Local Configuration of 4G ENodeB Using USB Memory Stick_V0.1

Local Configuration Of 4G eNodeB Using USB Memory Stick

Confidential

Local Configuration Of 4G eNodeB Using USB Memory Stick (Including CME XML file preparation)

Arno


Confidential

Document revision history: Version 0.1

Date 30.04.2013

Comments Initial version

Author Frank Garofano


Confidential

Contents 1. Scope ....................................................................................................................... 4 2. Required Tools ........................................................................................................ 4 3. Prepare the XML file ............................................................................................... 5 4. Prepare the USB Memory Stick............................................................................. 10 5. Download and activate the XML file on the eNodeB ........................................... 16 6. Install the O2 Root Certificate Manually from M2000 ......................................... 17 7. Summary Template; Field Explanations ............................................................... 20 8. 7.2 From the summary data template; common data tab ................................... 23 9. 7.3 LTE Design Principle including IP ID numbers ................................................. 24 10. Reference Documents........................................................................................... 24


Confidential

1. Scope This procedure describes how to locally configure the 4G eNodeB using a USB memory stick. After successful activation of the USB commissioning file, the eNB will automatically download the Vodafone Root/Trust Certificate and Device certificate from the Certificate Authority. (CA) It will then use the acquired certificates to set up the IPSEC tunnels using the Public Key Infrastructure authentication architecture. (PKI) After the VF service and OAM IPSEC tunnels have been established, it is required to download the O2 Root/Trust certificate manually from M2000. The O2 trust certificate along with the previously acquired device certificate will be used to bring up the O2 IPSEC tunnel. Please be aware that the Root Certificate is referred to as a Trust certificate in the eNB. This is just another name for the operator root certificate described above. There will be one Root/Trust certificate for VDF and another one for O2. Only one device certificate is needed for both operators.

2. Required Tools: -

-

-

USB Stick provided by Huawei. (This is normally a Netac Branded USB stick, only USB sticks provided by Huawei can be used) Offline CME, Version V200R012C00SPC210 or later. eNodeB Summary Template correctly filled in with the required datafill. (The summary template is included in the zip file with this procedure) Please note the template may have been updated since this guide was written; please obtain the latest template from your colleagues. eNodeB Site Template which reflects the actual hardware configuration and includes all fields that are specified in the summary template. (An example site template is included in the zip file with this procedure) USB Protector Application. (Used to encrypt and integrity protect the data on the USB stick, the file is included in the zip file with this procedure) Full root read & write access to the USB stick in non encrypted mode. (A Huawei PC with CPM encryption cannot be used to prepare the USB stick, please use another PC)


Confidential

3. Prepare the XML file: 1) Create the eNodeB site template, this template should contain the actual hardware units which are to be used. It should also contain the same fields that are specified in the summary template. If the fields do not exist then you will not be able to import the data from the summary template. Please refer to example site template included with this procedure. You can use this as a template for creating your own.

2) You can view and import the site template by selecting >>Advanced>>Template Management.


Confidential

3) Check the template is using the correct software version that the eNodeB will use. It is recommended that the software version of the site template matches the software of the eNB. It’s possible to automatically upgrade the software as part of the USB commissioning process, more details can be found in chapter 3.3 of the eNodeB commissioning guide. (included in the Zip file with this document)

4) You can upgrade the template by selecting the template and clicking on the “upgrade” button as shown below. You can then select the SW version required, after upgrade both old and new templates will be shown. (Please ensure you have the correct LTE component installed in CME for the SW version you require)


Confidential

5) After importing the site template, it will be visible when you create a new eNB. Go to >>LTE Application>>Create eNodeB and the imported template will be available as shown below.


Confidential

6) After importing the template and creating a new eNodeB you can then modify the template as required and then save the site template. You can then use this new template in the summary data file in step 8.


Confidential

7) Fill in the summary data file; complete the Common Data, eNodeB Transport Data & eNodeB Radio Data tabs with the data you received from the customer. You can refer to section 7 of this document for explanations of some key parameters in the Transport Data tab. Please note the summary file included with this procedure contains actual data from the test bed, please remove this data and replace with your own.

