li command reference
li hierarchy descriptions
This section provides the following Lawful Interception hierarchy descriptions:
configure li command hierarchy
configure
— li
— mobile-gateway
— 3gpp-5g-release
— 3gpp-release
— 5g-iri-ip-id
— client-tls-profile
— custom-correlation-id-format
— df-peer
— fan-out
— include-rai
— iri
— gw-function-iri-mode
— iri-per-mb-request
— ne-id
— te-id
— x2-iri-ice-type
— li-x1
— admf-peer
— alpn
— li-x1-keep-alive-time-p2
— li-x1-local-interface
— sni
— li-x2
— li-x2-keep-alive-time-p1
— li-x2-keep-alive-time-p2
— local-interface
— nf-id-value
— num-conn-retries
— operator-id
— server-tls-profile
— target
— tls
— x2-iri-cache-size
— x2-iri-qos
— x2-keep-alive-time
— pfcp-li-shared-key
— target
— description
— source
show li command hierarchy
show
— li
— mobile-gateway
— df-peer
— summary
— target
li command descriptions
This section provides the following Lawful Interception command descriptions:
configure li command descriptions
mobile-gateway
Syntax
- mobile-gateway
Context
- [Tree] configure li mobile-gateway
Description
Commands in this context configure lawful intercept (LI) functionality for the MAG-c.
3gpp-5g-release
Syntax
- 3gpp-5g-release release
Context
- [Tree] configure li mobile-gateway 3gpp-5g-release
Description
This command configures the 3GPP release option used for the 5G LI interfaces.
The no form of this command reverts to the default (base release).
Parameters
- release
- Specifies the 3GPP release.
3gpp-release
Syntax
- 3gpp-release release
Context
- [Tree] configure li mobile-gateway 3gpp-release
Description
This command configures the 3GPP release option used for LI interfaces.
The no form of this command reverts to the default (base release).
Parameters
- release
- Specifies the 3GPP release.
5g-iri-ip-id
Syntax
- 5g-iri-ip-id address ip-address | ipv6-address
- 5g-iri-ip-id auto
Context
- [Tree] configure li mobile-gateway 5g-iri-ip-id
Description
This command configures the interception product identifier (IP ID) of the 5G intercept-related information (IRI).
Default
5g-iri-ip-id auto
Parameters
- ip-address | ipv6-address
- Specifies the IP address as 5G IRI IP ID.
- auto
- Keyword to automatically generate the 5G IRI IP ID.
client-tls-profile
Syntax
- client-tls-profile tls-profile-name
- no client-tls-profile
Context
- [Tree] configure li mobile-gateway client-tls-profile
Description
This command configures a default client TLS profile on the MAG-c. When the TLS profile is configured, the MAG-c tries to establish a TCP connection with the lawful intercept gateway (LIG) over TLS for the 5G LI X2 interface. The MAG-c supports strict TLS-only mode for the 5G LI X2 interface. Both the MAG-c and the LIG must support TLS.
The no form of this command removes the configuration.
Default
no client-tls-profile
Parameters
- tls-profile-name
- Specifies the TLS profile name, up to 32 characters.
custom-correlation-id-format
Syntax
- custom-correlation-id-format {enable | disable}
- no custom-correlation-id-format
Context
- [Tree] configure li mobile-gateway custom-correlation-id-format
Description
This command facilitates sending the correlation ID with four octets charging ID (without including the gateway IP address). The correlation ID is included in IRI as well as in CC messages, so that the LIG can correlate IRI and CC messages.
The no form of this command reverts to default (disable).
Parameters
- enable
- Keyword to send the correlation ID with four octets charging identifier.
- disable
-
Keyword to not send the correlation ID with four octets charging identifier.
df-peer
Syntax
- df-peer df-peer-id df2-addr ip-address df2-port port [df2-tls-profile profile-name]
- no df-peer df-peer-id
Context
- [Tree] configure li mobile-gateway df-peer
Description
This command configures the DF peer of an LI gateway as DF2 (X2) only. It supports the following configuration options:
- DF2 IP address and port
- DF2 TLS profile
The no form of this command removes the DF peer information from the configuration.
