Skip to content

Commit 89924df

Browse files
v-regandownerv-regandowner
authored
Merge pull request #238800 from robswain/22153-direct-routing
ADO 22153 - add internal forwarding support
2 parents 43d8d66 + 4a34c36 commit 89924df

File tree

4 files changed

+184
-0
lines changed

4 files changed

+184
-0
lines changed

‎articles/private-5g-core/configure-internal-forwarding.md

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
---
2+
title: Configure UE to UE internal forwarding - Azure portal
3+
titleSuffix: Azure Private 5G Core
4+
description: In this how-to guide you'll learn how to enable or disable UE to UE internal forwarding using policy control configuration in the Azure portal.
5+
author: robswain
6+
ms.author: robswain
7+
ms.service: private-5g-core
8+
ms.topic: how-to
9+
ms.date: 05/31/2023
10+
ms.custom: template-how-to
11+
---
12+
13+
# Configure UE to UE internal forwarding for Azure Private 5G Core - Azure portal
14+
15+
Azure Private 5G Core enables traffic flowing between user equipment (UEs) attached to the same data network to stay within that network. This is called *internal forwarding between UEs*. Internal forwarding between UEs minimizes latency and maximizes security and privacy for UE-UE traffic. You can enable or disable this behavior using SIM policies.
16+
17+
If you are using the [Default service and allow-all SIM policy](default-service-sim-policy.md), internal forwarding will be enabled. If you are using a more restrictive policy, you may need to enable internal forwarding.
18+
19+
If you are using the [Default service and allow-all SIM policy](default-service-sim-policy.md) and would like to disable internal forwarding, either because you use an external gateway or because you do not want UEs to communicate with each other, you can create a service to do so and then apply it to your allow-all SIM policy.
20+
21+
## Prerequisites
22+
23+
- Ensure you can sign in to the Azure portal using an account with access to the active subscription you identified in [Complete the prerequisite tasks for deploying a private mobile network](complete-private-mobile-network-prerequisites.md). This account must have the built-in Contributor or Owner role at the subscription scope.
24+
- Identify the name of the Mobile Network resource corresponding to your private mobile network.
25+
- Collect all the configuration values in [Collect the required information for a service](collect-required-information-for-service.md) for your chosen service.
26+
27+
## Create a service to allow internal forwarding
28+
29+
In this step, we'll create a service that allows traffic labeled with the remote address in the range configured for UEs (10.20.0.0/16, in this example) to flow in both directions.
30+
31+
To create the service:
32+
33+
1. Sign in to the [Azure portal](https://portal.azure.com/).
34+
1. Search for and select the Mobile Network resource representing your private mobile network.
35+
36+
:::image type="content" source="media/mobile-network-search.png" alt-text="Screenshot of the Azure portal showing the results for a search for a Mobile Network resource.":::
37+
38+
1. In the **Resource** menu, select **Services**.
39+
40+
:::image type="content" source="media/configure-service-azure-portal/services-resource-menu-option.png" alt-text="Screenshot of the Azure portal showing the Services option in the resource menu of a Mobile Network resource.":::
41+
42+
1. In the **Command** bar, select **Create**.
43+
44+
:::image type="content" source="media/configure-service-azure-portal/create-command-bar-option.png" alt-text="Screenshot of the Azure portal showing the Create option in the command bar.":::
45+
46+
1. We'll now enter values to define the QoS characteristics that will be applied to service data flows (SDFs) that match this service. On the **Basics** tab, fill out the fields as follows.
47+
48+
|Field |Value |
49+
|---------|---------|
50+
|**Service name** |`service_allow_internal_forwarding` |
51+
|**Service precedence** | `200` |
52+
|**Maximum bit rate (MBR) - Uplink** | `2 Gbps` |
53+
|**Maximum bit rate (MBR) - Downlink** | `2 Gbps` |
54+
|**Allocation and Retention Priority level** | `2` |
55+
|**5QI/QCI** | `9` |
56+
