Astro LLA Systems Provisioning

[rr60]

I am wondering if anyone cares to guess generally how many systems have the feature enabled. Perhaps small medium or large numbers.

Clearly this is the way forward with proliferation of NAS and even recent enforcement actions.

From an administration view, would enabling LLA potentially obsolete old radios not capable? Or perhaps when LLA is enabled the system will permit non LLA radios and LLA enabled radios to coexist on a system, as either or.

It would seem that LAA provisioning might be limiting if the system can‘t support legacy non LLA capable radios as they would become obsolete. Is this hypothetical system a prisoner of past design?

Appreciate your input. Thanks.

 

[rr60]

Sheesh, I must get used to thinking AI first. Slowly, but getting there. Take a look.

ChatGPT says

You’re referring to LAA (Location-Based Authentication) or possibly LLA (Location-based Logical Assignment), depending on your context — both of which are emerging features in P25 or advanced trunking systems.

Let’s break this down:

Q: How many systems have this feature enabled (LAA/LLA)?

• Small to Medium number of systems at this time.
• Most legacy P25 systems do not support it yet.
• Adoption is slowly increasing, especially in statewide systems, federal systems, or new deployments with P25 Phase 2 + full ISSI/CSSI/3rd party NAS integration.
• Enforcement actions (likely referring to federal mandates or security compliance like CJIS, DHS guidelines) are pushing the trend toward enabling these authentication and authorization layers.

Q: Does enabling LAA/LLA obsolete older radios?

• Yes and No.
  • In strict enforcement, non-LAA capable radios could be excluded if the system operator configures the system that way.
  • However, most systems operate in a hybrid mode, allowing both:
    • Legacy radios (without LAA)
    • Modern radios (with LAA support)
• 
  
• The system can authenticate and assign privileges differently depending on capability. For example:
  • Legacy radios may have access only to basic talkgroups.
  • LAA radios may access secure, sensitive talkgroups or roaming features.
  • 
    
  • Q: Is the system a prisoner of past design?
• In many ways, yes.
  • Legacy radio support is often essential for cost, logistics, and operational continuity.
  • Until fleet replacement and funding support full LAA/NAS compliance, many systems remain in dual-mode, accommodating both radio types.
• Some systems phase out old radios as grants or upgrades allow.

From an Admin Viewpoint:

• Enabling LAA improves security and radio asset control (you know where radios are and who is using them).
• But it introduces complexity in provisioning and potential access issues for legacy units.
• Smart admins often segment LAA-capable talkgroups or zones and gradually migrate users rather than hard-cutting legacy support.

If you’re planning a system upgrade or administration decision involving LLA/LAA/NAS, I can help model a rollout plan or compatibility chart across your fleet. Just let me know the mix of radios and what system infrastructure you’re running.

 

[redbeard]

Link Layer Authentication, AI is wrong again (shocker)

It does nothing to prevent NAS, btw. It's to keep cloned and rogue radios from affiliating to the system. That is all.

 

[62Truck]

With LLA will also need to be enabled on the subscriber radio, so in theory if a radio does not support LLA then yes it will be obsolete to that system. However, with LLA you can also enable guest ID's which kinda defeats the whole purpose, granted one would need to know what the guest IDs are.

The area I live they are in the process of building out a new system, they were hot and heavy on LLA to prevent "cloned" radios but ended up dropping it due to cost and use that money for other items for the new system.

 

[kc8jwt]

Ohio MARCS is requiring LLA by July 1. I work in a K-12 school district and we had to have the state come in and load all of our MARCS safety radios with LLA. This is a result of a bust in the Akron area where they nailed at least 5 with cloned radios. What we were told was if you didn't have a radio that supported LLA, you needed to purchase one that did and have it programed at our cost. Luckily we had APX 4500's and they were supported.

5 people charged for using stolen IDs on police radio system that could put first responders at risk

7 Canton locations raided for stolen police data

 

[rr60]

Thanks for sharing that. @kc8jwt

 

[GTR8000]

Oh great, so now we're using AI to create posts? As if we don't already have a forum full of wrong answers coming from actual humans. 🤦‍♂️

 

[wsp44]

I was unfamiliar with LLA until a recent project I worked on. The consultant recommended LLA, ultimately the customer elected not to enable it, or purchase the option, due to the price it added per subscriber, and due to none of the surrounding agencies having LLA/P25 authentication in their radios.

As far as I know, LLA has to be ran system wide, unlike encryption you can't choose to run it on certain TG's, but I guess like 62truck said, you can have guest IDs that would allow interop for agencies that don't have LLA.

 

[wa8pyr]

I was unfamiliar with LLA until a recent project I worked on. The consultant recommended LLA, ultimately the customer elected not to enable it, or purchase the option, due to the price it added per subscriber, and due to none of the surrounding agencies having LLA/P25 authentication in their radios.

As far as I know, LLA has to be ran system wide, unlike encryption you can't choose to run it on certain TG's, but I guess like 62truck said, you can have guest IDs that would allow interop for agencies that don't have LLA.

Link Layer Authentication can be enabled system-wide, or optionally, or not at all.

Ohio MARCS is currently in the “optional” stage where if you enable it on the radio you’re good in the system but if you don’t have it you’re still ok. Starting July 1 of this year it goes systemwide; if your radio doesn’t have it, it won’t work.