8) Import the summary data file into CME. Select >>LTE Application>>Import Data as shown below:


Confidential

9) After Importing the new eNodeB is shown in CME. You can then export the eNodeB as an XML file, this file will be loaded onto the USB stick as described in section 4. Right click the eNodeB and select “Export eNodeB Data”.

4. Prepare the USB Memory Stick: 10) Format the USB memory stick. The volume name of the USB stick is not important and the default can be used when formatting. (empty) Do not copy any files onto the USB stick just yet.


Confidential

11) Once you have created and exported the XML file as described in section 3, you must encypt and integrity protect the data the on the USB stick otherwise the eNodeB cannot read the XML file. To do so, first rename the enodeB XML file to “CFGDATA.XML”, the name should be in UPPERCASE as shown below. Before:

After:

12) Create a folder on your computer in C:\Temp; name the folder “eNodeB”. The folder name is case sensitive.

13) Run the USBProtector.exe program.


14) In the menu bar, select >>One USB Setting>>Set Security Policies.

Confidential


Confidential

15) In the save path area, browse for the C:\Temp\eNodeB folder that you created earlier. You can use the default Encryption and Algorithm settings. After you select OK, you will find that a new USBConf.xml file has been created in the C:\Temp\eNodeB folder.


Confidential

16) In the menu bar, select >>One USB Setting>>Set USB Root Path. Browse for the C:\Temp\eNodeB folder that you created earlier.

17) Click the Add Files button and select the CFGDATA.XML file.


Confidential

18) Click the “IsEncypted:Index” checkbox and then click on “Execute Protect”. After successful encryption a pop window appears stating the operation has finshed.

19) Copy the “eNodeB” folder from C:\Temp to the ROOT of the USB memory stick. You must not use any form of encryption to copy the file, therefore you must use a Huawei PC without CPM encryption or use a non Huawei PC. (VDF PC for example)


Confidential

5. Download and activate the XML file on the eNodeB: 20) Check if the eNodeB is powered on. If it is not on, power on the eNodeB. 21) Check that all of the RFU’s are powered on and the CPRI cables are correctly connected between all of the RFU’s and LBBP board. 22) Wait until the eNodeB is in normal running status. The RED ALM LED should not be lit on any of the units. Wait until the RED ALM LED has switched off on the RRU and UMPT boards, this indicates normal operation. 23) Insert the USB memory stick into the USB port of the UMPT board. - Please wait for 1-2 minutes after inserting the USB stick for it to be read correctly. (Please do not remove the stick during this period) - Once the USB memory stick has been read successfully, the eNodeB will reset to activate the configuration. You can identify this because all the LED’s on the LBBP will change to RED shortly followed by the ALM LED’s on the RFU’s and UMPT boards. - After approximately 5 minutes the eNodeB should be ready. All ALM LED’s should be OFF. - If after 2 minutes you did not see the eNodeB restart then unplug the USB memory stick and power off the eNodeB for 2 minutes then repeat from step 20. - Please be aware that the same XML file can only be loaded ONCE onto the eNB. This is due to the CRC protection mechanism which prevents the same XML being repeatedly activated.


Confidential

6. Install the O2 Root Certificate Manually from M2000: 24) Check the root certificates installed in the eNodeB: DSP TRUSTCERT You will see that only a root certificate for VF exists.

25) Open the certificate management tool on M2000. >>>Security>>>Certificate Authentication Management>>>Certificate Management

26) Select the CA certificate tab.


Confidential

27) Select the correct eNB from the left hand window pane.

28) Click “Add” and then click “Import Certificate” from the batch Import CA Certificate window that appears.


Confidential

29) Select the O2 Root Certificate and ensure you select the right file extension. (.pem,.cer or .der)

30) Verify that the certificate download was successful. You can check the task located in the lower window pane in the certificate management tool. -

If the task fails, please use the SET FTPSCLT command to set the FTP transport encrypted mode to “Plain Text” and retry.

31) Check that the certificate has been downloaded to the eNB: DSP TRUSTCERT


Confidential

32) Check that the O2 IPSEC is now UP. - Each tunnel should have Phase 1 and 2 Established with an SA Flag of Ready|StayAlive. - If there is no entry listed then the tunnel is down.

