Transcript Mobile IP Technology Overview

Mobile Networking
Technology
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -1
The benefit of Mobile IP
“
“Mobile IP provides an IP node the ability to
retain the same IP address and maintain
uninterrupted network and application
connectivity while traveling across
networks ”
”
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-2
Which Applications
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -3
The objective
Maintaining continuous IP connectivity
while crossing network boundaries, e.g.
subnets or between networks
Gateway A
171.68.0.0
Host B
Internet
Mobile Router
171.68.69.0
171.68.70.0
© 2002, Cisco Systems, Inc. All rights reserved.
Gateway C
140.31.0.0
Mobile Router
171.68.69.0
171.68.70.0
Cisco Mobile Access Router—Module 2-4
The Possibilities
Many Networks Roaming
Internet
© 2002, Cisco Systems, Inc. All rights reserved.
Mobile Routers
Cisco Mobile Access Router—Module 2-5
IETF Proposed Standard
• Approved by the Internet Engineering Steering Group
(IESG) in June 1996; published proposed standard in
Nov. 1996
• Mobile IP is an IETF proposed standard solution for
mobility at Layer 3 IP
– RFC2002/3220 - Mobile IP
– RFC2003 and RFC2004 - Tunnel encapsulation
– RFC2005 - Mobile IP applicability
– RFC2006 - Mobile IP MIB
• Associated RFCs
– RFC1701 GRE – Generic Routing Encapsulation
– RFC3024 - Reverse Tunneling for Mobile IP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-6
The Problem with Mobility
Where is 171.68.69.0???
?
Gateway A
171.68.0.0
Mobile Router
171.68.69.0
171.68.70.0
“Connect to
171.68.69.24”
Host B
Internet
Gateway C
140.31.0.0
X
Mobile Router
171.68.69.0
171.68.70.0
SEND
• Gateway A replies to Host B with an ICMP unreachable
• Gateway C blocks router from joining network
• Routing Protocol rejects duplicate network advertisements
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-7
Mobile IP Solution
Mobility Binding Table:
MR
CoA
171.68.69.0 140.31.2.1
Host B
Internet
Home Agent
Mobile Router 171.68.60.1
171.68.69.0
171.68.70.0
Foreign Agent
COA 140.31.2.1
Mobile Router
171.68.69.0
171.68.70.0
• Mobile Router sends Registration Request [RRQ] to Home Agent (HA)
• Home Agent forwards packets to Mobile Router via Care of Address
[CoA]
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-8
Mobile IP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -9
Operator Benefits
• All applications work without
modifications (unlike
application/transport layer mobility)
• Operator can control handover
policies
• Access link independent (unlike link
layer mobility)
“IETF Standard RFC 3344!”
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-10
Solution in a Nutshell
• A mobile node has a “home address”
for the end-to-end communications,
but also uses a temporary “care-of
address” on access networks for
routing purpose.
• A home agent maintains a mobility
binding of home address and care-of
address.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-11
Mobile IP Network Elements
1. Mobile Node (MN): Mobile IP enabled
clients identified by home address or NAI
(notebooks, cell phones, PDAs) updates
CoA via registrations
2. Home Agent (HA): Mobile IP enabled
gateway acts as location database for
MNs
3. Foreign Agent (FA): Mobile IP enabled
gateway [Optional] off-loads CPU
processing of
encapsulation/decapsulation, enforces
local network administration policy,
allows for billing of MNs, conserves IP
address space, reduce access link usage
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-12
Mobile IP Key Concepts
• How does the Mobile Node find out where it is?
Mobility Agent Advertisements—facilitates discovery of
Mobility Agents (MN may solicits on demand)
• How does the Mobile Node inform the Home Agent of its current
location?
Via Registration—updates mobility binding after successful
authentication using security association between MN and
HA
• How does the Mobile Node receive packets from the Home
Agent?
Tunneling—Home agent adds IP header to direct packets to
CoA, where decapsulation occurs
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-13
Mobile IP Activities Example
Mobility Binding Table:
MN
CoA
171.68.69.24
140.31.2.1
Home Agent
171.68.69.1
Host A
171.68.69.24
Host B
Internet
Foreign Agent
140.31.2.1
Host A
171.68.69.24
• MN learns about FA and registers CoA
• HA maintains MN location database and
tunnels traffic to FA
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-14
Mobile IP Terminology
CN
HA
•
•
•
•
•
•
•
•
Internet
FA
Mobile Router (MR)
Home Agent (HA)
MR
Foreign Agent (FA) [1 Hop Away from MR]
Care of Address (CoA) [Tunnel Endpoint]
Correspondent Node (CN)
Security Association (SA) [SPI/Key]
ICMP Router Discovery Protocol (IRDP) [Advertisement]
Registration Request (RRQ)
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-15
Step 1: Agent Discovery
Dest Addr
MR Addr
Edited slide from original by
Lawrence Searcy, Cisco Systems
Src Addr
FA Intfc Addr
Advertisement
Includes COA
FA
MR
1.1.1.7
Src Addr
MR addr
HA
Dest Addr
224.0.0.2
MR
1.1.1.7
Solicitation
• MR sends out advertisement request (Solicitation) to
“all router” multicast address 224.0.0.2
• FA responds with unicast advertisement to MR
Response includes Care-of Address
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-16
Options in FA advertisements
•
•
•
R
Registration required. Registration with this foreign
agent (or another foreign agent on this link) is required
even when using a co-located care-of address.
•
•
B
Busy. The foreign agent will not accept registrations
from additional mobile nodes.
•
•
H
Home agent. This agent offers service as a home agent on
the link on which this Agent Advertisement message is
•
sent.
•
•
•
F
Foreign agent. This agent offers service as a foreign
agent on the link on which this Agent Advertisement
message is sent.
•
•
M
Minimal encapsulation. This agent implements receiving
tunneled datagrams that use minimal encapsulation [34].
•
•
G
GRE encapsulation. This agent implements receiving
tunneled datagrams that use GRE encapsulation [16].
•
•
r
Sent as zero; ignored on reception. SHOULD NOT be
allocated for any other uses.
•
T
© 2002, Cisco Systems, Inc. All rights reserved.
Foreign agent supports reverse tunneling [27].
Cisco Mobile Access Router—Module 2-17
Step 2: Registration Request
FA
MR
1.1.1.7
Src Addr
MR Addr
Src Port
random
Dest Addr
FA Intfc Addr
Dest Port
434
RRQ
Includes COA from FA
HA
Src Addr
FA Intfc Addr
Src Port
434
Dest Addr
HA Addr
Dest Port
434
1.1.1.7
RRQ
Includes COA
• MR retrieves CoA from Advertisement and
sends in RRQ
• FA checks requested services and either
rejects and replies or forwards the RRQ to HA
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-18
Options in RRQ
•
S
Simultaneous bindings. If the 'S' bit is set, the mobile
•
node is requesting that the home agent retain its prior
•
mobility bindings, as described in Section 3.6.1.2.
•
B
•
node requests that the home agent tunnel to it any
•
broadcast datagrams that it receives on the home network,
•
as described in Section 4.3.
•
D
Decapsulation by mobile node. If the 'D' bit is set, the
•
mobile node will itself decapsulate datagrams which are
•
sent to the care-of address. That is, the mobile node is
•
using a co-located care-of address.
•
M
Minimal encapsulation. If the 'M' bit is set, the mobile
•
node requests that its home agent use minimal
•
encapsulation [34] for datagrams tunneled to the mobile
•
node.
•
G
GRE encapsulation. If the 'G' bit is set, the mobile
•
node requests that its home agent use GRE encapsulation
•
[16] for datagrams tunneled to the mobile node.
•
r
•
•
© 2002, Cisco Systems, Inc. All rights reserved.
Broadcast datagrams. If the 'B' bit is set, the mobile
Sent as zero; ignored on reception. SHOULD NOT be
allocated for any other uses.
T
Reverse Tunneling requested; see [27].
Cisco Mobile Access Router—Module 2-19
Step 2: RRQ Reply
Dest Addr
MR Addr
Dest Port
Orig Port
Dest Addr
FA
Dest Port
434
Src Addr
FA Intfc Addr
Src Port
434
Src Addr
HA Intfc Addr
Src Port
434
RRP Reply
RRP Reply
FA
HA
MR
1.1.1.7
1.1.1.7
Home Agent
Foreign Agent
FA sees MR is
authenticated
•
HA authenticates MR
•
•
Sends RRP
Forwards RRP to
MR
•
Proxy ARPs for MR
•
Brings up tunnel
•
Brings up tunnel and
adds host route
•
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-20
MR States
MR has five states that it can be in:
• Unknown – MR has not heard any agent
advertisements and does not know where to send
registration requests (RRQs)
• Isolated – MR has heard an agent advertisement
• Pending – MR has sent an RRQ and is waiting for a
registration reply (RRP) from HA
• Registered – MR has been accepted and received the
RRP from HA, which has set up a binding table entry,
tunnels, and routes for the MR
• Home—MR is on its home network
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-21
Step 3: Routing
Correspondent
Host
Home
Agent
Foreign
Agent
Mobile
Router
• Traffic is sent as usual to the home subnet
• The home agent intercepts the traffic while the Mobile
Router is registered as away
• Traffic is tunneled to the CoA of the MR and
forwarded to MR
• Traffic from the Mobile Networks can go directly to the
correspondent host = “Triangle Routing”
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-22
Mobile Network Routing – Packet Flow
Mobile
Networks
Node on MR
Mobile Router
Foreign Agent
Internet
Mobile
Networks
appear to
be here
Correspondent Node
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Edited slide from original
by Lawrence Searcy, Cisco
Systems
Cisco Mobile Access Router—Module 2-23
Mobile Network Routing – Packet Flow
Mobile
Networks
Node on MR
Mobile Router
HA-FA Tunnel
Foreign Agent
Internet
Mobile
Network
appears
to be here
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Correspondent Node
Cisco Mobile Access Router—Module 2-24
Mobile Network Routing – Packet Flow
Mobile
Networks
Nodes on MR
HA-MR Tunnel
Mobile Router
FA WAN
HA-FA Tunnel
Foreign Agent
Internet
Mobile
Network
appears
to be here
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Correspondent Node
Cisco Mobile Access Router—Module 2-25
Mobile Network Routing – Packet Flow
Mobile
Networks
Node on MR
HA-MR Tunnel
Mobile Router
FA WAN
HA-FA Tunnel
Foreign Agent
Internet
Mobile
Network
appears
to be here
Correspondent Node
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-26
Mobile Network Routing – Return Packet Flow
Mobile
Networks
Node on MR
HA-MR Tunnel
Mobile Router
FA WAN
HA-FA Tunnel
Foreign Agent
Internet
Mobile
Network
appears
to be here
Correspondent Node
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-27
Tunneling
• HA double encapsulates the packets,
creating two tunnels:
HA to FA
HA to MR
• FA strips outer header and forwards to MR
• MR strips inner header and forwards to
node on mobile network
Outer Header
HA
FA
100.100.100.1 30.30.30.1
© 2002, Cisco Systems, Inc. All rights reserved.
