Important: In this release only one active charging service can be configured in a system.
Important: The commands or keywords/variables that are available are dependent on platform type, product version, and installed license(s).
Important: This command is available only in StarOS 8.1 and in StarOS 9.0 and later releases, and must be used to configure the Policy-based Stateful Firewall and NAT features.no access-ruledef access_ruledef_name
access_ruledef_name must be the name of an access ruledef, and must be an alphanumeric string of 1 through 63 characters, and can contain punctuation characters.
Important: An access ruledef can be referenced by multiple Stateful Firewall rulebases.
Important: Access ruledefs are different from ACS ruledefs.Also see the Firewall-and-NAT Access Ruledef Configuration Mode Commands chapter.
The following command creates an access ruledef named ruledef1, and enters the Firewall-and-NAT Access Ruledef Configuration Mode:
no bandwidth-policy bandwidth_policy_name
bandwidth_policy_name must be the name of a bandwidth policy, and must be an alphanumeric string of 1 through 63 characters.
Also see the ACS Bandwidth Policy Configuration Mode Commands chapter.
The following command creates a bandwidth policy named test73, and enters the ACS Bandwidth Policy Configuration Mode:
buffering-limit { flow-max-packets flow_max_packets | subscriber-max-packets subscriber_max_packets }
flow-max-packets flow_max_packets
flow_max_packets must be an integer from 1 through 255.
subscriber-max-packets subscriber_max_packets
subscriber_max_packets must be an integer from 1 through 255.
Important: A maximum of 2048 charging actions can be configured in the active charging service.charging_action_name must be the name of a charging action, and must be an alphanumeric string of 1 through 63 characters and can contain punctuation characters.
Also see the ACS Charging Action Configuration Mode Commands chapter.
The following command creates a charging action named action123 and changes to the ACS Charging Action Configuration Mode:
Default: generic
Important: A maximum of 64 Content Filtering Category Policies can be configured in the active charging service.content-filtering category policy-id cf_policy_id [ description [ description_string ] ] [ -noconfirm ]
no content-filtering category policy-id cf_policy_id
cf_policy_id must be an integer from 1 through 4294967295.
description_string must be an alphanumeric string of 1 through 31 characters.
“description” removes the previously specified description.
This description is displayed in the output of the “show content-filtering category policy-id id id” and “show active-charging service name service_name” commands.
Also see the Content Filtering Policy Configuration Mode Commands chapter.
The following command creates a Content Filtering Policy with the ID 101, and enters the Content Filtering Policy Configuration Mode:
group cc_group_name
Important: This option is only available in StarOS 8.1 and later releases.cc_group_name must be the name of a credit control group, and must be an alphanumeric string of 1 through 63 characters.
Also see the Credit Control Configuration Mode Commands chapter.
Description This command has been deprecated, and is replaced by the credit-control command.
no edr-format edr_format_name
edr_format_name must be a string of 1 through 63 characters.
Also see the EDR Format Configuration Mode Commands chapter.
The following command creates an EDR format named edr_format1:
Default: Flow control is enabled; unsent-queue-size: 375
unsent-queue-size unsent_queue_size
unsent_queue_size must be an integer from 1 through 2500.
fair-usage deact-margin deactivate_margin
Specifies that Fair Usage monitoring must be disabled when the instance-level credit usage goes deactivate_margin percentage below usage_threshold.
deactivate_margin is a percentage value, and must be an integer from 1 through 100.
Use this command to configure when to disable the Fair Usage feature, which enables SessMgr instance-level load balancing for in-line service features, and resource usage control for subscribers. For additional information, refer to the feature description in the Enhanced Charging Service Administration Guide.
max-flows-per-subscriber max_flows_subscriber
max_flows_subscriber must be an integer from 1 through 1000.
memory-share memory_share
memory_share is a percentage value, and must be an integer from 1 through 100.
fair-usage threshold-percent usage_threshold
usage_threshold is a percentage value, and must be an integer from 1 through 100.
Use this command to configure the threshold to enable the Fair Usage feature, which enables SessMgr instance-level load balancing for in-line service features, and resource usage control for subscribers. For additional information, refer to the feature description in the Enhanced Charging Service Administration Guide.
firewall flow-recovery { { downlink [ [ timeout timeout ] [ no-flow-creation ] + ] } | { uplink [ timeout timeout ] } }
|
•
|
downlink: Enables flow recovery for packets from the downlink direction.
|
|
•
|
uplink: Enables flow recovery for packets from the uplink direction.
|
timeout timeout
timeout must be an integer from 1 through 86400.
