APN ACL Support

Revision History


Note

Revision history details are not provided for features introduced before release 21.24.

Revision Details

Release

First introduced

Pre 21.24

Feature Description

Currently in CUPS (pre 21.19.x release), the APN level ACL definitions are configured on UP.

With this feature, ACLs configured on CP are pushed to UP. This feature saves the cost and effort of configuring separate ACL definitions on all UP nodes.


Note

  • Verify the APN ACLs in CP configuration before proceeding with the upgrade to the release.

  • The configuration must have the same context names in both CP and UP. CP can have more contexts than UP. If the context names do not match, the respective ACLs are dropped at UP.

  • It is recommended to not define APN ACLs in both CP and UP. However, if there is a requirement, the ACL names in both UP and CP must be different from each other to avoid any conflicts.

  • To ensure backward compatibility, ACLs locally created in UP configuration gets preference.

  • If an APN belongs to a specific user-plane-group, ACLs for the same APN are pushed to only those UPs, which are part of the same user-plane-group.

  • A maximum of 64 contexts is allowed and a maximum of 16 ACLs per context.

  • Multiple APNs can share an ACL in the same context.

  • Changes to an ACL are applicable only for new sessions, but not for ongoing sessions.

  • If a deny any rule is configured in IPv6 ACLs, the Router advertisement (RA) and Router Solicitation (RS) messages must be explicitly allowed in ACL.

Troubleshooting

This section describes how to troubleshoot this feature.


Note

This feature is enabled by default.

Show commands

This section describes the show commands for this feature.

show user-plane-service ip-access-list name access list name

This command is used to display ACL rules on user plane.

show user-plane-service pdn-instance name apn name

This command is used to display the access group for an apn on user plane.

show srp statistics

This command is used to display the sent, received, and discarded packet count for APN ACLs over SRP.

show demux-mgr statistics sxdemux all

This show command is used to display the number of PFD ACL_INFO packets sent from CP.