Cisco ASR 5000 Series Instruction Manual

Cisco ASR 5000 Series Femto Network
Gateway Administration Guide
Version 12.0
Last updated April 30, 2011
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-24872-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY
OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED
WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED
WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This
equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio
communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own
expense.
The following information is for FCC compliance of Class B devices: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to
part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can
radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If the equipment causes interference to radio or television reception, which can be determined by turning the
equipment off and on, users are encouraged to try to correct the interference by using one or more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and receiver.
Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
Consult the dealer or an experienced radio/TV technician for help.
Modifications to this product not authorized by Cisco could void the FCC approval and negate your authority to operate the product.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain
version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL
FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE
PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR
ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco ASR 5000 Series Femto Network Gateway Administration Guide
© 2011 Cisco Systems, Inc. and/or its affiliated entities. All rights reserved.

Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
iii
CONTENTS
About this Guide.................................................................................................v
Conventions Used....................................................................................................................................................vi
Contacting Customer Support ...............................................................................................................................viii
Femto Network Gateway Overview...................................................................9
Product Description................................................................................................................................................ 10
Summary of FNG Features and Functions ............................................................................................................. 11
Product Specifications............................................................................................................................................ 12
Licenses ............................................................................................................................................................. 12
Hardware Requirements .................................................................................................................................... 12
Platforms....................................................................................................................................................... 12
Components .................................................................................................................................................. 12
Operating System Requirements ....................................................................................................................... 13
Network Deployment(s) and Interfaces.................................................................................................................. 14
Network Elements ............................................................................................................................................. 14
Femtocell Access Point................................................................................................................................. 14
Femtocell Management System .................................................................................................................... 15
Femto Network Gateway .............................................................................................................................. 15
Femtocell AAA Server ................................................................................................................................. 15
IMS Core Network Elements........................................................................................................................ 15
PDSN/HA ..................................................................................................................................................... 16
Basic Operation ................................................................................................................................................. 16
Network Interfaces ............................................................................................................................................ 16
Features and Functionality ..................................................................................................................................... 18
FNG Service ...................................................................................................................................................... 18
IKEv2 and IP Security (IPSec) Encryption ....................................................................................................... 19
X.509 Certificate-based Peer Authentication .................................................................................................... 19
A12 Aggregation ............................................................................................................................................... 20
RADIUS Support............................................................................................................................................... 20
AAA Server Group Selection ............................................................................................................................ 21
FAP ID-based Duplicate Session Detection ...................................................................................................... 21
Tunnel Cleanup on FAP Reboot ................................................................................................................... 21
Child SA Rekey Support ................................................................................................................................... 21
Multiple Child SAs............................................................................................................................................ 22
DoS Protection Cookie Challenge ..................................................................................................................... 22
IKEv2 Keep-Alive Messages (Dead Peer Detection) ........................................................................................ 22
DSCP Marking .................................................................................................................................................. 23
Custom DNS Handling...................................................................................................................................... 23
Session Recovery Support ................................................................................................................................. 23
Congestion Control............................................................................................................................................ 24
Bulk Statistics .................................................................................................................................................... 24
Threshold Crossing Alerts ................................................................................................................................. 25
How the FNG Works.............................................................................................................................................. 27
IPSec Tunnel Establishment .............................................................................................................................. 27
IPSec Tunnel Establishment with EAP-AKA Authentication ........................................................................... 28
X.509 Certificate-based Peer Authentication .................................................................................................... 30
Supported Standards............................................................................................................................................... 33

