一文学会Open5GS和UERANSIM安装及使用

1 环境准备

VM配置（2台）

①操作系统：Ubuntu18.04.6 server（注意server版安装需要断网安装）

②CPU: 4

③Memory: 2G

④网卡2块：一块使用NAT模式用于访问外网（同时用于WebUI访问），另一块用于VM间的通信（配置桥接网卡，使用主机上的环回适配器）

注意：配置桥接口地址不要配置网关，否则可能无法访问外网

2 安装Open5GS及WebUI（使用1台虚拟机安装）

确认该虚拟机的网络地址配置，如修改，需执行sudo netplan apply执行生效

2.1 安装Open5GS

参考链接：
https://open5gs.org/open5gs/docs/guide/01-quickstart/

参考Ubuntu安装方法，具体如下：

$ sudo apt update
$ sudo apt install software-properties-common
$ sudo add-apt-repository ppa:open5gs/latest
$ sudo apt update
$ sudo apt install open5gs

2.2 安装WebUI

参考链接：
https://open5gs.org/open5gs/docs/guide/01-quickstart/

具体如下：

$ sudo apt install curl
$ curl -fsSL https://deb.nodesource.com/setup_14.x | sudo -E bash -
$ sudo apt install nodejs
$ curl -fsSL https://open5gs.org/open5gs/assets/webui/install | sudo -E bash -

WebUI需要通过http://localhost:3000访问，若localhost与想要访问的地址不一致，进行以下修改：

（1）修改文件中的hostname为ens33的IP地址172.16.190.214（OAM地址），可以使用“OAM地址+端口号”的格式访问客户端。

（2）重启webui服务

systemctl stop open5gs-webui.service
systemctl start open5gs-webui.service

root@guoliang:/home/guoliang# systemctl status open5gs-webui.service
● open5gs-webui.service - Open5GS WebUI
   Loaded: loaded (/lib/systemd/system/open5gs-webui.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2022-06-19 03:20:38 UTC; 6s ago
 Main PID: 6756 (node)
    Tasks: 11 (limit: 2287)
   CGroup: /system.slice/open5gs-webui.service
           └─6756 /usr/bin/node server/index.js

Jun 19 03:20:38 guoliang systemd[1]: Started Open5GS WebUI.
Jun 19 03:20:39 guoliang node[6756]: > Ready on http://172.16.190.214:3000
root@guoliang:/home/guoliang# 

（3）查看修改成功

（4）本地PC浏览器访问
http://172.16.190.214:3000/，默认账号密码：admin/1423

3 安装UERANSIM（使用另1台虚拟机安装）

确认该虚拟机的网络地址配置，如修改，需执行sudo netplan apply执行生效

参考链接：
https://github.com/aligungr/UERANSIM/wiki/Installation

cd ~
git clone https://github.com/aligungr/UERANSIM

sudo apt update
sudo apt upgrade

sudo apt install make
sudo apt install gcc
sudo apt install g++
sudo apt install libsctp-dev lksctp-tools
sudo apt install iproute2
sudo snap install cmake --classic

cd ~/UERANSIM
make

克隆时如需要输入账号密码，请登录github注册账号并获取token，token获取方式参考链接
https://blog.csdn.net/ddnosh/article/details/120575405

