ZXSS10 B200(V2.00.50) Data Configuration_EN

ZXSS10 B200Broadband Gateway

Data Configuration Manual

Version V2.00.50

ZTE CORPORATIONZTE Plaza, Keji Road South,Hi-Tech Industrial Park,Nanshan District, Shenzhen,P. R. China518057Tel: (86) 755 26771900Fax: (86) 755 26770801URL: http://ensupport.zte.com.cnE-mail: [email protected]

LEGAL INFORMATION

Copyright © 2006 ZTE CORPORATION.

The contents of this document are protected by copyright laws and international treaties. Any reproduction or distribution ofthis document or any portion of this document, in any form by any means, without the prior written consent of ZTE CORPO-RATION is prohibited. Additionally, the contents of this document are protected by contractual confidentiality obligations.

All company, brand and product names are trade or service marks, or registered trade or service marks, of ZTE CORPORATIONor of their respective owners.

This document is provided “as is”, and all express, implied, or statutory warranties, representations or conditions are dis-claimed, including without limitation any implied warranty of merchantability, fitness for a particular purpose, title or non-in-fringement. ZTE CORPORATION and its licensors shall not be liable for damages resulting from the use of or reliance on theinformation contained herein.

ZTE CORPORATION or its licensors may have current or pending intellectual property rights or applications covering the subjectmatter of this document. Except as expressly provided in any written license between ZTE CORPORATION and its licensee,the user of this document shall not acquire any license to the subject matter herein.

ZTE CORPORATION reserves the right to upgrade or make technical change to this product without further notice.

Users may visit ZTE technical support website http://ensupport.zte.com.cn to inquire related information.

The ultimate right to interpret this product resides in ZTE CORPORATION.

Revision History

Revision No. Revision Date Revision Reason

R1.0 Jan 13th, 2010 Version upgrade

Serial Number: sjzl20096999

Contents

About This Manual............................................. I

Configuration Environment................................1Methods for Configuring and Managing B200 ...................... 1

Configuring CONSOLE Login Mode..................................... 1

Configuring Telnet User and Password ............................... 4

Configuring Interface Information ..................................... 4

Configuring Telnet Login Mode.......................................... 5

System Parameter Setting.................................9Setting Host Name ......................................................... 9

Setting Greetings ..........................................................10

Setting Password for Privileged Mode ...............................10

Setting System Time......................................................11

Interface and Route Configuration ..................13Introduction to Interfaces ...............................................13

Configuring Ethernet Interface ........................................13

VRRP Address ...............................................................15

Setting VRRP Address ................................................15

Setting LOOPBACK Address.........................................16

SMARTGROUP Interface Configuration ..............................16

Introduction to SMARTGROUP......................................16

Interface Smartgroup.................................................17

Smartgroup Mode .....................................................17

Smartgroup Load-Balance...........................................17

IP Access-Group........................................................17

An Example for SMARTGROUP Configuration..................18

VLAN Sub-Interface Configuration....................................19

Introduction to VLAN Sub-Interface..............................19

Interface ..................................................................19

Encapsulation Dot1Q..................................................19

IP Address................................................................19

An Example for VLAN Sub-Interface Configuration..........20

Confidential and Proprietary Information of ZTE CORPORATION I

ZXSS10 B200 Data Configuration Manual

Static Routing Configuration............................................21

Introduction to Static Routing......................................21

IP Route...................................................................21

An Example for Static Routing Configuration..................22

Interconnection and Interworking

Configuration .................................................23Configuring SBC Working Role .........................................23

Integrated SBC’s Basic Configuration................................24

Configuring SP Layer in User-Location Way ...................26

Configuring SP layer in User-Location-Default Way .........27

Configuring Media Resource Items in MP layer

(Integrated SBC) ...............................................28

Configuring User-Location...........................................29

Example 1: Integrated SBC Configuration.....................30

Example 2: Integrated SBC Configuration.....................32

Separated SBC’s Basic Configuration ................................34

Configuring SPE layer.................................................34

Configuring Media Resource Items in MP Layer ..............35

Configuring User-Location...........................................36

Configuring Management Address for SPE’s Ia

Interface ..........................................................37

An Example for Separated SBC Configuration ................38

Inter-Domain Configuration ............................................40

Configuring Inter-Domain Interworking .......................40

Typical Configuration......................................................43

Configuring SPE Signal-Group’s Address Multiplexing

.......................................................................43

Configuring SPE Signal-Group’s Single-Address

Multiplexing at Two Sides....................................45

Configuring Multiple PBX for One Single-Group ..............47

Configuring SS Load Balancing Based on Each User .........48

Configuring MPE Address Multiplexing (For Media)..........51

Configuring MPE Single-Address (For Media)

Multiplexing At Two Sides ..................................53

Configuring SBC Media Release ...................................55

Protocol Configuration ....................................59Generalization...............................................................59

H.248 Protocol Configuration...........................................59

Viewing H.248 Attributes ...........................................59

Modifying H.248 Attributes..........................................60

II Confidential and Proprietary Information of ZTE CORPORATION

MGCP Protocol Configuration ...........................................61

Viewing MGCP Attributes ...........................................61

Modifying MGCP Attributes..........................................61

SIP Protocol Configuration ..............................................63

Viewing SIP Attributes................................................63

Modifying SIP Attributes .............................................63

H.323 Protocol Configuration...........................................65

Viewing H.323 Attributes ...........................................65

Modifying H.323 Attributes..........................................65

PAT Configuration ...........................................69Introduction to PAT........................................................69

PAT Working Principle.....................................................69

Configuring PAT Function ................................................70

Service Policy Configuration............................73Generalization...............................................................73

Configuring User-Group..................................................74

Register Policy Configuration ...........................................75

Configuring Registration White List/ Black List ...............75

Configuring Static Registration Users............................76

Call Policy Configuration .................................................79

Configuring Emergency Call ........................................79

An Example to Configure Emergency Call ......................80

CAC Policy Configuration.................................................82

Overview..................................................................82

Configuring CAC Policy ...............................................83

Configuring CPU-Based Control....................................85

An Example to Configure CAC Policy.............................86

QoS Policy Configuration.................................................88

Overview..................................................................88

Configuring QoS Signal Marking...................................90

Configuring QoS Media Marking ...................................91

Configuring QoS Remarking ........................................92

An Example to Configure QoS Policy.............................93

Resource Reservation Policy Configuration.........................95

Overview..................................................................95

Configuring Resource Reservation Policy .......................97

Security Configuration.....................................99Configuring Network Topology Hiding ...............................99

ACL Configuration........................................................ 100

Overview................................................................ 100

Confidential and Proprietary Information of ZTE CORPORATION III


ACL Classification .................................................... 100

ACL Statement........................................................ 101

ACL Rule ................................................................ 101

ACL Creation & Application........................................ 102

ACL Applications...................................................... 104

ACL Maintenance & Diagnosis.................................... 106

Configuring Signaling Firewall........................................ 106

SIP Encryption Configuration......................................... 108

Overview................................................................ 108

Configuring SIP Encryption ....................................... 109

An Example for SIP Encryption Configuration............... 110

Global Parameter Configuration ....................111Configuring Media Bandwidth Control ............................. 111

Configuring Learning Function for First Packet ................. 112

Configuring RTCP Function ............................................ 113

Configuring Media Discarding Function ........................... 113

Configuring Media Negotiation Control ............................ 114

Reliability Configuration ...............................115Generalization............................................................. 115

Configuring Cold Backup for Active/Standby B200............ 115

Configuring Hot Backup for Active/Standby B200 ............. 117

Disaster Recovery Configuration ...................121Generalization............................................................. 121

Configuration Flow....................................................... 121

Configuring Disaster Recovery Policy .............................. 122

Configuring SIP Terminal Fixedly-Affiliated to SS.............. 124

Configuring Attributes for Disaster Recovery.................... 124

Charging Configuration .................................127Generalization............................................................. 127

CDR Generation .......................................................... 128

CDR Configuration ....................................................... 128

Enabling CDR Function ............................................. 128

Configuring FTP Parameters for Upload CDR ................ 129

Configuring Public Attributes ..................................... 129

Setting CDR Division Interval .................................... 130

Operation and Maintenance Configura-

tion ...............................................................131Signaling Tracking ....................................................... 131

Tracking H.248 Protocol............................................ 131

IV Confidential and Proprietary Information of ZTE CORPORATION

Tracking MGCP Protocol ............................................ 132

Tracking SIP Protocol ............................................... 133

Tracking H.323 Protocol............................................ 134

SNMP Configuration ..................................................... 135

Overview................................................................ 135

Commands Introduction ........................................... 135

An Example for SNMP Configuration ........................... 137

SSH Configuration ....................................................... 138

Overview................................................................ 138

Configuring SSH...................................................... 139

An Example for SSH Configuration ............................. 140

SysLog Configuration ................................................... 140

Overview................................................................ 140


An Example for SysLog Configuration ......................... 141

RMON Configuration..................................................... 141

Overview................................................................ 141


Examples for RMON Configuration.............................. 142

Figures ..........................................................145

Glossary ........................................................147

Confidential and Proprietary Information of ZTE CORPORATION V


This page is intentionally blank.

VI Confidential and Proprietary Information of ZTE CORPORATION

About This Manual

Purpose This manual describes the ZXSS10 B200 Broadband Gatewayproduct in terms of data configuration for all kinds of functions.

IntendedAudience

This manual is intended for engineers and technicians who performoperation activities on the ZXSS10 B200 Broadband Gateway.

Prerequisite Skilland Knowledge

To use this document effectively, users must have a general un-derstanding of SoftSwitch technologies. Familiarity with followingaspects is helpful.

� Local operating procedures

� Equipment Environment

� Operation and functionality of ZXSS10 B200

What Is in ThisManual

This manual contains the following chapters:

TABLE 1 CHAPTER SUMMARY

Chapter Summary

Chapter 1, ConfigurationEnvironment

It introduces the establishment ofB200 configuration environment.

Chapter 2, System ParameterSetting

It introduces the systemparameter settings for B200.

Chapter 3, Interface and RouteConfiguration

It introduces the interface androute configuration for B200.

Chapter 4, Interconnection andInterworking Configuration

It introduces the interconnectionand interworking configuration forB200.

Chapter 5, Protocol Configuration It introduces the protocolconfiguration for B200.

Chapter 6, PAT Configuration It introduces the PAT configurationfor B200.

Chapter 7, Service PolicyConfiguration

It introduces the service policyconfiguration for B200.

Chapter 8, Security Configuration It introduces the securityconfiguration for B200.

Chapter 9, Global ParameterConfiguration

It introduces the global parameterconfiguration for B200, mainlyregarding the activation of systemparameters.

Chapter 10, ReliabilityConfiguration

It introduces the hot backupconfiguration as well as coldbackup for active/standby B200.

Chapter 11, Disaster RecoveryConfiguration

It introduces the disaster recoveryconfiguration for B200.

Confidential and Proprietary Information of ZTE CORPORATION I


Chapter Summary

Chapter 12, ChargingConfiguration

It introduces the chargingconfiguration for B200.

Chapter 13, Operation andMaintenance Configuration

It introduces related configurationduring operation & maintenancefor B200.

RelatedDocumentation

The following documentation is related to this manual:

� ZXSS10 B200 (V2.00.50) Broadband Gateway Product De-scription Manual

� ZXSS10 B200 (V2.00.50) Broadband Gateway Hardware De-scription Manual

� ZXSS10 B200 (V2.00.50) Broadband Gateway Hardware In-stallation Manual

� ZXSS10 B200 (V2.00.50) Broadband Gateway Operation Guide

� ZXSS10 B200 (V2.00.50) Broadband Gateway MaintenanceManual

� ZXSS10 B200 (V2.00.50) Broadband Gateway Command Ref-erence Manual (Volume I)

� ZXSS10 B200 (V2.00.50) Broadband Gateway Command Ref-erence Manual (Volume II)

II Confidential and Proprietary Information of ZTE CORPORATION

C h a p t e r 1

ConfigurationEnvironment

Table of ContentsMethods for Configuring and Managing B200.......................... 1Configuring CONSOLE Login Mode......................................... 1Configuring Telnet User and Password ................................... 4Configuring Interface Information ......................................... 4Configuring Telnet Login Mode.............................................. 5

Methods for Configuring andManaging B200

Overview After powering on B200, the operator can connect the PC to B200in two following ways, and then use MML to configure and manageB200.

� Configuring B200 through the Console interface.

� Configuring B200 through the Telnet tool.

Configuring CONSOLELogin Mode

Prerequisites Before configuring the CONSOLE login mode, meet the followingrequirements.

� The commissioning serial cable is in good condition.

� The commissioning PC has serial interface.

� The commissioning PC has the Windows Hyper terminal tool.

Context The CONSOLE interface is used to maintain and manage B200. Asthe RS232 (male, DB9) serial interface, the CONSOLE interfaceconnects to the background PC’s COM interface through the serialcable. Both two ends of the serial cable use the DB9 female con-nectors. The operator performs maintenance and management onB200 through the PC’s Hyper terminal software.

Confidential and Proprietary Information of ZTE CORPORATION 1


The CONSOLE interface is only for local configuration of B200.When B200 is powered on for the first time, or external networkcommunication interrupts or other abnormal situations occur, it issuggested to log in B200 through the CONSOLE interface

This topic describes the procedure to log in B200 through the CON-SOLE interface.

Steps 1. Power on B200, and then use the serial interface cable to con-nect B200 to the PC.

2. Start the PC’s Hyper terminal.The Connection Description dialog box appears as shown inFigure 1.

FIGURE 1 THE CONNECTION DESCRIPTION DIALOG BOX

3. Enter a name in the Name field, like ZXR10, and select an iconfrom the Icon field. Click the OK button.The Connect to dialog box appears as shown in Figure 2.

2 Confidential and Proprietary Information of ZTE CORPORATION

Chapter 1 Configuration Environment

FIGURE 2 THE CONNECT TO DIALOG BOX

4. Select an interface from the Connect using field, like COM1.The COM1 Properties dialog box appears as shown in Figure3.

FIGURE 3 THE COM1 PROPERTIES DIALOG BOX

5. Select 115200 from the Bits per second filed, select 8 fromthe Data bits filed, select None from the Parity field, select



1 from the Stop bits field, and select None from the Flowcontrol field.

6. Click the OK button.

END OF STEPS

Result The operator successfully enters the privileged mode after enteringthe enable command and related password as follows.ZXSS10B200>enablePassword: // The entered password is not displayed in the screen.

// By default, the password is zxr10.ZXSS10B200#

Configuring Telnet User andPassword

Prerequisites The operator already enters the CONSOLE login mode.

Context This topic describes the procedure to configure the Telnet user andpassword under the CONSOLE login mode.

Steps 1. Enter the config terminal command in the privilege mode.The operator enters the global configuration mode.

2. Set the Telnet user and password as follows.username <username> password <password>

END OF STEPS

Result The operator successfully configures the Telnet user and password.

Example Related configuration is as follows if the Telnet user and passwordare both who.ZXSS10B200#configure terminalEnter configuration commands, one per line, End with Ctrl-Z。ZXSS10B200(config)#username who password who

Configuring InterfaceInformation

Prerequisites Before configuring the interface information, meet the followingrequirements.

� The actual networking information is clear.

� The slot number of the physical interface in use is correct.

� Each interface’s IP address is already planned.



Context B200’s Ethernet interfaces consist of the Fast Ethernet interfaceand Gigabit Ethernet interface. The naming rule of the interface is“the type of the interface board_slot number/port number”

� For the Fast Ethernet interface board, the corresponding typeis FEI.

� For the Gigabit Ethernet interface board, the correspondingtype is GEI.

For example, for the port 7 of the fast Ethernet interface board onthe slot 3, its name is FEI_3/7.


2. Enter the interface configuration mode as follows.interface <interface-name>

3. Set the IP address of the interface.ip address <ip-addr> <net-mask> [<broadcast-addr>] [<secondary>]

4. Enter the Exit command.The operator returns to the global configuration mode.

5. View the interface information and state as follows.

END OF STEPS

Result The operator successfully configures the interface information.

Example � An example to configure the interface in the user sideZXSS10B200(config)#interface fei_1/1ZXSS10B200(config-if)#ip address ZXSS10B200(config-if)#exitZXSS10B200(config)#

� An example to configure the address in the network sideZXSS10B200(config)#interface fei_1/2ZXSS10B200(config-if)#ip address ZXSS10B200(config-if)#exitZXSS10B200(config)#

Configuring Telnet LoginMode

Prerequisites Before configuring the Telnet login mode, meet the following re-quirements.

� The background PC already connects to the LAN or WAN, andsuccessfully communicates with B200 (use the Ping commandfor test).

� The Telnet user and password are already set.

Context The operator is allowed to use the Telnet mode to log in B200 forconfiguration through the LAN or WAN only when the followingconditions are met.

� B200 is not powered on for the first time.



� The operator already configures the correct IP address forB200’s each interface as well as the correct login authentica-tion mode

� Reachable routes are between the configuration terminal andB200.

This topic describes the procedure to configure the Telnet loginmode.

Steps 1. Use the network cable to connect the PC’s Ethernet interface toB200’s Ethernet interface if the background PC Telnet to B200through the local Ethernet.

Note:

Another alternative is to interconnect networks through HUBor Ethernet switches, as shown in Figure 4.

If the operator uses the remote login way to configure B200,it is necessary connect the PC to B200 through the WAN, asshown in Figure 5.

FIGURE 4 CONSTRUCTING CONFIGURATION ENVIRONMENT THROUGHLAN

FIGURE 5 CONSTRUCTING CONFIGURATION ENVIRONMENT THROUGHWAN



2. The operator selects Start > Run from the PC’s programmenu, and enters the Telnet command.

Note:

For example, if the IP address of B200 is 192.168.3.1, theoperator must enter the telnet 192.168.3.1 command in theRun dialog box, as shown in Figure 6.

FIGURE 6 RUNNING TELNET COMMAND

3. Click the OK button.

END OF STEPS

Result The operator successfully configures the Telnet login mode forB200.





C h a p t e r 2

System ParameterSetting

Table of ContentsSetting Host Name ............................................................. 9Setting Greetings ..............................................................10Setting Password for Privileged Mode ...................................10Setting System Time..........................................................11

Setting Host NamePrerequisites The configuration environment is successfully established

Context B200’s default name is ZXSS10B200. The operator is allowed touse the hostname command to modify the host name.

Note:

The modification of the host name becomes effective immediately.

This topic describes the procedure to set system parameters.


2. Set the host name as follows.hostname <network-name>

Note:

The length of the network name ranges from 1 to 16 charac-ters.

END OF STEPS

Result The operator successfully sets the host name

Example The operator set the network name of B200 to SBC.ZXSS10B200(config)#hostname SBCSBC(config)



Setting GreetingsPrerequisites The configuration environment is successfully established.

Context When Telneting to B200, the operator enters the welcome inter-face used to customize the start-up greetings.

This topic describes the procedure to set startup greetings.

Steps 1. Enter the config terminal command in the privilege mode.The operator successfully enters the global configurationmode.

2. Set the startup greeting as follows.banner incoming <end-char>

END OF STEPS

Result The operator successfully sets the startup greeting.

Example The greeting is made up by up to 255 characters (including thespace and enter)

The customized ending character (like #) follows the command inthe same line, and the same character must be entered once againafter the whole greeting is entered.SBC(config)#banner incoming #welcome#

Setting Password forPrivileged Mode

Prerequisites The configuration environment is successfully established.

Context It is allowable to set operation parameters in the privilege modeand enter the configuration mode. To avoid the unauthorized per-son’s random modifications of configuration, it is necessary set thepassword for the privileged mode.

This topic describes the procedure to set the password for the priv-ilege mode.


2. Set the password for the privilege mode as follows.enable secret {0 <password>|5 <password>|<password>}

END OF STEPS


Chapter 2 System Parameter Setting

Result The operator successfully sets the startup greeting.

Example The operator sets the password for the privilege mode toZXSS10B200.SBC(config)#enable secret ZXSS10B200

Setting System TimePrerequisites The configuration environment is successfully established.

Context This topic describes the procedure to set system clock in a stan-dard time format.

Steps 1. Enter the privilege mode

2. Set system time as follows.clock set <current-time> <month> <day> <year>

END OF STEPS

Result The operator successfully sets system time.

Example The operator sets system time as follows.SBC#clock set 23:12:01 feb 23 2008





C h a p t e r 3

Interface and RouteConfiguration

Table of ContentsIntroduction to Interfaces ...................................................13Configuring Ethernet Interface ............................................13VRRP Address ...................................................................15SMARTGROUP Interface Configuration ..................................16VLAN Sub-Interface Configuration........................................19Static Routing Configuration................................................21

Introduction to InterfacesOverview Interfaces refer to the parts used to exchange data with other net-

work devices, which are classified into physical interfaces and logicinterfaces.

� Physical interface: Refers to the real physical interface sup-ported by related components. B200’s physical interfaces aremainly Ethernet interfaces which include the Fast Ethernet in-terfaces and Gigabit Ethernet interfaces.

� Fast Ethernet interfaces: Works at the 10 M or 100M rate,supports the full duplex mode and half-duplex mode, andhas the default auto-negotiation function.

� Gigabit Ethernet interfaces: Works at the 1000M rate, sup-ports the full duplex mode, and has the default auto-nego-tiation function.

Configuring EthernetInterface

Prerequisites Before configuring the Ethernet interface, meet the following re-quirements.

� The type of the Ethernet interface

� The location of the interface board

Context The naming rule for B200’s Ethernet interfaces is as follows.



� The type of the interface board_ slot number/port number

For the Fast Ethernet interface board, the corresponding type isFEI. For the Gigabit Ethernet interface board, the correspondingtype is GEI. For example, FEI_3/7 represents the port 7 of theFast Ethernet interface board in slot 3.

This topic describes the procedure to configure the Ethernet inter-faces.

Steps 1. Enter the config terminal command in the privilege mod.The operator enters the global configuration mode.

2. Enter the interface configuration mode as follows.interface <interface-name>

3. Set the Ethernet interface’s MAC offset as follows.interface mac-address offset <mac-offset>

Note:

If the interface’s MAC offset is not set, all interfaces’ MAC ad-dresses are basic ones, which leads to abnormal communica-tion.

4. Set the IP address as follows.ip address <ip-addr> <net-mask> [<broadcast-addr>] [<secondary>]

5. Set the interface’s working rate as followsspeed {10 | 100|1000 }

6. Set the interface’s full-duplex mode as follows.duplex { half | full}

Note:

The working rate and the full duplex mode only apply to theFast Ethernet interface.

END OF STEPS

Result The operator successfully configures the Ethernet interface.

Example � Example 1

As shown in Figure 7, ZXSS10 B200’s feiz-1/2 interface con-nects to the route switch’s et.2.1 interface.

FIGURE 7 AN EXAMPLE FOR THE ETHERNET ROUTER SWITCHCONFIGURATION


Chapter 3 Interface and Route Configuration

B200 is configured as follows.SBC(config)#interface fei_1/2SBC(config-if)#ip address 10.1.1.2 255.255.255.252SBC(config-if)#duplex fullSBC(config-if)#speed 100

� Example 2

In some application scenes, several IP addresses for a physicalinterface are necessary for multiple different groups or inter-connection among different network segments. At present, aphysical interface is allowed to have 128 IP addresses at most.SBC(config)#interface fei_1/6SBC(config-if)#ip address 1.1.1.2 255.0.0.0 secondary

VRRP AddressSetting VRRP Address

Context In general, each host in the inner network has a default routewhose next hop points to the IP address of the port for the exitrouter. Then, all messages regarding each host in the inner net-work accessing the external network are all firstly sent to the exitrouter. Next, the exit router forwards messages. At last, the com-munication between hosts in the inner network and the externalnetwork is achieved.

