Cisco ASR 5000 Series Instruction Manual

Cisco ASR 5x00 Enhanced Charging Services
Administration Guide
Version 15.0
Last Updated October 31, 2014
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY
OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED
WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED
WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain
version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL
FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE
PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR
ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco ASR 5x00 Enhanced Charging Services Administration Guide
© 2014 Cisco Systems, Inc. All rights reserved.

Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
iii
CONTENTS
About this Guide ............................................................................................... vii
Conventions Used ..................................................................................................................................viii
Contacting Customer Support..................................................................................................................ix
Additional Information............................................................................................................................... x
Enhanced Charging Service Overview........................................................... 11
Introduction.............................................................................................................................................12
Qualified Platforms.............................................................................................................................12
License Requirements........................................................................................................................12
Basic Features and Functionality ...........................................................................................................13
Shallow Packet Inspection .................................................................................................................13
Deep Packet Inspection .....................................................................................................................13
Charging Subsystem..........................................................................................................................13
Traffic Analyzers ............................................................................................................................13
How ECS Works............................................................................................................................14
ECS Deployment and Architecture.........................................................................................................28
Enhanced Features and Functionality....................................................................................................30
Session Control in ECS......................................................................................................................30
Service Group QoS Feature...............................................................................................................30
Configuration Overview..................................................................................................................32
Support for Service-based QoS.....................................................................................................33
Hierarchical Enforcement of QoS Parameters...............................................................................34
Reporting Statistics and Usage to PCRF.......................................................................................35
Time and Flow-based Bearer Charging in ECS.................................................................................35
Content Filtering Support ...................................................................................................................36
Content Filtering Server Group Support ........................................................................................37
In-line Content Filtering Support....................................................................................................37
DNS Snooping....................................................................................................................................37
License Requirements ...................................................................................................................38
Bulkstatistics Support.....................................................................................................................38
How it Works..................................................................................................................................38
Limitations and Dependencies.......................................................................................................42
IP Readdressing.................................................................................................................................42
URL-based Re-addressing.................................................................................................................43
Next-hop Address Configuration........................................................................................................44
Post Processing .................................................................................................................................45
How the Post-processing Feature Works......................................................................................45
Tethering Detection............................................................................................................................46
License Requirements ...................................................................................................................46
MUR Support for Tethering Detection ...........................................................................................46
Tethering Detection Databases .....................................................................................................47
Loading and Upgrading Tethering Detection Databases...............................................................47
Session Recovery Support ............................................................................................................47
Time-of-Day Activation/Deactivation of Rules....................................................................................47
How the Time-of-Day Activation/Deactivation of Rules Feature Works ........................................48
Transactional Rule Matching..............................................................................................................48

▀Contents
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
iv
Fastpath .........................................................................................................................................48
Bulkstatistics Support.....................................................................................................................51
Limitations and Dependencies.......................................................................................................52
Support for WebSocket Protocol Identification...................................................................................52
How it Works..................................................................................................................................52
URL Filtering.......................................................................................................................................52
Implementation of AES Encryption.....................................................................................................53
TCP Proxy..........................................................................................................................................54
Flow Admission Control .................................................................................................................55
TCP Proxy Behavior and Limitations .............................................................................................55
Dynamic Disabling of TCP Proxy...................................................................................................58
X-Header Insertion and Encryption....................................................................................................59
License Requirements ...................................................................................................................59
X-Header Insertion.........................................................................................................................59
X-Header Encryption......................................................................................................................60
Limitations to the Header Insertion and Encryption Features........................................................61
Supported X-Headers ....................................................................................................................62
X-Header Enrichment Anti Spoofing..............................................................................................63
RAN Bandwidth Optimization.............................................................................................................64
Selective TFT Suppression for Default Bearer...................................................................................64
Accounting and Charging Interfaces ......................................................................................................65
GTPP Accounting...............................................................................................................................65
RADIUS Accounting and Credit Control.............................................................................................65
Diameter Accounting and Credit Control............................................................................................66
Gx Interface Support......................................................................................................................66
Gy Interface Support......................................................................................................................66
Event Detail Records (EDRs).........................................................................................................67
Usage Detail Records (UDRs).......................................................................................................69
Charging Methods and Interfaces......................................................................................................69
Prepaid Credit Control....................................................................................................................69
Postpaid .........................................................................................................................................69
Prepaid Billing in ECS ........................................................................................................................70
How ECS Prepaid Billing Works ....................................................................................................70
Credit Control Application (CCA) in ECS ...........................................................................................71
How Credit Control Application (CCA) Works for Prepaid Billing ..................................................71
Postpaid Billing in ECS.......................................................................................................................72
How ECS Postpaid Billing Works...................................................................................................73
External Storage System........................................................................................................................76
System Resource Allocation...................................................................................................................77
Redundancy Support in ECS..................................................................................................................78
Intra-chassis Session Recovery Interoperability ................................................................................78
Recovery from Task Failure...........................................................................................................78
Recovery from CPU or Packet Processing Card Failure...............................................................78
Inter-chassis Session Recovery Interoperability ................................................................................78
Inter-chassis Session Recovery Architecture ................................................................................79
Session Recovery Improvements ..................................................................................................79
Impact on xDR File Naming ...............................................................................................................79
Impact on xDR File Content ...............................................................................................................80
Enhanced Charging Service Configuration ................................................... 83
Initial Configuration.................................................................................................................................84
Creating the ECS Administrative User Account.................................................................................84
Installing the ECS License .................................................................................................................85
Enabling Enhanced Charging Service................................................................................................85
Configuring the Enhanced Charging Service .........................................................................................86

