Provisioning Lawful Intercept - Cisco ASR 5000 Series Administration Manual

System Settings
to login with their credentials. After the system comes up with the earlier StarOS release, suspended users
can be identified in the output of the show local-user [verbose]command.
To reactivate suspended users a Security Administrator can:
• Set temporary passwords for suspended users, using the Exec mode password change local-user
• Reset the suspend flag for users, using the Configuration mode no suspend local-user username

Provisioning Lawful Intercept

Lawful Intercept (LI) functionality allows a network operator to intercept control and data messages to and
from targeted mobile users. Accompanied by a court order or warrant, a Law Enforcement Agency (LEA)
initiates a request for the network operator to start the interception for a particular mobile user.
There are different standards followed for Lawful Intercept in different countries. The LI Configuration Guide
describes how the feature works as well as how to configure and monitor the feature for each of the StarOS
services that support Lawful Intercept. This guide is not available on www.cisco.com. It can only be obtained
by contacting your Cisco account representative.
Security-related limitations on Lawful Intercept provisioning are described in Lawful Intercept Restrictions
section of the System Security chapter.
LI can be provisioned within one or more StarOS contexts. An administrative user with li-administration
privilege is associated with the context(s) that support LI capability. That administrator has access to the CLI
configuration commands that provision LI functionality.
There are several types of LI configurations supported within a StarOS system configuration.
• No LI Context – The LI configuration was never entered for any context.
• Single LI Context – The LI configuration was entered within one context, but was never been entered
• Multiple LI Contexts – Two or more contexts have been configured with the LI configuration. A
• Dedicated LI Context – If the existing system configuration is a No LI Context or a Single LI Context
username command.
command.
within any other context. In this state, the Single LI Context can be converted to Multiple LI contexts
if another context is configured with an LI configuration, or this context can be converted into the
Dedicated-LI context by entering the Context Configuration mode dedicated-li command.
Multiple-LI context configuration can never be re-configured as any other type of LI configuration.
system, it can be converted to a Dedicated-LI Context system by entering the Context Configuration
mode dedicated-li command. A Dedicated LI context limits access to the LI configuration to the one
VPN context which requires it. Once configured as a Dedicated-LI context system, it can never be
ASR 5500 System Administration Guide, StarOS Release 21.4
Provisioning Lawful Intercept
57