Cisco Wireless Security Gateway R4

Available Languages

Download Options

PDF (387.4 KB)
View with Adobe Reader on a variety of devices

Updated:October 2, 2013

Document ID:1518341677410518

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Product Overview

The Cisco ^® 7600 Wireless Security Gateway (WSG) is a highly scalable solution for securing Long Term Evolution (LTE) traffic, tunneling small cells and femtocells, Unlicensed Mobile Access (UMA) and Generic Access Networks (GANs), and third-generation (3G) and fourth-generation (4G) macro cell voice and data traffic over fixed broadband networks back to the mobile operator's core network.

The increase in 3G and 4G mobile wireless broadband usage is an indication of even more dramatic growth, which is expected to result from the introduction of High-Speed Packet Access (HSPA), Evolved High-Speed Packet Access (HSPA+), and LTE technologies. To meet the demand and deliver services that consume ever-higher levels of bandwidth at a cost level previously established by wireline operators, mobile wireless operators are evolving their networks to an open environment, where resources and assets can be shared. Today, many mobile wireless operators own and control the end-to-end network. This model is expected to continue, though it will be in combination with a deployment model using third-party and Internet service provider (ISP) networks to connect LTE evolved Node Bs (eNodeBs) to the IP networks.

In this network model, the S1-U and S1-C interconnection from the eNodeB to the Serving Gateway and Mobility Management Entity (MME), as well as the X2 interconnections between eNodeBs, are unprotected and, in many cases, will cross third-party and ISP networks. Cost benefits aside, it is essential for mobile wireless operators to secure these connections or risk exposing their eNodeB control (S1-C and X2-C) and subscriber traffic (S1-U and X2-U) to malicious actions. To prevent this exposure, operators need to use IP Security (IPsec) tunneling to promote secure connections between their eNodeBs and their IP networks.

Figure 1. Cisco 7600 WSG in LTE Service Provider Network

In a small cell or femtocell deployment, the Cisco 7600 WSG (Figure 1) uses IPsec to secure the connection between the mobile operator's core network and the Home Node B (3G femtocell access point) located at the subscriber's home. In this environment, the Cisco 7600 WSG provides greater security for trusted hosts (femtocell access points) when they communicate across an external untrusted broadband network, such as the Internet (Figure 2).

The Cisco 7600 WSG adheres to the latest 3rd Generation Partnership Project (3GPP) standards for secure remote access over untrusted networks. In addition to femtocell deployments, the Cisco 7600 WSG can also secure UMA and GAN traffic, where the subscriber has a UMA-capable mobile handset that communicates using a Wi-Fi access point over an untrusted network and back to the mobile operator's data center. In addition, this gateway can be deployed to secure 3G and 4G base stations that are connected to the mobile operator's network through a third-party's Carrier Ethernet service. The Cisco 7600 WSG plays an important role in cost-effectively securing backhaul networks for mobile operators, helping to reduce backhaul costs, which represent a significant part of their operating expenses (OpEx).

Figure 2. Cisco 7600 WSG in Femtocell Service Provider Network

The Cisco 7600 WSG is built on the Cisco Service and Application Module for IP (SAMI) for the Cisco 7600 Series Router. Each Cisco SAMI blade with Cisco 7600 WSG software can support up to 100,000 IPsec sessions using Internet Key Exchange (IKE) Version 1 or Version 2. IKEv2 has been specified by the 3GPP for use in UMA and GAN, femtocell and LTE applications. IKEv1 is available to support legacy solutions that have not migrated to IKEv2. An optimally configured Cisco 7613 Router with ten SAMI blades can support 1,000,000 IPsec sessions.

Cisco 7600 Series Routers

The Cisco 7600 Series Routers deliver robust, high-performance IP and Multiprotocol Label Switching (MPLS) features for a range of service provider edge applications. The physical interfaces supported on the Cisco 7600 Series platform include Fast Ethernet and Gigabit Ethernet, FlexWAN (ATM and Frame Relay), and the new line of Cisco shared port adapter (SPA) and SPA interface processor (SIP) line cards. Each Cisco 7600 Series router provides Layer 2 connectivity and Layer 3 routing services and can host a variety of specialized applications on the Cisco SAMI module (Figure 3).

Figure 3. Cisco 7600 Series Router with SAMI Blade

Applications

The Cisco 7600 WSG in a Femtocell Deployment

As the build-out of the mobile Internet accelerates, technology such as femtocells has moved to the forefront, as a way to cost-effectively scale mobile capacity to meet the expected 66-fold growth in mobile data traffic over the next few years. ^¹ The Cisco 7600 WSG will play a critical role in femtocell deployments. Figure 4 provides an example of how a Cisco 7600 WSG can be deployed.

