Project

General

Profile

Configuring the ipaccess nano3G » History » Version 36

tsaitgaist, 08/24/2019 09:50 AM
add SIB3 info for AC

1 2 neels
{{>toc}}
2 1 neels
3 2 neels
h1. Configuring the ip.access nano3G
4
5
h2. IP address
6
7 21 neels
The ip.access nano3G will obtain an IP address from the DHCP server in your network. Ways to find out:
8
9
* Run @abisip-find@ (currently in the osmo-bsc.git repository), which should find the nano3G (despite no Abis interface being present). Find the @abisip-find@ output matching the MAC address printed on the sticker next to the power jack.
10
* Watch wireshark, filtering on 'BOOTP' while the nano3G starts up.
11
* Look it up in your DHCP server's list of leases.
12
13 2 neels
For this text, let's assume the IP address it obtained is 192.168.0.124.
14
15
h2. Initial Config
16
17
Once off, configure:
18
19
* the MCC + MNC,
20
* the UARFCN (i.e. the frequencies to transceive on) and
21 25 tsaitgaist
* the LAC and RAC (max. 256)
22
* the Cell ID composed by RNC (12 bits) and HNB C-ID (16 bits)
23 2 neels
24
You can do this on the _dmi_ console reachable by telnet:
25
26
<pre>
27
telnet 192.168.0.124 8090
28
dmi>
29
</pre>
30
31
On the dmi, enter commands like these:
32
33
<pre>
34
# PLMN Id == MCC + MNC
35
set mcc="901"
36 30 daniel
set mnc="70"
37 2 neels
38
# [uarfcnDownlink, 1900 MHz band], [scramblingCode], [dummyCellId]
39
set rfParamsCandidateList=({9800, 401, 1})
40
41
# [lac], [rac]
42 1 neels
set lacRacCandidateList=({10422, (99)})
43 25 tsaitgaist
44
# cellid == RNCID<<16+HNBCID
45
set hnbCId=1
46
set rncIdentity=0
47
48 2 neels
</pre>
49
50
These settings persist across nano3G power down.
51
52 22 neels
*All of the above settings require a reboot of the nano3G to take effect.*
53
54 23 neels
h2. After Every Boot: Starting Operation
55 2 neels
56
Every time you boot the nano3G, you need to
57
58
* set the IP address the nano3G will find the HNB-GW at.
59
* 2061 = set cell parameters
60
* 1216 = unlock ap
61
* activate HNB-GW connection
62
* set csg to open access so that any IMSI can register
63
64
Enter the _dmi_...
65
<pre>
66
telnet 192.168.0.124 8090
67
dmi>
68
</pre>
69
70
...and issue commands like:
71
72
<pre>
73
set hnbGwAddress="192.168.0.132" 
74
action 2061
75
action 1216
76
action establishPermanentHnbGwConnection
77
set csgAccessMode=CSG_ACCESS_MODE_OPEN_ACCESS
78
</pre>
79
80 29 daniel
It is also possible to change the downlink power for the nano3G. This value is reset after the nano3G reboots and after changing the value the connection to the hnbgw needs to be reestablished before the change will become active.
81
82
The dmi attribute needed to set is maximumTotalWidebandTransmitPower
83
84
<pre>
85
dmi> set maximumTotalWidebandTransmitPower = 0
86
</pre>
87
88
The default value is 70 and a change of +/-10 seems to affect the output power by about 1dBm.
89
It is not possible to set the attribute to a negative value and setting it to something larger than the default should be done carefully
90
91
In our tests we were able to measure a tx power output of -6.5dBm for 1960MHz/UARFCN9800 with the attribute set to the lowest value (0) and 0dBm, with the default value of 70.
92
93 2 neels
h2. SSH Access
94
95
The nano3G come with a root password of 'newsys':
96
<pre>
97
ssh root@192.168.0.124
98
password: newsys
99
</pre>
100
101 9 roox
In case you are using a recent version of the OpenSSH-client you'll get the following error message while trying to connect:
102
_Unable to negotiate with 192.168.0.124 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1_
103
104
Starting with OpenSSH version 7.0 support for the 1024-bit diffie-hellman-group1-sha1 key exchange was disabled by default at run-time.
105 24 neels
Furthermore, the ciphers supported by the nano3G may be disabled by default. To enable both manually:
106 9 roox
<pre>
107 1 neels
ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -c aes128-cbc root@192.168.0.124
108 34 neels
