This command allows
you to specify the action to take on packets that match rule definitions.
Privilege
Security Administrator,
Administrator
Mode
Exec > ACS Configuration
> Charging Action Configuration
active-charging service service_name > charging-action charging_action_name
Entering the above
command sequence results in the following prompt:
[local]host_name(config-charging-action)#
Syntax
In StarOS 12.2 and
later releases:
flow action { conditional user-agent end-token end_token_name | discard [ downlink | uplink ] | random-drop interval interval_start to interval_end pkts-to-drop packet_min to packet_max | readdress [ [ server ipv4_address/ipv6_address [ discard-on-failure ] [ dns-proxy-bypass ] ] [ port port_number [ discard-on-failure ] [ dns-proxy-bypass ] ] | server-list server_list_name [ hierarchy ][ round-robin ] [ dns-proxy-bypass ] [ discard-on-failure ] ] | redirect-ocs-url | redirect-url redirect_url [ [ encryption { blowfish128 | blowfish64 }| { { aes128 | aes256 | aes-gcm-256 } [salt] } } [ encrypted ] key key ] [ clear-quota-retry-timer ] [ first-request-only [ post-redirect { allow | discard | terminate } ] ] ] | rulebase-change rulebase_name | terminate-flow | terminate-session | url-readdress server ipv4_address [ port port_number ] }
no flow action
In StarOS 12.1 and
earlier releases:
flow action { conditional user-agent end-token end_token_name | discard [ downlink | uplink ] | random-drop interval interval_start to interval_end pkts-to-drop packet_min to packet_max | redirect-url redirect_url [ clear-quota-retry-timer ] | readdress [ server ipv4_address/ipv6_address ] [ port port_number ] | terminate-flow | terminate-session }
no flow action
no
If previously configured,
deletes the flow action configuration in the current charging action.
conditional user-agent
end-token end_token_name
Specifies to conditionally
redirect the HTTP packets matched to a configured user-agent to
a specified URL. The user agent is configured using the redirect user-agent command
in the ACS Configuration Mode.
end_token_name must
be an alphanumeric string of 1 through 32 characters, and is configured
with this command to end the redirection condition.
discard [ downlink | uplink ]
Specifies to discard
the specified packets.
If downlink or uplink keyword
is not specified, both downlink and uplink packets will be discarded.
random-drop interval interval_start to interval_end pkts-to-drop packet_min to packet_max
Specifies to drop a
group of consecutive packets (pkts-to-drop )
to be dropped in the specified time interval (random-drop interval ).
This will cause degradation in user experience. P2P VoIP would need more
than one packet to be dropped, since that type of protocol is geared
to handle occasional single packet drops.
-
random-drop interval interval_start to interval_end : Specifies the random drop interval, in seconds, at which the voice packets will be dropped.
interval_start and interval_end must be integers from 1 through 999.
-
pkts-to-drop packet_min to packet_max : Specifies the number of voice packets to be dropped at a time in a flow when the packets have to be dropped.
packet_min and packet_max must be integers from 1 through 100.
readdress [ [ server ipv4_address/ipv6_address [ discard-on-failure ] [ dns-proxy-bypass ] ] [ port port_number [ discard-on-failure ] [ dns-proxy-bypass ] ] | server-list server_list_name [ hierarchy ] [ round-robin ] [ discard-on-failure ] [ dns-proxy-bypass ] ]
Specifies to readdress
the location of the uplink packets for charging action.
-
server ipv4_address/Ipv6 : Specifies the re-address server's IPv4/IPv6 address.
-
port port_number : Specifies the re-address server's port number.
port_number must be an integer from 1 through 65535.
Important
|
You can optionally keep the original destination address and just change the destination TCP/UDP port number.
|
-
server-list server_list_name
Important
|
This option is available only in StarOS 14.1 and later releases.
This keyword is license dependent. For more information please contact your Cisco account representative.
|
Specifies to readdress the packet flow to the DNS servers configured under the server list.
For more information about configuring the server list, see the ACS Readdress Server List Configuration Mode chapter.
-
hierarchy
Specifies the hierarchy approach to select the server list from the readdress server list.