Contents ▀
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
v
Creating the Enhanced Charging Service..........................................................................................86
Configuring Rule Definitions...............................................................................................................87
Verifying your Configuration...........................................................................................................87
Configuring Group of Ruledefs...........................................................................................................87
Verifying your Configuration...........................................................................................................88
Configuring Charging Actions ............................................................................................................88
Verifying your Configuration...........................................................................................................88
Configuring IP Readdressing.........................................................................................................88
Configuring Next Hop Address ......................................................................................................89
Configuring Rulebase.........................................................................................................................89
Verifying your Configuration...........................................................................................................90
Configuring Rulebase Lists ................................................................................................................90
Configuring a Rulebase List in an APN .........................................................................................90
Verifying your configuration ...........................................................................................................91
Setting EDR Formats .........................................................................................................................91
Verifying your Configuration...........................................................................................................92
Setting UDR Formats.........................................................................................................................92
Verifying your Configuration...........................................................................................................92
Enabling Charging Record Retrieval..................................................................................................92
Optional Configurations......................................................................................................................93
Configuring a Rulebase for a Subscriber.......................................................................................93
Configuring a Rulebase within an APN..........................................................................................94
Configuring Charging Rule Optimization .......................................................................................94
Configuring Enhanced Features.............................................................................................................95
Configuring Prepaid Credit Control Application (CCA) ......................................................................95
Configuring Prepaid CCA for Diameter or RADIUS.......................................................................96
Configuring Diameter Prepaid Credit Control Application (DCCA)................................................98
Configuring RADIUS Prepaid Credit Control Application ............................................................101
Configuring Redirection of Subscriber Traffic to ECS......................................................................102
Creating an ECS ACL..................................................................................................................102
Applying an ACL to an Individual Subscriber...............................................................................102
Applying an ACL to the Subscriber Named default .....................................................................103
Applying the ACL to an APN........................................................................................................103
Configuring GTPP Accounting .........................................................................................................103
Configuring DNS Snooping Feature.................................................................................................104
Configuring EDR/UDR Parameters..................................................................................................104
Verifying your Configurations.......................................................................................................105
Pushing EDR/UDR Files Manually ..............................................................................................105
Retrieving EDR and UDR Files....................................................................................................106
Configuring Post Processing Feature ..............................................................................................106
Configuring Service Group QoS Feature .........................................................................................107
Configuring TCP Proxy.....................................................................................................................107
Configuring Flow Admission Control............................................................................................108
Verifying your Configuration.........................................................................................................108
Configuring Tethering Detection Feature.........................................................................................108
Upgrading Tethering Detection Databases..................................................................................109
Sample Tethering Detection Feature Configurations ..................................................................109
Configuring Time-of-Day Activation/Deactivation of Rules Feature.................................................114
Verifying your Configuration.........................................................................................................115
Configuring Transactional Rule Matching Feature...........................................................................115
Configuring Flow Aware Packet Acceleration Feature.....................................................................116
Configuring Retransmissions Under Rulebase or Service Level CLI ..............................................116
Configuring Websockets ..................................................................................................................116
Configuring URL Filtering Feature ...................................................................................................117

▀Contents
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
vi
Verifying your Configuration.........................................................................................................118
Configuring URL-based Re-addressing ...........................................................................................118
Configuring X-Header Insertion and Encryption Feature .................................................................118
Configuring X-Header Insertion....................................................................................................118
Configuring X-Header Encryption ................................................................................................120

Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
vii
About this Guide
This document pertains to the features and functionality that run on and/or that are related to the Cisco® ASR 5000 and
virtualized platforms.

