Cisco ASR 5000 Instruction Manual

Cisco ASR 5000 Enhanced Wireless Access
Gateway Administration Guide
Version 14.0
Last Updated May 31, 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-28188-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED
WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED
WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain
version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL
FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE
PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR
ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phon e numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any u se of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
© 2013 Cisco Systems, Inc. All rights reserved.

Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
iii
CONTENTS
About this Guide ................................................................................................. v
Conventions Used .................................................................................................................................... v
Contacting Customer Support..................................................................................................................vi
Additional Information...............................................................................................................................vi
Enhanced Wireless Access Gateway Overview.............................................. 7
Introduction...............................................................................................................................................8
Product Overview .....................................................................................................................................8
Platform Requirements.........................................................................................................................9
License Requirements..........................................................................................................................9
Supported Standards ...........................................................................................................................9
Network Deployments and Network Interfaces..................................................................................10
Network Deployments....................................................................................................................10
Network Interfaces.........................................................................................................................10
Feature Description ................................................................................................................................11
UE Identity and Location Information Support ...................................................................................11
RADIUS AAA Support........................................................................................................................11
Control and Data Interfaces...........................................................................................................12
IP Address Allocation.....................................................................................................................13
Network Layer Service Access Point Identifier Allocation.............................................................13
Routing Area Identification Encoding.............................................................................................13
Differentiated Services Code Point Marking ......................................................................................13
Access Point Name Selection............................................................................................................14
Quality of Service Profile Selection....................................................................................................15
GGSN Selection.................................................................................................................................15
GGSN Failover Case..........................................................................................................................15
Network Address Translation and Application Level Gateway Support.............................................16
Virtual APN Support...........................................................................................................................16
UE Identity and Location Information Support ...................................................................................17
UE Identity Information Support.....................................................................................................17
UE Location Information Support...................................................................................................17
Bulk Statistics Support .......................................................................................................................18
Threshold Crossing Alerts Support ....................................................................................................18
Congestion Control Support...............................................................................................................19
Redundancy Support..........................................................................................................................20
How it Works ..........................................................................................................................................21
Session Setup....................................................................................................................................21
Session Setup using Accounting-Interim.......................................................................................24
Session Replacement ........................................................................................................................27
Session Setup Failure........................................................................................................................28
Mandatory AVP Missing / No Resource ........................................................................................29
GTP Tunnel Setup Failure.............................................................................................................30
Session Update..................................................................................................................................31
WLC-initiated Accounting Interim ..................................................................................................31
GGSN-initiated Update PDP Context ............................................................................................32
Session Teardown .........................................................................................................................33
Dependencies and Limitations ...............................................................................................................36

▀Contents
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
iv
OL-28188-02
eWAG + GGSN Combo Deployments ...............................................................................................36
Virtual APN Configuration in eWAG + GGSN Combo Deployments.............................................36
eWAG + TTG Combo Deployments...................................................................................................37
SGTP Service Configuration in eWAG + TTG Combo Deployments ............................................37
eWAG + TTG + GGSN Combo Deployments....................................................................................38
Mobility Setup Considerations............................................................................................................38
3G-eWAG-TTG Mobility using Proxy-MIP at GGSN......................................................................38
Enhanced Wireless Access Gateway Configuration .................................... 39
Before You Begin....................................................................................................................................40
eWAG Configuration...............................................................................................................................41
Creating and Configuring the eWAG Service.....................................................................................41
Creating the eWAG Service...........................................................................................................41
Configuring the eWAG Service......................................................................................................42
Configuring the APN...........................................................................................................................44
Configuring the SGTP Service ...........................................................................................................45
Configuring NAT/ALG Support...........................................................................................................46
Configuring ECS Rulebase with Firewall-and-NAT Policy.............................................................46
Configuring APN with Firewall-and-NAT Policy.............................................................................47
Configuring Routing Rules and NAT ALG......................................................................................47
Additional Configurations ...................................................................................................................50
Configuring Access Lists................................................................................................................50
Configuring Bulk Statistics .............................................................................................................50
Configuring Congestion Control.....................................................................................................51
Configuring Session Recovery.......................................................................................................52
eWAG Administration .............................................................................................................................53
Logging Support .................................................................................................................................53
Protocol Monitoring Support...............................................................................................................53
Monitor Protocol.............................................................................................................................54
Monitor Subscriber.........................................................................................................................54
Gathering eWAG-related Statistics and Information ..........................................................................55
Enhanced Wireless Access Gateway Configuration AAA AVP Support.... 57
Enhanced Wireless Access Gateway Sample Configurations .................... 59
eWAG Stand-alone Configuration ..........................................................................................................60
eWAG + GGSN Combo Configuration ...................................................................................................69

Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
v
About this Guide
This document pertains to the features and functionality that run on and/or that are related to the Cisco® ASR 5000
Chassis.
Conventions Used
The following tables describe the conventions used throughout this documentation.
Icon
Notice Type
Description
Information Note
Provides information about important features or instructions.
Caution
Alerts you of potential damage to a program, device, or system.
Warning
Alerts you of potential personal injury or fatality. May also alert you of potential electrical hazards.
Typeface Conventions
Description
Text represented as a screen
display
This typeface represents displays that appear on your terminal screen, for example:
Login:
Text represented as commands
This typeface represents commands that you enter, for example:
show ip access-list
This document always gives the full form of a command in lowercase letters. Commands
are not case sensitive.
Text represented as a command
variable
This typeface represents a variable that is part of a command, for example:
show card slot_number
slot_number is a variable representing the desired chassis slot number.
Text represented as menu or sub-
menu names
This typeface represents menus and sub-menus that you access within a software
application, for example:
Click the File menu, then click New

About this Guide
▀Contacting Customer Support
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
vi
OL-28188-02
Contacting Customer Support
Use the information in this section to contact customer support.
Refer to the support area of http://www.cisco.com for up-to-date product documentation or to submit a service request.
A valid username and password are required to access this site. Please contact your Cisco sales or service representative
for additional information.
Additional Information
Refer to the following guides for supplemental information about the system:
Cisco ASR 5000 Installation Guide
Cisco ASR 5000 System Administration Guide
Cisco ASR 5x00 Command Line Interface Reference
Cisco ASR 5x00 Thresholding Configuration Guide
Cisco ASR 5x00 SNMP MIB Reference
Web Element Manager Installation and Administration Guide
Cisco ASR 5x00 AAA Interface Administration and Reference
Cisco ASR 5x00 GTPP Interface Administration and Reference
Cisco ASR 5x00 Release Change Reference
Cisco ASR 5x00 Statistics and Counters Reference
Release notes that accompany updates and upgrades to the StarOS for your service and platform

Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
7
Chapter 1
Enhanced Wireless Access Gateway Overview
This chapter provides an overview of the Enhanced Wireless Access Gateway (eWAG).
The following topics are covered in this chapter:
Introduction
Product Overview
Feature Description
How it Works
Dependencies and Limitations

Enhanced Wireless Access Gateway Overview
▀Introduction
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
8
OL-28188-02
Introduction
Providing a consistent subscriber experience and supporting the ever exploding demand for bandwidth to provide data
services in 3G/4G networks is quickly becoming a big challenge for mobile operators. Widely prevalent Wireless Local
Area Network (WLAN) at public hotspots, private corporate networks, and so on have been viewed as providing a
viable alternative to 3G/4G radio and providing a solution to the overloading of radio networks by providing an
offloading solution. These Interworking WLAN (I-WLAN) provide subscriber access to 3G/4G networks making
services offered by operators universally available.
However, due to the inherent un-trusted nature of WLANs, the I-WLAN solution has been designed keeping security
aspects in view and so is based on IPSec. The IPSec-based solution requires a client to be installed on the UE. At this
point in the evolution of subscriber access from WLANs, the UE client has been a major stumbling block in the
deployment of I-WLANs.
On the other hand, trusted Wi-Fi networks provide a unique opportunity in converting WLANs into seamless extensions
of 3G/4G mobile networks, enabling improved subscriber experience, especially indoors which often suffers poor
cellular coverage, as subscribers are able to reach their 3G/4G services via both mobile and Wi-Fi accesses.
Product Overview
The Cisco® eWAG enables Wi-Fi integration into 3G mobile packet core (MPC), allowing clientless UE attached to
trusted Wireless Local Area Networks (WLANs) seamlessly access 3G services. In this case, the UE does not require a
client, it has no dependencies on the Wi-Fi architecture, and does not realize that it is connecting to a 3G network (3G
access is integrated with the normal UE-WLAN attach procedure).
Important: The eWAG enables 3GPP MPC access only from trusted Wi-Fi networks—802.1x for authentication
and Wi-Fi encryption is required.
The eWAG enables Wi-Fi sessions to be anchored on GGSN of the existing 3G networks via the Gn’ interface. On the
data plane, the eWAG accepts Layer 3 Wi-Fi packets, encapsulates them into GTP tunnels and sends them to the
GGSN. In the downlink direction, the eWAG de-capsulates the packets and sends them to the Wi-Fi network.
The unique advantages of the eWAG include:
The Cisco® ASR 5000 Series chassis on which the eWAG is deployed is a very high capacity chassis that can
support millions of subscribers on a single chassis. Therefore, a single chassis is likely to support large
session/capacity requirements for many years to come.
The Wi-Fi core does not need any enhancement apart from the Wi-Fi AAA, which must act as a RADIUS
accounting client towards the eWAG, with all data traffic routed to eWAG as the default nexthop.
This solution enables optimal use of existing MPC infrastructure—PCRF, OCS, Billing, and so on. Billing and
other 3G/MPC services such as deep packet inspection (DPI) are available to subscribers attached to Wi-Fi via
the GGSN. Apart from the basic IP services, eWAG enables enhanced services such as offload, video
optimization, and on-deck services to the Wi-Fi UE. It also enables policy and charging for the Wi-Fi network,
and enables service providers to provide seamless service experience for subscribers in Wi-Fi network
regardless of their access type.