4 修改地址实现UERANSIM与Open5GS互通

VM内的网元通过默认的loopback口进行通信，VM间使用管理口地址互通

4.1 N2互通

修改UERANSIM虚机地址配置，vi
~/UERANSIM/config/open5gs-gnb.yaml

修改Open5GS虚机地址配置，vi /etc/open5gs/amf.yaml

4.2 N3互通

N3互通地址为子接口地址，跟管理口在同一网段下。

修改UERANSIM虚机GNB配置，vi
~/UERANSIM/config/open5gs-gnb.yaml

UERANSIM虚机配置子接口地址，vi
/etc/netplan/00-installer-config.yaml

修改Open5GS虚机UPF配置，vi /etc/open5gs/upf.yaml

Open5GS虚机配置子接口地址，vi
/etc/netplan/00-installer-config.yaml

待N2和N3接口地址配置完后，Open5GS执行以下命令生效配置

sudo systemctl restart open5gs-amfd
sudo systemctl restart open5gs-upfd

确认UERANSIM和Open5GS虚机可以互通ping通N2和N3接口地址

5 用户上下线

（1）启动5gs网元

systemctl start open5gs-upfd.service

查看网元状态

ps -aux | grep open5gs
root@guoliang:/home/guoliang# ps -aux | grep open5gs
open5gs    3248  0.0  0.7 220552 15820 ?        Ssl  03:05   0:00 /usr/bin/open5gs-nrfd -c /etc/open5gs/nrf.yaml
open5gs    3339  0.0  0.7 260936 15932 ?        Ssl  03:05   0:00 /usr/bin/open5gs-sgwud -c /etc/open5gs/sgwu.yaml
open5gs    3549  0.0  0.8 270020 17244 ?        Ssl  03:05   0:00 /usr/bin/open5gs-sgwcd -c /etc/open5gs/sgwc.yaml
open5gs    3630  0.0  0.5 199712 10176 ?        Ssl  03:05   0:00 /usr/bin/open5gs-bsfd -c /etc/open5gs/bsf.yaml
open5gs    3798  0.0  0.4 196220  9588 ?        Ssl  03:05   0:00 /usr/bin/open5gs-nssfd -c /etc/open5gs/nssf.yaml
open5gs    4066  0.0  0.6 2468672 12608 ?       Ssl  03:05   0:02 /usr/bin/open5gs-mmed -c /etc/open5gs/mme.yaml
open5gs    4197  0.0  0.4 197004  9696 ?        Ssl  03:05   0:00 /usr/bin/open5gs-ausfd -c /etc/open5gs/ausf.yaml
open5gs    4295  0.0  1.8 2772456 36484 ?       Ssl  03:05   0:02 /usr/bin/open5gs-smfd -c /etc/open5gs/smf.yaml
open5gs    4426  0.0  0.5 197008 10936 ?        Ssl  03:05   0:00 /usr/bin/open5gs-udmd -c /etc/open5gs/udm.yaml
open5gs    4701  0.0  0.7 2459676 14420 ?       Ssl  03:05   0:02 /usr/bin/open5gs-hssd -c /etc/open5gs/hss.yaml
open5gs    4826  0.0  0.7 222900 14272 ?        Ssl  03:05   0:00 /usr/bin/open5gs-udrd -c /etc/open5gs/udr.yaml
open5gs    4839  0.0  0.7 2462400 14188 ?       Ssl  03:05   0:02 /usr/bin/open5gs-pcrfd -c /etc/open5gs/pcrf.yaml
open5gs    4939  0.0  0.7 233648 14860 ?        Ssl  03:05   0:00 /usr/bin/open5gs-pcfd -c /etc/open5gs/pcf.yaml
open5gs    6816  0.0  0.6 229440 12240 ?        Ssl  04:04   0:00 /usr/bin/open5gs-amfd -c /etc/open5gs/amf.yaml
root       7190  0.0  0.0  13144  1060 pts/0    S+   04:04   0:00 grep --color=auto open5gs
root@guoliang:/home/guoliang# 


systemctl list-units | grep open5gs
root@guoliang:/home/guoliang# systemctl list-units | grep open5gs
open5gs-amfd.service                                                                                     loaded active     running      Open5GS AMF Daemon                                                                                               
open5gs-ausfd.service                                                                                    loaded active     running      Open5GS AUSF Daemon                                                                                              
open5gs-bsfd.service                                                                                     loaded active     running      Open5GS BSF Daemon                                                                                               
open5gs-hssd.service                                                                                     loaded active     running      Open5GS HSS Daemon                                                                                               
open5gs-mmed.service                                                                                     loaded active     running      Open5GS MME Daemon                                                                                               
open5gs-nrfd.service                                                                                     loaded active     running      Open5GS NRF Daemon                                                                                               
open5gs-nssfd.service                                                                                    loaded active     running      Open5GS NSSF Daemon                                                                                              
open5gs-pcfd.service                                                                                     loaded active     running      Open5GS PCF Daemon                                                                                               
open5gs-pcrfd.service                                                                                    loaded active     running      Open5GS PCRF Daemon                                                                                              
open5gs-sgwcd.service                                                                                    loaded active     running      Open5GS SGW-C Daemon                                                                                             
open5gs-sgwud.service                                                                                    loaded active     running      Open5GS SGW-U Daemon                                                                                             
open5gs-smfd.service                                                                                     loaded active     running      Open5GS SMF Daemon                                                                                               
open5gs-udmd.service                                                                                     loaded active     running      Open5GS UDM Daemon                                                                                               
open5gs-udrd.service                                                                                     loaded active     running      Open5GS UDR Daemon                                                                                               
open5gs-upfd.service                                                                                     loaded activating auto-restart Open5GS UPF Daemon                                                                                               
open5gs-webui.service                                                                                    loaded active     running      Open5GS WebUI                                                                                                    
root@guoliang:/home/guoliang# 

