Remote access to Local IP network via Femto Peerapol Tinnakornsrisuphap Anand Palanigounder Jun Wang Douglas Knisely Feb 16 th, 2009 Notice ©2009. All rights reserved. The contributors grants a free, irrevocable license to 3GPP2 and its Organizational Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partner’s name any Organizational Partner’s standards publication even though it may include all or portions of this contribution; and at the Organizational Partner’s sole discretion to permit others to reproduce in whole or in part such contribution or the resulting Organizational Partner’s standards publication. The contributors are also willing to grant licenses under such contributor copyrights to third parties on reasonable, non-discriminatory terms and conditions for purpose of practicing an Organizational Partner’s standard which incorporates this contribution. This document has been prepared by the contributors to assist the development of specifications by 3GPP2. It is proposed to the Committee as a basis for discussion and is not to be construed as a binding proposal on the contributors. The contributors specifically reserves the right to amend or modify the material contained herein and nothing herein shall be construed as conferring or offering licenses or rights with respect to any intellectual property of the contributors other than provided in the copyright statement above.

Overview of Remote IP access Allow AT to reach local IP network or server in the same domain with the Femto AP even when the AT is not connected over-the-air with the Femto AP –E.g., providing the same capability as with Local IP access when the AT is away –Typically, this is difficult as the local domain for femto maybe behind NAT/Firewall and is not reachable from outside –In addition to server, the IP host that AT can access remotely could be appliances such as security camera, A/C, etc.

Requirements in 3GPP for Release 9 The H(e)NB shall support remote access for CSG member to home based network from a UE via a PLMN, in order to provide access to IP capable devices connected to the home based network. It shall be possible to restrict the access to the home based network on per-subscriber basis (e.g. some subscribers may have managed access to their home network and others may not).

Femto Gateway actsas VPN gatewayfor IPsec tunnel with ATFGW forwards any packetsreceived from AT to FemtoAP IPsec tunnel(based on credential that ATuses to set up IPsec withFGW)Femto is DHCP server whichFGW will request local IP toassign to the AT as part ofIKEv2FGW forwards selectedpackets from Femto AP to AT(e.g., based on targetaddress)Femto Gateway needs to bereachable via AT’s macro IPaddress Architecture

Packet from AT in macro network to Home

Packet from Home to AT in macro network

Why this feature and Femto? While this service can be accomplished using 3 rd party software and device, this feature has good synergy with femto AP because: –If the Femto AP needs to support Local IP access, it already needs to support assigning local IP address for AT and perform proxy ARP function –Femto AP already has persistent IPsec tunnel with Femto Gateway that traverses through any NAT between the FAP and the gateway –Credentials for remote AT access (e.g., for authentication / authorization, secure IPsec tunnel) does not need pre-provisioning at the AT. The credentials for remote access can be derived using one of the existing credentials that the AT shares with the home network The details on how this is accomplished is FFS –Allow operator to have control on such feature and add additional services/revenues (e.g., by subscription)

Open issues that need further study How does the AT learn of the FGW IP address? (For establishing VPN) Credentials for AT remote access, secure tunnel establishment procedures, etc.