Transactional Rule Matching

This chapter describes the Transactional Rule Matching (TRM) feature and provides detailed information on the following topics:

Feature Description

The Transactional Rule Matching (TRM) feature enables the Enhanced Charging Service (ECS) to bypass per-packet rule matching on a transaction once the transaction is fully classified. This enables ECS to better utilize CPU resources and accomodate additional throughput for the system, thus improving the overall performance.

A transaction for TRM can be defined as the entire UDP flow, the ACK of the 3-way handshake to the FIN/RST of a TCP flow, or the HTTP request to the next HTTP request, or HTTP request to the FIN/RST for the final request of the flow. The TRM feature can perform rule matching on IP L4 rules (UDP, TCP), HTTP, and HTTPS.

Fastpath

The Fastpath feature can be used to reduce the overall system performance impact as a large amount of data packet is consumed through the ECS data path. The Fastpath feature introduces an alternate ECS data path (Fastpath) with limited supported features. By limiting the supported features, Fastpath eliminates the overhead of packets being subjected to the large number of feature-based conditional checks in ECS.

Fastpath does not replace the existing data path, and works in parallel with the existing ECS data path. The Fastpath feature is part of the Transactional Rule Matching (TRM) feature and requires TRM to be enabled.


Important

From 16.0 release, Transactional Rule Matching and Fastpath functionalities have been merged, and will be governed only by the transactional-rule-matching keyword alone. The fastpath keyword independently can no longer be used to turn on or turn off this functionality.

Feature Support

The following table provides information on the supported and unsupported features of Fastpath. Features that are listed under the Optimized column in the table below indicate that the features are directly supported by Fastpath. Features that are listed under the Eligible column in the table below indicate that a flow requiring the feature does not prevent it from taking advantage of Fastpath. Features that are listed under the unsupported column in the table below indicate that all packets in the flow that belong to the feature is not supported for Fastpath and will take the existing ECS data path.


Important

The TRM feature is supported in SSI platform; earlier it was restricted only to ASR 5500.


Important

In 20.0 and later releases, MVG is not supported. For more information, contact your Cisco account representative.

Table 1. Flow-level Support

Feature

Fastpath Optimized

Fastpath Eligible

Unsupported

Url Redirect

—

Yes

—

Charging Bucket Maintenance

—

Yes

—

ITC/BW control

—

Yes

—

Next Hop

—

Yes

—

TCP State based rules

—

Yes

—

Post-processing Rules

—

Yes

—

Flow limit - Discard/Redirect/Terminate-Flow/Terminate-Session

—

Yes

—

DSCP / IP TOS

—

Yes

—

ICSR

—

Yes

—

Session Recovery

—

Yes

—

Content Filtering (CF) Static

—

—

Yes

CF Dynamic

—

—

Yes

Socket Migration

—

—

Yes

Blacklisting

—

Yes

—

ICAP

—

—

Yes

NAT

Yes

—

—

SFW

—

—

Yes

Video transrating

—

—

Yes

MVG CAE Readdressing

—

—

Yes

MVG Pacing

—

—

Yes

MVG Link Monitoring

—

—

Yes

MVG Header Insertion

—

—

Yes

ADC/P2P

Refer to the Note below this table.

—

Yes

—

SIP-ALG (App Layer Gateway)

—

—

Yes

H323 - ALG

—

—

Yes

DCCA

—

Yes

—

IPv6

Yes

—

—

Flow Readdress

—

—

Yes

Idle-timeout handling

Yes

—

—

Connection termination (2MSL)

—

Yes

—

TCP Proxy

—

—

Yes

QOS

—

Yes

—

Lawful Intercept

—

Yes

—

HTTP/HTTPS

—

Yes

—

Non HTTP L7 protocols

—

—

Yes

NON UDP/TCP flows

—

—

Yes

Tethering detection

—

—

Yes

Gx

—

Yes

—

Gy

—

Yes

—

HEE

—

Yes

—

Radius

—

Yes

—

Diameter

—

Yes

—

L4 checksum

—

—

Yes

TCP link monitoring

—

—

Yes

Header enrichment

—

—

Yes

Wimax Hotlining

—

—

Yes

Parsing Error Detection Denial

—

—

Yes

IP only Byte Counting/Charging

Yes

—

—

DNS Snoop

—

Yes

—

ICMP

—

—

Yes

Data Record generation

—

Yes

—

Fair Usage

—

Yes

—

SPI

Yes

—

—


Important

Note that all ADC protocols are not Fastpath eligible. Refer to the ADC Administration Guide for more information.

