> Ty Interface Support
> This chapter provides information on configuring the IP Multimedia Subsystem (IMS) Authorization Service support with Ty interface support for IMS subscriber in cdma2000 networks. This chapter also describes the configuration and commands with Diameter attributes that are used to implement this feature.
> It is recommended that you select the configuration example that best meets your service model, and configure the required elements for that model, as described in Packet Data Serving Node Administration Guide for PDSN/FA service and Home Agent Administration Guide for HA service, before using the procedures in this chapter.
> Important: The IMS Authorization Service feature described in this chapter is only available if you have purchased and installed a Dynamic Policy Interface feature license on chassis. If you have not previously purchased this enhanced feature, contact your sales representative for more information.
> This chapter includes the following:

> • | Overview

> • | Access Gateway Functionality for IMS Authorization

> • | How it Works

> • | Configuring IMS Authorization Service

> • | Enabling IMS Authorization and QoS Profile

> Overview
> Important: The system supports IMS authorization for IMS subscribers with Ty interface in cdma2000 networks. IMS authorization support is a license enabled feature and you must obtain and install a license key to enable it.
> IMS service provides wide application support for transport of voice, video, and data independent of the access support. The roaming IMS subscriber in cdma2000 networks requires specific interface support for service access in this network.
> Apart from other functionality sufficient, uninterrupted, consistent, and seamless user experience is expected by a subscriber during an application session. It is also important that the subscriber gets charged only for the amount of resources consumed by the particular IMS application used.
> In view of required flow bandwidth and QoS, the ASR 5000 Series Platforms provide enhanced support for use of Service Based Local Policy (SBLP) to provision and control the resources used by the IMS subscriber. SBLP is based on the dynamic parameters such as the media/traffic flows for data transport, network conditions and static parameters, such as subscriber configuration and category. It also provides Flow based Charging (FBC) mechanism to charge the subscriber dynamically based on content usage.
> The system provides Ty interface to implement IMS authorization in cdma2000 networks for Access Gateways (PDSN and HA). The following table indicates the products on which the feature is supported and the relevant sections within the chapter that pertain to that product.
> Applicable Products and Relevant Sections

> Applicable Product(s) | Refer to Sections
> PDSN |
> • | Access Gateway Functionality for IMS Authorization
> • | How it Works
> • | Ty Interface Support with AGW
> • | Configuring IMS Authorization Service
> • | Enabling IMS Authorization and QoS Profile
> • | Configuring IMS Authorization in PDSN Service
> • | Configuring Policy Map and DSCP Marking for PDSNHA Service
> • | Applying IMS Authorization to a Subscriber
> HA |
> • | Access Gateway Functionality for IMS Authorization
> • | How it Works
> • | Ty Interface Support with AGW
> • | Configuring IMS Authorization Service
> • | Enabling IMS Authorization and QoS Profile
> • | Configuring Policy Map and DSCP Marking for PDSNHA Service
> • | Applying IMS Authorization to a Subscriber

> ‌
> Supported Standards
> Support for the following standards and requests for comments (RFCs) have been added with the IMS authorization service functionality:

> • | 3GPP2 TSG-X (PSN) X.P0013-014-0.8, Service Based Bearer Control – Ty Interface Stage-3

> • | RFC 3588, Diameter Base Protocol

> • | RFC 4006, Diameter Credit-Control Application

> Supported Networks and Platforms
> This feature supports all ASR 5000 Series Platforms for the core network services configured on the system.
> Interfaces for IMS Authorization
> For IMS deployment in cdma2000 networks the system uses policy-based admission control support and/or flow based charging. The interfaces supported to perform SBLP and FBC in IMS authorization service described in the following sections.
> Ty Interface for PDSN/FA/HA
> The Ty reference is an interface between an Access Gateway (AGW) and a Policy and Charging Rules Function (PCRF) in support of Service Based Bearer Control.
> The system, acting as an AGW, performs the Traffic Plane Function (TPF) and Policy and Charging Enforcement Function (PCEF) functionality. PCRF may be co-located with the P-CSCF, but they are different entities.
> The Ty interface performs interactions for the purpose of local authorization of bearer level QoS resources on the resources negotiated at the application layer and/or based on local policy. In addition it supports the passing of information that may be used to establish flow based charging policy. The Ty interface also provides the following features:

> • | Co-ordination between the application and the bearer level for per-flow accounting

> • | Notification of loss of bearer from the bearer control entity to the application

> • | Application control of the flow of packets on the bearer including the restriction of flow end-points (flow filtering)

> • | General policy considerations for the allocation of resources on the bearer in the local domain.