About this Guide
▀Conventions Used
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
viii
Conventions Used
The following tables describe the conventions used throughout this documentation.
Icon
Notice Type
Description
Information Note
Provides information about important features or instructions.
Caution
Alerts you of potential damage to a program, device, or system.
Warning
Alerts you of potential personal injury or fatality. May also alert you of potential electrical hazards.
Typeface Conventions
Description
Text represented as a screen
display
This typeface represents displays that appear on your terminal screen, for example:
Login:
Text represented as commands
This typeface represents commands that you enter, for example:
show ip access-list
This document always gives the full form of a command in lowercase letters. Commands
are not case sensitive.
Text represented as a command
variable
This typeface represents a variable that is part of a command, for example:
show card slot_number
slot_number is a variable representing the desired chassis slot number.
Text represented as menu or sub-
menu names
This typeface represents menus and sub-menus that you access within a software
application, for example:
Click the File menu, then click New

About this Guide
Contacting Customer Support ▀
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
ix
Contacting Customer Support
Use the information in this section to contact customer support.
Refer to the support area of http://www.cisco.com for up-to-date product documentation or to submit a service request.
A valid username and password are required to access this site. Please contact your Cisco sales or service representative
for additional information.

About this Guide
▀Additional Information
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
x
Additional Information
Refer to the following guides for supplemental information about the system:
Cisco ASR 5000 Installation Guide
Cisco ASR 5000 System Administration Guide
Cisco ASR 5x00 Command Line Interface Reference
Cisco ASR 5x00 Thresholding Configuration Guide
Cisco ASR 5x00 SNMP MIB Reference
StarOS IP Security (IPSec) Reference
Web Element Manager Installation and Administration Guide
Cisco ASR 5x00 AAA Interface Administration and Reference
Cisco ASR 5x00 GTPP Interface Administration and Reference
Cisco ASR 5x00 Release Change Reference
Cisco ASR 5x00 Statistics and Counters Reference
Cisco ASR 5x00 Gateway GPRS Support Node Administration Guide
Cisco ASR 5x00 HRPD Serving Gateway Administration Guide
Cisco ASR 5000 IP Services Gateway Administration Guide
Cisco ASR 5x00 Mobility Management Entity Administration Guide
Cisco ASR 5x00 Packet Data Network Gateway Administration Guide
Cisco ASR 5x00 Packet Data Serving Node Administration Guide
Cisco ASR 5x00 System Architecture Evolution Gateway Administration Guide
Cisco ASR 5x00 Serving GPRS Support Node Administration Guide
Cisco ASR 5x00 Serving Gateway Administration Guide
Cisco ASR 5000 Session Control Manager Administration Guide
Cisco ASR 5000 Packet Data Gateway/Tunnel Termination Gateway Administration Guide
Release notes that accompany updates and upgrades to the StarOS for your service and platform

Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
11
Chapter 1
Enhanced Charging Service Overview
This chapter provides an overview of the Enhanced Charging Service (ECS) in-line service, also known as Active
Charging Service (ACS).
This chapter covers the following topics:
Introduction
Basic Features and Functionality
ECS Deployment and Architecture
Enhanced Features and Functionality

Enhanced Charging Service Overview
▀Introduction
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
12
Introduction
The Enhanced Charging Service (ECS) is an in-line service feature that enables operators to reduce billing-related costs
and gives the ability to offer tiered, detailed, and itemized billing to their subscribers. Using shallow and deep packet
inspection (DPI), ECS allows operators to charge subscribers based on actual usage, number of bytes, premium services,
location, and so on. ECS also generates charging records for postpaid and prepaid billing systems.
The ECS is an enhanced or extended premium service. The System Administration Guide provides basic system
configuration information, and the product administration guides provide information to configure the core network
service functionality. It is recommended that you select the configuration example that best meets your service model,
and configure the required elements for that model before using the procedures in this document.
Qualified Platforms
ECS is a StarOS in-line service application that runs on Cisco ASR 5x00 platforms. For additional platform information,
refer to the appropriate System Administration Guide and/or contact your Cisco account representative.
License Requirements
The ECS in-line service is a licensed Cisco feature. Separate session and feature licenses may be required. Contact your
Cisco account representative for detailed information on specific licensing requirements.
For information on installing and verifying licenses, refer to the Managing License Keys section of the Software
Management Operations chapter in the System Administration Guide.

