PacketCable Lawful Intercept Solution
Available Languages
Table Of Contents
PacketCable Lawful Intercept Architecture for BTS Versions 3.5 and 4.1
Business Objectives of the PacketCable LI Architecture
Key Requirements of LI Architecture
PacketCable Lawful Intercept Architecture
Topology of Networks That Support LI
Intercept-Related Information Intercept Access Point
Call Content Intercept Access Point
How PacketCable LI Architecture Works
PacketCable Voice Intercept Call Flows
Intercept Request Messaging Interfaces
Packet Encapsulation and Transport
Implementation of the PacketCable LI Architecture
Prerequisites and Design Considerations
Bandwidth and Processing Power Considerations
IP Address Provisioning Considerations
Cisco uBR 7246 VXR CMTS Configuration
VISM Trunking Gateway Configuration
Cisco BTS 10200 Softswitch Call Agent Configuration
Add an Electronic Surveillance Subsystem
Verint STAR-GATE Mediation Device Configuration
SS8 Networks Xcipio Mediation Device Configuration
Collection Function Configuration
Collection Function TCP Interface Configuration
IP Delivery Unit Configuration
Surveillance Record Configuration
IP Call Content Channel Configuration
Access Function BTS Provisioning Interface Configuration
Access Function PGW Provisioning Interface Configuration
Access Function RADIUS Interface Configuration
SNMP Alarms and Traps Configuration
Verifying the PacketCable LI Network
Verifying the Cisco BTS 10200 Softswitch Call Agent Configuration
Verifying the VISM Card Configuration
Verifying the Cisco uBR 7246 VXR CMTS Configuration
Verifying the Verint STAR-GATE Mediation Device Configuration
Verifying the SS8 Mediation Device Configuration
Troubleshooting a PacketCable LI Network
Troubleshooting the Mediation Device
Troubleshooting the BTS Call Agent
Troubleshooting the Call Agent Profile
Troubleshooting the Call Agent to CMTS Interface
Cisco Products That Support PacketCable Lawful Intercept BTS Versions 3.5 and 4.1
PacketCable Lawful Intercept Architecture for BTS Versions 3.5 and 4.1
Version History
Abstract
Lawful Intercept (LI) is the process (not a specific regulatory requirement) by which law enforcement agencies (LEAs) conduct electronic surveillance as authorized by judicial or administrative order. Legislation and regulations have been adopted that require service providers (SPs) and Internet service providers (ISPs) to design and implement their networks to explicitly support authorized electronic surveillance. Types of SPs and ISPs subject to LI mandates vary greatly from country to country. LI compliance in the United States is specified by the Communications Assistance for Law Enforcement Act (CALEA).
The PacketCable Lawful Intercept Architecture for BTS Versions 3.5 and 4.1 document describes the implementation of LI architecture on a PacketCable network. It describes LI of voice traffic only—LI of data traffic is not covered. PacketCable specifications are considered a SafeHarbor for compliance with CALEA. SafeHarbor is an initiative that provides the PacketCable LI user with a stable Cisco IOS/CatOS version-of-choice. This initiative is accomplished through systems level testing of functionality that is critical to the success of the PacketCable LI architecture in Cisco products.
The LI architecture is designed to support "plug-and-play" capability, which means that any architecture component can be replaced by any other PacketCable-compliant component. Because of this flexibility in component choices, it is not practical for this document to completely describe all aspects of LI implementation for all of the possible components. Therefore, this document is intended as a high-level description of the end-to-end PacketCable LI architecture including how LI works, the roles of the various components, what component options are available, and some information on design, implementation, operation, and troubleshooting LI on a PacketCable network. For detailed specifics on the various devices (such as image and memory requirements, configurations, and so forth), this document references the product documentation of the devices.
Contents
This document contains the following sections:
•
Business Objectives of the PacketCable LI Architecture
•
•
•
•
Business Objectives of the PacketCable LI Architecture
The following sections describe the business objectives of implementing the PacketCable LI architecture:
•
Key Requirements of LI Architecture
The following are the key requirements any LI architecture must meet:
•
•
•
•
•
Business Drivers
SPs and ISPs are being asked to meet LI requirements for voice and data in a variety of countries worldwide. CALEA is a public law that describes how telephony service providers in the United States must support LI. Two specifications define the interface to the LEAs for the purposes of meeting the CALEA requirements:
•
•
In Europe, a number of specifications have been defined but legal requirements and specific interfaces vary from country to country. This document does not address LI for non-American customers.
PacketCable Lawful Intercept Architecture
The following sections describe the Broadband Telephony Softswitch (BTS) versions 3.5 and 4.1 PacketCable LI architecture:
•
•
Topology of Networks That Support LI
Figure 1 shows a generic IP network that supports LI of voice and data traffic.
Figure 1 Generic IP Network That Supports LI of Voice and Data Traffic
Note
Figure 2 shows a PacketCable network that supports LI of voice traffic.
Figure 2 Functional Depiction of a PacketCable LI Network
The following components are integral to the PacketCable voice intercept network:
•
•
LI Administration Function
The SP uses the LI administration function to provision intercepts by interfacing with the other components in the network. It is responsible for provisioning components in the network, administering intercept orders, and tracking and maintaining intercept information. It also supervises the security and integrity of the LI process by continuously auditing activity logs to ensure that only authorized intercepts are provisioned and that authorized intercepts are not disrupted.
Note
Mediation Device
The mediation device (MD) is maintained by the SP or ISP and is the center of the LI process. It sends configuration commands to the various IAPs to enable intercepts, receives intercept information (both Intercept-Related Information [IRI] and call content [CC]), encapsulates it, and delivers it to the LEAs. If more than one LEA is monitoring an intercept target, the mediation device duplicates the intercept information for each LEA. The mediation device is sometimes called the delivery function.