Inner Header
HA
100.100.100.1
MR
65.1.1.1
Original Packet
<src> <dest> Data
Cisco Mobile Access Router—Module 2-28
Tunneling cont.
• HA dynamically creates tunnel(s) as MRs
and Mobile Hosts register
• Tunnels are handled as interfaces
• HA Routing Table shows Tunnels as
interfaces
• So “Tunneling” involves
ENCAPSULATION
INTERFACES IN ROUTING TABLE
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-29
HA State – Routing Table
Home_Agent_#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
110.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
M
110.10.11.0/24 is directly connected, Mobile0
M
110.10.11.237/32 [3/1] via 10.10.10.97, 00:57:28, Tunnel2
M
110.10.11.245/32 [3/1] via 10.10.10.129, 03:01:54, Tunnel0
10.0.0.0/8 is variably subnetted, 14 subnets, 3 masks
C
10.10.10.32/27 is directly connected, FastEthernet0/0
C
10.10.10.76/30 is directly connected, Loopback0
O IA 10.10.10.96/27 [110/11] via 10.10.10.36, 00:57:35, FastEthernet0/0
M
10.10.11.112/28 [3/1] via 110.10.11.237, 03:55:57, Tunnel1
O IA 10.10.10.128/27 [110/2] via 10.10.10.74, 00:57:35, FastEthernet0/1
M
10.10.11.144/28 [3/1] via 110.10.11.245, 03:55:57, Tunnel5
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-30
MR Routing
• Once MR is registered, routing is
disabled on the MR’s roaming
interfaces.
• When MR is home, routing is
resumed on the interfaces (bindings
and tunnels are no longer needed).
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-31
Mobile Router Timers
• Agent Solicitation-By default it is off, but if
configured, keeps track of when to send next
solicitation
• Agent Advertisement-Based on IRDP lifetime. As
advertisements are received, timer is restarted. When
timer expires, agent removed from agent table.
• Registration-Keeps track of when to send
registrations before the registration lifetime expires.
MR re-registers until a reply is received.
• Registration lifetime-Based on granted lifetime. As
replies are received, timer is restarted. When timer
expires, there is no more registration.
• Hold down-By default it is off, but if configured, MR
waits for timer to expire before using an agent heard
on that interface.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-32
Mobile IP
Features
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -33
Mobile Router Features
Co-located Care-of Address
Reverse tunneling
Preferred interfaces
Hold down timer
Agent solicitation
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-34
Mobile Router Features
MR redundancy
MR Asymmetric Links
MR Dynamic Networks
Identification mismatch adjustment
Sequence number detection
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-35
Co-located Care-of Address Support
MR
HA
• Care-of Address resides on Mobile Router
itself
Rather than on the Foreign Agent
• Does away with the need for Foreign Agents
• Two IP-in-IP tunnels are created: HA-Colocated address, HA-MR
HA-Co-located address tunnel is only used for
routing
Tunnel “Interfaces” added in Routing table
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-36
Co-located Care-of Address cont.
MR
HA
• Static Co-located Care-of Address
support uses the address statically
configured on the roaming interface as
care-of address
Used for fixed-IP address connections
e.g. Cellular Data Modem
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-37
Static Co-located Care-of Address
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco
CiscoMobile
MobileAccess
AccessRouter—Module
Router—Module 22-38
-38
Co-located Care-of Address cont.
HA
MR
• CCoA can be Static or Dynamic
• Dynamic Co-located Care-of Address
support uses DHCP or IPCP to obtain a
care-of address for the roaming
interface
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-39
Reverse Tunneling
• Normally, routers route packets by looking
at the destination address only.
• A security measure against attacks (such
as spoofing), ingress filtering on a router
checks the source and destination
addresses on a packet to make sure that
they are topologically correct.
• This poses a problem for Mobile IP
because the source address of a packet
from a mobile node does not belong to the
network from which it emanated.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-40
Mobile Network Routing – Packet Flow
Mobile Network
Node on MR
HA-MR Tunnel
Mobile Router
FA WAN
HA-FA Tunnel
Foreign Agent
Internet
Mobile
Network
appears
to be here
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Correspondent Node
Cisco Mobile Access Router—Module 2-41
Reverse Tunneling
• Reverse tunneling satisfies ingress filtering
• Packets from the mobile network are sent
back to the HA through the tunnel
• HA de-capsulates the packets and forwards
them to their destination through normal
routing
• Thus, the received packets’ path is
topologically correct
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-42
Mobile Network Routing – Reverse Tunneling
Mobile Network
Node on MR
Roaming
Interface
HA-MR Tunnel
Mobile Router
FA WAN
HA-FA Tunnel
Foreign Agent
Internet
Mobile
Network
appears
to be here
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
Correspondent Node
Edited slide from original
by Lawrence Searcy, Cisco
Systems
Cisco Mobile Access Router—Module 2-43
Preferred Interfaces
• By default, the Mobile Router sends data out
the active interface with the highest
bandwidth.
• If the bandwidth on multiple interfaces is
equal, then the interface with the higher IP
address is preferred.
• Priority can be configured on mobile router
interfaces (default 100).
• MR prefers to register with higher priority
interface.
• Uses – least-cost routing, preferential routing
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-44
Asymmetric Links
• Mobile Router can route traffic
unidirectionally over half-duplex links
Especially for a satellite environment
• MR configured to send traffic to a
downlink router even though it hears
advertisements on another interface
• FA configured to advertise foreignagent service out only one interface, the
uplink interface connected to MR
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-45
Asymmetric Links
MR sends RRQ to HA
via FA using its uplink
FA advertises service on
its uplink to MR’s downlink
Downlink
ADVT
Uplink
Downlink
Uplink
RRQ
RRP
Home Agent
Foreign Agent
RRP is sent to FA,
which forwards it to
MR on its uplink.
© 2002, Cisco Systems, Inc. All rights reserved.
MR
Then tunnels are
set up between HA-FA,
HA-MR’s downlink
interface
Cisco Mobile Access Router—Module 2-46
Dynamic Mobile Networks
•Mobile Networks can register with Home
Agent dynamically (as opposed to static
network configuration on HA)
•Critical Vendor/Organization Specific
Extension (CVSE) is appended to the RRQ
by MR, which contains the mobile network
information
•Re-registrations do not append CVSE
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-47
Dynamic Mobile Networks cont.
•When mobile network is added/deleted,
MR immediately sends another reregistration with CVSE
•HA processes RRQ with CVSE by
adding/deleting mobile network(s) and
creating/deleting routes to the mobile
network via MR
•If mobile network already exists HA
ignores the request
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-48
Dynamic Mobile Networks cont. 2
•FA needs to be able to process RRQs
with CVSE in order to forward them on
to HA.
•Dynamic and Static Networks can be
configured at the same time for an MR.
NOTE: CVSE is being replaced by AVSE
(standards-based) in near future
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-49
Mobile IP
in real deployments
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -50
Mobile IP and GPRS Similarities
GGSN
IP Network
SGSN
GTP
MT
HA
IP Network
FA
IPinIP/GRE/UDP
MN
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-51
Mobile IP and GPRS Integration
BSC
BTS
AP
RADIUS
Server
Serving GPRS
Support Node
(SGSN)
GPRS
Backbone
Network
(IP-Based)
Home Agent
© 2002, Cisco Systems, Inc. All rights reserved.
WLAN
Hotspot
GTP
Internet
Gateway
GPRS
Support Node
(GGSN)
Foreign Agent function can be
added to GGSN and WLAN
Access Router, though Mobile IP
works without FA as well.
Cisco Mobile Access Router—Module 2-52
3GPP WLAN
Interworking Scenarios
•
6 Scenarios identified which corresponds to incremental steps in terms of
services and operational features
1.
Common billing and Customer care
 no impact on 3GPP specs as such; access to Open internet
2.
3GPP system based access control and charging with access to
 UMTS/GSM authentication (based on EAP-SIM/AKA methods)
3.
Access to 3GPP system PS based services (e.g. IMS, Streaming,
MMS, etc.)
 bearer path to the home domain (current GPRS model)
4.
Service Continuity
 L3 Mobility introduction (e.g. Mobile IP technology)
5.
Seamless service provision
6.
