Enhanced Charging Service Configuration

---

At least one administrative user account with ECS privileges must be configured on the system. This is the account that is used to log on and execute ECS-related commands. For security purposes, it is recommended that these user accounts be created along with general system functionality administration.

To create the ECS administrative user account, use the following configuration:

configure
   context local
      administrator <user_name> password <password> ecs
      end

Notes:

The ECS in-line service is a licensed Cisco product. Separate session and feature licenses may be required. Contact your Cisco account representative for detailed information on licensing requirements.

For information on installing and verifying licenses, refer to the Managing License Keys section of the Software Management Operations chapter in the System Administration Guide.

Enhanced charging must be enabled before configuring charging services.

To enable Enhanced Charging Service, use the following configuration:

configure
   require active-charging
      context local
         interface <interface_name>
            ip address <ip_address/mask>
            exit
         server ftpd
         end

Notes:

To create an Enhanced Charging Service, use the following configuration:

configure
   active-charging service <ecs_service_name>
   end

Notes:

To create and configure a ruledef use the following configuration:

configure
   active-charging service <ecs_service_name>
      ruledef <ruledef_name>
         <protocol> <expression> <operator> <condition>
         rule-application { charging | post-processing | routing }
         end

Notes:

A group-of-ruledefs enables grouping rules into categories, so that charging systems can base the charging policy on the category.

To create and configure a group-of-ruledefs, use the following configuration:

configure
   active-charging service <ecs_service_name>
      group-of-ruledefs <ruledef_group_name>
         add-ruledef priority <priority> ruledef <ruledef_name>
         group-of-ruledefs-application { charging | content-filtering | gx-alias | post-processing }
         end

Notes:

Charging actions are used with rulebases and must be created before a rulebase is configured.

To create a charging action, use the following configuration:

configure
   active-charging service <ecs_service_name>
      charging-action <charging_action_name>
         content-id <content_id>
         retransmissions-counted
         billing-action { create-edrs { charging-edr <charging_edr_format_name> | reporting-edr <reporting_edr_format_name> } + [ wait-until-flow-ends ] | egcdr | exclude-from-udrs | radius | rf } +
         end

Notes:

A rulebase specifies which protocol analyzers to run and which packets are analyzed. Multiple rulebases may be defined for the Enhanced Charging Service. A rulebase is basically a subscriber's profile in a charging service.

To create and configure a rulebase, use the following configuration:

configure
   active-charging service <ecs_service_name>
      rulebase <rulebase_name>
         flow end-condition { content-filtering | hagr | handoff | normal-end-signaling | session-end | tethering-signature-change | url-blacklisting | timeout } [ flow-overflow ] + { charging-edr <charging_edr_format_name> | reporting-edr <reporting_edr_format_name> }
         billing-records udr udr-format <udr_format_name>
         action priority <action_priority> { [ dynamic-only | static-and-dynamic | timedef <timedef_name> ] { group-of-ruledefs <ruledef_group_name> | ruledef <ruledef_name> } charging-action <charging_action_name> [ monitoring-key <monitoring_key> ] [ description <description> ] }
         route priority <route_priority> ruledef <ruledef_name> analyzer <analyzer> [ description <description> ]
         rtp dynamic-flow-detection
         udr threshold interval <interval>
         cca radius charging context <context> group <group_name>
         cca radius accounting interval <interval>
         end

Notes:

To create a rulebase list, use the following configuration:

configure
   active-charging service <ecs_service_name>
      rulebase-list <rulebase_list_name> <rulebase_name>[ <rulebase_name> + ]
      exit 

To dynamically enable ruledef statistics collection in the ACS Configuration mode, use the following configuration:

configure
   active-charging service <ecs_service_name>
      statistics-collection { all | ruledef { all | charging | firewall | post-processing } }
      [ no ] statistics-collection 
      end

Notes:

To dynamically enable ruledef statistics collection in the Exec mode, use the following configuration:

statistics-collection active-charging { all | charging | firewall | post-processing { callid call_id | imsi imsi_number } }
[ no ] statistics-collection active-charging { callid call_id | imsi imsi_number }

Notes:

To view subscriber statistics, in the Exec Mode, use the following command:

show active-charging subscribers { acsmgr instance instance_id | all | callid call_id | full | imsi imsi_number | rulebase rulebase_name }

ECS generates postpaid charging data files which can be retrieved from the system periodically and used as input to a billing mediation system for postprocessing.