In some cases, the mediation device performs additional filtering of the information. It is also responsible for formatting the information to be compliant with the country or technology-specific requirements for delivery to law enforcement.
Mediation devices are third-party equipment. Cisco has performed end-to-end testing with a number of mediation device vendors. A list of these vendors can be found at the following URL: http://www.cisco.com/wwl/regaffairs/lawful_intercept/index.html
Intercept-Related Information Intercept Access Point
The Intercept-Related Information intercept access point (IRI IAP) is the device that provides identification information to the mediation device. IRI for voice includes the source and destination phone numbers and IP addresses and the time of the call. It also includes any post call-establishment messaging such as call forwarding or three-way calling. Depending on the architecture, the IRI IAP could be either the call agent, the CMTS, Session Initiation Protocol (SIP) proxy, or the gatekeeper. In the Media Gateway Control Protocol (MGCP)-based PacketCable network, both the call agent and the CMTS supply IRI IAP. The call agent supplies call control-related information (such as the dialed number and the call encoding) and the CMTS usually supplies QoS-related information.
Call Content Intercept Access Point
The Call Content Intercept Access Point (CC IAP) is the device that intercepts call content information, replicates it and forwards the replicated information to the mediation device. The CC IAP should be located as close to the source of the call as possible to minimize the number of simultaneous calls the device will have to monitor and to ensure that CC can be reliably intercepted. The edge device is the only device that can guarantee CC intercept.
However, the CC IAP should not be part of the MTA to prevent the intercept target from being able to detect the intercept. In the PacketCable network, the CMTS is the preferred CC IAP. If a call coming in from the public switched telephone network (PSTN) is forwarded back to the PSTN, the trunking gateway must serve as the CC IAP.
Collection Function
The collection function is a third-party device maintained by the LEA that receives, sorts, and stores intercept information from the mediation device. The collection function may also include case management capabilities.
Interfaces Between Devices
Figure 3 shows the interfaces of interest between the devices in a PacketCable voice intercept topology:
Figure 3 PacketCable Voice Intercept Device Interfaces
Table 1 describes the interfaces between devices shown in Figure 3.
Table 1 PacketCable LI Network Device Interfaces
c
Mediation Device and Collection Function
The mediation device delivers intercept information to the collection function. If more than one LEA is intercepting the same target, the mediation device must duplicate the intercept information to send to the collection function of each LEA. This interface meets the specifications defined in the PacketCable Electronic Surveillance Specification document in the "Related Documents" section.
d1
CMTS or trunking gateway and Mediation Device
This is the CC interface. The CC IAP (the CMTS for a PacketCable network) duplicates CC and sends it to the mediation device. The CMTS encapsulates the packets with additional User Datagram Protocol (UDP) and IP headers and a 32-bit call content connection identifier (CCCID) header. The CCCID is used to associate the CC with the target.
The CCCID is not globally unique; however, the combination of the CCCID and the IP address of the CMTS must be unique in order for the mediation device to accurately process intercepts.
In a typical CC intercept scenario, the CMTS is the CC IAP. In this case, the CMTS generates the CCCID. If a call comes in from the PSTN and is forwarded back to the PSTN, the trunking gateway must serve as the CC IAP. In this case, the call agent generates the CCCID.
The CCCID is included so that the mediation device can map intercepts to the appropriate warrants. Usually, the mediation device will rewrite the CCCID before forwarding intercept information to collection functions.
The CMTS also provides QoS IRI information to the mediation device.
For the format of the call content interface, see section 4 of the PacketCable Electronic Surveillance Specification document in the "Related Documents" section.
d2
Call agent and Mediation Device (provisioning interface)
This is the provisioning interface. The mediation device uses Secure Shell (SSH) to provision intercepts on the call agent.
d3
Call agent and Mediation Device (delivery interface)
This is the delivery interface. The call agent uses this interface to deliver IRI to the mediation device.
This interface is described in Appendix A of the PacketCable Event Messages Specification document in the "Related Documents" section.
e1
Call agent and CMTS
The call agent instructs the CMTS to duplicate the CC and send it to the appropriate mediation device using the Common Open Policy Service (COPS) protocol.
This interface is described in the PacketCable Dynamic Quality of Service Specification document in the "Related Documents" section.
e2
Call agent and trunking gateway
The call agent uses MGCP to instruct the trunking gateway to duplicate CC and send it to the appropriate mediation device. The parameters (local connection options) required to do this are described in the PacketCable PSTN Gateway Call Signaling Protocol Specification document in the "Related Documents" section.
How PacketCable LI Architecture Works
The following sections describe how the PacketCable LI architecture works:
•
•
•
Types of Intercepts
PacketCable architecture supports only voice intercept. There are two types of voice-related intercepts:
•
•
Initiating an Intercept
When a warrant is issued, the LEA physically delivers the warrant to the service provider. When the SP or ISP receives the warrant, it uses the LI administration function to enable LI of the target specified in the warrant. If the warrant is delivered prior to the authorized start date and time, the mediation device waits until the authorized start date and time to configure the tap. Once the intercept is provisioned on the mediation device, the process of initiating individual intercepts is completely automated.
Terminating an Intercept
When a warrant is issued, it includes an expiration date—typically 30 days. This expiration date is configured on the mediation device. When the warrant expires, the mediation device automatically removes the configuration for the warrant. The mediation device provisioning interface can be used to remove a warrant before the expiration date.