Access to 3GPP CS Services (no use case so far)
•
UMTS R6 includes scenario 2 & 3
•
UMTS R7 will consider scenario 4 (mobility)
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-53
WLAN/GPRS Seamless Mobility
Scenario 4 (Tentative)
Applications
Dual-mode handsets
with L3 Mobility support
PDG
(FA)
WLAN 802.11
Access
Network
IP Core
Mobility
(HA)
CMX
Content
GPRS/UMTS
GGSN(FA)
SGSN
RAN
RNC
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-54
Reiterate Benefit
• Mobile IP operates at network layer,
independent of link layer access
technologies, allowing migration and
coexistence of various access networks
while providing seamless mobility
transparently to the user
• Proven mobility across satellite, WLAN,
GPRS, CDMA2000 1xRTT, Flash OFDM,
iDEN, CDPD, etc.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-55
Differences between Mobile IPv4 and
Mobile IPv6
• Mobile IPv6 leverages enormous IPv6 address
space
• Mobile IPv6 is integrated into base IPv6 protocol
• MNv6 automatically obtain CoA after Router
Advertisement received
• No Foreign Agent in Mobile IPv6
• Registrations are protected by IPSec in Mobile IPv6
• Built in route optimization between MNv6 and CNv6
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-56
Security implications of Mobile IP
• Access authentication independent
of Mobile IP
PPP CHAP for dial up
802.1x for WLAN
• Service authorization
Mobile IP security association for
registrations
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-57
QOS Implications of Mobile IP
• DSCP copy to tunnel header
• Per MN session policing
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-58
Mobile IP Scalability and Flexibility
• Demonstrated deployment of millions
of MNs
• Mobile IP used for macro-mobility
and micro-mobility
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-59
References
• Books
MOBILE IP The Internet Unplugged, ISBN
0-13-856246-6 James D. Solomon
• Cisco Mobile IP Web Page
http://www.cisco.com/go/mobile_ip
• IETF Mobile IP Working Group
http://www.ietf.org/html.charters/mobilei
p-charter.html
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-60
Cisco Mobile IP Software
Development
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -61
Mobile IP Portfolio
• Product portfolio consists of:
Innovations
Standards compliance
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-62
IOS Features
Features
Releases
Home Agent and Foreign Agent
(RFC 2002, RFC 2003)
12.0(1)T
Home Agent and Foreign Agent MIBs
(RFC 2006)
12.0(1)T
Home Agent Redundancy
12.0(2)T
Cisco Enterprise Mobile IP MIBs
12.2(2)T
Home Agent Redundancy with SA Synchronization
12.1(7.1) 12.2(0.11)T
Resynchronize SA
12.1(5.6) 12.2(0.11)T
HA and FA Set/Trap MIBs
12.2(2)T
Mobile Router Redundancy
Mobile Node MIBs
(RFC 2006)
IPinIP Tunnel CEF Switching
12.2(13)T
Cisco Mobile Networks Dynamic Network
Cisco Mobile Networks Asymmetric Link
Mobile IP Generic Network Access Identfier (NAI) Support and Home Address Allocation
(RFC 2794)
Mobile IP Support for Foreign Agent Reverse Tunneling
(RFC 2344, RFC 3024)
Mobile IP RFC 3220 and RFC 3344 Compliance
HMAC-MD5 Authentication
Vendor Specific Extensions
(RFC 3025, RFC 3115)
Mobile IP Challenge/Response Extensions
(RFC 3012)
Mobile IP - NAT Detect
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-63
IOS Features
Features
Releases
Mobile IP Home Agent Policy Routing
12.2(13)T
Cisco Enterprise Mobile IP MIBs (NAI and HA Redundancy)
12.2(13)T
Mobile IP - Home Agent Accounting
12.2(15)T
Cisco Mobile Networks - Static Collocated Care-of Address
12.2(15)T
Cisco Mobile Networks - Priority HA Assignment
12.2(15)T
Cisco Mobile Networks - Tunnel Templates for Multicast
12.2(15)T
Mobile IP Dynamic Security Association and Key Distribution
12.3(4)T
Mobile Networks Deployment MIB
12.3(4)T
Mobile Networks Dynamic Collocated Care-of Address
12.3(4)T
Mobile Networks Home Agent Redundancy For Dynamic Networks
12.3(4)T
MIBs for Reverse Tunnel, FA Challenge, and VSE
12.3(4)T
NAT Detect for FA COA
12.3(5.2) 12.3(5.5)T
IGMP Query Trigger
12.3(5.9) 12.3(5.9)T
Mobile IP NAT Traversal (RFC 3519)
12.3(8)T
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-64
Cisco’s IP Mobility Role in
Standards
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -65
Standards Priority
• Focus on pragmatic existing
deployment issues
Address real world problems in Mobile
IPv4 WG
• Focus on features needed to facilitate
Mobile IPv6 deployments
Evaluate GAPs, CDMA2000 requirements
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-66
Cisco IETF drafts
Cisco Authored Drafts
WG
TITLE
DRAFT
AUTHORS
STATUS
MIP4
The Definitions of Managed Objects for IP Mobility Support using SMIv2, revised
WG item
Dynamic HA Assignment Framework
draft-ietf-mobileip-rfc2006bis-01.txt
draft-ietf-mip4-dynamic-assignment-00.txt mkulkarn, alpesh, kleung
Experimental Message, Extension and Error Codes for Mobile IPv4
WG item
kleung
WG item
draft-ietf-mip4-experimental-messages-00.txt
Mobile IPv4 NAI-based Home Address Assignment
draft-paulkandasamy-mobileip-nai-based-home-address-00.txt
The Mobile IPv6 MIB
sgundave
alpesh, kleung
naveenpk,
kleung
MIP6
draft-ietf-mipv6-mib-01.txt
Authentication Protocol for Mobile IPv6
WG item
draft-patel-mipv6-auth-protocol-00.txt
Network Access Identifier Option for Mobile IPv6
alpesh, kleung
draft-patel-mipv6-nai-option-00.txt
Vendor/Organization Specific Mobility Options for MIPv6 draft-patel-vendor-options-00.txt
Experimental Mobility Options for MiPv6
draft-patel-experimental-options-00.txt
Mobile IPv6 Bootstrap
alpesh
TBD
alpesh, kleung
alpesh
alpesh
NEMO
Base NEMO draft-ietf-nemo-base.txt pthubert WG item
NEMO MIB
draft-ietf-nemo-mib.00.txt
sgundave
WG item
OSPF-MANET
Problem Statement for OSPF Extensions for Mobile Ad Hoc Routing
WG item
draft-baker-manet-ospf-problem-statement-00.txt
mchandra
Extensions to OSPF to Support Mobile Ad Hoc Networking
draft-mchandra-ospf-manet-ext-00.txt
WG item
© 2002, Cisco Systems, Inc. All rights reserved.
mchandra
Cisco Mobile Access Router—Module 2-67
Mobile IP is also about
the clients
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -68
Handover enhancements, why Mobile IP is as good a other mobility
schemes
Make before break
Clients are always connected to at least one radio
network such as 2.5 or 3G, those are the underlying
building blocks of IP Mobility
Clients can measure radio network characteristics,
especially of those other/extra radio available ( WIFI /
WIMAX / … )
 They can always perform a new Registration Request on
a new access link before having lost the previous link
 Home Agent and Client establish new association
 All routing changes updated before losing previous
association
 There is no packet loss in handover process
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-69
Mobile IP Clients
Notebook/PDA Support
Birdstep Technology
Birdstep Intelligent Mobile IP Client
Cisco & Toshiba Partnership Cisco Mobile IP Client
Intel Intelligent Roaming
Continuous Roaming Mobile IP Client
Lifix Systems
Lifix Go! Mobile Client
ipUnplugged
ipUnplugged Roaming Client
Ecutel
Viatores Client
Greenpacket
SONmobile
Cellphone Support
Motorola iDEN (Integrated Digital Enhanced Network)
© 2002, Cisco Systems, Inc. All rights reserved.
Motorola iDEN handsets
Nextel is the Service Provider
Cisco Mobile Access Router—Module 2-70
Mobile IPv4 Clients PC/Workstation
IP
Operating Systems
Name
4
Cisco IOS
Cisco Mobile IP
commercial
4
FreeBSD 2.2.2
Monarch
1998 - Rice University
4
FreeBSD 2.2.8, 4.6, 4.8, 4.9, 5.2
Secure Mobile Net
4
HP-UX 11.11
HP
commercial Mobile IPv4 HA/CN, Reverse Tunneling, Route Optimization and AAA support
4
Linux
Dynamics
GPLv2
4
Linux
Secgo Mobile IP
commercial
4
Linux
Secure Mobile Net
BSD style
4
Linux
UoB-NOMAD SPL
2003 - based on NOMADv4
4
Linux kernel 2.2.16
MosquitoNet GPL?
2000 Stanford University
4
NetBSD 1.1
Monarch
1998 - Rice University
4
Solaris
Sun Mobile IP
commercial
4
Userland, (platform independent)
HP Mobile IP restricted
1997
4
Windows
Birdstep
commercial
4
Windows
EcuTel
commercial
4
Windows
Roamin
proprietary
4
Windows
Secgo Mobile IP
4
Windows
ipUnplugged commercial
4
Windows client
Dynamics
4
Windows/Linux
Netseal MPN commercial High availability HA(Linux), MN(Windows)
4
embedded systems
Birdstep
commercial
4
embedded, OS independent
Treck Inc.
commercial
© 2002, Cisco Systems, Inc. All rights reserved.
License
BSD style
BSD style
GPLv2
Comments
BSD style
2003 - Portland State University, actively updated
2001 - Helsinki University of Technology, not updated
2003 - Portland State University, actively updated
2000 - binary dist. for non-commercial use only
commercial
2001 - Helsinki University of Technology, not updated
Cisco Mobile Access Router—Module 2-71
Mobile IPv6 Clients PC/Workstation
IP
Operating Systems
Name
License
6
BSD?
NEC MIPv6?
2001? - NEC
6
Cisco IOS
Cisco Mobile IP
commercial
6
FreeBSD
SFC-MIP
BSD-style?2002? - SFC of WIDE
6
FreeBSD 2.2.2 with INRIA's IPv6 Monarch
BSD style 1997 - Rice University, (draft -03)
6
FreeBSD 3.4
INRIA HMIPv6
BSD-style 2000
6
FreeBSD 4.9
KAME
BSD-style 2004 - Stable, MIP code experimental, actively updated
6
HP-UX 11.11, 11.23
HP
commercial
Mobile IPv6 HA/CN, draft-24
6
Linux
HMIPv6
GPL or BSD-style
2003 - Monash University, based on MIPL
6
Linux
Lancaster MIPv6 Pkg ?
1998 - Lancaster University
6
Linux 2.4
TKN HMIPv6
?
2002 - Technical University of Berlin
6
Linux 2.4.0
MIPL
GPL
2003 - draft -24
6
NetBSD 1.6.1
KAME
BSD-style 2004 - Stable, MIP code experimental, actively updated
6
Tru64 UNIX 5.1B
HP
commercial
6
Windows
Microsoft Research
?
6
embedded, OS independent
Treck Inc.
commercial
© 2002, Cisco Systems, Inc. All rights reserved.
Comments
2003? - technology preview
2003 - draft -24
2000 - partial MIP v6 support
Cisco Mobile Access Router—Module 2-72
Concrete applications in Mobile SP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -73
Mobile IP key deployment points
Home Agent is the anchor point for MNs
Bandwidth overhead and FA relationship
Authentication process
 It is a second authentication, for mobility service
 There is still a initial link layer authentication
Preferred interfaces
 Make before break and minimal / no IP interruption
 interfacing layer 2 signal strengths
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-74
Cisco Wireless Convergence
1 Access
2 Control
Access Networks
Venue Owners
Network Manager Agg.
Auth./ Access Control
Service / Content Billing
Billing
Authent.
