PDF(413.9 KB) View with Adobe Reader on a variety of devices
Updated:February 14, 2011
Document ID:1474003587041776
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Product Overview
The Cisco
® Wireless Security Gateway (WSG) is a highly scalable solution for tunneling femtocell, Unlicensed Mobile Access (UMA)/Generic Access Network (GAN), and 3G/4G macrocell voice and data traffic over fixed broadband networks back to the mobile operator's core network. In a femtocell deployment, the Cisco WSG uses IP Security (IPsec) to secure the connection between the mobile operator's core network and the "Home Node B" (3G femtocell access point) located at the subscriber's home. In this environment the Cisco WSG provides security for trusted hosts (femtocell access points) when they communicate across an external untrusted broadband network such as the Internet (see Figure 1).
The Cisco WSG adheres to the latest 3rd Generation Partnership Project (3GPP) standards for secure remote access over untrusted networks. In addition to femtocell deployments, the Cisco WSG can also secure UMA/GAN traffic where the subscriber has a UMA-capable mobile handset that communicates via a Wi-Fi access point over an untrusted network and back to the mobile operator's data center. It can also be deployed to secure 3G/4G base stations that are connected to the mobile operator's network through a third party's carrier Ethernet service. The Cisco WSG plays an important role in cost-effectively securing backhaul networks for mobile operators, helping to reduce backhaul costs, which represent a significant part of their operating expenses (OpEx).
Figure 1. Cisco Wireless Security Gateway at Service Provider Network
The Cisco WSG is built on the Cisco Service and Application Module for IP (SAMI) for the Cisco 7600 Series Router. Each Cisco SAMI blade with Cisco WSG software can support up to 100,000 IPsec sessions using Internet Key Exchange (IKE) Version 1 or Version 2. IKEv2 has been specified by the 3GPP for use in UMA/GAN, femtocell, and Long-Term Evolution (LTE) applications. IKEv1 is available to support legacy solutions that have not migrated to IKEv2. An optimally configured Cisco 7613 Series Router with ten SAMI blades can support 1,000,000 IPsec sessions.
Cisco 7600 Series Router
The Cisco 7600 Series Router delivers robust, high-performance IP/MPLS features for a range of service provider edge applications. The physical interfaces supported on the Cisco 7600 Series platform include Fast Ethernet and Gigabit Ethernet, FlexWAN (ATM and Frame Relay), and the new line of Cisco shared port adapter (SPA) and SPA interface processor (SIP) line cards. Each Cisco 7600 Series Router provides Layer 2 connectivity and Layer 3 routing services and can host a variety of specialized applications on the Cisco SAMI module.
Figure 2. Cisco 7600 Series Router with SAMI Blade
Applications
The Cisco WSG in a Femtocell Deployment
As the build-out of the mobile Internet accelerates, technology such as femtocells has moved to the forefront as a way to cost-effectively scale mobile capacity to meet the expected 66-fold growth in mobile data traffic over the next few years (source: Cisco Visual Networking Index - Forecast, 2008-2013). The Cisco WSG will play a critical role in enabling femtocell deployments. Figure 3 provides an example of how a Cisco WSG can be deployed.
Figure 3. Cisco WSG in an End-to-End Femtocell Architecture
Features and Benefits
Table 1. Cisco Wireless Security Gateway Features
Feature
Description
Benefit
Standards compliance
• Complies with IETF RFCs
• Provides interoperability with other standards-compliant components
Authentication
• Endpoint authentications with PKI Certificates and EAP Protocol
• Allows users to uniquely authenticate using X.509 certificate
• Support of EAP facilitates Radius based
• Authentication
Address allocation
• IP local pool
• Increases flexibility of network design and address allocation
• Uses local pools for user address assignments
• Enhances end-node address management efficiency, and minimizes provisioning
IPsec and other security services
• Handling of IKE initialization request from endpoints with PKI
• CRL, CMPv2 and OCSP Certificate management protocol Support
• Protects data flow between Home Node B or eNode B and WSG
• Offers security services at IP level
• Provides secure tunnel between Home Node B or eNode B and WSG
• Protects data confidentiality, integrity, and authentication
DPD
• Dead Peer Detection (DPD) for IKE transactions
• Facilitates faster failover
Redundancy and load balancing
• 1+1 inter- or intra-chassis redundancy
• N+1 inter- or intra-chassis redundancy
• ACE HW Module based Server Load Balancing
• PBR (Packet Based Routing) Based Server Load Balancing
• Peace of mind
• Service availability
• Minimum user disruption
Network Address Translation (NAT) traversal
• Supports an intermediate device performing NAT
• Allows the home/mobile node to be behind a NAT entity address
• Offers increased flexibility of network design and address allocation
Quality of service (QoS)
