Enable IP Source Violation for Uplink Packets

The IP Source Violation feature on cnSGWc allows UPF to check if the origin of uplink packets is from the correct subscriber.

This feature enhances the security and privacy of subscribers by preventing the leakage of their data to unauthorized parties. This feature further reduces the risk of legal and regulatory issues for the service provider by complying with lawful interception requirements.

Default Setting: Disabled – Configuration Required to Enable

Initiate PFCP Association Release Request from UPF

This feature lets UPF to send notifications to cnSGWc and SMF on PFCP Session Release. This notification indicates to clear the calls simultaneously in UPF and SMF, or UPF and cnSGWc.

If SMF or cnSGWc is not notified, the call remains connected until UPF receives the next Session Modify Request from SMF or cnSGWc. This leads to loss of subscriber usage reports. Here, the Enhanced PFCP Association Release (EPFAR) feature improves the signalling efficiency and effective handling of usage reports by SMF or cnSGWc.

Default Setting: Disabled – Configuration Required to Enable

UCS C220 M7 Server Qualification

In this release, UPF is functionally qualified on the Cisco UCS C220 M7 server.

The Cisco UCS C220 M7 Rack Server is a versatile general-purpose infrastructure and application server. This high-density, 1RU, 2-socket rack server delivers industry-leading performance and efficiency for a wide range of workloads, including virtualization and bare-metal applications.

User Access Control through SGACL

UPF supports Cisco ISE integration for SGACL (Secure Group Tag-based Access Control List) enforcement on the downlink packets. SGACL controls and manages the authorization of security group members.

UPF fetches the SGACL matrix from ISE through an API query based on Destination SGT (D-SGT). SMF sends the D-SGT value to UPF over Sx or N4. UPF then applies the SGACLs based on the D-SGT and S-SGT (Source SGT) mapping for downlink packets. Therefore, you can enable policy enforcement from Cisco ISE.

Default Setting: Disabled – Configuration Required to Enable

IP Chunk Processing at UPF

Previous Behavior: UPF did not have a comprehensive validation criterion to process requests from SMF during IP chunk deletion or allocation.

New Behavior: The robustness of UPF is improved to prevent corruption of chunk lists. UPF rejects or ignores any incorrect requests from SMF, and only processes requests with correct parameters. The parameters include peer address, VRF name, chunk ID, chunk size, and start address.

This release supports the following new commands and logs:

• The show ip chunks all-vrf command lists all IPv4 chunks under each VRF in the configured context.

• The show ipv6 chunks all-vrf command lists all IPv6 chunks under each VRF in the configured context.

• VPN error logs to track errors:

  • Event ID 5585 is reported when conflicting chunk add request (mismatched parameters) is received at UPF VPNMgr.

  • Event ID 5586 is reported when conflicting chunk delete request (chunk-id mismatch) is received at UPF VPNMg.

  • Event ID 5587 is reported when conflicting chunk delete request (chunk-id matches but other parameters are mismatched) is received at UPF VPNMgr.

  • Event ID 5588 is reported when invalid prefix allocation request is received at UPF VPNMgr for which the chunk is not yet allocated.

  • Event ID 5589 is reported when invalid prefix release request is received at UPF VPNMgr for which the chunk is not yet allocated.

Elimination of Hash Entries in VPP for ICMPv6 Flows

Previous Behavior: The session manager created both stream and hash entries in VPP for ICMPv6 data flows.

New Behavior: For ICMPv6 data flows, the session manager only creates the streams and does not create hash entries in VPP. This behavior ensures uniform ICMPv4 and ICMPv6 data flow, and reduced number of hash entries.