GPRS
3G
GGSN
802.11
WiMAX
VPN
WLAN
3 Services
Other
Cisco Mobile
Exchange
Off Net Services
Content
Provider
L2TP
GRE
Internet
IPSec
Corporate
Intranet
Wireless
ASP
MPLS
IPV4
IPV6
WiMAX
Streaming
Localization
On Net Services
Mobile Internet Edge
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-75
Next-Generation IP Infrastructure
All-IP Multimedia Mobile Network
CCM
Hosted
Applications
Handsets with VoIP &
dual-mode support &
Mobility support
Presence
Corp
AAA
Visited
AAA
Home
AAA
Session control
(SIP)
IP Core
WLAN 802.11
Access
Network
(FA)
Mobility
(HA)
CMX
Visited
AAA
GPRS/UMTS/
GGSN(FA)/ CDMA
PDSN
SGSN
RAN
V
RNC
Enterprises
PSTN Gateway
PLMN
MSC/VLR
MSC/VLR
Unified IP-based infrastructure allows for uniform delivery of services
across consumer, enterprise and carrier domain
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-76
Cisco & Mobile IP
• Market Leaders
Early Field Trial since 1997, General Availability January 1999
Home Agent Redundancy
Largest mobile implementation of MoIP worldwide - Nextel
• Mobile IPv4 RFC Compliant
2002, 2003, 2005, 2006, 2794, 3012, 3220, 3344, 3519, 3543
compliant
• Applications
Foreign Agent, Home Agent, Proxy Mobile Node, Mobile Router
• Platforms Support
2600 through 7200, Cat5K RSM, Cat6K MSFC, 7600
• Cisco IOS
Tightly integrated with Cisco IOS functionality
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-77
GGSN Mobile IP support
• Mobile IP proxy Foreign Agent
On PDP context activation GGSN will perform:
• AAA req to authenticate and get the HA credentials
(IP address, security keys)
• MIP RegistrationReq to the HA
PDP Address can be allocated by HA
GTPv0 and GTPv1 support
Transparent to the MS (no Mobile IP support in the MS)
• GGSN 5.0 feature
• Full FA functionality on the roadmap
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-78
HA – Cisco IOS
Basis and Resources
• HA products leverage high proportion of
IOS code base to enable advanced IP
network services
• Current features under use today in HA
from IOS include MoIP, IPSec, Routing
Protocols (e.g. OSPF, RIP, BGP, EIGRP),
HSRP, ODAP, VRF, QoS
• HA runs on established platforms (7200,
6500, 7600) and can leverage the service
blades and functionality of the platforms
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-79
MWAM Product Overview
• Multiprocessor WAN Application Module
• Hardware design based on existing modules, e.g.
Firewall Module
• Vehicle for delivery of IOS based features; IOS
application runs on the daughter card
• 5 processors per MWAM utilized, 5 instances of HA or
PDSN
• All Mobile Wireless Applications use same Underlying
Hardware - SSG, GGSN, PDSN, HA
• Management : Mobile Wireless Center (MWC)
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-81
6509NEBs/7609 HA
Sample Configuration*
• Supervisor Modules (SUP2)
– Central Switching and management
function
– Runs separate IOS
– Second SUP2 can be configured for
redundancy
• MWAM
– HA application
– Up to 6 MWAMs per chassis**
• IPSec VPN Services Module
– IPSec Acceleration
• I/O Modules:
– 100BaseT (Fast Ethernet)
– 1000BaseT (Gigabit Ethernet)
*This is a sample configuration for xx09 only.
6513/7613
chassis
can have up to 10 MWAMs.
© 2002,**
Cisco
Systems, Inc. All rights
reserved.
Cisco Mobile Access Router—Module 2-82
65xx/76xx Flexibility
• Licensing is flexible to allow easy growth
Can be licensed per MWAM
Can be licensed per processor
True for HA, CSG, SSG
• Same chassis can be utilized for multiple CMX components
Cost savings on h/w
Easy growth and expansion as add services; example:
Simple IP services with VPN required for initial deployment.
Mobile IP Services added. MWAM for HA added to same
chassis.
Additional content billing capabilities desired. CSG added
to same chassis.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-83
Cisco HA Features & Compliance
• Standards-based product ensures successful interoperation
with other vendors.
• Basic features provide robust HA
HA redundancy: No impact to user.
HA load balancing: One IP address presented to FA.
WLAN interworking: Seamless roaming.
• Premium features further enhance the HA
VRF: Supports overlapping IP addresses.
Hotlining: Supports IP packet redirection
QoS: Downstream per session QoS. Aggregate QoS on
interfaces.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-84
Mobile Wireless Home Agent (HA)
Roadmap
HA R1.2 FCS
(7206VXR/76xx/65xx)
HA R2.0
EC
(7206VXR/76xx/65xx)
HA R3.0
NC
(7206VXR/76xx/65xx)
EFT – 15 May ’02 / 18 Nov ‘02
FCS – 16 Sept ’02 / 30 Dec ’02
EFT – 15 Jan ‘04
FCS – 30 Apr ’04
EFT – Q1 CY05
FCS – Q2 CY05
76xx/65xx Key Platform Features :
HA Key Features:
Firewall & IDS Module Support
Proxy MoIP
HA Redundancy (1:1)
HA Binding Update
HA Accounting
3DES Encryption Support
MoIP MIB Enhancements
7206 Key Platform Features :
NPE-G1 with 1GB DRAM
SA-VAM2
Solution Notes:
Features consistent on all platforms
3DES Encryption Support (h/w
required)
NOTE: Pricing Available
Sep
2002
Oct
Nov
2002 2002
GA = Generally Available
HA Key Features :
HA Load Balancer (HA-SLB) (MWAM
only)
HA Redundancy Enhancements
ODAP
Static IPSec per 835B
Resource Revocation per 835C
Packet of Disconnect (PoD) per 835C
Conditional Debugs for MoIP
VRF (overlapping IP addresses)
Hotlining
(rebuild) QoS
Solution Notes:
SSHv2
WLAN Interworking
HA Rx.0
NC
EFT –
FCS –
76xx/65xx Key Platform Features :
Sup720
PDSN/HA Key Features:
HA Key Features:
Broadcast/Multicast
Standards Compliance
Continuous MIB Enhancement
Capacity/Performance Improvements
Mobile IPv6
IP Reachability per 835B (DNS update by
HA)
HA Accounting per 835C
Continuous MIB Enhancement
Dynamic IPSec per 835B
Standards Compliance
Capacity/Performance Improvements
Diameter
PSD
NOTE: PRICING TBD.
Solution Notes:
L2TPv3
MPLS
MWAM – Sibyte with 1GHz Processor and
1G of memory
NOTE: PRICING TBD.
NOTE: Pricing Available
Dec Jan
2002 2003
Feb
2003
Mar
2003
FCS = First Customer Ship
Apr
2003
May
2003
Jun
2003
EFT = Early Field Trials
CQ03
2003
CQ04
2003
EC = Execute Committed
CQ01
2004
CQ02
2004
CC = Concept Committed
CQ03
2004
CQ04
2004
NC = Not Committed
Note: There is an associated cost for each release. Some features may have additional cost in addition to the base.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-85
R1.2 HA Performance
HA
Users
7206 HA
per
MWAM
Total Bindings
235K
1.175M
Throughput NDR
160 Mbps 2.5 Gbps
xx13 HA
Chassis
10 MWAMs
11.75M
25 Gbps
(512 bytes/pkt)
•
•
Results based on 512 Byte packets, unfragmented.
Performance measured for No Drop Rate. NDR is 0.01% or 1 in 10,000 packets.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-94
Home Agent Summary
• Feature Rich
Highly Compliant to Specifications and Customer Requirements
Value added service support such as VRF, Hot Lining, QoS
Service enablement via Cisco Mobile Exchange Framework
components
• Fault Tolerance
HA Redundancy, HA-SLB
Geographic Resiliency
• Product Maturity
Real life deployment; deployed since 2001
• Capacity and Performance Scalability
Small to very large deployment options
• Management
Provisioning, Fault Mediation, Performance Mediation,
Troubleshooting & Security
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-96
Cisco 3200
Mobile Access Router
Product Overview
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -97
Agenda
• Overview of the Cisco 3200 Series Mobile
Access Router
• Mobile Access Router Card
• Serial Mobile Interface Card
• Fast Ethernet Switch MIC
• Cisco 3200 Example Configurations
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-98
Cisco Mobile Access Router
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-99
Mobile Access Router Overview
• Mobile Access Router Card (MARC)
–High performance processor
–One 10/100 Ethernet
–One console
–One powered async serial (for GPS)
• Mobile Interface Cards (MICs)
–SMIC: 4 port sync/async serial
–FESMIC: 4 port FE/E Switch Card
© 2002, Cisco Systems, Inc. All rights reserved.
MIC
MIC
MARC
Cisco Mobile Access Router—Module 2-100
Remember the Names
• Cisco 3200 Mobile Access Router
• Cisco 3200 Series
• Cisco 3251 Mobile Access Router Card
(MARC)
• Cisco 3201 Serial Mobile Interface Card
(SMIC)
• Cisco 3201 FastEthernet Switch Mobile
Interface Card (FESMIC)
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-101
Cisco 3250 Mobile Access Router Platform
High performance mobile access router
• Modular Circuit-board construction
• Mobile Access Router Card
(Cisco3251MARC)
• Serial Mobile Interface Card
(Cisco3201SMIC)
• Fast Ethernet Switch MIC (FESMIC)
•
•
•
•
•
•
PC/104-Plus Form Factor
PC/104-Plus “Compliance”, PCI-Only
Runs Cisco IOS
Utilizes Cisco Mobile IP Feature Set
Industrial Grade
-40 C to 85 C local ambient
© 2002, Cisco Systems, Inc. All rights reserved.
MARC
FESMIC
SMIC
SMIC
Cisco Mobile Access Router—Module 2-102
PC 104-Plus Mechanical Standard
Industry Standard Hardware form factor
•Cisco 3200 Series will
test with a 3rd Party Lab
to conform to the level
of PC104-Plus
Compliant
More Specific
information at
www.PC104.org
Including definition of
our level of compliance
Size = 3.775” x 3.55”
Source: PC104-Plus Specification Version 1.2
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-103
Why PC-104-Plus?
• Smallest industry standard computing
platform
• Both ISA and PCI bus
Cisco puts signals on PCI bus only
Any non-Cisco cards cannot signal on PCI bus
ISA bus OK
• Self-stacking
No backplane or cardcage required
Stand-offs and screws recommended
• Designed for rugged, industrial-grade
applications
• Good product availability, vendor support
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-104
PC-104-Plus Card Format
PCI Bus Connector
120 pin, stack
through, PCI BUS
Connector (no key)
Power provided
By SI
Power supply pins
and grounds are
connected to the
Cisco boards via
ISA / PCI
connectors
ISA Bus
Connector
Cables and
Connectors on I/O
side provided by SI
© 2002, Cisco Systems, Inc. All rights reserved.