If the default route is used, the communication between all hosts(in the inner network) using the unique exit router as the next hopand the external network interrupts when the exit router breaksdown. Thus, the communication is not reliable.

The Virtual Router Redundancy Protocol (VRRP) organizes a groupof routers in the LAN as a virtual router, called the backup group.Of all the routers, only one is in active state, called Master. Therest of routers in backup state, called Backup, are ready to replaceMaster. VRRP designates Master and Backup according to the pri-orities of these routers. The Master ranks the top priority. Of therouters with the same priority, one with the larger IP address actsas the Master.

It is necessary to set the VRRP address when an interface is addedto the VRRP group. Then, when such interface works in activestate, the VRRP address acts as the interface’s floating address,which provides external access and services.

This topic describes the procedure to set the VRRP address.

Steps 1. Set the VRRP address.SBC(config)#interface fei_1/1SBC(config-if)#vrrp 1 ip 10.45.1.5

END OF STEPS



Result The operator successfully set the VRRP address.

Setting LOOPBACK Address

Context Equivalent to B200’s internal address, LOOPBACK is not bindedto any specific physical interface. However, for the data packetwhose destination address points to B200’s LOOPBACK address,B200 still processes it when the data packet reaches any interfaceof B200.

The typical applications of LOOPBACK address are as follows.

� The LOOPBACK address acts as B200’s management address.The operator sets a LOOPBACK address in B200 as the re-mote TELNET management address. By creating routing datain B200’s different adjacent route devices, the operator makesthe LOOPBACK address point to B200. Then, network devicesin different network segments can access B200 in a remoteway.

� The LOOPBACK address acts as the group’s inner or exter-nal address. The principle is the same as the one mentionedabove.

This topic describes the procedure to set the LOOPBACK address.

Steps 1. Set the LOOPBACK address.SBC(config) #interface loopback1SBC(config-if)#ip address 1.1.1.2 255.0.0.0

END OF STEPS

Result The operator successfully sets the LOOPBACK address in B200.

SMARTGROUP InterfaceConfigurationIntroduction to SMARTGROUP

Overview B200’s SMARTGROUP function provides more flexible and efficientnetworking solutions for users. By employing the SMARTGROUPfunction, more bandwidth, better stability, lower network con-struction cost can be achieved. In addition, a SMARTGROUP logicinterface, made up of multiple Ethernet Interfaces with the sametype, can be put into use.

The SMARTGROUP function fulfills following functions.

� Supports the binding of an interface board’s Ethernet inter-faces.



� Supports the binding of the Ethernet interfaces (same type,same IQ) for different interface boards.

� Supports two load sharing modes, i.e., per-packet, per-desti-nation. The latter one uses the “source IP address + destina-tion IP address” mode.

� Supports all kinds of routing protocols, like RIP (lower priority),BGP, OSPF and ISIS. That is, these protocols are allowed towork in the SmartGroup interface.

� Supports MPLS and VPN access

� Supports NAT, ACL, QoS and VRRP.

Interface Smartgroup

Syntax interface smartgroup

<smartgroup-id>

Purpose To create the SMARTGROUP interrface

Smartgroup Mode

Syntax smartgroup

<smartgroup-id> mode {passive|active|on}

Purpose To bind links

Smartgroup Load-Balance

Syntax smartgroup load-balance

<mode>

Purpose To configure the load sharing function of the SMARTGROUP inter-face

IP Access-Group

Syntax ip access-group

<acl-number> {in|out}

Purpose To implement the ACL function of the SMARTGROUP interface



An Example for SMARTGROUPConfiguration

Overview Figure 8 shows an example for SMARTGROUP configuration. Thefei_2/1-fei_2/3 interfaces of B200 (A) connect to fei_2/1 -fei_2/3interfaces of B200 (B). All of these interfaces are binded togetherto the SMARTGROUP, and the fei_1/1 interface of B200 (A) andthe fei_1/1 interface of B200 (B) both connect to the SMARTBITStester.

FIGURE 8 AN EXAMPLE FOR SMARTGROUP CONFIGURATION

SBC(config)#interface smartgroup1SBC(config-if)#ip address 10.10.10.1 255.255.255.0SBC(config-if)#exitSBC(config)#interface fei_2/1SBC(config-if)#smartgroup 1 mode activeSBC(config-if)#exitSBC(config)#interface fei_2/2SBC(config-if)#smartgroup 1 mode activeSBC(config-if)#exitSBC(config)#interface fei_2/3SBC(config-if)#smartgroup 1 mode activeSBC(config-if)#exitSBC(config)#interface smartgroup1SBC(config-if)#smartgroup load-balance per-packetSBC(config-if)#exitSBC(config)#interface fei_1/1SBC(config-if)#ip address 192.18.1.1 255.255.255.0SBC(config-if)#exitSBC(config)#ip route 192.19.1.0 255.255.255.0 10.10.10.2



VLAN Sub-InterfaceConfigurationIntroduction to VLAN Sub-Interface

Overview B200 uses VLAN trunks and sub-interfaces to provide routesamong VLANs. When B200 connects to a switch with multipleVLANs via a trunk, it is necessary to set the connection port ofB200, as well as the related port of the switch, in the trunk mode.To terminate different VLANs in the switch, it is required to createmultiple logic sub-interfaces on physical interfaces of B200, andmake sure the sub-interfaces correspond to VLANs of the switchone to one by VLAN number.

B200 follows the standard 802.1Q VLAN trunk protocol. B200’sEthernet interfaces support the VLAN sub-interface function.

Interface

Syntax interface

{<interface-name>| byname <byname>}

Purpose To create a sub-interface and enter the sub-interface configurationmode

Encapsulation Dot1Q

Syntax encapsulation dot1Q

<vlan-id>

Purpose To encapsulate a VLAN-ID number for the sub-interface

Usage Guidelines Encapsulation of VLAN-ID is to allocate the sub-interface to relatedVLAN. Then, the sub-interface corresponds to the VLAN.

IP Address

Syntax ip address

<ip-addr> <net-mask> [<broadcast-addr>] [<secondary>]



Purpose To allocate an IP address for the sub-interface.

An Example for VLAN Sub-InterfaceConfiguration

Overview Figure 9 shows an example, which realizes the access to a samephysical Ethernet interface for different VLAN users as well as rout-ing by employing the VLAN sub-interface technology.

In it, Interface fei_1/3 of B200 connects to port 10 of ZXR10 3904Switch, and ZXR10 3904’s port 2 and port 3 belong to VLAN100and VLAN200 respectively, connecting to two PCs.

FIGURE 9 AN EXAMPLE FOR VLAN SUB-INTERFACE

B200 is configured as follows.SBC(config)#interface fei_1/3.100SBC(config-subif)#encapsulation dot1q 100SBC(config-subif)#ip address 10.40.50.1 255.255.255.192SBC(config-subif)#exitSBC(config)#interface fei_1/3.101SBC(config-subif)#encapsulation dot1q 200SBC(config-subif)#ip address 10.40.50.65 255.255.255.192

ZXR10 3904 is configured as follows.



ZXR10-3904(bridge)#set vlan create br100 100ZXR10-3904(bridge)#set vlan create br200 200ZXR10-3904(bridge)#set vlan del br1 2-3,10ZXR10-3904(bridge)#set vlan add br100 2 untaggedZXR10-3904(bridge)#set vlan add br100 10 taggedZXR10-3904(bridge)#set vlan add br200 3 untaggedZXR10-3904(bridge)#set vlan add br200 10 taggedZXR10-3904(bridge)#set vlan pvid 2 100ZXR10-3904(bridge)#set vlan pvid 3 200ZXR10-3904(bridge)#exitZXR10-3904(config)#interface br100ZXR10-3904(config-if)#no shutdownZXR10-3904(config-if)#exitZXR10-3904(config)#interface br200ZXR10-3904(config-if)#no shutdown

Static Routing ConfigurationIntroduction to Static Routing

Overview Unlike dynamic routing, which creates a routing table accordingto the routing algorithm, static routing specifies information in therouting table through a configuration command by a network ad-ministrator.

For dynamic routing configuration, sometimes, it is necessary tosend the routing information of the whole Internet to a router.Considering the router’s capacity, static routing provides a solu-tion.

Static routing is characterized by fewer configurations. However,static routing configuration becomes more complicated in the rout-ing environment which owns multiple routers and paths.

IP Route

Syntax ip route

[vrf<vrf-name>][<prefix>|<net-mask>] {<forwarding-router's-address>| <interface-name>} [<distance-metric>] [tag <tag>]

Purpose To set up a static route

Usage Guidelines It is a global command. Parameter Tag is used to mark the route.Two static routes to the same destination, with different next hopaddresses, have different Tag values.



An Example for Static RoutingConfiguration

Overview Figure 10 shows a simple network, in which B200 is connected toSS through the Router.

FIGURE 10 AN EXAMPLE FOR STATIC ROUTING CONFIGURATION

If B200 wants to connect to SS, static routing must be configuredas follows.SBC(config)#ip route 192.168.5.0 255.255.255.0 192.168.4.2

It can be concluded that the above static route is configured inthe global configuration mode, one route at a time. Followed bythe ip route command are the remote network address and itssubnet mask, as well as the next hop IP address to the remotenetwork. In other words, messages from B200 are firstly sent tothe Router (IP address: 192.168.4.2), and then forwarded to SS.B200 directly connects to the Router.

If there are multiple routes to the same destination, multiple staticroutes with different management distances can be configured forB200. However, the route with the shortest distance is displayedin the routing table, due to its top priority among multiple routesin a network.

Parameter distance-metric in the ip route command is used tochange the management distance for a static route. Suppose thereare two different routes from B200 to the 192.168.5.0/24 networksegment, configuration is as follows.SBC(config)#ip route 192.168.5.0 255.255.255.0 192.168.4.2SBC(config)#ip route 192.168.5.0 255.255.255.0 192.168.3.2 25 tag 10

Two different static routes to a same network are both configuredin the above commands. For the 1st command, the default value1 is used because the management distance is not configured.

For the 2nd command, the management distance is 25. Since1 is less than 25, only the first route appears in the routing ta-ble. In other words, messages from B200 are sent to the destina-tion network 192.168.5.0/24 only through the next hop address192.168.4.2. The second route appears in the routing table onlywhen the first route is invalid and disappears from the routing ta-ble.


C h a p t e r 4

Interconnectionand InterworkingConfiguration

Table of ContentsConfiguring SBC Working Role .............................................23Integrated SBC’s Basic Configuration....................................24Separated SBC’s Basic Configuration ....................................34Inter-Domain Configuration ................................................40Typical Configuration..........................................................43

Configuring SBC WorkingRole

Context In the networking characterized by separated signaling and me-dia, the working mode of a single physical entity SBC, either SPEor MPE, is configurable. SPE, which uses signaling to interconnectterminals and SS/CSCF, controls and manages multiple networkMPE devices through the Ia interfaces. When working in the SPEmode, SPE is allowed to have an inner MPE. Then, SPE exerts con-trol on such MPE through internal messages.

If working in the MPE working mode, SBC’s SPE function moduleloses validity. By default, SBC works in the SPE mode.

This topic describes the procedures to configure SBC’s workingrole.

Steps 1. Run the following command.SBC(config-sbc)#working-role {signal-portal-element | me-dia-portal-element}

END OF STEPS

Result SBC’s working role is successfully configured.

Example Figure 11 shows a typical networking characterized by separatedsignaling and media. Of the four physical entities SBC, one actsas SPE, and the rest devices act as MPE.



FIGURE 11 CONFIGURING NETWORKING FOR WORKING ROLES

#1 configure SBC’s working role to SPESBC(config-sbc)#working-role signal-portal-element#2 configure SBC-1’s working role to MPESBC-1(config-sbc)#working-role media-portal-element#3 configure SBC-2’s working role to MPESBC-2(config-sbc)#working-role media-portal-element#4 configure SBC-3’s working role to MPESBC-3(config-sbc)#working-role media-portal-element

Integrated SBC’s BasicConfiguration

Overview In the architecture characterized by separated signaling and me-dia, the user-location concept is introduced. As a set regardingthe terminals’ media-based accessibility, the user-location usesthe address segment or address pool to define terminals. An im-portant principle must be followed. That is, terminals with thesame user-location must have the same media-based accessibil-ity, but terminals with the same media-based accessibility may notin the same user-location. For the integrated SBC, SPE uses thelocal MPE’s resources. Therefore, terminals, regardless of types,all have the media-based accessibility to MPE.

When A-SBC acts as a network access device, the user-location-default, used to define terminals due to the uncontrollable sourceaddresses of terminals, is applied to the networking characterizedby distributed source addresses.

Two ways are presented to configure the integrated SBC as follows.

� The user-location is used to define the sources of terminals, asshown in Figure 12.


Chapter 4 Interconnection and Interworking Configuration

FIGURE 12 CONFIGURATION FLOW (USER-LOCATION WAY)

� The user-location-default is used as shown in Figure 13.

FIGURE 13 CONFIGURATION FLOW (USER-LOCATION-DEFAULT WAY)



Configuring SP Layer inUser-Location Way

Prerequisites The configuration environment is in normal state.

Context SP configuration is equivalent to the configuration of different sig-naling groups (signal-groups). B200’s signal-group connects usersto the affiliated SS. If B200 serves for multiple SS, it is necessaryto configure multiple signal-groups. The signal-group, which is notused to solve media resources, is used to solve the terminals’ sig-naling-based accessibility.

This topic describes the procedure to configure the SP layer in theuser-location way.

Steps 1. Enter the following command to enter the Signal Portal config-uration mode.SBC(config-sbc)#signal-portal

2. Enter the following command to enter the signal-group config-uration mode.SBC(config-sbc-sp)#signal-group <1-65535>

Note:

At present, SBC supports 1024 signal-groups at most.

3. Configure the address couple for local signaling as follows.SBC(config-sbc-sp-sg)#signal uni-address {ipv4 | ipv6} <ip-address>nni-address {ipv4 | ipv6} <ip-address>

4. Configure the protocol port for local signaling as follows.SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}

5. Enter the next-hop configuration mode for signaling as follows.SBC(config-sbc-sp-sg)#signal nexthop id <1-65535>

6. Configure the next hop’s protocol address as follows.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4 | ipv6} <ip-address>[ weight <0-100> | track id <1-65535> ]

7. Configure the next hop’s protocol port as follows.SBC(config-sbc-sp-sg-snh)#port {sip | mgcp | h248} <1-65535>

8. Enable the complete signal-group after configuration as fol-lows.SBC(config-sbc-system)#activate signal-group <1-65535>

9. Repeat step 2 to step 8 if there are multiple signal-groups.

END OF STEPS



Result The operator successfully configures the SP layer in the user-loca-tion way.

Configuring SP layer inUser-Location-Default Way

Prerequisites The configuration environment is in normal state.

Context Unlike the SP configuration in user-location way, the SP configura-tion in user-location-default way must define related informationof user-location-default first.

When the user-location fails to give explicit defines for terminals’uncontrollable source addresses (meanwhile, A-SBC acts as thenetwork access device), the user-location-default is applied to thenetwork characterized by distributed source addresses. The useof the user-location-default reduces the work load of configurationto a large degree.

This topic describes the procedure to configure the SP layer in theuser-location-default way.

Steps 1. Enter the following command to enter the Signal Portal config-uration mode.SBC(config-sbc)#signal-portal

2. Enter the following command to enter the signal-group config-uration mode.SBC(config-sbc-sp)#signal-group <1-65535>

Note:


3. Configure the address couple for local signaling as follows.SBC(config-sbc-sp-sg)#signal uni-address {ipv4 | ipv6} <ip-address>nni-address {ipv4 | ipv6} <ip-address>

4. Configure the protocol port for local signaling as follows.SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}


6. Configure the next hop’s protocol address as follows.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4 | ipv6} <ip-address>[weight <0-100> | track id <1-65535> ]

7. Configure the next hop’s protocol port as follows.SBC(config-sbc-sp-sg-snh)#port {sip | mgcp | h248} <1-65535>



8. Enter the user-location-default configuration mode as follows.SBC(config-sbc-sp-sg)#user-location-default

9. Enter the media-group configuration mode as follows.SBC(config-sbc-sp-sg-uld)#media-group

10.Configure the usable media resources for terminals as follows.For the integrated SBC, local is selected for media-location.SBC(config-sbc-sp-sg-uld-mg)#media <1-65535> media-location {local| <1-65535>} media-resource <1-65535> [weight <0-100> | track-id <1-65535>]


12.Repeat step 2 to step 8 if there are multiple signal-groups.

END OF STEPS

Result The operator successfully configures the SP layer in the user-loca-tion-default way.

Configuring Media Resource Items inMP layer (Integrated SBC)

Context In the architecture characterized by separated signaling and me-dia, MPE provides media resources for SPE. Media-location rep-resents a SBC used to process media physically. Media-resourcerepresents one media resource in the SBC. Each media resourcecontains the media address in the user side, the media addressin the network side as well as the port capacity determined byend-port and start-port.

For the integrated SBC, SPE provides a MPE for the affiliated SBC.The MPE’s location-id is distinguished by local.

This topic describes the procedure to configure the media resourceitems in the MP layer.

Steps 1. Enter the Media Portal configuration mode as follows.SBC(config-sbc)#media-portal

2. Configure media-location to local as follows.SBC(config-sbc-mp)#media-location { local | <1-65535>}

Note:


3. Configure the media-resource as followsSBC(config-sbc-mp-ml)#media-resource <1-65535>

4. Configure the media resource in the user side as follows.SBC(config-sbc-mp-ml-mr)#uni-address {ipv4 | ipv6} <ip-address>uni-port <start-port> <end-port>



5. Configure the media resource in the network side as follows.SBC(config-sbc-mp-ml-mr)#nni-address {ipv4 | ipv6} <ip-address>nni-port <start-port> <end-port>

6. Repeat step 3 to step 5 if there are multiple media resources.

END OF STEPS

Result The operator successfully configures the media resource items inthe MP layer.

Configuring User-Location

Context This topic describes the procedure to configure the terminal user(user-location).

Steps 1. Enter the Signal Portal configuration mode as follows.SBC(config-sbc)#signal-portal

2. Enter the user-location configuration mode as follows.SBC(config-sbc-sp)#user-location <1-65535>

3. Configure the terminal’s source network as follows.

Note:

Each user-location represents a terminal’s source network, andthe terminal’s source address may be recorded in the net-work segment format, IP-PBX format or NAT address pool for-mat. Therefore, the configuration of source network informa-tion must support the network segment mode and address poolmode.

SBC(config-sbc-sp-ul)remote-address {ipv4|ipv6}{<ip-address>|ip-pool <start-address> <end-address>} prefix-length <prefix-len>

4. Configure the communication port as follows (optional).

Note:

The user-location refers to the terminal’s source net-work, IP-PBX or Gateway. Because the registration of theIP-PBX/Gateway users is unnecessary, SBC must identify theterminal’s source network, and specify the communicationport.

SBC(config-sbc-sp-ul)#gateway port <1-65535>

5. Enter the media-group configuration mode as follows.SBC(config-sbc-sp-ul)#media-group

6. Configure the media information of the media group’ as follows.SBC(config-sbc-sp-ul-mg)media <1-65535> media-location {local|<1-65535>}media-resource <1-65535> [{{[(weight <0-100>)][(track <1-65535>)]}}]



7. Repeat step 2 to step 6 if multiple user-locations are to bedefined.

END OF STEPS

Result The operator successfully configures the user-location.

Example 1: Integrated SBCConfiguration

Overview As shown in Figure 14, two terminal network segments both con-nect to SBC’s two different physical interfaces. Therefore, it isnecessary to configure an independent signal-group for each ter-minal network segment.

FIGURE 14 A TYPICAL NETWORKING (SBC ACTS AS THE ACCESS DEVICE)

� Method 1: Configure the user-location-default in the signal-group#1 Configures the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1



SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp-sg)#user-location-defaultSBC(config-sbc-sp-sg-uld)#media-groupSBC(config-sbc-sp-sg-uld-mg)#media 1 media-location local media-resource 1SBC(config-sbc-system)#activate signal-group 1SBC(config-sbc-sp)#signal-group 2SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.20.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5061SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp-sg)#user-location-defaultSBC(config-sbc-sp-sg-uld)#media-groupSBC(config-sbc-sp-sg-uld-mg)#media 1 media-location local media-resource 2SBC(config-sbc-system)#activate signal-group 2

#2 Configure the media resource items in the MP layerSBC(config-sbc-mp)#media-location localSBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 20000 39999SBC(config-sbc-mp-ml)#media-resource 2SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.20.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 40000 59999

� Method 2: Use the user-location to define the terminal source.#1 Configures the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-system)#activate signal-group 1SBC(config-sbc-sp)#signal-group 2SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.20.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5061SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-system)#activate signal-group 2

#2 Configures the media resource items in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location localSBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 20000 39999SBC(config-sbc-mp-ml)#media-resource 2SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.20.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 40000 59999

#3 Configures the user-locationSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 1SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 211.20.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 2



Example 2: Integrated SBCConfiguration

Overview As shown in Figure 15, two terminal network segments both con-nect to SBC’s two different physical interfaces. Therefore, it is nec-essary to configure an independent signal-group for each terminalnetwork segment. A terminal source network contains multiplesub-networks.

FIGURE 15 A TYPICAL NETWORKING (INTEGRATED SBC ACTS AS THEACCESS DEVICE)

� Method 1: Configure the user-location-default in the signal-group.#1 Configures the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp-sg)#user-location-defaultSBC(config-sbc-sp-sg-uld)#media-groupSBC(config-sbc-sp-sg-uld-mg)#media 1 media-location local media-resource 1SBC(config-sbc-system)#activate signal-group 1SBC(config-sbc-sp)#signal-group 2



SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.20.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5061SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp-sg)#user-location-defaultSBC(config-sbc-sp-sg-uld)#media-groupSBC(config-sbc-sp-sg-uld-mg)#media 1 media-location local media-resource 2SBC(config-sbc-system)#activate signal-group 2

#2 Configures the media resource items in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location localSBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 20000 39999SBC(config-sbc-mp-ml)#media-resource 2SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.20.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 40000 59999

� Method 2: Use the user-location to define the terminal source.#1 Configures the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-system)#activate signal-group 1SBC(config-sbc-sp)#signal-group 2SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.20.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5061SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-system)#activate signal-group 2

#2 Configures the media resource items in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location localSBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 20000 39999SBC(config-sbc-mp-ml)#media-resource 2SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.20.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 40000 59999

#3 Configures the user-locationSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 1SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 211.20.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 213.20.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 58.2.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 2

The following configuration is also allowable.#3 Configures the user-locationSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 1



SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 211.20.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 2SBC(config-sbc-sp)#user-location 3SBC(config-sbc-sp-ul)#remote-address ipv4 213.20.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 2SBC(config-sbc-sp)#user-location 4SBC(config-sbc-sp-ul)#remote-address ipv4 58.2.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location local media-resource 2

Separated SBC’s BasicConfiguration

Overview For the separated SBC, SPE is allowed to manage multiple MPEs.And SPE and MPE interconnect with each other through the Ia in-terface.Figure 16 shows the basic configuration flow for separatedSBC.

FIGURE 16 BASIC CONFIGURATION FLOW FOR SEPARATED SBC

Configuring SPE layer

Prerequisites The working role of SBC is already defined.

Context The main configuration of the separated SBC is performed in theSPE.



This topic describes the procedure to configure related informationof the signal-group in SPE.


2. Enter the signal-group configuration mode as follows.SBC(config-sbc-sp)#signal-group <1-65535>

Note:

The main configuration of SPE must be performed in the signal-group configuration mode.