PacketCable Voice Intercept Call Flows
The following sections describe the two basic types of PacketCable voice intercept:
•
•
Standard PacketCable Voice Intercept
Note
Figure 4 shows the topology for a standard PacketCable voice intercept:
Figure 4 Standard PacketCable Voice Intercept at CMTS or Aggregation Router
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Hairpin PacketCable Voice Intercept
Figure 5 shows the topology for a PacketCable voice intercept in a hairpin scenario (when a call coming in from the PSTN to the intercept target is forwarded off the network and back to the PSTN):
Figure 5 Hairpin PacketCable Voice Intercept at Trunking Gateway
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Intercept Request Messaging Interfaces
There are three IAPs in the PacketCable network:
•
•
•
When DQoS is used, the CMTS also acts as an IRI IAP for providing QoS_Reserve, QoS_Commit, and QoS_Release event messages. The following sections describe the interfaces between the call agent and the CC IAPs:
•
•
For information on the interface between the call agent and mediation device, see the PacketCable Event Messages Specification document in the "Related Documents" section. For information on the interface between the mediation device and the collection function, see the PacketCable Electronic Surveillance Specification document in the "Related Documents" section.
CMTS and Call Agent Interface
The COPS interface for requesting CC intercept is based on the PacketCable Dynamic Quality of Service Specification document found in the "Related Documents" section. DQoS is used to authorize QoS for media flows within the PacketCable architecture. In order to provision a CC intercept, some additional COPS objects have been added to indicate that the media stream should be replicated and where to send the replicated stream (by specifying the IP address and port of the mediation device).
Note
Trunking Gateway and Call Agent Interface
When a call coming from the PSTN is forwarded to the PSTN, the trunking gateway must be the CC IAP. The trunking gateway interfaces with the call agent using MGCP and some additional parameters in the MGCP message are used to request a CC intercept. These parameters are the "es-cci" and "es-ccd" parameters described in section 5.2.2.3 of the PacketCable PSTN Gateway Call Signaling Protocol Specification document in the "Related Documents" section. The parameters are used to specify the CCCID to be used and the destination of the replication stream (the IP address and port of the mediation device). The interface described here is identical to that described in the PacketCable TGCP specification and is compliant with the PacketCable Electronic Surveillance Specification document found in the "Related Documents" section.
Packet Encapsulation and Transport
Information on encapsulation and transport of intercepted packets is documented in section 4 of the PacketCable Electronic Surveillance Specification described in the "Related Documents" section.
Security Considerations
Information on security considerations for the PacketCable LI network is documented in the PacketCable Security Specification described in the "Related Documents" section. Call agents and mediation devices run standard operating systems, which include their own security best practices. The BTS uses an SSH interface and has dedicated usernames and passwords for accessing LI information.
Failure Recovery
The mediation device monitors the call agent. If the call agent fails or anything else happens to interrupt an intercept, the mediation device implements an audit to ensure that its database is in synchronization with the call agent database. If a CMTS reboots, all LI content on the CMTS will be lost.
Implementation of the PacketCable LI Architecture
The following section describes the implementation of the PacketCable LI architecture:
•
Prerequisites and Design Considerations
Before configuring your network for LI, you must establish reliable end-to-end Voice over IP (VoIP) service on your existing network. The main concern when designing an LI network is ensuring that the network has sufficient bandwidth and CPU capacity to handle the anticipated load of intercepts. The following sections describe design considerations for implementing LI:
•
•
Bandwidth and Processing Power Considerations
The CPUs of the following devices will be impacted by LI:
•
•
•
The following interfaces must be engineered with sufficient bandwidth to support LI traffic:
•
•
•
You should also take into consideration that three-way calls require twice the bandwidth of regular calls because they require two pairs of transmit and receive channels.
You must also provision a network management system to perform Domain Name Service (DNS) and Dynamic Host Configuration Protocol (DHCP) such as Cisco Network Registrar.
The various devices involved in LI have minimum software and memory requirements that must be met. However, because of the number of possible devices and the fact that these requirements are subject to change, see the various product documents listed in the "Related Documents" section for the specific requirements.
IP Address Provisioning Considerations
In general, Cisco recommends that service providers not use static IP addresses, particularly for cable modems. Static provisioning of IP addresses is time consuming, expensive, and error prone. Currently, LI is not compatible with variable length subnets. On the IAPs, it can be helpful to use loopback interfaces for the interface with the mediation device because the loopback interface remains constant if physical interfaces go out of service or if the routing path changes.
Device Configuration Files
The following sections provide detailed configuration information on the devices involved in LI:
•
•
•
•
•
Cisco uBR 7246 VXR CMTS Configuration
The following command must be configured on the Cisco Universal Broadband Router (uBR) 7246 VXR CMTS.
ubr7246vxr-1(config)# packetcable enableVISM Trunking Gateway Configuration
When using the Cisco BTS 10200 call agent, call messages come from the call agent and not the mediation device; therefore, the Voice Interworking Service Module (VISM) cards do not need to be configured to interface with the mediation device. The following command enables LI on the VISM card:
VISM-1> cnfcalea 2This command must be enabled on every VISM card on every MGX router.
Cisco BTS 10200 Softswitch Call Agent Configuration
The following three configurations must be provisioned on the Cisco BTS 10200 softswitch call agent:
•
Add an Electronic Surveillance Subsystem
To add an Electronic Surveillance Subsystem (ESS), you must log in as user "calea."
BTS(config)# add ess CDC-DF-ADDRESS=10.8.100.18Reply : Success: CLI add successfulTransaction 1035567544247 was processed.Add an Aggregation Router
To add an aggregation router, you must log in as a user other than "calea."
BTS(config)# add aggr id=I1705_bundle;TSAP-ADDR=10.8.0.1;es-supp=Y;dqos-supp=yAdd a Media Gateway
To add a media gateway, you must log in as a user other than "calea."