Enhanced Charging Service Overview
Basic Features and Functionality ▀
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
13
Basic Features and Functionality
This section describes basic features of the ECS in-line service.
Shallow Packet Inspection
Shallow packet inspection is the examination of the layer 3 (IP header) and layer 4 (for example, UDP or TCP header)
information in the user plane packet flow. Shallow packet analyzers typically determine the destination IP address or
port number of a terminating proxy.
Deep Packet Inspection
Deep-packet inspection is the examination of layer 7, which contains Uniform Resource Identifier (URI) information. In
some cases, layer 3 and 4 analyzers that identify a trigger condition are insufficient for billing purposes, so layer 7
examination is used. Whereas, deep-packet analyzers typically identify the destination of a terminating proxy.
For example, if the Web site “www.companyname.com” corresponds to the IP address 1.1.1.1, and the stock quote page
(www.companyname.com/quotes) and the company page (www.companyname.com/business) are chargeable services,
while all other pages on this site are free. Because all parts of this Web site correspond to the destination address of
1.1.1.1 and port number 80 (http), determination of chargeable user traffic is possible only through the actual URL
(layer 7).
DPI performs packet inspection beyond layer 4 inspection and is typically deployed for:
Detection of URI information at level 7 (for example, HTTP, WTP, RTSP URLs)
Identification of true destination in the case of terminating proxies, where shallow packet inspection would only
reveal the destination IP address/port number of a terminating proxy such as the OpCo’s WAP gateway
De-encapsulation of nested traffic encapsulation, for example MMS-over-WTP/WSP-over-UDP/IP
Verification that traffic actually conforms to the protocol the layer 4 port number suggests
Charging Subsystem
ECS has protocol analyzers that examine uplink and downlink traffic. Incoming traffic goes into a protocol analyzer for
packet inspection. Routing rules definitions (ruledefs) are applied to determine which packets to inspect. This traffic is
then sent to the charging engine where charging rules definitions are applied to perform actions such as block, redirect,
or transmit. These analyzers also generate usage records for the billing system.
Traffic Analyzers
Traffic analyzers in ECS are based on configured ruledefs. Ruledefs used for traffic analysis analyze packet flows and
create usage records. The usage records are created per content type and forwarded to a prepaid server or to a billing
system.
The Traffic Analyzer function can perform shallow (layer 3 and layer 4) and deep (above layer 4) packet inspection of
IP packet flows. It is able to correlate all layer 3 packets (and bytes) with higher layer trigger criteria (for example, URL
detected in an HTTP header). It also performs stateful packet inspection for complex protocols like FTP, RTSP, and SIP
that dynamically open ports for the data path and this way, user plane payload is differentiated into “categories”. Traffic

Enhanced Charging Service Overview
▀Basic Features and Functionality
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
14
analyzers can also detect video streaming over RTSP, and image downloads and MMS over HTTP and differential
treatment can be given to the Vcast traffic.
Traffic analyzers work at the application level as well, and perform event-based charging without the interference of the
service platforms.
The ECS content analyzers can inspect and maintain state across various protocols at all layers of the OSI stack. The
ECS supports inspecting and analyzing the following protocols:
Domain Name System (DNS)
File Transfer Protocol (FTP)
Hyper Text Transfer Protocol (HTTP)
Internet Control Message Protocol (ICMP)
Internet Control Message Protocol version 6 (ICMPv6)
Internet Message Access Protocol (IMAP)
Internet Protocol version 4 (IPv4)
Internet Protocol version 6 (IPv6)
Multimedia Messaging Service (MMS)
Post Office Protocol version 3 (POP3)
Remote Authentication Dial In User Service (RADIUS)
RTP Control Protocol/Real-time Transport Control Protocol (RTCP)
Real-time Transport Protocol (RTP)
Real Time Streaming Protocol (RTSP)
Session Description Protocol (SDP)
Secure-HTTP (S-HTTP)
Session Initiation Protocol (SIP)
Simple Mail Transfer Protocol (SMTP)
Transmission Control Protocol (TCP)
User Datagram Protocol (UDP)
WebSocket Protocol
Wireless Session Protocol (WSP)
Wireless Transaction Protocol (WTP)
Apart from the above protocols, ECS also supports analysis of downloaded file characteristics (for example, file size,
chunks transferred, and so on) from file transfer protocols such as HTTP and FTP.
How ECS Works
This section describes the base components of the ECS solution, and the roles they play.
Content Service Steering
Content Service Steering (CSS) enables directing selective subscriber traffic into the ECS subsystem (in-line services
internal to the system) based on the content of the data presented by mobile subscribers.