Parameters
- def-peer-id
- Specifies the DF peer ID.
- ip-address
- Specifies the DF peer IP address where the X2 is sent.
- port
- Specifies the DF port number (TCP/UDP port) where the X2 is sent.
- profile-name
- Specifies the DF profile name, up to 32 characters.
fan-out
Syntax
- [no] fan-out
Context
- [Tree] configure li mobile-gateway fan-out
Description
This command enables IRI and IRI+CC fan-out functionality for LI on the mobile gateway. Each target activation must be uniquely identified by the lawful interception ID (LIID) specified using the target command. A maximum of 10 target activations are supported for a UE. There could be, for example, 5 activations using IMSI, 3 activations using MSISDN, and 2 activations using IMEI. A maximum of 7 activations are supported using the same target type (for example, IMSI). Each activation must be deactivated separately using the same LIID used at the time of activation.
The no form of this command reverts to the default.
Default
no fan-out
include-rai
Syntax
- [no] include-rai
Context
- [Tree] configure li mobile-gateway include-rai
Description
This command supports the inclusion of the Routing Area Identifier (RAI) from the message level along with the ULI received from the SGSN, within the Location of the Target Information Element that is sent in the IRI messages to the LIG.
The no form of this command reverts to the default.
Default
no include-rai
iri
Syntax
- iri
Context
- [Tree] configure li mobile-gateway iri
Description
Commands in this context configure LI IRI settings.
gw-function-iri-mode
Syntax
- [no] gw-function-iri-mode
Context
- [Tree] configure li mobile-gateway iri gw-function-iri-mode
Description
This command controls the IRI mode of generating events for a combined 4G SGW/PGW session on the MAG-c. For a combined session, by default, only MAG-c IRI events are generated. When this command is enabled, separate events are generated for the combined session from both the SGW and the PGW function.
The no form of this command reverts to the default (only PGW events are generated for the combined SGW/PGW session).
Default
no gw-function-iri-mode
iri-per-mb-request
Syntax
- [no] iri-per-mb-request
Context
- [Tree] configure li mobile-gateway iri iri-per-mb-request
Description
This command enables the additional MBReq event on a MAG-c acting as the SGW.
The no form of this command reverts to the default.
Default
no iri-per-mb-request
ne-id
Syntax
- ne-id address ip-address | ipv6-address
- ne-id s5
Context
- [Tree] configure li mobile-gateway iri ne-id
Description
This command configures the network element identifier (NEID).
Default
ne-id s5
Parameters
- ip-address | ipv6-address
- Specifies the IP address as NEID.
- s5
- Keyword to use the IP address of the S5 interface.
te-id
Syntax
- [no] te-id
Context
- [Tree] configure li mobile-gateway iri te-id
Description
This command enables the population of the tunnel endpoint identifier (TEID) (S5/S8-U PGW F-TEID: TEID + IP address) information element (IE) in a bearer activation IRI event from the SGW or PGW. This is an operator-custom IE.
The no form of this command reverts to the default (disabled).
Default
no te-id
x2-iri-ice-type
Syntax
- [no]x2-iri-ice-type
Context
- [Tree] configure li mobile-gateway iri x2-iri-ice-type
Description
This command enables inclusion of the ICE-Type in GTP signaling-related IRI messages sent by the mobile gateway. Applicable gateway types include SGW, PGW, and combined SGW/PGW.
The no form of this command reverts to the default (ICE-Type is not included in GTP signaling
related IRI messages).
Default
no x2-iri-ice-type
li-x1
Syntax
- li-x1
Context
- [Tree] configure li mobile-gateway li-x1
Description
Commands in this context configure LI_X1 interface settings.
admf-peer
Syntax
- admf-peer df-peer-id admf-addr admf-peer-address [x1-port x1-port-num]
- no admf-peer df-peer-id
Context
- [Tree] configure li mobile-gateway li-x1 admf-peer
Description
This command configures the administration function (ADMF) peer IP address, and optionally a port if other than the default value of 443 is used.
The no form of this command removes the specified ADMF peer.
Parameters
- df-peer-id
- Specifies the peer ID.
- admf-peer-address
- Specifies the peer IP address.