104 pin, Stack
through, ISA Bus
Connector (no
key)
No Cisco signals
over ISA Bus
Cisco Mobile Access Router—Module 2-105
Complete Solution Requires
Integration
Cisco 3200 Series MARC + FESMIC+SMIC
Aironet 350 Access Points
Wireless Infrastructure with external
Radios compatible with network
Cables + Power Supply + Enclosure
Environmental/Ruggedized to specs and
integrated with customer-supplied device
or vehicle
Installation, deployment, training, etc.
System
Integration
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-106
Mobile Access Router Card (MARC)
• MPC8250, running at 200MHz CPU
core, 133MHz CPM core and 66MHz
Motorola 60x Bus.
• 32-bit PCI bus version 2.1 running at
25MHz, connects to Cisco MICs.
• 128Mbyte 64 bit, Unbuffered,
Synchronous DRAM,
• 32Mbyte 16 bit of Flash memory,
• Single 10/100 Fast Ethernet, full-duplex
100 Base-T, with auto negotiation.
• Single Console, with modem flow
control.
• Single Asynchronous, RS-232 serial,
for GPS/AUX devices.
• Integrated host-to-PCI bridge (PCI bus
version 2.1), with built-in PCI arbiter
that supports three external bus
masters/PCI agents.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-107
Mobile Access Router Card
PCI Bus Connector
120 pin, stack
through, PCI BUS
Connector (no key)
ISA Bus
Connector
34 pin, locking header
Aux
Console
LED’s
5V power
© 2002, Cisco Systems, Inc. All rights reserved.
104 pin, Stack
through, ISA Bus
Connector (no
key)
No Cisco signals
over ISA Bus
10 pin, locking header, for
MARC Fast Ethernet
Cisco Mobile Access Router—Module 2-108
Serial Mobile Interface Card (Cisco3201SMIC)
• Type of Mobile Interface Card (MIC)
PCI Bus
ISA Bus
• Typically used for a WAN (modem)
interface to a wireless / satellite
network
• Asynch/Synch
Supports up to 2Mbps
• 4 Cisco 12-in-1 Serial Interfaces
All existing 12-in-1 signals
supported
• Signals thru 2 60-pin multifunction
headers
• PCI Bus
• Up to 3 per stack
Rotary Switch
• Set rotary switch to unique
60-pin Multifunction Header
number
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-109
Fast Ethernet Switch MIC (FESMIC)
Fast Ethernet Headers
• 1 10/100 Ethernet with 4 port
switch with VLAN
802.1q and 802.1p
supported
Can route between
FESMIC and MARC FastE
• LED signals thru LED header
• No in-line power provided
• ISL not supported
• Limit one FESMIC per 3200
ISA Bus
LED Header
© 2002, Cisco Systems, Inc. All rights reserved.
PCI Bus
Cisco Mobile Access Router—Module 2-110
Presentation_ID
© 2001, Cisco Systems, Inc.
111
Cisco 3200
Mobile Access Router
IOS Configuration
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2 -112
Agenda
•
Configuration Outline
•
Configuration Commands
•
Example Configurations
•
Troubleshooting
• Reference:
• http://www.cisco.com/univercd/cc/td/doc/product/software/ios12
2/122newft/122tcr/122tip1r/p1ftmobi.htm
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-113
Configuring Mobile IP
An Outline
© 2002,
Cisco
Systems,
Inc.
AllAll
rights
reserved.
© 2002,
Cisco
Systems,
Inc.
rights
reserved.
Cisco Mobile Access Router—Module 2-114 114
Steps to Configure Home Agent
• Step 1 –
A. Create HA as a mobile IP agent
Define it as an HA
B. Set virtual nets in HA
Redistribute the virtual nets in routing updates
C. Define the IP address of the mobile router so the
HA will recognize it
Define the networks that will be associated with that
Mobile Router
D. Set up security association for that Mobile Router
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-115
Virtual Networks
• Virtual Network is:
Non-physical = no interface
Added to Routing Table
“Home” network for Mobile Host and Router
Mobile Host addresses are assigned from this
Must be unrelated to “real” networks
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-116
Steps to Configure Foreign Agent
•
Step 2 –
A. Create FA as a mobile IP agent
B. Define it as an Foreign Agent
Specify the interface to be used as Care-of
Address
C. Configure an interface to support Mobile IP
IP address and mask
Enable IRDP
Optional: IRDP advertisement intervals
max, min, and holdtime
Enable FA service on the interface
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-117
Steps to Configure Mobile Router
•
Step 3 –
A. Create Mobile Router as a mobile IP agent
B. Define it as an MR
Specify its address and subnet mask
Specify the IP address of its HA
Optional – registration parameters
Optional - Set Reverse Tunnel on
C. Configure Security Association with HA
Must match HA
D. Specify an interface with Mobile IP service
Set the IP address and mask
Enable roaming
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-118
Mobile Router – Optional Features
• Step 4 – Enable services (optional)
Solicitation, retransmission intervals
Co-Located Care-of Address (optional)
Enable CCOA on interface
Set Default Gateway on interface
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-119
Mobile Router Redundancy
•
Step 5 –Mobile Router Redundancy (optional)
Enable HSRP on interface
Set Priority
Set Preempt
Configure group name
Add redundancy group name to Mobile Router
configuration
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-120
Cisco 3200 Installation Course
Lab Diagram
Network 10.10.10.0/24
WebCam
.35/28
FA1 Bridge
Foreign
Agent 1
FE0/0
.130/28
FE0/1
.74/30
Network 10.10.11.0/24
.129/28
802.11b
3200 Bridge
10.10.11.36/28
FE0/1
Home .73/30
Virtual Network
110.10.11.0 / 24
Agent
E1/0
.33/28
FE0/0
.69/30
Lo0 .77/30
802.11b
E1 .33/28
FE0/0
.70/30
C3200
FE0/1
Server
.34/28
© 2002, Cisco Systems, Inc. All rights reserved.
.97/28
Foreign
Agent 2
.98/28
FA2 Bridge
.34/28
Loopback 0
110.10.11.209/32
Cisco Mobile Access Router—Module 2-121
Configuring Mobile IP
© 2002,
Cisco
Systems,
Inc.
AllAll
rights
reserved.
© 2002,
Cisco
Systems,
Inc.
rights
reserved.
Cisco Mobile Access Router—Module 2-122 122
Configure HA
HA(config)#router mobile
Enables Mobile IP on the router
HA(config-routerip mob)#ip mobile home-agent Enables home agent service.
HA(config)#ip mobile virtual-network
net mask [address address ]
Creates a Virtual network
HA(config)# router protocol [process ID]
Enters router configuration mode
HA(config-router)# redistribute mobile subnets Enables redistribution of virtual
network and mobile subnets into
routing protocols
HA(config)# ip mobile host lower [upper]
virtual-network net mask
Specifies mobile nodes on a virtual
network
HA(config)#ip mobile host lower [upper]
interface name
Specifies mobile nodes on a physical
interface
HA(config)# ip mobile mobile-networks address Specifies mobile router to be set up
HA(mobile-networks)# network net mask
Specifies a network that will be
hosted on the mobile host (router)
HA(config)#ip mobile secure host
address spi spi key [hex/ascii] string
Sets up mobile host security
associations.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-123
Configure HA (example)
HA(config)# router mobile
HA(config-router)# ip mobile home-agent
HA(config)# ip mobile virtual-network 10.10.11.0 255.255.255.0
HA(config)# router ospf 64
HA(config-router)# redistribute mobile subnets
HA(config)# ip mobile host 10.10.11.77 virtual-network 10.10.11.0 255.255.255.0
HA(config)# ip mobile mobile-networks 10.10.11.77
HA(mobile-networks)# network 10.10.11.76 255.255.255.252
HA(config)# ip mobile secure host 10.10.11.77 spi 300 key hex
12345678123456781234567812345678
HA(config)#ip mobile home-agent lifetime 65535
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-124
Configure FA
FA(config)#router mobile
Enables Mobile IP on the router
FA(config)#ip mobile foreign-agent
care-of interface
Sets up care-of addresses advertised to
all foreign agent-enabled interfaces.
FA(config-if)#ip mobile foreign-service Enables foreign agent service on the
interface.
FA(config)#router mobile
FA(config)#ip mobile foreign-agent care-of Faste 0/0
FA(config)#ip mobile foreign-agent care-of Faste 0/1
FA(config)#interface Faste 0/0
FA(config-if)#ip mobile foreign-service
FA(config-if)#ip mobile registration-lifetime 65535
FA(config)#interface Faste 0/1
FA(config-if)#ip mobile foreign-service
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-125
Configure Mobile Access Router
C3200_(config)# interface loopback number Configure loopback address
C3200_(config-if)# ip address <IP address
subnet mask>
Specifies IP address for loopback
interface
C3200_(config)# router mobile
Enable Mobile IP on the router
C3200_(config-router)#ip mobile router
Configure the mobile router
C3200_(mobile-router)# address
<IP address><SN mask>
IP address of mobile router (using
loopback address)
C3200_(mobile-router# home-agent
<IP address> [priority priority]
Specify Home Agent and priority
C3200_(config)# ip mobile secure home-agent
<IP add> spi spi key [ hex/ascii ] string
C3200_(config)# interface interface
Set up authentication key
Configure roaming interface
C3200_(config-if)# ip mobile router-service roam [priority priority level ]
C3200_(config-if)# ip mobile router-service solicit [interval seconds] [retransmit
initital interval maximum interval retry number of retries ]
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-126
Configure Mobile Access Router
(example)
C3200_# interface loopback
C3200_(Interface)# ip address 10.0.11.77 255.255.255.252
C3200_# router mobile
C3200_# ip mobile router
C3200_# address 10.0.11.77 255.255.255.252
C3200_# home-agent 10.0.10.77
C3200_# ip mobile secure home-agent 10.0.10.77 spi 300 key hex
12345678123456781234567812345678
C3200_# interface Faste 0/0
C3200_(interface)# ip mobile router-service roam
C3200_(interface)# ip mobile router-service solicit
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-127
Configure HA Advertisements
(Optional)
HA(config)#interface name
Interface providing the service
HA(config-if)#ip irdp
Turn on the advertisements on the interface
HA(config-if)#ip irdp maxadvertinterval [4-1800]
HA(config-if)#ip irdp minadvertinterval [3-1800]
HA(config)#interface e5/0/2
HA(config-if)#ip irdp
HA(config-if)#ip irdp maxadvertinterval 10
HA(config-if)#ip irdp minadvertinterval 4
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-128
Configure FA Advertisements
(Optional)
FA(config)#interface name
Interface providing the service
FA(config-if)#ip irdp
Turn on the advertisements on the interface
FA(config-if)#ip irdp maxadvertinterval [4-1800]
FA(config-if)#ip irdp minadvertinterval [3-1800]
FA(config)#interface e3/1
FA(config-if)#ip irdp
FA(config-if)#ip irdp maxadvertinterval 10
FA(config-if)#ip irdp minadvertinterval 4
FA(config)#interface e3/2
FA(config-if)#ip irdp
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-129
Troubleshooting Mobile IP
© 2002,
Cisco
Systems,
Inc.
