Out of the Box Test - LTE Connection
The purpose of this tutorial is to show you how to do basic connectivity test between a UE and Amari Callbox. It is assumed that you don't have any previous experience with Amari callbox. If you just a new box delivered to you or if you are completely new to the callbox operation, this tutorial would be the good place to start.
The configuration being used in this tutorial is LTE band 7. I think most of the commerical UEs that you can purchase from almost any shops would support LTE band 7 by default. So if you placed Amarisoft default USIM in the phone, I expect it to camp on the the callbox (eNB) without any problem.
As mentioned above, most of the commercial UE would support band 7, but I am not 100% sure if they support all the possible LTE bandwidth. As far as I personally experienced, most of the commercial UE would support all the bandwidth, but some UE may have some bandwidth restrictions (for example, some UE has difficulties with 1.4 Mhz BW). If your UE has any limitation about LTE bandwidth, you can change it by setting N_RB_DL parameter in the configuration file.
|
#define TDD 0 // Values: 0 (FDD), 1(TDD) #define N_RB_DL 25 // Values: 6 (1.4 MHz), 15 (3MHz), 25 (5MHz), 50 (10MHz), 75 (15MHz), 100 (20MHz) #define N_ANTENNA_DL 1 // Values: 1 (SISO), 2 (MIMO 2x2) #define N_ANTENNA_UL 1 // Values: 1, 2 #define CHANNEL_SIM 0 // Values: 0 (channel simulator disabled), 1 (channel simulator enabled) #define NG_ENB 0 // 1 for ng-eNB |
Following is the topics to be covered in this tutorial. Basically Amarisoft Callbox operation is just repetition of the process explained in this tutorial. So if you are new to Amarisoft Callbox, try to repeat this process several times until your finger get used to the process and your mind gets enough confidence with the operation.
Test Procedure Summary
This test requires gNB configuration change only and you can keep mme, ims configuration as in default.
Step 1 : Set TDD/FDD (TDD). number of DL Antenna(N_ANTENNA_DL), and Bandwidth(N_RB_DL) as you want
Step 2 : If you want to change the LTE band and frequency, specify dl_earfcn as you want.
Step 3 : Run the test
Step 4 : Verify the result with 't' command and the captured Log. .
Table of Contents
- Out of the Box Test - LTE Connection
Test Setup
Test setup for this tutorial is as shown below.
- Since this test is for Out of the box testing, I used the default configuration(cfg) file without changing anything in it
- SIM Card used in this tutorial is the one delivered with the system as it is.
- If you want to change the configuration, The tutorial Configuration Guide would help
Configuration
Go to the directory /root/enb/config and make a symbolic link as follows. (
Now you should see the enb.cfg file linked to enb.default.cfg as follows. (
Now go to the directory /root/mme/config. You should see the configuration files as below. (
If ims.cfg and mme.cfg is not linked to the files as shown above, you may run following commands to make proper link.
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
# service lte restart
Perform the Test
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
You will get the screen as shown below. This screen shows all the network components installed in the callbox. In this tutorial, it indicates MME, ENB, IMS, MBMSGW are installed in the callbox.
You would see a number before each component name. With Ctrl+A and the number before the component name, you can switch to command line window for the specific component. For example, if you press Ctrl+A+1, the command line window switches to ENB and if you press Ctrl+A+0, the command line window switches to MME and so on.
When you switches to [ENB] there are some important information provided without running any specific command. It provides RF information showing the sample_rate, dl_freq, ul_freq, band, dl_ant, ul_ant that gives you very fundamental RF information. Check out the details of these info and see if the RF is configured as you intended.
Run 't' command to start log display.
You can run this command any time during the test, but it is always good idea to run this command before you power on UE to get the log from very beginning of initial attach.
Power on UE. If UE detect the cell and perform attach, you would see a traces.
If you started 't' command before you powe on UE, you will get the traces for PRACH attempt. The presence of PRACH trace can be a good troubleshooting indicator for initial attach problem. If PRACH is properly received and the entire RACH process is completed, it is highly likely that the initial attach gets completed and start getting traffic log. Regarding the details on the meaning of each column of this log and how to use the information for troubleshoot, refer to this tutorial.
Press any key to stop trace and go back to prompt.
Check if UE has any IP address assigned to it.
Switch to (mme) window and Run the command [ue] in (mme) and it will show whether UE is assigned with any IP and what are those IPs. The IPs assigned to the UE is configured in mme.cfg file as indicated below.
Once you get the IP address properly, you may go out of the screen with [ Alt + A and D] .
Log Analysis
In most case, you may use WebGUI to analyze the log, but in this tutorial I will show you how to check out the log with text editor to give you the idea on where the log is collected and the format of the saved log. I would recommend you to check out the log in this way at least a few times when you just starts to use Amarisoft product and then WebGUI would be more handy tools for log analysis.
By default the log file is saved in /tmp directory (you can change the location of the log file in configuration file, but in most case most user just use the default location which is /tmp). In case of LTE test, you will find the log file named enb0.log in /tmp directory while the test is trunning. (
Open up the log using any kind of the text editor and you will see various high level information (meta data) at the beginning of the file. This is useful high level information. Check out this tutorial to the details on this meta data.
Now let's look into signaling message part of the log. The first thing you may want to check is 'RRC Connection Request' and 'RRC Connection Setup'. If you get these message, it indicates that cell search and PRACH process is properly done on UE side and UE initiates RRC Setup.
Next step you need to check is to see whether the eNB recieves RRC Connection Setup Complete or not. If you see this message, it mean that RrcSetup is completed on UE side. If UE fails with RrcSetup, it usually triggers RACH procedure again and send RrcConnectionRequest.