- x1-port-num
- Specifies the port number.
alpn
Syntax
- alpn {enable | disable}
Context
- [Tree] configure li mobile-gateway li-x1 alpn
Description
This command enables or disables the Application Layer Protocol Negotiation (ALPN) extension handling for TLS over the LI_X1 interface.
Default
alpn enable
li-x1-keep-alive-time-p2
Syntax
- li-x1-keep-alive-time-p2 x1-time-p2-value
- no li-x1-keep-alive-time-p2
Context
- [Tree] configure li mobile-gateway li-x1 li-x1-keep-alive-time-p2
Description
This command specifies the keep-alive time for the LI_X1 interface. If the timer is set to zero, the keep-alive mechanism is disabled.
The no form of this command reverts to the default.
Default
li-x1-keep-alive-time-p2 0
Parameters
- x1-time-p2-value
- Specifies the keep-alive time in seconds.
li-x1-local-interface
Syntax
- li-x1-local-interface ip-address [router router-instance] [local-port port-num]
- no li-x1-local-interface
Context
- [Tree] configure li mobile-gateway li-x1 li-x1-local-interface
Description
This command configures the IP address for the LI_X1 local end point.
Default
no li-x1-local-interface
Parameters
- ip-address
- Specifies the IP address.
- router-instance
- Specifies the router instance, up to 32 characters.
- port-num
- Specifies the port number.
sni
Syntax
- sni {enable | disable}
Context
- [Tree] configure li mobile-gateway li-x1 sni
Description
This command enables or disables the Service Name Indication (SNI) extension handling for TLS over the LI_X1 interface.
The no form of this command reverts to default.
Default
sni enable
li-x2
Syntax
- li-x2
Context
- [Tree] configure li mobile-gateway li-x2
Description
Commands in this context configure LI_X2 interface settings.
li-x2-keep-alive-time-p1
Syntax
- li-x2-keep-alive-time-p1 x2-time-p1-value
- no li-x2-keep-alive-time-p1
Context
- [Tree] configure li mobile-gateway li-x2 li-x2-keep-alive-time-p1
Description
This command specifies the keep-alive time for the LI_X2 interface on the MAG-c acting as the SMF. The POI sends a keepalive PDU at least everyx2-time-p1-value seconds (the default is 60 seconds). If the POI does not receive a keep-alive Acknowledgment PDU within the number of seconds specified for x2-time-p2-value, it disconnects the connection and attempts to reconnect to the MDF while reporting an error through the X1 interface as defined in ETSI TS 103 221-1. The default x2-time-p2-value is 180 seconds and it can be modified using the li-x2-keep-alive-time-p2 command.
The no form of this command reverts to the default. If the timer is set to 0 value, the keep-alive mechanism is disabled.
Parameters
- x2-time-p1-value
- Specifies the keep-alive time, in seconds.
li-x2-keep-alive-time-p2
Syntax
- li-x2-keep-alive-time-p2 x2-time-p2-value
- no li-x2-keep-alive-time-p2
Context
- [Tree] configure li mobile-gateway li-x2 li-x2-keep-alive-time-p2
Description
This command specifies the keep-alive time for the LI_X2 interface on the SMF. If the POI does not receive a keep-alive Acknowledgment PDU within the number of seconds specified for x2-time-p2-value (the default is 180 seconds), it disconnects the connection and attempts to reconnect to the MDF while reporting an error through the X1 interface as defined in ETSI TS 103 221-1.
The no form of this command reverts to the default. If the timer is set to 0 value, the keep-alive mechanism is disabled.
Parameters
- x2-time-p2-value
- Specifies the keep-alive time, in seconds.
local-interface
Syntax
- local-interface ip-address [router router-instance] [override-x2-interface x2-ip-address [x2-router x2-router-instance]]
- no local-interface
Context
- [Tree] configure li mobile-gateway local-interface
Description
This command configures the source IP address used by the xGW/GGSN for the LI interface. Specifying the override-x2-interface option enables each X2 interface to use a different VPRN context. When the override-x2-interface option is not specified, the X2 interfaces use the same IP address and VPRN context.
The no form of this command reverts to the default.