Enhanced Wireless Access Gateway Overview
Product Overview ▀
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
9
Figure 1. eWAG-based MPC access from WLAN
Platform Requirements
The eWAG service is supported on Cisco® ASR 5000 Series chassis running StarOS. The chassis can be configured
with a variety of components to meet specific network deployment requirements. For additional information, refer to the
Installation Guide for the chassis and/or contact your Cisco account representative.
License Requirements
The eWAG is a licensed Cisco product. Separate session and feature licenses may be required. Contact your Cisco
account representative for detailed information on specific licensing requirements. For information on installing and
verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the
System Administration Guide.
Supported Standards
The eWAG is a Cisco-developed solution, and is not standards based.

Enhanced Wireless Access Gateway Overview
▀Product Overview
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
10
OL-28188-02
Network Deployments and Network Interfaces
This section describes deployment options and network interfaces supported by the eWAG.
Network Deployments
The eWAG can be deployed in any of the following ways:
Stand-alone eWAG deployment on an ASR 5000 chassis.
Combo eWAG + GGSN deployment on the same ASR 5000 chassis.
Important: In this release, the following deployment options are not fully qualified and are not supported, these
are available only for lab testing purposes.
Combo eWAG + TTG deployment on the same ASR 5000 chassis.
Combo eWAG + TTG + GGSN deployment on the same ASR 5000 chassis.
Important: For information on dependencies and limitations of these deployment options see the Dependencies
and Limitations section.
Network Interfaces
The Gn’ reference point is located between the eWAG and the GGSN supporting GTPv1 and GTPv0 protocols. eWAG
supports GTP Path messages towards GGSN. Here, the eWAG acts as an SGSN and initiates the PDP Context Creation
procedure. For every UE, the eWAG creates one GTP tunnel with the GGSN. The UE’s APN and IMSI are forwarded
to the GGSN in the Create PDP Context Request message. This APN is either the subscribed APN from the HLR for the
connecting user, or the locally configured default APN at the eWAG.

Enhanced Wireless Access Gateway Overview
Feature Description ▀
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
11
Feature Description
This section presents general description of features supported by the eWAG.
RADIUS AAA Support
Differentiated Services Code Point Marking
Access Point Name Selection
Quality of Service Profile Selection
GGSN Selection
GGSN Failover Case
Network Address Translation and Application Level Gateway Support
Virtual APN Support
UE Identity and Location Information Support
Bulk Statistics Support
Threshold Crossing Alerts Support
Congestion Control Support
Redundancy Support
RADIUS AAA Support
The eWAG provisions a RADIUS server, as defined in RFC 2865, which enables the eWAG to act as a RADIUS
accounting server supporting receiving and responding to RADIUS accounting messages as defined in RFC 2866.
For the list of RADIUS attributes supported by eWAG, refer to the Enhanced Wireless Access Gateway AAA AVP
Support appendix.
The eWAG provisions configuring one or more RADIUS clients (with corresponding authentication keys) to create a
trusted set of AAA. The eWAG discards RADIUS messages from any device that is not in the RADIUS client list. The
eWAG authenticates each RADIUS message using a configured authentication key. The eWAG creates a new PDP
context (for a subscriber session) upon receiving a valid RADIUS Accounting Start Request.
No 3GPP interface has been defined between WLAN and MPC. Therefore, RADIUS messages generated by core Wi-Fi
network (for example, from WLAN AAA client (WLC or ISG)) are used to provide WLAN session information (Wi-Fi
IP address of UE) to MPC and set up access side association. For this, RADIUS accounting messages
(Start/Interim/Stop) are used.
Many attributes required by MPC (IMSI, MSISDN, APN, Charging-Characteristics, and others) are not inherent in
WLAN access interactions. So, these have to be populated by a WLAN network entity after obtaining it from the MPC.
This enrichment is done by the Wi-Fi AAA. The Wi-Fi AAA interacts with the MPC AAA to obtain these attributes
when UE authentication (EAP over 802.1x) is initiated during initial WLAN attach. Wi-Fi AAA caches these attributes.
After successful authentication and session establishment, WLAN AAA-client (WLC or ISG) generates Accounting-
Start message. This message is proxied by Wi-Fi AAA, enriched with MPC-related attributes, and sent to eWAG. Here,
Wi-Fi AAA acts as the RADIUS accounting client and eWAG as the RADIUS accounting server. eWAG extracts the
necessary attributes required to create the GTP tunnel to GGSN. eWAG resolves the APN to get the GGSN address to
which to create the GTP tunnel. In this release, the PDP context will be created with a dynamic IP address.

