Table Of Contents
Configuring Dynamic Addressing on the GGSN
Overview of Dynamic IP Addressing on the GGSN
Configuring DHCP Server Communication Globally
Configuring DHCP at the GGSN Global Configuration Level
Configuring a Loopback Interface
Specifying a DHCP Server for All Access Points
Specifying a DHCP Server for a Particular Access Point
Configuring a Local DHCP Server
Configuring MS Addressing via Local Pools on the GGSN
Configuring MS Addressing via RADIUS on the GGSN
Configuring IP Overlapping Address Pools
Defining Local Address Pooling as the Global Default
Configuring Multiple Ranges of IP Addresses into One Pool Example
Configuring the NBNS and DNS Address for an APN
Configuring Dynamic Addressing on the GGSN
This chapter describes how to configure dynamic IP addressing on the gateway GRPS support node (GGSN).
For a complete description of the GGSN commands in this chapter, refer to the Cisco GGSN Release 5.2 Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
This chapter includes the following sections:
•Overview of Dynamic IP Addressing on the GGSN
•Configuring MS Addressing via Local Pools on the GGSN
•Configuring MS Addressing via RADIUS on the GGSN
•Configuring IP Overlapping Address Pools
•Configuring the NBNS and DNS Address for an APN
Overview of Dynamic IP Addressing on the GGSN
There are three methods for configuring the GGSN to assign IP addresses to mobile station users who need to access the public data network (PDN): Dynamic Host Configuration Protocol (DHCP) allocation, Remote Authentication Dial-In User Service (RADIUS) allocation, and local IP address pool allocation configured at the access point name (APN).
A method of dynamic IP addressing can be configured either globally or at the access-point configuration level.
Be sure that the following configuration guidelines are met to support the type of IP address allocation in use on your network:
•DHCP IP address allocation
–Be sure that you configure the scope of the addresses to be allocated on the same subnet as the loopback interface.
–Do not configure an IP address for users on the RADIUS server.
–Specify the peer default ip address dhcp command at the PPP virtual template interface.
–Specify the aaa authorization network method_list none command on the GGSN.
•RADIUS IP address allocation
–Be sure that users are configured on the RADIUS server using the complete username@domain format.
–Specify the no peer default ip address command at the PPP Virtual Template interface.
–For more information about configuring RADIUS services on the GGSN, see the "Configuring Security on the GGSN" chapter in this book.
•Local pool IP address allocation
–Be sure to configure a local pool using the ip local pool command.
–Specify the aaa authorization network method_list none command on the GGSN.
–Specify the peer default ip address pool pool-name command.
Note On the Catalyst 6500 / Cisco 7600 platform, dynamic address allocation using the DHCP or RADIUS server methods requires that the DHCP or RADIUS server be Layer 3 routeable from the Supervisor/MSFC2.
Configuring DHCP on the GGSN
You can use local DHCP services within the Cisco IOS software, or you can configure the GGSN to use an external DHCP server such as the Cisco Network Registrar (CNR). For information about configuring internal DHCP services in the Cisco IOS software, refer to the Cisco IOS Configuration Fundamentals Configuration Guide.
The DHCP server can be specified in two ways:
•At the global configuration level, using the gprs default dhcp-server command
•At the access-point configuration level, using the dhcp-server command
To configure DHCP support on the GGSN, you must configure either the gprs default ip-address-pool global configuration command or the ip-address-pool access-point configuration command with the dhcp-proxy-client keyword option.
After you configure the access point for DHCP proxy client services, use the dhcp-server access-point configuration command to specify a DHCP server.
Use the ip-address argument to specify the IP address of the DHCP server. The second, optional ip-address argument can be used to specify the IP address of a backup DHCP server to be used in the event that the primary DHCP server is unavailable. If you do not specify a backup DHCP server, then no backup DHCP server is available.
If you specify a DHCP server at the access-point level by using the dhcp-server command, then the server address specified at the access point overrides the address specified at the global level. If you do not specify a DHCP server address at the access-point level, then the address specified at the global level is used.
Therefore, you can have a global address setting and also one or more local access-point level settings if you need to use different DHCP servers for different access points.
Use the vrf keyword when the DHCP server itself is located within the address space of a VRF interface on the GGSN. If the DHCP server is located within the VRF address space, then the corresponding loopback interface for the dhcp-gateway-address must also be configured within the VRF address space.