Default
no local-interface
Parameters
- ip-address
- Specifies the source IP address.
- router-instance
- Specifies the router instance, up to 32 characters.
- x2-ip-address
- Specifies the source X2 IP address.
- x2-router-instance
- Specifies the X2 router instance, up to 32 characters.
nf-id-value
Syntax
- nf-id-value {uuid | ip-addr | ip-addr-hex-string}
- no nf-id-value
Context
- [Tree] configure li mobile-gateway nf-id-value
Description
This command specifies the NF identifier choice of uuid or ip-addr to use for IRI and CC messages over the LI_X1, LI_X2 and LI_X3 interfaces. The ip-addr option specifies to use the configured local source IP address for the LI_X1, LI_X2 and LI_X3 interfaces as the NF identifier in IRI and CC messages respectively.
The no form of this command reverts to the default (uuid).
Default
no nf-id-value
Parameters
- uuid
- Keyword to use the UUID as the NF identifier in IRI and CC messages.
- ip-addr
- Keyword to use the local source IP address configured for the LI_X1, LI_X2 and the LI_X3 interfaces as the NF identifiers in the IRI and CC messages respectively.
- ip-addr-hex-string
- Keyword to use the local source IP address for the LI_X1, LI_X2 and the LI_X3 interfaces, encoded as a hex string (individual digits and the character '.' are converted to the hex form) as the NF identifiers for the IRI and CC messages respectively.
num-conn-retries
Syntax
- num-conn-retries num-of-retries
- no num-conn-retries
Context
- [Tree] configure li mobile-gateway num-conn-retries
Description
This command is used to specify the number of (TCP) connection retries to the LIG server, before it is deemed to be down.
The no form of this command reverts to the default.
Default
num-conn-retries 3
Parameters
- num-of-retries
- Specifies the number of retries.
operator-id
Syntax
- operator-id id-string
- no operator-id
Context
- [Tree] configure li mobile-gateway operator-id
Description
This command configures the operator ID for the deployment. The configured value is used to populate the operator-identifier field of the Network-Identifier IE.
The no form of this command reverts to the default
Default
operator-id oprId
Parameters
- id-string
- Specifies the operator ID, up to 5 characters.
server-tls-profile
Syntax
- server-tls-profile tls-profile-name
- no server-tls-profile
Context
- [Tree] configure li mobile-gateway server-tls-profile
Description
This command configures the default server TLS profile for the MAG-c lawful intercept X1 interface.
The no form of this command removes the server TLS profile configuration.
Default
no server-tls-profile
Parameters
- tls-profile-name
- Specifies the TLS profile name, up to 32 characters.
target
Syntax
- target target-type id target-value intercept intercept peer df-peer-id [liid liid-string]
- no target target-type id target-value [liid liid-string]
Context
- [Tree] configure li mobile-gateway target
Description
This command configures the LI target peer.
The no form of this command removes the specified LI target peer.
Parameters
- target-type
- Specifies the LI target type.
- target-value
- Specifies the LI target value.
- intercept
- Specifies that the interception is for IRI only.
- df-peer-id
- Specifies the peer ID.
- liid-string
- Specifies the lawful intercept ID (LIID), up to 25 characters.
tls
Syntax
- [no] tls
Context
- [Tree] configure li mobile-gateway tls
Description
This command enables the TLS protocol in the LI X2 and X3 interfaces. To enable the TLS protocol, make sure that following conditions apply:
- a valid client TLS profile is configured and administratively enabled (not shutdown) in all DF peers
- the X3 interface is using TCP as the transport option
The no form of this command reverts to the default.
Default
no tls
x2-iri-cache-size
Syntax
- x2-iri-cache-size cache-size
- no x2-iri-cache-size
Context
- [Tree] configure li mobile-gateway x2-iri-cache-size
Description
This command is used to specify the size of the IRI buffer cache. (IRI messages buffered when connectivity to the LIG is down). Setting the cache size to a value of 0 disables buffering.
The no form of this command reverts to the default.
x2-iri-qos
Syntax
- x2-iri-qos dscp {dscp-value | dscp-name}
- no x2-iri-qos
Context
- [Tree] configure li mobile-gateway x2-iri-qos
Description
This command specifies the DSCP to be set for interception related information (IRI) messages sent to a lawful interception gateway (LIG).