3. Configure the address couple for local signaling as follows.SBC(config-sbc-sp-sg)#signal uni-address {ipv4|ipv6} <ip-address>nni-address {ipv4|ipv6} <ip-address>

4. Configure the protocol port for local signaling as follows.SBC(config-sbc-sp-sg)#port {sip|mgcp|h248} uni-port <1-65535>nni-port <1-65535>


6. Configure the next hop’s protocol address as follows.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[weight <0-100>|track id <1-65535> ]

7. Configure the next hop’s protocol port as follows.SBC(config-sbc-sp-sg-snh)#port {sip|mgcp|h248} <1-65535>


END OF STEPS

Result The operator successfully configures the SPE layer.

Configuring Media Resource Items inMP Layer

Prerequisites The operator must make sure the configuration object is SPE.

Context In the architecture characterized by separated signaling and me-dia, MPE is used to provide media resources for SPE. The media-lo-cation represents B200 which processes media physically. The me-dia-resource represents a piece of media resource in B200. Eachpiece of media resource contains the media address in the userside, media address in the network side as well as the port capac-ity determined by the end port and start port.



For separated B200, in SPE, it is necessary to configure the controladdress of the Ia interface for each MPE. For centralized B200, itis unnecessary to configure related information of the Ia interface.


2. Configure the media-location as follows.

Note:

For separated SBC, the operator must not select local. Atpresent, the separated SBC supports up to 1024 media-loca-tions.

SBC(config-sbc-mp)#media-location { local|<1-65535>}

3. In SPE, configure the control address for MPE’s solo Ia interfaceas follows.SBC(config-sbc-mp-ml)#ip-address {ipv4|ipv6} <ip_address> port<port_number> transport {tcp|udp|stcp} [track id <1-65535>]

4. Enter the media-resource configuration mode as follows.SBC(config-sbc-mp-ml)#media-resource <1-65535>

5. Configure the media resource in the user side as follows.SBC(config-sbc-mp-ml-mr)#uni-address {ipv4|ipv6} <ip-address>uni-port <start-port> <end-port>

6. Configure the media resource in the network side as follows.SBC(config-sbc-mp-ml-mr)#nni-address {ipv4|ipv6} <ip-address>nni-port <start-port> <end-port>

7. Repeat step 2 to step 6 if there are multiple media-locations.

END OF STEPS

Result The operator successfully configures the media resource items inthe MP layer.

Configuring User-Location

Context This topic describes the procedure to configure the terminal user(user-location).


2. Enter the user-location configuration mode as follows.SBC(config-sbc-sp)#user-location <1-65535>

3. Configure the terminal’s source network as follows.



Note:

Each user-location represents a terminal’s source network, andthe terminal’s source address may be recorded in the net-work segment format, IP-PBX format or NAT address pool for-mat. Therefore, the configuration of source network informa-tion must support the network segment mode and address poolmode.

SBC(config-sbc-sp-ul)remote-address {ipv4|ipv6}{<ip-address>| ip-pool<start-address> <end-address>} prefix-length <prefix-len>

4. Configure the communication port as follows (optional).

Note:

The user-location refers to the terminal’s source net-work, IP-PBX or Gateway. Because the registration of theIP-PBX/Gateway users is unnecessary, SBC must identify theterminal’s source network, and specify the communicationport.

SBC(config-sbc-sp-ul)#gateway port <1-65535>

5. Enter the media-group configuration mode as follows.SBC(config-sbc-sp-ul)#media-group

6. Configure the media information of the media group’ as follows.SBC(config-sbc-sp-ul-mg) media <1-65535> media-location {local|<1-65535>}media-resource <1-65535> [{{[(weight <0-100>)][(track <1-65535>)]}}]

7. Repeat step 2 to step 6 if multiple user-locations are to bedefined.

END OF STEPS

Result The operator successfully configures the user-location.

Configuring Management Addressfor SPE’s Ia Interface

Prerequisites The operator must make sure the configuration object is MPE.

Context This topic describes the procedure to configure the managementaddresses for SPE’s one or more Ia interfaces.





Note:

For separated SBC, the operator must not select local. Theseparated SBC supports up to 1024 media-locations.

SBC(config-sbc-mp)#media-location { local | <1-65535>}

3. Enter the ia-interface configuration mode as follows.SBC(config-sbc-mp-ml)#ia-interface <1-65535>

4. In MPE, configure the management address for SPE’s Ia inter-face as follows.SBC(config-sbc-mp-ml-ia)#ip-address {ipv4|ipv6} <ip_address> port<port_number>local|remote{domain} <Word> transport {tcp|udp|stcp}[track id <1-65535>]

END OF STEPS

Result The operator successfully configures the management address forSPE’s Ia interface.

An Example for Separated SBCConfiguration

Overview As shown in Figure 17, a SPE is located in the core side of theMetropolitan-Area Network. Two MPEs are located near the BRAS.Each BRAS has four address pools for terminals to access the net-work. Considering the unified configuration of terminals, the car-rier requires all related terminals to use same addresses and portsfor signaling registration. That is, multiple signal-groups must notbe used in SPE.



FIGURE 17 A TYPICAL NETWORKING FOR SEPERATED SBC

� SPE’s configuration is as follows.#1 configure the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060

#2 configure the media resource items in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location 1SBC(config-sbc-mp-ml)#ia-interface 1SBC(config-sbc-mp-ml-ia)#ip-address ipv4 211.10.1.2 port 2222 remotedomain < word> transport udp//the controlled address for MPE-1's Ia interfaceSBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 211.10.2.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 211.10.1.2 nni-port 20000 39999SBC(config-sbc-mp)#media-location 2SBC(config-sbc-mp-ml)#ia- interface 1SBC(config-sbc-mp-ml-ia)#ip-address ipv4 210.10.2.2 port 3334 remotedomain <word> transport udp//the controlled address for MPE-2's Ia interfaceSBC(config-sbc-mp-ml)#media-resource 2SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.3.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 210.10.2.2 nni-port 20000 39999

#3 configure the user-location



SBC(config-sbc)#signal-portalSBC(config-sbc-sp-ul)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 211.40.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 158.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 178.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC(config-sbc-sp-ul)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 221.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 213.20.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 58.2.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 59.2.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)media 1 media-location 2 media-resource 1

� MPE-1’s configuration is as follows.SBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location 1SBC(config-sbc-mp-ml)#ia-interface 1SBC(config-sbc-mp-ml-ia)ip-address ipv4 210.10.1.1 port 2223 remotedomain <word> transport udp//the management address for SPE’s Ia interfaceSBC(config-sbc-mp-ml-ia)ip-address ipv4 211.10.1.2 port 2222 localdomain <word> transport udp//the management address for SPE’s Ia interface址

� MPE-2’s configuration is as follows.SBC(config-sbc)media-portalSBC(config-sbc-mp)media-location 1SBC(config-sbc-mp-ml)ia-control id 1SBC(config-sbc-mp-ml-ia)ip-address ipv4 210.10.1.1 port 2224 remotedomain <word> transport udp// the management address for SPE’s Ia interfaceSBC(config-sbc-mp-ml-ia)ip-address ipv4 210.10.2.2 port 3334 localdomain <word> transport udp// the management address for SPE’s Ia interface

Inter-Domain ConfigurationConfiguring Inter-DomainInterworking

Prerequisites

Context As a signaling proxy deployed between two different NGNs or twodifferent MANs, B200 is used to process SIP/SIP-T and H.323 sig-naling between two SS. Then, the interworking between two NGNscharacterized by different IP address domains is achieved throughthe public network. In addition, the two NGNs fail to see eachother’s network topology. B200 actually acts as the GW used tointerconnect services in different NGNs.

Figure 18 shows the networking when B200 is deployed betweentwo carriers.



FIGURE 18 CROSS-DOMAIN INTERWORKING NETWORKING

This topic describes the procedure to configure the inter-domaininterworking.

Steps 1. Enter the signal-group mode as follows.SBC(config-sbc-sp)#signal-group <1-65535>

2. Modify B200’s running mode to I-SBC mode as follows.SBC(config-sbc-sp-sg)#run-mode {(sip {a-sbc|i-sbc})|(h323{gk-register|no-register|neighbor-zone})|(mgcp{mgcp-mgcp|ncs-mgcp|any-mgcp|ncs-ncs})}

3. Define the uni-side and nni-side with respect to B200 as fol-lows.SBC(config-sbc-sp-sg)#signal uni-address {ipv4|ipv6} <ip-address>nni-address {ipv4|ipv6} <ip-address>

4. Configure the protocol port for signaling as follows.SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}

5. Enter the next-hop configuration mode for signaling and con-figure the information regarding the uni-side’s next hop.SBC(config-sbc-sp-sg)#signal nexthop id <1-65535>

6. Configure the next-hop’s protocol address as follows.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[weight <0-100>|track id <1-65535> ]

7. Configure the next-hop’s protocol port as follows.SBC(config-sbc-sp-sg-snh)#port {sip|mgcp|h248} <1-65535>

8. Define the next-hop’s location relative to SBC as follows (selectuni-side).



SBC(config-sbc-sp-sg-snh)#position {uni-side|nni-side}

9. Repeat step 5 to step 7 to configure information regarding thenni-side’s next hop.

END OF STEPS

Result The operator successfully configures the inter-domain interwork-ing.

Example As shown in Figure 19, B200 is applied to the inter-domain inter-working mode, and SS in two networks may be configured in theactive/standby mode.

FIGURE 19 INTER-DOMAIN INTERWORKING + ACTIVE/STANDBY SS MODE

#1 Configure the SPE layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp-sg)#run-mode sip i-sbc//Configure the signal-group to solve thereachability from domain-1 to domain-2SBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 IP1 nni-address ipv4 IP2SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060

SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 IP3SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp-sg-snh)#position uni-side

SBC(config-sbc-sp-sg)#signal-nexthop 2SBC(config-sbc-sp-sg-snh)#ip-address ipv4 IP4 track id 1SBC(config-sbc-sp-sg-snh)#port sip 5060



SBC(config-sbc-sp-sg-snh)#position uni-side

SBC(config-sbc-sp-sg)#signal-nexthop 3SBC(config-sbc-sp-sg-snh)#ip-address ipv4 IP5SBC(config-sbc-sp-sg-snh)#port sip 5060

SBC(config-sbc-sp-sg)#signal-nexthop 4SBC(config-sbc-sp-sg-snh)#ip-address ipv4 IP6 track id 3SBC(config-sbc-sp-sg-snh)#port sip 5060

Typical ConfigurationConfiguring SPE Signal-Group’sAddress Multiplexing

Context SBC supports multiple signal-groups. Therefore, it is practicable touse the same user-side address or network-side address or samecombination made up by the user-side address and network-sideaddress for multiple signal-groups. A signal-group is characterizedby the IP address and port number.

� If the user uses the port {sip|mgcp|h248} uni-port nni-portcommand first, and then uses the signal uni-address{ipv4|ipv6} <ip-address> nni-address {ipv4|ipv6} <ip-ad-dress> command, it is necessary to check if the addressconfliction exists.

� If the user uses the signal uni-address {ipv4|ipv6} <ip-ad-dress> nni-address {ipv4 | ipv6} <ip-address> command first,and then uses the port {sip|mgcp|h248} uni-port <1-65535>nni-port <1-65535> command, it is necessary to check if theport confliction exists.

This topic describes the procedure to configure the address multi-plexing for SPE’s signal-group.

Steps 1. Enter the signal-portal configuration mode as follows.SBC(config-sbc)#signal-portal



4. Configure the protocol ports for local signaling as follows.SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}

5. Enter the next-hop configuration mode for signaling as follows.



SBC(config-sbc-sp-sg)#signal nexthop id <1-65535>

6. Configure the protocol address for the next hop as follows.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[weight <0-100>|track id <1-65535> ]

7. Configure the protocol port number for the next hop as follows.SBC(config-sbc-sp-sg-snh)#port {sip|mgcp|h248} <1-65535>

END OF STEPS

Result The operator successfully configures the address multiplexing forSPE signal-group.

Example As shown in Figure 20, the IP address of SS is 222.1.1.108. SBChas two signal-groups which occupy two user-side addresses, i.e.,210.10.1.1 and 210.20.1.1. But there is only one usable addressin the network side. Therefore, it is necessary to use differentprotocol port numbers to identify the same network-side addressused for different signal-groups.

FIGURE 20 AN EXAMPLE TO CONFIGURE PROTOCOL PORT RESOURCES FORLOCAL SIGNALING



Configuration of SPE’s signal-group 1 is as follows.SBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060

………………

Configuration of SPE’s signal-group 2 is as follows.SBC(config-sbc-sp)#signal-group 2SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.20.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-port 5060 nni-port 5064// signal-group 2’s nni-port is differentfrom signal-group 1’s nni-port

…………

Configuring SPE Signal-Group’sSingle-Address Multiplexing at TwoSides

Context In some networking environment, the carrier provides limited IPaddresses. Sometimes, there is only one IP address. That is,the signal-group only owns one address acting as the user-sideaddress and the network-side address. For a same address, cor-responding port numbers must be different.

This topic describes the procedure to configure SPE signal-group’ssingle-address multiplexing at two sides.



3. Configure the address couple for local signaling as follows.

Note:

If the carrier only provides one address for the user side andthe network side, the uni-address and nni-address here are thesame.

SBC(config-sbc-sp-sg)#signal uni-address {ipv4|ipv6} <ip-address>nni-address {ipv4|ipv6} <ip-address>

4. Configure the protocol port for local signaling as follows.

Note:

If the uni-address and nni-address are the same, the corre-sponding port numbers must be different.



SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}


6. Configure the protocol address for the next hop as follows.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[weight <0-100> | track id <1-65535> ]


END OF STEPS

Result The operator successfully configures SPE signal-group’s single-ad-dress multiplexing at two sides.

Example As shown in Figure 21, SPE has only one IP address, 210.10.1.1.That is, such address acts as the signal-group’s network-side ad-dress and the user-side address.

FIGURE 21 AN EXAMPLE TO CONFIGURE PROTOCOL PORT RESOURCES FORLOCAL SIGNALING



During configuration, if the uni-address and nni-address are same,corresponding port numbers must be different. The configurationis as follows.SBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 210.10.1.1 // the uni-address andnni-address are sameSBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5061 // use different port numbers

Configuring Multiple PBX for OneSingle-Group

Overview To interconnect multiple IP-PBX, SBC must allocate each PBC to anindependent signal-group. Due to the introduction of the user-lo-cation concept, the PBX attributes are added in the user-location.Then, SBC knows the user-location’s terminals, connected to PBX,are free of registration. Therefore, multiple PBX in the same sig-nal-group is practicable. However, such plan only solves outgo-ing-calls from PBX. Calls from SS side still fail to find correspond-ing PBX in SBC. Therefore, in SBC, it is necessary to set up a tableto associate PBX with number segments.

Example As shown in Figure 22, there are two independent PBX connectedto the network. One PBX has the 5-digit number segment begin-ning with 87, and the other PBX has the 5-digit number beginningwith 88. SBC only wishes to use a signal-group.

FIGURE 22 A NETWORKING EXAMPLE

The configuration is as follows.



#1 Configure the SPE layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC (config-sbc-sp)#policy-group 1SBC (config-sbc-sp-pg)#call-policySBC (config-sbc-sp-pg-callp)#call-table call-in//start to search the incoming-call’s phone number in the call-tableSBC (config-sbc-sp-pg-callp-calltbl)#match 87XXXSBC (config-sbc-sp-pg-callp-calltbl-match)#user-location 1//the number is associated with the user-locationSBC (config-sbc-sp-pg-callp-calltbl)#match 88XXXSBC (config-sbc-sp-pg-callp-calltbl-match)#user-location 2//the number is associated with the user-location

#2 configure the user-locationSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.1 prefix-length 32SBC(config-sbc-sp-ul)#gateway port 5060//the gateway is free of registration

SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 221.10.1.1 prefix-length 32SBC(config-sbc-sp-ul)#gateway port 5060//the gateway is free of registratio

SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)media 1 media-location 2 media-resource 1

#3 configure the use-groupSBC (config-sbc-sp)#user-group 1SBC (config-sbc-sp-ug)#select *@* from user-location all

#4 configure the media resource items in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location 1SBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 211.10.2.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 211.10.1.2 nni-port 20000 39999SBC(config-sbc-mp)#media-location 2SBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.3.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 210.10.2.2 nni-port 20000 39999

Configuring SS Load BalancingBased on Each User

Context Because A-SBC’s signal-group supports multiple SS as the nexthop for signaling at the same time, the load balancing based oneach user is practicable.

This topic describes the procedure to configure SS load balancingbased on each user.


2. Enter the signal-group configuration mode as follows.



SBC(config-sbc-sp)#signal-group <1-65535>

Note:

At present, system supports up to 1024 signal-groups.


4. Configure the protocol port numbers for local signaling as fol-lows.SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}

5. Enter the next-hop configuration mode for signaling and con-figure the nth next hop as follows.SBC(config-sbc-sp-sg)#signal nexthop id <1-65535>

6. Configure the protocol address for the next-hop and the weightthe next hop occupies in terms of load balancing.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[ weight <0-100> | track id <1-65535> ]


END OF STEPS

Result The operator successfully configures SS load balancing based oneach user.

Example As shown in Figure 23, the core network has two sets of SS. Ac-cording to the arrangement, the SS (222.1.1.108) shares SBC’s80% users, and the other SS (58.1.1.108) shares SBC’s rest users.



FIGURE 23 AN EXAMPLE FOR LOAD BALANCING

� Configure SPE’s signal-group 1 as follows.SBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060

� Configure the 1st next hop which shares 80% work load asfollows.SBC(config-sbc-sp-sg)#signal nexthop id 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108 weight 20SBC(config-sbc-sp-sg-snh)#port sip 5060

� Configure the 2nd next hop which shares 20% work load asfollows.SBC(config-sbc-sp-sg)#signal nexthop id 2SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108 weight 20SBC(config-sbc-sp-sg-snh)#port sip 5060



Configuring MPE AddressMultiplexing (For Media)

Context In the architecture characterized by separated signaling and me-dia, MPE is used to provide media resources for SPE. Media re-sources mentioned here include the user-side media address, net-work-side media address, user-side media port pool, network-sidemedia port pool. A piece of MPE media resource must include theabove four elements. Different media resource items have differ-ent sets made up by these four elements. Two pieces of mediaresources (with different media port pools) are still different al-though having same user-side media addresses and network-sidemedia addresses.

This topic describes the procedure to configure the address multi-plexing for MPE’s media.



Note:

SPE manages multiple MPEs. Each MPE is characterized by asolo identifier, location_id. SPE’s affiliated SBC also provides aMPE. Therefore, local is used to identify MPE’s location-id. Atpresent, system supports up to 1024 media-locations.


3. Configure the media-resource as follows.

Note:

The media-resource represents a piece of media resource inSBC used to process media. A piece of media resource containsthe user-side media address, network-side media address, andthe port capacity determined the end port and start port.

SBC(config-sbc-mp-ml)#media-resource <1-65535>

4. Configure the user-side media resource as follows.SBC(config-sbc-mp-ml-mr)#uni-address {ipv4|ipv6} <ip-address>uni-port <start-port> <end-port>

5. Configure the network-side resource as follows.

Note:

The port numbers for media transfer must be different whenthere is only one network-side address.



SBC(config-sbc-mp-ml-mr)#nni-address {ipv4|ipv6} <ip-address>nni-port <start-port> <end-port>

END OF STEPS

Result The operator successfully configures MPE address multiplexing (formedia).

Example As shown in Figure 24, the user-side addresses regarding two ter-minals’ source networks are different in SBC. However, there isonly one network-side address i, 204.10.1.1.

FIGURE 24 AN EXAMPLE FOR MPE ADDRESS MULTIPLEXING (FOR MEDIA)

SBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location localSBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 20000 39999SBC(config-sbc-mp-ml)#media-resource 2SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.20.1.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 204.10.1.1 nni-port 40000 59999//Because two terminal’s source networks use the same media address(204.10.1.1) in the network side, the media-resource-1 uses the portpool (20000-39999) regarding the media address 204.10.1.1, and themedia-resource-2 uses the port pool (40000-59999) regarding the mediaaddress 204.10.1.1.



Configuring MPE Single-Address(For Media) Multiplexing At TwoSides

Context In some networking environment, the carrier provides limited IPaddresses. Sometimes, there is only one IP address. That is,the user-side address and the network-side address for the mediaresource item shares the same address. If so, corresponding portpools must be different.

This topic describes the procedure to configure MPE single-addressmultiplexing at two sides.



Note:

SPE manages multiple MPEs. Each MPE is characterized by asolo identifier, location_id. SPE’s affiliated SBC also provides aMPE. Then, local is exclusively used to identify the location-idof this MPE. At present, system supports up to 1024 media-locations.


3. Configure the media-resource as follows.

Note:

The media-resource represents a piece of media resource inSBC used to process media. A piece of media resource containsthe user-side media address, network-side media address, andthe port capacity determined by the end port and start port.

SBC(config-sbc-mp-ml-mr)#media-location {local | <1-65535>}media-resource <1-65535> uni-address {ipv4|ipv6} <ip-address>uni-port <start-port> <end-port>

4. Configure the user-side media resource as follows.SBC(config-sbc-mp-ml-mr)#uni-address {ipv4|ipv6} <ip-address>uni-port <start-port> <end-port>

5. Configure the network-side resource as follows.SBC(config-sbc-mp-ml-mr)#nni-address {ipv4 | ipv6} <ip-address>nni-port <start-port> <end-port>



Note:

If a MPE only has one media IP address (that is, the uni-addressand nni-address are same), the uni-port and nni-port must bedifferent in step 4 and step 5.

END OF STEPS

Result The operator successfully configures MPE single-address multi-plexing at two sides.

Example As shown in Figure 25, MPE-1 has only one media IP address,211.10.2.1.

FIGURE 25 AN EXAMPLE FOR MPE SINGLE-ADDRESS (FOR MEDIA)MULTIPLEXING

SBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location 1SBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 211.10.2.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 211.10.2.1 nni-port 40000 59999SBC(config-sbc-mp)#media-location 2SBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 210.10.3.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 210.10.2.2 nni-port 20000 39999



Configuring SBC Media Release

Overview � Example 1:

i. . As shown in Figure 26, BRAS’s two-layered access net-work is divided into four network segments. All terminals inthe network have the media reachability. Under such con-dition, the use of the media-release function is practicable.

FIGURE 26 MEDIA STRAIT INTERCONNECTION FOR PUBLICNETWORK USERS IN A USER-LOCATION

#1 Configure the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1nni-address ipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060nni-side nni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060

#2 configure the user-locationSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 211.40.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 158.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 178.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-release enable



SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1

#3 configure the media resource item in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location 1SBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 211.10.2.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 211.10.1.2 nni-port 20000 39999

ii. If the media-release function is enabled only for users inthe network segment (211.30.1.0/24), the configuration isas follows.#2 configure the user-locationSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-release enableSBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 211.40.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 158.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 178.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-release disableSBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1

Other configuration remains unchanged.

� As shown in Figure 27, the private network users access othernetworks through NAT. The NAT pools rang from 211.30.1.1 to211.30.1.100/24. Because all terminals in the private networkall have the media reachability, related media-release functionsare enabled.