• Reflects inner-to-outer type of service/differentiated services code point (ToS/DSCP) marking
• Supports the appropriate QoS and class of service (CoS) for application
Platform
• High end based on Cisco 7600 Series and SAMI
• Network Equipment Building Standards (NEBS) 3-compliant
• Flexibility of choice for better offering
• Distributed, not centralized
• Feature-rich line card for 10G and 4G needs
Scaling
• High throughput per application blade
• Right subscriber density per blade for 3G/4G nodes
• Load-balancing mechanism
• Up to 270 tunnels per second
• Up to 2 Gbps per blade for small packets - voice
• Up to 5 Gbps per blade for large packets - data
• Up to 50 Gbps per chassis
• Up to 100,000 subs per blade
• Up to 1,000,000 subs per chassis
Co-Location of Hardware/Software
• Co-Location of other wireless Services in the same chassis, i.e. IP-RAN and other wireless Gateways can co-exist in the same chassis
• Facilitates use of existing 7600 Platform
• Provides a more competitive solution
Standard Cisco hardware and software platforms
• Multiple service modules (such as Cisco Application Control Engine [ACE], SAMI, and Firewall Service Module [FWSM]) can be integrated in the same chassis
• Cisco hardware platforms are proven in some of the largest networks in the world
• Cisco devices run with the standard Cisco IOS
® Software feature set, which includes rich IP, security, mobile IP, and voice and data integration capability
• Minimizes risk; speeds deployment of network
• Helps accelerate time to market with advanced features
Configuration and Performance
Cisco 7600 Series with SAMI provides:
• Up to 100,000 Home Node B's per Cisco WSG module in a femtocell deployment (up to 100,000 dual-mode phones in a UMA/GAN deployment)
• Up to ten Cisco SAMI blades with Wireless Security Gateway can be installed in a Cisco 7613 Series Router
• Up to 2-Gbps bandwidth per module for small packets - voice
• Up to 5-Gbps bandwidth per module for large packets - data
• Chassis throughput of 20 Gbps (10 x 2 Gbps) for voice and 50 Gbps (10 x 5 Gbps) for large packets
Cisco 7600 Series Platform Requirements
• All Cisco 7600 Series chassis are supported: Cisco 7604, 7606, 7609, and 7613, with a minimum Cisco IOS® Software release requirement of 12.2(33)SRC2
• Supported supervisor engines: Cisco 7600 Series Supervisor Engine 720 and Route Switch Processor 720
• Single or redundant supervisor engine configurations are permitted
• No restriction on other cards (such as service and network modules) on the chassis
Ordering Information
Table 2 lists the product numbers for the Cisco WSG right-to-use (RTU) licenses, subscriber licenses, and SAMI hardware. The software license provides for unlimited use of features in the release with a defined number of connected subscribers, which may be limited by hardware resource capacity and traffic mix. The Cisco WSG subscriber license allows for increasing the number of connected subscribers in increments of 10,000 connected subscribers.
Table 2. Cisco WSG Ordering Information for Cisco 7600 Series
Product Number
Description
SAMI Module
WS-SVC-SAMI-BB-K9
Service Application Module for IP 6 x PPC w/ 1GB (Crypto)
WS-SVC-SAMI-BB-K9=
Service Application Module for IP 6 x PPC w/ 1GB Spare (Crypto)
MEM-SAMI-6P-2GB
SAMI 6xPPCs with 2GB per PPC Memory Option
MEM-SAMI-6P-2GB=
SAMI 6xPPCs with 2GB per PPC Memory Option
Software RTU Licenses*
SSAS20K9-COSLI20
SAMI Wireless Security Gateway R2.0 RTU License
SSAS20K9-COSLI20=
SAMI Wireless Security Gateway R2.0 RTU License (Spare)
Connected Tunnel Licenses, per Chassis for active WSG
FL-SS-10K-SUB
SAMI Wireless Security Gateway 10K connected tunnel license
FL-SS-10K-SUB=
SAMI Wireless Security Gateway 10K connected tunnel license (Spare)
* One RTU license is required per software module.
Service and Support
Cisco offers a wide range of service programs to accelerate customer success. These innovative service programs are delivered through a unique combination of people, processes, tools, and partners, resulting in high levels of customer satisfaction. Cisco services help you to protect your network investment, optimize network operations, and prepare your network for new applications to extend network intelligence and the power of your business. For more information about Cisco Services, see Cisco Technical Support Services or Cisco Advanced Services.
Additional Information
Cisco Service and Application Module for IP (SAMI)
http://www.cisco.com/en/US/docs/wireless/service_application_module/sami/user/guide/samiv1.html
Cisco ACE Application Control Engine Solution for High Availability
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/prod_brochure0900aecd806cecc5.html
Cisco Firewall Services Module for Cisco Catalyst 6500 and Cisco 7600 Series
https://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps4452/product_data_sheet0900aecd803e69c3.html
Cisco AAA and Cisco Network Registrar
®http://www.cisco.com/en/US/products/sw/netmgtsw/ps1982/tsd_products_support_series_home.htmlhttp://www.cisco.com/en/US/products/sw/netmgtsw/ps411/tsd_products_support_series_home.html
Feedback