|**Preemption capability** | Select **May not preempt**. |
57+
|**Preemption vulnerability** | Select **Not preemptible**. |
58+
59+
1. Under **Data flow policy rules**, select **Add a policy rule**.
60+
61+
1. We'll now create a data flow policy rule that allows any packets that match the data flow template we'll configure in the next step. Under **Add a policy rule** on the right, fill out the fields as follows.
62+
63+
|Field |Value |
64+
|---------|---------|
65+
|**Rule name** |`rule_allow_internal_forwarding` |
66+
|**Policy rule precedence** | Select **200**. |
67+
|**Allow traffic** | Select **Enabled**. |
68+
69+
1. We'll now create a data flow template that matches on packets flowing towards or away from UEs in 10.20.0.0/16, so that they can be allowed by `rule_allow_internal_forwarding`.
70+
Under **Data flow templates**, select **Add a data flow template**. In the **Add a data flow template** pop-up, fill out the fields as follows.
71+
72+
|Field |Value |
73+
|---------|---------|
74+
|**Template name** |`internal_forwarding` |
75+
|**Protocols** | Select **All**. |
76+
|**Direction** | Select **Bidirectional**. |
77+
|**Remote IPs** | `10.20.0.0/16` |
78+
|**Ports** | Leave blank. |
79+
80+
1. Select **Add**.
81+
1. On the **Basics** configuration tab, select **Review + create**.
82+
1. Select **Create** to create the service.
83+
1. The Azure portal will display the following confirmation screen when the service has been created. Select **Go to resource** to see the new service resource.
84+
85+
:::image type="content" source="media/configure-service-azure-portal/service-resource-deployment-confirmation.png" alt-text="Screenshot of the Azure portal showing the successful deployment of a service and the Go to resource button.":::
86+
87+
1. Confirm that the QoS characteristics, data flow policy rules, and service data flow templates listed at the bottom of the screen are configured as expected.
88+
89+
## Create a service to block internal forwarding
90+
91+
In this step, we'll create a service that blocks traffic labeled with the remote address in the range configured for UEs (10.20.0.0/16, in this example) in both directions.
92+
93+
To create the service:
94+
95+
1. Sign in to the [Azure portal](https://portal.azure.com/).
96+
1. Search for and select the Mobile Network resource representing your private mobile network.
97+
98+
:::image type="content" source="media/mobile-network-search.png" alt-text="Screenshot of the Azure portal showing the results for a search for a Mobile Network resource.":::
99+
100+
1. In the **Resource** menu, select **Services**.
101+
102+
:::image type="content" source="media/configure-service-azure-portal/services-resource-menu-option.png" alt-text="Screenshot of the Azure portal showing the Services option in the resource menu of a Mobile Network resource.":::
103+
104+
1. In the **Command** bar, select **Create**.
105+
106+
:::image type="content" source="media/configure-service-azure-portal/create-command-bar-option.png" alt-text="Screenshot of the Azure portal showing the Create option in the command bar.":::
107+
108+
1. Enter values to define the QoS characteristics that will be applied to service data flows (SDFs) that match this service. On the **Basics** tab, fill out the fields as follows.
109+
110+
|Field |Value |
111+
|---------|---------|
112+
|**Service name** |`service_block_internal_forwarding` |
113+
|**Service precedence** | `200` |
114+
|**Maximum bit rate (MBR) - Uplink** | `2 Gbps` |
115+
|**Maximum bit rate (MBR) - Downlink** | `2 Gbps` |
116+
|**Allocation and Retention Priority level** | `2` |
117+
|**5QI/QCI** | `9` |
118+
|**Preemption capability** | Select **May not preempt**. |
119+
|**Preemption vulnerability** | Select **Not preemptible**. |
120+
121+
> [!IMPORTANT]
122+
> The **Service precedence** must be a lower value than any conflicting service (such as an "allow all" service). Services are matched to traffic in order of precedence.
123+
124+
1. Under **Data flow policy rules**, select **Add a policy rule**.
125+
126+
1. We'll now create a data flow policy rule that blocks any packets that match the data flow template we'll configure in the next step. Under **Add a policy rule** on the right, fill out the fields as follows.
