Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

• This feature is applicable for IPv4 sessions, but not for IPv6 and dual-stack sessions.

• Only one local Dynamic Host Configuration Protocol (DHCP) pool can be used for simple IP sessions to perform web authentication.

• Only one access point name (APN) (corresponding to one Gateway GPRS Support Node [GGSN] IP address pool) is supported for web-authenticated sessions.

Using Access Interface as GTP Default Gateway

An access interface or a loopback interface can be used as the GPRS Tunneling Protocol (GTP) default gateway.

For a user equipment's (UE) initial attach, an unauthenticated simple IP session is created. The UE is assigned an IP address from a local DHCP pool that is identified using the access interface's subnet mask.

After the UE is authenticated through web portal, the simple IP session is transformed to a mobile IP session, and the access interface is used as the mobile IP session's default gateway instead of creating a new virtual interface.

The following example shows how to configure an access interface as the GTP default gateway on iWAG:

ip dhcp excluded-address 10.202.255.254
ip dhcp pool test
 network 10.202.0.0 255.255.0.0

interface Ethernet0/3
 ip address 10.202.255.254 255.255.0.0
 service-policy type control GTP_DHCP
 ip subscriber l2-connected
  initiator unclassified mac-address
  initiator dhcp class-aware
end

gtp
 n3-request 3
 information-element rat-type wlan
 interface local Ethernet0/0
apn 1
  apn-name apn1.starent.com
  ip address ggsn 10.10.1.2
  default-gw Ethernet0/3

If multiple access interfaces are used for web-authenticated sessions, these access interfaces have to share the same local DHCP pool. You can configure these access interfaces as unnumbered interfaces and use a loopback interface as their default gateway.

After the UE is authenticated through web portal, the loopback interface is used as the mobile IP session's default gateway instead of creating a new virtual interface.

The following example shows how to configure a loopback interface as the GTP default gateway on iWAG:

ip dhcp excluded-address 10.202.255.254
ip dhcp pool test
 network 10.202.0.0 255.255.0.0

interface Ethernet0/2
 ip unnumbered Loopback1
 service-policy type control GTP_DHCP
 ip subscriber l2-connected
  initiator unclassified mac-address
  initiator dhcp class-aware
end

interface Ethernet0/3
 ip unnumbered Loopback1
 service-policy type control GTP_DHCP
 ip subscriber l2-connected
  initiator unclassified mac-address
  initiator dhcp class-aware
end

interface Loopback1
 ip address 10.202.255.254 255.255.0.0
end

gtp
 n3-request 3
 information-element rat-type wlan
 interface local Ethernet0/0
apn 1
  apn-name apn1.starent.com
  ip address ggsn 10.10.1.2
  default-gw Loopback1

To reuse a simple IP session address for a mobile IP session in a web authentication scenario, the following options are available:

• Using the authentication, authorization, and accounting (AAA) server

  For more information on this, see the procedure described in the Web Authentication Support for iWAG-GTP Call Flow section.

• Using mobile client service abstraction (MCSA)

  The web authentication accepts an IPv4 address that is being passed from an unauthenticated subscriber session, and sends it to either the GPRS Gateway Support Node (GGSN) or Packet Gateway (PGW).

  The allow-static-ip command specifies whether the static IP address provided by the unauthenticated session is allowed by iWAG-GTP or not. This is applicable only to the IPv4 addresses and not the IPv6 addresses.

If an interface is configured as default gateway, the following events may occur on the configured interface:

• If an IP address or a network mask on a configured interface is changed, the traffic may still continue, but the sessions may not be torn down by the DHCP clients depending on the idle timeout. New session setup requests may either continue through the default gateway if the subnet of the GTP Packet Data Protocol (PDP) assigned from GGSN or PGW matches the subnet of the default gateway, or may be rejected if the subnet does not match.

• If the configured interface is shut down, the interface is removed from the active default gateway list. The traffic may still continue, but the sessions may not be torn down by the DHCP client depending on the idle timeout. New session setup requests are rejected due to lack of proper default gateway.

• If the configured interface is removed from the system (unconfiguring a subinterface or a loopback interface), the interface is removed from the active default gateway list. The traffic may still continue, but the sessions may not be torn down by the DHCP client depending on the idle timeout. New session setup requests are rejected due to lack of proper default gateway.

The following figure and steps describe the call flow pertaining to web authentication for a subscriber using GTP:

1. Subscriber connects to an open wireless local area network (WLAN) and gets an IP address from DHCP or the iWAG.

2. The iWAG creates a session on unclassified MAC.

3. L4 redirection and open garden is applied to the session.

4. Subscriber's HTTP request is redirected to the portal.

5. Mobility subscriber enters MSISDN in the portal, or a voucher in the case of walk-by user.

6. Portal sends change of authorization (CoA) to the iWAG with MSISDN as username.

7. iWAG sends an Access Request to the AAA server with MSISDN.

8. The AAA server receives the 3GPP parameters from the Home Location Register (HLR) and replies with an Access Accept message containing 3GPP information in AV pairs.

   The AAA server creates a tuple with IMSI and IP address for this session.

9. The iWAG sends Create PDP request to the GGSN.

10. The GGSN performs an AAA IMSI authentication with the same AAA server.

11. The AAA server provides the same as IP address in Framed-IP-address to the GGSN.

12. The GGSN provides the IP address provided by the iWAG to the session.

    Thus the simple IP and mobile IP sessions reuse the same IP address, providing a seamless migration.

Related Documents

MIBs

Technical Assistance

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.