Lawful Intercept - Cisco ASR 5000 series Product Overview

▀ Features and Functionality - Base Software
Routing and Miscellaneous Features
OSPFv3
MP-BGP v6 extensions
IPv6 flows (Supported on all Diameter QoS and Charging interfaces as well as Inline Services (e.g. ECS, P2P
detection, Stateful Firewall, etc)

Lawful Intercept

Provides a standardized architecture for lawful monitoring and interception of subscriber call content and control events
as mandated by a court ordered warrant from a law enforcement agency.
In accordance with 3GPP TS 33.108 Release 8 requirements the Cisco S-GW supports the Lawful Intercept Access
Function for intercepting control and data messages of mobile targets. Law Enforcement Agencies request the network
operator to start the interception of a particular mobile user based on court ordered subpoenas.
The Cisco EPC gateways provide access to the intercepted Content of Communications (CC) and the Intercept Related
Information (IRI) of the mobile target and services related to the target on behalf of Law Enforcement Agencies. In this
release the S-GW supports the following three interfaces:
X1 provisioning interface from Administrative Function (ADMF) using CLI over SSH: Intercept targets can be
provisioned using subscriber information including MSISDN, IMSI and MEI. Interception of only events (IRI)
or events and call content (IRI + CC) can be provisioned.
X2 event delivery interface for transferring Intercept Related Information (IRI) to a Delivery Function/Mediation
server: Intercepted events include QoS information (if available), bearer activation (Default and Dedicated
bearer), start of intercept with bearer active, bearer modification, bearer deactivation, and UE requested bearer
resource modification.
X3 content delivery: Includes intercepted call content for all default and dedicated EPS bearers.
The intercepted call control data is encoded in a Cisco proprietary message header format using an optional TLV field to
pack the IRI information. The message header also includes other identifying information including sequence numbers,
timestamps and session & correlation numbers to correlate session and bearer related information with interception on
other EPC elements. If provisioning is activated while the call is active for the target identity then the intercepted
information is immediately forwarded to the mediation server. Otherwise camp-on monitoring is used and the system
waits for the call to become active (ECM CONNECTED state) and compares the IMSI, MSISDN and MEI against the
LI monitoring list as a trigger to begin the intercept.
A total of 20,000 simultaneous LI triggers can be provisioned on the Cisco P-GW, S-GW or MME. Our solution is
currently interoperable with leading mediation solutions from partners such as SS8 and Utimaco.
Important:
Guide.
Subscriber Level Trace
Provides a 3GPP standards-based session level trace function for call debugging and testing new functions and access
terminals in an LTE environment.
▄ Cisco ASR 5000 Series Product Overview
For more information on Lawful Intercept support, refer to the Lawful Intercept Configuration
Serving Gateway Overview
OL-22938-02