FIGURE 27 MEDIA STRAIT INTERCONNECTION FOR PRIVATE NETWORKUSERS IN A USER-LOCATION

#1 configure the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060

#2 configure the user-locationSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 ip-pool 211.30.1.1211.30.1.100 prefix-length 24SBC(config-sbc-sp-ul)#media-release enableSBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1

#3 configure the media resource item in the MP layerSBC(config-sbc)#media-portalSBC(config-sbc-mp)#media-location 1SBC(config-sbc-mp-ml)#media-resource 1SBC(config-sbc-mp-ml-mr)#uni-address ipv4 211.10.2.1 uni-port 20000 39999SBC(config-sbc-mp-ml-mr)#nni-address ipv4 211.10.1.2 nni-port 20000 39999





C h a p t e r 5

Protocol Configuration

Table of ContentsGeneralization...................................................................59H.248 Protocol Configuration...............................................59MGCP Protocol Configuration ...............................................61SIP Protocol Configuration ..................................................63H.323 Protocol Configuration...............................................65

GeneralizationOverview The global protocol attributes define the global attribute parame-

ters (such as the heart-beat detection parameter, heart-beat de-tection cycle parameter) for SIP, H.323, H.248 as well as MGCPprotocols. During the on-site implementation, it is necessary tocarefully check the default configuration regarding these globalprotocol parameters, and modify them according to actual needs.

H.248 Protocol ConfigurationViewing H.248 Attributes

Context This topic describes the procedure to view H.248 attributes, in-cluding the call hold time, link detection mode, roaming mode,link detection parameter as well as retransmission time and re-transmission numbers for failed link detection.


2. Enter the signal-attribute configuration mode as follows.SBC(config-sbc-sp)#signal-attribute

3. Enter the H.248 configuration mode as follows.SBC(config-sbc-sp-sa)#h248

4. View H.248 attributes as follows.



SBC(config-sbc-sp-sa-h248)#show h248 cfg

END OF STEPS

Result The H.248 attributes are successfully displayed.

Modifying H.248 Attributes

Prerequisites The operator already views the H.248 attributes.

Context This topic describes the procedure to modify H.248 attributes.




4. Configure H.248’s call holding time as follows.SBC(config-sbc-sp-sa-h248)#call expire-time <0-86400>

5. Configure H.248 link detection method as follows.

SBC(config-sbc-sp-sa-h248)#link-check absorb {disable|enable}

6. Configure the storage time for H.248 transactions as follows.SBC(config-sbc-sp-sa-h248)#transaction expire-time <10-30>

7. Configure the maximum times for H.248 link detection as fol-lows.SBC(config-sbc-sp-sa-h248)#link-check terminal times <1-100>

8. Enable/Disable h248 iad link detection as follows.SBC(config-sbc-sp-sa-h248)#link-check terminal {disable|enable}

9. Configure the time for h248 iad link detection as follows.SBC(config-sbc-sp-sa-h248)#link-check terminal interval-time <30-3600>

10. Enable/Disable h248 naten as follows.SBC(config-sbc-sp-sa-h248)#early-media nat {disable|enable}

11.Configure the h248 roaming type as follows.

SBC(config-sbc-sp-sa-h248)#terminal-address-carry {disable|x-algmid|x-usradd|all}

12.Configure the retransmission time for failed h248 link detectionas follows.SBC(config-sbc-sp-sa-h248)#link-check nexthop retry-interval-time <1-8>

13.Configure the retransmission numbers for failed h248 link de-tection as follows.SBC(config-sbc-sp-sa-h248)#link-check nexthop retry-times <3-10>>

14.Configure the method for h248 ss link detection as follows.


Chapter 5 Protocol Configuration

SBC(config-sbc-sp-sa-h248)#link-check nexthop {disable|servicechange|notify|sip-option}

15.Configure the time for h248 ss link detection as follows.SBC(config-sbc-sp-sa-h248)#link-check nexthop interval-time <20-300>

END OF STEPS

Result The operator successfully modifies H.248 attributes.

MGCP ProtocolConfigurationViewing MGCP Attributes

Context This topic describes the procedure to view MGCP attributes, in-cluding the MGCP call holding time, the time interval for MGCPterminal link detection as well as the MGCP terminal link detectionparameter.



3. Enter the MGCP configuration mode as follows.SBC(config-sbc-sp-sa)#mgcp

4. View MGCP attributes as follows.SBC(config-sbc-sp-sa-h248)#show mgcp cfg

END OF STEPS

Result The MGCP attributes are successfully displayed.

Modifying MGCP Attributes

Context This topic describes the procedure to modify MGCP attributes ac-cording to requirements.



3. Enter the MGCP configuration mode as follows.SBC(config-sbc-sp-sa)#mgcp



4. Configure the time for mgcp call detection as follows.SBC(config-sbc-sp-sa-mgcp)#call expire interval-time <60-7200>

5. Enable/Disable the mgcp call detection parameter as follows.SBC(config-sbc-sp-sa-mgcp)#call expire {disable|enable}

6. Configure the time interval for terminal link detection as fol-lows.SBC(config-sbc-sp-sa-mgcp)#link-check terminal interval-time <600-3000>

7. Enable/Disable the terminal link detection parameter.SBC(config-sbc-sp-sa-mgcp)#link-check terminal {disable|enable}

8. Configure the number for terminal link detection.SBC(config-sbc-sp-sa-mgcp)#link-check terminal times <1-5>

9. Configure the time interval for the core network link detection.SBC(config-sbc-sp-sa- mgcp)#link-check nexthop interval-time <300-1800>

10.Configure the retransmission time interval for failed core net-work link detection.SBC(config-sbc-sp-sa-mgcp)#link-check nexthop retry-interval-time <1-60>

11.Configure the retransmission number for failed core networklink detection.SBC(config-sbc-sp-sa-mgcp)#link-check nexthop retry-times <1-5>

12. Enable the core network link detection parameter.SBC(config-sbc-sp-sa-mgcp)#link-check nexthop {disable|enable}

13. Enable the NAT parameter.SBC(config-sbc-sp-sa-mgcp)#early-media nat {disable|enable}

14.Configure the roaming type.SBC(config-sbc-sp-sa-mgcp)#terminal-address-carry {disable|x-algmid|x-usradd|all}

15.Configure the time interval for the release of MGCP transactionrequests.SBC(config-sbc-sp-sa-mgcp)#transaction request expire-time <1-60>

16.Configure the time interval for the release of MGCP transactionanswers.SBC(config-sbc-sp-sa-mgcp)#transaction response expire-time <1-60>

END OF STEPS

Result The operator successfully modifies MGCP attributes.



SIP Protocol ConfigurationViewing SIP Attributes

Context This topic describes the procedure to view SIP attributes, includ-ing the registration roaming method and if SIP users perform forkregistration.



3. Enter the SIP configuration mode as follows.SBC(config-sbc-sp-sa)#sip

4. View SIP attributes as follows.SBC(config-sbc-sp-sa-SIP)#show sip cfg

END OF STEPS

Result The SIP attributes are successfully displayed.

Modifying SIP Attributes

Context This topic describes the procedure to modify SIP attributes accord-ing to requirements.

Steps 1. Enter the Signal Portal configuration mode as follows.SBC(config)#sbcSBC(config-sbc)#signal-portal


3. Enter the SIP configuration mode as follows.SBC(config-sbc-sp-sa)#sip

4. Enable/Disable the addition of the P-Preferred-Identity fieldin the SIP message.

Note:

In the non-cross domain mode, the P-Preferred-Identity field isadded to the SIP message only when the received non-registra-tion request of the user side is forwarded to the core network.The P-Preferred-Identity field is not added to other messages.

SBC(config-sbc-sp-sa-sip)#add-ppi {disable|enable}



5. Enable/Disable the SIP user to perform the fork registration ac-cording to requirements. That is, configure B200 to allow/for-bid users with same names to send registration requests fromdifferent IP addresses or ports.SBC(config-sbc-sp-sa-sip)#fork {disable|enable}

6. Configure the detection method for the core network.SBC(config-sbc-sp-sa-sip)#link-check next-hop {{[uni-side{disable|enable}] [nni-side {disable|fast-switch|smooth-switch}]}}

7. Configure the roaming method for registration.SBC(config-sbc-sp-sa-sip)#terminal-address-carry {disable|via|contact|all}

8. Configure the media direction change mode of SDP in the SIPmessage.SBC(config-sbc-sp-sa-sip)#sdp-direction {disable|enable} side{uni-side|nni-side|both-sides} convert {sndrcv|sndonly|rcvonly|Iinactive } into {sndrcv|sndonly|rcvonly|inactive}

9. Enable/Disable the sending of analog logout message to thecore network to log out the terminal when the terminal detec-tion abnormally lasts too long.SBC(config-sbc-sp-sa-sip)#proxy-unregister {enable|disable }

10. Enable/Disable the restriction on the IP source address of SSto check if the core network message is from active/standbySS information in SBC.SBC(config-sbc-sp-sa-sip)#nexthop-ip-match {enable|disable }

11. Enable/Disable the overtime detection on the terminal accord-ing to the registered expiration time of the terminal.SBC(config-sbc-sp-sa-sip)#link-check terminal expire {enable|disable}

12. Enable/Disable the link detection on the terminal.SBC(config-sbc-sp-sa-sip)#link-check terminal option {disable|enable}

13.Configure the time interval to update registration for the ter-minal.SBC(config-sbc-sp-sa-sip)#link-check terminal expire interval-time <25-1000000>

14.Configure the time in the timer to release the call when nosignaling is detected.SBC(config-sbc-sp-sa-sip)#call expire-time <60-172800>

15.Configure the time interval for the diction of the core network.SBC(config-sbc-sp-sa-sip)#link-check nexthop {uni-side|nni-side}interval-time <20-300>

16.Configure the time interval to perform abnormal detection forthe core network.SBC(config-sbc-sp-sa-sip)#link-check nexthop {uni-side|nni-side}retry-interval-time <1-8>

17.Configure the time interval for the terminal link detection.SBC(config-sbc-sp-sa-sip)#link-check terminal option interval-time <30-3600>

18.Configure the number regarding the abnormal detection for thecore network.SBC(config-sbc-sp-sa-sip)#link-check nexthop {uni-side|nni-side}retry-times <3-10>



19.Configure the number regarding the abnormal detection for theterminal link.SBC(config-sbc-sp-sa-sip)#link-check terminal option retry-times <1-100>

END OF STEPS

Result The operator successfully modifies SIP attributes.

H.323 Protocol ConfigurationViewing H.323 Attributes

Context This topic describes the procedure to view H.323 attributes, includ-ing the overtime duration for H.323-based call detection, overtimeduration for H323 registration detection and if the H.323-basedGW address authentication parameter is valid.




4. View H.323 attributes as follows.SBC(config-sbc-sp-sa-h323)#show h323 cfg

END OF STEPS

Result The H.323 attributes are successfully displayed.

Modifying H.323 Attributes

Context This topic describes the procedure to modify H.323 attributes ac-cording to requirements.




4. Configure the overtime period for H.323-based call detection.

SBC(config-sbc-sp-sa-h323)#call setup expire-time <5-3600>



5. Enable/Disable the H.323-based GW authentication parameter.

Note:

Such parameter is used to control the authentication on theH.323-based GW IP address which originates the call.

SBC(config-sbc-sp-sa-h323)#nexthop-ip-match {enable|disable}

6. Configure the length for a half tpkt packet.SBC(config-sbc-sp-sa-h323)#fragment packet-length <0-512>

7. Configure the detection method for GK switchover in disasterrecovery.

Note:

In the network side of the H.323-based signal-group, it is al-lowable to configure the active/standby GK for disaster recov-ery.

SBC(config-sbc-sp-sa-h323)#link-check method {disable|h323-lrq|sip-option|all}

8. Configure the number of no answer when RAS signaling issent to GK. If the number reaches the configuration value, GKswitchover starts.

Note:

Such command is used along with the link-check-methodcommand. When the link-check-method command is set toh323-lrq or all, the value configured by the link-check nexthop retry-times command is valid.

SBC(config-sbc-sp-sa-h323)#link-check nexthop retry-times <10-30>

9. Configure the method to process IRR signaling.SBC(config-sbc-sp-sa-h323)#irr-process-method {disable|decode|un-decode}

10.Configure the NAT keep-alive duration concerning RTP mediachannel when the H323–based terminal starts NAT traversing.SBC(config-sbc-sp-sa-h323)#h460 rtp-channel keepalive-time <10-3600>

11.Configure the overtime period for H.323-based registration de-tection.

Note:

SBC periodically detects H323-based registration data area. Ifthe terminal fails to update registration during the specifiedperiod, the registration data area is released.



SBC(config-sbc-sp-sa-h323)#register expire-time <5-3600>

12. Enable/Disable the assembling of the tpkt packet.

Note:

After a tpkt packet is assembled based on the received TCPmessages, a piece of complete H255 signaling or H245 signal-ing is created.

SBC(config-sbc-sp-sa-h323)#fragment reassemble {enable|disable}

13.Configure the detection period for assembling a tpkt packet. Ifa half packet containing signaling is received, it is necessary towait for the subsequent half of the packet containing signalingcarried in the TCP message. Then, a complete H255 signalingor H245 signaling is assembled. The assembling of the tkptpacket fails if the subsequent half of the packet is not receivedduring specified time. At last, the subsequent half of the packetis discarded.

Note:

Such command is used along with the fragment reassemblecommand. The value configured by the following command iseffective if fragment reassemble is set to enable.

SBC(config-sbc-sp-sa-h323)#fragment reassemble expire-time <1-5>

14.Configure the period in the TCP keep-alive timer used in theTCP transmission layer.SBC(config-sbc-sp-sa-h323)#tcp expire-time <90-3600>

15.Configure the IP address and UDP port used in sending/receiv-ing H323 log packets by SBC.

Note:

SBC allows the use of the H323Traclient tool to acquire theH323 log in the host.

SBC(config-sbc-sp-sa-h323)#trace-address A.B.C.D port <1-65535>

END OF STEPS

Result The operator successfully modifies H.323 attributes.





C h a p t e r 6

PAT Configuration

Table of ContentsIntroduction to PAT............................................................69PAT Working Principle.........................................................69Configuring PAT Function ....................................................70

Introduction to PATOverview The PAT function, as a special application for B200, is unneces-

sarily to be configured. The configuration of PAT group dependson the application requirement on the spot. In some applicationscenes, for example, it is necessary to configure the PAT group forthe client to access the VIP customer server through B200.

Protocol Address Transfer (PAT), by operating the IP address aswell as TCP/UDP port number in the data packet, fulfills the trans-lation and mapping of the application protocol in the address/portof the network/transmission layer. As a device connecting differ-ent network segments, B200 uses the PAT function to enable a C/Sapplication protocol to function across networks.

The server entity is located in B200’s external port. Through thePAT function, B200 maps the server’s IP address/port number toB200’s inner port. The client in the inner network accesses appli-cation services of the external network through B200’s inner port.

B200 is allowed to configure multiple PAT groups. In B200, differ-ent inner ports point to different application services.

PAT Working PrincipleOverview Figure 28 shows the working principle for B200’s PAT function.



FIGURE 28 PAT APPLICATION

As shown in Figure 28, SvrIP+SvrPort acts as a server entity in theouter network. After the configuration of the PAT function, B200maps SvrIP to inner IP, and maps SvrPort to inner Port. For theclient in the inner network, the visible innerIP+innerPort acts as aserver entity in the inner network.

For a specified protocol model, SvrPort is a fixed value. Therefore,innerPort also requires a fixed value.

When the protocol data packet of the client reaches B200’s in-ner port, B200 translates the IP address and port number in thedata packet and modifies the server’s IP address/port number tothe real SvrIP/SvrPort. Then, on the other hand, B200 uses out-erIP/outerPort to replace the client’s address/port number in thedata packet. At last, B200 sends the data packet to the serverentity in the outer network.

In the C/S application model, the client’s port number is not fixed.Therefore, a range, instead of a fixed value, is allocated to theouterPort. Then, multiple clients are allowed to access the serverthrough the outerPort at the same time.

Configuring PAT FunctionPrerequisites The operator already enters the sbc mode.

Context When the client sends a signaling packet to B200 for the first time,B200 sets up the mapping relationship between the client's portnumber and the outer port's port number after B200's outer portaddress pool releases a free port. Through the mapping relation-ship, the forwarding relationship between APP and Client is hold.


Chapter 6 PAT Configuration

If no packet passes through the mapping during the specified flushtime, the port's mapping relationship is released.

This topic describes the procedure to configure the PAT function,which involves the configuration of following items.

� The server's address

� Addresses of B200's inner port and outer port

� The server's port number

� B200's inner port number

� B200's outer start port number

� Number of outer ports

� Flush time

� TFTP proxy enable flag

� PAT enable flag

Steps 1. Enter the system modeSBC(config-sbc)#system

2. View the pat group.SBC(config-sbc-system)#show pat group-configure

� If there is no pat group, the following prompt appears.%Code 26017: The pat configuration does not exist!

� If the pat group is already created, following informationappears.PAT GROUP:--------------------------------------group_id :4server_ip :200.200.0.100outer_ip :200.200.204.5inner_ip :100.100.204.5inner_port :10000server_port :8088out_port_start :15200out_port_num :4800flush_time :600tftp_enable :1enabled :1

3. Add the pat group.SBC(config-sbc-system)#pat group-configure <1-4> A.B.C.D A.B.C.DA.B.C.D <1-65535> <1-10000> <10000-15200> <1-4800> <180-600> <0-1> <0-1>

Parameter Description

group id ID

server ip The server’s IP address

inner ip The inner port’s IP address

outer ip The outer port’s IP address

server port Service port

inner port Inner port




out start port Outer start port

out port number Number of ports

time of living Aging time

tftp proxy enable TFTP proxy enable flag

enabled PAT enable flag

END OF STEPS

Result The operator successfully configures the PAT function.

Example An example is illustrated as follows.

The VIP customer system is a common application in SS network,also a typical application regarding the PAT function. It is neces-sary to place the VIP customer server and SS in a same network,in general, the carrier’s private network. The VIP customer clientis placed in the public network. B200’s PAT function is used whenthe client wants to access the server.

During the following application, the carrier’s private network isthe outer network, and the public network where the client is lo-cated is the private network. According to B200’s PAT principle,related configuration is performed as long as the service port num-ber (9900) for the VIP customer system is known. Suppose theIP address for the VIP customer server is A, IP address for B200’sinner port is B, and IP address for B200’s outer port is C. Then,the PAT group 1 is added in B200 as follows.SBC(config-sbc-system)#pat group-configure 1 A B C 9900 9900 10000 500 300 1 1


C h a p t e r 7

Service PolicyConfiguration

Table of ContentsGeneralization...................................................................73Configuring User-Group......................................................74Register Policy Configuration ...............................................75Call Policy Configuration .....................................................79CAC Policy Configuration.....................................................82QoS Policy Configuration.....................................................88Resource Reservation Policy Configuration.............................95

GeneralizationOverview In the architecture characterized by separated signaling and me-

dia, the service policies are processed in the pipeline architecture.

� For the register event, Figure 32 shows the service processflow.

FIGURE 29 THE PROCESSING FLOW FOR REGISTER EVENT

� For the “call/update” event, Figure 33 shows the service pro-cessing flow.



FIGURE 30 THE SERVICE PROCESSING FLOW FOR CALL/UPDATE

Each policy module, comparatively independent, works with othermodules through parameter transfer.

Each policy process module, used to process events based on theuser-group, may have many independent user-groups. In the net-working characterized by separated signaling and media, users inthe same user-group have one or multiple same service requests.One user may be in multiple user-groups, and each user-groupmay have many rules.

This manual takes the call event for example to describe the ser-vice process flow.

1. When a user originates a call, the Invite message reaches SPE.

2. SPE searches a match in each user-group of the “Call Policy”.Each match must contain all items in the select command forthe user-group. Once a match is found, it means the currentcall belongs to the user-group. Then, the policy configurationof the user-group in the “Call Policy” is used.

3. Search other matches in other user-groups of the “Cac Policy”and “Qos Policy”.

Note:

For each policy, the process terminates once a match is found.

Configuring User-GroupContext This topic describes the procedure to configure the user-group.

Steps 1. Enter the Signal Portal configuration mode.SBC(config-sbc)#signal-portal

2. Enter the user-group configuration mode.SBC(config-sbc-sp)#user-group <1-65535>


Chapter 7 Service Policy Configuration

3. Configure the rule of the user-group.SBC(config-sbc-sp-ug)#select <user-key> [exact|fuzzy] fromuser-location [all|<1-65535>]

END OF STEPS

Result The user-group is successfully configured.

In the above command, User-key is written as username@domain.

1. Username, often written in the phone number format, useswildcard for matching.

� #represents any digit.

� * represents a digit string (including 0) in optional length.Only one * is allowed.

� The maximum length is 64 bytes.

2. Domain, usually written in the string format, only uses a simplewildcard *. Therefore, the rest of information must be preciselyspecified.

� @* represents the domain names, like @zte.com [email protected], are the matches.

� The maximum length is 64 bytes.

Register PolicyConfigurationConfiguring Registration White List/Black List

Prerequisites The interconnection and interworking configuration is successful.

Context This topic describes the procedure to configure the registrationwhite list/black list.

Note:

System allows registration of the white list users and refuses reg-istration of the black list users.


2. Enter the policy-group configuration mode.SBC(config-sbc-sp)#policy-group <1-65535>

3. Enter the register-policy configuration mode.



SBC(config-sbc-sp-pg)#register-policy

4. Configure the register policy.

Note:

System refuses the registration of the black list users. That is,the reject parameter is selected. In contrast, system allowsthe registration of the white list users. That is the accept pa-rameter is selected.

SBC(config-sbc-sp-pg-regp)#register action {accept | reject | static}

5. Enter the signal-group configuration mode.SBC(config-sbc-sp)#signal-group <1-65535>

6. Apply the register policy to corresponding signal-group.SBC(config-sbc-sp-sg)#apply policy-group <1-65535> to user-group <1-65535>

END OF STEPS

Result The operator successfully configures the registration whitelist/black list.

Example SBC(config-sbc-sp)#policy-group 1SBC(config-sbc-sp-pg)#Register-policySBC(config-sbc-sp-pg-regp)register action acceptSBC(config-sbc-sp)#policy-group 2SBC(config-sbc-sp-pg)Register-policySBC(config-sbc-sp-pg-regp)register action rejectSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#apply policy-group 1 to user-group 10SBC(config-sbc-sp-sg)#apply policy-group 2 to user-group 100

In signal-group 1, the registration of the user-group 10 is ac-cepted, and the registration of the user-group 100 is refused. Theoperator is allowed to add users with different characteristics torelated user-groups.

Configuring Static Registration Users

Prerequisites

Context For static users, the fuzzy matching rule is not used. Instead, anexact matching rule is used.

The interconnection and interworking configuration is successful.



3. Enter the register-policy configuration mode.



SBC(config-sbc-sp-pg)#register-policy

4. Configure the register policy.

Note:

System refuses the registration of the black list users. That is,the reject parameter is selected. In contrast, system allowsthe registration of the white list users. That is the accept pa-rameter is selected.

SBC(config-sbc-sp-pg-regp)#register action {accept | reject | static}


6. Apply the register policy to corresponding signal-group.SBC(config-sbc-sp-sg)#apply policy-group <1-65535> to user-group <1-65535>

END OF STEPS

Result The operator successfully configures the static registration users.

Example As shown in Figure 31, in the 211.30.1.0/24 network, the threeusers ([email protected], [email protected], [email protected]) are all staticusers.



FIGURE 31 CONFIGURING STATIC REGISTRATION USERS

The configuration is as follows.#1 configure the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp)#policy-group 1SBC(config-sbc-sp-pg)register-policySBC(config-sbc-sp-pg-regp)register action staticSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#apply policy-group 1 to user-group 1

#2 configure the user-locationsSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 211.40.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 158.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 178.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1

#3 configure the use-groupSBC(config-sbc-sp)#user-group 1SBC(config-sbc-sp-ug)#select [email protected] exact from user-location 2



SBC(config-sbc-sp-ug)#select [email protected] exact from user-location 2SBC(config-sbc-sp-ug)#select [email protected] exact from user-location 2

Call Policy ConfigurationConfiguring Emergency Call

Prerequisites

Context Different calls have different priorities. The 119 and 112 calls arehigher than common calls. The call priority is determined by thematch in the “match” telephone number table. Otherwise, thedefault call priority is used.

