Project

General

Profile

Configuring the ipaccess nano3G » History » Version 12

neels, 06/21/2017 03:26 AM

1 2 neels
{{>toc}}
2 1 neels
3 2 neels
h1. Configuring the ip.access nano3G
4
5
h2. IP address
6
7
The ip.access nano3G will obtain an IP address from the DHCP server in your network.
8 5 neels
You can look it up there or watch wireshark, filtering on 'BOOTP' while the nano3G starts up.
9 2 neels
For this text, let's assume the IP address it obtained is 192.168.0.124.
10
11
h2. Initial Config
12
13
Once off, configure:
14
15
* the MCC + MNC,
16
* the UARFCN (i.e. the frequencies to transceive on) and
17
* the LAC and RAC.
18
19
You can do this on the _dmi_ console reachable by telnet:
20
21
<pre>
22
telnet 192.168.0.124 8090
23
dmi>
24
</pre>
25
26
On the dmi, enter commands like these:
27
28
<pre>
29
# PLMN Id == MCC + MNC
30
set mcc="901"
31
set mnc="98"
32
33
# [uarfcnDownlink, 1900 MHz band], [scramblingCode], [dummyCellId]
34
set rfParamsCandidateList=({9800, 401, 1})
35
36
# [lac], [rac]
37
set lacRacCandidateList=({10422, (99)})
38
</pre>
39
40
These settings persist across nano3G power down.
41
42
h2. Starting Operation
43
44
Every time you boot the nano3G, you need to
45
46
* set the IP address the nano3G will find the HNB-GW at.
47
* 2061 = set cell parameters
48
* 1216 = unlock ap
49
* activate HNB-GW connection
50
* set csg to open access so that any IMSI can register
51
52
Enter the _dmi_...
53
<pre>
54
telnet 192.168.0.124 8090
55
dmi>
56
</pre>
57
58
...and issue commands like:
59
60
<pre>
61
set hnbGwAddress="192.168.0.132" 
62
action 2061
63
action 1216
64
action establishPermanentHnbGwConnection
65
set csgAccessMode=CSG_ACCESS_MODE_OPEN_ACCESS
66
</pre>
67
68
h2. SSH Access
69
70
The nano3G come with a root password of 'newsys':
71
<pre>
72
ssh root@192.168.0.124
73
password: newsys
74
</pre>
75
76 9 roox
In case you are using a recent version of the OpenSSH-client you'll get the following error message while trying to connect:
77
_Unable to negotiate with 192.168.0.124 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1_
78
79
Starting with OpenSSH version 7.0 support for the 1024-bit diffie-hellman-group1-sha1 key exchange was disabled by default at run-time.
80
Use the following to connect to your nano3G in this case.
81
<pre>
82
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.0.124
83
</pre>
84
85 10 roox
h2. NTP
86
87
Be sure that the nano3G is able to resolve the DNS record _0.ipaccess.pool.ntp.org_ and can connect the the corresponding NTP servers.
88
Without syncronized NTP the nano3G does not bring up the TRX and it even do not try to connect to the hnbGw.
89 9 roox
90 2 neels
h2. Logging
91
92
When logged in via SSH, you can view the live logging here:
93
<pre>
94
ls /tmp/iapclogs/trace_*.log
95
</pre>
96
97
h2. Closed Mode
98
99
You can also set csgAccessMode to closed and allow only specific IMSIs:
100
101
<pre>
102 6 neels
set csgAccessMode=CSG_ACCESS_MODE_CLOSED_ACCESS
103 2 neels
# IMSI, 1:allowed/2:not allowed, phone number (only for "Closed Access")
104
set accessControlList = ({"001010123456015",  1, "81084"},{"001010123456025", 2, "81025"})
105
</pre>
106
107
(The phone number is actually not relevant)
108
109
h1. Peculiarities and Tips
110
111 12 neels
h2. Exiting the dmi while keeping it alive
112
113
When you exit the dmi telnet by hitting Ctrl-C, it will not be available anymore until you reboot the nano3G.
114
Every connection attempt will then end in
115
116
<pre>
117
dmi> Connection closed by foreign host.
118
</pre>
119
120
However, if you end your session by the telnet escape character and quitting, the dmi remains open for further connections. Usually that means: hit Ctrl-] and then enter 'quit':
121
122
<pre>
123
dmi> ^]
124
telnet> quit
125
</pre>
126
127 2 neels
h2. UE Register
128
129
The nano3G apparently passes the same identity received from the UE through to
130
the HNBAP UE Register Request message. This means that when the UE sends a
131
TMSI, the UE Register Request received by osmo-hnbgw contains no IMSI.
132
133 7 neels
In this scenario, the problem is that Paging apparently does not (always) work.
134 1 neels
So even though we have working code that allows HNBAP registration with
135 7 neels
a TMSI, that means that you can't (always) reach the UE from the CN.
136
This is not always the case, sometimes the nano3G can well page UEs that have
137
registered by TMSI. Vague idea: it may be that it needs to have seen the IMSI
138
once after power-cycling, e.g. after a closed-mode registration, and then
139
TMSI registration will not harm Paging. (TODO: clarify this)
140 2 neels
141 7 neels
The VTY configuration option to allow TMSI-only attaching to HNBGW, which
142
possibly helps to shorten your dev cycle but may harm paging, is:
143 2 neels
144
<pre>
145
hnbgw
146
 iuh
147 7 neels
  hnbap-allow-tmsi 1
148 2 neels
</pre>
149 1 neels
150 2 neels
Legacy workaround: connect the phone to a different network between retries (being
151
rejected suffices). That causes the UE to discard its TMSI and then use the IMSI
152
for the next registration.
153
154
A closed csgAccess with explicit IMSIs could help here to enforce that a UE
155 7 neels
indeed sends its IMSI to the nano3G and hence Paging should work.
156 3 neels
See also #1924.
157
158
h2. id-Reset
159
160
The nano3G seems to *not* send an id-Reset message upon connecting to the HNB-GW.
161
162
h2. Location Update failure due to timeout
163
164
If a UE seems to connect successfully at first but fails by timeout because the final
165
"TMSI Reallocation Complete" message is missing, this might be due to misconfiguration:
166
the CN is sending the wrong LAC or the PLMN-ID (NCC/MNC) is configured wrongly.
167
168
This might be confusing in the sense that a complete LU worked once but not after that;
169
GMM Attach may be successful; Security Mode Commands succeed; and so forth.
170 8 neels
Still the solution might be simply to fix the mobile network code in the osmo-msc.cfg.
171 4 neels
172
h2. RAB Assignment needs IuUP ACK Initialization
173
174
IuCS uses UP encapsulated in RTP. The UP starts off by sending an Initialization, replied
175
upon by an ACK Initialization.
176
177
The nano3G seems to not reply with an ACK when it receives an IuUP Initialization frame.
178
Thus it is not possible to merely echo its own RTP packets back to itself; instead, the
179
first RTP frame received from the nano3G (that is an IuUP Initialization) can be changed
180
to an ACK Initialization by writing 0xe4 to the first payload byte. Sending this back to
181
the nano3G then results in successful RAB Assignment.
182
183
(With the SysmoCell5000, echoing its own Initialization back to itself results in an ACK
184 1 neels
being sent, which we can also echo back to itself, so mere echoing works there.)
185 11 neels
186
A hack to make the nano3G work can be found on the neels/nano3G branch, but is currently
187
also kept on the sysmocom/iu branch (because it does not seem harm other femto cells).
Add picture from clipboard (Maximum size: 48.8 MB)