Policy and Traffic⚓︎

Policy configured in xControl is enforced on the user plane and applied to live sessions without a re-attach: bandwidth limits and quality of service from the System Profile, egress through the System's subnet, roaming restrictions from Roaming Profiles and Carrier Groups, per-network APN overrides for Mobile Assets on the mobile operator's public radio network, network slice selection on 5G, and correct handling of large packets.

EXP-POL-001 — Limit bandwidth (AMBR)⚓︎

Objective. When the Mobile Asset is moved to a System Profile with lower uplink and downlink bitrates (AMBR) in xControl, the subscriber database pushes the change into the live session: the bearer is modified without a detach, the UE keeps its address, and the measured upload and download throughput drops to the new limits.

Preconditions

• Device
  • The UE has a web browser application.
• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • A tool that measures upload and download throughput from the UE against a server on the enterprise network, such as iperf3 or OpenSpeedTest.
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Expected signalling

Capture points: S6a / N8 (point 4), S11 / N4 (point 3), S1-MME / N2 (point 1).

Pass criteria

• The change takes effect with no detach and no new session; the UE keeps its address.
• The signalled AMBR values equal the bitrates configured in the APN Profile.
• Measured upload and download after the change do not exceed the new limits.

Postconditions

• Restore the original System Profile if later tests assume it.

Evidence collected: Speed test result; xControl session event log; 3GPP signalling capture (pcap).
References: 3GPP TS 23.401 §4.7.3 (Bearer level QoS parameters (APN-AMBR)); 3GPP TS 23.401 §5.3.9.2 (Insert Subscriber Data procedure); 3GPP TS 23.401 §5.4.2.1 (HSS Initiated Subscribed QoS Modification); 3GPP TS 23.501 §5.7.2.6 (Session-AMBR); 3GPP TS 23.502 §4.3.3.2 (UE or network requested PDU Session Modification).

EXP-POL-002 — Enterprise access through the public radio network⚓︎

Objective. A Mobile Asset attached through the mobile operator's public radio network is authenticated by Expeto Gateway (xRouter), reaches the enterprise private LAN through the customer-dedicated xCore, and passes upload and download traffic.

Preconditions

• Platform
  • An xCore in the public configuration is installed and operational.
  • An xRouter is installed, configured, and integrated with that xCore.
• Mobile Asset
  • The Mobile Asset is imported into xControl and authorized (state Active).
• Tooling and access
  • Log in to xControl with an account that can view the Mobile Asset under test.
  • A signalling capture at the xRouter (capture point 4) and on the secure link (capture point 5).

Procedure

Expected signalling

Capture points: S6a / N8 at xRouter (point 4), secure link (point 5).

Pass criteria

• The UE reaches the enterprise LAN and passes traffic in both directions.
• No signalling crosses the secure link; only user-plane traffic does.

Evidence collected: UE connectivity check; xControl Mobile Asset status; 3GPP signalling capture (pcap).

EXP-POL-003 — System egress mapping⚓︎

Objective. Each System's Mobile Assets receive addresses from that System's range and their traffic leaves the xCore on that System's egress network, so that the enterprise can segment its network by System.

Preconditions

• Platform
  • The Site has two Systems, A and B, with different address ranges and different egress networks (for example two VLANs), each with a host that answers ping.
• Mobile Asset
  • One Mobile Asset on System A and one on System B, both connected (EXP-SES-007).
• Tooling and access
  • Log in to xControl with an account that can view the Mobile Asset under test.
  • A capture on each egress network (capture point SGi / N6).
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach
  • EXP-SES-007 — Multiple UE attach

Procedure

Pass criteria

• Every Mobile Asset's address is inside its System's range.
• Every Mobile Asset's traffic leaves on its own System's egress network and on no other.

Deployment notes

• Source address translation: Where a System's address pool is configured for source address translation on egress, the packets on the egress network carry the translated address; otherwise they carry the UE's address unchanged.

Evidence collected: xControl screenshot; ICMP result from the UE; 3GPP signalling capture (pcap).

EXP-POL-004 — Quality of service profile applied to the session⚓︎

Objective. The quality-of-service class configured in the Mobile Asset's APN Profile is signalled to the radio and the UE at session setup, and a change of profile is pushed into the live session by the subscriber database without a detach.

Preconditions

• Platform
  • Two System Profiles exist on the System whose APN Profiles differ in QoS (for example QCI 9 and QCI 6).
• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Expected signalling

Capture points: S6a / N8 (point 4), S11 / N4 (point 3), S1-MME / N2 (point 1).

Pass criteria

• The signalled QoS class and priority equal the configured values at setup and after the change.
• The change is applied to the live session with no detach and the same address.

Postconditions

• Restore the original System Profile if later tests assume it.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log.
References: 3GPP TS 23.401 §4.7.3 (Bearer level QoS parameters); 3GPP TS 23.401 §5.4.2.1 (HSS Initiated Subscribed QoS Modification); 3GPP TS 23.501 §5.7.1 (QoS model); 3GPP TS 23.502 §4.3.3.2 (UE or network requested PDU Session Modification).