Important: NAT flows will not be recovered.Description In StarOS 8.1 and later releases, for Rulebase-based Stateful Firewall this command is available in the ACS Rulebase Configuration Mode, and for Policy-based Stateful Firewall in the Firewall-and-NAT Policy Configuration Mode. In StarOS 8.3, this command is available in the ACS Rulebase Configuration Mode.
Description In StarOS 8.1 and later releases, for Rulebase-based Stateful Firewall this command is available in the ACS Rulebase Configuration Mode, and for Policy-based Stateful Firewall in the Firewall-and-NAT Policy Configuration Mode. In StarOS 8.3, this command is available in the ACS Rulebase Configuration Mode.
|
•
|
ftp: Enabled
|
|
•
|
h323: Enabled
|
|
•
|
pptp: Disabled
|
|
•
|
rtsp: Disabled
|
|
•
|
sip: Disabled
|
|
•
|
all: Enables/disables all of the following NAT ALGs.
|
|
•
|
ftp: Enables/disables File Transfer Protocol (FTP) NAT ALG.
|
|
•
|
h323: Enables/disables H323 NAT ALG.
|
|
•
|
pptp: Enables/disables Point-to-Point Tunneling Protocol (PPTP) NAT ALG.
|
|
•
|
rtsp: Enables/disables Real Time Streaming Protocol (RTSP) ALG.
|
|
•
|
sip: Enables/disables Session Initiation Protocol (SIP) NAT ALG.
|
|
•
|
ipv4-and-ipv6: Enables both NAT44 and NAT64 ALGs.
|
|
•
|
ipv4-only: Enables only NAT44 ALG.
|
|
•
|
ipv6-only: Enables only NAT64 ALG.
|
Description In StarOS 8.1 and later releases, this command is available in the ACS Rulebase Configuration Mode.
firewall port-scan { connection-attempt-success-percentage { non-scanner | scanner } percentage | inactivity-timeout inactivity_timeout | protocol { tcp | udp } response-timeout response_timeout | scanner-policy { block inactivity-timeout inactivity_timeout | log-only } }
|
•
|
non-scanner: Specifies the connection attempt success percentage for a non-scanner.
|
percentage must be an integer from 60 through 99.
|
•
|
scanner: Specifies the connection attempt success percentage for a scanner.
|
percentage must be an integer from 1 through 40.
inactivity-timeout inactivity_timeout
inactivity_timeout must be an integer from 60 through 1800.
protocol { tcp | udp } response-timeout response_timeout
|
•
|
tcp: Specifies response timeout for TCP.
|
response_timeout must be an integer from 3 through 30.
|
•
|
udp: Specifies response timeout for UDP.
|
response_timeout must be an integer from 3 through 60.
|
•
|
block inactivity-timeout inactivity_timeout: Specifies blocking any subsequent traffic from the scanner. If the scanner is found to be inactive for the inactivity-timeout period, then the scanner is no longer blocked, and traffic is allowed.
|
inactivity_timeout specifies the scanner inactivity timeout period, in seconds, and must be an integer from 1 through 4294967295.
|
•
|
log-only: Specifies logging scanner information without blocking scanner traffic.
|
Default: log-only
Use this command to configure the Stateful Firewall Port Scan Detection algorithm enabled by the firewall dos-protection port-scan CLI command.
The following command configures the Stateful Firewall Port Scan inactivity timeout setting to 900 seconds:
Important: This command is available only in StarOS 8.1. This command must be used to configure the Rulebase-based Stateful Firewall and NAT features.no firewall ruledef firewall_ruledef_name
firewall_ruledef_name must be the name of a Stateful Firewall ruledef, and must be a string of 1 through 63 characters, and can contain punctuation characters.
Important: The Stateful Firewall ruledefs are different from the ACS ruledefs.Also see the Firewall-and-NAT Access Ruledef Configuration Mode Commands chapter.