BTS(config)# add mgw id=mot050308;tsap-addr=mot050308.cactusv.cisco.com;call-agent-id=CA146;mgw-profile-id=mot; rgw=Y;tgw=N;nas=N;iad=N;pbx=N;ans=N;ive=N;mgw-monitoring-enabled=Y;aggr-id=I1705_bundleVerint STAR-GATE Mediation Device Configuration
The initial configuration on the Verint STAR-GATE must be performed using the Windows registry edit function. Verint technicians typically perform these configurations as part of the installation process. Usually, users only configure intercept information on the STAR-GATE system, which is configured by using a GUI. For information on configuring the Verint STAR-GATE, see the Verint STAR-GATE System Description Manual and the Verint STAR-GATE System Administration Manual documents in the "Related Documents" section.
SS8 Networks Xcipio Mediation Device Configuration
The SS8 Networks Xcipio mediation device runs on a series of Sun Microsystems workstations. The first Sun workstation can handle all call data intercepts and up to five simultaneous call content intercepts. Each additional workstation can handle up to 20 simultaneous call content intercepts.
Note
The SS8 Xcipio mediation device includes audio and visual alarms, and it can support secure sockets and other UNIX security measures.
The three methods of accessing the SS8 Xcipio mediation device are through a CLI, a direct GUI, and a JAVA web interface. All configurations, except for surveillance information, must be done using Man Machine Language (MML) commands. Surveillance information can be configured using the GUI. Some configuration information (such as call agents) can be viewed using the GUI but cannot be modified through the GUI.
The built-in help feature for MML commands can display all available commands. To access the help level, enter the following command:
MML_calea_opr> help:;For detailed information on a command, enter the command in help mode followed by :;. For example, to display help information for the add-cf command, enter:
HELP_MML_CMD> add-cf:;The following is a sample configuration for the SS8 Xcipio mediation device in a network that uses BTS 10200 call agents. For more information on configuring the SS8 Xcipio mediation device, see the SS8 Xcipio SSDF User Manual document in the "Related Documents" section.
The following configurations are performed on the SS8 Xcipio mediation device:
•
•
•
•
•
•
•
•
•
•
Collection Function Configuration
The add-cf command adds the collection function and must be executed by user calea_adm.
MML_calea_adm> add-cf:cfid=1,name=PenLink;Table 2 describes the strings in the add-cf command.
Table 2 add-cf Command Strings
cfid
Collection function ID. Any number that has not already been used.
name
Any meaningful string to make the entry easily identifiable.
Collection Function TCP Interface Configuration
The add-tcpipcfi command adds the collection function to a TCP/IP interface (tcpipcfi). The command must be executed by user calea_adm.
MML_calea_adm> add-tcpipcfi:cfid=1,ipaddr=172.18.137.94,port=43000,reqstate=ACTIVE;Table 3 describes the strings in the add-tcpipcfi command.
IP Delivery Unit Configuration
The add-ipdu command adds the IP delivery unit (IPDU). The command must be executed by user calea_adm. The IPDU is used for the call content portion of intercepts, and up to 16 can be configured on the mediation device. The first IPDU is typically on the same Sun workstation as the Softswitch Delivery Function (SSDF), while additional IPDUs are located on separate Sun workstations.
MML_calea_adm> add-ipdu:ipduid=1,ipaddr=10.15.113.9,port=15001,hostname=brie;Table 4 describes the strings in the add-ipdu command.
IP Port Pools Configuration
The add-ipport command creates pools of ports for call content delivery. The command must be executed by user calea_adm. Both incoming and outgoing ports must be created.
MML_calea_adm> add-ipport:ipduid=1,portid=1,end_portid=10,direction=IN;MML_calea_adm> add-ipport:ipduid=1,portid=11,end_portid=20,direction=OUT;Table 5 describes the strings in the add-ipport command.
Surveillance Record Configuration
The add-surveillance command is used to add a record for each subject that is to be monitored for call data or call data and call content. It must be executed by user calea_opr. Most of the strings in this command must match corresponding strings provisioned on the LEA collection function. In particular, the caseid string is used as a key to uniquely identify surveillance data. For ease of reading, the command is divided into three lines. The command must be configured as one string with no spaces.
MML_calea_opr> add-surveillance:state=NC,county=Wake,city=RTP,warrantid=6789,caseid=1234, subsid=6213000001,startdate=05/01/2002,expdate=06/01/2002, cfid=1,survtype=CONTENT, content=COMBINED,user=calea_opr,access=PUBLIC;Table 6 describes the strings in the add-surveillance command.
AFTDN Configuration
The add-aftdn command adds the access function target directory number (AFTDN). It must be executed by user calea_opr. The AFTDN associates a subject with the call agent serving that subject. The AFTDN must be added after the surveillance record is configured (using the add-surveillance command).
MML_calea_opr> add-aftdn:subsid=2222111112,afid=Cable;Table 7 describes the strings in the add-aftdn command.
IP Call Content Channel Configuration
The add-ipccc command adds the IP call content channel (IPCCC) and must be executed by user calea_opr. The IPCCC associates a target subscriber with a particular collection function. The IPCCC must be added after the surveillance record and AFTDN have been configured.
MML_calea_opr> add-ipccc:ipcccid=1,cccid=0001,state=AA,county=main-county,city=Home-Town, warantid=6789,subsid=3333000111,cfipaddr=172.18.137.56,cfport=9000;Table 8 describes the strings in the add-ipccc command.
Access Function Configuration
The add-af command adds access functions (AF), which are devices that intercept call data or call content, including call agents, gateways, and aggregation routers. The command must be executed by user calea_adm.
If the network includes aggregation routers supporting Simple Network Management Protocol version 3 (SNMPv3) interfaces, they must also be added with the type of SNMPER. (SNMPER identifies devices that support an SNMPv3 interface). Trunking gateways that support only MGCP LI options must be provisioned using the type TGW. Trunking gateways that support SNMPv3 should be provisioned as such.
