Cisco SP Wi-Fi solution: use cases and call flows. Djordje Vulovic Consulting Systems Engineer CCIE #16582

Transcription

1

2 Cisco SP Wi-Fi solution: use cases and call flows Djordje Vulovic Consulting Systems Engineer CCIE #16582

3 Local Breakout using MAC TAL Authentication

4 MAC TAL Authentication Device AP+WLC DHCP ISG QPS Open Association QPS Portal QPS SuM DHCP DHCP ARP IP All subscriber devices MACaddresses are provisioned and activated on the SUM server. Unknown MAC. RADIUS Access Req (username= MAC Framed IP) RADIUS Access Req (username= MAC) RADIUS Access Accept (Service Name) RADIUS Access Accept(Service Name) Check if service configured RADIUS AR/AA (Service Name) Apply service for authenticated user RADIUS Accounting START (Session) RADIUS Accounting START (Session) RADIUS Accounting START (Service) IP

5 Local Breakout using Web Authentication

6 Web Authentication following failed MAC-TAL (1/2) QPS Device AP+WLC DHCP ISG QPS Portal QPS SuM Open Association DHCP DHCP ARP IP All subscriber authentication credentials i.e. username, password, service-name, and device MAC-Address need to be provisioned on the SuM. Unknown MAC. RADIUS Access Req (username= MAC Framed IP) RADIUS Access Req (username= MAC) RADIUS Reject RADIUS Access Reject Apply Open Garden and L4 Redirect Services L4 Redirect to Portal REST API Send branded portal Post username/password credentials REST Authenticate Subscriber API RADIUS COA Req: Account Logon Username, Password REST Session Start API

7 Web Authentication following failed MAC-TAL (2/2) QPS Device AP+WLC DHCP ISG QPS Portal QPS SuM RADIUS Access Req (username and password) RADIUS Access Req (username, password) RADIUS Access Accept (Service Name) RADIUS Access Accept(Service Name) Check if service configured RADIUS AR/AA (Service Name) Apply services for authenticated subscriber RADIUS Accounting START (Session) RADIUS Accounting START (Session) RADIUS Accounting START (Service) RADIUS CoA Ack Account Logon

8 Web Authentication with SMS delivery (1/2) Device AP+WLC ISG QPS QPS Portal QPS SuM SMS GW As per previous examples Apply Open Garden and L4 Redirect Services L4 Redirect to Portal REST API Send branded portal POST MSISDN REST Authenticate MSISDN API RADIUS Access Req (username= MSISDN) RADIUS Access Accept (SMS Code) Deliver Short Message (MSISDN, SMS code and URL) Deliver SMS Deliver Short Message Response

9 Web Authentication with SMS delivery (2/2) Device AP+WLC ISG QPS QPS Portal QPS SuM SMS GW REST MSISDN Validated Renew page asking to enter code POST SMS Code RADIUS COA Req: Account Logon MSISDN, SMS Code REST Session Start API (MSISDN, SMS Code) RADIUS Access Req (MSISDN and SMS Code) RADIUS Access Req (MSISDN, SMS Code) RADIUS Access Accept (Service Name) RADIUS Access Accept(Service Name) Apply services for authenticated subscriber RADIUS Accounting START (Session) RADIUS Accounting START (Session) RADIUS Accounting START (Service) RADIUS CoA Ack Account Logon

10 Local Breakout using EAP Authentication

11 EAP-TTLS-based authentication (1/2)

12 EAP-TTLS-based authentication (2/2)

13 EAP-SIM Call Flow (steps 1-3) SIM-based clients EAPOL Start WLC AAA HLR/AuC EAP Request/Identity EAP Response/Identity EAP Response/Identity calling station ID = MAC, calledstation-id = SSID) EAP Request SIM-Start EAP Response SIM-Start EAP Response/SIM-Start (Nonce) EAP Request/SIM-Start IMSI Ki + RAND A3 A8 SRES Kc n * triplets (SRES, RAND, Kc)

14 EAP-SIM Call Flow (steps 4-6) SIM-based clients WLC EAP Request SIM-Challenge EAP Request/SIM-Challenge (n*rand, MAC) AAA MAC = SHA-1 (EAP Packet Nonce) MK = SHA-1(Identity n*kc Nonce HLR/AuC SIM calculates (n*sres, n*kc) Ki + RAND SIM MAC = SHA-1 (EAP Packet n*sres) A3 A8 K = SHA-1 (Identity n*kc Nonce) SRES Kc EAP Response SIM-Challenge EAP Response/SIM-Challenge (MAC) Comapre received MAC with SHA-1(EAP Packet n*sres) EAP Success EAP Success (MK)

15 Integration to Mobile Core using intelligent Wireless Access Gateway - iwag

16 What is iwag Intelligent Wireless Access Gateway A transport/switching element with ISG Subscriber Awareness Radius-based Authentication and Accounting Policy-based subscriber routing for WiFi wholesale model Ethernet Access with PMIPv6 transport to 4G Mobile Core and with GTP transport to 3G Mobile Core Policy-based subscriber selective offload Provides a transparent access to WLAN users to connect to the 3G or 4G Mobile Packet Core without having any client application installed in the userequipment(ue)

17 iwag models: Authentication and FSOL

18 iwag Deployment Model 1 HLR OCS PCRF CGF AAA DHCP Access Network Policy Gy Gx Ga Mobile Home Network Policy EAP-SIM/AKA Authentication (out-of-band) AP AP WLC FSOL: DHCP Discover GTP ASR1K EWAG Gn GGSN 3G Core L2 Connected Service IP Model # Access Type Authentication FSOL Service IP Internet 1 Layer 2 EAP-SIM/AKA (out-of- band) DHCP Discover GGSN

19 Call Flow WiFi client AP+WLC iwag AAA Vlan connectivity Out of band EAP authentication DHCP Discover [MAC=client-MAC] Access Req [client-mac] Access Accept [IMSI, MSISDN, APN, ssg-service=gtp-svc, etc] Create PDP Req [IP addr= ] Create PDP Resp [IP addr=c.c.c.c] Access Req Access Accept DHCP Offer [client IP =c.c.c.c; server=e.e.e.e] DHCP Req [client requested IP=c.c.c.c; server=e.e.e.e] Regenerate a DHCP offer to send back to the client DHCP ACK [client IP=c.c.c.c; server=e.e.e.e; renewal time ] client s traffic Activate session on DP fully after finding it having a valid IP addr client s traffic tunneled 19

20 iwag Deployment Model 2 HLR OCS PCRF CGF DHCP AAA Access Network Policy Gy Gx Ga Mobile Home Network Policy AP EAP-SIM/AKA Authentication (in-band) AP WLC FSOL: Radius Access Request ASR1K EWAG Gn GTP GGSN 3G Core Service IP L2 Connected Model # Access Type Authentication FSOL Service IP Internet 2 Layer 2 EAP-SIM/AKA (inband) Radius GGSN

21 Encap/decap EAP into/from Radius message Call flow (1/2) WiFi client AP+WLC Vlan connectivity AAA EAP Start EAP-Req/ID EAP-Resp/ID Access Req [EAP-Resp/ID] EAP-Req/SIM/Start EAP-Resp/SIM/Start EAP-Req/SIM/ Challenge EAP-Resp/SIM/ Challenge Access Accept [EAP-Req/SIM/Start] Access Req [EAP-Resp/SIM/Start] Access Accept [EAP-Req/SIM/Challenge] Access Req [EAP-Resp/SIM/Challenge] Detect Radius proxy in L2 as FSoL; create new ISG session Access Req [EAP-Resp/ID; NAS=e.e.e.e] Access Accept [EAP-Req/SIM/Start] Access Req [EAP-Resp/SIM/Start] Access Accept [EAP-Req/SIM/Challenge] Access Req [EAP-Resp/SIM/Challenge] Access Accept [EAP-Success; MAC, IMSI, MSISDN, APN, ssg-service=gtp-svc, etc] EAP-Success Access Accept [EAP-Success] Cache the downloaded user info, esp including client-mac, IMSI, MSISDN, GTP-svc Accounting Start Accounting Accept

22 Call flow (2/2) WiFi client AP+WLC AAA Vlan connectivity DHCP Discover [client MAC=MAC] Detect DHCP for an existing ISG session; regen GTP Create PDP Req [IP addr= ] Access Req DHCP Offer [client IP =c.c.c.c; server=e.e.e.e] Regenerate a DHCP offer to send back to the client Create PDP Resp [IP addr=c.c.c.c] Access Accept Accounting Start Accounting Accept DHCP Req [client requested IP=c.c.c.c; server=e.e.e.e] DHCP ACK [client IP=c.c.c.c; server=e.e.e.e; renewal time ] Client has valid addr c.c.c.c client s traffic Activate session on DP fully after finding it having a valid IP addr client s traffic tunneled

23 iwag Deployment Model 3 HLR OCS PCRF CGF DHCP AAA Portal Access Network Policy Gy Gx Ga Mobile Home Network Policy User name/password AP AP Web Logon Authentication L2 Connected WLC FSOL: Unclassified MAC ASR1K iwag Gn GTP Service IP GGSN 3G Core Model # Access Type Authentication FSOL Service IP Internet 3 Layer 2 Web Logon Unclassified MAC GGSN

24 Call flow (1/3) WiFi client AP+WLC DHCP Discover (broadcast) Vlan connectivity DHCP Discover (unicast on VLAN based on SSID) DHCP Offer (unicast to client) DHCP Offer [client IP=c.c.c.c; server=d.d.d.d] DHCP Req [client requested IP=c.c.c.c; server=d.d.d.d] DHCP ACK [client IP=c.c.c.c; server=d.d.d.d; renewal time ] ARP Req (broadcast) ARP Resp [Src MAC=iWAG-MAC; Dst MAC=Client-MAC] DHCP Req [client requested IP=c.c.c.c; server=d.d.d.d] DHCP ACK [client IP=c.c.c.c; server=d.d.d.d; renewal time ] ARP Req (broadcast on VLAN for SSID) [Src MAC=WLC-MAC] ARP Resp [Src MAC=iWAG-MAC; Dst MAC=WLC-MAC] Client has a valid IP addr & DHCP server addr Client has iwag s MAC addr and e.e.e.e as GW addr DNS Req [Src MAC=client-MAC; Src IP=c.c.c.c; Dst MAC=iWAG-MAC; Dst IP=e.e.e.e] Detect unclassified MAC addr > iwag creates unauth session

25 Call flow (2/3) WiFi AAA DNS Access Req (download control policies for OG & L4Redirect) Access Accept Apply OG policy Access Req (for MAC TAL) Access Rej Apply unauth timer & L4Redirect DNS Resp [Src MAC=EWAG-MAC; Src IP=e.e.e.e; Dst MAC=client-MAC; Dst IP=c.c.c.c] DNS Req (permitted by OG) DNS Resp HTTP Req [Src IP= c.c.c.c; Dst IP=public addr w.w.w.w; Dst MAC=EWAG-MAC] HTTP Resp [Src IP=p.p.p.p; Dst IP=c.c.c.c] w.w.w.w not part of OG; L4Redirect to p.p.p.p HTTP Login Credential [Src IP=c.c.c.c; Dst IP==p.p.p.p] HTTP Req (L4Redirected) [Src IP=e.e.e.e; Dst IP=p.p.p.p] HTTP Resp [Src IP=p.p.p.p; Dst IP=e.e.e.e] HTTP Login credential [Src IP==e.e.e.e; Dst IP==p.p.p.p]

26 Call flow (3/3) WiFi AAA CoA Req/Acct-logon [username/pwd] Detect acct-logon event; trigger user authen for username/pwd Access Req [username/pwd] HTTP Resp [Src IP=p.p.p.p; Dst IP=c.c.c.c] Access Accept [IMSI, MSISDN, APN, GTP-svc, etc] CoA ACK/Acct-logon [username/pwd] HTTP Login Resp [Src IP=p.p.p.p; Dst IP=e.e.e.e] Client fully authenticated; remove OG & L4Redirect; regen GTP PDP context & tunnel Create PDP Req [PDP addr=c.c.c.c] Create PDP Resp [PDP addr=c.c.c.c] Access Req Access Accept Activate session on DP fully Accounting Start Accounting Accept client s traffic client s traffic tunneled

27 3G / 4G Mobile user Radius profiles subscriber-profile gtp1 { access-accept { cisco-avpair { "cisco-mn-service=ipv4" } cisco-avpair { "cisco-mpc-protocol-interface=gtpv1" } cisco-avpair { "cisco-service-selection=cisco1.com" } cisco-avpair { "cisco-msisdn= " } 3gpp { imsi } } } 3G mobile user RADIUS profile GTP based 4G mobile user RADIUS profile PMIPv6 based subscriber-profile pmip { access-accept { reply-msg "Default profile cisco-avpair { "mn-service=ipv4" } cisco-avpair { "home-lma=lma1" } cisco-avpair { "cisco-mpc-protocol-interface=pmipv6" } cisco-avpair { "home-lma-ipv6-address=9::2" } cisco-avpair { "cisco-downlink-gre-key=100" } cisco-avpair { "cisco-uplink-gre-key=100" } 3gpp { mn-nai { username mn domain-name cisco.com start-at 1 } } } }

28 Integration to Mobile Core using enhanced Wireless Access Gateway - ewag

29 ReWAG Home HSS internet AAA GGSN Gn GTPv1 Radius triggered (ReWAG) 1- UE authenticated by AAA (EAP-SIM) 2- UE gets WiFi IP address from DHCP Packet Core ewag 3- UE sends Accounting start (radius) WiFi access DHCP PMIPv6 WLC 4- Session is triggered 5- ewag gets mobile IP address from GGSN 6- ewag sets up tunnel 7-eWAG does NAT

30 Radius-based ewag (ReWAG) w/o ISG 1/3 30

31 Radius-based ewag (ReWAG) w/o ISG 2/3 31

32 Radius-based ewag (ReWAG) w/o ISG 3/3 32

33 DeWAG Home HSS internet AAA GGSN Packet Core WiFi access Gn GTPv1 ewag PMIPv6 WLC DHCP DHCP triggered (DeWAG) 1- UE authenticated by AAA (EAP-SIM) 2- UE comes to ewag for DHCP (VLAN) 3- ewag gets mobile IP address from GGSN 4- ewag sets up tunnel 5- Accounting is started 6- (no NAT)

34 DHCP-based ewag (DeWAG) 1/3 34

35 DHCP-based ewag (DeWAG) 2/3 35

36 DHCP-based ewag (DeWAG) 3/3 36

37 Integration to Mobile Core using S2a Mobility Gateway - SaMOG

38 EPC, Trusted wifi & Untrusted wifi Architecture HSS/ AAA PGW/ GGSN S6a S5 STa S2a S2b MME SGW TWAG TWAP SaMOG GW epdg Aggregation/ Core S1-U S1-MME S1-U S1-MME Radius IP/GRE Radius IP/GRE Radius IP/GRE Secure Transport, S1 Aggregation Un-trusted WiFi Radio Access (RAN) Radio Access

39 3GPP SaMOG Functional Architecture AAA/HSS PGW STa (Diameter) S2a GTP PMIP6 Internet TWAP TWAG Cw Uw WiFi Access Trusted WiFi Cw: AAA Radius Uw: Tunnel, native IP

40 Trusted WLAN AAA Proxy (TWAP) Functions Relaying the AAA information between the WLAN Access Network and the 3GPP AAA Server Establishing Binding of UE IMSI with UE MAC address on the WLAN Access Network into (IMSI, MAC) tuple via snooping on the AAA protocol messages Detecting L2 Attach of UE to the WLAN Access Network via snooping on the AAA protocol for EAP-Success message Detecting L2 Detach of UE from the WLAN Access Network via snooping on the AAA protocol for Accounting-Request STOP message Informing the Trusted WLAN Access Gateway of WLAN Attach and Detach events for UE with (MAC, IMSI) tuple

41 Trusted WLAN Access Gateway For IPv4: Default IPv4 router Allocates the IP address received from P-GW to the UE (Direct or indirect) For IPv6: Default IPv6 Router Advertises the IPv6 prefix received from P-GW to UE ( Direct or indirect) WLAN Access side connectivity S2a connectivity towards PGW Support for LBO in case of NSWO

42 ASR5K based SaMOG GW (TWAG/TWAP)

43 Multi-Radio Management Entity (MRME) New StarOS service for access control and session management Basic Functions Trusted WLAN AAA Proxy (TWAP) EAP-AKA( ) over Radius termination (support EAP-SIM as well) Diameter STa interface to 3GPP AAA Server UE session management (Attach, Detach, Mobility) Enhanced functions (roadmap) GW selection ( for 3G, 4G users) session continuity (Anchor PGW selection) access admission control Closed Subscriber Group support

44 Converged Access Gateway (CGW) New StarOS service for Trusted WLAN Access Gateway 3GPP TWAG Ingress (towards the WiFi AP) IP-in-IP-GRE termination Un-tunneled operation Egress (towards Mobile Gateway) GTPv2-C, GTP-U

45 SaMOG Session Establishment w/eap-sim 1/2

46 SaMOG Session Establishment w/eap-sim 2/2

47