Enhanced Charging Service Overview
Basic Features and Functionality ▀
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
15
CSS uses Access Control Lists (ACLs) to redirect selective subscriber traffic flows. ACLs control the flow of packets
into and out of the system. ACLs consist of “rules” (ACL rules) or filters that control the action taken on packets
matching the filter criteria.
ACLs are configurable on a per-context basis and applies to a subscriber through either a subscriber profile (for PDSN)
or an APN profile (for GGSN) in the destination context.
Important: For more information on CSS, refer to the Content Service Steering chapter of the System
Administration Guide.For more information on ACLs, refer to the IP Access Control Lists chapter of the System
Administration Guide.
Protocol Analyzer
The Protocol Analyzer is the software stack responsible for analyzing the individual protocol fields and states during
packet inspection.
The Protocol Analyzer performs two types of packet inspection:
Shallow Packet Inspection—Inspection of the layer 3 (IP header) and layer 4 (for example, UDP or TCP
header) information.
Deep Packet Inspection—Inspection of layer 7 and 7+ information. DPI functionality includes:
Detection of Uniform Resource Identifier (URI) information at level 7 (for example, HTTP, WTP, and
RTSP URLs)
Identification of true destination in the case of terminating proxies, where shallow packet inspection
would only reveal the destination IP address/port number of a terminating proxy
De-encapsulation of upper layer protocol headers, such as MMS-over-WTP, WSP-over-UDP, and IP-
over GPRS
Verification that traffic actually conforms to the protocol the layer 4 port number suggests
The Protocol Analyzer performs a stateful packet inspection of complex protocols, such as FTP, RTSP, and SIP, which
dynamically open ports for the data path, so the payload can be classified according to content.
The Protocol Analyzer is also capable of determining which layer 3 packets belong (either directly or indirectly) to a
trigger condition (for example, URL). In cases where the trigger condition cannot be uniquely defined at layers 3 and 4,
then the trigger condition must be defined at layer 7 (that is, a specific URL must be matched).
Protocol Analyzer Software Stack
Every packet that enters the ECS subsystem must first go through the Protocol Analyzer software stack, which
comprises of individual protocol analyzers for each of the supported protocols.

Enhanced Charging Service Overview
▀Basic Features and Functionality
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
16
Figure 1. ECS Protocol Analyzer Stack
Note that protocol names are used to represent the individual protocol analyzers.
Each analyzer consists of fields and states that are compared to the protocol-fields and protocol-states in the incoming
packets to determine packet content.
Important: In 14.0 and later releases, the ECS HTTP analyzer supports both CRLF and LF as valid terminators
for HTTP header fields.
Rule Definitions
Rule definitions (ruledefs) are user-defined expressions based on protocol fields and protocol states, which define what
actions to take on packets when specified field values match.