> Terminology and Definition
> This section provides the descriptions of the terms used in this chapter for IMS authorization service support.

> • | Binding Information: The binding information associates a bearer to the IP flows of a session. The binding information is based on IMS session information for IMS sessions and sent by UE. The system receives the binding information from the UE during bearer activation or modification. The binding information consists of flow identifiers, QoS information, and flow description, if any for the IMS session.

> • | Flow Identifier: In an IMS session an IP flow is indicated uniquely by means of a flow identifier. The flow identifier is created based on the ordinal number of the flow stream and of the IP flow in the session where the IP flows are arranged based on the ports used.

> • | Binding Mechanism: This mechanism is used to associate a bearer with the IP flow(s) of an IMS session in the PDF.

> • | Service-based Local Policy (SBLP): This term refers to the instantiation of a policy for use of bearer resources in the access network based on Authorization by a service. In the context of Ty interface this is the combined QoS given to a set of IP flows for an IMS session.

> • | Service Based Authorization: This term refers to the authorization for use of bearer resources in the access network based on a determination by the application, possibly due to negotiation involving the user. In general, bearer resources are authorized if the resources requested at the bearer do not exceed the resources negotiated or requested at the service level.

> • | Charging Rule: This is a set of information that contains the key to identify the packet flow(s) and defines how the flow(s) is to be charged. The Traffic Plane Function (TPF)/ PCEF installs the charging rules either statically or dynamically.

> • | Dynamic Charging Rule: The charging rules that depend upon real time analysis of the IP flow data being negotiated at the time of the session setup.

> • | Main A10: This is the primary bearer used for all the signaling. The traffic TFTs can be associated with both main A10 and auxiliary A10.

> • | Auxiliary A10: This is the secondary bearer used for data traffic only.

> Access Gateway Functionality for IMS Authorization
> This section describes the functionality of AGW service for IMS authorization to an IMS subscriber session in its networks.
> The AGW contains and supports the Policy Enforcement Point (PEP)/PCEF function in Service Based Local Policy architecture and the Traffic Plane Function (TPF)/PCEF in the Flow Based charging (FBC) architecture. The individual requirements for each of these models are described in the following sections.
> Policy Enforcement Point in SBLP
> The Policy Enforcement Point in SBLP controls the quality of service that is provided to a combined set of IP flows. The basic PEP functionality for SBLP support is identified as:

> • | Support for “Gate” Functionality

> • | Support for Bearer Authorization

> • | Charging Correlation

> Support for 'gate' Functionality
> The PEP implements “gate” functionality which controls the flow of packets in the user plane based on the status of the gate. The gate operations are controlled on the basis of policy. It controls the allow and discard of IP packets in “open” or “closed” state of the gate. A gate applies to unidirectional flow(s) and consists of packet classifier and the associated gate status. The gate status is updated dynamically (to open/to close) based on policy decisions from PDF. When there are changes to a packet flow associated with an application (e.g. a mobile user puts a session on hold, or introduces a new media flow or terminates another), these changes are communicated to PEPs.
> The gating of packet flows allows the operator the ability to control the use of the relevant IP resources, depending on the application being offered. The operator uses this capability to control the destination and source of the bearer. This gating function helps to prevent leakage of service and denial of service attacks in the network.
> Support for Bearer Authorization
> The system authorizes the use of bearer resources for the IMS media flow transport purpose. To achieve this, the system performs query and/or get unsolicited policy decision messages from the PDF. The decision messages indicate the IP flow(s) and the max value authorized for the resource which in this context is the QoS bandwidth used by the bearer.
> The system also enforces this limit on the usage of the bearer for the transport of the IMS application media.
> Charging Correlation
> For IMS bearer charging, the IP Multimedia Core Network (IM CN) subsystem and the Packet Switched (PS) domain entities are required to generate correlated charging data.
> In order to achieve this, the AGW provides the co-relation identifiers associated with the bearer along with its address to the PDF. The PDF in turn sends the IMS Charging Identifier (ICID), which is provided by the P-CSCF, to the AGW. The system generates the charging records including the co-related identifier as well as the ICID if received from PDF, so that the correlation of charging data can be done with the billing system.
> The policy authorization transactions are carried over the Ty interface, which is based on the Diameter protocol.
> Flow Based Charging with TPF/PCEF
> Flow based charging handles differentiated charging of the bearer usage based on real time analysis of the service data flows. Generally charging for the usage of bearer is based on subscriber at the bearer level. Flow based charging provides a more granular charging mechanism where the charging is a dynamic function of the IP flows used by the media for an application.
> The Charging Rule Function (CRF) or PCRF is capable of provisioning charging rules to the system where the charging rules are statically or dynamically defined at CRF/PCRF. A charging rule has a name, rating group, service identifier, service data flow filter and other charging related parameters associated with it.
> The service data flow filters identify a flow and are unidirectional. These filters are associated with an IP 5 tuple (protocol, local address, local port, remote address, remote port). In case of static or predefined filters, the IP flow will be inspected by attributes beyond the 5 tuple of port, address and protocol. It is the function of Traffic Plane Function (TPF)/ Policy and Charging Enforcement Function (PCEF) to analyze the data packet based on the installed flow filters. If a packet does not match with the filters for the bearer, it is dropped by the TPF/PCEF. TPF/PCEF counts packets based on individual flow for charging purpose.
> The charging rules also include the type of charging, (online or offline), the primary and secondary addresses for the offline, and online charging systems as applicable for the credit control of the session.
> CRF/PCRF is also capable of generating unsolicited messages for provisioning charging rules for a bearer. The TPF/PCEF is required to enforce the charging rules from any decision received from CRF/PCRF.
> The system supports the following charging rule operations over the Ty interface:

> • | Installation, modification, and removal of dynamic charging rule using Ty interface.

> • | Provide high priority to the dynamic charging rules over the static charging rules configured with the system.

> Important: The system does not need any static configuration knowledge of traffic categories (Rating-Groups) dynamically received by CRF/PCRF and packets dropped due to the closure of “gate” are not counted against the quota for the matching category.
> A dynamic charging rule has the following attributes:

> • | a charging rule name

> • | service data flow filter(s)

> • | precedence

> • | “gate” status

> • | QoS parameters

> Policy Mapping between PCRF and PCEF
> This section describes the process of policy mapping between PCRF/P-CSCF and PCEF/AGW.
> The Operator can associate each subscriber with one static policy-group and one dynamic policy-group. The static policy-group parameters for the subscriber are configured by the operator, and the dynamic policy-group is automatically created from the Charging-Rule-Definition AVP returned by the PCRF for the subscriber. The contents of the dynamic policy-group can be updated on request from the PCRF.
> The system applies the following rules to decide the order in which charging rules are applied for a subscriber:

> • | If the AGW service instance is NOT configured for SBBC service any static policy configured for the subscriber will be applied.

> • | If the AGW service instance is configured for SBBC and PCRF disables the charging any static policy configured for the subscriber will be applied.

> • | If the AGW service instance is configured for SBBC and PCRF enables the charging:

> • | specific charging rules installed by the PCRF for the subscriber will be applied.

> • | default charging rules installed by the PCRF for the subscriber will be applied.

> • | any static policy configured for the subscriber will be applied.

> The following rules decide the order of evaluation of Charging-Rules associated with the Policy-Group:

> • | The Charging -Rule-Definitions with the highest precedence will be evaluated first.