This section contains the following information:
•Configuring DHCP Server Communication Globally
•Configuring DHCP at the GGSN Global Configuration Level
•Configuring a Local DHCP Server
Configuring DHCP Server Communication Globally
This section describes how to configure a global DHCP server host that the GGSN can use to assign IP addresses to mobile users. You can configure additional DHCP server communication at the GGSN global configuration level.
To globally configure DHCP server communication on the router or instance of Cisco IOS software, use the following commands, beginning in global configuration mode:
For more information about configuring global DHCP services, refer to the Cisco IOS IP Configuration Guide, Cisco IOS IP Command References, and the Cisco IOS Dial Technologies Command Reference publications.
Configuring DHCP at the GGSN Global Configuration Level
To complete the DHCP configuration for the GGSN, you can configure DHCP at the GGSN global configuration level. When you configure DHCP at the GGSN configuration level, you can configure DHCP server communication for all access points or for a specific access point.
Configuring DHCP at the GGSN configuration level includes the following tasks:
•Configuring a Loopback Interface (Required)
•Specifying a DHCP Server for All Access Points (Optional)
•Specifying a DHCP Server for a Particular Access Point (Optional)
Configuring a Loopback Interface
When you configure a DHCP gateway address for DHCP services at an access point, and when you are supporting unique supernets across all access points on the GGSN for DHCP, then you must configure a loopback interface for each unique network.
A loopback interface is a software-only interface that emulates an interface that is always up. It is a virtual interface supported on all platforms. The interface number is the number of the loopback interface that you want to create or configure. There is no limit on the number of loopback interfaces you can create.
To configure a loopback interface on the GGSN, use the following commands, beginning in global configuration mode:
Specifying a DHCP Server for All Access Points
When processing DHCP address allocation, the GGSN software first checks to see whether a DHCP server has been specified at the access-point configuration level. If a server has been specified, the GGSN uses the DHCP server specified at the access point. If no DHCP server is specified at the access-point configuration level, then the GGSN uses the default GGSN DHCP server.
To specify a DHCP server for all GGSN access points, use the following commands, beginning in global configuration mode:
Specifying a DHCP Server for a Particular Access Point
To override the default DHCP server configured for all access points, you can specify a different DHCP server for a particular access point. Or, if you choose not to configure a default GGSN DHCP server, you can specify a DHCP server at each access point.
To specify a DHCP server for a particular access point, use the following commands, beginning in access-point configuration mode:
Configuring a Local DHCP Server
Note Using a local DHCP Server is not recommended on the Catalyst 6500 / Cisco 7600 platform.
Although most networks use external DHCP servers, such as that available through the Cisco Network Registrar (CNR), you can also configure internal DHCP services on the GGSN. If you use local DHCP services on the GGSN, then there are a couple of commands that you should configure to improve the internal DHCP response times.
To optimize local DHCP services on the GGSN, use the following commands, beginning in global configuration mode:
Configuration Example
The following example shows a VRF configuration for vpn3 (without tunneling) using the ip vrf global configuration command. Because the ip vrf command establishes both VRF and CEF routing tables, notice that ip cef also is configured at the global configuration level to enable CEF switching at all of the interfaces.
The following other configuration elements must also associate the same VRF named vpn3:
•FastEthernet0/0 is configured as the Gi interface using the ip vrf forwarding interface configuration command.
•Access-point 2 implements VRF using the vrf command access-point configuration command.
The DHCP server at access-point 2 also is configured to support VRF. Notice that access-point 1 uses the same DHCP server, but is not supporting the VRF address space. The IP addresses for access-point 1 will apply to the global routing table:
aaa new-model!aaa group server radius fooserver 10.2.3.4server 10.6.7.8!aaa authentication ppp foo group fooaaa authorization network foo group fooaaa accounting network foo start-stop group foo!ip cef!ip vrf vpn3rd 300:3!interface Loopback1ip address 10.30.30.30 255.255.255.255!interface Loopback2ip vrf forwarding vpn3ip address 10.27.27.27 255.255.255.255!interface FastEthernet0/0ip vrf forwarding vpn3ip address 10.50.0.1 255.255.0.0duplex half!interface FastEthernet1/0ip address 10.70.0.1 255.255.0.0duplex half!interface loopback 1ip address 10.8.0.1 255.255.255.0!interface Virtual-Template1ip unnumber loopback 1encapsulation gtpgprs access-point-list gprs!ip route 10.10.0.1 255.255.255.255 Virtual-Template1ip route vrf vpn3 10.100.0.5 255.255.255.0 fa0/0 10.50.0.2ip route 10.200.0.5 255.255.255.0 fa1/0 10.70.0.2!no ip http server!gprs access-point-list gprsaccess-point 1access-point-name gprs.pdn.comip-address-pool dhcp-proxy-clientdhcp-server 10.200.0.5dhcp-gateway-address 10.30.30.30network-request-activationexit!access-point 2access-point-name gprs.pdn2.comaccess-mode non-transparentip-address-pool dhcp-proxy-clientdhcp-server 10.100.0.5 10.100.0.6 vrfdhcp-gateway-address 10.27.27.27aaa-group authentication foovrf vpn3exit!gprs default ip-address-pool dhcp-proxy-clientgprs gtp ip udp ignore checksum!radius-server host 10.2.3.4 auth-port 1645 acct-port 1646 non-standardradius-server host 10.6.7.8 auth-port 1645 acct-port 1646 non-standardradius-server key ggsntelConfiguring MS Addressing via Local Pools on the GGSN
As the number of PDP contexts increases, allocating IP addresses via locally-configured address pools improves the PDP context activation rate. Whether or not addresses are allocated to MSs using local pools is specified at the access-point configuration level and requires that a local pool or pools of IP address have been configured on the GGSN using the ip local pool configuration command.
