Cisco ASR 5000 Series, Обзор продукта

Страница: 435 / 992

Packet Data Interworking Function Overview
Interfaces ▀
Cisco ASR 5000 Series Product Overview ▄
OL-22938-02
Interfaces
The figure below shows how the PDIF/FA acts as a security gateway between the Internet and packet data services. All
components are located in the home network.
Figure 117. PDIF/FA Mobile IP Interfaces
DMH
WiFi
Access
Point
ST40 PDIF
CDMA
IPSec Tunnel
PDSN
Home
Subscriber
Server
Home
AAA
BSC/PCF
MSC/VLR
IP Access
Network
IP Core
SIP Core
PLMN/PSTN
Broadband
Network
WiFi
1. The IPSec virtual tunnel interface with the MS: The Mode keyword in the IPSec-transform-set configuration
mode defaults to Tunnel. In Tunnel mode, the IP datagram is passed to IPSec, where a new IP header is created
ahead of the AH and/or ESP IPSec headers. The original IP header is left intact.
2. The Diameter interface: In a mobile IP network, the IMS Sh interface is used for MAC address validation with
the HSS as well as HSS subscriber profile updates. In a Proxy-MIP network using multiple authentication, the
HSS server is used to authenticate the device during Stage 1 authentication using the EAP-AKA authentication
method.
3.
The RADIUS authentication and accounting interface: In a mobile IP network, this interface is used for
subscriber authentication using the EAP-AKA authentication method. For subscriber accounting, the PDIF/FA
sends start, stop and interim messages to the accounting server. When used in a Proxy-MIP network using
multiple authentication, RADIUS is used with the AAA servers to authenticate the subscriber using the
GTC/MD5 authentication methods.