EDRs are generated according to action statements in rule commands.

Up to 32 different EDR schema types may be specified, each composed of up to 32 fields or analyzer parameter names. The records are written at the time of each rule event in a comma-separated (CSV) format.

To set the EDR formats use the following configuration:

configure
   active-charging service <ecs_service_name>
      edr-format <edr_format_name>
         attribute <attribute> { [ format { MM/DD/YY-HH:MM:SS | MM/DD/YYYY-HH:MM:SS | YYYY/MM/DD-HH:MM:SS | YYYYMMDDHHMMSS | seconds } ] [ localtime ] | [ { ip | tcp } { bytes | pkts } { downlink | uplink } ] priority <priority> }
         rule-variable <protocol> <rule> priority <priority>
         event-label <event_label> priority <priority>
         delimiter { comma | tab }
         end

For information on EDR format configuration and rule variables, refer to the EDR Format Configuration Mode Commands chapter of the Command Line Interface Reference.

ECS generates postpaid charging data files which can be retrieved from the system periodically and used as input to a billing mediation system for postprocessing.

UDRs are generated according to action statements in rule commands. Up to 32 different UDR schema types may be specified, each composed of up to 32 fields or analyzer parameter names. The records are written thresholds in a comma-separated (CSV) format.

To set the UDR format, use the following configuration:

configure
   active-charging service <ecs_service_name>
      udr-format <udr_format_name>
         attribute <attribute> { [ format { MM/DD/YY-HH:MM:SS | MM/DD/YYYY-HH:MM:SS | YYYY/MM/DD-HH:MM:SS | YYYYMMDDHHMMSS | seconds } ] [ localtime ] | [ { bytes | pkts } { downlink | uplink } ] ] priority <priority> }
         end

To retrieve charging records you must configure the context that stores the charging records to accept SFTP connections.

To enable SFTP, use the following configuration:

configure
   context local
      administrator <user_name> [ encrypted ] password <password>
      config-administrator <user_name> [ encrypted ] password <password>
      exit
   context <context_name>
      ssh generate key
      server sshd
      subsystem sftp
      end

Notes:

This section describes the following optional configuration procedures:

To configure the Active Charging Service (ACS) subscriber base, use the following configuration:

configure
   active-charging service service_name
      subscriber-base subs_base_name
         priority priority subs-class subs_class_name bind service-scheme serv_scheme_name
         end

Notes:

• The priority command is used to assign priority to the service-scheme association within a subscriber base. This priority must be unique within a subscriber base.

To configure the Active Charging Service (ACS) subscriber class, use the following configuration:

configure
   active-charging service service_name
      subs-class subs_class_name
         [ no ] any-match operator condition
         [ no ] apn operator apn_name
         [ no ] multi-line-or all-lines
         [ no ] rulebase operator rulebase_name
         [ no ] v-apn operator v_apn_name
         end

Notes:

• The any-match command is used to enable or disable the wildcard configuration.

• The apn command is used to specify the APN name as a condition.

• The multi-line-or command is used to check if the OR operator must be applied to all lines in a subscriber class.

• The rulebase command is used to specify the rulebase name as a condition.

• The v-apn command is used to specify the virtual APN name as a condition.

To enable the association of service-scheme based on subscriber class, use the following configuration:

configure
   active-charging service service_name
      service-scheme service_scheme_name
         [ no ] trigger { loc-update | sess-setup }
         end

Notes:

• The trigger command is used to configure the set of trigger events such as session-setup, location-update that will be handled under the service-scheme.

To configure the set of triggers that will be handled under the associated service-scheme, use the following configuration:

configure
   active-charging service service_name
      service-scheme service_scheme_name
         [ no ] trigger { loc-update | sess-setup }
            priority priority trigger-condition trigger_condn_name trigger-action trigger_action_name
            end

Notes:

• The priority command is used to assign priority to the trigger events configured in service-scheme. The priority must be unique within a trigger.

To configure the Active Charging Service (ACS) trigger actions, use the following configuration:

configure
   active-charging service service_name
      trigger-action trigger_action_name
         [ no ] charge-request-to-response http { all | connect | delete | get | head | options | post | put | trace }
         [ no ] throttle-suppress
         [ no ] transactional-rule-matching response http { all | connect | delete | get | head | options | post | put | trace }
         end

Notes:

• The charge-request-to-response command is added in support of the Response-based Charging feature to delay charging till the HTTP response for the configured HTTP request method(s).