▀Contents
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
iv
OL-24872-01
3GPP2 References............................................................................................................................................. 33
IETF References................................................................................................................................................ 33
Femto Network Gateway Configuration.........................................................35
Configuring the System to Perform as a Femto Network Gateway ....................................................................... 36
Required Information ........................................................................................................................................ 36
Required Local Context Configuration Information..................................................................................... 36
Required FNG Context Configuration Information...................................................................................... 37
Required FNG Service Configuration Information ...................................................................................... 38
Required Egress Context Configuration Information ................................................................................... 38
Femto Network Gateway Configuration ........................................................................................................... 39
Initial Configuration.......................................................................................................................................... 40
Modifying the Local Context........................................................................................................................ 40
FNG Context Configuration.............................................................................................................................. 41
Creating the FNG Context............................................................................................................................ 41
Creating the AAA Group.............................................................................................................................. 42
Creating the EAP Profile .............................................................................................................................. 43
Creating IKEv2 Transform Sets ................................................................................................................... 43
Creating IPSec Transform Sets..................................................................................................................... 44
Creating the Crypto Template ...................................................................................................................... 44
Creating the FNG Service............................................................................................................................. 45
Egress Context Configuration ........................................................................................................................... 46
Creating the Egress Context ......................................................................................................................... 46
Logging Configuration...................................................................................................................................... 46
Verifying and Saving the Configuration ........................................................................................................... 47
Configuring Optional Features............................................................................................................................... 48
A12 Aggregation Configuration........................................................................................................................ 48
Multiple Child SAs and DSCP Marking Configuration .................................................................................... 49
FAP ID-based Duplicate Session Detection Configuration............................................................................... 50
Verifying and Saving Your Configuration......................................................51
Verifying the Configuration................................................................................................................................... 52
Feature Configuration........................................................................................................................................ 52
Service Configuration........................................................................................................................................ 53
Context Configuration....................................................................................................................................... 54
System Configuration........................................................................................................................................ 54
Finding Configuration Errors ............................................................................................................................ 54
Saving the Configuration ....................................................................................................................................... 56
Saving the Configuration on the Chassis ............................................................................................................... 57
Monitoring the FNG Service.............................................................................59
Monitoring System Status and Performance.......................................................................................................... 60
Clearing Statistics and Counters ............................................................................................................................ 62
Sample Femto Network Gateway Configuration File....................................63
Sample FNG Configuration ................................................................................................................................... 64
Femto Network Gateway Engineering Rules.................................................69
IKEv2/IPSec Restrictions....................................................................................................................................... 70

Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
v
About this Guide
This document pertains to the features and functionality that run on and/or that are related to the Cisco® ASR 5000
Chassis, formerly the Starent Networks ST40.

About this Guide
▀Conventions Used
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
vi
OL-24872-01
Conventions Used
The following tables describe the conventions used throughout this documentation.
Icon
Notice Type
Description
Information Note Provides information about important features or instructions.
Caution
Alerts you of potential damage to a program, device, or system.
Warning Alerts you of potential personal injury or fatality. May also alert you of potential
electrical hazards.
Electro-Static Discharge
(ESD)
Alerts you to take proper grounding precautions before handling a product.
Typeface Conventions
Description
Text represented as a screen
display
This typeface represents displays that appear on your terminal screen, for example:
Login:
Text represented as commands This typeface represents commands that you enter, for example:
show ip access-list
This document always gives the full form of a command in lowercase letters. Commands
are not case sensitive.
Text represented as a command
variable
This typeface represents a variable that is part of a command, for example:
show card slot_number
slot_number is a variable representing the desired chassis slot number.
Text represented as menu or sub-
menu names
This typeface represents menus and sub-menus that you access within a software
application, for example:
Click the File menu, then click New
Command Syntax
Conventions
Description
{ keyword or
variable }
Required keywords and variables are surrounded by grouped brackets.
Required keywords and variables are those components that are required to be entered as part of the
command syntax.