To configure a local IP address pool, use the following command in global configuration mode:
To configure a local IP address pool allocation on an access-point, use the following command in access-point configuration mode:
Note Using VRF at the access point, you can configure APNs that use the same IP address pool (overlapping addresses). However, on the Catalyst 6500 / Cisco 7600 platform, VRF is not supported on the Supervisor II / MSFC2. Therefore, if using a Supervisor II, you must tunnel the encapsulated VRF traffic through the Supervisor using a GRE tunnel.
Fore more information on configuring VPN access via VRF from an access point, see the "VPN Access Using VRF Configuration Task Lists" section.
The Catalyst 6500 / Cisco 7600 Sup720 supports VRF.
Configuration Example
The following is a configuration example of a local address pool configured at the APN.
!ip local pool local_pool1 128.1.0.1 128.1.255.254
!access-point 1access-point-name gprs.pdn.comip-address-pool local local_pool1
aggregate 128.1.0.0/16exitConfiguring MS Addressing via RADIUS on the GGSN
Dynamic IP addressing via a RADIUS server is configured at the access-point configuration level using the ip-address-pool access-point configuration command.
For more information about the ip-address-pool access-point configuration command, see "Configuring Other Access Point Options" section. For more information about configuring RADIUS, see the Cisco IOS Security Configuration Guide.
Configuring IP Overlapping Address Pools
The IP Overlapping Address Pools feature improves flexibility in assigning IP addresses dynamically. This feature allows you to configure overlapping IP address pool groups to create different address spaces and concurrently use the same IP addresses in different address spaces.
IP Overlapping Address Pools gives greater flexibility in assigning IP addresses dynamically. It allows you to configure overlapping IP address pool groups to create different address spaces and concurrently use the same IP addresses in different address spaces.
With Cisco IOS Release 12.3(2)XB and later, the GGSN supports the concept of an IP address group to support multiple IP address spaces and still allow the verification of nonoverlapping IP address pools within a pool group. Pool names must be unique within the GGSN. The pool name carries an implicit group identifier because that pool name can be associated only with one group. Pools without an explicit group name are considered members of the base system group and are processed in the same manner as the original IP pool implementation.
Existing configurations are not affected by the new pool feature. The "group" concept is an extension of the existing ip local pool command. Processing of pools that are not specified as a member of a group is unchanged from the existing implementation.
To configure a local IP address pool group and verify that it exists, use the following commands in global configuration mode:
Configuration Examples
The following are configuration examples for configuring IP overlapping address pools.
•Defining Local Address Pooling as the Global Default
•Configuring Multiple Ranges of IP Addresses into One Pool Example
Defining Local Address Pooling as the Global Default
The following example shows how to configure local pooling as the global default mechanism:
ip address-pool local ip local pool default 192.169.15.15 192.68.15.16Configuring Multiple Ranges of IP Addresses into One Pool Example
The following example shows how to configure two ranges of IP addresses for one IP address pool:
ip local pool default 192.169.10.10 192.169.10.20
ip local pool default 192.169.50.25 192.169.50.50
Configuring IP Overlapping Address Pools on a GGSN on the Catalyst 6500 / Cisco 7600 Platform with Supervisor II / MSFC2 Example
The following example shows how to configure IP overlapping address pools on the Catalyst 6500 / Cisco 7600 platform
The following examples also show a partial configuration for two VPNs (vpn1 and vpn2) and their associated GRE tunnel configurations (Tunnel1 and Tunnel2).
