Configuring a Cisco 887 and Telstra 3G WAN

Recently I had to configure a Cisco 887 (specifically an 887VAG) for connecting via Telstra’s 3G WAN service. Whilst there are several guides including Cisco’s own excellent documentation nothing was exactly what I was looking for so I thought I’d share my config and a few handy hints I picked up along the way.

Firstly these routers make an excellent standardized platform as they do ADSL, 3G and Ethernet so have pretty much all the branch connectivity you could want. Plus you can configure the ADSL as a primary connection and 3G as a backup, in this case however I just needed 3G connectivity for a remote site where ADSL was not available. Enough fawning though here’s the main thing you probably want the final working configuration, which has had the irrelevant bits removed for brevity.

version 15.2
hostname MyRouter
chat-script telstra "" "AT!SCACT=1,1" TIMEOUT 15 "OK"
controller Cellular 0
interface FastEthernet0
  switchport access vlan 1
  no ip address
interface Cellular0
  description 3G SIM Slot 0
  ip address negotiated
  encapsulation slip
  dialer in-band
  dialer idle-timeout 300
  dialer string telstra
  dialer-group 1
  async mode interactive
interface Vlan1
 ip address
ip route Cellular0
dialer-list 1 protocol ip permit
line 3
  exec-timeout 0 0
  script dialer telstra
  modem InOut
  no exec
  transport input all

This however is not enough on its own, there is also some configuration that is stored withing the 3G modem itself so does not display in a show running-configuration output. This is the string that contains the 3G APN and user credentials if required. For connecting to Telstra’s Corporate WAN service you need the following.

MyRouter# cellular 0 gsm profile create 1 telstra.corp chap USERNAME PASSWORD ipv4

Note this is entered not at a configure prompt but rather the global enable prompt, also your correct values for username and password need to be entered where indicated. typically the username is in the format as given to you by your Telstra rep. This configuration will connect to Telstra’s WAN service, however the above config will also work to connect to any other service from Telstra or any other provider you just need to correct APN. Some examples would be:

Standard Telstra 3G data service with no username or password

MyRouter# cellular 0 gsm profile create 1 telstra.wap
MyRouter# cellular 0 gsm profile create 1 telstra.datapack

Optus 3G Pre or Post paid data service with no username or password

MyRouter# cellular 0 gsm profile create 1 preconnect
MyRouter# cellular 0 gsm profile create 1 connect

You can find a reasonable list of the Australian 3G APN names here or via Google.

Note as well in the configuration there are 3 references to “telstra” for my config because I was using Telstra I named the script that so it’s easily identifiable. That script is merely a name so it will still work perfectly fine for any non-Telstra carrier but you might still want to change it to avoid confusion. Just make sure to change it in the chat-script, Cellular0 and line3 sections of the configuration. I’m not entirely sure as well that the dialer string is required but I had enough other things to solve and it works so I left it.

That’s it! With that configuration you should be able to get 3G happily working and connecting into your WAN. If for some reason though it doesn’t work see the troubleshooting guide below.


One of the biggest problems I had when it didn’t work straight out of the box was knowing what it should be doing and the interrelationship between all the different bits. To make that easier here’s a layman’s breakdown of how the 3G setup all works and hangs together.

  • The first part is the modem and 3G sim, these obviously need to be working correctly and you need to make sure you have a datapack enabled on your sim.
  • The next component is the “line3” part of the configuration. This is what the Cellular0 interface uses to “talk” through to access the modem. With a 3G HWIC cards it is NOT line 3 but something else, so make sure you double check what your hardware is and adjust as appropriate. If someone out there also knows why it’s 3 and not 1 or 7, I’d love to hear the explanation. I’m also unsure  if SIM slot 1 is line 4 but for all my configuration I had the SIM in slot0 (the bottom one), and suggest you do the same.
  • The last component is the Cellular0 interface, this handles the actual setup and tear-down of the interface and “call” based upon fairly standard DDR stuff. The keys being dialer in-band and async mode.