The following command creates a Stateful Firewall ruledef named fw_ruledef1, and enters the Firewall Ruledef Configuration Mode:
Description In StarOS 8.1 and later releases, for Rulebase-based Stateful Firewall this command is available in the ACS Rulebase Configuration Mode, and for Policy-based Stateful Firewall in the Firewall-and-NAT Policy Configuration Mode. In StarOS 8.3, this command is available in the ACS Rulebase Configuration Mode.
firewall track-list attacking-servers no_of_servers
Important: This command variant is available only in StarOS 8.3 and later releases.attacking-servers no_of_servers
no_of_servers must be an integer from 1 through 100.
Important: This command is available only in 11.0 and later releases. This command must be used to configure the Stateful Firewall and NAT Action.no fw-and-nat action action_name
action_name must be the name of a Firewall-and-NAT action, and must be an alphanumeric string of 1 through 63 characters.
Also see the Firewall-and-NAT Action Configuration Mode Commands chapter.
The following command creates a Firewall-and-NAT action named test1, and changes to the Firewall-and-NAT Action Configuration Mode:
Important: This command is available only in StarOS 8.1 and in StarOS 9.0 and later releases. This command must be used to configure the Policy-based Stateful Firewall and NAT features.no fw-and-nat policy policy_name
Important: When a Firewall-and-NAT policy is deleted, for all subscribers using the policy, Stateful Firewall and NAT processing is disabled, also ACS sessions for the subscribers are dropped. In case of session recovery, the calls are recovered but with Stateful Firewall and NAT disabled.policy_name must be the name of a Firewall-and-NAT policy, and must be an alphanumeric string of 1 through 63 characters.
Also see the Firewall-and-NAT Policy Configuration Mode Commands chapter.
The following command creates a Firewall-and-NAT policy named test321, and changes to the Firewall-and-NAT Policy Configuration Mode:
Important: This command is available only in StarOS 10.2 and later releases.
Important: A maximum of 16 object groups can be configured in the active charging service. And a maximum of 128 objects can be configured within each object group.no group-of-objects objects_group_name
objects_group_name must be the name of a group-of-objects, and must be an alphanumeric string of 1 through 63 characters.
Important: “string” is the only data type supported in this release.Also see the ACS Group-of-Objects Configuration Mode Commands chapter.
The following command creates a group-of-objects named test4 with the data type string, and enters the ACS Group-of-Objects Configuration Mode:
Important: This command is customer specific. For more information contact your Cisco account representative.
Important: A maximum of 64 group-of-prefixed-URL groups can be configured in the active charging service.no group-of-prefixed-urls prefixed_urls_group_name
prefixed_urls_group_name must be the name of a group-of-prefixed-urls, and must be an alphanumeric string of 1 through 63 characters.
Also see the ACS Group-of-Prefixed-URLs Configuration Mode Commands chapter.
The following command creates group-of-prefixed-urls named test5, and enters the ACS Group-of-Prefixed-URLs Configuration Mode:
Important: A maximum of 64 groups-of-ruledefs can be configured in the active charging service.no group-of-ruledefs ruledefs_group_name
ruledefs_group_name must be unique within the active charging service, and must be a string of 1 through 63 characters. Up 64 groups may be configured.
Also see the ACS Group-of-Ruledefs Configuration Mode Commands chapter.
The following command creates a group-of-ruledefs named group1, and enters the ACS Group-of-Ruledefs Configuration Mode:
h323 time-to-live timeout
timeout must be an integer from 1 through 2147483647.
The following command configures the time for an endpoint registration with a timeout setting of 5 seconds:
h323 timeout { admission admission_timeout | discovery discovery_timeout | location location_timeout | registration registration_timeout | unregistration unregistration_timeout }
admission admission_timeout
admission_timeout must be an integer from 1 through 20.
discovery discovery_timeout
discovery_timeout must be an integer from 1 through 20.
location location_timeout
location_timeout must be an integer from 1 through 20.
registration registration_timeout
registration_timeout must be an integer from 1 through 20.
unregistration unregistration_timeout
unregistration_timeout must be an integer from 1 through 20.
h323 tpkt max_tpkt_size
max_tpkt_size must be an integer from 4 through 4096.
h323 version h323_version_number
h323_version_number must be an integer from 1 through 7.
no host-pool host_pool_name
host_pool_name must be the name of a host pool, and must be a string of 1 through 63 characters, and can contain punctuation characters.