Even when a flow is supported for Fastpath, some packets for the flow are not eligible to be processed in Fastpath. When a packet is not eligible, the packet is processed in the existing ECS data path. The following table provides information on the packet-level support in Fastpath:

Table 2. Packet-level Support

Packet Handling Feature

Fastpath Eligible

No Support

Valid UDP/TCP in order pkts

Yes

—

OOO Packet handling

—

Yes

TCP Retransmissions

Yes

—

IP Fragmentation

—

Yes

TCP Handshaking

—

Yes

TCP Termination

—

Yes

First packet of Flow

—

Yes

Gx Rule Update

—

Yes

Invalid L3/L4 packet

Yes

—

Packet already queued

—

Yes

Limitations and Dependencies

The following are limitations to the TRM feature:

  • TRM is supported only on the ASR 5500 platform.

  • TRM is limited to flows with no protocol routing rules with the exception of HTTP and HTTPS flows. All other flows are not supported and TRM does not have any impact on other flows.

  • When TRM is enabled, the following functionalities are affected:

    • Per direction rule matching.

    • TCP state rules for the duration of the TRM transaction.

    • Configuring delay charging when the TRM feature is enabled impacts only packets outside transaction boundaries. All packets within the transaction boundary will be applied to the application (i.e. HTTP).

  • Once a flow is classified to a ruledef (first packet in flow for UDP or the first data packet after the 3-way handshake for a TCP flow), TRM will attempt to use that matched rule for the duration of the transaction. This might result in the ruledefs such as those with mid-transaction TCP states or packet direction to be ignored for the flow.

Configuring Transactional Rule Matching Feature

Use the following configuration to enable the Transactional Rule Matching (TRM) feature.


Important

The TRM feature is supported in SSI platform; earlier it was restricted only to ASR 5500. 

configure 
   active-charging service <ecs_service_name> 
      rulebase <rulebase_name> 
         transactional-rule-matching  
         end

Notes:

  • Use the no transactional-rule-matching command or default transactional-rule-matching command to disable transactional rule matching.

  • Transactional rule matching is disabled by default.


Important

From 16.0 release, Transactional Rule Matching and Fastpath functionalities have been merged, and will be governed by only the transactional-rule-matching keyword alone. The keyword fastpath independently can no longer be used to turn on or turn off this functionality.

Verifying the TRM Configuration

To verify your configuration, in the Exec mode, enter the following command: 

show active-charging rulebase name <rulebase_name>

Monitoring and Troubleshooting the Transactional Rule Matching feature

This section provides information on the bulk statistics and show commands available to support this feature.

show active-charging rulebase statistics

The output of this command displays the TRM statistics.

  • TRM Statistics:

    • Bypassed rule-matching

    • Rule-matching bypass triggered

    • Failed to create dynamic flow element

    • Flow cleared, rule not found

    • Flow cleared, rule stats not found

    • Flow cleared, group not found

    • Flow cleared, group rule error

    • Flow cleared, rule error

    • Flow cleared, rule expired

    • Flow cleared, pkts not forwarded

    • Flow cleared, pkts buffered

    • Flow cleared, SEF event

    • Flow cleared, egcdr bucket idle time out

    • FastPath Eligible Flows

    • FastPath Packets

    • FastPath Failures

show active-charging rulebase statistics name

The output of this command displays the TRM statistics.

  • TRM Statistics:

    • Bypassed rule-matching

    • Rule-matching bypass triggered

    • Failed to create dynamic flow element

    • Flow cleared, rule not found

    • Flow cleared, rule stats not found

    • Flow cleared, group not found

    • Flow cleared, group rule error

    • Flow cleared, rule error

    • Flow cleared, rule expired

    • Flow cleared, pkts not forwarded

    • Flow cleared, pkts buffered

    • Flow cleared, SEF event

    • Flow cleared, egcdr bucket idle time out

    • FastPath Eligible Flows

    • FastPath Packets

    • FastPath Failures

Bulk Statistics

Bulk statistics reporting for the TRM feature is supported.

The following bulk statistics are available in the ECS schema:

  • trm-rule-match-bypassed

  • trm-rule-match-bypass-triggered

  • fp-eligible-flows

  • fp-packets

  • fp-failures

For more information on these bulk statistics, see the ECS Schema Statistics chapter of the Statistics and Counters Reference.