from the S-GW
-
IPSec ESP security in
accordance with 3GPP TS 33.210 is provided for S1 control plane,
S1 bearer plane and S1 management plane traffic. Encryption of traffic
over the S1 reference interface is desirable in cases where the
EPC core operator leases radio capacity from a roaming partner's
network.
L2TP LAC Support
Use of L2TP
LAC requires that a valid license key be installed. Contact your
local Sales or Support representative for information on how to
obtain a license.
The system configured
as a Layer 2 Tunneling Protocol Access Concentrator (LAC) enables
communication with L2TP Network Servers (LNSs) for the establishment
of secure Virtual Private Network (VPN) tunnels between the operator
and a subscriber's corporate or home network.
The use of L2TP in VPN
networks is often used as it allows the corporation to have more
control over authentication and IP address assignment. An operator
may do a first level of authentication, however use PPP to exchange
user name and password, and use IPCP to request an address. To support
PPP negotiation between the P-GW and the corporation, an L2TP tunnel must
be setup in the P-GW running a LAC service.
L2TP establishes L2TP
control tunnels between LAC and LNS before tunneling the subscriber
PPP connections as L2TP sessions. The LAC service is based on the
same architecture as the P-GW and benefits from dynamic resource
allocation and distributed message and data processing.
The LAC sessions can
also be configured to be redundant, thereby mitigating any impact
of hardware or software issues. Tunnel state is preserved by copying
the information across processor cards.
Lawful Intercept
The feature
use license for Lawful Intercept on the P-GW is included in the
P-GW session use license.
The Cisco Lawful Intercept
feature is supported on the P-GW. Lawful Intercept is a licensed-enabled,
standards-based feature that provides telecommunications service
providers with a mechanism to assist law enforcement agencies in
monitoring suspicious individuals for potential illegal activity.
For additional information and documentation on the Lawful Intercept
feature, contact your Cisco account representative.
Layer 2 Traffic
Management (VLANs)
Use of Layer
2 Traffic Management requires that a valid license key be installed.
Contact your local Sales or Support representative for information
on how to obtain a license.
Virtual LANs (VLANs)
provide greater flexibility in the configuration and use of contexts
and services.
VLANs are configured
as “tags” on a per-port basis and allow more complex
configurations to be implemented. The VLAN tag allows a single physical
port to be bound to multiple logical interfaces that can be configured
in different contexts; therefore, each Ethernet port can be viewed as
containing many logical ports when VLAN tags are employed.
IMPORTANT:
For more information
on VLAN support, refer to the VLANs chapter in
the System Administration
Guide.
Local Policy Decision
Engine
Use of the
Local Policy Decision Engine requires that a valid license key be
installed. Contact your local Sales or Support representative for
information on how to obtain a license.
The Local Policy Engine
is an event-driven rules engine that offers Gx-like QoS and policy
controls to enable user or application entitlements. As the name
suggests, it is designed to provide a subset of a PCRF in cases
where an operator elects not to use a PCRF or scenarios where connections
to an external PCRF are disrupted. Local policies are used to control
different aspects of a session like QoS, data usage, subscription
profiles, and server usage by means of locally defined policies.
A maximum of 1,024 local policies can be provisioned on a P-GW system.
Local policies are
triggered when certain events occur and the associated conditions
are satisfied. For example, when a new call is initiated, the QoS
to be applied for the call could be decided based on the IMSI, MSISDN,
and APN.
Potential uses cases
for the Local Policy Decision Engine include:
-
Disaster recovery
data backup solution in the event of a loss of PCRF in a mobile core
network.
-
Dedicated bearer establishment
for emergency voice calls.
-
Network-initiated
bearer establishment on LTE to non-3GPP inter-domain handovers.
MPLS Forwarding
with LDP
Use of MPLS
requires that a valid license key be installed. Contact your local
Sales or Support representative for information on how to obtain
a license.
Multi Protocol Label
Switching (MPLS) is an operating scheme or a mechanism that is used
to speed up the flow of traffic on a network by making better use
of available network paths. It works with the routing protocols
like BGP and OSPF, and therefore it is not a routing protocol.