So now you have an idea of the rough order and interaction you can now target each part depending on where it’s failing.

3G SIM and Modem

As previously stated you want to make sure your SIM is properly enabled and setup, the easiest way to do this usually is to stick it in a 3G capable phone and see if you get connectivity. If the SIM is working OK in the phone check that the router recognizes it and the hardware is OK.

show cellular 0 hardware and show cellular 0 security are your best bets here, you’re looking for things like Modem Status = Online, Active SIM = 0 and SIM Status = OK. This tells you the hardware is fine and the sim is correctly inserted and recognized. If  the show security says the sim is locked you can unlock it using cellular 0 gsm sim unlock PIN full details here. If the SIM is showing errors in general, you can try also activating the SIM with MyRouter# cellular 0 gsm sim activate slot 0 which should either work or return the error [Cellular0] Command failed: SIM 0 is already the active sim.

If the SIM is all OK you can make sure the modem is working correctly.  The 3G modem is just like the old school modems you have to connect to it via a serial connection and perform a bunch of cryptic AT commands to get it to cough up it’s information, on the Cisco this is done via a reverse telnet. If you have a working IP on the device say a LAN interface you can use that otherwise you need to give it a temporary loopback interface and use that. The sequence is:

MyRouter#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
MyRouter(config)#interface loopback0
MyRouter(config-if)#ip address
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
MyRouter#telnet 2003
Trying, 2003 ... Open

The only odd bit here is the port 2003 you connect to. Remember I said it was line3 before, well the port you have to connect to is 2000 + line number so in this case 2003. I don’t know why but it works so I don’t question it.

Note also it will refuse the connection if a “call” is currently in progress as the Cellular0 interface has the line busy. If you’re troubleshooting chances are this isn’t a problem but in-case you need to manually connect just shutdown the cellular interface and you should be good to telnet. Once connected to the modem you can fire AT commands to chack the modem is working correctly. The most useful ones at this point are probably AT!RESET which resets the modem, AT+CGMI, AT+CGMM which show manufacturer details and AT+CLAC which shows the commands supported by your modem. You should be careful playing directly with the modem too, some of the commands can change some fairly low level stuff like frequencies, operators and QoS and which might break things. In fact Cisco recommend not sending AT commands directly to 3G cards but sometimes it’s necessary for testing, so use at your own risk.  🙂

One of the other Important AT commands is AT!SCACT=1,1 which you will notice is contained in the config as the chat script. Basically this can be interpreted as try and connect using the first profile saved in the modem. The first number can be either 1 or 0 and means effectively enable, the second is the profile number. This command is your link between the profile saved above and the modem.

If you have a profile saved and all is setup correctly issuing the command should simply return “OK” after a brief pause. Typically though if things aren’t working you’ll see something like “+CME ERROR: no network service”, which is less than helpful. You can get a bit more information about the possible problem by using “debug cellular messages all”, althoguh typically all is probably overkill so you may just want callcontrol and/or async.

The debug output will usually point you in the right direction of the problem, although sometimes it isn’t so obvious. My problems with a wrong password were showing in the debug as ” Cellular0 DirectIP: Remove negotiated IP interface address” which doesn’t exactly scream wrong password. At this level though generally the main things that can go wrong outside of hardware failure is a wrong username or password, so double check with your service provider and double check your profile entries with “show cellular 0 profile“.