-
round-robin
Specifies the round-robin approach to select the server list from the readdress server list. This is the default approach.
-
discard-on-failure
Important
|
This option is available only in StarOS 14.0 and later releases.
|
Specifies to discard the packets if readdressing fails due to duplicate key. If this keyword is not configured, no action
is taken and the packets are allowed to pass.
If already configured, to revert the behavior, configure the flow action readdress command again without the discard-on-failure keyword.
-
dns-proxy-bypass
Important
|
This option is available only in StarOS 12.3 and later releases.
|
Specifies the DNS packets to bypass interception at the session manager when readdressing for flow occurs, and go through
ECS-based DNS redirection. If this keyword is not configured, DNS redirection from ECS is disabled.
redirect-ocs-url
Important
|
This option is available
only in StarOS 12.3 and later releases.
|
Specifies to redirect
to the URL provided by OCS only for post-processing dynamic rules.
redirect-url redirect_url [ [ encryption { blowfish128 | blowfish64 } | { { aes128 | aes256 | aes-gcm-256 }aes [salt] } } [ encrypted ] key key ] [ clear-quota-retry-timer ] [ first-request-only [ post-redirect { allow | discard | terminate } ] ] ]
Specifies to return
a redirect response to the subscriber, and terminate the TCP connections (to
the subscriber and server). The subscriber's Web browser should
automatically send the original HTTP packet to the specified URL.
Redirection is only possible for certain types of HTTP packets (for
example, GET requests), which typically are only sent in the uplink
direction. If the flow is not HTTP, the redirect-url option
is ignored, that is the packet is forwarded normally, except for
SIP. For SIP, a Contact header with the redirect information is
inserted.
The redirect-url consists
of the redirect url and may additionally include one or more dynamic
fields. Earlier, the dynamic fields could be encrypted using 128
and 256 bit blowfish encryption. The new functionality provides
the additional AES-CBC encryption ofthe dynamic fields as well.
-
redirect_url specifies the redirect URL. redirect_url must be an alphanumeric string of 1 through 511 characters. It may include one or more dynamic fields (up to 16 may be specified).
For example, http://search.com/subtarg=#HTTP.URL#.
Dynamic fields must be enclosed in "#" (hash).
Up to 16 dynamic fields out of the following 23 are allowed:
-
#BEARER.CALLED-STATION-ID#
-
#BEARER.CALLING-STATION-ID#
-
#BEARER.NAS-IP-ADDRESS#
-
#BEARER.USER-NAME#
-
#BEARER.ACCT-SESSION-ID#
-
#BEARER.CORRELATION-ID#
-
#BEARER.RULEBASE#
-
#BEARER.SERVED-BSA-ADDR#
-
#BEARER.SERVICE-NAME#
-
#BEARER.SUBSCRIBER-ID#
-
#BEARER.MSISDN#
-
#HTTP.URL#
-
#HTTP.URI#
-
#HTTP.HOST#
-
#RTSP.URI#
-
#WSP.URL#
-
#CONTENT-ID-LABEL#
-
#CONTENT-ID-LABEL-CAUSING-REDIRECTION#
-
#BEARER.HWID#
-
#BEARER.IMSI#
-
#BEARER.IMEI#
-
#BEARER.ESN#
-
#BEARER.MEID#
Concatenated fields separated by ; (semi colon) can also be inserted. For example, #BEARER.IMSI;BEARER.IMEI#
-
encryption { blowfish128 | blowfish64 } [ | { { aes128 | aes256 | aes-gcm-256 } [salt] } } encrypted ] key key
Important
|
This option is available only in StarOS 12.2 and later releases.
|
-
encryption : Specifies to enable encryption for dynamic fields of the redirect URL.
-
blowfish128 : Specifies to use Blowfish encryption with 128 bit key for encrypting the dynamic fields.
-
blowfish64 : Specifies to use Blowfish encryption with 64 bit key for encrypting the dynamic fields.
-
aes128 : Specifies to use AES-CBC encryption with 128-bit key for encrypting the dynamic fields.
-
aes256 : Specifies to use AES-CBC encryption with 256 bit key for encrypting the dynamic fields.