On the GGSN:
service gprs ggsn!hostname 6500-7-2!ip cef!ip vrf vpn1description GRE Tunnel 1rd 100:1!ip vrf vpn2description GRE Tunnel 3rd 101:1!interface Loopback1ip address 150.1.1.72 255.255.0.0!interface Loopback100description GPRS GTP V-TEMPLATE IP ADDRESSip address 9.9.9.72 255.255.255.0!interface Tunnel1description VRF-GRE to PDN 7500(13) Fa0/1ip vrf forwarding vpn1ip address 50.50.52.72 255.255.255.0tunnel source 150.1.1.72tunnel destination 165.2.1.13!interface Tunnel2description VRF-GRE to PDN PDN 7200(12) Fa3/0ip vrf forwarding vpn2ip address 80.80.82.72 255.255.255.0tunnel source 150.1.1.72tunnel destination 167.2.1.12!interface GigabitEthernet0/0.1description Giencapsulation dot1Q 100ip address 10.1.2.72 255.255.255.0!interface Virtual-Template1description GTP v-accessip unnumbered Loopback100encapsulation gtpgprs access-point-list gprs!router ospf 10network 10.1.2.0 0.0.0.255 area 10network 150.1.0.0 0.0.255.255 area 10!ip local pool vpn1_pool 100.2.0.1 100.2.255.255 group vpn1ip local pool vpn2_pool 100.2.0.1 100.2.255.255 group vpn2ip route vrf vpn1 0.0.0.0 255.255.255.0 Tunnel1ip route vrf vpn2 0.0.0.0 255.255.255.0 Tunnel2gprs access-point-list gprsaccess-point 1access-point-name apn.vrf1.comaccess-mode non-transparentaaa-group authentication ipdbfmsip-address-pool local vpn1_poolvrf vpn1!access-point 2access-point-name apn.vrf2.comaccess-mode non-transparentaaa-group authentication ipdbfmsip-address-pool local vpn2_poolvrf vpn2!Related configuration on the Supervisor / MSFC2:
interface FastEthernet9/5no ip addressswitchportswitchport access vlan 167no cdp enable!interface FastEthernet9/10no ip addressswitchportswitchport access vlan 165no cdp enable!interface Vlan165ip address 165.1.1.1 255.255.0.0!interface Vlan167ip address 167.1.1.1 255.255.0.0!! provides route to tunnel endpoints on GGSNsrouter ospf 10network 10.1.2.0 0.0.0.255 area 10!! routes to tunnel endpoints on PDN!ip route 165.2.0.0 255.255.0.0 165.1.1.13ip route 167.2.0.0 255.255.0.0 167.1.1.12Configuring the NBNS and DNS Address for an APN
You can configure a primary and secondary NetBIOS Name Service (NBNS) and domain name system (DNS) under an APN. This feature is benefits address allocation schemes where there is no mechanism to obtain these address. Also, for a RADIUS-based allocation scheme, it prevents the operator from having to configure a NBNS and DNS under each user profile.
The NBNS and DNS addresses can come from three possible sources: DHCP server, RADIUS server, or local APN configuration. The criterium for selecting the addresses depends on the IP address allocation scheme configured under the APN. Depending on the configuration, the criterium for selecting the DNS and NBNS addresses is as follows:
1. DHCP-based IP address allocation scheme (local and external)—NBNS address returned from the DHCP server is sent to the MS. If the DHCP server does not return an NBNS address, the local APN configuration is used.
2. RADIUS-based IP address allocation scheme—NBNS address returned from the RADIUS server (in Access-Accept responses) is used. If the RADIUS server does not return an NBNS address, the local APN configuration is used.
3. Local IP Address Pool-based IP address allocation scheme—Local APN configuration is used.
4. Static IP Addresses—Local APN configuration is used.
Note The GGSN sends NBNS and DNS addresses in the create PDP response only if the MS is requesting the DNS address in the PCO IE.
To specify a primary (and backup) NBNS to be sent in create PDP responses at the access point, use the nbns primary access-point configuration command. To remove the NBNS from the access-point configuration, use the no form of this command
nbns primary ip-address [secondary ip-address]
To specify a primary (and backup) DNS to be sent in create PDP responses at the access point, use the dns primary access-point configuration command. To remove the DNS from the access-point configuration, use the no form of this command
dns primary ip-address [secondary ip-address]