The following table lists the information that is required to configure the Egress context and MAG (Mobile Access Gateway) service on the ePDG.

Note	ePDG can only be configured and associated either with MAG or EGTP and not both at a time.

The following table lists the information that is required to configure the Egress context and EGTP (Evolved GPRS Tunneling Protocol) service on the ePDG.

Note	ePDG can only be configured and associated either with MAG or EGTP and not both at a time.

Use the following configuration example to create a management interface, configure remote access capability, and set the default subscriber in the local context:

configure
      context local
           interface <mgmt_interface_name>
                ip address <ip_address> <subnet_mask>
                exit
           server ftpd
           ssh key <data> length <octets>
           ssh key <data> length <octets>
           ssh key <data> length <octets>
           server sshd
                subsystem sftpd
                exit
           server telnetd
                exit
           subscriber default
                exit
           administrator <name> encrypted password <password> ftp
           aaa group default
               exit
           gttp group default
                exit
           ip route 0.0.0.0 0.0.0.0 <gateway_ip_addr> <mgmt_interface_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           bind interface <mgmt_interface_name> local
           exit
      end

The server command configures remote server access protocols for the current context. The system automatically creates a default subscriber, a default AAA group, and a default GTTP group whenever a context is created. The ip route command in this example creates a default route for the management interface.

Use the following configuration example to create the ePDG context, the EAP profile, the IPSec and IKEv2 transform sets, the crypto template, the SWu, SWm, and DNS interfaces, the SWm and IPSec loopback interfaces, and the AAA group for Diameter authentication:

configure
      context <epdg_context_name>
           eap-profile <eap_profile_name>
                mode authenticator-pass-through
                exit
           ipsec transform-set <ipsec_tset_name>
                hmac aes-xcbc-96
                exit
           ikev2-ikesa transform-set <ikev2_ikesa_tset_name>
                hmac aes-xcbc-96
                prf aes-scbc-128
                exit
           crypto template <crypto_template_name> ikev2-dynamic
                authentication remote eap-profile <eap_profile_name>
                     exit
                ikev2-ikesa retransmission-timeout <milliseconds>
                ikev2-ikesa transform-set list <ikev2_ikesa_tset_name>
                ikev2-ikesa rekey
                payload <payload_name> match childsa match any
                ipsec transform-set list <ipsec_tset_name>
                     lifetime <seconds>
                     rekey keepalive
                     exit
                ikev2-ikesa keepalive-user-activity
                ikev2-ikesa policy error-notification
 ikev2-ikesa policy use-rfc5996-notification
                exit
           ip routing maximum-paths <max_num>
           interface <swu_interface_name>
                ip address <ip_address> <subnet_mask>
                exit
           interface <swm_interface_name>
                ip address <ip_address> <subnet_mask>
                exit
           interface <epdg_dns_interface_name>
                ip address <ip_address> <subnet_mask>
                exit
           interface <swu_loopback_interface_name> loopback
                ip address <ip_address> <subnet_mask>
                exit
           interface <swm_ipsec_loopback_interface_name> loopback
                ip address <ip_address> <subnet_mask>
                exit
           subscriber default
                aaa group <group_name>
                ip context-name <epdg_context_name>
                exit
           aaa group default
                exit
           aaa group <group_name>
                diameter authentication dictionary <aaa_custom_dictionary>
                diameter authentication endpoint <endpoint_name>
                diameter authentication max-retries <max_retries>
                diameter authentication max-transmissions <max_transmissions>
                diameter authentication request-timeout <request_timeout_duration>
                diameter authentication failure-handling eap-request request-timeout action terminate
                diameter authentication failure-handling eap-request result-code <start_result_code_1> to <end_result_code_1> action retry-and-terminate
                diameter authentication failure-handling eap-request result-code <start_result_code_2> to <end_result_code_2> action terminate
                diameter authentication server <host_name> priority <priority>
                exit
           gttp group default
           exit
      end

In this example, the EAP method is used for UE authentication. The eap-profile command creates the EAP profile to be used in the crypto template for the ePDG service. The mode authenticator-pass-through command specifies that the ePDG functions as an authenticator passthrough device, enabling an external EAP server to perform UE authentication.

The crypto template command and associated commands are used to define the cryptographic policy for the ePDG. You must create one crypto template per ePDG service. The ikev2-dynamic keyword in the crypto template command specifies that IKEv2 protocol is used. The authentication remote command specifies the EAP profile to use for authenticating the remote peer.

The rekey keepalive command enables Child SA (Security Association) rekeying so that a session will be rekeyed even when there has been no data exchanged since the last rekeying operation. The ikev2-ikesa keepalive-user-activity command resets the user inactivity timer when keepalive messages are received from the peer. The ikev2-ikesa policy error-notification command enables the ePDG to generate Error Notify messages for Invalid IKEv2 Exchange Message ID and Invalid IKEv2 Exchange Syntax for the IKE_SA_INIT exchange.

The ip routing maximum-paths command enables ECMP (Equal Cost Multiple Path) routing support and specifies the maximum number of ECMP paths that can be submitted by a routing protocol in the current context. The interface command creates each of the logical interfaces, and the associated ip address command specifies the IP address and subnet mask of each interface.

The aaa group command configures the AAA server group in the ePDG context and the diameter authentication commands specify the associated Diameter authentication settings.

The ikev2-ikesa policy use-rfc5996-notification command enables processing for new notification payloads added in RFC 5996, and is disabled by default.

Use the following configuration example to do the following:

configure
      context <epdg_context_name>
           epdg-service <epdg_service_name>
                plmn id mcc <code> mnc <code>

Note	If egtp service is used, we should have associate egtp-service <egtp service name> instead of mobile-access-gateway

                mobile-access-gateway context <egress_context_name> mag-service <mag_service_name>
                setup-timeout <seconds>
                fqdn <domain_name>
                bind address <ip_address> crypto-template <crypto_template_name>
                pgw-selection agent-info error-terminate
                dns-pgw selection topology weight
                exit
           ip route <ip_address/subnet mask> <ip_address/subnet mask> <gateway_ip_address> <mgmt_interface_name>
           ip domain-lookup
           ip name-servers <ip_address>
           diameter endpoint <endpoint_name>
                use-proxy
                origin host <host_name> address <ip_address> port <port_number>
                response-timeout <seconds>
                connection timeout <seconds>
                cea-timeout <seconds>
                dpa-timeout <seconds>
                connection retry-timeout <seconds>
                peer <peer_name> realm <realm_name> address <ip_address>
                route-entry peer <peer_id> weight <priority>
                exit
           dns-client <dns_client_name>
                bind address <ip_address>
                exit
           end

The ePDG context defaults to a MAG service configured in the same context unless the mobile-access-gateway command is used to specify the context where the MAG service will reside as shown above. The fqdn command configures the ePDG FQDN (Fully Qualified Domain Name) for longest suffix match during P-GW dynamic allocation. The IP address that you to the ePDG service above is used as the connection point for establishing the IKEv2 sessions between the WLAN UEs and the ePDG. The pgw-selection agent-info error-terminate command specifies the action to be taken during P-GW selection when the MIP6-agent-info parameter is expected but not received from the AAA server/HSS, which is to terminate P-GW selection and reject the call. The dns-pgw selection topology weight command enables P-GW load balancing based on both topology, in which the nearest P-GW to the subscriber is selected first, and weight, in which the P-GW is select based on a weighted average.

The ip route command in this example creates a route for the SWu interface between the WLAN UEs and the ePDG and specifies the destination IP addresses that will use this route. The ip domain-lookup command enables domain name lookup via DNS for the current context. The ip name-servers command specifies the IP address of the DNS that the ePDG context will use for logical host name resolution. The diameter endpoint command specifies the Diameter origin endpoint.

The origin host command specifies the origin host for the Diameter endpoint. The peer command specifies a peer address for the Diameter endpoint. The route-entry command creates an entry in the route table for the Diameter peer.

The dns-client command specifies the DNS client used during P-GW FQDN discovery.

Use the following configuration example to configure the Egress context, the MAG (Mobile Access Gateway) service, the S2b interface and S2b loopback interface to the P-GW, and bind all of the logical interfaces to the physical Ethernet ports.

configure
      context <egress_context_name>
           interface <s2b_interface_name>
                ipv6 address <ipv6_address>
                exit
           interface <s2b_loopback_interface_name>
                ipv6 address <ipv6_address>
                exit
           subscriber default
                exit
           aaa group default
                exit
           gtpp group default
                exit
           mag-service <mag_service_name>
                reg-lifetime <seconds>
                bind address <ipv6_address>
                exit
           ipv6 route <ipv6_address/prefix_length> next-hop <ipv6_address> interface <s2b_interface_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <swu_interface_name> <epdg_context_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <epdg_dns_interface_name> <epdg_context_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <swm_interface_name> <epdg_context_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <s2b_interface_name> <egress_context_name>
           exit
      end

The mag-service command creates the MAG (Mobile Access Gateway) service that communicates with the LMA (Local Mobility Anchor) service on the P-GW to provide network-based mobility management. The ipv6 route command configures a static IPv6 route to the next-hop router. In this configuration, it configures a static route from the ePDG to the P-GW over the S2b interface. The bind interface command binds each logical interface to a physical Ethernet port.

Use the following configuration example to configure thegress context, the EGTP (Evolved GPRS Tunnel Protocal) service, the S2b interface and S2b loopback interface to the P-GW, and bind all of the logical interfaces to the physical Ethernet ports.

configure
      context <egress_context_name>
           interface <s2b_interface_name>
                ipv4/ipv6 address <ipv6_address>
                exit
           interface <s2b_loopback_interface_name>
                ipv4/ipv6 address <ipv6_address>
                exit
           subscriber default
                exit
           aaa group default
                exit
           gtpp group default
                exit
           gtpu-service <gtpu-service-name>
                reg-lifetime <seconds>
                bind ipv4/ipv6-address <s2bloopbackipv4/ipv6_address>
                exit
           egtp-service egtp-epdg-egress
           interface-type interface-epdg-egress
            associate gtpu-service gtpu-epdg-egress
                exit
           ipv4/ipv6 route <ipv4/ipv6_address/prefix_length> next-hop <ip4/ipv6_address> interface <s2b_interface_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <swu_interface_name> <epdg_context_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <epdg_dns_interface_name> <epdg_context_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <swm_interface_name> <epdg_context_name>
           exit
      port ethernet <slot_number/port_number>
           no shutdown
           vlan <tag>
           bind interface <s2b_interface_name> <egress_context_name>
           exit
      end

The egtp-service command creates the eGTP (evolved GPRS Tunneling Protocol) service that communicates with the LMA (Local Mobility Anchor) service on the P-GW to provide network-based mobility management. The ipv6 route command configures a static IPv6 route to the next-hop router. In this configuration, it configures a static route from the ePDG to the P-GW over the S2b interface. The bind interface command binds each logical interface to a physical Ethernet port.

For additional information on how to verify and save configuration files, see the System Administration Guide and the eHRPD/LTE Command Line Interface Reference.