A correctly functioning 3G profile debug output looks like this:

*Jan 18 05:17:22.327: [Cellular0]:CALLCTRL RX Link Status Indication (218 bytes):
00 DA 78 00 01 01 00 D6 08 1C 00 54 00 65 00 6C
 ... <snip> ...
 00 00 00 00 00 00 00 00 00 00
*Jan 18 05:17:22.331: Incoming LSI msg: profile_id = 1, session_state = 4, pdp_context_no = 0
*Jan 18 05:17:22.331: ip address for profile id 1
  87405C70:            XXXXXX XXXX
*Jan 18 05:17:22.335: Cellular0 DirectIP: Primary DNS address added
*Jan 18 05:17:22.335: Cellular0 DirectIP: Secondary DNS added

If you wanted multiple profiles you could create them using

  cellular 0 gsm profile create [1-9] APN chap USER PASSWORD

and then “dial” them using AT!SCACT=1,[1-9], either directly for testing or via a chat script.

To exit out hit Ctrl-Shift-6 x or ^X, which takes you back to the global prompt. You will also want to disconnect the session otherwise the Cellular interface will fail because the serial interface is busy. This is done with the command:

MyRouter# disconnect 1
Closing connection to [confirm]y

If all is working fine at this point you can be confident your 3G SIM and modem are working correctly.

Line 3

The next part to look at is the line 3 component which is essential the connecting  from the cellular interface to the modem. Not a lot can go wrong with this. As long as you have the config as above about the only thing that could be wrong is the script dialer line. The script named must be exactly the same as what you named it in the chat-script line at the top of the configuration.

You can double check it is calling the right script by checking the output of a debug chat command.

Cellular Interface

The final piece of the puzzle, the cellular interface takes care of bringing up the connection, assigning IPs and all the regular stuff. Looking at the config line by line:

  • The description is pretty straight forward, mostly used for your own reference.
  • IP address negotiated is used if your provider assigns you an IP address. If they use a fixed IP you could configure it here instead.
  • Encapsulation slip is important, so much so that I don’t think you can even remove it and trying to change it will result in the error message “Cellular0: Only SLIP encapsulation supported“. The reason is as I said above the 3G is like an old school modem, all the commands are over serial, so only SLIP is needed. You don’t need any of the other functionality a protocol like PPP provides, as the username if required is configured in the modem profile.
  • Dialer in-band specifies that this interface will use Demand Dial routing (DDR)
  • Dialer idle-timeout says how long the interface should stay connected when there is no traffic. Given the sizeable delay in bringing up an interface you probably don’t want it going down and up all the time if there’s pauses in traffic. You could also set it very long like 12 hours or more. If there’s no traffic you’re not being charged anyway unless you’re on some strange data plan when you’re charged for time connected.
  • Dialer string as I said before I’m not sure you actually need, in traditional DDR configs this would be the phone number or similar to dial. In the 3G case though there’s no number and all the details are stored in the modem profile I can’t see how it uses it. As earlier though it works with this here so might as well make it match the chat-script name to avoid confusion.
  • Dialer Group specifies which dialer-list to use to specify “interesting” traffic that will bring up the dialer interface. In my configuration I specify any IP traffic will bring up the interface, you could tailor it as required.
  • Async mode this enables the EXEC type commands for slip. To be honest the Cisco documentation I could find on this was a bit hazy on what it does for an async interface, but it seemed to need it.

Again at this point if the 3G is working at the lower level there’s not a lot else that can go wrong. The main problem would be the interface not being brought up when traffic is initiated. You can check what’s going on with debug dialer packets and debug chat these will allow you to verify the interesting traffic and that it is calling the correct script.

The other two pieces of configuration that are interesting are:
  ip route cellular0 which tells the router to direct all traffic out the cellular interface. You can also use various routing protocols or other statics as required, but for this config a simple static is all that’s required.
and chat-script telstra “” “AT!SCACT=1,1” TIMEOUT 15 “OK”, as explained above the AT command commands the modem to establish a connection using the profile stored in slot1, and to wait 15 seconds for an OK. Also the string “telstra” is key and has to match the string used under the line 3 configuration. It is however just a name so you can feel free to call it whatever you like.

Thant’s about it, hopefully this  configuration and document is some help in configuring your Cisco 887 router.

Tagged with: , ,