ASR5x00 Series: IP Allocation Failure Upon PDP Request Creation

Introduction

This document describes an IP address allocation failure that happens due to an unknown Packet Data Protocol (PDP) Type or PDP Type errors in GTP_CREATE_PDP_RESPONSE. This problem is reported on Cisco Aggregation Services Router (ASR) 5x00 Series that works as a Gateway GPRS Support Node (GGSN).

Problem

The User Equipment (UE) requests a static IP address <x.x.x.x>.

The user has static IP address allocation from Home Location Register (HLR)/Home Subscriber Server (HSS) for a particular Access Point Name (APN), so the end user is not supposed to be allocated with an IP address dynamically from GGSN.

This error was observed from the monitor subscriber which resulted in failure of the establishing session:

#Monitor subscriber Imsi  <> (enable options x, a, y, verbosity 4)

----------------------------------------------------------------------
Incoming Call:
----------------------------------------------------------------------
MSID/IMSI : <>                    Callid : <>
IMEI : <>                         MSISDN : <>
Username : <>                     SessionType : ggsn-pdp-type-ipv4
Status : Active                   Service Name: GGSN_SVC
Src Context : <>
----------------------------------------------------------------------

INBOUND>>>>> 21:50:38:497 Eventid:47000(3)
GTPC Rx PDU, from <IP>:34273 to <IP>:2123 (213)
TEID: 0x00000000, Message type: GTP_CREATE_PDP_CONTEXT_REQ_MSG 
 (0x10) >>>1st Create PDP Request
Sequence Number:: 0x7B16 (31510)


<<<<OUTBOUND 21:50:38:501 Eventid:47001(3)
GTPC Tx PDU, from <IP>:2123 to <IP>:34273 (103)
TEID:0x179E3645, Message type: GTP_CREATE_PDP_CONTEXT_RES_MSG 
 (0x11) >>>1st Create PDP Response
Sequence Number:: 0x7B16 (31510)

----------------------------------------------------------------------
(Switching Trace) - New Incoming Call:
----------------------------------------------------------------------
MSID/IMSI : <>                    Callid : <>
IMEI : <>                         MSISDN : <>
Username : <>                     SessionType : ggsn-pdp-type-ipv4
Status : Active                   Service Name: GGSN_SVC
Src Context : <>
----------------------------------------------------------------------

INBOUND>>>>> 21:50:41:346 Eventid:47000(3)
GTPC Rx PDU, from <IP>:34273 to <IP>:2123 (213)
TEID: 0x00000000, Message type: GTP_CREATE_PDP_CONTEXT_REQ_MSG
 (0x10) >>>2nd PDP Request
Sequence Number:: 0x7B20 (31520)


***CONTROL*** 21:50:41:360 Eventid:10083
Sessmgr-80 Failed to allocate static IPv4 address <IP> mask 0xffffffff poolname
 <Pool_name> for call (errcode=VPN_MSG_STATUS_DUPLICATE_INSTANCE)

<<<<OUTBOUND 21:50:41:363 Eventid:47001(3)
GTPC Tx PDU, from <IP>:2123 to <IP>:34273 (103)
TEID: 0x179E36C5, Message type: GTP_CREATE_PDP_CONTEXT_RES_MSG
 (0x11) >>>2nd PDP Response
Sequence Number:: 0x7B20 (31520)


INBOUND>>>>> 21:58:04:155 Eventid:47000(3)
GTPC Rx PDU, from <IP>:34273 to <IP>:2123 (16)
TEID: 0x9D052050, Message type: GTP_DELETE_PDP_CONTEXT_REQ_MSG (0x14)
Sequence Number:: 0x801F (32799)


<<<<OUTBOUND 21:58:04:156 Eventid:47001(3)
GTPC Tx PDU, from <IP>:2123 to <IP>:34273 (14)
TEID: 0x179E36C5, Message type: GTP_DELETE_PDP_CONTEXT_RES_MSG (0x15)
Sequence Number:: 0x801F (32799)

 

***CONTROL*** 21:58:04:170 Eventid:10285
CALL STATS: msisdn <>, apn <apn_name>, imsi <>, Call-Duration(sec): 443
input pkts: 7                                 output pkts: 19
input bytes: 301                              output bytes: 928
input bytes dropped: 0                        output bytes dropped: 0
input pkts dropped: 0                         output pkts dropped: 0
pk rate from user(bps): 0                     pk rate to user(bps): 53
ave rate from user(bps): 0                    ave rate to user(bps): 26
sust rate from user(bps): 0                   sust rate to user(bps): 27
pk rate from user(pps): 0                     pk rate to user(pps): 0
ave rate from user(pps): 0                    ave rate to user(pps): 0
sust rate from user(pps): 0                   sust rate to user(pps): 0
link online/active percent: 100
ipv4 bad hdr: 0                               ipv4 ttl exceeded: 0
ipv4 fragments sent: 0                        ipv4 could not fragment: 0
ipv4 input acl drop: 0                        ipv4 output acl drop: 0
ipv4 bad length trim: 0
ipv4 input non-mip drop: 0                    ipv4 output non-mip drop: 0
ipv4 input css drop: 0                        ipv4 output css drop: 0
output gre xoff pkts drop: 0                  output gre xoff bytes drop: 0
ipv4 output no-flow drop: 0
ipv4 source violations: 0                     ipv4 early pdu drop: 0
ipv4 proxy-dns redirect: 0                    ipv4 proxy-dns pass-thru: 0
ipv4 proxy-dns drop: 0                        ipv4 proxy-dns redirect tcp connection: 0
ipv6 bad hdr: 0                               ipv6 bad length trim: 0
ip source violation no acct: 0                ip source violation ignored: 0
dlnk pkts exceeded bw: 0                      dlnk pkts violated bw: 0
uplnk pkts exceeded bw: 0                     uplnk pkts violated bw: 0
Disconnect Reason: Remote-disconnect
Last Progress State: PDP-Type-IPv4-Connected

When the error "Failed to allocate static IPv4 address <x.x.x.x> mask 0xffffffff poolname <pool_name > for call (errcode=VPN_MSG_STATUS_DUPLICATE_INSTANCE)" occurred and the session creation failed, there was no  Mobile Station (MS)/UE allocated with same IP address. This was verified with the show subscribers ip-address <x.x.x.x> command.

[local]ASR5x00#show subscribers ip-address <x.x.x.x>
         No subscribers match the specified criteria

For every successful create PDP for the same user, the output of the show subscriber ip-address <x.x.x.x> command shows that the IP x.x.x.x was mapped with same International Mobile Subscriber Identity (IMSI).

[local]ASR5x00# show subscribers ip-address <x.x.x.x>

Sunday October 12 21:51:36 PDT 2014

+-----Access  (S) - pdsn-simple-ip     (M) - pdsn-mobile-ip  (H) - ha-mobile-ip

|     Type:   (P) - ggsn-pdp-type-ppp  (h) - ha-ipsec        (N) - lns-l2tp

|             (I) - ggsn-pdp-type-ipv4 (A) - asngw-simple-ip (G) - IPSG

|             (V) - ggsn-pdp-type-ipv6 (B) - asngw-mobile-ip (C) - cscf-sip

|             (z) - ggsn-pdp-type-ipv4v6

|             (R) - sgw-gtp-ipv4       (O) - sgw-gtp-ipv6    (Q) - sgw-gtp-ipv4-ipv6

|             (W) - pgw-gtp-ipv4       (Y) - pgw-gtp-ipv6    (Z) - pgw-gtp-ipv4-ipv6

|             (@) - saegw-gtp-ipv4     (#) - saegw-gtp-ipv6  ($) - saegw-gtp-ipv4-ipv6

|             (p) - sgsn-pdp-type-ppp  (s) - sgsn            (4) - sgsn-pdp-type-ip

|             (6) - sgsn-pdp-type-ipv6 (2) - sgsn-pdp-type-ipv4-ipv6

|             (L) - pdif-simple-ip     (K) - pdif-mobile-ip  (o) - femto-ip

|             (F) - standalone-fa      (J) - asngw-non-anchor

|             (e) - ggsn-mbms-ue       (i) - asnpc           (U) - pdg-ipsec-ipv4

|             (E) - ha-mobile-ipv6     (T) - pdg-ssl         (v) - pdg-ipsec-ipv6

|             (f) - hnbgw-hnb          (g) - hnbgw-iu        (x) - s1-mme

|             (a) - phsgw-simple-ip    (b) - phsgw-mobile-ip (y) - asngw-auth-only

|             (j) - phsgw-non-anchor   (c) - phspc           (k) - PCC

|             (X) - HSGW               (n) - ePDG            (t) - henbgw-ue

|             (m) - henbgw-sg

|             (D) - bng-simple-ip      (l) - pgw-pmip        (u) - Unknown

|

|+----Access  (X) - CDMA 1xRTT         (E) - GPRS GERAN      (I) - IP

||    Tech:   (D) - CDMA EV-DO         (U) - WCDMA UTRAN     (W) - Wireless LAN

||            (A) - CDMA EV-DO REVA    (G) - GPRS Other      (M) - WiMax

||            (C) - CDMA Other         (N) - GAN             (O) - Femto IPSec

||            (P) - PDIF               (S) - HSPA            (L) - eHRPD

||            (T) - eUTRAN             (B) - PPPoE           (F) - FEMTO UTRAN

||            (H) - PHS                (.) - Other/Unknown

||

||+---Call    (C) - Connected          (c) - Connecting

|||   State:  (d) - Disconnecting      (u) - Unknown

|||           (r) - CSCF-Registering   (R) - CSCF-Registered

|||           (U) - CSCF-Unregistered

|||

|||+--Access  (A) - Attached           (N) - Not Attached

||||  CSCF    (.) - Not Applicable

||||  Status:

||||

||||+-Link    (A) - Online/Active      (D) - Dormant/Idle

||||| Status:

|||||

|||||+Network (I) - IP                 (M) - Mobile-IP         (L) - L2TP

||||||Type:   (P) - Proxy-Mobile-IP    (i) - IP-in-IP          (G) - GRE

||||||        (V) - IPv6-in-IPv4       (S) - IPSEC             (C) - GTP

||||||        (A) - R4 (IP-GRE)        (T) - IPv6              (u) - Unknown

||||||        (W) - PMIPv6(IPv4)       (Y) - PMIPv6(IPv4+IPv6) (R) - IPv4+IPv6

||||||        (v) - PMIPv6(IPv6)

||||||

||||||

vvvvvv CALLID    MSID            USERNAME               IP                   TIME-IDLE

------ -------- --------------- ---------------------- --------------------  ---------

IECNAI   <>       <>             name@apn_name          x.x.x.x              00h00m57s

From the traces it was observed that there was a very short time (~20ms) between the deletion and creation of the PDP. This is why the gateway rejected the PDP with the error code VPN_MSG_STATUS_DUPLICATE_INSTANCE.

Initial APN Configuration

apn apn_name

      bearer-control-mode mixed

      selection-mode subscribed sent-by-ms chosen-by-sgsn

      accounting-mode none

      gtpp group CGF1 accounting-context <context_name>

      gtpp group CGF2 accounting-context <context_name>

      gtpp group CGF3 accounting-context <context_name>

      gtpp group CGF4 accounting-context <context_name>

      idle-timeout-activity ignore-downlink

      apn-ambr rate-limit direction downlink burst-size auto-readjust
 duration  1 violate-action drop

      apn-ambr rate-limit direction uplink burst-size auto-readjust
 duration  1 violate-action drop

      ims-auth-service <service name>

      timeout idle 14400

      ip access-group onegas.com in

      ip access-group onegas.com out

      ip source-violation check drop-limit 0

      ip context-name <context name>

      ip address pool name <pool name>

      active-charging rulebase <Rulebase>

    exit

One thought is to reduce the address-hold-timer, but the concept of "address-hold-timer" is applicable only for Dynamic IP address allocation and not for static allocation.

This was checked in the lab also:

[Gi](config-ctx)#

   ip pool SIMPLE-POOL a.b.c.d 255.255.0.0 static address-hold-timer 100

Failure: Hold timer can not be configured for this pool 

Note: When the "address-hold-timer" is enabled and an active subscriber is disconnected, the IP address is held or considered still in use and is not returned to the free state until the address-hold-timer expires. This enables subscribers who reconnect within the length of time specified (in seconds) to obtain the same IP address from the IP pool.

Root Cause

When there is a small time gap between the Delete PDP Request (DPR) and the Create PDP Request (CPR) for the same IMSI, the Radius Server returns the same static address.

When DPR is received by the ASR 5x00 it processes the DPR and accepts a new CPR, but meanwhile it still holds the static IP address and takes some time (250ms) for the vpnmgr to release/flush the address. Since the new CPR comes before this flush completes, the ASR 5x00 rejects the new CPR.

In this case, the time gap between deletion of the PDP and creation of the PDP is very small.

In the packet capture diagram, you can see that the time gap (shown in the red block) between delete PDP and create PDP is very small.

You should expect a delay of 250 ms between deletion and creation for the IP address allocation for the same address to be successful.

This is the design requirement for the distributed architecture. See the workaround in the Solution section in order to avoid any impact for the static address allocation.

Solution

See this configuration workaround applied on the gateway.

 config   

    context <>  

       ggsn-service <>   

           newcall duplicate-subscriber-requested-address accept  

  exit 

This command enables or disables new call connections, when the UE is not able to gracefully disconnect from the enterprise Packet Data Network (PDN) before it attempts to reconnect via another access method. When enabled, this command tears down the old session in order to accept the new connection with the same IP address assignment.

This command also allows the GGSN to accept a request for a static subscriber address, even if the address is already used by another session. If this feature is not enabled, a new request with the same IP address for another session will be rejected.

Revision History