Enhanced Wireless Access Gateway Overview
▀Feature Description
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
12
OL-28188-02
On successful creation of the GTP tunnel, eWAG creates the association between the GGSN-assigned IP address and
the Wi-Fi IP address.
All IP data packets generated by the UE in the WLAN are directed to the eWAG. The eWAG NATs the outer source IP
address (Wi-Fi IP address) with the GGSN-assigned IP address (MPC IP address) and forwards it to the GGSN via the
GTP tunnel. The application servers in the PDN identify the UE by the GGSN-assigned IP address.
In the downlink direction, the eWAG NATs the outer destination address (MPC IP address) to the Wi-Fi IP address so
that it is correctly routed to the UE in the WLAN.
Control and Data Interfaces
eWAG supports the following control and data interfaces:
WLC/Wi-Fi AAA –eWAG:
Control Plane: The following RADIUS messages are supported on this interface:
Accounting Start
Accounting Interim
Accounting Stop
Disconnect Request
Data Plane: There is direct IP connectivity between WLC and eWAG. eWAG receives the original IP
packets generated by UE in WLAN. There could be other network elements (routers) between WLC
and eWAG, which can provide Layer 2 or Layer 3 tunneling to route the WLAN-generated packets
across the public network.
Important: In this release, eWAG does not support Tunneling (IP over GRE).
ICMP Processing: ICMP packets in the downlink direction are remapped and sent to the UE.
eWAG –GGSN (Gn’):
PDP Activation Messages: The following messages are supported over the Gn’ reference point:
Create PDP Context Request / Response
Update PDP Context Request / Response: eWAG-initiated Update PDP Context scenario is
supported as explained in the Session Update Call Flow section.
Delete PDP Context Request / Response
Error Indication
Version Not Supported
GTP Payload Forwarding
GTP Echo

Enhanced Wireless Access Gateway Overview
Feature Description ▀
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
13
IP Address Allocation
When a UE attaches to the WLAN network it obtains an IP address from the WLAN network (Wi-Fi IP address). Also,
when the eWAG creates PDP context with the GGSN, the GGSN assigns a remote MPC IP address to the UE. In the
Create PDP Context Request message the end-subscriber-address IE will be empty (indicating dynamic address
assignment by the GGSN), which makes the GGSN assign and return an IP address in the response message.
eWAG performs NAT between the Wi-Fi IP address and the MPC IP address during data transmission.
Network Layer Service Access Point Identifier Allocation
The eWAG allocates Network Layer Service Access Point Identifier (NSAPI) values before sending the Create PDP
Context Request message to the GGSN. Although the eWAG acts like an SGSN in terms of GTP tunnel establishment,
it also manages NSAPI allocation as WLAN UE's proxy for the purpose of leaving the Gn’-based eWAG transparent to
the WLAN UE.
Important: In this release, the eWAG always assigns the NSAPI value 15. For simultaneous GPRS and WLAN
connection with the same GGSN, if the UE uses NSAPI 15 for GPRS PDP context then context replacement will occur
at the GGSN.
Routing Area Identification Encoding
The Routing Area Identification (RAI) is encoded using PLMN-ID in “3GPP-SGSN-MCC-MNC”, if received in
Accounting-Start/Interim. Otherwise, the RAI is encoded using the MCC MNC or PLMN ID configured at the eWAG.
Differentiated Services Code Point Marking
Differentiated Services Code Point (DSCP) levels can be assigned to specific traffic patterns in order to ensure that data
packets are delivered according to the precedence with which they are tagged. The DiffServ markings are applied to the
IP header for every subscriber data packet transmitted in the downlink and/or uplink direction. The four traffic patterns
have the following order of precedence:
1. Background (lowest)
2. Interactive
3. Streaming
4. Conversational (highest)
In addition, for class type Interactive, further categorization is done in combination with traffic handling priority and
allocation-retention priority. Data packets falling under the category of each of the traffic patterns are tagged with a
DSCP marking. Each traffic class is mapped to QCI value according to mapping mentioned in TS 23.203. Therefore,
DSCP values must be configured for different QCI values. The following table lists mapping for traffic class to QCI.