The interconnection and interworking configuration is successful.

Steps 1. Enter SBC SYSTEM configuration mode to configure the priorityof the emergency call.SBC(config-sbc-system)#emergency-call serviceid <250~255>

2. Enter the Signal Portal configuration mode.SBC(config-sbc)#signal-portal


4. Enter the call-policy configuration mode.SBC(config-sbc-sp-pg)#call-policy

5. Enter the call-table configuration mode to configure the calldirection.

Note:

The call policy may use the call direction to match the phonenumber.

SBC(config-sbc-sp-pg-callp)#call-table <call-in | call-out>

6. Set a call priority.SBC(config-sbc-sp-pg-callp-calltbl)#user-serviceid <1-255>

7. Configure the phone number for matching.SBC(config-sbc-sp-pg-callp-calltbl)#match <call-number>



Note:

� The “match” phone number table only uses the fuzzymatching mode, prefix matching or suffix matching. Forexample, matching 110* or matching *110 is allowable.

� If a match is not found in the “match” telephone numbertable, the default user-serviceid, signal-nexthop id as wellas the user-location id are used.

8. Configure the next hop of the phone number for matching.SBC(config-sbc-sp-pg-callp-calltbl-match)#signal-nexthop <1-65535>

9. Configure the user-location of the phone number for matching.SBC(config-sbc-sp-pg-callp-calltbl-match)#user-location <1-65535>

10.Configure the user-serviceid of the phone number for match-ing.SBC(config-sbc-sp-pg-callp-calltbl-match)#user-serviceid <1-255>


12.Apply the call policy to the corresponding signal-group.SBC(config-sbc-sp-sg)#apply policy-group <1-65535> to user-group <1-65535>

END OF STEPS

Result The operator successfully configures the emergency call.

An Example to Configure EmergencyCall

Overview As shown in Figure 32, in the MAN, a SPE is located in the corenetwork side, and two MPEs are placed near BRAS. Each BRAS hasfour address pools for terminals to access the network. BRAS-1acts as the area A of a city, and BRAS-2 acts the area B of the samecity. The emergency calls involve 122, 119 and 110. All calls to110 are connected to the 110 control center.



FIGURE 32 THE EMERGENCY CALL SKETCH MAP

The configuration is as follows.#1 configure the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc-sp-sg)#signal-nexthop 2//110 police call center

SBC(config-sbc-sp-sg-snh)#ip-address ipv4 224.1.1.108 call-tableSBC(config-sbc-sp-sg-snh)#port sip 5060SBC(config-sbc)#systemSBC(config-sbc-system)#emergency-call serviceid 250SBC(config-sbc)#signal-portalSBC(config-sbc-sp)#policy-group 1SBC(config-sbc-sp -pg)#call-policySBC(config-sbc-sp -pg-callp)#call-table call-outSBC(config-sbc-sp -pg-callp-calltbl)#user-serviceid 100//the priority of the common call is 100

SBC(config-sbc-sp -pg-callp-calltbl)#match <110*>SBC(config-sbc-sp -pg-callp-calltbl-match)#user-serviceid 255

//the user priority

SBC(config-sbc-sp -pg-callp-calltbl-match)#signal-nexthop 2//forcedly connected to the 110 police call center

SBC(config-sbc-sp -pg-callp-calltbl)#match 122SBC(config-sbc-sp -pg-callp-calltbl)#user-serviceid 255

//the user priority

SBC(config-sbc-sp -pg-callp-calltbl)#match 119SBC(config-sbc-sp -pg-callp-calltbl)#user-serviceid 255



//the user priority

SBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#apply policy-group 1 to user-group 1

#2 configure the user-locationsSBC(config-sbc)#signal-portalSBC (config-sbc-sp)#user-location 1SBC(config-sbc-sp-ul)#area-info nanjing-baixia//configure the geography information of the area

SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 211.40.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 158.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 178.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC (config-sbc-sp)user-location 2SBC(config-sbc-sp-ul)#area-info nanjing-gulou//configure the geography information of the area

SBC(config-sbc-sp-ul)#remote-address ipv4 221.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 213.20.1.0 prefix-length 24SBC (config-sbc-sp)user-location 1SBC(config-sbc-sp-ul)#remote-address ipv4 58.2.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 59.2.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 2 media-resource 1

#3 configure the use-groupSBC(config-sbc-sp)#user-group 1SBC(config-sbc-sp-ug)#select *@* from user-location all

CAC Policy ConfigurationOverview

The Call Admission Control (CAC) is used to admit and control theregistration and calls of users. Such sub-system, as an importantway to avoid the overloading of B200/network, plays an importantrole to ensure the quality of voice services as well as the usabilityof B200.

CAC sub-system has the following functions.

� Admits and controls the registration of users

� Limits the maximum number of registered user-groups, in-cluding the number of all registered users in an enterprise,the maximum number of registered users regarding a pro-tocol, the maximum number of registered users regardinga service.

� Limits the maximum registration rate for a user-group, likethe registration rate of all registered users in an enterprise,the registration rate of users regarding a protocol, the reg-istration rate of users regarding a service.

� Limits the maximum registration refresh rate for a singleuser.

� Admits and control the calls of users



� Limits the number of maximum concurrent calls for auser-group (like the enterprise, protocol user-group, ser-vice group)

� Limits the maximum call rate for a user-group

� Limits the maximum call rate for a user

� Limits the maximum bandwidth for a user

� Limits the maximum bandwidth for a user-group

� Limits the time interval between two calls for a same user

� Exerts ratio control on the registration as well as call CACthreshold according to the CPU occupation rate

� Provides CAC statistics

Configuring CAC Policy


Context This topic describes the procedure to configure the CAC policy,including the number of registered users in the CAC group as wellas the registration rate.

Steps 1. Enter the signal-portal mode.SBC(config-sbc)#signal-portal

2. Configure the CAC-profile with the specified number.SBC(config-sbc-sp)#cac-profile <n>。

3. Configure the minimum interval between two calls for a sameuser.SBC(config-sbc-sp-cp)#call-gapping <5-1800>

4. Configure the maximum registration rate every minute for auser.SBC(config-sbc-sp-cp)#user-reg-rate <1-65535>

Note:

When a user registers to SBC, the user’s registration refreshrate per minute is calculated. If the rate already exceedsthe pre-set maximum registration refresh rate, the registra-tion packet is discarded.

5. Configure the user’s maximum call rate per minute.SBC(config-sbc-sp-cp)#user-call-rate <1-65535>



Note:

For a caller or callee, the number of the user’s invite messagesreceived/sent per minute is calculated. If the number exceedsthe pre-set maximum rate or threshold, the Invite packet isdiscarded.

6. Configure the user’s maximum physical bandwidth.SBC(config-sbc-sp-cp)#user-bandwidth <1-100000kbps>

7. Configure the maximum registration rate per minute for allusers in a user-group.SBC(config-sbc-sp-cp)#reg-rate <1-65535>

Note:

For all registered users in a user-group, the number of theregistration packets sent per minute is calculated. If the resultalready exceeds the pre-set maximum threshold, the registra-tion packets are discarded.

8. Configure the maximum call rate per minute for the signal-group’s users.

Note:

The number of the Invite messages sent/received per minuteregarding a signal-group’s all users (as callees or callers) iscalculated. If the result exceeds the pre-set maximum rate,the Invite messages are discarded.

SBC(config-sbc-sp-cp)#call-rate <1-65535>

9. Configure the maximum physical bandwidth for the sig-nal-group.SBC(config-sbc-sp-cp)#max-bandwidth <1-100000kbps>

10.Configure the maximum number of concurrent registration forthe signal-group.

Note:

For the signal-group’s users, if the maximum number of con-current registration exceeds the pre-set threshold, the subse-quent Invite messages are discarded.

SBC(config-sbc-sp-cp)#max-num-regs <1-65535>



11. Configure the maximum number of concurrent sessions for asignal-group.

Note:

For the signal-group’s users, if the maximum number of con-current calls exceeds the pre-set threshold, the subsequentInvite packets are discarded.

SBC(config-sbc-sp-cp)#max-num-calls <1-65535>


13. Enter the cac-policy configuration mode.SBC(config-sbc-sp-pg)#cac-policy

14.Configure the call direction.SBC(config-sbc-sp-pg-cacp)#cac-table <call-in | call-out>

15.Apply the CAC-profile to cac-policy.SBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule <cac-profile-id>

OrSBC(config-sbc-sp-pg-cacp-cactbl)#match user-serviceid <1-255>cac-rule <cac-profile-id>


17.Apply the cac policy to corresponding signal-group.SBC(config-sbc-sp-sg)#apply policy-group <1-65535> to user-group <1-65535>

END OF STEPS

Result The operator successfully configures the CAC policy.

Configuring CPU-Based Control


Context The registration behavior as well as call behavior regarding ter-minal users are admitted and controlled according to B200’s CPUoccupation rate.

� Registration behavior:

Exerts ratio control on the discarding of registration time ac-cording to the CPU occupation rate. Such control avoids.



� the extra load on busy B200 due to frequent registration ofusers

� the influence on users’ normal operations as well as con-versation performance.

� Call behavior:

Exerts ratio control on discarding of the user-group’s callevents according to the CPU occupation rate, avoiding moreloads on B200.

Steps 1. Enter the system mode.SBC(config-sbc)#system

2. Configure the ratio control on discarding of the calls and reg-istration according to the CPU occupation rate.SBC(config-sbc-system)#exceed CPU <level-1|level-2|level-3|level-4><percent%> <call|register> action deny <percent%>

END OF STEPS

Result The operator successfully configures the CPU-based control.

An Example to Configure CAC Policy

Overview As shown in Figure 33,

� The maximum registration number for the user-groups (UE11to UE12) is 500, the registration rate for total users is 30times/per minute, the maximum registration rate for a singleuser is 2 times/per minute, the maximum number for concur-rent calls is 50, and the total call rate is 60 times/per minute.

� The maximum registration number for the user groups (UE21to UE22) is 1000, the maximum registration rate for a singleuser is 2 times/per minute, the maximum number for concur-rent calls is 100, and the call rate for a single user is 2 times/perminute.

� For IPBX1 users, the number of concurrent calls is 600, andthe call rate is 300 times/per minute.

� For IPBX2 users, the number of concurrent calls is 300, themaximum bandwidth is 50M and the encoding method isG.711.



FIGURE 33 THE APPLICATION SCENE FOR CAC

1. configure the user-groupsSBC(config-sbc)signal-group 1SBC(config-sbc-sp)user-location 1SBC(config-sbc-sp-ul)#area-info UE1X//configure the geography information of the area

SBC(config-sbc-sp-ul)#remote-address ipv4 172.16.4.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 172.16.6.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)media 1 media-location 1 media-resource 1SBC(config-sbc-sp)user-location 2SBC(config-sbc-sp-ul)#area-info UE2X//configure the geography information of the area

SBC(config-sbc-sp-ul)#remote-address ipv4 172.16.11.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 172.16.12.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)media 1 media-location 1 media-resource 1SBC(config-sbc-sp)user-location 3SBC(config-sbc-sp-ul)#area-info IPBX1//configure the geography information of the area

SBC(config-sbc-sp-ul)#remote-address ipv4 172.16.3.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)media 1 media-location 1 media-resource 1SBC(config-sbc-sp)user-location 4SBC(config-sbc-sp-ul)#area-info IPBX1//configure the geography information of the area

SBC(config-sbc-sp-ul)#remote-address ipv4 172.16.10.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC(config-sbc-sp)#user-group 1SBC(config-sbc-sp-ug)#select *@* from user-location 1SBC(config-sbc-sp)#user-group 2SBC(config-sbc-sp-ug)#select *@* from user-location 2SBC(config-sbc-sp)#user-group 3SBC(config-sbc-sp-ug)#select *@* from user-location 3SBC(config-sbc-sp)#user-group 4SBC(config-sbc-sp-ug)#select *@* from user-location 4

2. configure the CAC profilesSBC(config-sbc-sp)#cac-profile 1SBC(config-sbc-sp-cp)#reg-rate 30SBC(config-sbc-sp-cp)#user-reg-rate 2SBC(config-sbc-sp-cp)#max-num-regs 500SBC(config-sbc-sp)#cac-profile 2SBC(config-sbc-sp-cp)#user-call-rate 60SBC(config-sbc-sp-cp)#max-num-calls 50SBC(config-sbc-sp)#cac-profile 3SBC(config-sbc-sp-cp)#user-reg-rate 2SBC(config-sbc-sp-cp)#max-num-regs 1000SBC(config-sbc-sp)#cac-profile 4SBC(config-sbc-sp-cp)#user-call-rate 2SBC(config-sbc-sp-cp)#max-num-calls 100



SBC(config-sbc-sp)#cac-profile 5SBC(config-sbc-sp-cp)#user-call-rate 300SBC(config-sbc-sp-cp)#max-num-calls 600SBC(config-sbc-sp)#cac-profile 6SBC(config-sbc-sp-cp)#max-num-calls 300SBC(config-sbc-sp-cp)#max-bandwidth 50,000SBC(config-sbc-sp-cp)#codec-list accept g711aSBC(config-sbc-sp-cp)#codec-list accept g711u

3. Apply the CAC-profiles to cac-policySBC(config-sbc-sp)#policy-group 1SBC(config-sbc-sp-pg)#cac-policySBC(config-sbc-sp-pg-cacp)#cac-table call-outSBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule 1SBC(config-sbc-sp)#policy-group 2SBC(config-sbc-sp-pg)#cac-policySBC(config-sbc-sp-pg-cacp)#cac-table call-outSBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule 2SBC(config-sbc-sp)#policy-group 3SBC(config-sbc-sp-pg)#cac-policySBC(config-sbc-sp-pg-cacp)#cac-table call-outSBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule 3SBC(config-sbc-sp)#policy-group 4SBC(config-sbc-sp-pg)#cac-policySBC(config-sbc-sp-pg-cacp)#cac-table call-outSBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule 4SBC(config-sbc-sp)#policy-group 5SBC(config-sbc-sp-pg)#cac-policySBC(config-sbc-sp-pg-cacp)#cac-table call-outSBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule 5SBC(config-sbc-sp)#policy-group 6SBC(config-sbc-sp-pg)#cac-policySBC(config-sbc-sp-pg-cacp)#cac-table call-outSBC(config-sbc-sp-pg-cacp-cactbl)#cac-rule 6

4．Apply the CAC-policy to signal groupSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#apply policy-group 1 to user-group 1SBC(config-sbc-sp-sg)#apply policy-group 2 to user-group 1SBC(config-sbc-sp-sg)#apply policy-group 3 to user-group 2SBC(config-sbc-sp-sg)#apply policy-group 4 to user-group 2SBC(config-sbc-sp-sg)#apply policy-group 5 to user-group 3SBC(config-sbc-sp-sg)#apply policy-group 6 to user-group 4

QoS Policy ConfigurationOverview

Background With the popular use of the Internet, network is closely associatedwith people’s life, and various services (data, voice, and video)emerged as the times required. Different services have differentrequirements for communication conditions.

� Characterized by discreteness, the data services require veryhigh reliability (measured by the error code rate) in servicetransfer. The delay is tolerated to some extent.

� The voice services as well as the video services are character-ized by large flow, continuity, real time and relevance. How-ever, the delay leads to the distorted voices and tones as wellas the mosaic video. Therefore, the transfer delay and the jit-ter are strictly controlled.



The traditional IP network provides the Best-Effort service,through which all service flow compete for the network resourcesequally. Therefore, it is difficult to meet the communicationrequirements for each kind of service. Then, it is necessary toresearch the essential reason of IP QoS.

QoS Service Model In general, three key parameters are used to describe the networkperformance, delay, jitter and packet loss rate. The three param-eters are also used to divide QoS types.

IP QoS consists of three structural models during use.

� Best-Effort Service

As a single service model, Best-Effort Service is also the sim-plest service model. The application program may send mes-sages of any number at any time, without getting the approvalin advance or sending notification to the network. The net-work makes the best to send messages, but without any per-formance assurance, like jitter or reliability.

The Best-Effort service, as the default service model in theInternet, is achieved through the FIFO model.

� InterServ

As an integrated service model, Intserv satisfies various QoSrequirements. Such service model requests the specified ser-vice from network before messages are sent. Signal imple-ments this request. At first, the application program sends thenetwork’s flow information or quality request for the specifiedservice to the network, like bandwidth and jitter. After receiv-ing the confirmation information from the network; that is, thenetwork already reserves resources for the messages of theapplication program, the application program sends messagesto the network.

When receiving the resource request from the application pro-gram, the network performs Admission control on resources.That is, considering the current use of resources, the networkevaluates if it is appropriate to allocate resources for the ap-plication program.

If the allocation of resources is approved, the network agreesto satisfy the application program’s QoS requirement as longas the message flow is controlled in the mentioned range.

Then, according to the IP addresses of two ends, port numbersas well as protocol numbers, the network maintains a state foreach flow. Furthermore, the network fulfills classification ofmessages, flow monitoring, queuing and scheduling of mes-sages based on the above state. This implements the perfor-mance assurance for the application program, characterized byconnection-orientation.

In terms of network devices, the requirement for processingcapability is higher. The Resource Reservation Protocol (RSVP)is used to transfer QoS request to the router.

� Diffserv

As the differentiated service model, Diffserv is used to sat-isfy different QoS requirements. Unlike the Integrated ser-vice, Diffserv removes signaling. That is, it is unnecessary forthe application program to notify the router when sending themessages. The network, unnecessary to maintain the state



for each flow, provides the specified service according to QoSdesignated by each message. Different ways may be used todesignate the Qos of the message, like the Precedence of the IPpacket, the source address as well as the destination addressof the message. Through the above information, the networkimplements message classification, flow reshaping, flow mon-itoring and queuing.

In the above three models, only the Inteserv and Diffserv as-sure IP QoSfor multiple services. The connection-oriented traitof Interserv is not accord with the connectionless trait of theIP network, which easily leads to the complication of the net-work. During the use, Interserv requires the network to main-tain a state for each flow, which put forwards a higher require-ment for the performance of the devices. In addition, com-plete QoS is achieved only when the network devices all usethe universal techniques. Unlike Interserv, Diffserv, which hasno such deficiency and has high processing efficiency, allowsthe step-by-step implementation for deployment and applica-tion.

Therefore, during application, Differv architecture is always thecommon choice.

Diffserv Diffserv (RFC 2474, 2475), Differenciated Service, is proposed byIETF. Compared the Interserv model, Diffserv simplifies the sig-naling task to a large extent and focuses on the aggregated dataflow as well as Per Hop Behavior (PHB). Differv renames the ToSfield of the IPV4 message to the DS field. Figure 34 shows thestructure of the DS field.

FIGURE 34 STRUCTURE OF THE DS FIELD

The working flow of Diffserv is as follows:

The user signed a Service Level Agreement (SLA) with the InternetService Provider (ISP). Such agreement, static or dynamic, explic-itly specifies the service level as well as corresponding maximumamount of data. The static SLA must be negotiated periodically,and the users of the dynamic SLA use a signaling protocol (such asRSVP) to request the service. RSVP, not a part of Diffserv, can beused with Differv. The user is allowed to mark the correspondingDifferen-tiated Services Code Point (DSCP) to designate the QoS.In addition, the user is also allowed to use the edge router to markDSDP according to the classification of the MultiField (MF).

Configuring QoS Signal Marking




Context This topic describes the procedure to configure the QoS signalmarking for a signal-group.

Note:

When the QoS signal marking varies, the signaling socket mustbe initiated once again. Then, the QoS signal marking is validatedimmediately.


2. Configure the number for the QoS-profile.SBC(config-sbc-sp)#qos-profile <n>

3. Configure the QoS signal marking for the QoS policy.SBC(config-sbc-sp-qp)#qos signal marking [dscp | ip-precedence]SBC(config-sbc-sp-qp-dscp)#dscp <0-63>

4. Apply the QoS policy to corresponding signal-group.SBC(config-sbc-sp-sg)#qos-rule <1-65535> direction uni-nniSBC(config-sbc-sp-sg)#qos-rule <1-65535> direction nni-uni

END OF STEPS

Result The operator successfully configures the QoS signal marking.

Configuring QoS Media Marking


Context This topic describes the procedure to configure the QoS mediamarking for some qualified calls in a signal-group.

Note:

When the QoS media marking varies, the new configuration iseffective only for the new calls. The previous calls remain un-changed.


2. Configure the number for the QoS-profile.SBC(config-sbc-sp)#qos-profile <n>

3. Configure the QoS medial marking for the QoS policy.



Note:

Media data involve fax, video, voice as well as data.

SBC(config-sbc-sp-qp)#qos fax marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip {(tos <0-15>)|(precendence <0-7>)}SBC(config-sbc-sp-qp)#qos voice marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip {(tos <0-15>)|(precendence <0-7>)}SBC(config-sbc-sp-qp)#qos video marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip {(tos <0-15>)|(precendence <0-7>)}SBC(config-sbc-sp-qp)#qos data marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip {(tos <0-15>)|(precendence <0-7>)}


5. Enter the qos-policy configuration mode.SBC(config-sbc-sp-pg)#qos-policy

6. Configure the call direction.

Note:

The QoSpolicy may use the call direction for matching.

SBC(config-sbc-sp-pg-qosp)#cac-table <call-in | call-out>

7. Apply the qos-profile to the qos-policy.SBC(config-sbc-sp-pg-qosp-qostbl)#qos-rule <qos-profile-id>

OrSBC(config-sbc-sp-pg-qosp-qostbl)#match user-serviceid <1-255>qos-rule <qos-profile-id>


9. Apply the qos policy to corresponding signal-group.SBC(config-sbc-sp-sg)#apply policy-group <1-65535> to user-group <1-65535>

END OF STEPS

Result The operator successfully configures the QoS media marking.

Configuring QoS Remarking




Context In the architecture characterized by separated signaling and me-dia, the QoS remarking is configured in MPE and validated imme-diately.

This topic describes the procedure to configure QoS remarking.

Steps 1. Enter the system mode.SBC(config-sbc)#media-portal

2. Enter the media-remark mode.SBC(config-sbc-mp)#media-remark

3. Configure QoS remarking.SBC(config-sbc-mp-remark)#media-qos-remark {audio|video|data|all}{callin|callout} uni-tos <0-255> nni-tos <0-255>

END OF STEPS

Result The operator successfully configures QoS remarking.

An Example to Configure QoS Policy

Overview As shown in Figure 35, users of the 211.30.1.0/24 network, in theuser side and network side, are all have higher QoS level than thecommon users.