Note
|
For aes128 and aes256 CBC encryption, the iteration count used is 10 and the digest used is sha1. Both of these parameters are static fields used
while encrypting and are not configurable by the user.
|
-
aes-gcm-256 : Use AES GCM with 256 bit key for encrypting the dynamic fields.
Note
|
For aes-gcm-256 encryption, the iteration count used is 14 and the digest used is sha384. Both of these parameters are static fields used
while encrypting and are not configurable by the user.
|
-
salt : Specifies to use salt with AES encryptions of the dynamic fields. Note: salt is not relevant for blowfish algorithms.
-
encrypted : Specifies to encrypt the key.
-
key key : Specifies the key to use for encryption of dynamic fields.
key must be an alphanumeric string of 1 through 523 characters.
Note that encryption is supported only for the following fields:
Also, concatenated fields having any of the above will be encrypted.
%3furl= can be used as a delimiter between URL. As in http://search.com/subtarg/%3furl=#HTTP.URL# format.
-
clear-quota-retry-timer : Specifies to reset Credit Control Application (CCA) Quota Retry Timer upon redirection.
-
first-request-only [ post-redirect { allow | discard | terminate } ]
Important
|
This option is available only in StarOS 12.3 and later releases.
|
-
first-request-only : Specifies the url-redirection to be performed only once per session after the first web traffic has been detected.
-
post-redirect : Specifies the action to be taken on subsequent flow packets that invoke this charging action after the first url-redirection
has been performed for that session.
The following are the different actions allowed on the flow packets:
-
allow : allows the packets subsequent to the first url-redirection to flow
-
discard : discards the packets subsequent to the first url-redirection
-
terminate : terminates the flow of packets on receiving packets subsequent to the first url-redirection
To disable this option if configured earlier, reuse the same flow action redirect-url
redirect_url command without the first-request-only keyword.
Important
|
Disabling the first-request-only keyword will not affect the existing subscriber calls.
|
rulebase-change rulebase_name
Specifies the rulebase
to change to when the charging action is applied. The new rulebase will
be applied to the next packet on the call, and applied only to the
current PDN.
terminate-flow
Specifies to terminate
the flow.
Terminates the TCP
connection gracefully between the subscriber and external server
and sends a TCP FIN to the subscriber and a TCP RST to the server.
If the flow does not use TCP, this option simply discard the packets.
This option is applicable only for flows that use TCP.
terminate-session
Specifies to terminate
the session.
When a rule pointing
to a charging action configured with the terminate-session keyword
is hit, then the corresponding session will be terminated.
url-readdress server ipv4_address [ port port_number ]
Configures the URL
server to re-address for the specified charging action.
-
server ipv4_address : Specifies the re-address server's IPv4 address.
-
port port_number : Specifies the re-address server's port number.
port_number must be an integer from 1 through 65535.
Usage Guidelines
Use this command to
specify the action to take on packets, for example to discard, terminate,
or redirect.
When a readdress server
is configured for a charging action, the show configuration command
will display the readdress related configuration only if server
address is configured. The show configuration verbose command
will display the readdress sever if configured, else will display "no
flow action".
The redirect-url option
can be used to redirect SIP requests as well. The following is a sample
configuration:
configure
active-charging service s1
charging-action ca_sip_redir
content-id 10
flow action redirect-url sip:test@sip.org
exit
ruledef sip_req
sip request packet = TRUE
exit
rulebase plan1
action priority 08 ruledef sip_req charging-action ca_sip_redir
/* other rules, routing rules for sip, etc */
end
This would mean any
SIP request that hits the sip_req ruledef,
would get redirected to the url given in ca_sip_redir . This
involves creating a redirection packet with the following response
line and "Contact" header in the response.
SIP/2.0 302
Moved Temporarily
302 Moved Temporarily
Most of the header
fields are copied directly from the request, so that the mandatory
SIP headers are present. If content-length header was seen in the
original message, it is replaced in the reply with "Content-Length:
0".
Example
The following command
sets the flow action to terminate:flow-action terminate-flow
The following command
resets quota retry timer upon redirection of flow to HTTP URL http://search.com/?url=#http://msn.com# :flow action redirect-url http://search.com/%3url=#http://msn.com# clear-quota-retry-timer
Feedback