Cisco 1941 with EHWIC-3G-HSPA+7 card configuration

The main resources of this tutorial are coming from http://routing-bits.com/2010/05/12/hwic-3g-gsm/

Preamble

Three components are required to use a 3G data connection: a SIM, a radio modem, and a router. The SIM identifies the subscriber (that is you the human) for billing and so forth. The radio modem does the hard work in providing physical layer (Layer1) access to the local 3G base station. The router typically uses PPP as the Layer2 data link to the provider’s Network Access Server (NAS), and from there is connected to the provider’s Layer3 network (which may be a private VPN, or public Internet).

The cellular modem must establish a data call, then once connected a PPP session is established to the providers NAS. The cellular modem still requires age-old AT commands to make that call, and additionally to interrogate the SIM, etc. Cisco IOS provides an interface to a handful of modem features via the “cellular” exec command and a chat script(s). Note that AT commands can only be issued when the modem is idle (not in a call).

The modem is configured with at least one “profile” which stores an Access Point Name (APN) and optionally a username and password. This profile is then “dialled” to establish the connection similar to using a traditional phone number. These modem profiles are stored on the modem and NOT on the routers NVRAM or flash. Note that a modem profile and an IOS dialer profile are two separate things.

The EHWIC-3G-HSPA+7 is just a Sierra Wireless MC8705 AirPrime modem sold in a EHWIC form factor with a Cisco Logo on it. The modem is presented in Cisco IOS as two interfaces:

Low-speed asynchronous “control” interface which communicates with the modem.

line x/x/x

High-speed synchronous interface connecting to the cellular providers network.

interface cellular x/x/x

Configure APN

APN configuration is stored on the modem nvram not on the router it self. Cisco IOS provides interface to manipulate the modem and modem profiles with following syntax:

cellular 0/0/0 gsm create profile create 1 <apn name> chap <username> <password> ipv4

Both working profiles for Vodafone contract are below, the first one with CHAP auth seems to be quicker to establish connection:

cellular 0/0/0 gsm profile create 1 internet chap web web ipv4
cellular 0/0/0 gsm profile create 2 internet pap web web ipv4

Define Vodafone provider AT command in a chat-script

Syntax

chat-script <dialer_name> "" "AT!SCACT=1,<apn_profile_number>" TIMEOUT 60 "OK"

Live command

chat-script hspa "" "AT!SCACT=1,1" TIMEOUT 60 "OK"

Manually execute the chat script if needed for debugging purposes. Here hspa is the chat-script name and 0/0/0 is cellular interface

start-chat hspa 0/0/0

Configure line interface

This line interface information sets low-speed asynchronous “control” interface which communicates with the modem. The line x/x/x number is the same as cellular x/x/x interface number.

line 0/0/0			'<---This will depend on what slot the card uses'
 exec-timeout 0 0
 script dialer hspa 		'<---Calls the chat-script'
 script activation hspa	'<---activates the script it did not work without and it is not documented anywhere'
 modem InOut
 no exec
 rxspeed 21600000
 txspeed 5760000

NAT and cellular routing

Local lan is connected to Gi0/1 and all traffic is NAT overload'ed through Cellular0/0/0 interface. There ip 192.168.100.254/24 is a default gateway for local LAN hosts.

interface GigabitEthernet0/1
 ip address 192.168.100.254 255.255.255.0
 ip nat inside 		'<--- NAT needed when coming from private addresses'
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Cellular0/0/0
 description WAN link to Vodafone-APN
 ip address negotiated 	'<--- The NAS will issue your card an IP address'
 ip nat outside
 ip virtual-reassembly in
 encapsulation slip 		'<--- new modem cards are using native slip protocol to communicate with the router '
 dialer in-band
 dialer string hspa 		'<--- Again uses the chat-script'
 dialer-group 1 		'<--- References the dialer-list (interesting traffic)'
 async mode interactive
!
interface Cellular0/0/1
 no ip address
 encapsulation slip
!
ip forward-protocol nd
!
ip nat inside source list 2 interface Cellular0/0/0 overload
ip route 0.0.0.0 0.0.0.0 Cellular0/0/0 '<--- Static route to cellular interface required by Cisco for proper packet routing'
!
access-list 2 permit any 
dialer-list 1 protocol ip permit	'<--- Specifies interesting traffic to bring up the dialer'

Verify 3G connection

sh cellular 0/0/0 profile
  
Profile 1 = INACTIVE* 			'<--- NOTE inactive, Cellular still down'
--------
PDP Type = IPv4
Access Point Name (APN) = internet
Authentication = CHAP
Username: web
Password: web

Since we using a DDR config, the Cellular interface will only be brought up if there is interesting traffic, either real traffic or traffic created by IP SLA or from the command line.

#ping 8.8.8.8
 
Type escape sequence to abort.
  Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
  ...!!
  Success rate is 40 percent (2/5), round-trip min/avg/max = 92/106/120 ms
 
*Aug  28 10:37:58.499: %LINK-3-UPDOWN: Interface Cellular0/0/0, changed state to up

Verify the profile again to confirm all is working

#sh cellular 0/0/0 profile
Profile 1 = ACTIVE* 		'<--- NOTE now its active, Cellular is up'
--------
PDP Type = IPv4
PDP address = 10.49.122.44
Access Point Name (APN) = Internet
Authentication = CHAP
Username: web
Password: web
        Primary DNS address = 88.82.13.60
        Secondary DNS address = 88.82.13.60

Troubleshooting

This debug requires you to have enable service internal enabled

debug cellular 0/0/0 messages all 
debug ppp negotiation
debug ppp authentication
debug ppp packet
debug chat
debug async state
debug dialer

*debug ppp will only show messages on old routers as the new ones are using slip protocol for comminication between router and modem

show cell 0/0/0 radio history all '<-- will draw RSSI in time graph'
sh cellular 0/0/0 network | i Service|Status
sh cellular 0/0/0 con   !! (if there is one)

show cellular 0/0/0 network
show cellular 0/0/0 radio '<-- shows link strength' 
show cellular 0/0/0 profile
show cellular 0/0/0 security
show cellular 0/0/0 all 

show dialer
show interface dialer 3
show caller time

show controllers cellular 0/0/0
show interfaces cellular 0/0/0
show run interface cellular 0/0/0

sh cellular 0/0/0 network | include Cell

Examples at EN37QJ post code

sh cellular 0/0/0 network
 Current Service Status = Normal, Service Error = None
 Current Service = Combined
 Packet Service = HSPA+ (Attached)
 Packet Session Status = Active
 Current Roaming Status = Home
 Network Selection Mode = Automatic
 Country = GBR, Network = voda UK
 Mobile Country Code (MCC) = 234
 Mobile Network Code (MNC) = 15
 Location Area Code (LAC) = 175
 Routing Area Code (RAC) = 175
 Cell ID = 63412
 Primary Scrambling Code = 490
 PLMN Selection = Automatic
 Registered PLMN = vodafone UK , Abbreviated = voda UK
 Service Provider =

Explained

Cell ID

A unique number used to identify the GSM base transceiver station the phone is connected to.

MNC - Mobile Network Code

This number is used to uniquely identify the GSM network operator in combination with the MCC the phone is currently connected to.

MCC - Mobile Country Code

This is a unique number for the country with the GSM net the phone is currently connected to. (234 - United Kingdom)

LAC - Location Area Code

A 16-digit fixed length code that identifies the phone's location area within a GSM public land mobile network.

References

Configuring 3G Wireless WAN on Modular and Fixed ISRs (HWIC-3G-GSM, HWIC-3G-HSPA, PCEX-3G-HSPA-x)