AllAll
rights
reserved.
© 2002,
Cisco
Systems,
Inc.
rights
reserved.
Cisco Mobile Access Router—Module 2-130 130
Troubleshooting Mobile IP - Outline
1.
What is router’s configuration?
Verify Agent, Operation
Is it sending Advertisements?
•
SHOW IP MOBILE GLOBALS
•
DEBUG IP MOBILE ADVERTISEMENTS
2.
What is Mobile Router seeing?
Is Wireless associated?
Is Mobile Router receiving Advertisements?
DEBUG IP ICMP
3.
What is router doing?
Is Mobile Router trying to register?
Are FA and HA accepting registrations?
•
4.
•
•
DEBUG IP MOBILE
Who are router’s neighbors?
SHOW IP ROUTE
SHOW ARP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-131
Troubleshooting Mobile IP Outline
1.
What is router’s configuration?
Verify Agent, Operation
Is it sending Advertisements?
•
SHOW IP MOBILE GLOBALS
•
DEBUG IP MOBILE ADVERTISEMENTS
2.
What is Mobile Router seeing?
Is Wireless associated?
Is Mobile Router receiving Advertisements?
DEBUG IP ICMP
3.
What is router doing?
Is Mobile Router trying to register?
Are FA and HA accepting registrations?
•
4.
•
•
DEBUG IP MOBILE
Who are router’s neighbors?
SHOW IP ROUTE
SHOW ARP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-132
Verifying HA Configuration
HA#show ip mobile globals
IP Mobility global information:
Home Agent
Registration lifetime: 10:00:00 (36000 secs)
Broadcast disabled
Replay protection time: 7 secs
Reverse tunnel enabled
ICMP Unreachable enabled
Virtual networks
110.10.11.0 /24
Foreign Agent is not enabled, no care-of address
0 interfaces providing service
Encapsulations supported: IPIP and GRE
Tunnel fast switching enabled
Tunnel path MTU discovery aged out after 10 min
ha_#
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-133
Verifying FA Configuration
FA#show ip mobile globals
Foreign_Agent_2_#sh ip mob globals
IP Mobility global information:
Home Agent is not enabled
Foreign Agent
Pending registrations expire after 15 secs
Care-of addresses advertised
FastEthernet0/1 (10.10.10.97) - up
1 interface providing service
Encapsulations supported: IPIP and GRE
Tunnel fast switching enabled
Tunnel path MTU discovery aged out after 10 min
Foreign_Agent_2_#
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-134
Debug Advertisements on FA
Foreign_Agent_2_#debug ip mobile advertise
IP mobility agent advertisements debugging is on
Foreign_Agent_2_#
02:30:02: MobileIP: Agent advertisement sent out FastEthernet0/1:
type=16, len=10, seq=2984, lifetime=36000, flags=0x1400(rbhFmGv-rsv-),
02:30:02: Care-of address: 10.10.10.97
02:30:05: MobileIP: Agent advertisement sent out FastEthernet0/1:
type=16, len=10, seq=2985, lifetime=36000, flags=0x1400(rbhFmGv-rsv-),
02:30:05: Care-of address: 10.10.10.97
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-135
Troubleshooting Mobile IP Outline
1.
What is router’s configuration?
Verify Agent, Operation
Is it sending Advertisements?
•
SHOW IP MOBILE GLOBALS
•
DEBUG IP MOBILE ADVERTISEMENTS
2.
What is Mobile Router seeing?
Is Wireless associated?
Is Mobile Router receiving Advertisements?
DEBUG IP ICMP
3.
What is router doing?
Is Mobile Router trying to register?
Are FA and HA accepting registrations?
•
4.
•
•
DEBUG IP MOBILE
Who are router’s neighbors?
SHOW IP ROUTE
SHOW ARP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-136
MR: Advertisements
MR#debug ip icmp
*Mar
*Mar
*Mar
*Mar
*Mar
1 04:09:27.938: ICMP: rdp advert
1 04:09:31.938: ICMP: rdp advert
1 04:09:34.934: ICMP: rdp advert
1 04:09:37.934: ICMP: rdp advert
1 04:09:39.934: ICMP: rdp advert
rcvd
rcvd
rcvd
rcvd
rcvd
type
type
type
type
type
9, code 0, from 10.10.10.97
9, code 0, from 10.10.10.97
9, code 0, from 10.10.10.97
9, code 0, from 10.10.10.97
9, code 0, from 10.10.10.97
> It is receiving advertisements from Foreign Agent 10.10.10.97
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-137
Troubleshooting Mobile IP Outline
1.
What is router’s configuration?
Verify Agent, Operation
Is it sending Advertisements?
•
SHOW IP MOBILE GLOBALS
•
DEBUG IP MOBILE ADVERTISEMENTS
2.
What is Mobile Router seeing?
Is Wireless associated?
Is Mobile Router receiving Advertisements?
DEBUG IP ICMP
3.
What is router doing?
Is Mobile Router trying to register?
Are FA and HA accepting registrations?
•
4.
•
•
DEBUG IP MOBILE
Who are router’s neighbors?
SHOW IP ROUTE
SHOW ARP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-138
MR: Registration Requests RRQs
MR#debug ip mob
IP mobility events debugging is on
MR#
*Mar 1 04:12:12.898: MobileIP: Authentication
*Mar 1 04:12:16.898: MobileIP: Authentication
*Mar 1 04:12:18.898: MobileIP: Authentication
*Mar 1 04:12:22.898: MobileIP: Authentication
algorithm
algorithm
algorithm
algorithm
MD5
MD5
MD5
MD5
> It is sending in Registration Requests and not getting any answer
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-139
Debugs on HA – Registration
Rejected
Home_Agent_#debug ip mobile
Home_Agent_#
00:14:18: MobileIP: HA 114 received registration for MN 10.4.1.1 on FastEthernet
0/1 using COA 10.3.1.1 HA 10.1.4.1 lifetime 36000 options sbdmgvt
00:14:18: MobileIP: Skip2TLV look for type 32, addr start 7D8742C end 7D87442
00:14:18: MobileIP: Skip2TLV look for type 32, addr start 7D87442 end 7D87442
00:14:18: MobileIP: MN 10.4.1.1 - authenticating MN 10.4.1.1 using SPI 100
00:14:18: MobileIP: MN 10.4.1.1 - authenticated MN 10.4.1.1 using SPI 100
00:14:18: MobileIP: Identification field has timestamp 146 secs greater than our
current time 03/01/93 00:14:18 (> allowed 7 secs) for MN 10.4.1.1
00:14:18: %IPMOBILE-6-SECURE: Security violation on HA from MN 10.4.1.1 - errcod
e registration id mismatch (133), reason Bad identifier (3)
00:14:18: MobileIP: HA rejects registration for MN 10.4.1.1 - registration id mi
smatch (133)
00:14:18: MobileIP: MN 10.4.1.1 - MH auth ext added (SPI 100) to MN 10.4.1.1
00:14:18: MobileIP: MN 10.4.1.1 - HA sent reply to 10.1.3.2
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-140
Debugs on HA – Registration
Accepted
Home_Agent_# debug ip mobile
00:14:18: MobileIP: HA 114 received registration for MN 10.4.1.1 on FastEthernet
0/1 using COA 10.3.1.1 HA 10.1.4.1 lifetime 36000 options sbdmgvt
00:14:18: MobileIP: Skip2TLV look for type 32, addr start 7D877EC end 7D87802
00:14:18: MobileIP: Skip2TLV look for type 32, addr start 7D87802 end 7D87802
00:14:18: MobileIP: MN 10.4.1.1 - authenticating MN 10.4.1.1 using SPI 100
00:14:18: MobileIP: MN 10.4.1.1 - authenticated MN 10.4.1.1 using SPI 100
00:14:18: MobileIP: Mobility binding for MN 10.4.1.1 created
00:14:18: MobileIP: 15 ifs in use
00:14:18: MobileIP: Tunnel0 (IP/IP) created with src 10.1.4.1 dst 10.3.1.1
00:14:18: MobileIP: 16 ifs in use
00:14:18: MobileIP: Tunnel1 (IP/IP) created with src 10.1.4.1 dst 10.4.1.1
00:14:18: MobileIP: Roam timer started for MN 10.4.1.1, lifetime 36000
00:14:18: MobileIP: MN 10.4.1.1 is now roaming
00:14:18: MobileIP: Insert route 10.4.1.1/255.255.255.255 via gateway 10.3.1.1 on Tunnel0
00:14:18: MobileIP: Insert route 10.5.2.0/255.255.255.0 via gateway 10.4.1.1 on Tunnel1
00:14:18: MobileIP: HA accepts registration from MN 10.4.1.1
00:14:18: MobileIP: MN 10.4.1.1 - MH auth ext added (SPI 100) to MN 10.4.1.1
00:14:18: MobileIP: MN 10.4.1.1 - HA sent reply to 10.1.3.2
00:14:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
00:14:19: MobileIP: swif coming up Tunnel0
00:14:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
00:14:19: MobileIP: swif coming up Tunnel1
Home_Agent_#
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-141
Debugs on FA - Registration
FA#debug ip mobile
1d02h: MobileIP: FA received registration for MN 20.0.197.84 on Ethernet3/1 using COA 40.0.197.19 HA 20.0.197.82
lifetime 990 options sBdmgvt
1d02h: MobileIP: Ethernet3/1 glean 20.0.197.84 accepted
1d02h: MobileIP: FA queued MN 20.0.197.84 in register table
1d02h: MobileIP: Visitor registration timer started for MN 20.0.197.84, lifetime 15
1d02h: MobileIP: Skip2TLV look for type 32, addr start 200210AC end 200210C2
1d02h: MobileIP: FA forwarded registration for MN 20.0.197.84 to HA 20.0.197.82
1d02h: MobileIP: FA received accept (0) reply for MN 20.0.197.84 on Ethernet3/5 using HA 20.0.197.82 lifetime 990
1d02h: MobileIP: Reply in for MN 20.0.197.84, accepted
1d02h: MobileIP: Update visitor table for MN 20.0.197.84
1d02h: MobileIP: Tunnel2 (IP/IP) created with src 40.0.197.19 dst 20.0.197.82
1d02h: MobileIP: ARP entry for MN 20.0.197.84 inserted
1d02h: MobileIP: Visitor timer started for MN 20.0.197.84, lifetime 990
1d02h: MobileIP: FA dequeued MN 20.0.197.84 from register table
1d02h: MobileIP: MN 20.0.197.84 visiting on Ethernet3/1
1d02h: MobileIP: Skip2TLV look for type 32, addr start 200215A8 end 200215BE
1d02h: MobileIP: FA forwarding reply to MN 20.0.197.84 using src 20.0.197.84 mac 0030.8538.1c90
1d02h: MobileIP: swif coming up Tunnel2
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-142
Debugs on MR - Registration
FA#debug ip mobile
*Mar 1 04:21:53.778: MobileIP: ParseRegExt type MHAE(32) addr 6002A08 end 6002A
1E
*Mar 1 04:21:53.778: MobileIP: ParseRegExt skipping 20 to next
*Mar 1 04:21:53.778: MobileIP: Authenticating HA 10.10.10.77 using SPI 3003
*Mar 1 04:21:53.782: MobileIP: Authentication algorithm MD5
*Mar 1 04:21:53.782: MobileIP: Authenticated HA 10.10.10.77 using SPI 3003
*Mar 1 04:21:57.762: MobileIP: Authentication algorithm MD5
*Mar 1 04:21:57.782: MobileIP: ParseRegExt type MHAE(32) addr 61BF1A8 end 61BF1
BE
*Mar 1 04:21:57.782: MobileIP: ParseRegExt skipping 20 to next
*Mar 1 04:21:57.782: MobileIP: Authenticating HA 10.10.10.77 using SPI 3003
*Mar 1 04:21:57.782: MobileIP: Authentication algorithm MD5
*Mar 1 04:21:57.782: MobileIP: Authenticated HA 10.10.10.77 using SPI 3003
*Mar 1 04:21:57.782: MobileIP: Tunnel0 (IP/IP) created with src 110.10.11.217 d
st 10.10.10.77
*Mar 1 04:21:58.782: MobileIP: swif coming up Tunnel0
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-143
Troubleshooting Mobile IP Outline
1.
What is router’s configuration?
Verify Agent, Operation
Is it sending Advertisements?
•
SHOW IP MOBILE GLOBALS
•
DEBUG IP MOBILE ADVERTISEMENTS
2.
What is Mobile Router seeing?
Is Wireless associated?
Is Mobile Router receiving Advertisements?
DEBUG IP ICMP
3.
What is router doing?
Is Mobile Router trying to register?
Are FA and HA accepting registrations?
•
4.
•
•
DEBUG IP MOBILE
Who are router’s neighbors?
SHOW IP ROUTE
SHOW ARP
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-144
HA Binding Table
ha_#show ip mobile binding ?
A.B.C.D IP address
home-agent Mobility bindings for specific home agent
summary Summary of binding table
|
Output modifiers
<cr>
ha_#show ip mobile binding
Mobility Binding List:
Total 9
110.10.11.237:
Care-of Addr 10.10.10.97, Src Addr 10.10.10.70
Lifetime granted 10:00:00 (36000), remaining 06:59:10
Flags sbdmgvt, Identification AF3BF344.D8F21340
Tunnel2 src 10.10.10.77 dest 10.10.10.97 reverse-allowed
MR Tunnel1 src 10.10.10.77 dest 110.10.11.237 reverse-allowed mobile-network
110.10.11.237
Routing Options 110.10.11.233:
Care-of Addr 10.10.10.97, Src Addr 10.10.10.70
Lifetime granted 10:00:00 (36000), remaining 06:59:10
Flags sbdmgvt, Identification AF3BF344.5F153F64
………… etc.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-145
HA State – Routing Table
Home_Agent_#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
110.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
M
110.10.11.0/24 is directly connected, Mobile0 Virtual Network
M
110.10.11.237/32 [3/1] via 10.10.10.97, 00:57:28, Tunnel2
M
110.10.11.245/32 [3/1] via 10.10.10.129, 03:01:54, Tunnel0
10.0.0.0/8 is variably subnetted, 14 subnets, 3 masks
C
10.10.10.32/27 is directly connected, FastEthernet0/0
C
10.10.10.72/30 is directly connected, FastEthernet0/1
C
10.10.10.76/30 is directly connected, Loopback0
O IA 10.10.10.96/27 [110/11] via 10.10.10.36, 00:57:35, FastEthernet0/0
M
10.10.11.112/28 [3/1] via 110.10.11.237, 03:55:57, Tunnel1
O IA 10.10.10.128/27 [110/2] via 10.10.10.74, 00:57:35, FastEthernet0/1
M
10.10.11.144/28 [3/1] via 110.10.11.245, 03:55:57, Tunnel5
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-146
FA State – Visiting Mobile Routers
Foreign_Agent_2_#show ip mobile visitor
Mobile Visitor List:
Total 5
110.10.11.229:
Interface FastEthernet0/1, MAC addr 0001.6441.87ba
IP src 110.10.11.229, dest 10.10.10.97, UDP src port 434
HA addr 10.10.10.77, Identification AF3C1098.B402FE18
Lifetime 10:00:00 (36000) Remaining 08:56:25
Tunnel0 src 10.10.10.97, dest 10.10.10.77, reverse-allowed
Routing Options 110.10.11.245:
Interface FastEthernet0/1, MAC addr 0001.6441.87a2
IP src 110.10.11.245, dest 10.10.10.97, UDP src port 434
HA addr 10.10.10.77, Identification AF3C114E.911E78F8
Lifetime 10:00:00 (36000) Remaining 08:59:27
Tunnel0 src 10.10.10.97, dest 10.10.10.77, reverse-allowed
Routing Options ……… etc.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-147
Foreign Agent Routing Table
Foreign_Agent_2_#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
110.0.0.0/24 is subnetted, 1 subnets
O E2 110.10.11.0 [110/20] via 10.10.10.33, 00:58:44, FastEthernet0/0
10.0.0.0/8 is variably subnetted, 14 subnets, 4 masks
C
10.10.10.32/27 is directly connected, FastEthernet0/0
O
10.10.10.72/30 [110/2] via 10.10.10.33, 00:58:44, FastEthernet0/0
O
10.10.10.77/32 [110/2] via 10.10.10.33, 00:58:44, FastEthernet0/0
C
10.10.10.96/27 is directly connected, FastEthernet0/1
O E2 10.10.11.112/28 [110/20] via 10.10.10.33, 00:58:47, FastEthernet0/0
O IA 10.10.10.128/27 [110/3] via 10.10.10.33, 00:58:47, FastEthernet0/0
O E2 10.10.11.144/28 [110/20] via 10.10.10.33, 00:58:47, FastEthernet0/0
Foreign_Agent_2_#
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-148
FA State – ARP Table
Foreign_Agent_2_#sh arp
Protocol Address
Age
Internet 10.10.10.73
8
Internet 10.10.10.129
Internet 10.10.10.130
7
Internet 10.10.10.74
Internet 110.10.11.237
2
Foreign_Agent_2_#
© 2002, Cisco Systems, Inc. All rights reserved.
(min) Hardware Addr Type Interface
000a.8a7d.0f41 ARPA FastEthernet0/0
000a.8a83.0d81 ARPA FastEthernet0/1
0040.9657.cc93 ARPA FastEthernet0/1
000a.8a83.0d80 ARPA FastEthernet0/0
00ff.ff40.00aa ARPA FastEthernet0/1
Cisco Mobile Access Router—Module 2-149
What FA is MR Visiting? Part 1
mar_demo_1_#sh arp
Protocol Address
Internet 10.3.1.1
Internet 10.5.2.1
Internet 10.5.3.1
Internet 10.5.3.2
Internet 10.5.3.34
mar_demo_1_#
© 2002, Cisco Systems, Inc. All rights reserved.
Age (min) Hardware Addr Type Interface
12 000a.8a83.0d81 ARPA Vlan1
- 00ff.ff40.00aa ARPA FastEthernet0/0
- 00ff.ff40.00ab ARPA Vlan1
137 0040.9657.2624 ARPA Vlan1
4 0010.a49f.57d9 ARPA Vlan1
Cisco Mobile Access Router—Module 2-150
What FA is MR Visiting? Part 2
mar_demo_1_#sh ip rout
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 10.3.1.1 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
M
10.3.1.1/32 [3/1] via 10.3.1.1, 00:07:28, Vlan1
C
10.5.3.0/24 is directly connected, Vlan1
M
10.1.4.1/32 [3/1] via 10.3.1.1, 00:07:28, Vlan1
C
10.5.1.0/24 is directly connected, Loopback0
M* 0.0.0.0/0 [3/1] via 10.3.1.1, 00:07:28, Vlan1
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-151
Debugs on HA/FA - Handoff
ha_# 05:17:02: MobileIP: HA 120 received registration for MN 110.10.11.225 on
FastEthernet0/1 using COA 10.10.10.129 HA 10.10.10.77 lifetime 36000 options
sbdmgvt
05:17:02: MobileIP: MN 110.10.11.225 - authenticating MN 110.10.11.225 using SPI
5005
05:17:02: MobileIP: MN 110.10.11.225 - authenticated MN 110.10.11.225 using SPI 5005
05:17:02: MobileIP: Delete tunnel route for 110.10.11.225/255.255.255.255 via gateway
10.10.10.97
05:17:02: MobileIP: Deleted user (7 remains) from Tunnel2 src 10.10.10.77 dest
10.10.10.97
05:17:02: MobileIP: Mobility binding for MN 110.10.11.225 updated – tunnel changed
05:17:02: MobileIP: Added user (2 active) on Tunnel0 src 10.10.10.77 dest 10.10.10.129
05:17:02: MobileIP: Insert route 110.10.11.225/255.255.255.255 via gateway
10.10.10.129 on Tunnel0
05:17:02: MobileIP: Roam timer started for MN 110.10.11.225, lifetime 36000
05:17:02: MobileIP: HA accepts registration from MN 110.10.11.225
05:17:02: MobileIP: MN 110.10.11.225 - MH auth ext added (SPI 5005) to MN
110.10.11.225
05:17:02: MobileIP: MN 110.10.11.225 - HA sent reply to 10.10.10.74
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-152
Show IP Mobile Traffic (Home Agent)
Home_Agent_#show ip mobile traffic
IP Mobility traffic:
Advertisements:
Solicitations received 0
Advertisements sent 0, response to solicitation 0
Home Agent Registrations:
Register 2622, Deregister 2 requests
Register 1302, Deregister 2 replied
Accepted 87, No simultaneous bindings 0
Denied 1215, Ignored 1322 , Dropped 0
Unspecified 1198, Unknown HA 0
Administrative prohibited 0, No resource 0
Authentication failed MN 0, FA 0, active HA 0
Bad identification 17, Bad request form 0
Unavailable encap 0, reverse tunnel 0
Binding updates received 0, sent 0 total 0 fail 0
Binding update acks received 0, sent 0
Binding info request received 0, sent 0 total 0 fail 0
Binding info reply received 0 drop 0, sent 0 total 0 fail 0
Binding info reply acks received 0 drop 0, sent 0
Gratuitous 0, Proxy 0 ARPs sent
© 2002, Cisco Systems, Inc. All rights reserved.