MPLS generates a fixed-length
label to attach or bind with the IP packet's header to control the
flow and destination of data. The binding of the labels to the IP
packets is done by the label distribution protocol (LDP). All the
packets in a forwarding equivalence class (FEC) are forwarded by
a label-switching router (LSR), which is also called an MPLS node.
The LSR uses the LDP in order to signal its forwarding neighbors
and distribute its labels for establishing a label switching path
(LSP).
In order to support
the increasing number of corporate APNs, which have a number of different
addressing models and requirements, MPLS is deployed to fulfill
at least the following two requirements:
-
The corporate APN traffic
must remain segregated from other APNs for security reasons.
-
Overlapping of IP addresses
in different APNs.
When deployed, the
MPLS backbone automatically negotiates routes using the labels binded with
the IP packets. Cisco P-GW as an LSR learns the default route from
the connected provider edge (PE), while the PE populates its routing
table with the routes provided by the P-GW.
NEMO Service Supported
Use of NEMO
requires that a valid license key be installed. Contact your local
Sales or Support representative for information on how to obtain
a license.
The P-GW may be configured
to enable or disable Network Mobility (NEMO) service.
When enabled, the
system includes NEMO support for a Mobile IPv4 Network Mobility (NEMO-HA)
on the P-GW platform to terminate Mobile IPv4 based NEMO connections
from Mobile Routers (MRs) that attach to an Enterprise PDN. The
NEMO functionality allows bi-directional communication that is application-agnostic
between users behind the MR and users or resources on Fixed Network
sites.
The same NEMO4G-HA
service and its bound Loopback IP address supports NEMO connections
whose underlying PDN connection comes through GTP S5 (4G access)
or PMIPv6 S2a (eHRPD access).
Session Recovery
Support
The feature
use license for Session Recovery on the P-GW is included in the
P-GW session use license.
Session recovery provides
seamless failover and reconstruction of subscriber session information
in the event of a hardware or software fault within the system preventing
a fully connected user session from being disconnected.
In the telecommunications
industry, over 90 percent of all equipment failures are software-related.
With robust hardware failover and redundancy protection, any card-level
hardware failures on the system can quickly be corrected. However,
software failures can occur for numerous reasons, many times without
prior indication. StarOS Release 9.0 adds the ability to support
stateful intra-chassis session recovery for P-GW sessions.
When session recovery
occurs, the system reconstructs the following subscriber information:
-
Data and control state
information required to maintain correct call behavior
-
Subscriber data statistics
that are required to ensure that accounting information is maintained
-
A best-effort attempt
to recover various timer values such as call duration, absolute time,
and others
Session recovery is
also useful for in-service software patch upgrade activities. If
session recovery is enabled during the software patch upgrade, it
helps to preserve existing sessions on the active PSC/PSC2
during the upgrade process.
IMPORTANT:
For more information
on session recovery support, refer to the Session Recovery chapter
in the System Administration Guide.
Smartphone Tethering
Detection Support
Use of Smartphone
Tethering Detection requires that a valid license key be installed.
Contact your local Sales or Support representative for information
on how to obtain a license.
On the P-GW, using the
inline heuristic detection mechanism, it is now possible to detect
and differentiate between the traffic from the mobile device and
a tethered device connected to the mobile device.
Traffic Policing
Use of Per-Subscriber
Traffic Policing requires that a valid license key be installed.
Contact your local Sales or Support representative for information
on how to obtain a license.
Traffic policing allows
you to manage bandwidth usage on the network and limit bandwidth
allowances to subscribers.
Traffic policing enables
the configuring and enforcing of bandwidth limitations on individual
subscribers and/or APNs of a particular traffic class in
3GPP/3GPP2 service.
Bandwidth enforcement
is configured and enforced independently on the downlink and the uplink
directions.
A Token Bucket Algorithm
(a modified trTCM) [RFC2698] is used to implement
the Traffic-Policing feature. The algorithm used measures the following
criteria when determining how to mark a packet:
-
Committed Data Rate
(CDR): The guaranteed rate (in bits per second) at which packets
can be transmitted/received for the subscriber during the
sampling interval.
-
Peak Data Rate (PDR):
The maximum rate (in bits per second) that subscriber packets can
be transmitted/received for the subscriber during the sampling interval.