• The throttle-suppress command is added in support of the Location based QoS Override feature to perform throttle suppression to provide unlimited bandwidth based on trigger condition matched.

• The transactional-rule-matching command is added in support of the Response-based TRM feature to delayw-c engagement of TRM till the HTTP response for the configured HTTP request method(s).

To configure Active Charging Service (ACS) trigger conditions, use the following configuration:

configure
   active-charging service service_name
      trigger-condition trigger_condn_name
         [ no ] any-match operator condition
         [ no ] local-policy-rule = local_policy_rule
         [ no ] multi-line-or all-lines
         end

Notes:

• The any-match command is used to analyze all flows created after event activation.

• The local-policy-rule command is used to specify the local-policy rule within ECS for enabling trigger condition.

• The multi-line-or command is used to check if the OR operator must be applied to all lines in a trigger-condition.

Use the following commands in the Exec Mode to verify your configuration:

• This command is used to display the number of subscribers associated with the configured service-scheme:

  show active-charging service-scheme { all | name serv_scheme_name | statistics [ name serv_scheme_name ] } [ service name service_name ] [ | { grep grep_options | more } ]

• This command displays the service-scheme selected for the particular subscriber:

  show active-charging subscribers full all

• This command displays information about the trigger action(s) configured in a service.

  show active-charging trigger-action { all | name trigger_action_name [ service acs_service_name ] } [ | { grep grep_options | more } ]

• This command displays information about the trigger condition(s) configured in a service.

  show active-charging trigger-condition { { all | name trigger_condn_name [ service acs_service_name ] } | statistics [ name trigger_condn_name ] } [ | { grep grep_options | more } ]

Use the sample configuration to enable features based on service-scheme framework for a subscriber.

configure
   active-charging service s1
      subscriber-base default
         priority 10 subs-class class1 bind service-scheme scheme1
         priority 20 subs-class class2 bind service-scheme scheme2 
      #exit
      subs-class class1
         apn = cisco.com
         rulebase = plan1
         v-apn != some_virtual_apn
         multi-line-or 
      #exit
      subs-class class2
         any-match 
      #exit
      service-scheme scheme1
         trigger sess-setup
            priority 10 trigger-condition tc1 trigger-action ta1
            priority 20 trigger-condition tc2 trigger-action ta2
         #exit
      #exit
      service-scheme scheme2
         trigger sess-setup
            priority 10 trigger-condition tc1 trigger-action ta1
         #exit
      #exit
      trigger-condition tc1
         any-match
      #exit
      trigger-action ta1
         transactional-rule-matching response http all
         charge-request-to-response http all
      #exit
      trigger-action ta2
         throttle-suppress
      #exit

This section describes how to configure the Prepaid Credit Control Application for Diameter or RADIUS.

To configure Prepaid Credit Control Application:

User traffic is directed through the ECS service inspection engine by using Access Control List (ACL) mechanism to selectively steer subscriber traffic.

To configure redirection of subscriber traffic to ECS:

For information on configuring GTPP accounting, if you are using StarOS 12.3 or an earlier release, refer to the AAA and GTPP Interface Administration and Reference. If you are using StarOS 14.0 or a later release, refer to the AAA Interface Administration and Reference.

This section provides an example configuration to configure EDR/UDR file transfer and file properties parameters, including configuring hard disk support on SMC card on ASR 5500, transfer modes, transfer interval, etc.

To configure EDR/UDR file parameters:

configure
   context <context_name>
      edr-module active-charging-service  [ charging | reporting ]
         cdr { purge { storage-limit <storage_limit> | time-limit <time_limit> } [ max-files <max_records_to_purge> ] | push-interval <push_interval> | push-trigger space-usage-percent <trigger_percentage> | remove-file-after-transfer | transfer-mode { pull [ module-only ] | push primary { encrypted-url <encrypted_url> | url <url> } [ [ max-files <max_records> ] [ module-only ] [ secondary { encrypted-secondary-url <encrypted_secondary_url> | secondary-url <secondary_url> } ] [ via local-context ] + ] | use-harddisk }
         file [ charging-service-name { include | omit } ] [ compression { gzip | none } ] [ current-prefix <string> ] [ delete-timeout <seconds> ] [ directory <directory_name> ] [ edr-format-name ] [ exclude-checksum-record ] [ field-separator { hyphen | omit | underscore } ] [ file-sequence-number rulebase-seq-num ] [ headers ] [ name <file_name> ] [ reset-indicator ] [ rotation [ num-records <number> | time <seconds> | volume <bytes> ] ] [ sequence-number { length <length> | omit | padded | padded-six-length | unpadded } ] [ storage-limit <limit> ] [ single-edr-format ] [ time-stamp { expanded-format | rotated-format | unix-format } ] [ trailing-text <string> ] [ trap-on-file-delete ] [ xor-final-record ] +
         exit
      udr-module active-charging-service
         file [ charging-service-name { include | omit } ] [ compression { gzip | none } ] [ current-prefix <string> ] [ delete-timeout <seconds> ] [ directory <directory_name> ] [ exclude-checksum-record ] [ field-separator { hyphen | omit | underscore } ] [ file-sequence-number rulebase-seq-num ] [ headers ] [ name <file_name> ] [ reset-indicator ] [ rotation [ num-records <number> | time <seconds> | volume <bytes> ] ] [ sequence-number { length <length> | omit | padded | padded-six-length | unpadded } ] [ storage-limit <limit> ] [ time-stamp { expanded-format | rotated-format | unix-format } ] [ trailing-text <string> ] [ trap-on-file-delete ] [ udr-seq-num ] [ xor-final-record ] +
         end

Notes:

This section describes how to configure the RADIUS Analyzer. When a call is established, the pre-DFA-rulebase uses the traffic that has been authenticated by the RADIUS server. Until then all the normal traffic is denied and is resumed only after the additional RADIUS based authentication is successful. The success of RADIUS authentication is determined by a RADIUS analyzer.

To configure the RADIUS Analyzer, use the following configuration:

configure
   active-charging service  service_name
      ruledef  ruledef_name
         [ no ] radius [ any-match < != | = > < FALSE | TRUE  > | error < != | = > <FALSE | TRUE  > | state < != | = > < auth-req-rcvd | auth-rsp-fail |  auth-rsp-success  > ]
         end

Notes:

This section describes how to configure the Post-processing feature to enable processing of packets even if rule matching for them has been disabled.

To configure the Post-processing feature, use the following configuration:

configure
   active-charging service <ecs_service_name>
      ruledef <ruledef_name>
         <protocol> <expression> <operator> <condition>
         rule-application post-processing
         exit
      charging-action <charging_action_name>
         ...
         exit
      rulebase <rulebase_name>
         action priority <action_priority> { [ dynamic-only | static-and-dynamic | timedef <timedef_name> ] { group-of-ruledefs <ruledef_group_name> | ruledef <ruledef_name> } charging-action <charging_action_name> [ monitoring-key <monitoring_key> ] [ description <description> ] }
         post-processing priority <priority> ruledef <ruledef_name> charging-action <charging_action_name>
         ...
         end

Notes:

To create and configure a QoS-Group-of-Ruledefs, use the following configuration:

configure
   active-charging service <ecs_service_name>
      qos-group-of-ruledefs <qos_group_of_ruledefs_name> [ -noconfirm ] [ description <description> ]
         add-ruledef <ruledef_name>
         end

Notes:

To suppress throttling at charging-action, bearer and APN level, use the following configuration:

configure
   active-charging service service_name
      charging-action charging_action_name
         throttle-suppress [ timeout suppress_timeout ]
         no throttle-suppress
         end

Notes:

• timeout suppress_timeout: Specifies the time for which throttling is suppressed, in seconds. suppress_timeout must be an integer from 10 through 300.

• When configured with the timeout keyword, bandwidth limiting is suppressed for the mentioned time.

• When configured without the timeout keyword, the default value of 30 seconds will apply.

• When throttle-suppress is configured, the timeout will take the default value of 30 seconds. The flow will not be throttled for the next 30 seconds.

• When no throttle-suppress is configured, bandwidth limiting will continue from the next flow onwards.

Verifying your Configuration

Verify your configuration in the Exec mode using the following commands.