Once RRC Setup Procedure is complete, eNB initiate the Authentication process. If the authentication is confirmed on UE side, UE send Authentication Response message. If you see the Authentication Failure instead of Authentication Response, it usually implies that there is SIM parameter mismatch between USIM and eNB SIM parameter setting. In most case, K value mismatch would be the culprit of the failure. Check ue_db.cfg or ue_db-ims.cfg and make it sure it has authentication parameter that matches DUT's USIM parameter.
Once Authentication process is complete, ENB starts Security checkup. There are two different level of security checkup. The first one is NAS Security and the second one is RRC Security.
If you see EMM:Security mode complete message recieved, it indicates that NAS Security is complete.
If you see DCCH:Security mode complete message recieved, it indicates that RRC Security is complete.
Once Authentication and Security checkup is done, eNB initiate RRC Connection Reconfiguration.
Once all the required RRC and NAS Procedure for initial registration is complete, UE is supposed to send EMM:Attach Accept message.
Once initial attach is complete, eNB initiate the default EPS bearer setup by sending Activate default EPS bearer context request. In this message, you can confirm the UE IP and DNS Server IP that is assigned to the UE.
On the completion of Attach process and IP allocation, UE send Attach Complete message. This is a good indication that the entire initial attach procedure is done.
Now user data flows between network and UE. If there is no more user traffic for a certain duration, eNB send RRC Release to terminate the RRC Connection.
RRC / NAS Signaling
: This section is to show you the overall structure of important Rrc messages and Information IE (IE) that are related to this tutorial. It is not intended to describe the details on every RRC/NAS Information elements. With the overall structure and key IEs shown here, it hope it would be easier / clearer to go through the sample log provided in this tutorial or any logs that you captured from your own test setup or live network.
SIB1
: This is the SIB1 message sent by eNB to configure LTE. (
{
message c1: systemInformationBlockType1: {
cellAccessRelatedInfo {
plmn-IdentityList {
{
plmn-Identity {
...
},
cellReservedForOperatorUse notReserved
}
},
trackingAreaCode '0001'H,
cellIdentity '1A2D001'H,
cellBarred notBarred,
intraFreqReselection allowed,
csg-Indication FALSE
},
cellSelectionInfo {
q-RxLevMin -70
},
p-Max 10,
freqBandIndicator 7,
schedulingInfoList {
...
},
si-WindowLength ms40,
systemInfoValueTag 0
}
}
SIB2
: This is the SIB2 message sent by eNB to configure LTE. (
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
...
},
bcch-Config {
...
},
pcch-Config {
...
},
prach-Config {
...
},
pdsch-ConfigCommon {
...
},
pusch-ConfigCommon {
...
},
pucch-ConfigCommon {
...
},
soundingRS-UL-ConfigCommon setup: {
...
},
uplinkPowerControlCommon {
...
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
...
}
},
ue-TimersAndConstants {
...
},
freqInfo {
...
},
...
},
RrcConnectionSetup
: This is the RrcConnectionSetup message sent by eNB (
{
message c1: rrcConnectionSetup: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r8: {
radioResourceConfigDedicated {
srb-ToAddModList {
...
},
mac-MainConfig explicitValue: {
...
},
physicalConfigDedicated {
pdsch-ConfigDedicated {
...
},
pucch-ConfigDedicated {
...
},
pusch-ConfigDedicated {
...
},
uplinkPowerControlDedicated {
...
},
cqi-ReportConfig {
...
},
soundingRS-UL-ConfigDedicated setup: {
...
},
schedulingRequestConfig setup: {
...
}
AttachRequest
: This is the AttachRequest message sent by UE (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x1 (Integrity protected)
Auth code = 0x410496cc
Sequence number = 0x09
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 2 (combined EPS/IMSI attach)
NAS key set identifier:
...
Old GUTI or IMSI:
...
UE network capability:
...
ESM message container:
...
Last visited registered TAI:
...
DRX parameter:
...
MS network capability:
...
Old location area identification:
...
Mobile station classmark 2:
...
Mobile station classmark 3:
...
Supported codecs:
...
Voice domain preference and UE's usage setting = 0x07 (IMS PS voice preferred, CS Voice as secondary, Data centric)
Old GUTI type = 0
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
UE additional security capability:
...
AttachAccept
: This is the AttachAccept message sent by Core Network (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x6bb083ed
Sequence number = 0x02
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 2 (combined EPS/IMSI attach)
T3412 value:
...
TAI list:
...
ESM message container:
...
GUTI:
...
Location area identification:
...
MS identity:
...
Emergency number list:
...
EPS network feature support:
...
RrcConnectionReconfiguration
: This is the RrcConnectionReconfiguration message sent by eNB (
{
message c1: rrcConnectionReconfiguration: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionReconfiguration-r8: {
dedicatedInfoNASList {
',,,
},
radioResourceConfigDedicated {
srb-ToAddModList {
,,,
},
physicalConfigDedicated {
antennaInfo-r10 explicitValue-r10: {
,,,
},
cqi-ReportConfig-r10 {
,,,
},
pucch-ConfigDedicated-v1020 {
,,,
},
cqi-ReportConfigPCell-v1250 {
,,,
}
},
drb-ToAddModList-r15 {
,,,
}
},
Activate default EPS bearer context request
: This is the "Activate default EPS bearer context request" message sent by Core Network (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x88b74077
Sequence number = 0x04
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 6
Procedure transaction identity = 9
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
...
Access point name = "..."
PDN address:
...
Extended protocol configuration options:
...