Important: Host pools configured in other ruledefs cannot be deleted.Also see the ACS Host Pool Configuration Mode Commands chapter.
The following command creates a host pool named hostpool1, and enters the ACS Host Pool Configuration Mode:
|
•
|
alg-media: 120 seconds
|
|
•
|
flow-mapping { tcp | udp }: 300 seconds for TCP and 0 seconds for UDP
|
|
•
|
For alg-media specifies the media inactivity timeout. The idle_timeout value gets applied on RTP and RTCP media flows that are created for SIP/H.323 calls. The timeout is applied only on those flows that actually match the RTP and RTCP media pinholes that are created by the SIP/H.323 ALG.
The following command configures the maximum duration a TCP flow can remain idle to 3000 seconds, after which the system automatically terminates the flow:
no imsi-pool imsi_pool_name
imsi_pool_name must be the name of an IMSI pool, and must be an alphanumeric string of 1 through 63 characters, and can contain punctuation characters.
Important: IMSI pools configured in other ruledefs cannot be deleted.Also see the ACS IMSI Pool Configuration Mode Commands chapter.
The following command creates an IMSI pool named imsipool1, and enters the ACS IMSI Pool Configuration Mode:
ip dns-learnt-entries timeout timeout_period
timeout_period must be an integer from 1 through 2147483647.
The following command specifies to keep the snooped IPv4 addresses that were extracted from DNS responses for a time period of 900 seconds, or for the TTL value specified in the DNS response, whichever is greater:
ip max-fragments max_fragments
max_fragments must be an integer from 1 through 300.
no label content-id content_id
content-id content_id
content_id must be an integer from 1 through 65535.
text label_text
label_text must be an alphanumeric string of 1 through 64 characters.
Important: This command is available only in StarOS 8.3 and later releases.
Important: This command is available only in StarOS 8.3 and later releases.Default: buffer
|
•
|
buffer: Buffers the packets.
|
|
•
|
drop:Drops the packets.
|
Important: This command is available only in StarOS 8.3 and later releases.nat tcp-2msl-timeout timeout
timeout must be an integer from 30 through 240.
Specifies to detect all supported P2P protocols. Specifying all is the same as individually configuring each of the following protocols.
Important: The facetime protocol option is available only in 9.0 and in 11.0 and later releases.
Important: The gamekit protocol option is available only in 9.0 and in 11.0 and later releases.no packet-filter packet_filter_name
packet_filter_name must be the name of a packet filter, and must be an alphanumeric string of 1 through 63 characters.
Also see the ACS Packet Filter Configuration Mode Commands chapter.
The following command creates a packet filter named filter3, and enters the ACS Packet Filter Configuration Mode:
duration duration
duration must be an integer from 1 through 20.
bytes bytes
bytes must be an integer from 1 through 4000000000.
Important: This command is customer specific. For more information contact your Cisco account representative.use-rule dynamic_rule_name
dynamic_rule_name specifies name of the dynamic rule, and must be an alpha and/or numeric string of 1 through 63 characters in length.
|
•
|
charging-rule-base-name: active-charging-group-of-ruledefs
|
|
•
|
use-first: Disabled
|
ignore-when-removed: Specifies to ignore PCRF request for removal of Charging-Rule-Base-Name, and take no action. If this keyword is not configured, the PDP context from which the rulebase is removed gets terminated.
use-first: If multiple Charging-Rule-Base-Name are received from the PCRF, since a call can only have one ACS rulebase applied, specifies to select the first rulebase. If previously enabled, to disable this configuration, use the no policy-control charging-rule-base-name active-charging-rulebase use-first command. If this keyword is not configured, by default, the last rulebase is selected.
no port-map port_map_name
port_map_name must be the name of a port map, and must be an alphanumeric string of 1 through 63 characters, and can contain punctuation characters.
Important: Port maps in use in other ruledefs cannot be deleted.Also see the ACS Port Map Configuration Mode Commands chapter.
The following command creates a port map named portmap1, and enters the ACS Port Map Configuration Mode:
[ no ] redirect user-agent user_agent_name
user_agent_name must be the name of a user agent, and must be an alphanumeric string of 1 through 32 characters.
Use this command to redirect the traffic flow with conditions based on configured user-agent name. This user agent is used with flow action command in the ACS Charging Action Configuration Mode.