MML_calea_adm> add-af:afid=1,name=CactusCable,type=BTS10200,version=3.2,preprov=000:00;MML_calea_adm> add-af:afid=I1705,name=I1705,type=CMTS,version=12.2,preprov=000:00;MML_calea_adm> add-af:afid=ESR-egw,type=SNMPER,version=12.2,preprov=000:00;Table 9 describes the strings in the add-af command.
Access Function BTS Provisioning Interface Configuration
The add-afbi command adds the access function BTS interface (AFBI), which provisions the interface that the SS8 SSDF uses to provision wiretaps on the BTS Element Management System (EMS). The command must be executed by user calea_adm. Because the EMS typically consists of active and standby units that each have different IP addresses, the add-afbi command must be configured for both units.
MML_calea_adm> add-afbi:afid=CactusCable,ifid=1,ipaddr=10.8.100.100,username=calea password=test123,reqstate=ACTIVE;MML_calea_adm> add-afbi:afid=CactusCable,ifid=2,ipaddr=10.8.100.101,username=calea password=test123,reqstate=ACTIVE;Table 10 describes the strings in the add-afbi command.
Note
Access Function PGW Provisioning Interface Configuration
The add-afgi command adds the access function PSTN Gateway (PGW) interface (AFGI), which provisions the interface that SS8 SSDF uses to provision wiretaps on the PGW. The command must be executed by user calea_adm. Because the PGW typically consists of an active and standby unit that each have different IP addresses, the add-afgi command must be configured for both units.
MML_calea_adm> add-afgi:afid=PGW,ifid=1,ipaddr=10.15.113.80,username=liusr,passwd=test123,reqstate=ACTIVETable 11 describes the strings in the add-afgi command.
Access Function RADIUS Interface Configuration
The add-afri command adds the access function Remote Authentication Dial-In User Services (RADIUS) interface (AFRI), which provisions the PacketCable Event Message interface between the call agent and the SS8 mediation device. The command must be executed by user calea_adm. As with the add-afbi command, the add-afri command must be performed for both active and standby call agent units. The AFID is the same for both, and the IFID is unique for each.
MML_calea_adm> add-afri:afid=CactusCable,ifid=1,ipaddr=10.8.100.102,port=14146,reqstate=ACTIVE,version=I0 3,sharedsecret=0000000000000000;MML_calea_adm> add-afri:afid=CactusCable,ifid=2,ipaddr=10.8.100.103,port=14146,reqstate=ACTIVE,version=I0 3,sharedsecret=0000000000000000;MML_calea_adm> add-afri:afid=7246-I1705,ifid=1,ipaddr=10.8.104.5,port=1646,reqstate=ACTIVE, version=I03,sharedsecret=0000000000000000;
Note
Table 12 describes the strings in the add-afri command.
SNMP Alarms and Traps Configuration
The add-almdest command configures SNMP alarms. It must be executed by user calea_adm.
MML_calea_adm> add-almdest:name=SNMP,type=SNMP;MML_calea_adm> add-almstream:name=SNMP,group=ALL,module=ALL,number=ALL,severity=ALL,type=ALL;The add-almstream command configures SS8 to send SNMP traps to the network management system. It must be executed by user calea_adm.
MML_calea-adm> add-almstream:name=SNMP,group=ALL,module=ALL,number=ALL,severity=ALL, type=PASS;For information on editing files to set up the addresses and ports of the SNMP network management server, see the SS8 Xcipio SSDF User Manual in the "Related Documents" section. The files that need to be edited will depend upon whether the network management server supports SNMPv1 or SNMPv2. The SS8 Management Information Base (MIB) definition files will also need to be installed into the network management software.
Verifying the PacketCable LI Network
The following sections describe how to verify the PacketCable LI network has been successfully configured:
•
•
•
•
•
Verifying the Cisco BTS 10200 Softswitch Call Agent Configuration
The following commands can be used to verify the LI configuration on the Cisco BTS 10200 softswitch call agent:
BTS> show aggrReply : Success: Entries 1-3 of 3 returned.ID=I1705_bundleTSAP_ADDR=10.8.0.1ES_SUPP=YDQOS_SUPP=YKA_TIMER=2RADIUS_AUTH_KEY=0000000000000000ACK_TIMEOUT=1000RETRY_COUNT=0ID=I1703_bundleTSAP_ADDR=10.8.4.1ES_SUPP=YDQOS_SUPP=YKA_TIMER=2RADIUS_AUTH_KEY=0000000000000000ACK_TIMEOUT=1000RETRY_COUNT=0ID=virt_aggrTSAP_ADDR=10.8.200.31ES_SUPP=YDQOS_SUPP=YKA_TIMER=10RADIUS_AUTH_KEY=0000000000000000ACK_TIMEOUT=1000RETRY_COUNT=0BTS> show mgw id=cva30Reply :Success:Entry 1 of 1 returned.ID=cva30TSAP_ADDR=x1-6-00-04-27-a5-b4-f5.ipclab.cisco.comCALL_AGENT_ID=CA146MGW_PROFILE_ID=CvaSTATUS=INSCALL_AGENT_CONTROL_PORT=2427RGW=YTGW=NNAS=NIAD=NPBX=NANS=NIVR=NMGW_MONITORING_ENABLED=NOPER_STATUS=NFAGGR_ID=CMTS1BTS> status aggr id=i1703_bundleReply : Success:AGGR ID -> i1703_bundleOPER STATE -> AGGR Unknown StateRESULT -> ADM configure result in failureREASON -> ADM database table(s) or entries not foundBTS> status aggr id=I1705_bundleReply : Success:AGGR ID -> I1705_bundleOPER STATE -> AGGR IN ServiceRESULT -> ADM configure result in successREASON -> ADM executed successfulThe show wiretap EXEC command can be issued only by the user "calea."