Enhanced Charging Service Overview
Basic Features and Functionality ▀
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
17
Rule expressions may contain a number of operator types (string, =, >, and so on) based on the data type of the operand.
For example, “string” type expressions like URLs and host names can be used with comparison operators like
“contains”, “!contains”, “=”, “!=”, “starts-with”, “ends-with”, “!starts-with” and “!ends-with”. In 14.0 and later releases,
ECS also supports regular expression based rule matching. For more information, refer to the Regular Expression
Support for Rule Matching section.
Integer type expressions like “packet size” and “sequence number” can be used with comparison operators like “=”,
“!=”, “>=”, “<=”. Each ruledef configuration consists of multiple expressions applicable to any of the fields or states
supported by the respective analyzers.
Ruledefs are of the following types:
Routing Ruledefs—Routing ruledefs are used to route packets to content analyzers. Routing ruledefs determine
which content analyzer to route the packet to when the protocol fields and/or protocol-states in ruledef
expression are true. Up to 256 ruledefs can be configured for routing.
Charging Ruledefs—Charging ruledefs are used to specify what action to take based on the analysis done by
the content analyzers. Actions can include redirection, charge value, and billing record emission. Up to 2048
charging ruledefs can be configured in the system.
Post-processing Ruledefs—Used for post-processing purposes. Enables processing of packets even if the rule
matching for them has been disabled.
Important: When a ruledef is created, if the rule-application is not specified for the ruledef, by default the
system considers the ruledef as a charging ruledef.
Ruledefs support a priority configuration to specify the order in which the ruledefs are examined and applied to packets.
The names of the ruledefs must be unique across the service or globally. A ruledef can be used across multiple
rulebases.
Important: Ruledef priorities control the flow of the packets through the analyzers and control the order in which
the charging actions are applied. The ruledef with the lowest priority number invokes first. For routing ruledefs, it is
important that lower level analyzers (such as the TCP analyzer) be invoked prior to the related analyzers in the next
level (such as HTTP analyzer and S-HTTP analyzers), as the next level of analyzers may require access to resources or
information from the lower level. Priorities are also important for charging ruledefs as the action defined in the first
matched charging rule apply to the packet and ECS subsystem disregards the rest of the charging ruledefs.
Each ruledef can be used across multiple rulebases, and up to 2048 ruledefs can be defined in a charging service.
In 14.1 and earlier releases, a maximum of 10 rule expressions (rule-lines) can be added in one ruledef.
In 15.0 and later releases, a maximum of 32 rule expressions (rule-lines) can be added in one ruledef.
Ruledefs have an expression part, which matches specific packets based upon analyzer field variables. This is a boolean
(analyzer_field operator value) expression that tests for analyzer field values.
The following is an example of a ruledef to match packets:
http url contains cnn.com
–or–
http any-match = TRUE
In the following example the ruledef named “rule-for-http” routes packets to the HTTP analyzer:
route priority 50 ruledef rule-for-http analyzer http

Enhanced Charging Service Overview
▀Basic Features and Functionality
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
18
Where, rule-for-http has been defined with the expressions: tcp either-port = 80
The following example applies actions where:
Subscribers whose packets contain the expression “bbc-news” are not charged for the service.
All other subscribers are charged according to the duration of use of the service.
ruledef port-80
tcp either-port = 80
rule-application routing
exit
ruledef bbc-news
http url starts-with http://news.bbc.co.uk
rule-application charging
exit
ruledef catch-all
ip any-match = TRUE
rule-application charging
exit
charging-action free-site
content-id 100
[ ... ]
exit
charging-action charge-by-duration
content-id 101
[ ... ]
exit
rulebase standard
[ ... ]
route priority 1ruledef port-80 analyzer http
action priority 101 ruledef bbc-news charging-action free-site
action priority 1000 ruledef catch-all charging-action charge-by-
duration

Enhanced Charging Service Overview
Basic Features and Functionality ▀
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
19
[ ... ]
exit
The following figure illustrates how ruledefs interact with the Protocol Analyzer Stack and Action Engine to produce
charging records.
Figure 2. ECS In-line Service Processing
Packets entering the ECS subsystem must first pass through the Protocol Analyzer Stack where routing ruledefs apply to
determine which packets to inspect. Then output from this inspection is passed to the charging engine, where charging
ruledefs apply to perform actions on the output.
Routing Ruledefs and Packet Inspection
The following figure and the steps describe the details of routing ruledef application during packet inspection.

Enhanced Charging Service Overview
▀Basic Features and Functionality
▄Cisco ASR 5x00 Enhanced Charging Services Administration Guide
20
Figure 3. Routing Ruledefs and Packet Inspection
Step 1 The packet is redirected to ECS based on the ACLs in the subscriber’s template /APN and packets enter ECS through
the Protocol Analyzer Stack.
Step 2 Packets entering Protocol Analyzer Stack first go through a shallow inspection by passing through the following
analyzers in the listed order:
Step a Bearer Analyzer
Step b IP Analyzer
Step c ICMP, TCP, or UDP Analyzer as appropriate
Important: In the current release traffic routes to the ICMP, TCP, and UDP analyzers by default.
Therefore, defining routing ruledefs for these analyzers is not required.
Step 3 The fields and states found in the shallow inspection are compared to the fields and states defined in the routing ruledefs
in the subscriber’s rulebase.
The ruledefs’ priority determines the order in which the ruledefs are compared against packets.
Step 4 When the protocol fields and states found during the shallow inspection match those defined in a routing ruledef, the
packet is routed to the appropriate layer 7 or 7+ analyzer for deep-packet inspection.
Step 5 After the packet has been inspected and analyzed by the Protocol Analyzer Stack:
Step a The packet resumes normal flow and through the rest of the ECS subsystem.