Collect the required information for a site

Azure Private 5G Core private mobile networks include one or more sites. Each site represents a physical enterprise location (for example, Contoso Corporation's Chicago factory) containing an Azure Stack Edge device that hosts a packet core instance. This how-to guide takes you through the process of collecting the information you need to create a new site.

You can use this information to create a site in an existing private mobile network using the Azure portal. You can also use it as part of an ARM template to deploy a new private mobile network and site, or add a new site to an existing private mobile network.

Prerequisites

• Complete the steps in Complete the prerequisite tasks for deploying a private mobile network.
• Make a note of the resource group that contains your private mobile network that was collected in Collect the required information to deploy a private mobile network. We recommend that the mobile network site resource you create in this procedure belongs to the same resource group.
• Ensure you have the relevant permissions on your account if you want to give Azure role-based access control (Azure RBAC) to storage accounts.

Choose a service plan

Choose the service plan that best fits your requirements and verify pricing and charges. See Azure Private 5G Core pricing.

Collect mobile network site resource values

Collect all the values in the following table for the mobile network site resource that represents your site.

Collect packet core configuration values

Collect all the values in the following table for the packet core instance that runs in the site.

Collect RADIUS values

If you have a Remote Authentication Dial-In User Service (RADIUS) authentication, authorization and accounting (AAA) server in your network, you can optionally configure the packet core to use it to authenticate UEs on attachment to the network and session establishment. If you want to use RADIUS, collect all the values in the following table.

To add the secrets to Azure Key Vault, see Quickstart: Set and retrieve a secret from Azure Key Vault using the Azure portal.

Collect access network values

Collect all the values in the following table to define the packet core instance's connection to the access network over the control plane and user plane interfaces. The field name displayed in the Azure portal depends on the value you have chosen for Technology type, as described in Collect packet core configuration values.

Collect UE usage tracking values

If you want to configure UE usage tracking for your site, collect all the values in the following table to define the packet core instance's associated Event Hubs instance. See Monitor UE usage with Event Hubs for more information.

Collect data network values

You can configure up to ten data networks per site. During site creation, you'll be able to choose whether to attach an existing data network or create a new one.

For each data network that you want to configure, collect all the values in the following table. These values define the packet core instance's connection to the data network over the user plane interface, so you need to collect them whether you're creating the data network or using an existing one.

Collect values for diagnostics package gathering

You can use a storage account and user assigned managed identity, with write access to the storage account, to gather diagnostics packages for the site.

If you don't want to configure diagnostics package gathering at this stage, you don't need to collect anything. You can configure this after site creation.

If you want to configure diagnostics package gathering during site creation, see Collect values for diagnostics package gathering.

Choose the authentication method for local monitoring tools

Azure Private 5G Core provides dashboards for monitoring your deployment and a web GUI for collecting detailed signal traces. You can access these tools using Microsoft Entra ID or a local username and password. We recommend setting up Microsoft Entra authentication to improve security in your deployment.

If you want to access your local monitoring tools using Microsoft Entra ID, after creating a site follow the steps in Enable Microsoft Entra ID for local monitoring tools.

If you want to access your local monitoring tools using local usernames and passwords, you don't need to set any additional configuration. After deploying the site, set up your username and password by following Access the distributed tracing web GUI and Access the packet core dashboards.

You'll be able to change the authentication method later by following Modify the local access configuration in a site.

Collect local monitoring values

You can use a self-signed or a custom certificate to secure access to the distributed tracing and packet core dashboards at the edge. We recommend that you provide your own HTTPS certificate signed by a globally known and trusted certificate authority (CA), as this provides additional security to your deployment and allows your browser to recognize the certificate signer.

If you don't want to provide a custom HTTPS certificate at this stage, you don't need to collect anything. You'll be able to change this configuration later by following Modify the local access configuration in a site.

If you want to provide a custom HTTPS certificate at site creation:

1. Either create an Azure Key Vault or choose an existing one to host your certificate. Ensure the key vault is configured with Azure Virtual Machines for deployment resource access.

2. Ensure your certificate is stored in your key vault. You can either generate a Key Vault certificate or import an existing certificate to your Key Vault. Your certificate must:

   • Be signed by a globally known and trusted CA.
   • Use a private key of type RSA or EC to ensure it's exportable (see Exportable or non-exportable key for more information).

   We also recommend setting a DNS name for your certificate.

3. If you want to configure your certificate to renew automatically, see Tutorial: Configure certificate auto-rotation in Key Vault for information on enabling auto-rotation.

   Note

   • Certificate validation is always performed against the latest version of the local access certificate in the Key Vault.
   • If you enable auto-rotation, it might take up to four hours for certificate updates in the Key Vault to synchronize with the edge location.

4. Decide how you want to provide access to your certificate. You can use a Key Vault access policy or Azure role-based access control (RBAC).

   • Assign a Key Vault access policy. Provide Get and List permissions under Secret permissions and Certificate permissions to the Azure Private MEC service principal.

   • Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control (RBAC). Provide Key Vault Reader and Key Vault Secrets User permissions to the Azure Private MEC service principal.

   • If you want to, assign the Key Vault access policy or Azure RBAC to a user-assigned identity.

     • If you have an existing user-assigned identity configured for diagnostic collection you can modify it.
     • Otherwise, you can create a new user-assigned identity.

5. Collect the values in the following table.

   Value	Field name in Azure portal
   The name of the Azure Key Vault containing the custom HTTPS certificate.	Key vault
   The name of the CA-signed custom HTTPS certificate within the Azure Key Vault.	Certificate

Next steps

Use the information you've collected to create the site:

• Create a site - Azure portal
• Create a site - ARM template