Figure 4. Cisco 7600 WSG in an End-to-End Femtocell Architecture

Features and Benefits

Table 1. Cisco 7600 WSG Features


Feature	Description	Benefit
Standards compliance	• Complies with IETF RFCs	• Provides interoperability with other standards-compliant components
Authentication	• IPSec peer authentication with public key infrastructure (PKI) and Pre-Shared Key (PSK) • Secondary endpoint authentications with Extensible Authentication Protocol (EAP)	• Allows users to uniquely authenticate using X.509 certificate • Facilitates RADIUS-based authentication
Address allocation	• IP local pool and Dynamic Host Configuration Protocol (DHCP) support	• Increases flexibility of network design and address allocation • Uses local pools for user address assignments • Enhances end-node address management efficiency and reduces provisioning
IPsec and other services	• Support of IKEv1 and IKEv2 • Creation of IPsec Encapsulating Security Payloads (ESP) tunnels • Cryptographic algorithm negotiations • Packet encryption and decryption: AES/AES-CBC 128 bits, DES, and 3DES • Hash algorithms: MD5, SHA-1, SHA-2 (256, 384 and 512), and XCBC-AES • Diffie-Hellman Groups: 1 (768 bit), 2 (1024 bit), and 5 (1536 bit) • Rekeying, time and volume based • Traffic selector negotiations • Encryption and Diffie-Hellman Group Negotiations • Anti-replay • Preshared keys • Extended Sequence Number (ESN) • IKE Call Admission Control (CAC) mechanism • Support of X.509 certificates • CRL, CMPv2, and OCSP Certificate management protocol support • Blacklist • IPv6 • VRF • Reverse Route Injection (RRI)	• Protects data flow between Home Node B or eNodeB and Cisco 7600 WSG • Offers security services at IP level • Provides secure tunnel between Home Node B or eNodeB and Cisco 7600 WSG • Protects data confidentiality, integrity, and authentication
Dead peer detection (DPD)	• DPD for IKE transactions	• Facilitates faster failover
Redundancy and load balancing	• Active-active redundancy • 1+1 stateful inter- or intrachassis redundancy • N+1 inter- or intrachassis redundancy • ACE hardware module-based server load balancing • Server load balancing using Packet Based Routing (PBR) • IKEv2 redirect	• Enhances reliability • Improves service availability • Minimizes user disruption
Other features	• Path maximum transmission unit (MTU) Internet Control Message Protocol (ICMP) support • Secure Shell (SSH) with RADIUS • Reverse Domain Name System (DNS) lookup	• Avoids fragmentation • Provides more secure login • Displays DNS names for IPSec peer
Network Address Translation (NAT) traversal	• Support for an intermediate device performing NAT	• Allows the home or mobile node to be behind an NAT entity address • Offers increased flexibility for network design and address allocation
Quality of service (QoS)	• Correlation with inner-to-outer type of service (ToS) and differentiated services code point (DSCP) marking	• Supports the appropriate QoS and class of service (CoS) for application
Platform	• High-end based on Cisco 7600 Series and SAMI	• Complies with Network Equipment Building Standards (NEBS) 3 • Provides more flexible choices for better offerings • Provides the advantages of distributed, not centralized, platform • Offers feature-rich line card for 10 Gigabit Ethernet for 4G network needs
Scaling	• High throughput per application blade • Right subscriber density per blade for 3G and 4G nodes • Load-balancing mechanism	Supports: • Up to 270 tunnels per second • Up to 2.1 Gbps per blade for small packets - voice • Up to 9 Gbps per blade for large packets - data • Up to 72 Gbps per chassis • Up to 100,000 subs per blade • Up to 1,000,000 subs per chassis
Colocation of hardware and software	• Colocation of other wireless services in the same chassis; i.e., IP Radio Access Network (RAN) and other wireless gateways can coexist in the same chassis	• Facilitates use of existing Cisco 7600 platform • Provides a more competitive solution
Standard Cisco hardware and software platforms	• Multiple service modules (such as Cisco Application Control Engine [ACE], SAMI, and Firewall Service Module [FWSM]) can be integrated in the same chassis. • Cisco hardware platforms are proven in some of the largest networks in the world. • Cisco devices run with the standard Cisco IOS ^® Software feature set, which includes rich IP, security, mobile IP, and voice and data integration capabilities.	• Minimizes risk and speeds deployment of network • Helps accelerate time to market with advanced features

Configuration and Performance

Cisco 7600 Series with SAMI supports:

• Up to 100,000 Home Node Bs per Cisco 7600 WSG module in a femtocell deployment (up to 100,000 dual-mode phones in a UMA or GAN deployment)

• Up to 16,000 eNodeBs per Cisco 7600 WSG module in an LTE deployment (up to 160,000 per chassis)

• Up to ten Cisco SAMI blades with Cisco 7600 WSG can be installed in a Cisco 7613 Router.

• Up to 2.1 Gbps bandwidth per module for small packets-voice

• Up to 9 Gbps bandwidth per module for large packets-data

• Chassis throughput of 21 Gbps for voice and 72 Gbps for large packets

Cisco 7600 Series Platform Requirements

• All Cisco 7600 Series chassis are supported, including Cisco 7604, 7606, 7609, and 7613, with a minimum Cisco IOS Software release requirement of 12.2(33)SRC2.

• Supported supervisor engines include Cisco 7600 Series Supervisor Engine 720 and Route Switch Processor 720.

• Single or redundant supervisor engine configurations are permitted.

• There is no restriction on other cards (such as service and network modules) on the chassis.

Ordering Information

To place an order, visit the Cisco Ordering homepage, and refer to the information in Table 2, which lists the product numbers for the Cisco 7600 WSG right-to-use (RTU) licenses, subscriber licenses, and SAMI hardware. The software license provides for unlimited use of features in the release, with a defined number of connected subscribers, which may be limited by hardware resource capacity and traffic mix. The Cisco 7600 WSG subscriber license allows for increasing the number of connected subscribers in increments of 10,000 connected subscribers.

Table 2. Cisco 7600 WSG Ordering Information for Cisco 7600 Series


Product Number	Description
SAMI Module
WS-SVC-SAMI-BB-K9	Service Application Module for IP 6 x PPC w/ 1GB (Crypto)
WS-SVC-SAMI-BB-K9=	Service Application Module for IP 6 x PPC w/ 1GB Spare (Crypto)
MEM-SAMI-6P-2GB	SAMI 6xPPCs with 2GB per PPC Memory Option
MEM-SAMI-6P-2GB=	SAMI 6xPPCs with 2GB per PPC Memory Option
Software RTU Licenses^*
SSAS20K9-COSLI20	SAMI Wireless Security Gateway R2.0 RTU License
SSAS20K9-COSLI20=	SAMI Wireless Security Gateway R2.0 RTU License (Spare)
R-SSAS20K9-COSLI20=	SAMI Wireless Security Gateway R2.0 RTU License (eDelivery)
SSAS30K9-COSLI30	SAMI Wireless Security Gateway R3.0 RTU License
SSAS30K9-COSLI30=	SAMI Wireless Security Gateway R3.0 RTU License (Spare)
R-SSAS30K9-COSLI30=	SAMI Wireless Security Gateway R3.0 RTU License (eDelivery)
SSAS40K9-COSLI30	SAMI Wireless Security Gateway R4.0 RTU License
SSAS40K9-COSLI30	SAMI Wireless Security Gateway R4.0 RTU License (Spare)
R-SSAS40K9-COSLI30=	SAMI Wireless Security Gateway R4.0 RTU License (eDelivery)
Connected Tunnel Licenses, per Chassis
FL-SS-10K-SUB ^**	SAMI Wireless Security Gateway 10K connected tunnel feature license
FL-SS-10K-SUB=	SAMI Wireless Security Gateway 10K connected tunnel feature license (Spare)

^* One RTU license is required per software module.

^** No subscriber License is required for redundant software module.

Service and Support

Cisco offers a wide range of service programs to help accelerate your success. These innovative service programs are delivered through a unique combination of people, processes, tools, and partners. Cisco services help you protect your network investment, optimize network operations, and prepare your network for new applications that can extend network intelligence and the power of your business. For more information about Cisco Services, see Cisco Technical Support Services or Cisco Advanced Services.

For More Information

For additional information about the following Cisco products and services, please use the links provided.

Cisco Service and Application Module for IP (SAMI)
http://www.cisco.com/en/US/docs/wireless/service_application_module/sami/user/guide/samiv1.html

Cisco ACE Application Control Engine Solution for High Availability
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/prod_brochure0900aecd806cecc5.html

Cisco Firewall Services Module for Cisco Catalyst 6500 and Cisco 7600 Series
https://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps4452/product_data_sheet0900aecd803e69c3.html

Cisco AAA and Cisco Network Registrar ^® http://www.cisco.com/en/US/products/sw/netmgtsw/ps1982/tsd_products_support_series_home.html

Cisco 7600 Series Router
http://www.cisco.com/go/7600

Cisco Mobile Wireless Products and Solutions
http://www.cisco.com/go/mobile

Mobile Wireless Center for the Cisco Service Exchange Framework http://www.cisco.com/en/US/partner/products/hw/wireless/index.html or contact your Cisco account manager.

¹Source: Cisco Visual Networking Index - Forecast, 2008-2013.

Contact Cisco

Was this Document Helpful?

Feedback