-
Burst-size: The
maximum number of bytes that can be transmitted/received for
the subscriber during the sampling interval for both committed (CBS)
and peak (PBS) rate conditions. This represents the maximum number
of tokens that can be placed in the subscriber’s “bucket”.
Note that the committed burst size (CBS) equals the peak burst size
(PBS) for each subscriber.
The system can be
configured to take any of the following actions on packets that
are determined to be in excess or in violation:
-
Drop: The offending
packet is discarded.
-
Transmit: The offending
packet is passed.
-
Lower the IP Precedence:
The packet’s ToS bit is set to “0”, thus downgrading
it to Best Effort, prior to passing the packet. Note that if the
packet’s ToS bit was already set to “0”,
this action is equivalent to “Transmit”.
User Location Information
Reporting
Use of User Location
Information (ULI) Reporting requires that a valid license key be
installed. Contact your local Sales or Support representative for
information on how to obtain a license.
ULI Reporting allows
the eNodeB to report the location of a UE to the MME, when requested
by a P-GW.
The following procedures
are used over the S1-MME interface to initiate and stop location reporting
between the MME and eNodeB:
-
Location Reporting Control:
The purpose of Location Reporting Control procedure is to allow
the MME to request that the eNodeB report where the UE is currently
located. This procedure uses UE-associated signaling.
-
Location Report Failure
Indication: The Location Report Failure Indication procedure
is initiated by an eNodeB in order to inform the MME that a Location Reporting
Control procedure has failed. This procedure uses UE-associated
signalling.
-
Location Report:
The purpose of Location Report procedure is to provide the UE's
current location to the MME. This procedure uses UE-associated signalling.
The start/stop
trigger for location reporting for a UE is reported to the MME by
the S-GW over the S11 interface. The Change Reporting Action (CRA)
Information Element (IE) is used for this purpose. The MME updates
the location to the S-GW using the User Location Information (ULI)
IE.
The following S11 messages
are used to transfer CRA and ULI information between the MME and
S-GW:
-
Create Session Request:
The ULI IE is included for E-UTRAN Initial Attach and UE-requested
PDN Connectivity procedures. It includes ECGI and TAI. The MME includes
the ULI IE for TAU/ X2-Handover procedure if the P-GW has
requested location information change reporting and the MME support
location information change reporting. The S-GW includes the ULI
IE on S5/S8 exchanges if it receives the ULI from the MME.
If the MME supports change reporting, it sets the corresponding
indication flag in the Create Session Request message.
-
Create Session Response:
The CRA IE in the Create Session Response message can be populated
by the S-GW to indicate the type of reporting required.
-
Create Bearer Request:
The CRA IE is included with the appropriate Action field if the
Location Change Reporting mechanism is to be started or stopped
for the subscriber in the MME.
-
Modify Bearer Request:
The MME includes the ULI IE for TAU/Handover procedures
and UE-initiated Service Request procedures if the P-GW has requested
location information change reporting and the MME supports location
information change reporting. The S-GW includes this IE on S5/S8
exchanges if it receives the ULI from the MME.
-
Modify Bearer Response:
The CRA IE is included with the appropriate Action field if the
Location Change Reporting mechanism is to be started or stopped
for the subscriber in the MME.
-
Delete Session Request:
The MME includes the ULI IE for the Detach procedure if the P-GW
has requested location information change reporting and MME supports location
information change reporting. The S-GW includes this IE on S5/S8
exchanges if it receives the ULI from the MME.
-
Update Bearer Request:
The CRA IE is included with the appropriate Action field if the
Location Change Reporting mechanism is to be started or stopped
for the subscriber in the MME.
-
Change Notification
Request: If no existing procedure is running for a UE, a Change
Notification Request is sent upon receipt of an S1-AP location report
message. If an existing procedure is running, one of the following
messages reports the ULI:
If an existing Change
Notification Request is pending, it is aborted and a new one is sent.
IMPORTANT:
Information on configuring
User Location Information (ULI) Reporting support is located in the Configuring Optional
Features on the MME section of the Mobility Management
Entity Configuration chapter in the Mobility Management Entity
Administration Guide.