Enhanced Wireless Access Gateway Overview
▀Feature Description
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
14
OL-28188-02
Table 1. Traffic Class to QCI Mapping
GPRS QoS Class Identifier Value
UMTS QoS Parameters
Traffic Class
THP
Signalling Indication
Source Statistics Descriptor
1
Conversational
N/A
N/A
speech
2
Conversational
N/A
N/A
unknown
3
Streaming
N/A
N/A
speech
4
Streaming
N/A
N/A
unknown
5
Interactive
1
Yes
N/A
6
Interactive
1
No
N/A
7
Interactive
2
No
N/A
8
Interactive
3
No
N/A
9
Background
N/A
N/A
N/A
For the downlink path, DSCP markings can be configured to control the DSCP markings for downlink packets. IP
header of the packet is updated with the value in TOS field. Note that there is no tunnel at access side in eWAG, hence
TOS field in subscriber IP packet is marked with DSCP value directly.
For uplink traffic—traffic from eWAG to GGSN through GTP tunnel—DSCP markings can be configured. In this case,
only outer IP header is used to routing the packet over Gn’ interface. Hence, TOS field of only outer IP header is
changed, that is subscriber packet is not marked with DSCP value at eWAG.
DSCP marking can be configured with a “pass through” option, which when configured uses the marking received on
the ingress to mark packets on egress.
Access Point Name Selection
eWAG selects Access Point Name (APN) in the following manner:
If the “Called-Station-ID” AVP is populated in the Accounting-Start Request received and the corresponding
APN is configured at eWAG, this APN is selected and call is accepted.
If the “Called-Station-ID” AVP is populated in the Accounting-Start Request received and the corresponding
APN is not configured at eWAG, the call is dropped.
If “Called-Station-ID” AVP is not populated in the Accounting-Start Request received, it is checked if the
default APN name is configured in the profile in service configuration. If that default APN is configured in
eWAG, the call is accepted.
If the “Called-Station-ID” AVP is not populated in the Accounting-Start request received, it is checked if the
default APN name is configured in the profile in service configuration. If that default APN is not configured,
the call is dropped.
Important: Note that in all cases only the NI part (as in the APN definition) needs to be specified as APN name
in eWAG.

Enhanced Wireless Access Gateway Overview
Feature Description ▀
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
15
Quality of Service Profile Selection
If the “3GPP-GPRS-Negotiated-QoS-Profile” AVP is not supplied in Accounting-Start Request message, a default
Quality of Service (QoS) profile is used. This value is hardcoded to maximum values in the QoS profile as defined in TS
24.008.
GGSN Selection
In this release, eWAG assumes the presence of Operator Identifier (OI) in “mncXXX.mccYYY.gprs” format in APN
received in the “Called-Station-ID” AVP. However, no validation of the presence of OI is made. The “Called-Station-
Id” AVP content is sent to DNS for GGSN IP address resolution without any modification. The same is applicable if the
“Called-Station-Id” AVP is not present and the default APN configuration in the eWAG service is used. Note that in
both these cases only the Network Identifier (NI) part has to be configured as APN at eWAG.
GGSN Failover Case
Important: In this release, GGSN Failover Support is not fully qualified and is not supported, it is available only
for lab / testing purposes.
In case the DNS server returns more than one GGSN address for the given APN, and if Create PDP Context Request to
GGSN fails due to the GGSN being unreachable, then the next GGSN address from the list of addresses will be tried.
The next GGSN address will also be tried in case the GGSN rejects Create PDP Context Request due to any of the
following reasons:
No resources available
All dynamic PDP addresses are occupied
No memory available
Missing or unknown APN
System failure
Unknown PDP address or PDP type
All decode errors at peer, such as “Mandatory IE incorrect”, “Mandatory IE missing”, “Optional IE incorrect”,
and “Invalid message format”
The next GGSN will be tried until either the address list is exhausted or PDP context activation succeeds. Note that the
eWAG is concerned with only the first five reasons from the above list to retry the next GGSN.
The maximum limit for the number of GGSN addresses that can be retried is 31.

Enhanced Wireless Access Gateway Overview
▀Feature Description
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
16
OL-28188-02
Network Address Translation and Application Level Gateway Support
For the interworking between trusted WLANs and 3G MPC, the eWAG uses Network Address Translation (NAT) in-
line service support to map Wi-Fi IP addresses to MPC IP addresses and vice versa.
A UE connected to Wi-Fi has IP address allocated from Wi-Fi. It will also have another IP address allocated from the
MPC. The translation involves remapping of the Wi-Fi IP address to the MPC IP address and vice versa in the IP header
as well as in the payload (Application Level Gateway (ALG)).
On successful creation of the GTP tunnel, the eWAG creates the association between the GGSN-assigned IP address
and the Wi-Fi IP address with static NAT support. The binding between the Wi-Fi IP address and GGSN IP address for
a subscriber is maintained by eWAG/NAT.
In the uplink direction, the eWAG accepts Layer 3 Wi-Fi packets, which are translated by NAT. The Source IP address,
which is the Wi-Fi IP address, is translated to the GGSN-assigned IP address. The translated packet is then encapsulated
into GTP tunnel and forwarded to the GGSN.
In the downlink direction, the eWAG de-capsulates the GTP packets and translates the destination IP address, which is
the GGSN IP address, to the Wi-Fi IP address and then forwards the packets to the Wi-Fi network.
The eWAG + NAT/ALG supports the ability to apply the FTP, SIP, RTSP, PPTP, and H323 ALG on the subscriber's IP
flows.
Important: eWAG call requires NAT configuration. Without NAT, eWAG call will not setup. For NAT/ALG,
eWAG service configuration requires rulebase configuration with NAT ALG enabled, IN and OUT ACL in APN, and
Firewall-and-NAT policy specified in the APN or rulebase. For eWAG + GGSN combo deployments, virtual-APN
configuration is required to separate the rulebases required for eWAG (for NAT) and GGSN (for DPI, NAT, P2P, and
others).
Virtual APN Support
The Virtual APN feature allows operators to use a single APN to configure differentiated services. The APN that is
supplied by the eWAG is evaluated by the GGSN in conjunction with configurable parameters. Then the GGSN selects
an APN configuration based on the supplied APN and those configurable parameters.
Important: For eWAG + GGSN combo deployments, the virtual-APN configuration is required to ensure that
the rulebases required for eWAG (for NAT) and GGSN (for DPI, NAT, P2P, and others) work without any issues. For
more information on virtual-APN support in eWAG + GGSN combo deployments refer to the Dependencies and
Limitations section.

Enhanced Wireless Access Gateway Overview
Feature Description ▀
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
17
UE Identity and Location Information Support
The eWAG supports sending UE identity and location information to the GGSN, which the GGSN can use for Lawful
Intercept support.
UE Identity Information Support
The eWAG receives UE identity information from the Wi-Fi AAA in the optional “SN-WLAN-UE-Identifier” AVP
included in Accounting-Start/Accounting-Interim message from the WLC. The eWAG encodes the UE identity
information into IMEIsV IE of Create PDP Context. The UE identity information is composed of the UE's MAC
address in the “Calling-Station-Id” AVP’s format as per RFC 3580, that is the MAC address in ASCII format (upper
case only), with octet values separated by hyphens. For example, “00-10-A4-23-19-C0”.
Important: Note that eWAG's encoding of the UE MAC address into IMEIsV is not standards based. This is
because the IMEIsV definition only allows values in the range of 0–9. While the MAC address hex values range from
0–F. TBCD encoding used for encoding IMEIsV on GTP allows the range 0–F. Also, when the UE MAC address is
encoded into IMEIsV in TBCD format, MAC address is encoded in the initial six bytes of IMEIsV IE. The last two
bytes get padded with FFFE in TBCD encoding. The last nibble is encoded as 0xE since if the ASR5000 GGSN
encounters F in the last nibble it drops the last byte considering it a filler. As all the 16 ASCII -hex characters have to be
sent to Gx, Gy, and CDR interfaces, the eWAG instead encodes the last two bytes as FFFE.
Important: Note that the “SN-WLAN-UE-Identifier” AVP is available only in the “starent” RADIUS dictionary.
Therefore, UE Identity Information support is available only if eWAG uses the “starent” RADIUS dictionary, if not
eWAG will ignore the AVP.
UE Location Information Support
The eWAG receives the access point identity information from the Wi-Fi AAA in the optional “SN-WLAN-AP-
Identifier” AVP included in Accounting-Start message from the WLC. The eWAG encodes this access point identity
information into ULI IE of Create PDP Context. In Accounting-Interim, if a new AP identifier is provided it is sent to
the GGSN in ULI IE of Update PDP Context. The access point identity is composed of the Location Area Code Cell
Identity (LAC_CI) —that is, Location Area Code (LAC) and Cell Id (CI) separated by an underscore. For example, if
the access point is assigned LAC = 123 and CI = 56789, then SN-WLAN-AP-Identifier AVP will contain 123_56789.
Important: Note that the “SN-WLAN-AP-Identifier” AVP is available only in the “starent” RADIUS dictionary.
Therefore, UE Location Information support is available only if eWAG uses the “starent” RADIUS dictionary, if not
eWAG will ignore the AVP.

Enhanced Wireless Access Gateway Overview
▀Feature Description
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
18
OL-28188-02
Bulk Statistics Support
The system's support for bulk statistics allows operators to choose to view not only statistics that are of importance to
them, but also to configure the format in which it is presented. This simplifies the post-processing of statistical data
since it can be formatted to be parsed by external, back-end processors.
When used in conjunction with the Web Element Manager, the data can be parsed, archived, and graphed.
The system can be configured to collect bulk statistics (performance data) and send them to a collection server (called a
receiver). Bulk statistics are statistics that are collected in a group. The individual statistics are grouped by schema.
For the list of supported schema and information on how to configure them, refer to the Enhanced Wireless Access
Gateway Configuration chapter.
The system supports the configuration of up to four sets (primary/secondary) of receivers. Each set can be configured
with to collect specific sets of statistics from the various schema. Statistics can be pulled manually from the system or
sent at configured intervals. The bulk statistics are stored on the receiver(s) in files.
The format of the bulk statistic data files can are configurable, operators can specify the format of the file name, file
headers, and/or footers to include information such as the date, system host name, system uptime, the IP address of the
system generating the statistics (available for only for headers and footers), and/or the time that the file was generated.
When the Web Element Manager is used as the receiver, it is capable of further processing the statistics data through
XML parsing, archiving, and graphing.
The Bulk Statistics Server component of the Web Element Manager parses collected statistics and stores the information
in the PostgreSQL database. If XML file generation and transfer is required, this element generates the XML output and
can send it to a Northbound NMS or an alternate bulk statistics server for further processing.
Additionally, if archiving of the collected statistics is desired, the Bulk Statistics server writes the files to an alternative
directory on the server. A specific directory can be configured by the administrative subscriber or the default directory
can be used. Regardless, the directory can be on a local file system or on an NFS-mounted file system on the Web
Element Manager server.
Important: For more information on bulk statistic configuration, refer to the Configuring and Maintaining Bulk
Statistics chapter in the System Administration Guide.
Threshold Crossing Alerts Support
Thresholding on the system is used to monitor the system for conditions that could potentially cause errors or outage.
Typically, these conditions are temporary (i.e. high CPU utilization, or packet collisions on a network) and are quickly
resolved. However, continuous or large numbers of these error conditions within a specific time interval may be
indicative of larger, more severe issues. The purpose of thresholding is to help identify potentially severe conditions so
that immediate action can be taken to minimize and/or avoid system downtime.
There are no eWAG- or IPSG-specific thresholds available. However, thresholds for generic total/active sessions, call
setup/failure, license-level, system resource utilization like port/CPU, and others work with eWAG. With this capability,
operators can configure threshold on these resources whereby, should resource depletion cross the configured threshold,
an SNMP Trap will be sent.

Enhanced Wireless Access Gateway Overview
Feature Description ▀
Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide ▄
OL-28188-02
19
The following thresholding models are supported by the system:
Alert: A value is monitored and an alert condition occurs when the value reaches or exceeds the configured high
threshold within the specified polling interval. The alert is generated then generated and/or sent at the end of
the polling interval.
Alarm: Both high and low threshold are defined for a value. An alarm condition occurs when the value reaches
or exceeds the configured high threshold within the specified polling interval. The alert is generated then
generated and/or sent at the end of the polling interval.
Thresholding reports conditions using one of the following mechanisms:
SNMP traps: SNMP traps have been created that indicate the condition (high threshold crossing and/or clear) of
each of the monitored values.
Generation of specific traps can be enabled or disabled on the chassis. Ensuring that only important faults get
displayed. SNMP traps are supported in both Alert and Alarm modes.
Logs: The system provides a facility called threshold for which active and event logs can be generated. As with
other system facilities, logs are generated. Log messages pertaining to the condition of a monitored value are
generated with a severity level of WARNING.
Logs are supported in both the Alert and the Alarm models.
Alarm System: High threshold alarms generated within the specified polling interval are considered
“outstanding” until a the condition no longer exists or a condition clear alarm is generated. “Outstanding”
alarms are reported to the system's alarm subsystem and are viewable through the Alarm Management menu in
the Web Element Manager.
The Alarm System is used only in conjunction with the Alarm model.
Important: For more information on thresholds, refer to the Thresholding Configuration Guide.
Congestion Control Support
The Congestion Control feature enables to specify how the system reacts in a heavy load condition. Congestion control
operation is based on configuring congestion condition thresholds and service congestion policies.
Important: Overload Disconnect is not supported.
Congestion Control monitors the system for conditions that could potentially degrade performance when the system is
under heavy load. Typically, these conditions are temporary (for example, high CPU or memory utilization) and are
quickly resolved. However, continuous or large numbers of these conditions within a specific time interval may have an
impact the system’s ability to service subscriber sessions. Congestion control helps identify such conditions and invokes
policies for addressing the situation.
Congestion control operation is based on configuring the following:
Congestion Condition Thresholds: Thresholds dictate the conditions for which congestion control is enabled
and establishes limits for defining the state of the system (congested or clear). These thresholds function in a
way similar to operation thresholds that are configured for the system as described in the Thresholding
Configuration Guide. The primary difference is that when congestion thresholds are reached, a service
congestion policy and an SNMP trap are generated.
A threshold tolerance dictates the percentage under the configured threshold that must be reached in order for
the condition to be cleared. An SNMP trap is then triggered.

Enhanced Wireless Access Gateway Overview
▀Feature Description
▄Cisco ASR 5000 Enhanced Wireless Access Gateway Administration Guide
20
OL-28188-02
Port Utilization Thresholds: Congestion thresholds for utilization of all ports in the system.
Port-specific Thresholds: Congestion thresholds for individual ports.
Service Congestion Policies: Congestion policies are configurable for each service. These policies
dictate how services respond when the system detects that a congestion condition threshold has been
crossed.
License Utilization: Congestion thresholds for license utilization on the system.
Maximum Sessions-per-Service Utilization: Congestion thresholds for maximum number of sessions
allowed per service.
Important: For more information on Congestion Control feature, refer to the Congestion Control chapter in the
System Administration Guide.
Redundancy Support
Important: In this release, eWAG supports basic Session Recovery, ICSR is not supported.
Session Recovery feature provides a mechanism to recover failed Session Manager (SessMgr) task(s) without any call
loss. Recovery framework is same as used by other products. A minimum of four PSCs (three active and one standby) is
required in an ASR 5000 chassis to support the Session Recovery feature. This is because the DEMUX Manager and
VPN Manager tasks run on a PSC where no SessMgr runs when session recovery is enabled and one PSC is used as
standby PSC. The other two PSCs run SessMgr and AAAMgr tasks.
Session Recovery is a licensed feature and can be controlled from the CLI, that is enabled/disabled Session Recovery
across the whole chassis. When the CLI is used to configure the Session Recovery feature, Session Controller updates
each SessMgr task.
In the case of eWAG, the IPSG Manager, SGTPC Manager, and VPN Manager run on one PSC. SessMgr runs on one
separate PSC. AAAMgr runs on one separate PSC and on one standby PSC. Therefore, a minimum of four PSCs (three
active and one standby) are required.
For eWAG Session Recovery support, existing IPSG Session Recovery framework is reused for recovering access side
attributes common between IPSG and eWAG sessions. New fields are added in IPSG Session Recovery record to
recover attributes specific to eWAG session such as WLAN IP address, MPC IP address, eWAG GTP information, and
so on. eWAG GTP context information will be recovered similar to TTG since Gn' interface is used by both.