Cisco ASR 5000 Series, Обзор продукта

Страница: 484 / 992

PDG/TTG Overview
▀ Features and Functionality
▄ Cisco ASR 5000 Series Product Overview
OL-22938-02
Important:
For more information on AAA configuration, refer to the AAA Interface Administration and
Reference.
EAP Fast Re-authentication Support
When subscriber authentication is performed frequently, it can lead to a high network load, especially when the number
of currently connected subscribers is high. To address this issue, the PDG/TTG can employ fast re-authentication, which
is a more efficient method than full authentication.
Fast re-authentication is an EAP (Extensible Authentication Protocol) exchange that is based on keys derived from a
preceding full authentication exchange. The fast re-authentication mechanism can be used during both EAP-AKA and
EAP-SIM authentication.
When fast re-authentication is enabled, the PDG/TTG receives a fast re-auth ID from the UE in the IDi payload of the
IKE_AUTH_REQ message. The PDG/TTG sends the fast re-auth ID to the AAA server in an Authentication Request
message to initiate fast re-authentication.
During fast re-authentication, the PDG/TTG handles two separate IKE/IPSec SAs, one for the original session and one
for re-authentication. The re-authentication SA remains for a very short period until the fast re-authentication is
successful. After the successful fast re-authentication, the PDG/TTG assigns the UE with the same IP address. The
SGTP service running on the PDG/TTG identifies the original session and replicates the same session using the same IP
address assignment. The PDG/TTG then deletes the original session SA.
The AAA server falls back to full authentication in the following scenarios:
When the AAA server does not support fast re-authentication.
When the number of times a fast re-authentication is allowed after a successful full authentication exceeds the
limit configured on the AAA server.
When the EAP server does not have the permanent subscriber identity to perform a fast re-authentication.
Pseudonym NAI Support
The PDG/TTG supports the use of pseudonym Network Access Identifiers (NAIs) to protect the identity of subscribers
against tracing from unauthorized access networks.
Pseudonym NAIs are allocated to the WLAN UEs by the EAP server along with the last successful full authentication.
The EAP server maintains the mapping of pseudonym-to-permanent identity for each subscriber. The UEs store this
mapping in non-volatile memory to save it across reboots, and then use the pseudonym NAI instead of the permanent
one in responses to identity requests from the EAP server.
Multiple APN Support for IPSec Access
The PDG/TTG supports multiple wireless APNs for the same UE (the same IMSI) for use during subscriber
authorization.