BTS> show wiretapReply : Success: Entries 1-2 of 2 returned.SUBSCRIBER_DN=9892121212SUB_ID=cvafb1/1TAPTYPE=PEN_AND_TRACECDC_DF_ADDRESS=10.8.100.17CDC_DF_PORT=1813SUBSCRIBER_DN=9891221111SUB_ID=cvafb2/1TAPTYPE=INTERCEPTCDC_DF_ADDRESS=10.8.100.17CDC_DF_PORT=1813CCC_DF_ADDRESS=10.15.92.29CCC_DF_PORT=45010The show wiretap subscriber EXEC command can be issued only by the user "calea."
BTS> show wiretap subscriber_dn=6213000001SUBSCRIBER_DN=6213000001TAPTYPE=INTERCEPTCDC_DF_ADDRESS=10.15.113.9CDC_DF_PORT=1813CCC_DF_ADDRESS=10.15.113.9CCC_DF_PORT=45010Reply: Success: Entry 1 of 1 returned.BTS>The show ess EXEC command can be issued only by the user "calea."
BTS> show essReply : Success: Entries 1-2 of 2 returned.CDC_DF_PORT=1813CDC_DF_ADDRESS=10.8.100.17ENCRYPTION_KEY=0000000000000000ACC_REQ_RETRANSMIT=3ACC_RSP_TIMER=2CDC_DF_PORT=1813CDC_DF_ADDRESS=141.1.1.31ENCRYPTION_KEY=0000000000000000ACC_REQ_RETRANSMIT=3ACC_RSP_TIMER=2Enter the show call-agent-profile EXEC command to verify the call agent profile:
CLI> show call-agent-profileID=CA146CMS_ID=12345MGC_ID=54321FEID=54321CMS_SUPP=YMGC+SUPP=YDQOS_SUPP=YCDB_BILLING_SUPP=NEM_BILLING_SUPP=YGTD_SUPP=NReply: Success: Entry 1 of 1 returned.Verifying the VISM Card Configuration
When using the BTS call agent, you only need to verify that CALEA is enabled on the VISM cards. To display the status of CALEA, use the following command:
VISM-1> dspcaleaCALEA : enableVerifying the Cisco uBR 7246 VXR CMTS Configuration
To verify that the CMTS is connected to the call agent, use the show packetcable gc-list EXEC command. This command indicates if a successful COPS session has been opened between the uBR and the call agent. The output should indicate the correct IP address of the call agent along with COPS and TCP handle IDs. The following example shows successful output from the show packetcable gc-list EXEC command:
ubr7246vxr-1# show packetcable gc-listGC-Addr GC-Port COPS-handle TCP-handle10.15.113.9 0x8041 0x620F3738 0x620F3738To verify that gates are enabled on the CMTS, use the show packetcable global EXEC command. The following example shows successful output:
ubr7246vxr-1# show packetcable globalPacket Cable Global configuration:Enabled :YesMax Gates :100Default Timer value -T0 :30000 msecT1 :300000 msecT2 :2000 msecT5 :500 msecVerifying the Verint STAR-GATE Mediation Device Configuration
The Verint STAR-GATE mediation device is configured and verified by using a GUI. For information on verifying the Verint STAR-GATE, see the Verint STAR-GATE System Description Manual and the Verint STAR-GATE System Administration Manual in the "Related Documents" section.
Verifying the SS8 Mediation Device Configuration
The following commands can be used to verify the SS8 mediation device configuration. For more information on verifying the SS8 mediation device, see the SS8 Xcipio SSDF User Manual in the "Related Documents" section.
MML_TH> display-almdest:;-----------------------------------------------------------------NAME TYPE DEST ARG STATUS-----------------------------------------------------------------CONSOLE CONSOLE stdout OKLOG LOGFILE /ADC/ADCsoftware/SS8/access/AlarmLogs AccessAlarms.0 OKPANEL PANEL 0x16000001 819296 OKSNMP SNMP OK<SUCCESS>:: 4 records found.MML_TH> display-almstream:;-----------------------------------------------NAME GROUP MODULE NUMBER SEVERITY TYPE-----------------------------------------------CONSOLE ALL ALL ALL ALL PASSLOG ALL ALL ALL ALL PASSPANEL ALL ALL ALL ALL PASSSNMP ALL ALL ALL ALL PASS<SUCCESS>:: 4 records found.MML_TH> display-ipdu:;-----------------------------------------------------------------------------------IPDUID HOSTNAME IPADDR PORT STATE INSTR INEND OUTSTR OUTEND-----------------------------------------------------------------------------------1 swiss 10.15.93.29 15001 ACTIVE 45001 45128 45129 45512<SUCCESS>:: 1 records found.MML_TH> display-ipport:;---------------------------------------------IPDUID PORTID PORT DIRECTION PROTOCOL STATE---------------------------------------------1 1 45001 IN UDP IDLE1 2 45002 IN UDP IDLE1 3 45004 IN UDP IDLE1 4 45003 IN UDP IDLE1 5 45005 IN UDP IDLE1 6 45006 IN UDP IDLE1 7 45007 IN UDP IDLE1 8 45008 IN UDP IDLE1 9 45009 IN UDP IDLE1 10 45010 IN UDP IDLE1 11 45129 OUT UDP IDLE1 12 45130 OUT UDP IDLE1 13 45131 OUT UDP IDLE1 14 45132 OUT UDP IDLE1 15 45133 OUT UDP IDLE1 16 45134 OUT UDP IDLE1 17 45135 OUT UDP IDLE1 18 45136 OUT UDP IDLE1 19 45137 OUT UDP IDLE1 20 45138 OUT UDP IDLE<SUCCESS>:: 20 records found.MML_TH> display-cf:;--------------------------------------------------------CFID NAME TYPE GRP1 GRP2 GRP3 GRP4 CARRIER--------------------------------------------------------1 PenLink TCPIP N/A N/A N/A N/A 0002 JSI TCPIP N/A N/A N/A N/A 000<SUCCESS>:: 2 records found.MML_TH> display-tcpipcfi:;-------------------------------------------------------------CFID OWNIP IPADDR PORT REQSTATE STATE-------------------------------------------------------------1 172.18.137.105 172.18.137.94 43001 ACTIVE ACTIVE2 172.18.137.105 172.18.137.56 43001 ACTIVE ACTIVE<SUCCESS>:: 2 records found.MML_TH> display-af:;------------------------------------------------------------------------------------------ -AFID NAME TYPE SERIAL VERSION PREPROV