The following command specifies the redirect user agent user_rule1 for conditional redirection of traffic flow:
Important: A maximum of 512 rulebases can be configured in the active charging service.no rulebase rulebase_name
rulebase_name must be the name of an ACS rulebase, and must be an alphanumeric string of 1 through 63 characters, and can contain punctuation characters.
Use this command to create/configure/delete an ACS rulebase. A rulebase is a collection of protocol rules to match a flow and associated actions to be taken for matching flow. The rulebase_name must be unique in the active charging service.
Also see the ACS Rulebase Configuration Mode Commands chapter.
The following command creates a rulebase named test1, and enters the ACS Rulebase Configuration Mode:
Important: A maximum of 2048 ruledefs can be configured in the active charging service.no ruledef ruledef_name
ruledef_name must be the name of an ACS ruledef, and must be an alphanumeric string of 1 through 63 characters, and can contain punctuation characters.
ruledef_name must be unique with in the service. Host pool, port map, IMSI pool, and firewall, routing, and charging ruledefs must have unique names.
Also see the ACS Ruledef Configuration Mode Commands chapter.
The following command creates an ACS ruledef named test1, and enters the ACS Ruledef Configuration Mode:
Important: This command is customer specific. For more information contact your Cisco account representative.system-limit l4-flows limit
Default: Disabled; same as no system-limit l4-flows
limit must be an integer from 1 through 2147483647.
tethering-database [ os-signature os_signature_db_file_name | tac tac_db_file_name | ua-signature ua_signature_db_file_name ] +
tethering-database os-signature os_signature_db_file_name
os_signature_db_file_name must be the name of the OS Signature database file, and must be an alphanumeric string of 1 through 255 characters.
tethering-database tac tac_db_file_name
tac_db_file_name must be the name of a TAC database file, and must be an alphanumeric string of 1 through 255 characters.
tethering-database ua-signature ua_signature_db_file_name
ua_signature_db_file_name must be the name of a UA Signature database file, and must be an alphanumeric string of 1 through 255 characters.
The files are picked from the disk file system within the /databases directory. If a file name value is not configured, the default file names, os-db, tac-db, and ua-db, are used.
For more information on the Tethering Detection feature, refer to the Enhanced Charging Services Administration Guide.
The following command enables Tethering Detection and selects the UA Signature database file named test:
Important: This command is available only in StarOS 8.1 and in StarOS 9.0 and later releases.
Important: A maximum of 10 timedefs can be configured in the active charging service.no timedef timedef_name
timedef_name must be the name of a timedef, and must be an alphanumeric string of 1 through 63 characters.
Also see the ACS Timedef Configuration Mode Commands chapter.
The following command creates a timedef named test1, and enters the ACS Timedef Configuration Mode:
no tpo policy tpo_policy_name
tpo_policy_name must be the name of a TPO policy, and must be an alphanumeric string of 1 through 63 characters.
Important: A maximum of 2048 TPO policies can be created in the active charging service.Also see the ACS TPO Policy Configuration Mode Commands chapter.
The following command creates a TPO policy named tpo_policy_1, and enters the ACS TPO Policy Configuration Mode:
no tpo profile tpo_profile_name
tpo_profile_name must be the name of a TPO profile, and must be an alphanumeric string of 1 through 63 characters.
Important: A maximum of 2048 TPO profiles can be created in the active charging service.Also see the ACS TPO Profile Configuration Mode Commands chapter.
The following command creates a TPO profile named tpo_profile_1, and enters the ACS TPO Profile Configuration Mode:
no udr-format udr_format_name
udr_format_name must be the name of a UDR format, and must be an alphanumeric string of 1 through 63 characters.
Also see the UDR Format Configuration Mode Commands chapter.
The following command creates an UDR format named udr_fromat1 and changes to the UDR Format Configuration Mode:
Default: exact
no xheader-format xheader_format_name
xheader_format_name must be the name of an xheader format, and must be an alphanumeric string of 1 through 63 characters.
An x-header may be specified in a charging action to be inserted into HTTP GET and POST request packets. See xheader-insert CLI command in the ACS Charging Action Configuration Mode Commands chapter. Also see the ACS X-header Format Configuration Mode Commands chapter.
The following command creates an x-header format named test, and enters the ACS X-header Format Configuration Mode:
