Eric Lajoie's Contact Information

Wed, 07 Dec 2011 14:31:36 -0500

...

Eric Lajoie
Network Consulting Engineer
elajoie@ericlajoie.com
Mobile: +491717411510

Cisco IOS AnyConnect WebVPN

Sun, 04 Dec 2011 08:29:47 -0500

This HOWTO is based off Cisco's GUI based method and is only focused on CLI method. Click on read more to see the whole tutorial.


#Add DYNDNS Service
ip ddns update method DYNDNS
 HTTP
#User ctrl-v to insert the ? mark
  add http://username:password@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
  remove http://username:password@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
 interval maximum 28 0 0 0
!
#On Wan Interface
 ip ddns update hostname <hostname.domainname>
 ip ddns update DYNDNS host members.dyndns.org
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login WebVPN local
aaa authorization exec default local
!
!
crypto pki trustpoint WebVPN-TP
 enrollment selfsigned
 subject-name cn=WebVPN-TP
 revocation-check none
 rsakeypair WebVPN-TP
!
!
crypto pki enroll WebVPN-TP
# Answer No, No, Yes
!
username test privilege 15 password 0 test
!
!
ip local pool new 172.17.200.80 172.17.200.89
ip http server
ip http authentication local
ip http secure-server
!
webvpn gateway GW
 ip interface <wan interface> port 443
 http-redirect port 80
 ssl trustpoint WebVPN-TP
 inservice
 !
#Download pkg files
webvpn install svc flash:/webvpn/svc_1.pkg sequence 1
 !
webvpn context WebVPN-HOME
 secondary-color white
 title-color #CCCC66
 text-color black
 ssl authenticate verify all
 !
 !
 policy group WebVPN-Policy
   functions svc-enabled
   svc address-pool "WebVPN"
   svc dns-server primary 4.2.2.2
 default-group-policy WebVPN-Policy
 aaa authentication list WebVPN
 gateway GW
 max-users 10
 inservice
 ...

LTE Node Selection - DNS

Sun, 04 Dec 2011 07:51:46 -0500

This LTE DNS HOWTO assumes you have Googled the basic setup of your BIND service and master/slave deployment. We will only focus on the 3GPP aspect of the zone file and how you can use it with an ASR5000. The 3GPP specification 29.303 Annex A4.3(S10) Annex 4.11(S11 and S5), 23.003, RFC 2915, and RFC 3958(2.2.3)are the main references used in this HOWTO.

Basic DNS Syntax

Below we show the basic header of a zone file and what each element is and how to use it.

In the beginning you will see an $ORIGIN epc.mnc111.mcc222.3gppnetwork.org. value. Every record in the zone file that does not end with a dot will automatically inherit the $ORIGIN value. For example the record foobar does not contain a trailing dot so the BIND service would read it as http://foobar.epc.mnc111.mcc222.3gppnetwork.org. On the other hand if the record was foobar., BIND would read this as foobar and nothing else.
```
$ORIGIN epc.mnc111.mcc222.3gppnetwork.org.
```

Now the next item in the top of your zone file will be the TTL field. The TTL is sent to the DNS client of the ASR5000 to let it know when the data expires and it need to do a new DNS query. Please note this TTL value can be overwritten locally on the ASR5000 via the TTL command in the DNS client configuration section.
```
$TTL    1800
```

For the Start of Authority(SOA) you can refer to the zone file snippet used for EPC below. Note that the email in dot form root is just the root user for the system and will likely be different for your deployment.

@       IN      SOA     ns      root (
                                1       ; Serial
                                3600    ; Refresh
                                30      ; Retry
                                3600    ; Expire
                                600 )   ; Negative Cache TTL

Name Authority Pointer (NAPTR) for us will only use two flag types (A & S) which is called S-NAPTR or Straightforward-NAPTR. In S-NAPTR you will see many service types which are all defined in 23.003 section 19.4.3 "Service and Protocol service names for 3GPP". The first number in the S-NAPTR RR after the word NAPTR is Order and the second number is Preference.

Note that since we have S-NAPTR with flag type "s" for our TAI resolution and gw-selection is co-location, we will not use order or preference in selection criteria unless we have multiple best matches in which case lowest order value will trump

;TAI S-NAPTR
;South:
tac-lb01.tac-hb00.tac IN NAPTR 100  100  "s" "x-3gpp-sgw:x-s5-gtp" "" _sgw._south
tac-lb02.tac-hb00.tac IN NAPTR 100  100  "s" "x-3gpp-sgw:x-s5-gtp" "" _sgw._south
; North:
tac-lbed.tac-hb77.tac IN NAPTR 100  100  "s" "x-3gpp-sgw:x-s5-gtp" "" _sgw._north

; APN NAPTR
;APN's on only one PGW
apnName1.apn   IN NAPTR 100  100  "a" "x-3gpp-pgw:x-s5-gtp" "" topon.s5-pgw.nodeName1.site1.north
apnName2.apn   IN NAPTR 100  100  "a" "x-3gpp-pgw:x-s5-gtp" "" topon.s5-pgw.nodeName2.site2.north
apnName3.apn   IN NAPTR 100  100  "a" "x-3gpp-pgw:x-s5-gtp" "" topon.s5-pgw.nodeName3.site3.south
apnName4.apn   IN NAPTR 100  100  "a" "x-3gpp-pgw:x-s5-gtp" "" topon.s5-pgw.nodeName4.site4.south

;Common APN on all PGW's
apnName.apn  IN NAPTR 100  100  "s" "x-3gpp-pgw:x-s5-gtp" "" _nodes._pgw

Service(SRV) records give you the ability to load balance and set destination port numbers. The first number in the SVR record after the word SRV is Priority and the second number is Weight.

Note that when we have multiple best matches with equal order values in the S-NAPTR record then we can use priority in the SRV record to decide how to load balance across them.

;SRV Records for SGW
;North
_sgw._north 1800 IN SRV 20 100 2123 topon.s5-sgw.nodeName1.site1.north
_sgw._north 1800 IN SRV 20 100 2123 topon.s5-sgw.nodeName2.site2.north
_sgw._north 1800 IN SRV 30 100 2123 topon.s5-sgw.nodeName3.site3.south
_sgw._north 1800 IN SRV 30 100 2123 topon.s5-sgw.nodeName4.site4.south
;South
_sgw._south 1800 IN SRV 20 100 2123 topon.s5-sgw.nodeName3.site3.south
_sgw._south 1800 IN SRV 20 100 2123 topon.s5-sgw.nodeName4.site4.south
_sgw._south 1800 IN SRV 30 100 2123 topon.s5-sgw.nodeName1.site1.north
_sgw._south 1800 IN SRV 30 100 2123 topon.s5-sgw.nodeName2.site2.north

;SRV Records for PGW
;PGW, Equal weight for common apn's. TTL 1800. Port gtp-c v2 is 2123
_nodes._pgw 1800 IN SRV 50 100 2123 topon.s5-pgw.nodeName1.site1.north
_nodes._pgw 1800 IN SRV 50 100 2123 topon.s5-pgw.nodeName2.site2.north
_nodes._pgw 1800 IN SRV 50 100 2123 topon.s5-pgw.nodeName3.site3.south
_nodes._pgw 1800 IN SRV 50 100 2123 topon.s5-pgw.nodeName4.site4.south

A or AAAA are the final record pointing to the IP address of node.

We are still trying to confirm why MME looks up service type "x-3gpp-sgw:x-s5-gtp" when we would think "x-3gpp-sgw:x-s11-gtp". The only evidence supporting the current method is in 3GPP specification 29.303 Annex A.4.11.

;A records for PGW
;S5
topon.s5-pgw.nodeName1.site1.north IN A  1.1.1.1
topon.s5-pgw.nodeName2.site2.north IN A  2.2.2.2
topon.s5-pgw.nodeName3.site3.south IN A  3.3.3.3
topon.s5-pgw.nodeName4.site4.south IN A  4.4.4.4

;A records for SGW
;S5 - these are actually SGW S11 addresses
topon.s5-sgw.nodeName1.site1.north IN A  5.5.5.5
topon.s5-sgw.nodeName2.site2.north IN A  6.6.6.6
topon.s5-sgw.nodeName3.site3.south IN A  7.7.7.7
topon.s5-sgw.nodeName4.site4.south IN A  8.8.8.8
;S11
topon.s11-sgw.nodeName1.site1.north IN A  5.5.5.5
topon.s11-sgw.nodeName2.site2.north IN A  6.6.6.6
topon.s11-sgw.nodeName3.site3.south IN A  7.7.7.7
topon.s11-sgw.nodeName4.site4.south IN A  8.8.8.8

Basic MME Configuration (co-location)

Below you will find basic MME configuration to support node selection plus static selection in the event DNS/BIND is down or unreachable. The top element in the structure is the lte-policy/subscriber-map which calls the operator-policy. Then the operator-policy calls the call-control-profile and apn-profile. The call-control-profile below is used to say "use dns look up for both SGW and PGW selection" and if DNS is down use static list TMD1. The static tai management DB is also used to define TA Lists that are sent to UE to inform it about the TA is can move between before it needs to perform a TAU. The important part in the call-control-profile for node selection is the use of gw-selection co-location which tells the MME to use best match of SGW and PGW with topon and longest conical name match. In the example above we would match conical names up to the nodeName# portion of the FQDN. The apn-profile is used for static PGW assignment for when DNS is unreachable.

Please note that if the DNS client gets multiple answers with equal order or preference and we have round-robin-answers enabled in the client, we will round robin across the results on a per service/PCS2 basis. This may result in what looks broken functionality as the first results may get used always until all session managers have done so and move on to next result.

context local
  operator-policy name OP1
    associate call-control-profile CCP1
    apn default-apn-profile AP1
  #exit

  call-control-profile CCP1
    dns-sgw context GP-GN
    dns-pgw context GP-GN
    gw-selection co-location
    associate tai-mgmt-db TMD1
  #exit
  apn-profile AP1
    pgw-address 1.1.1.1
    pgw-address 2.2.2.2
    pgw-address 3.3.3.3
    pgw-address 4.4.4.4
  #exit

context S1
    mme-service MME-SVC
      associate subscriber-map SM1
    exit

context GP-GN
    ip domain-lookup
    ip name-servers 9.9.9.9 10.10.10.10
    dns-client DNS
      bind address 11.11.11.11
      round-robin-answers
    #exit

GlobalConfig
  lte-policy
    subscriber-map SM1
      precedence 1 match-criteria all operator-policy-name OP1
    exit
    tai-mgmt-db TMD1
      tai-mgmt-obj TMO1
        tai mcc 111 mnc  222 tac 1
        sgw-address 5.5.5.5 s5-s8-protocol gtp weight 100
        sgw-address 6.6.6.6 s5-s8-protocol gtp weight 100
        sgw-address 7.7.7.7 s5-s8-protocol gtp weight 100
        sgw-address 8.8.8.8 s5-s8-protocol gtp weight 100
      #exit
      tai-mgmt-obj TMO2
        tai mcc 111 mnc  222 tac 2
        sgw-address 5.5.5.5 s5-s8-protocol gtp weight 100
        sgw-address 6.6.6.6 s5-s8-protocol gtp weight 100
        sgw-address 7.7.7.7 s5-s8-protocol gtp weight 100
        sgw-address 8.8.8.8 s5-s8-protocol gtp weight 100
      #exit
      tai-mgmt-obj TMO30701
        tai mcc 111 mnc  222 tac 30701
        sgw-address 5.5.5.5 s5-s8-protocol gtp weight 100
        sgw-address 6.6.6.6 s5-s8-protocol gtp weight 100
        sgw-address 7.7.7.7 s5-s8-protocol gtp weight 100
        sgw-address 8.8.8.8 s5-s8-protocol gtp weight 100
      #exit

Gateway Selection Logic

Below we detail the four different gateway selection criteria available in IOS-M R12.0.

gw-selection { co-location | pgw weight | sgw weight | topology }

co-location

co-location as the determining factor for gateway selection.

What this means: The MME does not take NAPTR preference into account but will use order (and priority of SRV during s flag) when we have multiple topon records with highest conical match in NAPTR with flag type "a or s". This option looks at both topon and topoff by the MME DNS client.

P/SGW retries are configured in egtp service
P/SGW fallback happens four times per subscriber to the selected nodes equaling total of 5 nodes attempted before reject.
If order and priority are all equal and round-robin is configured, the MME will use a list for each session to manager per PSC card(assuming 10 matches) round robin as follows 1,2,3,4,5 to each card for its first sub. Then 2,3,4,5,6 for all PSC cards for it next subscriber and so one as subs get round robin-ed on a per PSC bases.
PGW selection uses Order/Priority on PGW only when more than one PGW is available and only one SGW is available.

Record Type	Flag	Metric Type	Is it Used?
NAPTR	s	Order	Yes, only when DNS returns two or more SGW RRs FQDN length as a tie breaker
NAPTR	s	Preference	No
NAPTR	a	Order	Yes, only when DNS returns two or more SGW RRs FQDN length as a tie breaker
NAPTR	a	Preference	No
SRV	N/A	Priority	Yes, only when DNS returns two or more SGW RRs FQDN length as a tie breaker
SRV	N/A	Weight	Yes, When multiple equal length longest matches are returned, this value dictates what percent each will be load balanced. For example if you have two results with priority of 20 and 80 then the 20 result will get 20% of bearer requests and the other will bet 80% per session manager.

pgw weight

pgw weight as the determining factor for gateway selection.

What this means: Need to figure out logic especially when S-NAPTR is flag type "a" where weight is not available

Record Type	Flag	Metric Type	Is it Used?
S-NAPTR	s	Order	?
S-NAPTR	s	Preference	?
S-NAPTR	a	Order	?
S-NAPTR	a	Preference	?
SRV	N/A	Priority	?
SRV	N/A	Weight	?

sgw weight

serving gateway as the determining factor for gateway selection.

What this means: Need to figure out logic especially when S-NAPTR is flag type "a" where weight is not available

Record Type	Flag	Metric Type	Is it Used?
S-NAPTR	s	Order	?
S-NAPTR	s	Preference	?
S-NAPTR	a	Order	?
S-NAPTR	a	Preference	?
SRV	N/A	Priority	?
SRV	N/A	Weight	?

topology

topology as the determining factor for gateway selection.

What this means: Need to figure out how topon anf topoff relate in the selection method...

Record Type	Flag	Metric Type	Is it Used?
S-NAPTR	s	Order	?
S-NAPTR	s	Preference	?
S-NAPTR	a	Order	?
S-NAPTR	a	Preference	?
SRV	N/A	Priority	?
SRV	N/A	Weight	?

Service Types

Description	IETF RFC 3958 section 6.5 'app-service' name	IETF RFC 3958 section 6.5 'app-protocol' name
PGW and interface types supported by the PGW	x-3gpp-pgw	x-s5-gtp x-s5-pmip x-s8-gtp x-s8-pmip x-s2a-pmip x-s2a-mipv4 x-s2b-pmip x-s2cdsmip x-gn x-gp
SGW and interface types supported by the SGW	x-3gpp-sgw	x-s5-gtp x-s5-pmip x-s8-gtp x-s8-pmip x-s11 x-s12 x-s4 x-s1-u x-s2a-pmip x-s2b-pmip
GGSN	x-3gpp-ggsn	x-gn x-gp
SGSN	x-3gpp-sgsn	x-gn x-gp x-s4 x-s3 x-s16
MME and interface types supported by the MME	x-3gpp-mme	x-s10 x-s11 x-s3 x-s6a x-s1-mme x-gn x-gp

Additional Information

From 3GPP Specification 23.401:
- 5.5.1.1.2 X2-based handover without Serving GW relocation
  "The MME determines that the Serving GW can continue to serve the UE" (this means translates 100% to fact that SGW can handle UEs target TA)
- 5.5.1.1.3 X2-based handover with Serving GW relocation
  "the MME decides that the Serving GW is to be relocated" (this means translates 100% to fact that SGW cannot handle UEs target TA)

Eric's Site

Eric Lajoie's Contact Information

Cisco IOS AnyConnect WebVPN

LTE Node Selection - DNS