INDEX------------------------------------------------------------------------------------------ -CBeyond BTS_CBeyond BTS10200 N/A 2.1 000:00 1CactusCable BTS_CactusCable BTS10200 N/A 3.3 000:00 2<SUCCESS>:: 2 records found.MML_TH>MML_TH> display-afbi:;------------------------------------------------------------------------------------------AFID IFID IPADDR REQSTATE STATE USERNAME PASSWD------------------------------------------------------------------------------------------CBeyond 1 10.15.69.7 INACTIVE INACTIVE calea test123CactusCable 1 10.8.100.100 ACTIVE INACTIVE calea test123CactusCable 2 10.8.100.101 ACTIVE INACTIVE calea test123<SUCCESS>:: 3 records found.MML_TH> display-afsi:;------------------------------------------------------------------------------------------ -------------------------------------------------------------------AFID IFID DOMAINNAME IPADDR PORT REQSTATE STATE USERNAME AUTHPASSWD PRIVPASSWD SECURITYLVL------------------------------------------------------------------------------------------ -------------------------------------------------------------------7200-egw 1 7200-egw.sm02.cisco.com 10.15.115.1 161 ACTIVE ACTIVE ss8user ss8passwd ss8passwd AUTHNOPRIV7500-egw 1 7500-egw.sm02.cisco.com 10.15.115.2 161 ACTIVE ACTIVE ss8user ss8passwd ss8passwd AUTHNOPRIVESR-egw 1 ESR-egw.sm02.cisco.com 10.15.115.3 161 ACTIVE ACTIVE ss8user ss8passwd ss8passwd AUTHNOPRIV<SUCCESS>:: 3 records found.MML_TH> display-afri:;---------------------------------------------------------------------------------AFID IFID IPADDR PORT REQSTATE VERSION SHAREDSECRET---------------------------------------------------------------------------------CBeyond 1 10.15.69.35 1813 ACTIVE I02 0000000000000000CBeyond 2 10.15.69.36 1813 ACTIVE I02 0000000000000000CBeyond 3 10.15.69.67 1813 ACTIVE I02 0000000000000000CBeyond 4 10.15.69.68 1813 ACTIVE I02 0000000000000000PGW 1 10.15.113.80 14146 ACTIVE I03 0000000000000000CactusCable 1 10.8.100.102 14146 ACTIVE I03 0000000000000000CactusCable 2 10.8.100.103 14146 ACTIVE I03 0000000000000000<SUCCESS>:: 7 records found.MML_TH> display-surveillance:;------------------------------------------------------------------------------------------ --------------------------------------------------------------------------STATE COUNTY CITY WARRANTID JAREA CASEID SUBSID ENTRYDATESTARTDATE EXPDATE STATUS CFID SURVTYPE CONTENT USER ACCESS------------------------------------------------------------------------------------------ -------------------------------------------------------------------------NC Wake RTP 1187 COUNTRY 1187 7242711187 05/03/200205/03/2002 05/03/2003 ACTIVE 2 DATA NONE calea_opr PUBLIC<SUCCESS>:: 1 records found.In the following output from the display-aftdn:; command, the first entry is for call data only. The second entry is for call data and for call content. The SS8 software automatically selects the IP address and the port number.
MML_TH> display-aftdn:;------------------------------------------------------------------------------SUBSID AFID IPADDR PORT REQSTATE STATE------------------------------------------------------------------------------7242711187 1 N/A 0 ACTIVE TOBEPROV9192621002 2 10.15.93.29 45010 ACTIVE TOBEPROV<SUCCESS>:: 1 records found.MML_TH> display-ipccc:;------------------------------------------------------------------------------------------ -------------IPCCID STATE COUNTY CITY WARRANTID CCCID SUBSID CFIPADDR CFPORT STATUS------------------------------------------------------------------------------------------ -------------1 NC Wake RTP 2621002 1002 9192621002 172.18.137.56 9000 ACTIVE<SUCCESS>:: 1 records found.Troubleshooting a PacketCable LI Network
The following sections provide guidance in troubleshooting a PacketCable LI network:
•
•
•
General Troubleshooting Notes
The most common problem encountered in configuring voice intercept on a network is general networking problems. All of the involved devices must have static IP addresses, and most require the use of specific ports.
All of the firewalls involved (end customer, SP, ISP, LEA, and so on) must allow the static IP addresses and port numbers through.
When firewalls prohibit ping traffic, pings cannot be used for troubleshooting. Instead, a sniffer may be used to verify connectivity.
J-STD has a test message for verifying and troubleshooting, but it is not supported by PacketCable messaging.
Troubleshooting the Mediation Device
If you have trouble with a mediation device, first check the mediation device logs and alarms. In case of serious trouble, the mediation devices have various tracing mechanisms. For information on troubleshooting the Verint STAR-GATE mediation device, see the Verint STAR-GATE Maintenance and Troubleshooting Manual in the "Related Documents" section.
On the SS8 Xcipio mediation device, if the file /etc/resolv.conf is edited to add or modify IP addresses of DNS servers while the CALEA application is running, CALEA must be stopped and re-started (using the calea_stop and calea_start commands) before the application will recognize the configuration changes. For more information on troubleshooting the SS8 Xcipio mediation device, see the SS8 Xcipio SSDF User Manual in the "Related Documents" section.