• To verify the configured timeout value for suppress-throttle:

  show active-charging charging-action name <charging_action_name> [ | { grep <grep_options> | more } ]

• To verify the number of uplink and downlink bytes that escaped bandwidth limiting due to suppressing functionality:

  show active-charging charging-action statistics [ name <charging_action_name> ] [ | { grep <grep_options> | more } ]

• To verify the total suppress time and elapsed time:

  show active-charging flows full all [ | { grep <grep_options> | more } ]

• To verify the historical total and current number of flows for which bandwidth limiting is suppressed:

  show active-charging subsystem all [ | { grep <grep_options> | more } ]

To configure the TCP Proxy Flow Admission Control feature, use the following configuration:

configure
   active-charging service <ecs_service_name>
      fair-usage tcp-proxy max-flows-per-subscriber <max_flows>
      fair-usage tcp-proxy memory-share <memory_share>
      end

Notes:

This section describes how to configure the Time-of-Day Activation/Deactivation of Rules feature to enable charging according to day/time.

To configure the Time-of-Day Activation/Deactivation of Rules feature, use the following configuration:

configure
   active-charging service <ecs_service_name>
      ruledef <ruledef_name>
         ...
         exit
      timedef <timedef_name>
         start day { friday | monday | saturday | sunday | thursday | tuesday | wednesday } time <hh> <mm> <ss> end day { friday | monday | saturday | sunday | thursday | tuesday | wednesday } time <hh> <mm> <ss>
         start time <hh> <mm> <ss> end time <hh> <mm> <ss>
         exit
      charging-action <charging_action_name>
         ...
         exit
      rulebase <rulebase_name>
         action priority <action_priority> timedef <timedef_name> { group-of-ruledefs <ruledef_group_name> | ruledef <ruledef_name> } charging-action <charging_action_name> [ description <description> ]
         ...
         end

Notes:

To enable retransmission under Rulebase or Service Level base, use the following configuration:

configure
     active-charging service <ecs_service_name>
          rulebase <rulebase name>
               retransmissions-counted  
              end

To verify your configuration, in the Exec mode, enter the following command:

show active-charging rulebase name <rulebase_name>

To enable the websocket flow detection feature, use the following configuration:

configure
   active-charging service <ecs_service_name>
      rulebase <rulebae name>
         websocket flow-detection  <protocol>
         end

Notes:

Use the no websocket flow-detection command or default websocket flow-detection command to disable websocket flow detection.

To verify your configuration, in the Exec mode, enter the following command:

show active-charging rulebase name <rulebase_name>

This section describes how to configure the URL Filtering feature to simplify rules for URL detection.

To create a group-of-prefixed-URLs, use the following configuration:

configure
   active-charging service <ecs_service_name>
      group-of-prefixed-urls <prefixed_urls_group_name>
      end

To configure the URLs to be filtered in the group-of-prefixed-URLs, use the following configuration:

configure
   active-charging service <ecs_service_name>
      group-of-prefixed-urls <prefixed_urls_group_name>
         prefixed-url <url_1>
         ...
         prefixed-url <url_10>
         end

To enable or disable the group in the rulebase for processing prefixed URLs, use the following configuration:

configure
   active-charging service <ecs_service_name>
      rulebase <rulebase_name>
         url-preprocessing bypass group-of-prefixed-urls <prefixed_urls_group_name>
         ...
         url-preprocessing bypass group-of-prefixed-urls <prefixed_urls_group_name>
         end

Notes:

This section describes how to redirect the flow to the redirect-url and encrypt the dynamic fields by using either blowfish encryption or AES encryption.

The flow action redirect-url specifies ASR to return a redirect response to the subscriber, and terminate the TCP connections (to the subscriber and server). The subscriber's Web browser automatically sends the original HTTP packet to the specified URL. Redirection is only possible for certain types of HTTP packets (for example, GET requests), which typically are only sent in the uplink direction. If the flow is not HTTP, the redirect-url option is ignored, that is the packet is forwarded normally, except for SIP. For SIP, a Contact header with the redirect information is inserted. The redirect-url consists of the redirect url and may additionally include one or more dynamic fields. Earlier, the dynamic fields could be encrypted using 128 and 256 bit blowfish encryption. The new functionality provides the additional AES-CBC encryption of the dynamic fields as well.

To redirect-URL action on packet and flow for Session Control functionality, use this configuration.

configure
   active-charging service <ecs_service_name>
      flow action redirect-url redirect_url [ encryption { blowfish128 | blowfish64 | { { aes128 | aes256 } [ salt ] } } [ encrypted ] key key ] ] 
      end

Notes: