本文档介绍在Cisco SMF和UPF网络元素中配置虚拟DNN/APN的步骤。
在3GPP 5G架构中,数据网络名称(DNN)是4G/LTE中接入点名称(APN)的5G等效名称。标识建立PDU会话的数据网络。在标准部署中,单个DNN统一用于会话管理所涉及的所有网络功能(NF),包括统一数据管理(UDM)、AMF、SMF、CHF、UPF、RADIUS和PCF。
虚拟DNN允许网络向特定网络功能呈现不同的DNN身份,同时使用基本DNN与其他网络功能进行用户交互。这样可以实现计费区分、选择性策略实施和服务分离,而无需单独物理基础设施或在UDM中修改用户订用数据。
本文档提供了以下方面的技术解决方案:
支持的部署模式:
| 型号 |
描述 |
实例 |
|---|---|---|
| 异地复制SMF |
两个SMF站点成对以实现冗余。更改同时应用于两个站点。 |
每个SMF 2个实例(_inst1、_inst2) |
| 独立SMF |
单个SMF,无地域复制。 |
1个实例(仅限_inst1) |
支持的实施方法:
| 方法 |
描述 |
|---|---|
| NSO MoP自动化 |
使用MoP自动化负载通过思科NSO RESTful API部署配置 |
| 直接CLI |
配置直接应用于SMF/UPF CLI |
在标准5G核心部署中,当UE启动具有特定DNN的PDU会话时,该相同的DNN身份将发送到会话生命周期中涉及的所有网络功能 — UDM、CHF、UPF、RADIUS和PCF。这会带来特定挑战。
如果没有虚拟DNN功能,运营商需要:
虚拟DNN功能通过允许对各个网络功能进行选择性DNN身份表示来解决这些问题。关键机制是:
虚拟DNN — 网络功能交互行为SMF将基本DNN(从AMF接收)解析为虚拟DNN的过程如下:
SMF Base DNN到虚拟DNN解析流
高级步骤:
| 选项 |
NF列表 |
PCF交互 |
RADIUS身份验证 |
使用案例 |
|---|---|---|---|---|
| 选项A |
[ chf upf radius ] |
禁用 |
启用 |
UDM使用基本DNN;无PCF已启用RADIUS |
| 选项B |
[ chf udm upf pcf ] |
启用 |
禁用 |
无RADIUS身份验证;已启用PCF |
| 选项C |
[ chf upf ] |
禁用 |
禁用 |
最小NF交互(仅限CHF + UPF) |
注意:根据需要更改配置。
| 会话类型 |
SMF配置 |
UPF pdp-type |
|---|---|---|
| 仅IPv4 |
会话类型IPV4 |
pdp类型ipv4 |
| 仅IPv6 |
会话类型IPV6 |
pdp类型ipv6 |
| IPv4v6(双堆栈) |
会话类型IPV4V6 |
pdp类型ipv4 ipv6 |
方法1. SMF上的直接CLI
在所有目标SMF上执行(同时执行两个地理复制站点)。
在policy subscriber polsub中添加优先级条目以将用户(按SUPI范围、国家/地区代码和实例)映射到虚拟DNN运营商策略。
config policy subscriber polsub precedence 1 supi-start-range <SUPI-START> supi-stop-range <SUPI-STOP> cc-start-range <CC-VALUE> cc-stop-range <CC-VALUE> instance-start-range 1 instance-stop-range 1 operator-policy oppol_<VDNN>_inst1 exit precedence 2 supi-start-range <SUPI-START> supi-stop-range <SUPI-STOP> cc-start-range <CC-VALUE> cc-stop-range <CC-VALUE> instance-start-range 2 instance-stop-range 2 operator-policy oppol_<VDNN>_inst2 exit exit
为每个实例创建运营商策略,指向虚拟DNN策略DNN。
config policy operator oppol_<VDNN>_inst1 policy dnn poldnn_<VDNN>_inst1 exit policy operator oppol_<VDNN>_inst2 policy dnn poldnn_<VDNN>_inst2 exit
此处定义虚拟DNN替换。传入的基本DNN(来自AMF)映射到虚拟DNN配置文件。
config policy dnn poldnn_<VDNN>_inst1 dnn <BASE-DNN-NAME> profile dnnprof-<VDNN>_inst1 exit policy dnn poldnn_<VDNN>_inst2 dnn <BASE-DNN-NAME> profile dnnprof-<VDNN>_inst2 exit
DNN配置文件定义虚拟DNN名称、NF列表(NF接收虚拟DNN)、RMGR标记(共享资源链接)和其他会话参数。
config profile dnn dnnprof-<VDNN>_inst1 dns primary ipv4 <PRIMARY-DNS-IP> dns secondary ipv4 <SECONDARY-DNS-IP> network-element-profiles chf <CHF-PROFILE> network-element-profiles amf <AMF-PROFILE> network-element-profiles udm <UDM-PROFILE> network-element-profiles scp <SCP-PROFILE> dnn <VIRTUAL-DNN-NAME> network-function-list [ chf radius upf ] dnn rmgr <RMGR-TAG>_1 timeout up-idle <UP-IDLE-TIMEOUT> cp-idle <CP-IDLE-TIMEOUT> charging-profile <CHARGING-PROFILE> wps-profile <WPS-PROFILE> ssc-mode 1 allowed [ 2 ] session type <SESSION-TYPE> upf apn <VIRTUAL-DNN-NAME> qos-profile <QOS-PROFILE> authentication secondary radius group <RADIUS-GROUP> authentication algorithm pap 1 always-on false dcnr true pcf-interaction false userplane-inactivity-timer <INACTIVITY-TIMER> only-nr-capable-ue false eventmgmt-policy <EVENT-POLICY> exit profile dnn dnnprof-<VDNN>_inst2 dns primary ipv4 <PRIMARY-DNS-IP> dns secondary ipv4 <SECONDARY-DNS-IP> network-element-profiles chf <CHF-PROFILE> network-element-profiles amf <AMF-PROFILE> network-element-profiles udm <UDM-PROFILE> network-element-profiles scp <SCP-PROFILE> dnn <VIRTUAL-DNN-NAME> network-function-list [ chf radius upf ] dnn rmgr <RMGR-TAG>_2 timeout up-idle <UP-IDLE-TIMEOUT> cp-idle <CP-IDLE-TIMEOUT> charging-profile <CHARGING-PROFILE> wps-profile <WPS-PROFILE> ssc-mode 1 allowed [ 2 ] session type <SESSION-TYPE> upf apn <VIRTUAL-DNN-NAME> qos-profile <QOS-PROFILE> authentication secondary radius group <RADIUS-GROUP> authentication algorithm pap 1 always-on false dcnr true pcf-interaction false userplane-inactivity-timer <INACTIVITY-TIMER> only-nr-capable-ue false eventmgmt-policy <EVENT-POLICY> exit
apn <VIRTUAL-DNN-NAME>
gtpp group gtpp_group
active-charging rulebase rulebase-mobility
exit
方法 2:NSO MoP自动化
配置文件:virtual_dnn_new_optionA.cfg
路径:/var/opt/ncs/mops
(文件内容与之前的CLI相同)
NSO负载(异地复制 — 两个站点):
POST: http://<NSO-SERVER>:8080/restconf/operations/mop-mop:action/mop-automation
{
"mop-automation": {
"mop-file-name": [
{
"file-name": "virtual_dnn_new_optionA.cfg",
"order": 1,
"target-devices-list": [
{ "target-device-name": "<SMF-NODE-SITE-A>" },
{ "target-device-name": "<SMF-NODE-SITE-B>" }
]
}
],
"operation-type": "dry-run"
}
}
警告:首先使用'operation-type:dry-run',以验证增量配置。验证后,请更改为“operation-type:commit'以应用。
在SMF上提交新的虚拟DNN配置文件后:
show system status show running-status info | nomore show running-config profile dnn <VIRTUAL-DNN-PROFILE-INST1> show running-config profile dnn <VIRTUAL-DNN-PROFILE-INST2>
确认:系统状态为100%,无BGP或CDL Pod重新启动。
在两个站点上为虚拟DNN提供服务的所有UPF上添加虚拟DNN APN配置。
仅适用于IPV4:
config
context <UPF-CONTEXT>
apn <VIRTUAL-DNN-NAME>
pdp-type ipv4
selection-mode subscribed sent-by-ms chosen-by-sgsn
gtpp group <GTPP-GROUP>
ip access-group <IPV4-ACL-NAME> in
ip source-violation ignore
ip context-name <UPF-CONTEXT>
active-charging rulebase <RULEBASE-NAME>
exit
exit
end
仅适用于IPV6:
config
context <UPF-CONTEXT>
apn <VIRTUAL-DNN-NAME>
pdp-type ipv6
selection-mode subscribed sent-by-ms chosen-by-sgsn
gtpp group <GTPP-GROUP>
ipv6 access-group <IPV6-ACL-NAME> in
ip source-violation ignore
ip context-name <UPF-CONTEXT>
active-charging rulebase <RULEBASE-NAME>
exit
exit
end
对于IPV4V6(双堆栈):
config
context <UPF-CONTEXT>
apn <VIRTUAL-DNN-NAME>
pdp-type ipv4 ipv6
selection-mode subscribed sent-by-ms chosen-by-sgsn
gtpp group <GTPP-GROUP>
ip access-group <IPV4-ACL-NAME> in
ip source-violation ignore
ip context-name <UPF-CONTEXT>
ipv6 access-group <IPV6-ACL-NAME> in
active-charging rulebase <RULEBASE-NAME>
exit
exit
end
NSO MoP自动化(UPF):
配置文件:virtual_dnn_upf_new.cfg
路径:/var/opt/ncs/mops
POST: http://<NSO-SERVER>:8080/restconf/operations/mop-mop:action/mop-automation
{
"mop-automation": {
"mop-file-name": [
{
"file-name": "virtual_dnn_upf_new.cfg",
"order": 1,
"target-devices-list": [
{ "target-device-name": "<UPF-NODE-SITE-A-1>" },
{ "target-device-name": "<UPF-NODE-SITE-A-2>" },
{ "target-device-name": "<UPF-NODE-SITE-A-3>" },
{ "target-device-name": "<UPF-NODE-SITE-A-4>" },
{ "target-device-name": "<UPF-NODE-SITE-B-1>" },
{ "target-device-name": "<UPF-NODE-SITE-B-2>" },
{ "target-device-name": "<UPF-NODE-SITE-B-3>" },
{ "target-device-name": "<UPF-NODE-SITE-B-4>" }
]
}
],
"operation-type": "dry-run"
}
}
show configuration context <UPF-CONTEXT> apn <VIRTUAL-DNN-NAME> show system status show session summary
在所有UPF上成功配置后,保存配置以在重新启动后保持不变。在每个UPF上执行:
show boot show dir /flash show dir /sftp cp /flash/<PRODUCTION-CONFIG>.cfg /sftp/<PRODUCTION-CONFIG>_Backup-<DATE>.cfg save configuration /flash/<PRODUCTION-CONFIG>.cfg -noconfirm
当SMF上已存在虚拟DNN且您需要修改其配置(例如,更改NF列表、禁用/启用PCF交互、更改RADIUS设置)时,请使用此部分。
高级步骤:
目的:在应用配置更改时防止在虚拟DNN上建立新的PDU会话。现有会话不受影响。
方法1. SMF上的直接CLI
在所有目标SMF上执行:
config profile dnn <VIRTUAL-DNN-PROFILE-INST1> mode offline exit profile dnn <VIRTUAL-DNN-PROFILE-INST2> mode offline exit show config diff | nomore commit
方法2. NSO MoP自动化
配置文件:virtual_dnn_offline.cfg
路径:/var/opt/ncs/mops
POST: http://<NSO-SERVER>:8080/restconf/operations/mop-mop:action/mop-automation
{
"mop-automation": {
"mop-file-name": [
{
"file-name": "virtual_dnn_offline.cfg",
"order": 1,
"target-devices-list": [
{ "target-device-name": "<SMF-NODE-SITE-A>" },
{ "target-device-name": "<SMF-NODE-SITE-B>" }
]
}
],
"operation-type": "dry-run"
}
}
警告:首先使用'operation-type:dry-run'以便验证。然后更改为“operation-type:commit”才能应用。
步骤后验证:
show system status show running-status info | nomore
系统状态必须保持为100%。BGP或CDL Pod不会重新启动,也不会对现有呼叫造成影响。
场景1.从NF列表中删除UDM并禁用PCF交互
目的:虚拟DNN仅发送到CHF、UPF和RADIUS。UDM使用基本DNN。已禁用PCF。
直接CLI:
config profile dnn <VIRTUAL-DNN-PROFILE-INST1> no mode offline dnn <VIRTUAL-DNN-NAME> network-function-list [ chf upf radius ] pcf-interaction false exit profile dnn <VIRTUAL-DNN-PROFILE-INST2> no mode offline dnn <VIRTUAL-DNN-NAME> network-function-list [ chf upf radius ] pcf-interaction false exit show config diff | nomore commit
NSO MoP自动化:
配置文件:virtual_dnn_modify_no_udm_no_pcf.cfg
POST: http://<NSO-SERVER>:8080/restconf/operations/mop-mop:action/mop-automation
{
"mop-automation": {
"mop-file-name": [
{
"file-name": "virtual_dnn_modify_no_udm_no_pcf.cfg",
"order": 1,
"target-devices-list": [
{ "target-device-name": "<SMF-NODE-SITE-A>" },
{ "target-device-name": "<SMF-NODE-SITE-B>" }
]
}
],
"operation-type": "dry-run"
}
}
预期的修改后配置:
profile dnn <VIRTUAL-DNN-PROFILE-INST1> dns primary ipv4 <PRIMARY-DNS-IP> dns secondary ipv4 <SECONDARY-DNS-IP> network-element-profiles chf <CHF-PROFILE> network-element-profiles amf <AMF-PROFILE> network-element-profiles udm <UDM-PROFILE> network-element-profiles scp <SCP-PROFILE> dnn <VIRTUAL-DNN-NAME> network-function-list [ chf upf radius ] dnn rmgr <BASE-DNN-RMGR-INST1> timeout up-idle <UP-IDLE-TIMEOUT> cp-idle <CP-IDLE-TIMEOUT> charging-profile <CHARGING-PROFILE> wps-profile <WPS-PROFILE> ssc-mode 1 allowed [ 2 ] session type <SESSION-TYPE> upf apn <VIRTUAL-DNN-NAME> qos-profile <QOS-PROFILE> authentication secondary radius group <RADIUS-GROUP> authentication algorithm pap 1 always-on false dcnr true pcf-interaction false userplane-inactivity-timer <INACTIVITY-TIMER> only-nr-capable-ue false eventmgmt-policy <EVENT-POLICY> exit
show system status show running-status info | nomore show running-config profile dnn <VIRTUAL-DNN-PROFILE-INST1> show running-config profile dnn <VIRTUAL-DNN-PROFILE-INST2>
确认:系统状态为100%,没有BGP或CDL Pod重新启动,对现有呼叫没有影响。
在SMF CLI上启动监控器用户:
monitor subscriber supi imsi-<TEST-IMSI>
跟踪中的预期行为:
| 检查点 |
预期结果 |
|---|---|
| PDU会话建立请求 |
DNN =从AMF接收的<Base-DNN-NAME> |
| UDM交互(Nudm_SDM) |
发送到UDM的DNN =基本DNN(通过dnn rmgr) |
| CHF交互(Nchf_ConvergedCharging) |
发送到CHF的DNN = <VIRTUAL-DNN-NAME> |
| UPF(PFCP会话建立) |
APN = <VIRTUAL-DNS-NAME> |
| RADIUS Access-Request(如果已启用) |
Called-Station-Id = <VIRTUAL-DNS-NAME> |
| PCF交互(Npcf_SMPolicyControl)(如果启用) |
DNN = <VIRTUAL-DNN-NAME> |
| PCF交互(如果禁用) |
跟踪中没有pcf消息 |
| PDU会话建立接受 |
会话已成功建立 |
| IP地址分配 |
从正确池分配的有效IP |
监控器用户输出示例(关键字段):
--- PDU Session Establishment Request --- DNN: <VIRTUAL-DNN-NAME> S-NSSAI: SST=1, SD=<SD-VALUE> PDU Session Type: <SESSION-TYPE> --- Nudm_SDM (Subscription Data) --- DNN: <BASE-DNN-NAME> <-- Base DNN used for UDM lookup --- Nchf_ConvergedCharging_Create --- DNN: <VIRTUAL-DNN-NAME> <-- Virtual DNN sent to CHF --- PFCP Session Establishment Request (to UPF) --- APN: <VIRTUAL-DNN-NAME> <-- Virtual DNN sent to UPF --- RADIUS Access-Request (if applicable) --- Called-Station-Id: <VIRTUAL-DNN-NAME> <-- Virtual DNN sent to RADIUS --- Npcf_SMPolicyControl_Create (if applicable) --- DNN: <VIRTUAL-DNN-NAME> <-- Virtual DNN sent to PCF --- PDU Session Establishment Accept --- PDU Address: <ALLOCATED-IP> DNN: <VIRTUAL-DNN-NAME>
验证UPF上的会话:
show subscribers imsi <TEST-IMSI>
show subscribers user-plane-only full callid <callid>
| 变量 |
描述 |
示例值 |
|---|---|---|
| <VIRTUAL-DNS-NAME> |
虚拟DNN标识符 |
enterprise-iot.cc |
| <VIRTUAL-DNN-PROFILE-INST1> |
DNN配置文件名称,实例1 |
dnprof-enterprise-iot.cc_inst1 |
| <VIRTUAL-DNN-PROFILE-INST2> |
DNN配置文件名称,实例2 |
dnprof-enterprise-iot.cc_inst2 |
| <BASE-DNN-RMGR-INST1> |
基础DNN的资源管理器,实例1 |
base-apn.operator_1 |
| <BASE-DNN-RMGR-INST2> |
基础DNN的资源管理器,实例2 |
base-apn.operator_2 |
| <SMF-NODE-SITE-A> |
站点A的SMF节点名称 |
SMF站点A |
| <SMF-NODE-SITE-B> |
站点B的SMF节点名称 |
SMF-SITE-B |
| <UPF-NODE-SITE-A-1>到<UPF-NODE-SITE-A-4> |
站点A的UPF节点 |
UPF1A至UPF1D |
| <UPF-NODE-SITE-B-1>到<UPF-NODE-SITE-B-4> |
站点B的UPF节点 |
UPF1A至UPF1D |
| <PRIMARY-DNS-IP> |
DNN的主DNS IP |
10.x.x.x |
| <SECONDARY-DNS-IP> |
DNN的辅助DNS IP |
10.x.x.x |
| <CHF-PROFILE> |
CHF网络元素配置文件名称 |
nfprf-chf2 |
| <AMF-PROFILE> |
AMF网络元素配置文件名称 |
nfprf-amf1 |
| <UDM-PROFILE> |
UDM网络元素配置文件名称 |
nfprf-udm1 |
| <SCP-PROFILE> |
SCP网络元素配置文件名称 |
nfprf-scp1 |
| <CHARGING-FILE> |
计费配置文件名称 |
chgprof-b2b |
| <QOS-PROFILE> |
QoS配置文件名称 |
5qi-to-dscp-mapping-table |
| <RADIUS-GROUP> |
RADIUS AAA组名称 |
aaa_group_iot |
| <UP-IDLE-TIMEOUT> |
用户平面空闲超时(秒) |
3600 |
| <CP-IDLE-TIMEOUT> |
控制平面空闲超时(秒) |
7320 |
| <INACTIVITY-TIMER> |
Userplane inactivity timer(秒) |
3600 |
| <EVENT-POLICY> |
事件管理策略名称 |
em_duplicateip |
| <WPS-PROFILE> |
无线优先级服务配置文件 |
动态WPS |
| <NSO-SERVER> |
NSO服务器主机名/IP |
nso-server.mgmt |
| <UPF-CONTEXT> |
DNN的UPF上下文名称 |
B2B |
| <GTPP-GROUP> |
用于生成CDR的GTPP组 |
gtpp_group |
| <RULEBASE-NAME> |
活动计费规则库 |
规则库移动性 |
| <IPV4-ACL-NAME> |
IPv4访问控制列表名称 |
ue_acl_B2B |
| <IPV6-ACL-NAME> |
IPv6访问控制列表名称 |
ipv6_acl_B2B |
| <会话类型> |
PDU会话IP类型 |
IPV4 / IPV6 / IPV4V6 |
| <TEST-IMSI> |
测试用户IMSI进行验证 |
10000XXXXXXXXX |
| 选项 |
NF列表 |
PCF交互 |
RADIUS身份验证 |
pcf-interaction设置 |
|---|---|---|---|---|
| A |
[ chf udm upf radius ] |
已启用(默认) |
启用 |
未配置(默认) |
| B |
[ chf upf radius ] |
禁用 |
启用 |
pcf-interaction false |
| C |
[ chf udm upf pcf ] |
启用 |
禁用 |
未配置(默认) |
| D |
[ chf upf ] |
禁用 |
禁用 |
pcf-interaction false |
| 场景 |
更改说明 |
之后的NF列表 |
PCF设置 |
|---|---|---|---|
| 1 |
删除UDM +禁用PCF |
[ chf upf radius ] |
pcf-interaction false |
| 2 |
删除UDM,保留PCF |
[ chf upf radius pcf ] |
默认(启用) |
| 3 |
仅禁用PCF |
[ chf udm upf radius ] |
pcf-interaction false |
| 4 |
删除RADIUS |
[ chf udm upf pcf ] |
默认(启用) |
| 版本 | 发布日期 | 备注 |
|---|---|---|
1.0 |
01-Sep-2026
|
初始版本 |