EXP-POL-005 — Per-network APN override on the public radio network⚓︎

Objective. An APN override configured for a specific Carrier in the Mobile Asset's System Profile is applied when the UE is served by that network, taking precedence over the APN Profile's own bitrates.

Preconditions

• Platform
  • The public network the UE uses exists as a Carrier in xControl.
• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • A tool that measures upload and download throughput from the UE against a server on the enterprise network, such as iperf3 or OpenSpeedTest.
  • A signalling capture at xRouter (capture point 4).
• Procedures executed first
  • EXP-POL-002 — Enterprise access through the public radio network

Procedure

Pass criteria

• The override's bitrates are applied to the live session when the UE is on the named network, without a detach.

Postconditions

• Remove the override.

Evidence collected: Speed test result; 3GPP signalling capture (pcap).

EXP-POL-006 — Roaming Profile restriction on the public radio network⚓︎

Objective. A Roaming Profile whose Allowed Carrier Groups exclude the public network the UE is on causes the attach to be refused, and adding the network's Carrier Group restores service.

Preconditions

• Platform
  • The public network the UE uses exists as a Carrier in a Carrier Group in xControl.
  • A Roaming Profile exists whose Allowed Carrier Groups do not include that Carrier Group.
• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • A signalling capture at xRouter (capture point 4).
• Procedures executed first
  • EXP-POL-002 — Enterprise access through the public radio network

Procedure

Expected signalling

Capture points: S6a / N8 at xRouter (point 4).

Pass criteria

• The UE obtains no service while its Roaming Profile excludes the serving network.
• The Update Location Answer carries the roaming-not-allowed error and the UE receives EMM cause #11, PLMN not allowed (4G), or 5GMM cause #11 (5G), so it stops retrying this network and continues PLMN selection on others.
• Service returns once the Carrier Group is allowed.

Postconditions

• Restore the Mobile Asset's original Roaming Profile.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log.
References: 3GPP TS 29.272 §5.2.1.1 (Update Location procedure (roaming not allowed)); 3GPP TS 24.301 §5.5.1.2.5 (Attach not accepted by the network).

EXP-POL-007 — Large packets and MTU⚓︎

Objective. Packets up to the link MTU the network signals to the UE pass end to end without fragmentation, larger packets are handled per the configuration, and bulk TCP transfers do not stall.

Preconditions

• Device
  • The UE has a terminal application that can send pings of a chosen size with the do-not-fragment flag set.
• Tooling and access
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
  • A host on the enterprise LAN that answers ping and runs an iperf3 server.
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Pass criteria

• The network signals a link MTU of at least 1400 bytes to the UE.
• Packets at the signalled MTU pass unfragmented in both directions.
• The 60-second TCP transfers complete without stall in either direction.

Evidence collected: 3GPP signalling capture (pcap); UE connectivity check; Speed test result.
References: 3GPP TS 24.301 §6.5.1.3 (UE requested PDN connectivity procedure accepted by the network (protocol configuration options)).

EXP-POL-008 — Network slice selection (5G)⚓︎

Objective. A 5G UE requests network slices at registration. The AMF grants exactly the slices the Mobile Asset is subscribed to, the PDU session is established on an allowed slice and carries its S-NSSAI to the radio and the user plane, and a request for a slice the Mobile Asset is not subscribed to is refused.

Preconditions

• Platform
  • The Site's AMF advertises the S-NSSAIs supported for the Site's PLMN and tracking areas (in the access-mobility configuration of the core, plmnTacSliceList with supportedSnssais), and the user plane maps each S-NSSAI to the System's DNN.
  • You know the S-NSSAIs written into the Mobile Asset's subscription by xControl (its default single NSSAIs, for example SST 1 and SST 1 with SD 000001).
• Mobile Asset
  • The UE's Mobile Asset is provisioned in xControl on the System under test, with state Active and status Provisioned or Disconnected.
• Device
  • A 5G SA UE whose Requested NSSAI can be set (or a UE that requests the network's default slice) and, for the negative step, a UE or simulator that can request an S-NSSAI not in the subscription.
  • The UE has the APN of its System Profile configured.
• Tooling and access
  • Log in to xControl with an account that can view the Mobile Asset under test.
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
  • Access to the CLI.

Procedure

Expected signalling

Capture points: N2 (point 1), N4 (point 3).

Pass criteria

• The Allowed NSSAI in the Registration Accept equals the Mobile Asset's subscribed S-NSSAIs; every other requested S-NSSAI is rejected.
• The PDU session carries an allowed S-NSSAI end to end (NAS, N2, AMF context) and passes traffic.
• A PDU session on a non-allowed S-NSSAI is refused without affecting the established session.

Evidence collected: 3GPP signalling capture (pcap); CLI output; xControl Mobile Asset status.
References: 3GPP TS 23.501 §5.15.5.2.1 (Network slice selection at registration); 3GPP TS 23.502 §4.2.2.2.2 (General Registration (Allowed NSSAI)); 3GPP TS 24.501 §5.5.1.2.4 (Initial registration accepted by the network (Allowed and Rejected NSSAI)); 3GPP TS 24.501 §6.4.1.2 (UE-requested PDU session establishment procedure initiation (S-NSSAI); 3GPP TS 29.503 §5.2.2.2 (Subscription data retrieval (NSSAI)).