The no form of this command reverts to the default.
Parameters
- dscp-value
- Specifies the value of the DSCP to be set for IRI.
- dscp-name
- Specifies the name of the DSCP to be set for IRI.
x2-keep-alive-time
Syntax
- x2-keep-alive-time keep-alive-time
- no x2-keep-alive-time
Context
- [Tree] configure li mobile-gateway x2-keep-alive-time
Description
This command configures the keep-alive time for the X2 interface. An LI message including a keep-alive parameter is sent to the LIG when no LI message has been sent for the configured amount of time (for example, five minutes), indicating to the LIG that the LI connection is still up.
The no form of this command reverts to the default. A value of 0 disables the keep-alive mechanism.
Parameters
- keep-alive-time
- Specifies the keep-alive time in minutes.
pfcp-li-shared-key
target
Syntax
- target name
- no target
Context
- [Tree] configure li target
Description
This command configures an LI target name. This name only serves as an alias for the LI target.
The no form of this command removes the LI target configuration.
Parameters
- name
- Specifies the target name, up to 32 characters.
description
Syntax
- description description-string
Context
- [Tree] configure li target description
Description
This command configures a description for the LI target.
Parameters
- description-string
- Specifies the target description, up to 80 characters.
source
Syntax
- no source id
- source id imsi imsi-number [ingress] [egress] [fc fc-name [fc-name… (up to 8 max)]] intercept-id intercept-id session-id session-id [mirror-destination service-name]
- source id subscriber name [ingress] [egress] [fc fc-name [fc-name...(up to 8 max)]] intercept-id intercept-id session-id session-id mirror-destination service-name
- source id msisdn msisdn-number [ingress] [egress] [fc fc-name [fc-name… (up to 8 max)]] intercept-id intercept-id session-id session-id [mirror-destination service-name]
Context
- [Tree] configure li target source
Description
This command configures activation and deactivation of subscriber LI. The MAG-c supports 4G, 5G, and BNG subscriber LI.
The no form of this command removes the configuration of the source ID.
Parameters
- id
- Specifies a target source ID, or a name up to 64 characters; for example, if the target has 4 IMSIs. The imsi-number and id parameters are mutually exclusive. If you are performing LI on a wireline (BNG) subscriber, use the subscriber keyword.
- imsi-number
- Specifies an IMSI or SUPI number. The imsi-number and the id parameters are mutually exclusive. If you perform LI on a 4G or 5G wireless subscriber, use the imsi keyword.
- name
-
Specifies the subscriber name, up to 64 characters.
- ingress
- Keyword to specify the ingress source.
- egress
- Keyword to specify the egress source.
- fc-name
- Specifies the FC type.
- intercept-id
- Specifies the intercept ID.
- session-id
- Specifies the session ID.
- service-name
- Specifies the service name, up to 64 characters.
- msisdn-number
- Specifies the Mobile Station International Subscriber Directory Number (MSISDN).
show li command descriptions
mobile-gateway
Syntax
- mobile-gateway
Context
- [Tree] show li mobile-gateway
Description
Commands in this context display LI information.
df-peer
Syntax
- df-peer ip-addr ip-address | ipv6-address
- df-peer [df-peer-id]
Context
- [Tree] show li mobile-gateway df-peer
Description
This command displays only information about the 4G delivery function (DF) peer.
Parameters
- ip-address | ipv6-address
- Specifies the DF peer IP address.
- df-peer-id
- Specifies the DF peer ID.
summary
Syntax
- summary
Context
- [Tree] show li mobile-gateway summary
Description
This command displays a summary of the LI information.
target
Syntax
- target [target-type] [id target-value] [liid liid-string]
- target target-type id target-value detail
- target target-type id target-value stats
Context
- [Tree] show li mobile-gateway target
Description
This command displays only information about the 4G LI target type and value.
Parameters
- target-type
- Keyword that specifies the target type.
- target-value
- Specifies the target value.
- detail
- Keyword to display detailed information for the LI target context.