> • | If there are multiple Charging -Rule-Definitions with the same precedence the newer rule will be evaluated first.

> • | If there are multiple Charging -Rule-Definitions in the same RAR, CCA messages with the same precedence, the charging rules will be evaluated in the order of the occurrence in packet.

> The charging rule definitions returned by the PCRF are translated in the policy infrastructure for the AGW. The section Maintaining the Dynamic Policy-Group defines the mapping of different entities in the policy infrastructure for the dynamic policy-group.
> Maintaining the Dynamic Policy-Group
> This section defines the mapping of the Charging-Rule-Install AVP to the dynamic policy-group and related policy infrastructure. The rules for creating a dynamic policy group are as follows:

> • | Create a dynamic policy group, if one does not exist, for each Charging-Rule-Install AVP in the packet:

> • | If a charging rule with the same name exists, then replace all the policy-maps and class-maps with new information and update any precedence change in the policy-group.

> • | If charging-rule does not exists; then create class-map, policy-map, and policy-group entries.

> Important: For more information on Class-Map, Policy-Map, and Policy-Group, refer to the Intelligent Traffic Control chapter.
> How it Works
> This section describes the IMS authorization and dynamic policy support in a cdma2000 networks.
> The DPCA is the Ty interface to the Policy Control and Charging Rule Function (PCRF). The PCRF contains both PDF (Policy Decision Function) and CRF (Charging Rule Function). The PCRF may reside in Proxy-Call Session Control Function (P-CSCF) or on stand-alone system.
> The interface between IMSA with PCRF is the Ty interface and between Session Manager and Online Charging Service (OCS) is the Tx interface.
> Important: Online charging is not supported in this release.
> Ty Interface Support with AGW
> IMS authorization support performs in following way to provide the IMS authorization service to a subscriber in cdma2000 network.
> When an AGW receives a packet in downlink or uplink direction, it matches the packets against all the downlink/uplink PCC rules that configured by the PCRF for the subscriber. On the basis of matching rules it selects one PCC rule and applies the ‘gating policy’ as available in selected PCCC rule to the flow. It also applies the traffic policing to the flow on the basis of downlink/uplink bandwidth limit provided in authorized QoS profile available in the PCC rule. To provide the bandwidth limit the AGW uses 3 color 2 bucket in the color blind mode to enforce the bandwidth.
> If flow is in uplink direction AGW applies the routing function on the packet or extract the flow-identifier for the downlink flow with the use of Flow-Identifier AVP in PCC rule.
> Based on the flow -id the AGW selects the A10 to transport the packet and adds the flow identifier attributes to the GRE header and forwards the packet on the selected A10.
> The following figure provides a high-level view of the IMS authorization process between a system and IMS components that is initiated by the MN. The table explains each step in detail.
> Note that the IMS Authorization (IMSA) service and Diameter Policy Control Application (DPCA) are part of Session Manager on the system and separated in the following figure for illustration purpose only.
> IMS Authorization Call Flow
> IMS Authorization Call flow Description

> Step | Description
> 1 | IMS subscriber (MN) sends request for primary bearer(A10) activation/creation.
> 2 | Session manager allocates IP address to MN.
> 3 | Session manager sends IMS authorization request to IMS authorization service (IMSA).
> 4 | IMSA creates a session with the PCRF on the basis of PCRF configuration.
> 5 | IMSA sends request to DPCA module to issue the authorization request to selected PCRF.
> 6 | DPCA sends a CCR-initial message to the selected PCRF. This message includes the IP address allocated to MN.
> 7 | CCA message sent to DPCA. If a preconfigured rule set for the bearer is provided in PCRF, it sends that charging rules to DPCA in CCA message.
> 8 | DPCA module calls the callback function registered with it by IMSA.
> 9 | After processing the charging rules, IMSA sends Policy Authorization Complete message to session manager.
> 10 | The rules received in CCA message are used for dynamic rule configuration structure and session manager sends the message to the ACS manager.
> 11 | ACS Manager installs the rules and performs credit authorization by sending CCR-Initial to Online Charging System (OCS) with CC-Request-Type set to INITIAL_REQUEST to open the credit control session. This request includes the active Rule base Id and 3GPP2 specific attributes (e.g. Subscriber, QoS etc.).
> 12 | OCS returns a CCA-Initial message to activate the statically configured rulebase and includes pre-emptive credit quotas.
> 13 | ACS manager responds to session manager with the response message for dynamic rule configuration.
> 14 | On the basis of response for the bearer authorization, session manager sends the response to the MN and activates/rejects the call.
> Note: Step 10 through 13 are not relevant to this release.

> ‌
> Ty Interface Support with HA
> IMS authorization support uses Mobile IP to manage session with HA. The Ty interface between HA and PCRF provides following functions:

> • | Local policy based authorization and bearer-level QoS negotiation

> • | Accounting co-ordination on a per flow basis, between bearer-level and application-level

> • | Flow control and filtering on the basis of subscriber profile

> • | Bearer resource allocation to the subscriber

> In HA service deployment, the HA matches the packets received against all the downlink/uplink PCC rules that configured by the PCRF for the subscriber, and applies the ‘gating policy’ and traffic policing to the flow on the basis of applicable PCC rule. It also applies the Authorized-QoS profile available in the PCC rule. After applying the gating policy and QoS profile, the HA tunnels the packet to the AGW for downlink traffic or applies routing function on the packet for uplink traffic flow.
> The following figure provides a high-level view of the IMS authorization process between a system and IMS components that is initiated by the MN. The following table explains each step in detail.
> IMS Authorization HA Call Flow
> IMS Authorization HA Call flow Description

> Step | Description
> 1 | FA forwards the Registration Request MIP_RRQ to the HA.
> 2 | HA performs AAA authentication for subscriber, if required.
> 3 | After authentication CCR-Session-Up is initiated by HA with PCRF.
> 4 | HA sends MIP-RRP message to FA.
> 5 | PCRF with CCA-Session-Up to HA.
> • | If the response is failure the call is rejected.
> • | If the response is succeeded the charging rule, if available for this response, is installed and session established.
> 6 | After a request for modification of an existing media flow is requested, the PCRF initiates an RAR request with a modified Authorized QoS for the specific media flow.
> 7 | HA updates the existing flows with new QoS, bandwidth, flow description, and gating parameters.
> 8 | HA responds to the PCRF with a RAA message.
> 9 | After the session MN wants to terminate the session and initiates the termination of session procedure. The FA sends an RRQ to HA initiating the termination of the Mobile IP tunnel.
> 10 | HA responds with an RRP message to the FA indicating successful completion of the termination procedure.
> 11 | HA generates a CC-Request-Session-Terminate message and sends to the PCRF.
> 12 | PCRF clears all the flows corresponding to the session and responds with a CC-Answer-Session-Terminate message to HA.
> 13 | HA clears all the flow information for the subscriber session.

> ‌
> Configuring IMS Authorization Service
> Use the following example to enable IMS authorization service for IMS subscriber in cdma2000 networks:
> configure
> context <name>
> ims-auth-service name <name>
> p-cscf discovery <option>
> end
> Notes:

> • | A maximum of 16 authorization services can be configured globally in a system. There is also a system limit for maximum number of total configured services.

> • | Define the P-CSCF discovery algorithm for either discovery or table options.

> • | Optional. Specify the trigger events to initiate re-authorization for a subscriber in IMS authorization service using the reauth-trigger command.

> Important: The trigger events specified are applicable on the events generated by the PCRF only.
> Configuring the Policy Control Settings

> 1. | Enter the Policy Control Configuration mode for authorization and policy control parameter in IMS authorization service by entering the following command:

> configure
> context <name>
> ims-auth-service name <name>
> policy-control
> diameter origin endpoint <endpoint_name>
> diameter dictionary <dictionary_type>
> failure-handling <handling_option>
> diameter host-select row-precedence <precedence_value>
> diameter host-select reselect subscriber-limit <subs_limit> time-interval <duration>
> end
> Notes:

> • | failure-handling specifies the handling of the failure of Enhanced-Policy Decision Function (E-PDF).