</pre>
109
110
or in ~/.ssh/config:
111
112
<pre>
113
Host nano3g
114
Hostname 192.168.0.124
115
User root
116
KexAlgorithms +diffie-hellman-group1-sha1
117
Ciphers aes128-cbc
118 9 roox
</pre>
119
120 10 roox
h2. NTP
121
122
Be sure that the nano3G is able to resolve the DNS record _0.ipaccess.pool.ntp.org_ and can connect the the corresponding NTP servers.
123
Without syncronized NTP the nano3G does not bring up the TRX and it even do not try to connect to the hnbGw.
124 9 roox
125 20 neels
A workaround is to edit the @/etc/hosts@ file on the nano3G (via SSH) and add an entry to resolve 0.ipaccess.pool.ntp.org to your local NTP server's IP address (which requires re-mounting the root file system in read-write mode...).
126 19 neels
127 2 neels
h2. Logging
128
129
When logged in via SSH, you can view the live logging here:
130
<pre>
131
ls /tmp/iapclogs/trace_*.log
132
</pre>
133
134
h2. Closed Mode
135
136
You can also set csgAccessMode to closed and allow only specific IMSIs:
137
138
<pre>
139 6 neels
set csgAccessMode=CSG_ACCESS_MODE_CLOSED_ACCESS
140 2 neels
# IMSI, 1:allowed/2:not allowed, phone number (only for "Closed Access")
141
set accessControlList = ({"001010123456015",  1, "81084"},{"001010123456025", 2, "81025"})
142
</pre>
143
144
(The phone number is actually not relevant)
145
146 27 tsaitgaist
h2. Neighbour Cells
147
148
If you have multiple cells running you can add the other to the neighbouring cell list over dmi.
149
150
<pre>
151
set neighbourListPopulation=STATIC_ONLY
152
# ({band:ENUM, dlUarfcn:INT, scramblingCode:INT, mcc:STRING, mnc:STRING, lac:INT, rac:INT, rncId:INT, cellId:INT, qQualMin:INT, qRxlevMin:INT, txDiversityIndicator:ENUM, primaryCpichTxPower:INT, hcsPriority:INT, qHcs:INT, deltaQhcs:INT}, ...)
153
set staticUmtsNeighbourList_001=({UMTS_BAND_2, 9800, 401, "262", "42", 10422, 99, 0, 1, -24, -119, TX_DIVERSITY_DISABLED, -10, 0, 0, -5},)
154
</pre>
155
156 35 tsaitgaist
h2. Emergency support
157
158
To advertise that your cell does not support emergency calls, you have to barre access class 10 (See 3GPP TS 25.331 section 10.3.2.1) :
159
160
<pre>
161
set accessClassBarredList=[NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED, NOT_BARRED]
162
</pre>
163
164 36 tsaitgaist
The access class barred list is indicated in the System Information Block 3 message broadcasted by the base station.
165
166 2 neels
h1. Peculiarities and Tips
167
168 12 neels
h2. Exiting the dmi while keeping it alive
169
170
When you exit the dmi telnet by hitting Ctrl-C, it will not be available anymore until you reboot the nano3G.
171
Every connection attempt will then end in
172
173
<pre>
174
dmi> Connection closed by foreign host.
175
</pre>
176
177 1 neels
However, if you end your session by the telnet escape character and quitting, the dmi remains open for further connections. Usually that means: hit Ctrl-] (Ctrl and closing square brace) and then enter 'quit':
178
179
<pre>
180
dmi> ^]
181
telnet> quit
182 28 tsaitgaist
</pre>
183
184
If the telnet interface for dmi is closed (after you quit it), you can still issue commands using the [[Configuring_the_ipaccess_nano3G#SSH-Access|console]] (here to close the connection to the HNB-GW)
185
<pre>
186
/opt/ipaccess/DMI/ipa-dmi -c 'action terminatePermanentHnbGwConnection'
187 12 neels
</pre>
188
189 2 neels
h2. UE Register
190
191
The nano3G apparently passes the same identity received from the UE through to
192
the HNBAP UE Register Request message. This means that when the UE sends a
193
TMSI, the UE Register Request received by osmo-hnbgw contains no IMSI.
194
195 7 neels
In this scenario, the problem is that Paging apparently does not (always) work.
196 1 neels
So even though we have working code that allows HNBAP registration with
197 7 neels
a TMSI, that means that you can't (always) reach the UE from the CN.
198
This is not always the case, sometimes the nano3G can well page UEs that have
199
registered by TMSI. Vague idea: it may be that it needs to have seen the IMSI
200
once after power-cycling, e.g. after a closed-mode registration, and then
201
TMSI registration will not harm Paging. (TODO: clarify this)
202 2 neels
203 7 neels
The VTY configuration option to allow TMSI-only attaching to HNBGW, which
204
possibly helps to shorten your dev cycle but may harm paging, is:
205 2 neels
206
<pre>
207
hnbgw
208
 iuh
209 7 neels
  hnbap-allow-tmsi 1
210 2 neels
</pre>
211 1 neels
212 2 neels
Legacy workaround: connect the phone to a different network between retries (being
213
rejected suffices). That causes the UE to discard its TMSI and then use the IMSI
214
for the next registration.
215
216 18 neels
A [[Configuring the ipaccess nano3G#Closed-Mode|closed csgAccess]] with explicit IMSIs could help here to enforce that a UE
217 7 neels
indeed sends its IMSI to the nano3G and hence Paging should work.
218 3 neels
See also #1924.
219
220
h2. id-Reset
221
222
The nano3G seems to *not* send an id-Reset message upon connecting to the HNB-GW.
223
224
h2. Location Update failure due to timeout
225
226
If a UE seems to connect successfully at first but fails by timeout because the final
227
"TMSI Reallocation Complete" message is missing, this might be due to misconfiguration:
228
the CN is sending the wrong LAC or the PLMN-ID (NCC/MNC) is configured wrongly.
229
230
This might be confusing in the sense that a complete LU worked once but not after that;
231
GMM Attach may be successful; Security Mode Commands succeed; and so forth.
232 8 neels
Still the solution might be simply to fix the mobile network code in the osmo-msc.cfg.
233 4 neels
234
h2. RAB Assignment needs IuUP ACK Initialization
235
236
IuCS uses UP encapsulated in RTP. The UP starts off by sending an Initialization, replied
237
upon by an ACK Initialization.
238
239
The nano3G seems to not reply with an ACK when it receives an IuUP Initialization frame.
240
Thus it is not possible to merely echo its own RTP packets back to itself; instead, the
241
first RTP frame received from the nano3G (that is an IuUP Initialization) can be changed
242
to an ACK Initialization by writing 0xe4 to the first payload byte. Sending this back to
243
the nano3G then results in successful RAB Assignment.
244
245
(With the SysmoCell5000, echoing its own Initialization back to itself results in an ACK
246 1 neels
being sent, which we can also echo back to itself, so mere echoing works there.)
247 11 neels
248 14 neels
A hack to make the nano3G work is currently on the "3G master" (the vlr_3G branch),
249
because it does not seem to harm other femto cells: the commit's summary is
250
"mgcp: hack RAB success from nano3G: patch first RTP payload", see "cgit":http://git.osmocom.org/openbsc/log/?h=vlr_3G.
251 15 neels
252
See also #1712#note-21 and the following two comments.
253 31 lynxis
254
h2. There is no DMI interface and the device restarts every 5 minutes
255
256
The ssh should still work. One of many daemons might not been started. This happens usually when a daemon is using a .cfg which is meant for another version.
257
Removing the configuration helps, because every daemon have a default configuration.
258
259 32 lynxis
**cat /tmp/consoleLog** shows what happened! <pre>grep FAILURE /tmp/consoleLog</pre>
260 31 lynxis
261
The configuration files are located under **/var/ipaccess/config_bank_2**
262 33 neels
263
264
h2. Phone is registered, but is usually not receiving any SMS / voice calls
265
266
In open access mode, it seems the nano3G sometimes fails to page a phone -- it looks like it didn't store the subscriber's IMSI. Try to register the phone that should receive a call to a different network (being rejected suffices, just to get the TMSI out of the phone's state) and then re-register to the hNodeB.
267
268
It may also help to set the nano3G to closed access and indicate your IMSI as one of the allowed subscribers.
Add picture from clipboard (Maximum size: 48.8 MB)