In this section:
The SBC Core provides Lawful Intercept (LI) support using one of two methods:
The SBC supports up to 500 simultaneous LI sessions. SBC works in coordination with an Intercept Server (IS) to provide call data and call content to law enforcement agencies for calls involving identified intercept subjects. When it receives matching LI criteria in a policy response from ERE (or external PSX in centralized PSX solution), the SBC routes the call as directed and additionally reports call events to the IS.
The SBC also sends an RTP copy of the call's voice streams (call content) to an IP address provided by the IS. LI is configured by EMA (or EMS in centralized PSX solution). The target number is uploaded to LI table of ERE (or PSX, with the help of EMS).
You must use the default addressContext when configuring LI.
Refer to Lawful Intercept page for an in-depth explanation of LI functionality.
The SBC 52x0 and SBC 7000 systems support creating IP Interface Groups containing sets of IP interfaces that are not "processor friendly" (i.e. carried on physical Ethernet ports served by separate processors). However, restrictions exist regarding the usage of such Interface Groups.
(This ability does not apply to the SBC 51x0 and SBC 5400 systems which have only two physical media ports. IP interfaces from the two physical ports may be configured within the same IP Interface Groups without restriction.)
For complete details, refer to Configuring IP Interface Groups and Interfaces.
When configuring LI through EMA/ERE, you must be 'Calea' user. Refer to Managing SBC Core Users and Accounts for descriptions of users and permissions.
As user 'Calea', use the following command syntax to configure LI.
% set addressContext <default> intercept callDataChannel <callDataChannel> nodeNumber <integer>
Intercept Parameters
Parameter | Length/Range | Description |
---|---|---|
| 1-23 | The user-configurable LI Call Data Control Channel name. (See Call Data Channel Parameters table below for parameter details) |
| 0-9999999 | The unique global node number to assign to the SBC which is used by the LI server for identification purposes. |
As user 'Calea', use the following CLI syntax to establish the LI call data channel configuration:
Some parameters only display after others are configured as described in the Call Data Channel Parameters table below.
% set addressContext <default> intercept callDataChannel <callDataChannel_name> dsrProtocolVersion <0 | 1> interceptStandard < etsi | packetcable | threeGpp> ipInterfaceGroupName <ipInterfaceGroup_Name> kaTimer <0-65535 seconds> liPolDipForRegdOodMsgs <disabled | enabled> mediaIpInterfaceGroupName <IP interface group name> mediationServer <server name> priIpAddress <IPv4 address> priMode <active | outofservice | standby> priPort <0-65535> priState <disabled | enabled> retries <value> rtcpInterception <disabled | enabled> secIpAddress <IP_Address> secMode <active | outofservice | standby> secState <disabled | enabled> vendorId <none | groupTwoThousand | ss8 | utimaco | verint>
Call Data Channel Parameters
Parameter | Length/Range | Description |
---|---|---|
| N/A | Signifies the intercepted X2 signaling protocol version towards the mediation servers. The default value 0 maintains backward compatibility with SBC Core 8.0 or earlier
|
| N/A | The Intercept Standard to use for this Call Data Channel.
|
| 0-23 |
|
| 0-65535 |
|
liPolDipForRegdOodMsgs | N/A | Use this flag to control the sending of the policy dip to PSX for registered user's Out-Of-Dialog messages.
NOTE: This parameter is only visible when |
mediaIpInterfaceGroupName | 1-23 characters | The name of the IP interface group that is used to stream media packets to the LI server. |
mediationServer | 0-23 |
NOTE: The |
| N/A |
|
| N/A | Mode of the primary server. Options are:
|
| 0-65535 |
|
| N/A | Use this flag to enable/disable communication to the primary LI server.
|
| N/A | Number of retries before the LI Call Data Channel is considered as failed. (default = 3) |
| N/A | Enable this flag to intercept RTCP information for IMS LI.
NOTE: The |
| N/A | Secondary LI server's IPv4 address where Call Data Channel messages are sent. (default = 0.0.0.0) |
| N/A | Mode of the secondary server. Options are:
|
| N/A | Use this flag to enable/disable communication to secondary LI server.
|
| N/A | The vendor name of the LI server.
|
The SBC allows configuration of a maximum of 16 mediation servers for IMS LI in the Call Data Channel (CDC). When a call is tapped, the SBC selects among the Delivery Function 2 (DF2) servers in a round-robin manner, and establishes persistent TCP connections with all configured mediation servers.
Each mediation server object contains the Signaling(X2) and Media (X3) IP addresses. The SBC allows configuration of multiple mediation servers with the same X2 IP address but a different X3 IP address.
For IMS LI, the SBC does not support any Active-Standby configuration for the X2 servers. It assumes that the DF2 servers are running in Active-Active mode, and in case of a failure, moves the IP address of the active DF2 server to the standby DF2 server.
The X2 and X3 servers operate independently. Even if the X2 servers are not reachable, the SBC sends X3 media if DF3 servers are available, and vice versa.
The SBC supports TCP to transport mediation server details.