> • | diameter host-select adds or appends rows with primary and/or secondary host name to a Diameter host table with precedence.

> • | reselect subscriber-limit defines the pacing of the reselection or switching of the Enhanced-Policy Decision Function (E-PDF) after a change occurs in table configuration for an IMS Authorization Service.

> • | Optional. Define the method or algorithm to select Diameter host table by entering diameter host-select table { 1 | 2 } [ algorithm { ip-address-modulus | msisdn-modulus | round-robin } ]

> • | Repeat as needed to configure more IMS authorization services as required within the specified context.

> Important: A maximum of 16 authorization services can be configured globally in the system. There is also a system limit for maximum number of total configured services.
> Verifying your configuration

> Step 1 | Verify your configured parameters for IMS authorization service by entering the following command:

> show ims-authorization service name <name>
> Important: For more information on keywords/options of the show ims-authorization command, refer to the Executive Mode Commands chapter in Command Line Interface Reference.

> Step 2 | Save your configuration as described in Saving Your Configuration chapter.

> Step 3 | Proceed to Configuring IMS Authorization in cdma2000 Networks section to enable the IMS authorization in a core service and associate the configured IMS Authorization service to a subscriber within that context.

> Enabling IMS Authorization and QoS Profile
> This section describes the procedure to configure the QoS profile identifier for QoS mapping and associates an IMS authorization through Ty interface at the service level.
> This section also provides the configuration to associate an IMS authorization service functionality to a previously configured subscriber within the same context in cdma2000 networks.
> Configuring IMS Authorization in PDSN Service
> This section describes how to associate an IMS authorization service at the service level for all subscriber in that service and to create the QoS profile id for QoS mapping in cdma2000 networks.
> This procedure assumes that you are at the Context Configuration mode level in the same context as specified in Configuring IMS Authorization Service section and following prompt is appearing:
> config
> context <name>
> pdsn-service <pdsn_svc_name>
> qos-profile-id-mapping profile-id <id_num> <options>
> end
> Notes:

> • | You can configure qos-profile parameters to define description, downlink/uplink bandwidth, drop-rate, latency, and the maximum drop percentage.

> • | Repeat this configuration to add additional subscribers for IMS Authorization service.

> Verifying your configuration for the PDSN Service

> Step 1 | Verify the IMS authorization configuration for the PDSN service(s) by entering the following command:

> show dynamic-policy statistics pdsn-service <pdsn_svc_name>

> Step 2 | Save your configuration as described in Saving Your Configuration chapter.

> Configuring Policy Map and DSCP Marking for PDSN/HA Service
> This section describes how to configure the DSCP marking and policy map for subscribers configured in a destination context for IMS authorization.
> configure
> context <name>
> class-map name <class_name>
> match any
> exit
> policy-map name <policy_name>
> type template
> qos traffic-police committed <bps> peak <bps> burst-size <bytes> exceed-action <option>
> qos user-datagram dscp-marking <dscp_code>
> qos encaps-header dscp-marking
> class-map name <class_name>
> exit
> policy-group name <policy_group>
> end
> Notes:

> • | Save your configuration as described in Saving Your Configuration chapter.

> Applying IMS Authorization to a Subscriber
> This section describes how to associate an IMS authorization service with individual subscriber(s) in cdma2000 networks.
> This configuration example assumes that you are at the context configuration mode level of the same context as specified in the Configuring IMS Authorization Service section
> config
> context <name>
> subscriber name <subs_name>
> ims-auth-service <ims_auth_name>
> end
> Notes:

> • | Repeat this configuration example to configure additional subscribers for IMS Authorization service.

> Verifying the IMS Authorization configuration

> Step 1 | Verify the IMS authorization configuration for the subscriber(s)

> context <context_name>
> show subscribers ims-auth-service

> Step 2 | Save your configuration as described in Saving Your Configuration chapter.

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883