ps:修改网元配置后要重启网元服务生效

sudo systemctl restart open5gs-amfd
sudo systemctl restart open5gs-upfd

（2）启动基站

root@ueran:~/UERANSIM/build# 

执行后出现如下打印，则证明NG设置流程成功。后续的ueransim操作需要另开一个终端窗口。

（3）用户签约

查找用户签约需要的信息

查看/UERANSIM/config下的open5gs-ue.yaml，执行以下命令获取其中的supi、key、op、opType和amf的值

cat /UERANSIM/config/open5gs-ue.yaml
guoliang@guoliang:~$ cat UERANSIM/config/open5gs-ue.yaml 
# IMSI number of the UE. IMSI = [MCC|MNC|MSISDN] (In total 15 digits)
supi: 'imsi-901700000000001'
# Mobile Country Code value of HPLMN
mcc: '901'
# Mobile Network Code value of HPLMN (2 or 3 digits)
mnc: '70'

# Permanent subscription key
key: '465B5CE8B199B49FAA5F0A2EE238A6BC'
# Operator code (OP or OPC) of the UE
op: 'E8ED289DEBA952E4283B54E88E6183CA'
# This value specifies the OP type and it can be either 'OP' or 'OPC'
opType: 'OPC'
# Authentication Management Field (AMF) value
amf: '8000'
# IMEI number of the device. It is used if no SUPI is provided
imei: '356938035643803'
# IMEISV number of the device. It is used if no SUPI and IMEI is provided
imeiSv: '4370816125816151'

# List of gNB IP addresses for Radio Link Simulation
gnbSearchList:
  - 127.0.0.1

# UAC Access Identities Configuration
uacAic:
  mps: false
  mcs: false

# UAC Access Control Class
uacAcc:
  normalClass: 0
  class11: false
  class12: false
  class13: false
  class14: false
  class15: false

# Initial PDU sessions to be established
sessions:
  - type: 'IPv4'
    apn: 'internet'
    slice:
      sst: 1

# Configured NSSAI for this UE by HPLMN
configured-nssai:
  - sst: 1

# Default Configured NSSAI for this UE
default-nssai:
  - sst: 1
    sd: 1

# Supported integrity algorithms by this UE
integrity:
  IA1: true
  IA2: true
  IA3: true

# Supported encryption algorithms by this UE
ciphering:
  EA1: true
  EA2: true
  EA3: true

# Integrity protection maximum data rate for user plane
integrityMaxRate:
  uplink: 'full'
  downlink: 'full'
guoliang@guoliang:~$ 

在网页输入
http://172.16.190.214:3000/登录签约界面，并将上述关键信息填写到新建的Subscriber当中

（4）UE上线，UE上线成功后会创建接口uesimtun0

root@ueran:~/UERANSIM/build# ./nr-ue -c ../config/open5gs-ue.yaml 

执行后出现如下打印，表明UE的IP地址已经分配完成。后续的ueransim操作需要另开一个终端窗口。

在UERANSIM虚机上查看uesimtun0接口状态为UP，IP地址为10.45.0.6，该地址就是分配给UE的IP地址，用于GTP报文的转发。

在Open5GS虚机上查看ogstun接口，该接口IP地址与ueransim的uesimtun0的地址处于同一网段，两个接口可以带源互PING。（如：在UERANSIM节点上执行ping -I uesimtun0 10.45.0.1）