% set addressContext <addressContext name> intercept callDataChannel <CDC name> mediationServer <mediationServer name> media tcp dscpValue <0-63> ipAddress <IPv4/IPv6 address> kaInterval <5-60 seconds> kaProbe <4-8 seconds> kaTime <60-7200 seconds> mode <inService | outOfService> portNumber <0-65535> state <disabled | enabled>
Mediation Server: Media over TCP Parameters
Parameter | Length/Range | Descriptions |
---|---|---|
dscpValue | 0-63 | The DSCP value for intercepted media packets sent on TCP port. (Default = 16) |
ipAddress | IPv4/IPv6 format | The IPv4/IPv6 Address of the mediation server for media interception over TCP. |
| 5-60 | The duration between two successive keep alive retransmissions, if acknowledgement to the previous keep alive transmission is not received. (Default = 30 seconds) |
| 4-8 | The number of retransmissions to be carried out before declaring that the remote end is not available. (Default = 4) |
| 60 to 7200 | The duration, in seconds, between the two keep alive transmissions in the idle condition. (Default = 180 seconds) |
mode | N/A | The operational mode of the signaling/media connection towards the mediation server.
|
portNumber | 0-65535 | The TCP port number of the mediation server for media interception over TCP. (Default = 0) |
state | N/A | The administrative state of the TCP connection towards the mediation server.
|
The SBC supports UDP to transport mediation server details.
% set addressContext <addressContext name> intercept callDataChannel <CDC name> mediationServer <mediationServer name> media udp dscpValue <0-63> ipAddress <IPv4/IPv6 address> mode <inService | outOfService> portNumber <0-65535> state <disabled | enabled>
Mediation Server: Media over UDP Parameters
Parameter | Length/Range | Descriptions |
---|---|---|
dscpValue | 0-63 | The DSCP value for intercepted media packets sent on UDP port. (Default = 16) |
ipAddress | IPv4/IPv6 format | The IPv4/IPv6 Address of the mediation server for media interception over UDP. |
mode | N/A | The operational mode of the signaling/media connection towards the mediation server.
|
portNumber | 0-65535 | The UDP port number of the mediation server for media interception over UDP. (Default = 0) |
| N/A | The administrative state of the UDP connection towards the mediation server.
|
% set addressContext <addressContext name> intercept callDataChannel <CDC name> mediationServer <mediationServer name> signaling dscpValue <0-63> ipAddress <IPv4/IPv6 address> mode <inService | outOfService> portNumber <0-65535> protocolType <tcp | udp> state <disabled | enabled>
Mediation Server: Signaling Parameters
Parameter | Descriptions |
---|---|
| Mediation server signaling interception settings.
|
The protocolType
"udp
" command is not supported for Signaling interception in this release.
To retrieve the LI statistics, use the command:
> show status addressContext <addressContext name> intercept
The following table depicts the interceptStandard
and verndorId
configuration options to configure SBC for the the various LI flavors.
Configuration Options When Configuring SBC for Different LI Flavors
Configuration Settings |
LI Flavor | |
---|---|---|
interceptStandard | vendorId | |
packetcable | none/utimaco/verint/groupTwoThousand | Legacy LI (default) |
packetcable | ss8 | SS8 LI |
threeGpp/etsi | none/utimaco/verint/groupTwoThousand | IMS LI |
To configure the name of the IP interface group used to stream to the LI server, use the commands:
% set addressContext default intercept callDataChannel CDC ipInterfaceGroupName LIG1 % commit
The ipInterfaceGroup
/mediaIpInterfaceGroup
for CDC must be different from other signaling/media ipInterface
groups. This ensures that LI doesn't use signaling ipAddress
to send intercepted traffic (media/signaling) towards the mediation server.
To configure intercept standard, use the commands:
% set addressContext default intercept callDataChannel CDC interceptStandard etsi % commit
To configure the vendor ID, use the commands:
% set addressContext default intercept callDataChannel CDC interceptStandard etsi vendorId verint % commit
To configure mediation server for media interception, use the commands:
% set addressContext default intercept callDataChannel CDC interceptStandard etsi vendorId verint mediationServer ms1 % commit
To configure mediation server for media interception over TCP, use the commands:
% set addressContext default intercept callDataChannel CDC mediationServer ms1 media tcp dscpValue 0 ipAddress 10.54.66.67 portNumber 7870 % commit % set addressContext default intercept callDataChannel CDC mediationServer ms1 media tcp mode inService state enabled % commit
To configure mediation server for media interception over UDP, use the commands:
% set addressContext default intercept callDataChannel CDC mediationServer ms1 media udp dscpValue 0 ipAddress 10.54.66.57 portNumber 7881 % commit % set addressContext default intercept callDataChannel CDC mediationServer ms1 media udp mode inService state enabled % commit
To configure mediation server for signaling interception, use the commands:
% set addressContext default intercept callDataChannel CDC mediationServer ms1 signaling dscpValue 0 ipAddress 10.54.64.80 portNumber 7880 protocolType tcp % commit % set addressContext default intercept callDataChannel CDC mediationServer ms1 signaling mode inService state enabled % commit
To configure RTCP interception, use the commands:
% set addressContext default intercept callDataChannel CDC rtcpInterception enabled % commit
To enable the sending of the policy dip to PSX for registered user's Out-Of-Dialog messages, use the commands:
% set addressContext default intercept callDataChannel CDC liPolDipForRegdOodMsgs enabled % commit