7. Summary Template; Field Explanations: -

Here are some explanations of the key fields used in the summary template. Please note only the key parameters are explained, the others should be self explanatory.

7.1. From the summary data template; transport data tab:

Site Template: Should be the exact name of the site template you are using. Site Type and Cabinet Type: Should match the values inside the site template.


Confidential

OmCH LocalIP: Loopback IP for OAM. (IP10)

S1 Sig LogicIP0: Loopback IP towards VDF MME. (IP11) S1 Userplane Logic IP0: Loopback IP towards VDF SGW. (IP12) X2 Sig Logic IP0: Loopback IP towards VDF X2 CP&UP. (IP13)

S1 Sig LogicIP1: Loopback IP towards O2 MME. (IP14) S1 Userplane Logic IP1: Loopback IP towards O2 SGW. (IP15) X2 Sig Logic IP1: Loopback IP towards VDF X2 CP&UP. (IP16)

Local IP address for VF S1&OAM: External Device IP for VF S1&OAM, used for setting up the VF service and OAM tunnel. (IP1) Local IP address for VF X2: External Device IP for VF X2, used for setting up the VF X2 tunnel. (IP3) Local IP address for O2 S1&X2: External Device IP for O2 S1&X2, used for setting up the O2 tunnel. (IP5)


Confidential

Certificate Fetch Mode: This is set to CFG_INIT_UPD_ADDR. This means the eNB will automatically download the required certificates after USB deployment. It will also automatically update the certificates based on the certificate update task schedule. (CERTCHKTSK) Certificate Update Source IP: This is the source IP address used to update the certificate; it should be set to the OAM Loopback IP. (IP10) Source IP for Applying for a Certificate during Site Deployment: This is the source IP address used to apply for the root and device certificates after USB commissioning. It should be set to the S1&OAM device IP address. (IP1)

VF X2 Subnet: This is the destination subnet ID of the VF eNB used in X2 neighbor definitions. O2 X2 Subnet: This is the destination subnet ID of the VF eNB used in O2 neighbor definitions.

Mask for VF S1: Used as the destination mask for the following IP routes: VF S1, VF&02 SecGw’s, O2 MME’s. (Please see IPRoute pattern tab for exact mappings) Mask for VF X2: Destination Mask used for IPRT’s towards VF X2. Mask for VF O2: Destination Mask used for IPRT’s towards O2 X2.


Confidential

IPRoute NexthopIP1 & VLANID1: IP & VLAN ID for the gateway IP on the router used for VF S1&OAM. (IP2) IPRoute NexthopIP2 & VLANID2: IP & VLAN ID for the gateway IP on the router used for VF X2. (IP4) IPRoute NexthopIP3 & VLANID3: IP & VLAN ID for the gateway IP on the router used for O2 S1&X2. (IP6)

7.2 From the summary data template; common data tab:

M2000 IP: M2000 Destination IP used for OAM in LST OMCH command. M2000 Subnet: M2000 Destination Subnet IP used for OAM in LST IPRT command.

First Service IP: This is the destination of the SGW. O2 SGW Subnet: This is the destination subnet ID used for the IPRT to the pool of O2 Serving Gateways. (SGW’s) This information is used to create the IPRT. (Please see IPRoute pattern tab for exact mappings) O2 SGW Mask: Destination Mask used for IPRT’s towards O2 SGW’s. This information is used to create the IPRT. (Please see IPRoute pattern tab for exact mappings)


Confidential

7.3 LTE Design Principle including IP ID numbers:

8. Reference Documents -

Summary Template: CME_Template_Security_eRAN Sharing_Endpoint v1 4_testbed_modified.xls Site Template: BTS3900L_2_2_2_CA_test_v1.xml Chapter 3.3 & 4.5 of the eNodeB Commissioning Guide (V100R005C00_07)(PDF)-EN.pdf Slide 12 of IP Tx Design for GUL V1.8_20130306.pdf

Local Configuration of 4G ENodeB Using USB Memory Stick_V0.1

Recommend Documents