在open5gs上查看AMF的LOG：

$ tail -f /var/log/open5gs/amf.log

（5）用户打流

Open5GS虚机配置NAT:

### Enable IPv4/IPv6 Forwarding 
$ sudo sysctl -w net.ipv4.ip_forward=1 
$ sudo sysctl -w net.ipv6.conf.all.forwarding=1 

### Add NAT Rule 
$ sudo iptables -t nat -A POSTROUTING -s 10.45.0.0/16 ! -o ogstun -j MASQUERADE 
$ sudo ip6tables -t nat -A POSTROUTING -s 2001:db8:cafe::/48 ! -o ogstun -j MASQUERADE

①Ping包

root@ueran:~/UERANSIM/build# ping -I uesimtun0 baidu.com

如果ping不通，首先检查uesimtun0和ogustun接口是否可以带源互ping，然后检查Open5GS上是否可以ping通外网地址（如：www.baidu.com），如果无法Ping通外部网络，请检查Open5GS本机的路由设置，default路由是否关联在NAT网络并拥有较小的metric值。

②http包(curl)

执行前需要检查./nr-binder是否有执行权限（没有权限的话执行chmod 777 ./nr-binder）

如果提示curl指令不存在，则安装curl（执行指令：apt-get install curl）

root@ueran:~/UERANSIM/build# ./nr-binder 10.45.0.5 curl baidu.com

（6）抓包

tcpdump -i any可以抓到VM内网元交互以及VM间网元交互的所有报文

6 UERANSIM操作命令

查看node

root@guoliang:/home/guoliang/UERANSIM/build# ./nr-cli --dump
UERANSIM-gnb-901-70-1
imsi-901700000000001

查看gnb下可使用的命令

root@guoliang:/home/guoliang/UERANSIM/build# ./nr-cli UERANSIM-gnb-901-70-1
--------------------------------------------------------------------------------------------
$ commands
info       | Show some information about the gNB
status     | Show some status information about the gNB
amf-list   | List all AMFs associated with the gNB
amf-info   | Show some status information about the given AMF
ue-list    | List all UEs associated with the gNB
ue-count   | Print the total number of UEs connected the this gNB
ue-release | Request a UE context release for the given UE
--------------------------------------------------------------------------------------------
$ 

$ info
name: UERANSIM-gnb-901-70-1
nci: 16
plmn: 901/70
tac: 1
nssai: 
 - sst: 0x01
   sd: null
ngap-ip: 10.10.10.11
gtp-ip: 10.10.10.21
paging-drx: v128
ignore-sctp-id: true

$ status   
is-ngap-up: true

$ amf-list 
- id: 2

$ amf-info 2
id: 2
name: open5gs-amf0
address: 10.10.10.12:38412
state: CONNECTED
capacity: 255
association: 
 id: 2
 rx-num: 10
 tx-num: 10
served-guami: 
 - guami: 
    plmn: 901/70
    region-id: 2
    set-id: 1
    pointer: 0
   backup-amf: 
served-plmn: 
 - plmn: 901/70
   nssai: 
    - sst: 0x01
      sd: null

$ ue-list
- ue-id: 4
  ran-ngap-id: 4
  amf-ngap-id: 4

$ ue-count
1

$ ue-release 4 
Requesting UE context release

ue-release即UE释放，这里UE的ID值为4，执行ue-release 1后将发起UE释放的流程UE端显示UE切换为CM-IDLE状态

gNB端显示开始执行UE上下文的释放

在open5gs端抓取NGAP报文，能够看到UE上下文释放的流程及其内容（待补充）

查看UE下可使用的命令

root@guoliang:/home/guoliang/UERANSIM/build# ./nr-cli imsi-901700000000001
--------------------------------------------------------------------------------------------
$ commands
info           | Show some information about the UE
status         | Show some status information about the UE
timers         | Dump current status of the timers in the UE
rls-state      | Show status information about RLS
coverage       | Dump available cells and PLMNs in the coverage
ps-establish   | Trigger a PDU session establishment procedure
ps-list        | List all PDU sessions
ps-release     | Trigger a PDU session release procedure
ps-release-all | Trigger PDU session release procedures for all active sessions
deregister     | Perform a de-registration by the UE
--------------------------------------------------------------------------------------------
$ 