- liid-string
- Specifies the LI ID string for the target, up to 24 characters.
- stats
- Keyword to display statistics for the LI target context.
Output
The following output examples display configuration and statistics information for LI targets.
- LI target information
- LI target information for a specified IMSI
- LI target information for a specified MSISDN
- LI target information for a specified IMSI ID and LI ID
- LI target information for a specified MSISDN ID and LI ID
- LI target statistics for a specified IMSI ID
- LI target statistics for a specified MSISDN ID
- LI target detailed statistics for a specified IMSI ID
- LI target detailed statistics for a specified MSISDN ID
LI target information
# show li mobile-gateway target
===============================================================================
LI Target Information
===============================================================================
Target id (imsi) : 206010000000004
Intercept type : iri Df peer : 6
Li ID : 40
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Target id (msisdn) : 8801812300005
Intercept type : iri Df peer : 6
Li ID : 200
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 2
===============================================================================
LI target information for a specified IMSI
# show li mobile-gateway target imsi id 206010000000004
=============================================================================
LI Target Information
=============================================================================
Target id (imsi) : 206010000000004
Intercept type : iri Df peer : 6
Intercept id : 40
Sec Df Peer : 0 HA Df peer : 0
------------------------------------------------------------------------------
Number of targets : 1
==============================================================================
LI target information for a specified MSISDN
# show li mobile-gateway target msisdn id 8801812300005
===============================================================================
LI Target Information
===============================================================================
Target id (msisdn) : 8801812300005
Intercept type : iri Df peer : 6
Li ID : 200
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 1
===============================================================================
LI target information for a specified IMSI ID and LI ID
# show li mobile-gateway target imsi id 206010000000004 liid 40
===============================================================================
LI Target Information
===============================================================================
Target id (imsi) : 206010000000004
Intercept type : iri Df peer : 6
Li ID : 40
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 1
===============================================================================
LI target information for a specified MSISDN ID and LI ID
# show li mobile-gateway target msisdn id 8801812300005 liid 200
===============================================================================
LI Target Information
===============================================================================
Target id (msisdn) : 8801812300005
Intercept type : iri Df peer : 6
Li ID : 200
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 1
===============================================================================
LI target statistics for a specified IMSI ID
# show li mobile-gateway target imsi id 206010000000004 stats
===============================================================================
LI Target Information
===============================================================================
Target id (imsi) : 206010000000004
Intercept type : iri Df peer : 6
Li ID : 40
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Start of Interception with active bearer : 1
Number of targets : 1
===============================================================================
LI target statistics for a specified MSISDN ID
# show li mobile-gateway target msisdn id 8801812300005 stats
===============================================================================
LI Target Information
===============================================================================
Target id (msisdn) : 8801812300005
Intercept type : iri Df peer : 6
Li ID : 200
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 1
===============================================================================
LI target detailed statistics for a specified IMSI ID
# show li mobile-gateway target imsi id 206010000000004 detail
===============================================================================
LI Target Information
===============================================================================
Target id (imsi) : 206010000000004
Intercept type : iri Df peer : 6
Li ID : 40
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 1
-------------------------------------------------------------------------------
IMSI : 206010000000004
IMEI : 358505010000040
MSISDN : 8801812300004
UE State : connected Failure Reason : noError
Attach Time : 2024/06/17 19:02:38
ULI Type : taiAndEcgi
ULI Time : N/A
ULI : 206-01-4-00015b7
===============================================================================
LI target detailed statistics for a specified MSISDN ID
# show li mobile-gateway target msisdn id 8801812300005 detail
===============================================================================
LI Target Information
===============================================================================
Target id (msisdn) : 8801812300005
Intercept type : iri Df peer : 6
Li ID : 200
Sec Df Peer : 0 HA Df peer : 0
-------------------------------------------------------------------------------
Number of targets : 1
-------------------------------------------------------------------------------
IMSI : 206010000000005
IMEI : 358505010000050
MSISDN : 8801812300005
UE State : connected Failure Reason : noError
Attach Time : 2024/06/17 20:35:30
ULI Type : taiAndEcgi
ULI Time : N/A
ULI : 206-01-5-00015b8
===============================================================================