Troubleshooting the BTS Call Agent
To perform ESS and wiretap commands on the BTS, you must log in as user calea. All other commands, including the ones shown below, can be performed by any user with the proper permissions.
When accessing the BTS, you must log in as user calea.
The following sections describe troubleshooting procedures on the BTS call agent:
•
•
For more information on debugging and tracing tools for the BTS, see the BTS CALEA Interface Specification documentation in the "Related Documents" section.
Troubleshooting the Call Agent Profile
Enter the show call-agent-profile EXEC command to verify the call agent profile:
CLI> show call-agent-profileID=CA146CMS_ID=12345MGC_ID=54321FEID=54321CMS_SUPP=YMGC_SUPP=YDQOS_SUPP=YCDB_BILLING_SUPP=NEM_BILLING_SUPP=YGTD_SUPP=NReply: Success: Entry 1 of 1 returned.The EM_BILLING_SUPP, CMS_SUPP, and MGC_SUPP all must be set to Y. The CMS_ID, MGC_ID, and financial entity ID (FEID) all must be set to nonzero numbers.
CMS_SUPP controls the sending of event messages when an on-net endpoint is involved in the call. If MGC_SUPP is set to Y, the BTS will send event messages; if it is set to N, the BTS will not send event messages.
CMS_ID, MGC_ID, and FEID are PacketCable network element identifiers. Unique values for these network elements must be agreed upon by all involved parties. For the purposes of settlements, PacketCable zones are divided into one or more logical financial entities. A single call agent is assigned at most one FEID. One or more call agent may be assigned the same FEID.
MGC_SUPP controls the sending of event messages when an off-net endpoint is involved in the call. If MGC_SUPP is set to Y, the BTS will send event messages; if it is set to N, the BTS will not send event messages.
Troubleshooting the Call Agent to CMTS Interface
Use the show packetcable gc-list EXEC command as shown in the previous "Verifying the Cisco uBR 7246 VXR CMTS Configuration" section. If you do not see similar output, there is a problem with the connection between the call agent and the CMTS. Complete the following procedure to troubleshoot this connection:
1.
Ensure that each aggregation router (AGGR) has only one entry. If any AGGR has duplicate entries with different tsap-addr, delete the incorrect one. The AGGR should use the CMTS cable interface IP address as its tsap-addr.
2.
Ensure that the OPER STATE is AGGR IN_Service.
3.
"Unable to send OPN message to client layer"This error indicates that the CMTS client type is incorrect. For Release 3.3 on the BTS, the CMTS must support the I03 DQoS client type, which is 8008. (I02 uses client type 8005). If you encounter this error, you will need to load a different image on the CMTS that supports I03 DQoS.
4.
ubr7246.241#config> packetcable enableubr7246.241#config> packetcable max-gates 100 (the value 100 is used for testing)If you switch the CMTS image, you must re-enable these commands after the CMTS is reloaded.
5.
There are various debugging commands that can be used on the CMTS, but they can impact call performance and should be used only under the direction of Cisco support.
Appendix
This section contains the following information:
•
•
Cisco Products That Support PacketCable Lawful Intercept BTS Versions 3.5 and 4.1
Table 13 provides the following additional information on the Cisco products that support PacketCable LI BTS versions 3.5 and 4.1:
•
•
•
Related Documents
Table 14 lists related documents.
Standards
RFCs
Technical Assistance
Glossary
AF—access function
AFBI—access function BTS interface
AFGI—access function PGW interface
AFID—access function ID
AFRI—access function RADIUS interface
AFTDN—access function target directory number
AGGR—aggregation router
ATA—Analog Telephone Adapter
BTS—Broadband Telephony Softswitch. A call agent.
CALEA—Communications Assistance for Law Enforcement Act
CC—call content
CCC—call content connection
CCCid—call content connection identifier
CC IAP—Communication Content intercept access point
CFID—collection function ID
CMS—call management server
CMTS—cable modem termination system
COPS—Common Open Policy Service
DCFD—Data Collection and Filtering Device. A sniffer that collects and analyzes RADIUS traffic.
DHCP—Dynamic Host Configuration Protocol
DNS—Domain Name Service
DQoS—dynamic quality of service
EMS—Element Management System
ESR—Edge Services Router
ESS—Electronic Surveillance Subsystem
FEID—financial entity ID
IAD—Integrated Access Device
IAP—intercept access point
IFID—Interface ID
IPCCC—IP call content channel
IPDU—IP delivery unit
IRI IAP—Intercept-Related Information intercept access point
ISP—Internet service provider
LEA—law enforcement agency
LI—lawful intercept
MD—mediation device. A hardware device that receives signal and voice information from an SP or ISP network and translates the information into the correct protocol.
MGC—Media Gateway Controller
MGCP—Media Gateway Control Protocol
MIB—Management Information Base
MML—Man Machine Language
MTA—media termination adapter
NAS—network access server
off-net—off-network
on-net—on-network
PGW—PSTN Gateway
PSTN—public switched telephone network
RADIUS—Remote Authentication Dial-In User Services
reqstate—required state
SIP—Session Initiation Protocol
SMDS—Switched Multimegabit Data Service
sniffer—A network analyzer used to capture packets transmitted in a network for inspection and problem detection.
SNMPv3—Simple Network Management Protocol version 3
SP—service provider
SSDF—Softswitch Delivery Function. A software program provided by SS8 Networks called Xcipio SSDF.
SSH—Secure Shell
tcpipcfi—TCP/IP collection function interface
TGW—trunking gateway
TIA—Telephone Industry Association
UDP—User Datagram Protocol
uBR—Universal Broadband Router
VISM—Voice Interworking Service Module
VoIP—Voice over IP
VXSM—Voice Switch Service Module
Note
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006 Cisco Systems, Inc. All rights reserved.
Feedback