$ info
supi: imsi-901700000000001
hplmn: 901/70
imei: 356938035643803
imeisv: 4370816125816151
ecall-only: false
uac-aic: 
 mps: false
 mcs: false
uac-acc: 
 normal-class: 0
 class-11: false
 class-12: false
 class-13: false
 class-14: false
 class-15: false
is-high-priority: false

$ status
cm-state: CM-IDLE
rm-state: RM-REGISTERED
mm-state: MM-REGISTERED/NORMAL-SERVICE
5u-state: 5U1-UPDATED
sim-inserted: true
selected-plmn: 901/70
current-cell: 1
current-plmn: 901/70
current-tac: 1
last-tai: PLMN[901/70] TAC[1]
stored-suci: no-identity
stored-guti: 
 plmn: 901/70
 amf-region-id: 0x02
 amf-set-id: 1
 amf-pointer: 0
 tmsi: 0xcf0085b4
has-emergency: false

$ timers
T3346: .
T3396: .
T3444: .
T3445: .
T3502: .
T3510: .
T3511: .
T3512: rem[32171] int[32400]
T3516: .
T3517: .
T3519: .
T3520: .
T3521: .
T3525: .
T3540: .
T3584: .
T3585: .

$ rls-state
sti: 269378BE453D856D
gnb-search-space: 
 - 127.0.0.1

$ coverage
[1]: 
 signal: -1 dBm (Excellent)
 mib: 
  barred: false
  intra-freq-reselection: allowed
 sib1: 
  nr-cell-id: 0000000000000010
  plmn: 901/70
  tac: 1
  operator-reserved: false

$ ps-establish
Trigger a PDU session establishment procedure 
Usage:
  ps-establish <session-type> [options]

Examples:
  ps-establish IPv4 --sst 1 --sd 1 --dnn internet
  ps-establish IPv4 --emergency

Options:
  --sst <value>    SST value of the PDU session
  --sd <value>     SD value of the PDU session
  -n, --dnn <apn>  DNN/APN value of the PDU session
  -e, --emergency  Request as an emergency session
--------------------------------------------------------------------------------------------
$ ps-establish IPv4 --sst 1 sd 1 --dnn internet
PDU session establishment procedure triggered

Gnb端的打印

UE端的打印

$ ps-list        
PDU Session1: 
 state: PS-ACTIVE
 session-type: IPv4
 apn: internet
 s-nssai: 
  sst: 0x01
  sd: null
 emergency: false
 address: 10.45.0.8
 ambr: up[1Gb/s] down[1Gb/s]
 data-pending: false
PDU Session2: 
 state: PS-ACTIVE
 session-type: IPv4
 apn: internet
 s-nssai: 
  sst: 0x01
  sd: null
 emergency: false
 address: 10.45.0.9
 ambr: up[1Gb/s] down[1Gb/s]
 data-pending: false

$ ps-release 1
PDU session release procedure(s) triggered

UE端的打印

Gnb端的打印

$ ps-release-all
PDU session release procedure(s) triggered

释放所有PDU Session之后，系统会自动激活一个PDU Session

$ ps-list   
PDU Session1: 
 state: PS-ACTIVE
 session-type: IPv4
 apn: internet
 s-nssai: 
  sst: 0x01
  sd: null
 emergency: false
 address: 10.45.0.10
 ambr: up[1Gb/s] down[1Gb/s]
 data-pending: false

$ deregister
Perform a de-registration by the UE 
Usage:
  deregister <normal|disable-5g|switch-off|remove-sim>
--------------------------------------------------------------------------------------------
$ deregister switch-off
De-registration procedure triggered. UE device will be switched off.

选择UE去注册，类型为关机

UE端的输出，显示UE已关机，且UE进程退出

Gnb端的输出