About this Guide
Conventions Used ▀
Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
vii
Command Syntax
Conventions
Description
[ keyword or
variable ]
Optional keywords or variables, or those that a user may or may not choose to use, are surrounded by square
brackets.
| With some commands there may be a group of variables from which the user chooses one. These are called
alternative variables and are documented by separating each variable with a vertical bar (also known as a
pipe filter).
Pipe filters can be used in conjunction with required or optional keywords or variables. For example:
{ nonce | timestamp }
OR
[ count number_of_packets | size number_of_bytes ]

About this Guide
▀Contacting Customer Support
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
viii
OL-24872-01
Contacting Customer Support
Use the information in this section to contact customer support.
For New Customers: Refer to the support area of http://www.cisco.com for up-to-date product documentation or to
submit a service request. A valid username and password is required to this site. Please contact your local sales or
service representative for additional information.
For Existing Customers with support contracts through Starent Networks: Refer to the support area of
https://support.starentnetworks.com/ for up-to-date product documentation or to submit a service request. A valid
username and password is required to this site. Please contact your local sales or service representative for additional
information.
Important:For warranty and repair information, please be sure to include the Return Material Authorization
(RMA) tracking number on the outside of the package.

Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
9
Chapter 1
Femto Network Gateway Overview
This chapter contains general overview information about the Femto Network Gateway (FNG), including:
•Product Description
•Summary of FNG Features and Functions
•Product Specifications
•Network Deployment(s) and Interfaces
•Features and Functionality
•How the FNG Works
•Supported Standards

Femto Network Gateway Overview
▀Product Description
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
10
OL-24872-01
Product Description
The Cisco® ASR 5000 Chassis provides 3GPP mobile operators with a flexible solution that functions as a Femto
Network Gateway (FNG) in CDMA2000 wireless voice and data networks. The FNG consists of new software for the
ASR 5000.
The FNG enables mobile operators to provide 3G network services to subscribers with wireless handsets via Femtocell
Access Points (FAPs). The FNG makes it possible for operators to provide secure access to the operator’s 3G network
from a non-secure network, extend wireless service coverage indoors, especially where access would otherwise be
limited or unavailable, reduce the load on the macro wireless network, and make use of existing backhaul infrastructure
to reduce the cost of carrying wireless calls.
The FNG functions as a security gateway that allows the FAPs in the access network to connect to circuit, packet, and
IMS core networks. The FNG implements an IPSec interface to provide a secure, encrypted IPSec tunnel to each FAP in
the access network as it connects to the operator’s core network. In addition, the FNG provides a highly scalable
femtocell solution by allowing a large number of FAPs to interoperate with legacy core network elements that are
typically not designed to interface with such a large number of elements.
The FNG splits voice and data traffic flows into and out of the core network. It forwards all voice traffic to the
operator’s IMS core network and all data traffic to the PDSN/HA toward the packet data network. This network
configuration fully isolates the traditional MSC from IP attacks, because all backhauled traffic is secure and offloaded to
a convergence server in the IMS core network.

Femto Network Gateway Overview
Summary of FNG Features and Functions ▀
Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
11
Summary of FNG Features and Functions
The FNG features and functions include:
•FNG service
•IKEv2 and IP Security (IPSec) encryption
•A12 aggregation
•X.509 certificate-based peer authentication
•RADIUS Support
•AAA server group selection
•FAP ID-based duplicate session detection
•Child SA rekey support
•Multiple Child SAs
•DoS protection cookie challenge
•IKEv2 keep-alive messages (dead peer detection)
•DSCP marking
•Custom DNS handling
•Session recovery support
•Congestion control
•Bulk statistics
•Threshold crossing alerts (TCAs)

Femto Network Gateway Overview
▀Product Specifications
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
12
OL-24872-01
Product Specifications
The following information is located in this section:
•Licenses
•Hardware Requirements
•Operating System Requirements
Licenses
The FNG is a licensed product. A session use license key must be acquired and installed to use the FNG service. For
information about FNG licenses, contact your sales representative.
Hardware Requirements
Information in this section describes the hardware required to enable the FNG service.
Platforms
The FNG service operates on the ASR 5000.
Components
The following application and line cards are required to support FNG functionality on the ASR 5000:
•System Management Cards (SMCs): Provide full system control and management of all cards within the ASR
5000. Up to two SMCs can be installed; one active, one redundant.
•Packet Services Cards (PSCs/PSC2s): Provide high-speed, multi-threaded PDP context processing capabilities
for 2.5G and 3G services. Up to 14 PSCs/PSC2s can be installed, allowing for multiple active and/or redundant
cards.
•Switch Processor Input/Outputs (SPIOs): Installed in the upper-rear chassis slots directly behind the SMCs,
SPIOs provide connectivity for local and remote management and for central office (CO) alarms. Up to two
SPIOs can be installed; one active, one redundant.
•Ethernet 10/100 and/or Ethernet 1000 Line Cards: Installed directly behind PSCs/PSC2s, these cards provide
the physical interfaces to elements in the operator’s network. Up to 26 line cards can be installed for a fully

Femto Network Gateway Overview
Product Specifications ▀
Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
13
loaded system with 13 active PSCs/PSC2s, 13 in the upper-rear slots and 13 in the lower-rear slots for
redundancy. Redundant PSCs/PSC2s do not require line cards.
•Redundancy Crossbar Cards (RCCs): Installed in the lower-rear chassis slots directly behind the SMCs,
RCCs utilize 5 Gbps serial links to ensure connectivity between Ethernet 10/100 or Ethernet 1000 line cards
and every PSC/PSC2 in the system for redundancy. Two RCCs can be installed to provide redundancy for all
line cards and PSCs/PSC2s.
Important:Additional information pertaining to each of the application and line cards required to support
CDMA2000 wireless voice and data services is located in the “Hardware Platform Overview” chapter of the Product
Overview Guide.
Operating System Requirements
The FNG is available for the ASR 5000 running StarOS Release 10.0 or later.

Femto Network Gateway Overview
▀Network Deployment(s) and Interfaces
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
14
OL-24872-01
Network Deployment(s) and Interfaces
This section describes the FNG as it functions in a CDMA2000 network.
The figure below shows how the FNG functions both as a security gateway and a femtocell gateway between the FAPs
in the access network and the operator’s IMS core network for voice services and the PDSN/HA and the packet data
network for data services.
Figure 1. FNG Network Architecture
Femtocell
Management
System
Femtocell
AAA Server
Operator’s
Core
Network
UE
Broadband Network
FAP
IMS Network
for Voice Services
IPSec tunnel
PDSN/HA
Packet Data Network
for Data Services
Access
Network
FNG
Network Elements
This section provides a description of the network elements in an FNG network.
Femtocell Access Point
The Femtocell Access Point (FAP) is a SIP-based CDMA2000 wireless access point that provides coverage in a small
area, usually a private residence or small office, and connects the subscriber UEs to an operator’s core network via a

Femto Network Gateway Overview
Network Deployment(s) and Interfaces ▀
Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
15
broadband connection (e.g., DSL or cable). A FAP allows operators to extend wireless service coverage indoors,
especially where access would otherwise be limited or unavailable.
Femtocell Management System
The Femtocell Management System (FMS) is a network element that resides in the operator’s network and facilitates
the provisioning, activation, and operational management of the FAPs in the network based on industry standards such
as TR-069. The FMS helps to ensure the scalability of the FAP network to potentially millions of devices.
Femto Network Gateway
The Femto Network Gateway (FNG) is a network element that resides in the operator’s network and functions as both a
security gateway and a femtocell gateway. The security gateway functions provide secure access for the FAPs to access
services within the operator’s core network. The femtocell gateway functions provide aggregation and proxy capabilities
for the FAPs. The FNG forwards all voice traffic to the operator’s IMS core network and all data traffic to the
PDSN/HA.
Femtocell AAA Server
The Femtocell AAA Server provides a FAP authorization function. It sends authorization policy information to the
FNG.
IMS Core Network Elements
An operator’s IMS core network may include the following elements to enable voice services:
•P-CSCF: The P-CSCF (Proxy Call/Session Control Function) is the entry point into the IMS domain and serves
as the outbound proxy server for SIP messaging for the subscriber UEs. The UEs attach to the P-CSCF prior to
performing IMS registrations and initiating SIP sessions. All SIP signaling traffic to and from the FAPs and the
IMS core is handled by the P-CSCF. The P-CSCF provides message manipulation, breakout of emergency call
services, QoS (Quality of Service) authorization, and signaling compression. Once the P-CSCF completes all
of the functions for which it is responsible, it forwards the call to the I-CSCF.
•I-CSCF: The I-CSCF (Interrogating Call/Session Control Function) functions as a location server in the IMS
core network. Its major functions are to select the appropriate registrar server for the subscriber UEs by
consulting the HSS (Home Subscriber Server) and forwarding the request to the IMS registrar (the S-CSCF).
The HSS returns a set of required S-CSCF capabilities for initial registration requests by the UE. Based on
these capabilities, the I-CSCF selects the appropriate S-CSCF.
•S-CSCF: The S-CSCF (Serving Call/Session Control Function) provides session control and registration
services for the subscriber UEs and FAPs in the network. It is responsible for all aspects of session control,
handling all subscriber requests, which it relays to the appropriate application server. The S-CSCF routes
mobile-terminating traffic to the P-CSCF and routes mobile-originating traffic to the convergence server based
on iFC (initial Filter Criteria) downloaded from the HSS.

Femto Network Gateway Overview
▀Network Deployment(s) and Interfaces
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
16
OL-24872-01
•HSS: The HSS (Home Subscriber Server), is the master user database that supports the IMS network entities that
handle calls. It contains subscription-related information (subscriber profiles), performs authentication and
authorization of the user, and provides information about the subscriber's location and IP information.
•Femtocell Convergence Server: The Femtocell Convergence Server (FCS) is an IMS application server that
provides legacy Telephony Application Services (TAS) to 1x femtocell subscribers via SIP, including voice
services and voice feature delivery. The femtocell convergence server also manages idle and active mode
mobility for 1x subscribers as they move into and out of range of FAP coverage. It functions as an MFIF
(MAP-Femtocell Interworking Function) and interfaces with the HLR for 1x subscriber authentication. It
appears as an IMS application server to the S-CSCF and as a serving MSC to the HLR.
•Media Gateway: The Media Gateway terminates bearer channels from the circuit-switched network and media
streams from the packet-switched network. It can support media conversion, bearer control, and payload
processing (e.g., using codecs, echo cancellers, and conference bridges).
PDSN/HA
The PDSN/HA enables femtocell subscribers to receive packet data services in the mobile operator's core network. In
most cases, these services are the same as those available via the mobile operator's macro network.
Basic Operation
When a FAP powers up, it uses DNS resolution to resolve its pre-configured FQDN of the FNG and obtain the FNG’s
IP address. It then initiates IPSec tunnel establishment over the broadband access network. The IPSec tunnel terminates
at the FNG.
The FAP receives an IPv4 address known as the Tunnel Inner Address (TIA) from the FNG during the first IPSec tunnel
establishment. The FNG assigns the TIA from its own IPv4 address pool. Once an IPSec tunnel is established, the FAP
uses the TIA in all its SIP messages and to obtain configuration data from its FMS. The FNG is agnostic in regard to the
protocol used between the FAP and its FMS, and simply forwards packets between the FAP and the FMS over the
secure connection.
The 1x FAP performs P-CSCF discovery via a DHCP server per RFC 3319, or it may receive the IP address of the P-
CSCF from the FMS. Once the FAP gets the P-CSCF address, it initiates SIP registration with the IMS core network.
When a UE attaches to the FAP, it performs 1x registration with the IMS core network.
Network Interfaces
The following table provides descriptions of the network interfaces supported by the FNG in a CDMA2000 network.
Table 1. Network Interfaces in a CDMA2000 Network
Interface
Description

Femto Network Gateway Overview
Network Deployment(s) and Interfaces ▀
Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
17
Interface
Description
FAP Interface The secure interface to the FAPs in the network is an IPSec tunnel. The FNG uses IKEv2 for establishing the
IPSec tunnel.
Note that the FNG does not have a direct interface to the UEs in the network. The FNG receives all voice and
data traffic from the UEs via secure IPSec tunnels between the FNG and the FAPs and sends the traffic to the
operator’s IMS core or PDSN/HA.
RADIUS
Interface
The interface to the RADIUS server is used for FAP device authentication. The FAP can use one of the
following authentication methods:
•EAP-AKA (Extensible Authentication Protocol - Authentication and Key Agreement) authentication
•PSK (Pre-Shared Key) authentication
•X.509 certificate-based peer (client) authentication
Interface with the
IMS Core
The FNG sends all SIP signaling and bearer traffic from the FAPs to the IMS core to access voice services.
Interface with the
PDSN/HA
The FNG sends all signaling and bearer traffic from the FAPs to the PDSN/HA to access packet data services.

Femto Network Gateway Overview
▀Features and Functionality
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
18
OL-24872-01
Features and Functionality
This section describes the features and functions supported by the FNG.
The following features are supported and described in this section:
•FNG Service
•IKEv2 and IP Security (IPSec) Encryption
•X.509 Certificate-based Peer Authentication
•A12 Aggregation
•RADIUS Support
•AAA Server Group Selection
•FAP ID-based Duplicate Session Detection
•Child SA Rekey Support
•Multiple Child SAs
•DoS Protection Cookie Challenge
•IKEv2 Keep-Alive Messages (Dead Peer Detection)
•DSCP Marking
•Custom DNS Handling
•Session Recovery Support
•Congestion Control
•Bulk Statistics
•Threshold Crossing Alerts
FNG Service
The FNG service and its associated processes enable the system to function as a femtocell gateway. The FNG service
enables the FAPs in the network to connect to the core network elements via a secure IPSec interface. During
configuration, you create the FNG service in an FNG context, which is a routing domain on the ASR 5000. FNG context
and service configuration includes the following main steps:
•Configure the IPv4 address for the service: This is the IP address of the FNG to which the FAPs in the
network attempt to connect, sending IKEv2 messages to this IP address to establish IPSec tunnels.
•Configure the name of the crypto template for IKEv2/IPSec: A crypto template is used to configure an
IKEv2/IPSec policy. It includes most of the IKEv2 and IPSec parameters for keep-alive, lifetime, NAT-T, and
cryptographic and authentication algorithms. There must be one crypto template per FNG service.

Femto Network Gateway Overview
Features and Functionality ▀
Cisco ASR 5000 Series Femto Network Gateway Administration Guide ▄
OL-24872-01
19
•The name of the EAP profile: This profile defines the EAP authentication method and associated parameters. If
the PSK (Pre-Shared Key) authentication method is used, this configuration is not needed.
•IKEv2 and IPSec transform sets: Transform sets define the negotiable algorithms for IKE SAs and Child SAs
to enable calls to connect to the FNG.
•The setup timeout value: This parameter specifies the session setup timeout timer value. The FNG terminates a
connection attempt if the FAP does not establish a successful connection within the specified timeout period.
•Max-sessions: This parameter sets the maximum number of subscriber sessions allowed by this FNG service.
•FNG supports a domain template for storing domain-related configuration: The domain name is taken from
the received Network Address Identifier (NAI) and searched in the domain template database.
•Duplicate session detection parameters: The FNG supports the FAP ID in the form of an NAI for duplicate
session detection. This setting enables duplicate session detection for the FNG service.
When the FNG service is configured in the system with the IP address, crypto template, and so on, the FNG is ready to
accept IKEv2 control packets for establishing IKEv2 sessions.
IKEv2 and IP Security (IPSec) Encryption
The FNG supports IKEv2 and IPSec encryption using IPv4 addressing. IKEv2 and IPSec encryption enables network
domain security for all IP packet-switched networks in order to provide confidentiality, integrity, authentication, and
anti-replay protection.
At the beginning of IKEv2 session setup, the FNG and the FAP exchange capabilities for authentication. IKEv2 and
IPSec transform sets configured in the crypto template define the negotiable algorithms for IKE SA and Child SA setup
to connect calls to the FNG by creating a single IPSec tunnel, called the Tunnel Inner Address (TIA), which is intended
for user traffic coming from the FAP. There can be multiple UEs connecting to a single FAP at the same time, and the
traffic from all of the connected UEs passes through the same IPSec tunnel. The FAP to which a UE is connected can
request one of the following authentication methods:
•EAP-AKA (Extensible Authentication Protocol - Authentication and Key Agreement) authentication
•PSK (Pre-Shared Key) authentication
•X.509 certificate-based peer (client) authentication
The FNG partially supports the EAP MD5 (Extensible Authentication Protocol Message-Digest 5) authentication
method.
X.509 Certificate-based Peer Authentication
In addition to the EAP-AKA (Extensible Authentication Protocol - Authentication and Key Agreement) and PSK (Pre-
Shared Key) peer authentication methods, the FNG supports X.509 certificate-based peer authentication.
The FNG checks the network policy on whether a FAP is authorized to provide service. If the network policy states that
all FAPs that pass device authentication are authorized to provide service, no further authorization check may be
required. If the network policy requires that each FAP be individually authorized for service (in the case where the
FEID is associated with a valid subscription), the FNG sends a RADIUS Access-Request message to the AAA server. If
the AAA server sends a RADIUS Access-Accept message, the FNG proceeds with device authentication. Otherwise, the
FNG terminates the IPSec tunnel setup by sending an IKEv2 Notification message indicating authentication failure.

Femto Network Gateway Overview
▀Features and Functionality
▄Cisco ASR 5000 Series Femto Network Gateway Administration Guide
20
OL-24872-01
For a detailed presentation of X.509 certificate-based peer authentication, see the section How the FNG Works later in
this chapter.
A12 Aggregation
The Access Network AAA (AN-AAA) servers in 1x networks are not designed to handle a large numbers of FAPs
attempting A12 authentication to access the network. The A12 aggregation feature reduces the number of source
addresses in the A12 Access-Request messages sent to the AN-AAA servers by the FNG, which simplifies the
configuration of the AN-AAA server's database.
A12 authentication is a CHAP-based authentication method used by CDMA2000 AN-AAA servers to provide High
Rate Packet Data (HRPD) access authentication between the AN function in the FAPs and the AN-AAA servers in the
network.
When the FNG receives an A12 Access-Request message from a FAP, it validates the source address of the FAP, then
substitutes the source address (and, optionally, the NAS IP address/port number) in the Access-Request message with its
own source address before sending the message to the AN-AAA server. When the FNG receives the Access-Accept
message from the AN-AAA server, the FNG sends it back to the FAP. In this way, the number of AAA sessions
required by the AN-AAA server is reduced.
RADIUS Support
RADIUS support on the FNG provides a mechanism for performing authentication, authorization, and accounting
(AAA) for subscribers. The benefits of using AAA are:
•Higher flexibility for subscriber access control
•Better accounting, charging, and reporting options
•Industry standard RADIUS authentication
The Remote Authentication Dial-In User Service (RADIUS) protocol can be used to provide AAA functionality for
subscribers. The AAA functionality on the FNG provides a wide range of configuration options via AAA server groups,
which allow a number of RADIUS parameters to be configured in support of the FNG service.
Currently, two types of authentication load-balancing methods are supported: first-server and round-robin. The first-
server method sends requests to the highest priority active server. A request will be sent to a different server only if the
highest priority server is not reachable. With the round-robin method, requests are sent to all active servers in a round-
robin fashion.
The FNG can detect the status of the AAA servers. Status checking is enabled by configuration in the AAA Server
Group Configuration Mode of the system’s CLI. Once an AAA server is detected to be down, it is kept in the down state
up to a configurable duration of time called the dead-time period. After the dead-time period expires, the AAA server is
eligible to be retried. If a subsequent request is directed to that server and the server properly responds to the request, the
system makes the server active again.
Important:For more information on RADIUS AAA configuration, refer to the AAA Interface Administration
and Reference.