127+
128+
|Field |Value |
129+
|---------|---------|
130+
|**Rule name** |`rule_block_internal_forwarding` |
131+
|**Policy rule precedence** | Select **200**. |
132+
|**Allow traffic** | Select **Blocked**. |
133+
134+
1. We'll now create a data flow template that matches on packets flowing towards or away from UEs in 10.20.0.0/16, so that they can be blocked by `rule_block_internal_forwarding`.
135+
Under **Data flow templates**, select **Add a data flow template**. In the **Add a data flow template** pop-up, fill out the fields as follows.
136+
137+
|Field |Value |
138+
|---------|---------|
139+
|**Template name** |`internal_forwarding` |
140+
|**Protocols** | Select **All**. |
141+
|**Direction** | Select **Bidirectional**. |
142+
|**Remote IPs** | `10.20.0.0/16` |
143+
|**Ports** | Leave blank. |
144+
145+
1. Select **Add**.
146+
1. On the **Basics** configuration tab, select **Review + create**.
147+
1. Select **Create** to create the service.
148+
1. The Azure portal will display the following confirmation screen when the service has been created. Select **Go to resource** to see the new service resource.
149+
150+
:::image type="content" source="media/configure-service-azure-portal/service-resource-deployment-confirmation.png" alt-text="Screenshot of the Azure portal showing the successful deployment of a service and the Go to resource button.":::
151+
152+
1. Confirm that the QoS characteristics, data flow policy rules, and service data flow templates listed at the bottom of the screen are configured as expected.
153+
154+
## Modify an existing SIM policy to assign the new service
155+
156+
In this step, we'll assign the new service (`service_allow_internal_forwarding` or `service_block_internal_forwarding`) to an existing SIM policy.
157+
158+
1. Find the SIM policy configured for your UEs.
159+
160+
:::image type="content" source="media/configure-sim-policy-azure-portal/sim-policies-resource-menu-option.png" alt-text="Screenshot of the Azure portal showing the SIM policies option in the resource menu of a Mobile Network resource.":::
161+
162+
163+
1. Select the SIM policy you want to modify and select **Modify the selected SIM policy**.
164+
165+
:::image type="content" source="media/sim-policies-modify-button.png" alt-text="Screenshot of the Azure portal showing the modify SIM policies option.":::
166+
167+
1. Select **Modify Network Scope** for the existing slice and data network configured for your UEs.
168+
1. Under **Service configuration**, add the new service.
169+
1. Select **Modify**.
170+
1. Select **Assign to SIMs**.
171+
1. Select **Review + modify**.
172+
1. Review your updated SIM policy and check that the configuration is as expected.
173+
174+
- The top level settings for the SIM policy are shown under the **Essentials** heading.
175+
- The network scope configuration is shown under the **Network scope** heading including configured services under **Service configuration** and quality of service configuration under **Quality of Service (QoS)**.
176+
177+
## Next steps
178+
179+
- [Find out how to design your own policy control configuration](policy-control.md)
180+

‎articles/private-5g-core/index.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,8 @@ landingContent:
120120
url: configure-sim-policy-azure-portal.md
121121
- text: Configure a service and SIM policy - ARM template
122122
url: configure-service-sim-policy-arm-template.md
123+
- text: Configure UE to UE internal forwarding - Azure portal
124+
url: configure-internal-forwarding.md
123125
# Card
124126
- title: Provision and manage SIMs
125127
linkLists:

‎articles/private-5g-core/media/sim-policies-modify-button.png

37.6 KB
Loading

‎articles/private-5g-core/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,8 @@ items:
124124
href: configure-sim-policy-azure-portal.md
125125
- name: Configure a service and SIM policy - ARM template
126126
href: configure-service-sim-policy-arm-template.md
127+
- name: Configure UE to UE internal forwarding - Azure portal
128+
href: configure-internal-forwarding.md
127129
- name: SIMs
128130
items:
129131
- name: Provision new SIMs - Azure portal

0 commit comments

Comments
 (0)