CONTINUED >>>
Cisco Mobile Access Router—Module 2-154
Show IP Mobile Traffic (Home Agent) cont.
Home_Agent_#show ip mobile traffic
CONTINUED…..
Foreign Agent Registrations:
Request in 0,
Forwarded 0, Denied 0, Ignored 0
Unspecified 0, HA unreachable 0
Administrative prohibited 0, No resource 0
Bad lifetime 0, Bad request form 0
Unavailable encapsulation 0, Compression 0
Unavailable reverse tunnel 0
Replies in 0
Forwarded 0, Bad 0, Ignored 0
Authentication failed MN 0, HA 0
Home_Agent_#
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-155
Show IP Mobile Tunnels
Home_Agent_#show ip mob tunnel
Mobile Tunnels:
Tunnel1:
src 10.10.10.77, dest 110.10.11.237
encap IP/IP, mode reverse-allowed, tunnel-users 1
IP MTU 1460 bytes
Path MTU Discovery, mtu: 0, ager: 10 mins, expires: never
outbound interface Tunnel2
HA created, fast switching enabled, ICMP unreachable enabled
0 packets input, 0 bytes, 0 drops
10508 packets output, 1237820 bytes
Tunnel5:
src 10.10.10.77, dest 110.10.11.245
encap IP/IP, mode reverse-allowed, tunnel-users 1
IP MTU 1460 bytes
Path MTU Discovery, mtu: 0, ager: 10 mins, expires: never
outbound interface Tunnel0
HA created, fast switching enabled, ICMP unreachable enabled
0 packets input, 0 bytes, 0 drops
0 packets output, 0 bytes
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-156
Show IP Mobile Secure Hosts
Home_Agent_# show ip mob secure host
Security Associations (algorithm,mode,replay protection,key):
10.10.11.77:
SPI 300, MD5, Prefix-suffix, Timestamp +/- 7,
Key 12345678123456781234567812345678
110.10.11.213:
SPI 200, MD5, Prefix-suffix, Timestamp +/- 7,
Key 23456781234567812345678123456781
110.10.11.217:
SPI 3003, MD5, Prefix-suffix, Timestamp +/- 7,
Key 45678123456781234567812345678102
110.10.11.221:
SPI 4004, MD5, Prefix-suffix, Timestamp +/- 7,
Key 56781234567812345678123456781203
110.10.11.225:
SPI 5005, MD5, Prefix-suffix, Timestamp +/- 7,
Key 67812345678123456781234567812304
……. etc.
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-157
Show IP Mobile Host
HA#show ip mobile host 20.0.197.84
Mobile Host List:
20.0.197.84:
Allowed lifetime INFINITE/default)
Roam status -Registered-, Home link on interface Ethernet5/0/2
Accepted 8, Last time 03/26/01 10:40:30
Overall service time 00:28:39
Denied 1, Last time 04/24/02 18:13:22
Last code 'registration id mismatch (133)'
Total violations 1
Tunnel to MN - pkts 1, bytes 100
Reverse tunnel from MN - pkts 0, bytes 0
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-158
Show IP Mobile Interface
Foreign_Agent_2_#sh ip mobile interface
IP Mobility interface information:
Interface FastEthernet0/1:
IRDP (includes agent advertisement) enabled
Prefix Length not advertised
Lifetime is 36000 seconds
Foreign Agent service provided
No registration required
Not busy
Home Agent access list:
Current number of visitors: 5
Foreign_Agent_2_#
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-159
Clear Commands
Router#clear ip mobile binding [addr]
Removes the binding entry.
Router#clear ip mobile traffic
Clears all the Mobile IP counters.
Router#clear ip mobile host counters [addr] Clears Mobile Host Counters.
Router#clear ip mobile visitor
© 2002, Cisco Systems, Inc. All rights reserved.
Removes the visitor information.
Cisco Mobile Access Router—Module 2-160
Invalid SPI - Debug
MobileIP: HA 30 received registration for MN 20.0.197.84 on Ethernet5/0/2 using COA 40.0.197.19
HA 20.0.197.82 lifetime 65535 options sBdmgvt
MobileIP: Skip2TLV look for type 32, addr start 61D8EBE4 end 61D8EBFA
MobileIP: Skip2TLV look for type 32, addr start 61D8EBFA end 61D8EBFA
MobileIP: MN 20.0.197.84 - authenticating MN 20.0.197.84 using SPI 100
MobileIP: MN 20.0.197.84 - invalid authenticator for MN 20.0.197.84
MobileIP: HA rejects registration for MN 20.0.197.84 - MN failed authentication (131)
MobileIP: MN 20.0.197.84 - MH auth ext added (SPI 100) to MN 20.0.197.84
MobileIP: MN 20.0.197.84 - HA sent reply to 20.0.197.81
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-161
Invalid SPI – Violations Log
HA#show ip mobile violation
Security Violation Log:
Total violations 1
Mobile Hosts:
20.0.197.84:
Violations: 1, Last time: 02/11/02 10:49:11
SPI: 100, Identification: C0122026.6D841504
Error Code: MN failed authentication (131), Reason: Bad authenticator (2)
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-162
Timestamp Mismatch
MobileIP: HA 32 received registration for MN 20.0.197.84 on
Ethernet5/0/2 using COA 40.0.197.19 HA 20.0.197.82 lifetime
1000 options sBdmgvt
MobileIP: Skip2TLV look for type 32, addr start 616B4100 end
616B4116
MobileIP: Skip2TLV look for type 32, addr start 616B4116 end
616B4116
MobileIP: MN 20.0.197.84 - authenticating MN 20.0.197.84 using
SPI 100
MobileIP: MN 20.0.197.84 - authenticated MN 20.0.197.84 using
SPI 100
MobileIP: Identification field 2939948267 has timestamp
288712535 secs less than our current time 04/24/02 18:13:22
3228660802 (< allowed 7 secs) for MN 20.0.197.84
MobileIP: HA rejects registration for MN 20.0.197.84 - registration
id mismatch (133)
MobileIP: MN 20.0.197.84 - MH auth ext added (SPI 100) to MN
20.0.197.84
MobileIP: MN 20.0.197.84 - HA sent reply to 20.0.197.81
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-163
MN Not Configured
MobileIP: HA 32 received registration for MN
20.0.197.85 on Ethernet5/0/2 using COA 40.0.197.19
HA 20.0.197.82 lifetime 1000 options sBdmgvt
MobileIP: MN 20.0.197.85 is not configured, request
ignored
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-164
Shorter Lifetime on HA
MobileIP: HA 32 received registration for MN 30.2.0.2 on
Ethernet5/0/2 using COA 40.0.200.1 HA 20.0.197.82 lifetime 1900
options sBdmgvt
MobileIP: Skip2TLV look for type 32, addr start 616B4100 end
616B4116
MobileIP: Skip2TLV look for type 32, addr start 616B4116 end
616B4116
MobileIP: MN 30.2.0.2 - authenticating MN 30.2.0.2 using SPI 200
MobileIP: MN 30.2.0.2 - authenticated MN 30.2.0.2 using SPI 200
MobileIP: MN 30.2.0.2 requested broadcast support, but disabled
locally
MobileIP: Mobility binding for MN 30.2.0.2 updated
MobileIP: Roam timer started for MN 30.2.0.2, lifetime 1000
MobileIP: HA accepts registration from MN 30.2.0.2
MobileIP: MN 30.2.0.2 - MH auth ext added (SPI 200) to MN
30.2.0.2
MobileIP: MN 30.2.0.2 - HA sent reply to 20.0.197.81
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-165
Larger Lifetime on FA
MobileIP: FA received registration for MN 30.2.0.2 on
Serial4/1 using COA 40.0.200.1 HA 20.0.197.82
lifetime 40000 options sBdmgvt
MobileIP: Lifetime is too long in request from MN 30.2.0.2
MobileIP: FA rejects registration from MN 30.2.0.2 lifetime too long (69)
MobileIP: MN 30.2.0.2 - FA sent reply to 30.2.0.2
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-166
Lifetime Expires
MobileIP: Roam timer expired for MN 20.0.197.84
MobileIP: Delete tunnel route for 20.0.197.84 via gateway
40.0.197.19
MobileIP: Deleted Tunnel0 src 20.0.197.82 dest 40.0.197.19
MobileIP: HA route maint started with index 0
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-167
HA not replying (seen from FA)
MobileIP: FA received registration for MN 30.2.0.2 on Serial4/1
using COA 40.0.200.1 HA 20.0.197.83 lifetime 4000 options
sBdmgvt
MobileIP: FA queued MN 30.2.0.2 in register table
MobileIP: Visitor registration timer started for MN 30.2.0.2,
lifetime 15
MobileIP: Skip2TLV look for type 32, addr start 2000060C end
20000622
MobileIP: FA forwarded registration for MN 30.2.0.2 to HA
20.0.197.83
MobileIP: Visitor registration timer expired for MN 30.2.0.2
MobileIP: FA dequeued MN 30.2.0.2 from register table
MobileIP: Visitor timer expired for MN 30.2.0.2
MobileIP: Host route 30.2.0.2 deleted from routing table
MobileIP: ARP entry for MN 30.2.0.2 removed
MobileIP: Deleted Tunnel0 src 40.0.200.1 dest 20.0.197.82
MobileIP: MN 30.2.0.2 no longer visiting on Serial4/1
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-168
Invalid Care-of Address
MobileIP: FA received registration for MN 30.2.0.2 on
Serial4/1 using COA 40.0.200.10 HA 20.0.197.82 lifetime
40000 options sBdmgvt
MobileIP: Care-of addr 40.0.200.10 is invalid in request
from MN 30.2.0.2
MobileIP: FA rejects registration from MN 30.2.0.2 - reason
unspecified (64)
MobileIP: MN 30.2.0.2 - FA sent reply to 30.2.0.2
© 2002, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-169
©
2002, Cisco Systems, Inc. All rights reserved.
Presentation_ID
© 2001, Cisco Systems, Inc. All rights reserved.
Cisco Mobile Access Router—Module 2-170
170