Configuring the ipaccess nano3G » History » Version 11
neels, 03/09/2017 05:38 PM
1 | 2 | neels | {{>toc}} |
---|---|---|---|
2 | 1 | neels | |
3 | 2 | neels | h1. Configuring the ip.access nano3G |
4 | |||
5 | h2. IP address |
||
6 | |||
7 | The ip.access nano3G will obtain an IP address from the DHCP server in your network. |
||
8 | 5 | neels | You can look it up there or watch wireshark, filtering on 'BOOTP' while the nano3G starts up. |
9 | 2 | neels | For this text, let's assume the IP address it obtained is 192.168.0.124. |
10 | |||
11 | h2. Initial Config |
||
12 | |||
13 | Once off, configure: |
||
14 | |||
15 | * the MCC + MNC, |
||
16 | * the UARFCN (i.e. the frequencies to transceive on) and |
||
17 | * the LAC and RAC. |
||
18 | |||
19 | You can do this on the _dmi_ console reachable by telnet: |
||
20 | |||
21 | <pre> |
||
22 | telnet 192.168.0.124 8090 |
||
23 | dmi> |
||
24 | </pre> |
||
25 | |||
26 | On the dmi, enter commands like these: |
||
27 | |||
28 | <pre> |
||
29 | # PLMN Id == MCC + MNC |
||
30 | set mcc="901" |
||
31 | set mnc="98" |
||
32 | |||
33 | # [uarfcnDownlink, 1900 MHz band], [scramblingCode], [dummyCellId] |
||
34 | set rfParamsCandidateList=({9800, 401, 1}) |
||
35 | |||
36 | # [lac], [rac] |
||
37 | set lacRacCandidateList=({10422, (99)}) |
||
38 | </pre> |
||
39 | |||
40 | These settings persist across nano3G power down. |
||
41 | |||
42 | h2. Starting Operation |
||
43 | |||
44 | Every time you boot the nano3G, you need to |
||
45 | |||
46 | * set the IP address the nano3G will find the HNB-GW at. |
||
47 | * 2061 = set cell parameters |
||
48 | * 1216 = unlock ap |
||
49 | * activate HNB-GW connection |
||
50 | * set csg to open access so that any IMSI can register |
||
51 | |||
52 | Enter the _dmi_... |
||
53 | <pre> |
||
54 | telnet 192.168.0.124 8090 |
||
55 | dmi> |
||
56 | </pre> |
||
57 | |||
58 | ...and issue commands like: |
||
59 | |||
60 | <pre> |
||
61 | set hnbGwAddress="192.168.0.132" |
||
62 | action 2061 |
||
63 | action 1216 |
||
64 | action establishPermanentHnbGwConnection |
||
65 | set csgAccessMode=CSG_ACCESS_MODE_OPEN_ACCESS |
||
66 | </pre> |
||
67 | |||
68 | h2. SSH Access |
||
69 | |||
70 | The nano3G come with a root password of 'newsys': |
||
71 | <pre> |
||
72 | ssh root@192.168.0.124 |
||
73 | password: newsys |
||
74 | </pre> |
||
75 | |||
76 | 9 | roox | In case you are using a recent version of the OpenSSH-client you'll get the following error message while trying to connect: |
77 | _Unable to negotiate with 192.168.0.124 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1_ |
||
78 | |||
79 | Starting with OpenSSH version 7.0 support for the 1024-bit diffie-hellman-group1-sha1 key exchange was disabled by default at run-time. |
||
80 | Use the following to connect to your nano3G in this case. |
||
81 | <pre> |
||
82 | ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.0.124 |
||
83 | </pre> |
||
84 | |||
85 | 10 | roox | h2. NTP |
86 | |||
87 | Be sure that the nano3G is able to resolve the DNS record _0.ipaccess.pool.ntp.org_ and can connect the the corresponding NTP servers. |
||
88 | Without syncronized NTP the nano3G does not bring up the TRX and it even do not try to connect to the hnbGw. |
||
89 | 9 | roox | |
90 | 2 | neels | h2. Logging |
91 | |||
92 | When logged in via SSH, you can view the live logging here: |
||
93 | <pre> |
||
94 | ls /tmp/iapclogs/trace_*.log |
||
95 | </pre> |
||
96 | |||
97 | h2. Closed Mode |
||
98 | |||
99 | You can also set csgAccessMode to closed and allow only specific IMSIs: |
||
100 | |||
101 | <pre> |
||
102 | 6 | neels | set csgAccessMode=CSG_ACCESS_MODE_CLOSED_ACCESS |
103 | 2 | neels | # IMSI, 1:allowed/2:not allowed, phone number (only for "Closed Access") |
104 | set accessControlList = ({"001010123456015", 1, "81084"},{"001010123456025", 2, "81025"}) |
||
105 | </pre> |
||
106 | |||
107 | (The phone number is actually not relevant) |
||
108 | |||
109 | h1. Peculiarities and Tips |
||
110 | |||
111 | h2. UE Register |
||
112 | |||
113 | The nano3G apparently passes the same identity received from the UE through to |
||
114 | the HNBAP UE Register Request message. This means that when the UE sends a |
||
115 | TMSI, the UE Register Request received by osmo-hnbgw contains no IMSI. |
||
116 | |||
117 | 7 | neels | In this scenario, the problem is that Paging apparently does not (always) work. |
118 | 1 | neels | So even though we have working code that allows HNBAP registration with |
119 | 7 | neels | a TMSI, that means that you can't (always) reach the UE from the CN. |
120 | This is not always the case, sometimes the nano3G can well page UEs that have |
||
121 | registered by TMSI. Vague idea: it may be that it needs to have seen the IMSI |
||
122 | once after power-cycling, e.g. after a closed-mode registration, and then |
||
123 | TMSI registration will not harm Paging. (TODO: clarify this) |
||
124 | 2 | neels | |
125 | 7 | neels | The VTY configuration option to allow TMSI-only attaching to HNBGW, which |
126 | possibly helps to shorten your dev cycle but may harm paging, is: |
||
127 | 2 | neels | |
128 | <pre> |
||
129 | hnbgw |
||
130 | iuh |
||
131 | 7 | neels | hnbap-allow-tmsi 1 |
132 | 2 | neels | </pre> |
133 | 1 | neels | |
134 | 2 | neels | Legacy workaround: connect the phone to a different network between retries (being |
135 | rejected suffices). That causes the UE to discard its TMSI and then use the IMSI |
||
136 | for the next registration. |
||
137 | |||
138 | A closed csgAccess with explicit IMSIs could help here to enforce that a UE |
||
139 | 7 | neels | indeed sends its IMSI to the nano3G and hence Paging should work. |
140 | 3 | neels | See also #1924. |
141 | |||
142 | h2. id-Reset |
||
143 | |||
144 | The nano3G seems to *not* send an id-Reset message upon connecting to the HNB-GW. |
||
145 | |||
146 | h2. Location Update failure due to timeout |
||
147 | |||
148 | If a UE seems to connect successfully at first but fails by timeout because the final |
||
149 | "TMSI Reallocation Complete" message is missing, this might be due to misconfiguration: |
||
150 | the CN is sending the wrong LAC or the PLMN-ID (NCC/MNC) is configured wrongly. |
||
151 | |||
152 | This might be confusing in the sense that a complete LU worked once but not after that; |
||
153 | GMM Attach may be successful; Security Mode Commands succeed; and so forth. |
||
154 | 8 | neels | Still the solution might be simply to fix the mobile network code in the osmo-msc.cfg. |
155 | 4 | neels | |
156 | h2. RAB Assignment needs IuUP ACK Initialization |
||
157 | |||
158 | IuCS uses UP encapsulated in RTP. The UP starts off by sending an Initialization, replied |
||
159 | upon by an ACK Initialization. |
||
160 | |||
161 | The nano3G seems to not reply with an ACK when it receives an IuUP Initialization frame. |
||
162 | Thus it is not possible to merely echo its own RTP packets back to itself; instead, the |
||
163 | first RTP frame received from the nano3G (that is an IuUP Initialization) can be changed |
||
164 | to an ACK Initialization by writing 0xe4 to the first payload byte. Sending this back to |
||
165 | the nano3G then results in successful RAB Assignment. |
||
166 | |||
167 | (With the SysmoCell5000, echoing its own Initialization back to itself results in an ACK |
||
168 | 1 | neels | being sent, which we can also echo back to itself, so mere echoing works there.) |
169 | 11 | neels | |
170 | A hack to make the nano3G work can be found on the neels/nano3G branch, but is currently |
||
171 | also kept on the sysmocom/iu branch (because it does not seem harm other femto cells). |