FIGURE 35 QOSPOLICY CONFIGURATION

#1 configure the SP layerSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-addressipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060SBC (config-sbc-sp)#policy-group 1SBC(config-sbc-sp-pg)#qos-policySBC(config-sbc-sp-pg-qosp)#qos-table call-outSBC(config-sbc-sp-pg-qosp-qostbl)qos-rule 100//use the qos-profile 100SBC(config-sbc-sp-pg-qosp)#qos-table call-inSBC(config-sbc-sp-pg-qosp-qostbl)qos-rule 100//use the qos-profile 100

SBC (config-sbc-sp)#policy-group 2SBC(config-sbc-sp-pg)#qos-policySBC(config-sbc-sp-pg-qosp)#qos-table call-outSBC(config-sbc-sp-pg-qosp-qostbl)qos-rule 120//use the qos-profile 120SBC(config-sbc-sp-pg-qosp)#qos-table call-inSBC(config-sbc-sp-pg-qosp-qostbl)qos-rule 120//use the qos-profile 120SBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#apply policy-group 1 to user-group 1SBC(config-sbc-sp-sg)#apply policy-group 2 to user-group 2

#2 configure the user-locationsSBC(config-sbc)#signal-portalSBC(config-sbc-sp)#user-location 1



SBC(config-sbc-sp-ul)#remote-address ipv4 211.40.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 158.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#remote-address ipv4 178.10.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1SBC(config-sbc-sp)#user-location 2SBC(config-sbc-sp-ul)#remote-address ipv4 211.30.1.0 prefix-length 24SBC(config-sbc-sp-ul)#media-groupSBC(config-sbc-sp-ul-mg)#media 1 media-location 1 media-resource 1

#3 configure the use-groupsSBC(config-sbc-sp)#user-group 1SBC(config-sbc-sp-ug)#select *@* from user-location 1SBC(config-sbc-sp)#user-group 2SBC(config-sbc-sp-ug)#select *@* from user-location 2

#4 configure the qos-profilesSBC(config-sbc-sp)#qos-profile 100SBC(config-sbc-sp-qp)#qos signal marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 1SBC(config-sbc-sp-qp-ipp)#ip precedence 0SBC(config-sbc-sp-qp)#SBC(config-sbc-sp-qp-ipp)#ip tos 1SBC(config-sbc-sp-qp-ipp)#ip precedence 0SBC(config-sbc-sp-qp)#qos voice marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 1SBC(config-sbc-sp-qp-ipp)#ip precedence 0SBC(config-sbc-sp-qp)#qos video marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 1SBC(config-sbc-sp-qp-ipp)#ip precedence 0SBC(config-sbc-sp)#qos-profile 120SBC(config-sbc-sp-qp)#qos signal marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 8SBC(config-sbc-sp-qp-ipp)#ip precedence 5SBC(config-sbc-sp-qp)#qos fax marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 8SBC(config-sbc-sp-qp-ipp)#ip precedence 5SBC(config-sbc-sp-qp)#qos voice marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 8SBC(config-sbc-sp-qp-ipp)#ip precedence 5SBC(config-sbc-sp-qp)#qos video marking ip-precedenceSBC(config-sbc-sp-qp-ipp)#ip tos 8SBC(config-sbc-sp-qp-ipp)#ip precedence 5

Resource Reservation PolicyConfigurationOverview

Background B200, before the start of the session, uses the resource reservationpolicy of the application layer to reserve resources (calls, mediabandwidth) for callers or called numbers (like the emergency num-bers) according to priorities. Then, the Service Level Agreement(SLA) assurance for various sub-divided user groups is achieved.

Figure 36 shows the relationships among the reserve profiles, pol-icy groups and user groups.



FIGURE 36 RELATIONSHIPS AMONG RESERVE PROFILES, POLICY GROUPSAND USER GROUPS

One policy group may use multiple reserve profiles (in private orpublic mode), and multiple user groups may use one policy group.

ResourceReservationTemplate

There are two modes for the resource reservation template.

� Private mode: Only the specified user group is allowed to usesuch resource.

If the resource template is in private mode, the resources arededucted only when the following conditions are met.

� One or more rules have been applied to a policy group.

� The resource template is configured.

� One or more rules have been applied to a user group.

� Public mode: All user groups share the resource.

If the resource template is in public mode, global resources arededucted.

Validity Checkfor ResourceReservation

With regard to the resource reservation, it is necessary to makesure the resource for reservation is actually available. That is,during the deduction of the resource, the operator must check ifsystem current available resources are more than or equal to thededucted resources. If less, the current available resources arenot enough for reservation.

Deletion ofResource

Reservation

� If current resources are in public mode,

� The deletion of the application for the resource templatehas no effect on resources.

� After deletion of the resource template, the reserved re-sources are released to the rest of public resources avail-able.

� If current resources are in private mode,

� The deletion of the relationship between the user groupand policy group has effect on the user-group’s resources.Therefore, it is supposed to release the user-group’s allprivate resources reserved to the rest of public resourcesavailable.

� The deletion of the policy group has effect on all user-groups using such policy group. Therefore, if is necessaryto release these user group’s private resources to the restof public resources available.

� The deletion of the resource template has effect on all pol-icy groups using such resource template. And furthermore,



all user groups using these policy groups are also affected.Therefore, it is necessary to release all resources usingsuch template to the rest of public resources available.

Configuring Resource ReservationPolicy


Context The resource reservation consists of call reservation and band-width reservation.

This topic describes the procedure to configure the resource reser-vation policy.


2. Configure the number for the reserve-profile.SBC(config-sbc-sp)#reserve-profile <1-65535>

3. Modify the number of reserved calls.SBC(config-sbc-sp-rp)#reserve-calls <1-50000>

4. Modify the value of the reserved media bandwidth.SBC(config-sbc-sp-rp)#reserve-bandwidth <1-64000000(Kbps)>

5. Configure the type of the reserved resource template.SBC(config-sbc-sp-rp)#owner <private|public>


7. Enter the reserve-policy configuration mode.SBC(config-sbc-sp-pg)#reserve-policy

8. Apply one or more reserve profiles to a policy group.SBC(config-sbc-sp-pg-resp)#reserve-rule <reserve-profile-id>SBC(config-sbc-sp-pg-resp)#match user-serviceid <1-255>reserve-rule <reserve-profile-id>

9. Enter the signal-group mode.SBC(config-sbc-sp)#signal-group <1-65535>

10.Apply the reserve policy to corresponding signal-group.SBC(config-sbc-sp-sg)#apply policy-group <1-65535> to user-group <1-65535>

END OF STEPS



Result The operator successfully configures the resource reservation pol-icy.


C h a p t e r 8

Security Configuration

Table of ContentsConfiguring Network Topology Hiding ...................................99ACL Configuration............................................................ 100Configuring Signaling Firewall ........................................... 106SIP Encryption Configuration............................................. 108

Configuring NetworkTopology Hiding


Context B200, which is used to hide the information concerning all topologystructures for the IP core network as well as the external network,makes the channels from the external network to the IP networktransparent for users at two sides. Then, such way effectivelyblocks the illegal attacks to the IP network as well as the externalnetwork. At last, the security performance of the whole networkis improved.

At present, the network hiding is achieved in two following ways.

� B200 works in the Back-TO-Back User Agent (B2BUA) mode.The head fields of the topology information in the SIP messagesto the external network are locally kept. The SIP messagesfrom the external network are added to the head fields of thetopology information locally kept. From the external networkpoint, B200 originates calls to the external network, withoutknowing information regarding the network topology.

� Another way is to use the encryption way to hide the infor-mation. Then, the external network fails to acquire relatedinformation. The use of encryption for network topology hid-ing follows the ETSI ES 283 003 description.

This topic describes the procedure to configure the network topol-ogy hiding.


2. Enter the signal-attribute configuration mode.SBC(config-sbc-sp)#signal-attribute



3. Enter the sip protocol configuration mode.SBC(config-sbc-sp-sa)#sip

4. Configure the mode to achieve the network topology hiding.SBC(config-sbc-sp-sa- sip)#run-mode { proxy | b2bua }

END OF STEPS

Result The operator successfully configures the network topology hiding.

ACL ConfigurationOverview

To filter data packets, SBC sets a series of matching rules to iden-tify the objects for filtration. Access Control List (ACL) statementshave two components, a condition and an action. A condition isused to match on packet contents. When a match is found for acondition, an action is taken: permit or deny the packet. A con-dition is basically a set of rules that define what to look for in apacket’s contents to determine whether the packet matches. Acondition can be something as simple as looking for a match onthe source address in the packet, or something as complicated aslooking for a match in a source address, destination address, pro-tocol type and protocol information.

ACL Classification

Overview The types of ACLs are as follows.

� Standard ACL: Only performs matching for the source IP ad-dress of the data packet, then denies or permits the data pack-ets. The standard IP ACL is actually the standard ACL whichranges from 1 to 99 or from 1000 to 1499.

� Extended ACL: Owns more matching items (protocol type,source address, destination address, source port, destinationport, IP precedence for setting up connection) than the stan-dard ACL. The extended IP ACL is actually the extended ACLwhich ranges from 100 to 199 or from 155 to 1999.

� Timed ACL: Activated to filter data packets according to a pe-riod or a single time point.


Chapter 8 Security Configuration

ACL Statement

Overview One ACL statement consists of a condition as well as an action. Thecondition, once matching the content of the data packet, performsrelated action, i.e., denying or permits the data packet.

� Condition

The condition, basically a group of rules, defines the contentsearched in the data packet. A condition may be used only tosearch the source address in the data packet, or search thesource address, destination address, protocol type as well asthe protocol information.

Each ACL statement only lists a condition. However, it is al-lowable to group multiple ACL statements as a single list or apolicy. These ACL statements are grouped by a common num-ber or name.

� Condition matching

When the condition of an ACL statement matches the contentof the data packet, related action (deny or permit) is taken.

Once a match is found, the program jumps over the rest of ACLstatements.

Also, a default invisible statement, called the implicit denystatement, is at the end of each ACL. Such statement is usedto discard the data packet if no match is found after thestatement-by-statement matching is performed. Therefore,at least, a “permit” action must be in each ACL. If the ACLonly owns the “deny” action, the data packet is still discardedif matching one of these statements or the implicit “deny”statement is used.

ACL Rule

Overview ACL has many rules as follows.

� The ACL statements are grouped according to names or num-bers.

� Each ACL statement has only one set of conditions and oneaction (deny or permit). For multiple conditions or multipleoperations, multiple ACL statements must be created.

� If a match is not found in the condition of a statement, theprogram proceeds to the next ACL statement.

� If a match is found in a statement of an ACL group, no furtherstatements are processed.

� If a match is not found after all ACL statements are searched,the invisible implicit “deny” statement denies the packet.

� Given the implicitly deny at the end of the grouping of ACLstatements, at least on permit action is set; otherwise, allpackets are denied.



� Order of statements is important. The most restrictive state-ments must be at the top of list, and the least restrictive mustbe at the bottom.

� An empty ACL grouping permits all packets. An empty ACLgrouping is an ACL that has been activated on a router butthat does not contain any statements. For the implicit denystatement to take effect, there must be at least one permit ordeny statement in the ACL.

� It is allowable to apply one ACL per interface, per protocol,per direction. For example, it is forbidden to have two IP ACLsapplied inbound on an interface, but allowable to have an IPACL applied inbound and outbound.

� Inbound ACLs are processed before a packet is routed to an-other interface.

� Outbound ACLs are processed after a packet is routed to theinterface but before the packet exits the interface.

� When an ACLis applied to an interface, which affects trafficflowing through the interface, the ACL does not filter trafficthat the router itself generates. For example, if an outboundACL is on an interface that blocks ICMP traffic, it will not filterpings that the router generates.

ACL Creation & Application

Selectionstandards for

definition

A group is characterized by the selection standards in ACL rules.One ACL that defines the source address or one ACL that definesthe source address & destination address can be used to filtergroups. A statement is defined according to the following rules.

� Source IP address

� Destination IP address

� Source port number

� Destination port number

� Protocol type

The above selection standards act as the fields of the ACL rules.The ACL from 1 to 99 is called the standard ACL, which only de-fines the source address. And the ACL from 100 to 199 is calledthe extended ACL. In the extended ACL, the source address, desti-nation address, source port number, destination port number andprotocol number are all defined.

Format Mode Description

acl {extended|standard}{number <acl-number>|alias <acl-alias>}

ip access-list {extended

<access-list-num-ber>|standard

<access-list-number>}

Global� Defines an ACL� Enter the ACL

configuration mode




deny <source>[<source-wildcard>] ACL Sets the “deny” condition for

the standard ACL

permit <source>[<source-wildcard>] ACL Sets the “permit” condition

for the standard ACL

deny <protocol> <source>

<source-wildcard>[<source-port>]

<destination><destination-wildcard>

[<destination-port>]

ACL Sets the “deny” condition forthe extended ACL

permit <protocol><source>

<source-wildcard>[<source-port>]

<destination><destination-wildcard>

[<destination-port>]

ACL Sets the “permit” conditionfor the extended ACL

name <word> ACL Sets a name for the ACL

In the ACL rules, each field is sensitive to the address. For ex-ample, for the TCP rule, the source address must be placed afterthe destination address, and the source port and destination portmust be placed after the source address and destination addressrespectively.

Not all fields of the ACL rules must be specified. If not speci-fied, the field is regarded as a wildcard or left alone. If specified,the field is used to match the group. Different protocols matchdifferent fields. Each field is sensitive to the location, therefore,sometimes, it is necessary to jump over some fields, in order tospecify a value for another field. The keyword any is used to jumpover the source address field or the destination address field.

Usage of ACL After a group of ACL selection standards are defined, the ACL is stillnot effective. The ACL is effective only when used by interfaces orsome policies. Some common ACL usages are listed as follows.

� Interface ACL: Applies the ACL an interface. Then, the inter-face permits or denies the data packets from/to the GW equip-ment.

� Service ACL: Applies the ACL to a service. Then, the servicepermits or denies the data packets from/to the GW equipment.

Precautions The precautions are as follows.

1. For an ACL with several rules, the order of these rules is veryimportant. The ACL searches the match in strict accordancewith the order of rules. The show running-config commandor show access-list command is used to view the order ofthese ACL rules.

If a group matches a certain rule, data packets are received ordenied according to the permit keyword or the deny keyword,and all following rules are ignored. That is, the firstly-matchedalgorithm is used. The gateway checks the ACL from top to



down, one rule per a time, until the match is found. There-fore, more specific rules must always be placed before lessspecific rules. For example, the following ACL permits all IPdata packets from the 4.3.2.1/16 sub-network, and denies thedata packets from other network segments.SBC(config)#ip access-list 101 permit ip 4.3.2.1 0.0.255.255 anySBC(config)#ip access-list 101 deny ip any any

Data packets from the 10.2.0.0/16 sub-network are discardedwhen a match is not found in the first rule.

2. At the end of each ACL, an implicit deny statement is automat-ically added, used to deny all IP data packets.

For those groups which fail to match any specified rules, theimplicit deny statement plays a blocking role.

Setting the implicit deny statement is out of the safety consid-eration. If an ACL is misconfigured, groups that should havepassed B200 are blocked due to the implicit deny statement.The worst result is any data are not sent and received. How-ever, a security accident occurs if groups that should have beenblocked are forwarded. Therefore, the implicit deny statementsets a defense line for ACL misconfiguration.

An ACLis as follows.SBC(config)#ip access-list 101 permit ip 1.2.3.4 0.0.0.255SBC(config)#ip access-list 101 permit ip 4.3.2.1 0.0.0.255 any

Due to the implicit deny statement, such ACLactually has threerules as follows.SBC(config)#ip access-list 101 permit ip 1.2.3.4 0.0.0.255SBC(config)#ip access-list 101 permit ip 4.3.2.1 0.0.0.255 anySBC(config)#ip access-list 101 deny ip any any

Because the implicit deny statement matches all groups, theincoming groups that fail to match the first two rules are finallydiscarded.

ACL Applications

Applying ACLtoInterfaces

The ACL is applied to an interface to check inbound/outbound datapackets. The inbound data packet refers to the data packet thatenters the gateway. The outbound data packet refers to the datapacket forwarded by the gateway.

For each interface, only an ACLis used for a protocol in a direc-tion. For example, it is forbidden to apply two or more IP ACLsto an interface in the inbound direction. If one ACL is applied tothe inbound data packet and another ACL is applied to the out-bound data packet, these two ACLs also can be applied to a sameinterface. To add more rules in an ACL, it is allowable to put theserule to another ACL applied to the opposite direction of the sameinterface.

When a group enters B200 through the interface that uses the in-bound ACL, B200 compares the group with the rules specified by



the inbound ACL. Such group enters B200 if permitted. Otherwise,it is discarded. The outbound ACL is used if the group is forwardedfrom another port (i.e., the group is to be routed). At the interfaceexit, the group is compared with the rules of the outbound ACL.Therefore, the group undergoes two separate checks: One is atthe inbound interface, and another one is at the outbound inter-face.

If an ACL is applied to an interface, the following command is used.


ip access-group<access-list-number>

{in|out}

Port Applies the configuredACLto the incoming/outgoingdirection of the port.

Figure 37shows an example of ACL configurationfor the interface.

FIGURE 37 ONE APPLICATION OF ACL

B200is configured as follows.SBC(config)#interface fei_1/1// Enters interface mode.SBC(config-if)#ip address 134.141.7.2 255.255.255.0// Configures the IP address of the interface.SBC(config-if)#access-group 100 out// Applies the ACL whose number is 100 to the outgoing direction ofInterface fei_1/1.SBC(config)#interface fei_1/2// Enters interface mode.SBC(config-if)#ip address 134.141.6.3 255.255.255.0// Configures the IP address of the interfaceSBC(config-if)#access-group 100 in// Applies the ACL whose number is 100 to the incoming direction ofInterface fei_1/2.SBC(config)#access-list 100 deny ip 134.141.9.0 0.0.0.255 any//Defines an extended ACL whose number is 100, and blocks off all IPdata packets from 134.141.9.0 networkSBC(config)#access-list 100 deny ip any 134.141.9.0 0.0.0.255//Defines an extended ACL whose number is 100, and blocks off all IPdata packets sent to 134.141.9.0 network.SBC(config)#access-list 100 permit ip any any// Permits other data packets

Applying ACLtoServices

In B200, ACL is created to permit or deny the access to a kind ofservice of the gateway. Some types like HTTP, Telnet are calledService ACL. As the definition points out, Service ACL is used tocontrol the inbound group sent to an interface of the gateway.

For example, in an interface, some hosts are allowed to accessTelnet Server, or some sub-networks are denied to access WebServer. The main purpose of creating Service ACL is to controlthe access to some services for the gateway. As a result, only theinbound data packets sent to the gateway are checked.



To apply the ACL to a service, it must firstly apply the ACL to re-lated interface.

This manual still takes the networking shown in Figure 40 to de-scribe the detailed ACL configuration.

B200is configured as follows.SBC(config)#interface fei_1/1SBC(config-if)#ip address 134.141.7.2 255.255.255.0SBC(config-if)#ip access-group 110 outSBC(config-if)#exitSBC(config)#interface fei_1/2SBC(config-if)#ip address 134.141.6.3 255.255.255.0SBC(config-if)#ip access-group 110 inSBC(config-if)#exitSBC(config)#ip access-list 110 permit tcp any 134.141.9.88 0.0.0.0 eq telnet

ACL Maintenance & Diagnosis

Overview To facilitate ACL maintenance and diagnosis, B200 provides fol-lowing check commands.

The following table displays contents of all ACLs or contents of aspecified ACL.


show access-list[<access-list-number] |[<name> <word>]

User,privi-lege

Displays all contents in theACLor contents of the specifiedtable

Configuring SignalingFirewall

Prerequisites

Context As the edge access device between SS and IMS core network, B200fulfills following functions.

� Signaling/media traversing (basic function)

� Protecting the core network devices from attacks of the exter-nal network

As a gateway, B200, which plays a role of defense, separates thecore network from the external network by terminating the directinterconnection. However, the defense in such extent is still farfrom enough. Without any defense measure, the hackers originateattacks to B200 or to the core network by bypassing B200 in thesignaling layer.

Therefore, it is necessary to add the firewall in B200 signaling layerto check and filter all kinds of signaling attacks.

The black list refers to a filtration method according to the sourceIP address of the message. Compared with the ACL-based packetfiltration, the fields the black list uses for matching are very simple,



which filter messages in a very high speed. Then, the messagesfrom the specified IP address are effectively denied.

B200’s processing mechanism: B200 evaluates if the signaling at-tack occurs according to the threshold for the user connection rate.If the rate exceeds the threshold, it means the signaling attackstarts. Then, B200 automatically adds the attacker’s IP addressand port number to the black list and keep them until the agingtime is up.

This topic describes the procedure to configure the signaling fire-wall.

Steps 1. Enter the system configuration mode.SBC(config-sbc)#system

2. Enter the alg-firewallconfiguration mode.SBC(config-sbc-system)#alg-firewall

3. Enable/Disable the firewall.SBC(config-sbc-firewall)#firewall {disable|enable}

4. Enable/Disable the socket port filtration.SBC#diagnoseSBC(diag)#diag alg-ipfirewall white-list-switch {disable|enable}

5. Configure the black list.SBC(config-sbc-firewall)#black_list ip-address A.B.C.D [port <1-65535>]

6. Configure the cac firewall.SBC(config-sbc-firewall)#cac-flood {register|call> period <60-900>reject-times <1-4294967295> block-timer <15-4294967295>[log] [alarm]

7. Configure the firewallfor the malformed packets.SBC(config-sbc-firewall)#malform-flood {(user <60-900> <1-4294967295><15-4294967295>)|(sbc <60-900> <1-4294967295>)}{log|alarm}

8. Configure the firewallfor flooding registration.SBC(config-sbc-firewall)#reg-flood {(user <60-900> <1-4294967295><15-4294967295>)|(sbc <60-900> <1-4294967295>)}{log|alarm }

END OF STEPS

Result The operator successfully configures the signaling firewall.

The CAC firewalls consist of the registration CAC firewall and thecall CAC firewall. The CAC firewall configuration must firstly beginwith the CAC policy configuration (the maximum call rate or themaximum registration rate for a user each minute).

For the malformed packet firewall or flooding registration, SBCuses two policies. That is, the device-based firewall and the user-based firewall. The device-based firewall, which does not createthe black list automatically, creates the alarm log directly. The op-erator must add the black list manually.



SIP Encryption ConfigurationOverview

SS, on the basis of Internet, is a multi-media application systemincluding video, audio, as well as data, etc.

Due to different carriers’ data networks, considering respectiveinterests, the carriers filter port numbers which use SS applicationprotocols, and even perform analytic filtration for protocols. Thisway makes some normal services fail. Therefore, two plans areproposed to solve the above problem.

� Solution to filtering SIP protocol port numbers

Due to the well-known port UDP 5060 for SIP protocol, at thefirewall of the data network, port number filtration is used forservice filtration to limit development of services.

With respect to such situation, a plan is used as follows.

� Modifying the two protocol port numbers between the ter-minal and B200, and modify the SIP protocol numbers be-tween B200 and the terminal.

� The port number of B200 and port number of SS still usethe standard ones for SIP protocol.

So far, such plan is applied to B200 and terminals.

This plan has the following advantages.

� A small scale application

� Because each area owns a broadband gateway, it is onlynecessary to modify the protocol port numbers for B200and the terminal in the area where the port filtration occurs.

At present, such mode is applied to application servers, softterminals, as well as broadband gateways.

� In-depth check & filtration solution for SIP protocol

A solution for in-depth check & filtration of SIP protocol is putforward, which practices the principle of exerting judgment onthe protocol layer by analyzing UDP message. Under suchmode, a simple way, modification of protocol numbers, fails toachieve the firewall traversing. Therefore, related policy, mod-ifying protocol contents in the transmission period, is used toachieve the anti-filtering purpose. At the same time, follow-ing process continues after the SIP protocol is recovered in theprotocol process layer.

The details are: After modification of the protocol transmissionmodules for the broadband gateway and terminal, the terminalencrypts SIP messages when SIP protocol is transmitted; then,B200 re-encrypts and recovers SIP messages after receivingthem. The standard SIP protocol is still used between B200and SS.

As far as an encryption is concerned, the encryption algorithm,encryption key, as well as encrypted contents are necessary.



An encryptionalgorithm can be a public one, characterized bythe recovery trait for encrypted contents. Also, the encryptedcontents are configurable, i.e., the encryption depth is config-urable. The encryption key is required to be previously config-ured in the terminal or B200.

