PDN Gateway Overview
Features and Functionality - Optional Enhanced Feature Software ▀
Cisco ASR 5x00 Packet Data Network Gateway Administration Guide ▄
81
Important:
For more information on inter-chassis session recovery support, refer to the
Interchassis Session
Recovery
chapter in the
System Administration Guide
.
IP Security (IPSec) Encryption
Use of Network Domain Security requires that a valid license key be installed. Contact your local Sales or Support
representative for information on how to obtain a license.
IPSec encryption enables network domain security for all IP packet switched LTE-EPC networks in order to provide
confidentiality, integrity, authentication, and anti-replay protection. These capabilities are insured through use of
cryptographic techniques.
The Cisco P-GW supports IKEv1 and IPSec encryption using IPv4 addressing. IPSec enables the following two use
cases:
Encryption of S8 sessions and EPS bearers in roaming applications where the P-GW is located in a separate
administrative domain from the S-GW
IPSec ESP security in accordance with 3GPP TS 33.210 is provided for S1 control plane, S1 bearer plane and S1
management plane traffic. Encryption of traffic over the S1 reference interface is desirable in cases where the
EPC core operator leases radio capacity from a roaming partner's network.
Important:
For more information on IPSec support, refer to the
Cisco StarOS IP Security (IPSec) Reference
.
L2TP LAC Support
Use of L2TP LAC requires that a valid license key be installed. Contact your local Sales or Support representative for
information on how to obtain a license.
The system configured as a Layer 2 Tunneling Protocol Access Concentrator (LAC) enables communication with L2TP
Network Servers (LNSs) for the establishment of secure Virtual Private Network (VPN) tunnels between the operator
and a subscriber's corporate or home network.
The use of L2TP in VPN networks is often used as it allows the corporation to have more control over authentication
and IP address assignment. An operator may do a first level of authentication, however use PPP to exchange user name
and password, and use IPCP to request an address. To support PPP negotiation between the P-GW and the corporation,
an L2TP tunnel must be setup in the P-GW running a LAC service.
L2TP establishes L2TP control tunnels between LAC and LNS before tunneling the subscriber PPP connections as
L2TP sessions. The LAC service is based on the same architecture as the P-GW and benefits from dynamic resource
allocation and distributed message and data processing.
The LAC sessions can also be configured to be redundant, thereby mitigating any impact of hardware or software
issues. Tunnel state is preserved by copying the information across processor cards.
Important:
For more information on this feature support, refer to the
L2TP Access Concentrator
appendix in this
guide.