During the application, it is suggested to acquire such param-eters as the IP address, encryption key, and encryption depthof B200, etc, from the configuration management center oncethe terminal is powered on. Then, the registration and serviceexecution are performed according to the above parameters.For the convenience of maintenance and searching in applica-tion, this plan uses encryption depth instead of any encryptionkey.

The detailed operation is as follows: Performing encryptional-gorithm calculation from the first character of the SIP messageto the character specified by the encryption depth whose unitis byte. For example, if the encryption depth is 6, the first sixcharacters of the SIP message are modified from ABCDEF toFEDCBA after encryption. Considering the flexibility, multipleencryption algorithms can be put into use.

As far as such mode is concerned, the terminal and B200 mod-ify related programs to improve effectiveness of managementfunction concerning the encryption module as well as the en-cryption key (encryption depth); the encryption depth is con-figurable; the terminal, which is not a standard one, can becustomized.

In response to the firewall performing flirtation on SIP protocolport numbers, as well as in-depth analysis and filtration on theSIP protocol, considering from a whole view, a way that the ter-minal encrypts SIP messages when SIP protocol is transmittedis used. Such way allows the gateway performing decryptionand recovery when receiving these encrypted messages. Then,the service failure is avoided, as shown in Figure 38.

FIGURE 38 SIP ENCRYPTION

Configuring SIP Encryption

Context This topic describes the procedure to configure SIP encryption.


2. Enable/Disable the SIP encryption.SBC(config-sbc-system)#signal-encrypt-switch {disable|enable}

3. Set the SIP encryption.SBC(config-sbc-system)#signal-encrypt <inner ip> <sip port><Encrypt length> <arithmetic>



4. Query the SIP encryption rule.SBC(config-sbc-system)#show signal-encrypt stat

END OF STEPS

Result The operator successfully configures the SIP encryption.

An Example for SIP EncryptionConfiguration

Overview The following algorithm sets the SIP encryption rule.SBC(config-sbc-system)#signal-encrypt-switch enableSBC(config-sbc-system)#signal-encrypt 100.100.36.1 5060 32 1SBC(config-sbc-system)#show signal-encrypt stat------------------------------SignalEncryFlag:0Current SignalEncryNum :1------------------------------Number = 1Ipaddr = 100.100.36.1SipPort = 5060EncryptLen = 32EnArithmetic = 1SipEncryptReceiveCount = 0SipDecryptReceiveCount = 0SipDecryptCount = 0SipEncryptCount = 0SipEncryptReceiveByte = 0SipDecryptReceiveByte = 0SipDecryptByte = 0SipEncryptByte = 0------------------------------SBC(config-sbc-system)#


C h a p t e r 9

Global ParameterConfiguration

Table of ContentsConfiguring Media Bandwidth Control ................................. 111Configuring Learning Function for First Packet ..................... 112Configuring RTCP Function ................................................ 113Configuring Media Discarding Function ............................... 113Configuring Media Negotiation Control ................................ 114

Configuring MediaBandwidth Control

Context B200 is allowed to control the bandwidth of the session not overthe negotiated bandwidth according to the flow.

This topic describes the procedure to configure the media band-width control.


2. Enable/disable the media bandwidth control.SBC(config-sbc-system)#media session-car {disable|enable}

3. Exit from the system mode and enter the signal-portal mode.SBC(config-sbc)#signal-portal

4. Enter the bandwidth mode.SBC(config-sbc-sp)#bandwidth

5. Configure the packet time as well as the bandwidth regardingthe media type.SBC(config-sbc-sp-bw)#media-type {g711a|g711u|g722|g723|g728|g729|h261|h263} packet-time <5-60>bandwidth <1-65535>

END OF STEPS

Result The operator successfully configures the media bandwidth control.



Configuring LearningFunction for First Packet

Prerequisites SPE and MPE both function normally.

Context The learning mechanism for the first packet is described as follows.

The first packet learning is classified into the single-way learning aswell as the two-way learning. The single- way learning is used tosupport inconsistent receiving port and sending port. The two-waylearning is used to support inconsistent receiving port and sendingport as well as NAT traversing.

� First packet learning without NAT: Check the consistencybetween the source IP address/port number for the cur-rently-received packet and the source IP address/port numberfor the entrance. For consistent matching, the source IP ad-dress/port number of the entrance are modified to the sourceIP address/port number of the currently-received packet.Otherwise. NAT traversing is performed.

� First packet learning with NAT: When the source IP addressof the received packet is inconsistent with the source IP ad-dress of the entrance, check if the signaling checking flag isenabled. If such flag is marked, verify the consistency be-tween the source IP address of the packet and the signaling IPaddress. For consistent matching, the two-way learning for thefirst packet starts. Otherwise, the media packet is discarded(such packet is not the media packet processed by MTI). Whenthe signaling checking flag is not marked, further verification isnot performed. Instead, the normal two-way learning for thefirst packet starts.

� The normal two-way learning for the first packet: Use thesource IP address and PORT number for currently-receivedpacket to modify the source port of the entrance for the cur-rent item (such item is acquired according to the index of thedestination port for the entry, which is used to support the in-consistent receiving port and the sending port). Use the sourceIP address and PORT number of the currently-received packetto modify the destination IP address and PORT number of theexit for the item in another direction regarding the same link(such item is acquired when the source port of the exit for cur-rent item acts as the index). Then, NAT traversing is achieved.

This topic describes the procedure to configure the learning func-tion for the first packet.


2. Enable/Disable the learning function for the first packet.SBC(config-sbc-system)#NAT-traversal <enable|disable> [source-ip-check]

END OF STEPS

Result The operator successfully configures the learning function for thefirst packet.


Chapter 9 Global Parameter Configuration

Configuring RTCP FunctionContext The Realtime Transport Control Protocol (RTCP) is used to ex-

change information regarding transmission quality to furthercontrol transmission. During RTCP session, each participant peri-odically transfers the RTCP packets which contain the numbers ofthe sent data packets, numbers of lost data packets. Therefore,the server uses the above information to dynamically changethe transmission rate, or even change types of the valid loads.The joint use of RTP and RTCP ensures the optimization of thetransmission rate through the effective feedback and minimumcost, which is most appropriate for the transmission of networkreal-time data.

This topic describes the procedure to configure the RTCP function.


2. Enable/Disable the RTCP function.SBC(config-sbc-system)#rtcp {enable|disable}

END OF STEPS

Result The operator successfully configures the RTCP function.

Configuring MediaDiscarding Function

Context This topic describes the procedure to discard unmatched mediapackets as well as attack packets in the lower layer. These packetsare not sent to CPU to avoid loss to upper-layer CPU.


2. Enable/Disable the media discarding function.SBC(config-sbc-system)#media-discard {enable|disable}

END OF STEPS

Result The operator successfully configures the media discarding func-tion.



Configuring MediaNegotiation Control

Context Through the use of the media negotiation control, B200 allows theidentifiable media types pass by according to system configura-tion. For unidentifiable media types, B200 uses the filtration way.

This topic describes the procedure to configure the media negoti-ation control function.


2. Configure the number for CAC-profile, and enter the cac-profilemode.SBC(config-sbc-sp)#cac-profile <n>

3. Configure the negotiated media type system accepts or rejectsnegotiation.SBC (config-sbc-sp-cp)#codec-list {accept|reject}{g711u|g711a|g722|g723|g728|g729|h261|h263}

Note:

Such command, which must only be configured once, is usedto select B200’s one or more known media types.

By default, system enables the encoding and decoding func-tions regarding codec-list accept.

4. Set the filtration on the terminals’ media types unidentifiablefor B200.SBC(config-sbc-sp-cp)#codec-list {accept | reject} unknown-type <0x01-0xff>

Note:

In a cac-profile, at most 10 unknown-type configuration com-mands are configured.

END OF STEPS

Result The operator successfully configures the media negotiation controlfunction.


C h a p t e r 10

Reliability Configuration

Table of ContentsGeneralization................................................................. 115Configuring Cold Backup for Active/Standby B200................ 115Configuring Hot Backup for Active/Standby B200 ................. 117

GeneralizationOverview To ensure the reliability of B200 during operation, the hot backup

or cold backup mode is used in the actual engineering networking.

� The active/standby B200 using the hot back up mode has thesame data configuration, and synchronizes dynamic data realtime. Once the active B200 breaks down, the standby B200starts to work, without any loss of data.

� The active/standby B200 using the cold back up mode has thesame data configuration, but no real-time synchronization ofthe dynamic data (like the service data). Once the active B200breaks down, the standby B200 starts to work, similar to thereboot.

Configuring Cold Backup forActive/Standby B200

Context The cold backup mode for active/standby B200 is used to achieveactive/standby switchover for service ports by enabling VRRP ineach service port. Then, the active/standby switchover for B200is fulfilled. Meanwhile, to realize synchronous switchover for eachVRRP group, B200 uses the TRACK function on the basis of VRRPto monitor the variation of the states for physical ports and bindTRACK with VRRP. When the state of the physical port binded withVRRP varies, the priority of such VRRP also varies (rise or drop)based on the configured variable.

This topic describes the procedure to configure the cold backup foractive/standby B200.

Steps 1. Configure TRACK in the global mode.



2. Configure the floating addresses as well as priorities for multi-ple VRRP groups in the interface mode.

3. Bind VRRP with TRACK.

END OF STEPS

Result The operator successfully configures the cold backup for ac-tive/standby B200.

Example As shown in Figure 39, the data configuration for cold backup isas follows.

FIGURE 39 COLD BACKUP CONFIGURATION NETWORKING

1．B200_1 configuration is as follows.B200_1(config)#track 1 interface fei_1/1 line-protocol//TRACK 1 monitors the fei_1/1 portB200_1(config)#track 2 interface fei_1/2 line-protocol//TRACK 2 monitors the fei_1/2 portB200_1(config)#interface fei_1/1B200_1(config-if)#ip address 172.172.1.1 255.255.255.0B200_1(config-if)#vrrp 1 ip 172.172.1.3// Configure the floating address for VRRP1B200_1(config-if)#vrrp 1 priority 150//configure the priority for VRRP1B200_1(config-if)#vrrp 1 track 2 decrement 51// bind VRRP with TRACK and set the variable for priorityB200_1(config-if)#exitB200_1(config)#interface fei_1/2B200_1(config-if)#ip address 192.192.1.1 255.255.255.0B200_1(config-if)#vrrp 2 ip 192.192.1.3B200_1(config-if)#vrrp 2 priority 150B200_1(config-if)#vrrp 2 track 1 decrement 51

2．B200_2 configuration is as follows.B200_2(config)#interface fei_1/1B200_2(config-if)#ip address 172.172.1.2 255.255.255.0B200_2(config-if)#vrrp 1 ip 172.172.1.3B200_2(config-if)#exitB200_2(config)#interface fei_1/2B200_2(config-if)#ip address 192.192.1.2 255.255.255.0B200_2(config-if)#vrrp 2 ip 192.192.1.3

� During the configuration of VRRP, the operator must config-ure the floating address for VRRP to the actual address of thebinded port.


Chapter 10 Reliability Configuration

� For the cold backup mode, the active/standby B200 must havedifferent priorities. The active B200 has higher priority thanthe standby B200.

� The TRACK function must be enabled in the active B200.Once the VRRP priority in a B200 is modified, the boot VRRPswitchover is also achieved.

The priority of the active VRRP minus the variable must be lowerthan the priority of the standby VRRP.

As shown in the above example, the priority for B200_1 in theactive state is set to 150 and the variable is 51. B200_2 uses thedefault priority (100).

Configuring Hot Backup forActive/Standby B200

Context The hot backup function for B200 adds the data synchronizationon the basis of the cold backup. Data synchronization is ensuredthrough the Hot Standby Transfer Protocol (HSTP). After HSTP andVRRP are binded together through data configuration, the judg-ment for active/standby B200 and the boot VRRP switchover areboth achieved.

This topic describes the procedure to configure the hot backup foractive/standby B200.

Steps 1. Enable the HSTP function in the global mode.

2. Configure the floating addresses for VRRP groups in the inter-face mode.

3. Configure VRRP groups in the interface mode.

4. Bind HSTP with VRRP and set the priorities.

END OF STEPS

Result The operator successfully configures the hot backup for ac-tive/standby B200.

Example As shown in Figure 40, the data configuration for hot back up isas follows.



FIGURE 40 HOT BACKUP NETWORKING

1．B200_1 configuration is as follows：B200_1(config)#hstp 1 enable// Enable the HSTP function

B200_1(config)#hstp bathsync enable//Enable batch synchronizationB200_1(config)#interface fei_1/1B200_1(config-if)#ip address 172.172.1.1 255.255.255.0B200_1(config-if)#vrrp 1 ip 172.172.1.3B200_1(config-if)#exitB200_1(config)#interface fei_1/2B200_1(config-if)#ip address 192.192.1.1 255.255.255.0B200_1(config-if)#vrrp 2 ip 192.192.1.3B200_1(config-if)#exitB200_1(config)#interface fei_1/3B200_1(config-if)#ip address 192.168.0.1 255.255.255.0// configure the IP address for the HSTP portB200_1(config-if)#hstp 1 neighbor 192.168.0.2// Configure HSTP’s adjacent addressB200_1(config-if)#hstp 1 bind vrrp 1// bind the VRRP groups, at most 256B200_1(config-if)#hstp 1 bind vrrp 2B200_1(config-if)#hstp 1 bind vrrp 3B200_1(config-if)#hstp 1 bind vrrp 4//In the network port’s interface configuration mode, set the//relationships between the hot active/standby group and the VRRP//groups functioning in the inner port and outer port. Then, when//active/standby switchover starts, the switchover of VRRP groups//also begins. For an inactive B200, related services and VRRP//groups must be switched to another standby B200.

B200_1(config-if)#hstp 1 force-priority 200 decrement 150// Set the forced priority and the decrease variable for hstp to VRRP

2．B200_2 configuration is as follows.B200_2(config)#hstp 1 enable// Enable the HSTP function

B200_2(config)#hstp bathsync enable// Enable batch synchronizationB200_2(config)#interface fei_1/1B200_2(config-if)#ip address 172.172.1.2 255.255.255.0B200_2(config-if)#vrrp 1 ip 172.172.1.3B200_2(config-if)#exitB200_2(config)#interface fei_1/2B200_2(config-if)#ip address 192.192.1.2 255.255.255.0B200_2(config-if)#vrrp 2 ip 192.192.1.3B200_2(config-if)#exitB200_2(config)#interface fei_1/3

B200_2(config-if)#ip address 192.168.0.2 255.255.255.0// Configures the IP address for the HSTP port


Chapter 10 Reliability Configuration

B200_2(config-if)#hstp 1 neighbor 192.168.0.1// Configure HSTP’s adjacent addressB200_2(config-if)#hstp 1 bind vrrp 1B200_2(config-if)#hstp 1 bind vrrp 2B200_2(config-if)#hstp 1 bind vrrp 3B200_2(config-if)#hstp 1 bind vrrp 4B200_2(config-if)#hstp 1 force-priority 150 decrement 140

//Set the forced priority and the decrease value for hstp to the VRRP





C h a p t e r 11

Disaster RecoveryConfiguration

Table of ContentsGeneralization................................................................. 121Configuration Flow........................................................... 121Configuring Disaster Recovery Policy .................................. 122Configuring SIP Terminal Fixedly-Affiliated to SS.................. 124Configuring Attributes for Disaster Recovery........................ 124

GeneralizationOverview As a network that replaces PSTN network with new integrated tech-

nology, NGN, with very large capacity, is applied on a large scale.Being the core control equipment of NGN, SS is required to behighly reliable in network. Once SS (the important node to processsignaling) breaks down, the disastrous influence splits over a widerange of network. The implementation of remote disaster recoveryeffectively avoids the influence caused by breakdown SS, ensuringthe network reliability.

From the network point, the remote disaster recovery meets im-portant requirements of NGN network security. When a main SSbreaks down in the network, another backup SS starts to work toprovide the same services.

Configuration FlowOverview There are total three steps regarding the disaster recovery config-

uration.

1. Configure the disaster recovery policy

2. Configure the disaster recovery users

3. Configure the switchover mode and detection method for dis-aster recovery.



Configuring DisasterRecovery Policy

Context A-SBC’s signal-group allows multiple SS/CSCF devices as the next-hop for signaling. Therefore, the simple disaster recovery policybased on each user is practicable.

This topic describes the procedure to configure the disaster recov-ery policy.


2. Enter the signal-group mode.SBC(config-sbc-sp)#signal-group <1-65535>

Note:

The main configuration of the physical SPE is performed in thesignal Portal configuration mode.

At present, system allows 1024 signal-groups.

3. Configure the address couple for local signaling.SBC(config-sbc-sp-sg)#signal uni-address {ipv4|ipv6} <ip-address>nni-address {ipv4|ipv6} <ip-address>

4. Configure the protocol ports for local signaling.SBC(config-sbc-sp-sg)#port {(sip uni-side{uni-udpport <1-19999>|uni-tcpserverport <1-5999>{short|long}|uni-tcpclientport <1-5999>}nni-side { nni-udpport <1-19999>|nni-tcpserverport <1-5999>{short|long}|nni-tcpclientport <1-5999>})|(mgcp uni-port <1-19999>nni-port <1-19999>)|(h248 uni-port <1-19999> nni-port <1-19999>)|( h323 uni-rasport <1-19999> uni-callport <1-19999> nni-rasport<1-19999> nni-callport <1-19999>)}

5. Enter the next-hop configuration mode for signaling and con-figure the main SS.SBC(config-sbc-sp-sg)#signal-nexthop id <1-65535>

6. Configure the protocol address for the main SS.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[weight <0-100>|track id <1-65535>]

7. Configure the protocol port number for the main SS.SBC(config-sbc-sp-sg-snh)#port {sip|mgcp|h248} <1-65535>

8. Enter the next-hop configuration mode for signaling and con-figure the standby SS.SBC(config-sbc-sp-sg)#signal-nexthop id <1-65535>


Chapter 11 Disaster Recovery Configuration

9. Configure the protocol address and track policy for the standbySS.SBC(config-sbc-sp-sg-snh)#ip-address {ipv4|ipv6} <ip-address>[weight<0-100>|track id <1-65535>]

Note:

Such command enables the standby SS to track the active SS.

10.Configure the protocol port number for the standby SS.SBC(config-sbc-sp-sg-snh)#port {sip|mgcp|h248} <1-65535>

END OF STEPS

Result The operator successfully configures the disaster recovery policy.

Example As shown in Figure 41, SBC has two sets of SS. One SS(222.1.1.108) functions normally, and the other SS (58.1.1.108)acts as the standby system in case of disaster recovery.

FIGURE 41 DISASTER RECOVERY NETWORKING

1. Configure the signal-group 1 for SPE.SBC(config-sbc)#signal-portalSBC(config-sbc-sp)#signal-group 1SBC(config-sbc-sp-sg)#signal uni-address ipv4 210.10.1.1 nni-address



ipv4 204.10.1.1SBC(config-sbc-sp-sg)#port sip uni-side uni-udpport 5060 nni-sidenni-udpport 5060

2. Configure the first nexthop as the active SS.SBC(config-sbc-sp-sg)#signal-nexthop 1SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108SBC(config-sbc-sp-sg-snh)#port sip 5060

3. Configure the second nexthop as the standby SS.SBC(config-sbc-sp-sg)#signal-nexthop 2SBC(config-sbc-sp-sg-snh)#ip-address ipv4 222.1.1.108 track id 1SBC(config-sbc-sp-sg-snh)#port sip 5060

Configuring SIP TerminalFixedly-Affiliated to SS

Context This topic describes the procedure to configure a user used to de-tect heart beat information between the active SS and standby SS.

Steps 1. Enter the signal-portal configuration mode.SBC(config-sbc)#signal-portal

2. Enter the nexthop-track-switchconfiguration mode.SBC(config-sbc-sp)#nexthop-track-switch

3. Configure the SIP terminal fixedly-affiliated to SS.SBC(config-sbc-sp-nts)#nexthop-user <WORD>

END OF STEPS

Result The operator successfully configures the SIP terminal fixedly-affil-iated to SS.

Configuring Attributes forDisaster Recovery

Context This topic describes the procedure to configure the attributes (likedisaster recovery mode, switchover mode as well as detectionmethod) for disaster recovery.

Steps 1. Enter the maintenance configuration mode.SBC(config-sbc)#maintenance

2. Enter the nexthop-track-switch configuration mode.SBC(config-sbc-ma)#nexthop-track-switch


Chapter 11 Disaster Recovery Configuration

3. Activate the SIP terminals fixedly-affiliated to SS.SBC(config-sbc-ma-nts)#activate nexthop-user {<user name>|all}signal-group <1-65535> signal-nexthop <1-65535>

Note:

The no command is used to cancel the setting.

SBC(config-sbc-ma-nts)#no activate nexthop-user {<user name>|all}signal-group <1-65535> signal-nexthop <1-65535>

4. Switch the standby SS which the SIP terminal (in a designatedgroup) is affiliated to the active SS.SBC(config-sbc-ma-nts)#active {{[signal-group <1-65535>]}}[signal-nexthop <1-65535>]

5. Switch the active SS which the SIP terminal (in a designatedgroup) is affiliated to the standby SS.SBC(config-sbc-ma-nts)#active {{[signal-group <1-65535>]}}[signal-nexthop <1-65535>]

6. Enable/Disable the IP auditing to restrict information fromother SS not related to the specified users.SBC(config-sbc-ma-nts)#nexthop-soucreip-auditing {disable|enable}

7. Enable/Disable the silence keeping for the SIP terminals.SBC(config-sbc-ma-nts)#keep-silence {disable|enable}

8. Configure the state of the SS which a designated group is af-filiated to.SBC(config-sbc-ma-nts)#nexthop-state {dynamic-offline|dynamic-online|permanent-offline|permanent-online} signal-group<1-65535> [signal-nexthop <1-65535>]

9. Configure the switching method for active/standby SS.SBC(config-sbc-ma-nts)#switch-method {immediate|smooth}

10.Configure the switching mode for active/standby SS.SBC(config-sbc-ma-nts)#switch-mode {auto|manual}

END OF STEPS

Result The operator successfully configures attributes for disaster recov-ery.





C h a p t e r 12

Charging Configuration

Table of ContentsGeneralization................................................................. 127CDR Generation .............................................................. 128CDR Configuration ........................................................... 128

GeneralizationOverview With the increasing expansion of the communication networks at

home and abroad as well as the rapid growth of various commu-nication management telecom services, SBC, as the key positionregarding signaling and media flow for IMS and NGN, plays an in-creasingly large role. The use of SBC’s signaling, media flow aswell as state realizes the centralized monitoring. Then, the ac-quisition of the real-time operation state for SBC helps the deci-sion makers to make decisions regarding the network operation& maintenance management, service management analysis, net-work planning and charging.

CDR or TDR, the basic format the monitoring system uses for datastorage, provides original data for the application-layer function ofthe background OMM system.

CDR is mainly used to

� Record call duration and flow

� Export the call progresses to files

� Upload the call records to specified FTP server

Note:

CDR is not achieved in MPE.

TDR is mainly used to register related records regarding the trans-action processing.

� When a user registers to SBC, system starts to record theuser’s registration information and generates a TDR.

� When a user’s registration information refreshes, records therefresh time.

� When a user logs out, records the log-out time and generatesa TDR.



CDR GenerationOverview A CDR is used to record the contents of a call which occurs. A

new CDR is generated when the call ends. During the call process,related flow information is updated when the flow is reported.

The CDR function is mainly used to collect and export tickets re-lated to calls. CDR

1. Collects information related to a call which occurs.

2. Generates a CDR according to the collected contents after thecall ends, and exports the CDR to the buffer area in a fixedbinary format.

3. When the number of CDRs in the buffer area reaches thethreshold or the CDR division time is up, writes these CDRs toa file.

4. When the FTP output time (set by MML) is up, uses the FTPtool to export these CDR files in the hard disk to the receivingserver.

5. If the hard disk fails to store more data, use the hard diskcapacity checking mechanism to check if the data previouslystored in the hard disk reaches the threshold the minor alarmallows. If so, generates the minor alarm.

6. When the number of CDR files reaches the threshold the majoralarm allows, starts to send the CDR files to OMM in the trapway.

7. When the capacity reaches the threshold the critical alarm al-lows, deletes files from the hard disk.

CDR ConfigurationEnabling CDR Function

Context This topic describes the procedure to enable the CDR function.

Note:

Tickets are generated only when the CDR/TDR function is enabled.

Steps 1. Enter the billing mode.SBC(config-sbc)#billing

2. Enable/Disable the CDR/TDR function.SBC(config-sbc-billing)#billing {cdr|reg-tdr} {disable|enable}


Chapter 12 Charging Configuration

END OF STEPS

Result The operator successfully enables the CDR function.

Configuring FTP Parameters forUpload CDR

Context This topic describes the parameters for upload CDR files in FTPway.


2. Enable/Disable the FTP client to export CDR files.SBC(config-sbc-billing)#ftp client {enable|disable}

3. Set the IP address and port number of the FTP server the CDRfiles are exported to.SBC(config-sbc-billing)#ftp client remote-ip-address {ipv4|ipv6}<ip-address> remote-port <port>

4. Set the user name and password for the FTP client to accessthe FTP server.SBC(config-sbc-billing)#ftp client remote-user username <string>password <string>

5. Set the interval to receive CDR files for the FTP server.SBC(config-sbc-billing)#ftp client timer put-interval <60-2592000>

END OF STEPS

Result The operator successfully configures FTP parameters for uploadCDR.

Configuring Public Attributes

Context This topic describes the procedure to set B200’s ID and the car-rier’s ID.


2. Set B200’s ID.SBC(config-sbc-billing)#local-id <0-65535>

3. Set the carrier’s ID.SBC(config-sbc-billing)#carrier-id <must be 4 characters>



END OF STEPS

Result The operator successfully configures the public attributes.

Setting CDR Division Interval

Context This topic describes the procedure to generate a CDR file or TDRfile in B200’s hard disk every preset seconds.


2. Set the division interval for CDR files.SBC(config-sbc-billing)#timer split-interval <60～2592000>

END OF STEPS

Result The operator successfully sets the CDR division interval.


C h a p t e r 13

Operation andMaintenanceConfiguration

Table of ContentsSignaling Tracking ........................................................... 131SNMP Configuration ......................................................... 135SSH Configuration ........................................................... 138SysLog Configuration ....................................................... 140RMON Configuration......................................................... 141

Signaling TrackingTracking H.248 Protocol

Context This topic describes the procedure to track the H.248 protocol.

Steps 1. Enter signal-tracing configuration mode.SBC(config-sbc-ma)#signal-tracing

2. Track the H.248 messages according to the domain name inthe signal-tracing configuration mode.SBC(config-sbc-ma-trace)#trace h248 node domainname

3. Track all H.248 messages.SBC(config-sbc-ma-trace)#trace h248 node bgwh248

Note:

If there are multiple terminals, the use of such command bringssome loads to the equipment. So, the operator must be cau-tious enough to use it.

4. Enable the printing function to display the tracked messagesin the privileged mode.SBC#Terminal monitor



5. Cancel the H.248 signaling tracking.SBC(config-sbc-ma-trace)#stop tracing h248

6. Cancel all protocol signaling tracking.SBC(config-sbc-ma-trace)#stop tracing all

7. Disable the printing function.SBC#no terminal monitor

END OF STEPS

Result The operator successfully tracks the H.248 protocol according torequirements.

Example The following example shows the H.248 messages regarding theIAD whose domain name is 00D0D0334455 are tracked.SBC(config-sbc-ma-trace)#Trace h248 node 00D0D0334455

Tracking MGCP Protocol

Context This topic describes the procedure to track the MGCP protocol.


2. Track the MGCP messages according to the domain name inthe signal-tracing configuration mode.SBC(config-sbc-ma-trace)#trace mgcp node domainname

3. Track all MGCP messages.SBC(config-sbc-ma-trace)#trace mgcp node mgcp

Note:


4. Enable the printing function to display the tracked messagesin the privileged mode.SBC#Terminal monitor

5. Cancel the MGCP signaling tracking.SBC(config-sbc-ma-trace)#stop tracing mgcp



END OF STEPS


Chapter 13 Operation and Maintenance Configuration

Result The operator successfully tracks the MGCP protocol according torequirements.

Example The following example shows the MGCP messages regarding theIAD whose domain name is 00D0D0334455 are tracked.SBC(config-sbc-ma-trace)#Trace mgcp node 00D0D0334455

Tracking SIP Protocol

Context This topic describes the procedure to track the SIP protocol.


2. Track the SIP messages according to the domain name in thesignal-tracing configuration mode.SBC(config-sbc-ma-trace)#trace sip node domainname

3. Track all SIP messages.SBC(config-sbc-ma-trace)#trace sip node sip

Note:


4. Enable the printing function to display the tracked messagesin the privileged mode.SBC#terminal monitor

5. Cancel the SIP signaling tracking.SBC(config-sbc-ma-trace)#stop tracing sip



END OF STEPS

Result The operator successfully tracks the SIP protocol according to re-quirements.

Example The following example shows the SIP messages regarding the SIPterminal (52870000) are tracked.SBC(config-sbc-ma-trace)#Trace sip node 52870000



Tracking H.323 Protocol

Context This topic describes the procedure to track the H.323 protocol.


2. Track the H.323 messages according to the domain name inthe signal-tracing configuration mode.SBC(config-sbc-ma-trace)#Trace h323 module <group number>[C <phone code> I <time> M <show mode> T <tracetype>]

Parameters description:


Group num-ber

Group number supporting H323, ranging from 1 to65535.

Phone codePhone number supporting H323, containing 1-63characters.

Time Length

Valid time length of a signaling tracing task, rangingfrom 1 to 65535, in 30s. The default value is 20,that is, 600s.

Show mode

Message type for signaling tracing. The range is 0-2,where 0: Decode Msg, 1: ALL Msg, 2: Only MsgHead.

TraceTypeSignaling tracing type. The range is 0-2, where 0:Regist, 1: Call Msg, 2: ALL Msg.

3. Track all H.323 messages.SBC(config-sbc-ma-trace)#trace h323 by-all

Note:


4. Enable the printing function to display the tracked messagesin the privileged mode.SBC#terminal monitor

5. Cancel the H.323 signaling tracking.SBC(config-sbc-ma-trace)#stop tracing h323


7. Disable the printing function.



SBC#no terminal monitor

END OF STEPS

Result The operator successfully tracks the H.323 protocol according torequirements.

Example Trace signaling for the message head of the H323 registration mes-sage on group 1 for five minutes:SBC(config-sbc-ma-trace)#trace h323 module 1 C 12345 T 0 M 2 I 10

SNMP ConfigurationOverview

Overview The Simple Network Management Protocol (SNMP) is a most pop-ular network management protocol. Its target is to transmit man-agement information between two random points, which helps thenetwork management administrator to search information at anynetwork node, correct information, search failures, diagnose fail-ures, plan capacity and create reports.

Polling mechanism is applied in SNMP to provide collections of basicfunctions, applicable in the small, rapid and low cost environment.Only the unauthenticated UDP is applied in SNMP, thus supportedby a wide selection of products.

SNMP functions on the basis of the C/S mode. The backgroundOMM server acts as SNMP server, and the foreground networkequipment acts as the SNMP client. Both the background and theforeground share the same MIB management database, commu-nicating with each other through the SNMP protocol. For B200 asthe SNMP agent, it is necessary to configure the designated SNMPserver as well as define the contents and rights which OMM col-lects. Furthermore, B200 supports variable SNMP versions.

Commands Introduction

SNMP-ServerCommunity

� Syntax

snmp-server community <community-name> [view <view-name>] [ro|rw]

� Purpose

To set the SNMP message community

� Usage Guidelines

It is a global command. The community authentication modeis applied in SNMPv1/v2c. SNMP community uses a string forits name. Such access rights as the read-only and read-writerights are allocated for different communities. For a commu-



nity with the read-only right, it can only query equipment in-formation. For a community with the read-write right, it canconfigure the equipment besides querying equipment informa-tion.

The SNMP community’s right is limited by view, no matterwhat kind of right (the read-only right or read-write right) theSNMP community has. Operations are permitted only withinthe range of view. If view is omitted, the default parameterDefaultView is used. If ro/rw is omitted, ro (i.e., read-only) isused.

SNMP-Server View � Syntax

snmp-server view <view-name> <subtree-id> {included|ex-cluded}

� Purpose

To define SNMPv2 view


It is a global command, which uses included or excluded to addsubtree-ID to a designated view or remove it from the view.After commands with the same view-name but with differentsubtree-IDs are executed for several times, an intersection setis created.

SNMP-ServerContact

� Syntax

snmp-server contact <mib-syscontact-text>

� Purpose

To set the contact information for the system principal regard-ing the MIB object


SysContact, a management variable in MIB II’s system group,lists the ID and contact information for the person related tothe controlled equipment.

SNMP-ServerLocation

� Syntax

snmp-server location <mib-syslocation-text>

� Purpose

To set the place where MIB object is located


As a global command, SysLocation refers to a managementvariable in MIB II’s system group, which is used to display thelocation where the controlled equipment is located.

SNMP-ServerEnable Trap

� Syntax

snmp-server enable trap [<notification-type>]

� Purpose

To set the trap type the agent sends


It is a global command. TRAP refers to information automat-ically sent by the controlled equipment to NMS without anyrequest, used to report some emergent & important events.



SNMP-Server Host � Syntax

snmp-server host [mng|vrf <vrf-name>] <ip-address>[trap|inform] [version {1|2c|3 {auth|noauth|priv}}] <com-munity-name> [udp-port <udp-port>] […<trap-type>]

� Purpose

To set the sending address, port, version & type for the Param-eter trap or Parameter inform regarding the host.


B200 supports five routine traps, i.e., snmp, bgp, ospf, rmon,stalarm.

SNMP-ServerGroup

� Syntax

snmp-server group <group-name> v3 [auth|noauth|priv][notify|read|write] <community-name>[notify <commu-nity-name>]

� Purpose

To set the name of snmpv3 group, authentication & encryptionmode, read/write operation, community string, etc.

SNMP-Server User � Syntax

snmp-server user <user-name><group-name> v3 [auth|en-crypted] [md5|sha] <password>[pri des56<password>]

� Purpose

To set the name of snmpv3 user, group name, authentication& encryption mode, etc.


It is a global command. During the configuration of the userauthentication & encryption mode and the group authentica-tion & encryption mode, OMM successfully sets snmp connec-tion with B200 only when the user’s security level completelymatches with (or has a higher priority over) the group’s secu-rity level.

Show SNMP � Syntax

show snmp

� Purpose

To displays statistics concerning the SNMP messages

An Example for SNMP Configuration

Overview An example for SNMP configuration is as follows.SBC(config)#snmp-server community public view AllView roSBC(config)#snmp-server community private view AllView rwSBC(config)#snmp-server trap-source 100.100.240.1 //Configure the sourceIP address in the trap messageSBC(config)#snmp-server enable trapSBC(config)#snmp-server host 10.44.112.73 trap version 2c public udp-port 162// configure the IP address of the trap server, check string, version numberas well as the sending port regarding the trap serverSBC(config)#unm onSBC(config)#unm server 10.44.112.73 public



SSH ConfigurationOverview

Traditional network service programs, such as ftp, pop, and telnet,are not safe in nature. Due to the transmission of passwords anddata in the plaintext form in the network, it is very easy to acquirepasswords and data by other ill-disposed persons. Furthermore,these service programs are easy to be attacked by the “man-in-the-middle” due to the weak points in their security authenticationmodes.

The “man-in-the-middle” receives data sent to the server by pre-tending to be the real server, and then sends data to the real serverby pretending to be the opposite end. As a result, serious prob-lems arise due to ill-modified data from “the middle man”.

Secure Shell (SSH) encrypts all transmission data to prevent notonly attacks from “the middle man”, but also DNS deception andIP deception. In addition, transmitted data are compressed toaccelerate the transmission speed. SSH acts as not only the telnettool, but also as the ftp or pop tool, even provides a safe “channel”for Point-to-Point protocol (PPP).

SSH is composed of the client software and server software, withtwo incompatible versions, i.e., Version 1.x and Version 2.x. Theclient program with Version SSH 2.x can not connect to the serverprogram with Version SSH1.x. OpenSSH is a software packageused to replace SSH, supporting both Version SSH1.x and VersionSSH2.x.

From the client’s point, SSH provides the following two safety au-thentication modes in different two levels.

� Password-based safety authentication: The operator logs inthe remote host as long as the operator knows his accountand password. The encryption of all transmission data doesnot mean the operator can log in the real server. Sometimes,another server acts as the real server, i.e., “the middle man”launches attacks.

� Key-based safety authentication: The operator creates a pairof keys and put the public key in the server to be accessed.If the operator wants to connect to the SSHserver, the clientsoftware sends a request to the server, requiring safety au-thentication on your key.

After receiving the request, the server searches the public keyin the root directory of the server, and then compares it with thekey sent from the operator. If the two keys are consistent, theserver encrypts the “challenge” with the public key, and sendsthe “challenge” to the client. After receiving the “challenge”,the client decrypts it with the operator’s private key and sendsthe “challenge” to the server.



Configuring SSH

Context This topic describes the procedure to set related information re-garding SSH, such as the group number of the radius server aswell as the server authentication mode.

Steps 1. Enter the global configuration mode.SBC#configure terminal

2. Set the group number of the radius server for SSH authenti-cation.SBC(config)#ssh server authentication <ispgroup>

3. Set the authentication mode (local or Radius) for the SSHserver.SBC(config)#ssh server authentication mode <local >|<Radius>

4. Set the authentication type for the SSH server.SBC(config)#ssh server authentication type <chap>|<pap>

Note:

� CHAP refers to Challenge Handshake Authentication Proto-col, which performs periodical authentication through thethree-way handshake. Once set, CHAP is used only onceafter the initiation of links. Without any inquiry, CHAP stillallows the calling party to attempt an authentication.

� PAP refers to Password Authentication Protocol, which con-firms the caller party’s validity through the two-way hand-shake. PAP forwards its password in the plaintext formthrough the link, and does not have any protection for at-tacks concerning repeated password guessing.

PAP’s password, instead of CHAP’s password, is captured inthe link through the protocol analyzer, the reason of whichis CHAP uses the MD5 algorithm to transmit its passwordin the form of cipher text through the link.

5. Enable the SSH service.SBC(config)#ssh server enable

6. Generate the key for the SSH server.SBC(config)#ssh server generate-key

7. Set the login way which only uses the SSH authentication, ex-cluding the telnet way.SBC(config)#ssh server only

8. Set the version of SSH.SBC(config)#ssh server version



END OF STEPS

Result The operator successfully configures related information regardingSSH.

An Example for SSH Configuration

Overview The following example sets the authentication mode to the localmode.SBC(config)#ssh server authentication mode local

SysLog ConfigurationOverview

Overview B200 provides the log setting function and the log query functionfor users. Log information provides much convenience for the op-erator to perform routine maintenance on the gateway. Thanksto the syslog function, the alarm information of the gateway andstate changes of interfaces can be queried. Log information is dis-played in the configuration terminals in real time, or stored in thegateway or background log server in the form of files. After thesyslog protocol in B200 is enabled, the transmission of log infor-mation, through the communication between the syslog protocoland background syslog server, is practicable.


Syslogon � Syntax

syslog on

� Purpose

To enable the log function (it is a global command)

SyslogLevel � Syntax

Sysloglevel level

� Purpose

To set the log level stored in the log buffer (it is a global com-mand)

SyslogServer � Syntax

syslog server [vrf <vrf-name>|mng] <ftp-server> <user-name> <password> [<filename>]



� Purpose

To set parameters of the background FTP log server (it is aglobal command)

An Example for SysLog Configuration

Overview An example for system log setting is as follows. Before configu-ration, it is necessary to enable the log function by running thesyslog on command.SBC(config)#syslog onSBC(config)#syslog level errorsSBC(config)#syslog server mng 168.1.70.100 lport 65535

Note:

The log information setting is performed in the config mode, noneed to enter the sbc configuration mode.

RMON ConfigurationOverview

Overview Remote Network Monitoring (RMON) is used to monitor remotenetwork services. Through RMON, data acquisition & process-ing are implemented in a remote detector, i.e., local B200. B200contains a RMON agent software used to communicate with OMMthrough SNMP. Messages are transmitted to OMM only when nec-essary.


RMON CollectionStatistics

� Syntax

rmon collection statistics <index> [owner <string>]

� Purpose

To enable the statistics function of the interface (it is only ap-plicable for Ethernet)

RMON Alarm � Syntax

rmon alarm <index> <variable> <interval> {delta|abso-lute}rising-thershold <value> [<event-index>] falling-thresh-old <value> [<event-index>] [owner <string>]



� Purpose

To set alarms and the MIB object (it is a global command)

RMON CollectionHistory

� Syntax

rmon collection history <index> [owner <string>] [bucket<bucket-number>] [interval <seconds>]

� Purpose

To enable the history collection function for the interface (it isan interface command)

RMON Event � Syntax

rmon event <index> [log] [trap<community>] [description<string>] [owner <string>]

� Purpose

To configure an event (it is a global command)

Show RMON � Syntax

show rmon [alarms] [events] [history] [statistics] [task]

� Purpose

To display RMON configuration and related information (it is aprivileged command)

Examples for RMON Configuration

Overview There are several examples for RMON configuration as follows.

� Sets and enables the RMON statistical control articleSBC(config)#interface fei_1/1SBC(config-if)#rmon collection statistics 1 owner rmontestSBC(config-if)#

Suppose there are several PCs connected to the Interfacefei_1/1. When these PCs function in the sub-network, theoperator can view flow statistics data through OMM softwareor by running the show command.SBC#show rmon statisticsEtherStatsEntry 1 is active, and owned by rmontestMonitors ifEntry.1.1 which hasReceived 60739740 octets, 201157 packets,1721 broadcast and 9185 multicast packets,0 undersized and 0 oversized packets,0 fragments and 0 jabbers,0 CRC alignment errors and 32 collisions.#of dropped packet events (due to lack of resources): 511#of packets received of length (in octets):64: 92955, 65-127: 14204, 128-255: 1116,256-511: 4479, 512-1023: 85856, 1024-1518:2547SBC#

� Sets and enables the RMON history control articleSBC(config)#interface fei_1/1SBC(config-if)#rmon collection history 1 bucket 10 interval 10 owner rmontestSBC(config-if)#



The operator can view the RMON history information by run-ning the show command.SBC#show rmon historyEntry 1 is active, and owned by rmontestMonitors ifEntry.1.1 every 10 secondsRequested #of time intervals, ie buckets, is 10Granted #of time intervals, ie buckets, is 10Sample #1 began measuring at 00:11:00Received 38346 octets, 216 packets,0 broadcast and 80 multicast packets,0 undersized and 0 oversized packets,0 fragments and 0 jabbers,0 CRC alignment errors and 0 collisions.#of dropped packet events is 0Network utilization is estimated at 1

� Sets and enables the RMON alarm control articleSBC(config)#rmon alarm 1 system.3.0 10 absolute rising-threshold1000 1 Falling-threshold 10 1 owner rmontest// In the rmon alarm command, Parameter Falling event index begins with 1.SBC(config)#

The operator can view the RMON alarm information by runningthe show command.SBC#show rmon alarmsAlarm 1 is active, owned by rmontestMonitors system.3.0 every 10 secondsTaking absolute samples, last value was 54000Rising threshold is 1000, assigned to event 1Falling threshold is 10, assigned to event 0On startup enable rising or falling alarmSBC#

� Sets and enables the event functionSBC(config)#rmon event 1 log trap rmontrap description test owner rmontestSBC(config)#

The operator must wait for 10 seconds after setting an alarmcontrol article, and then runs the show command to view con-tents of the RMON event.SBC#show rmon eventsEvent 1 is active, owned by rmontestDescription is testEvent firing causes log and trap to community rmontrap, last fired 05:40:20Current log entries:

index time description1 05:40:14 test

SBC#





Figures

Figure 1 The Connection Description dialog box ...................... 2

Figure 2 The Connect to dialog box ....................................... 3

Figure 3 The COM1 Properties dialog box ............................... 3

Figure 4 Constructing Configuration Environment Through

LAN .................................................................. 6

Figure 5 Constructing Configuration Environment Through

WAN ................................................................. 6

Figure 6 Running Telnet Command........................................ 7

Figure 7 An Example for The Ethernet Router Switch

Configuration ...................................................14

Figure 8 An Example for SMARTGROUP Configuration .............18

Figure 9 An Example For VLAN Sub-Interface ........................20

Figure 10 An Example for Static Routing Configuration............22

Figure 11 Configuring Networking for Working Roles...............24

Figure 12 Configuration Flow (User-Location Way) .................25

Figure 13 Configuration Flow (User-Location-Default Way) ......25

Figure 14 A Typical Networking (SBC Acts As The Access

Device) ............................................................30

Figure 15 A Typical Networking (Integrated SBC Acts As the

Access Device) ..................................................32

Figure 16 Basic Configuration Flow For Separated SBC............34

Figure 17 A Typical Networking For Seperated SBC.................39

Figure 18 Cross-Domain Interworking Networking..................41

Figure 19 Inter-Domain Interworking + Active/Standby SS

Mode ...............................................................42

Figure 20 An Example to Configure Protocol Port Resources

for Local Signaling .............................................44

Figure 21 An Example to Configure Protocol Port Resources

for Local Signaling .............................................46

Figure 22 A Networking Example .........................................47

Figure 23 An Example for Load Balancing..............................50

Figure 24 An Example for MPE Address Multiplexing (For

Media) .............................................................52



Figure 25 An Example for MPE Single-Address (For Media)

Multiplexing ......................................................54

Figure 26 Media Strait Interconnection For Public Network

Users in A User-Location.....................................55

Figure 27 Media Strait Interconnection For Private Network

Users in A User-Location.....................................57

Figure 28 Pat Application ....................................................70

Figure 29 The Processing Flow for Register Event...................73

Figure 30 The Service Processing Flow for Call/Update............74

Figure 31 Configuring Static Registration Users......................78

Figure 32 The Emergency Call Sketch Map ............................81

Figure 33 The Application Scene for CAC...............................87

Figure 34 Structure of the DS Field ......................................90

Figure 35 QoSPolicy Configuration .......................................94

Figure 36 Relationships Among Reserve Profiles, Policy

Groups and User Groups.....................................96

Figure 37 One Application of ACL ....................................... 105

Figure 38 SIP Encryption .................................................. 109

Figure 39 Cold Backup Configuration Networking ................. 116

Figure 40 Hot Backup Networking ...................................... 118

Figure 41 Disaster Recovery Networking ............................. 123


Glossary

BRAS- Broadband Remote Access Server

CAC- Connection Admission Control

CPU- Central Processing Unit

MPE- Media Portal Element

PAT- Port Address Translation

QoS- Quality of Service

SBC- Session Border Controller

SPE- Signal Portal Element

TCP- Transfer Control Protocol

UDP- User Datagram Protocol

VLAN- Virtual Local Area Network

VRRP- Virtual Router Redundancy Protocol


Documents

ZXSS10 B200(V2.00.50) Data Configuration_EN