The main data, in addition to the key point, i.e. whether the user is authorized or not, needed to the fastPCRF to form the response to the Access-Request properly, are the following:
User-Name, CUI or VasExperts-UserName
The Stingray Service Gateway supports both IPv4 and IPv6 subscriber addressing. In case of IPv4 subscribers, the response should contain the Framed-IP-Address attribute specifying the IPv4 address, but this address has to match the one specified in the Access-Request. If the Framed-IP-Address values in the request and response differ, this is considered an error.
Framed-IP-Address attribute to Access-Accept in L3 authorization mode. For such cases fastpcrf.conf-option radius_framed_ip_from_request=1 is provided: with this value, if the Framed-IP-Address attribute is missing in the response, the fastPCRF takes it from the authorization request.
The following attributes are supported in the Access-Accept/Reject for IPv6 subscribers:
Framed-IPv6-Address specifies the subscriber IPv6 address. The attribute value within response has to match the corresponding value within request.Framed-IPv6-Prefix specifies the IPv6 subscriber subnet prefix. Prefix size, as well as its value within the response have to match the ones within the request.Framed-IPv6-Pool is the pool name. It is optional attribute. If this attribute is specified in the response, it will be sent in all the Accounting-Request packets.
In case of IPv6, the response has to contain one of the Framed-IPv6-Address or Framed-IPv6-Prefix attributes (or both). However, the SSG interprets Framed-IPv6-Address attribute as a subnet prefix without taking into account the least significant bits of the address (remember that the SSG currently can handle only equal sized prefixes, specifying by the ipv6_subnetwork parameter).
The dual stack subscribers are also supported: the Access-Request is always sent using either IPv4 or IPv6 address, but the response can contain both addresses in the Framed-IP-Address and Framed-IPv6-Address/Framed-IPv6-Prefix attributes. This means that the subscriber is assigned both an IPv4 address and an IPv6 prefix. At the same time, such a subscriber is not considered by default a multi-bind subscriber: the SSG implies that each subscriber, even single-binded, can be bound to the pair: IPv4 address and IPv6-prefix.
The policing profile and the list of activated services are sent in the [26] Vendor-Specific attribute contained in the responses.
VENDOR VasExperts 43823 BEGIN-VENDOR VasExperts ATTRIBUTE VasExperts-Policing-Profile 1 string ATTRIBUTE VasExperts-Service-Profile 2 string ATTRIBUTE VasExperts-Enable-Service 3 string ATTRIBUTE VasExperts-Multi-IP-User 4 integer ATTRIBUTE VasExperts-UserName 5 string ATTRIBUTE VasExperts-Restrict-User 7 byte или integer END-VENDOR VasExperts
The VasExperts-Policing-Profile attribute is included in the Access-Accept response and is responsible for applying policing rules.
VasExperts-Policing-Profile attribute.
Profile configuration options:
A string attribute that specifies the name of the policing profile:
VasExperts-Policing-Profile = “50Mbps”
VasExperts-Policing-Profile = “BV##100000#100000#+++-++++”
where:
BV — By Value, the HTB algorithm is used, where the ceil for each class is equal to the root rate##100000 — limit from the Internet to the subscriber (download), kbps#100000 — limit from subscriber to Internet (upload), kbps#+++-++++ — permission for classes cs0 … cs7, rate(cs3)=0 — class cs3 is blocked, other classes use root speed with the possibility of borrowing (HTB)SSG DPI uses two types of policing — HTB (Hierarchical Token Bucket) and TBF (Token Bucket Filter). The examples below use the HTB algorithm with a minimum (rate) and maximum (ceil) speed limit for each class.
The policing profile defines the overall rate (root) and the rate for each traffic class (cs0 … cs7)
It allows you to set the rate and ceil parameters for each class separately and contains 36 parameters.
Format (displayed as a single line without line breaks):
VasExperts-Policing-Profile = "BR##4#<RIN><ROUT><CIN><COUT><RIN0><ROUT0><CIN0><COUT0><RIN1><ROUT1><CIN1><COUT1><RIN2><ROUT2><CIN2><COUT2><RIN3><ROUT3><CIN3><COUT3><RIN4><ROUT4><CIN4><COUT4><RIN5><ROUT5><CIN5><COUT5><RIN6><ROUT6><CIN6><COUT6><RIN7><ROUT7><CIN7><COUT7>
where:
BR — By Rates##4# — HTB is used; the rate and ceil are transmitted for inbound and outbound traffic<RIN> — kbps root rate (#8192k), the total rate for all classes for inbound traffic (download)<ROUT> — kbps root rate (#8192k), total speed for all classes for outbound traffic (upload)<RIN0> … <RIN7> — kbps class rate, minimum speed by class for inbound traffic (download)<CIN0> … <CIN7> — kbps ceiling rate, maximum speed per class for inbound traffic (download)<ROUT0> … <ROUT7> — kbps class rate, minimum speed per class for outbound traffic (upload)<COUT0> … <COUT7> — kbps ceiling rate, maximum speed (ceiling) by class for outbound traffic (upload)For convenience, it has been broken into lines, but it must be sent as a single line.
VasExperts-Policing-Profile = "BR##4# 8192k8192k65M65M 1024k1024k8192k8192k 1024k1024k8192k8192k 1024k1024k8192k8192k 1024k1024k8192k8192k 1024k1024k8192k8192k 1024k1024k8192k8192k 1024k1024k8192k8192k 1024k1024k8192k8192k"
sudo fdpi_ctrl list --policing --ip <ip> | sed 's/\s/\n/g'
Sample output:
htb_inbound_root=rate 8192kbit htb_inbound_class0=rate 1024kbit ceil 8192kbit htb_inbound_class1=rate 1024kbit ceil 8192kbit htb_inbound_class2=rate 1024kbit ceil 8192kbit htb_inbound_class3=rate 1024kbit ceil 8192kbit htb_inbound_class4=rate 1024kbit ceil 8192kbit htb_inbound_class5=rate 1024kbit ceil 8192kbit htb_inbound_class6=rate 1024kbit ceil 8192kbit htb_inbound_class7=rate 1024kbit ceil 8192kbit htb_root=rate 8192kbit htb_class0=rate 1024kbit ceil 8192kbit htb_class1=rate 1024kbit ceil 8192kbit htb_class2=rate 1024kbit ceil 8192kbit htb_class3=rate 1024kbit ceil 8192kbit htb_class4=rate 1024kbit ceil 8192kbit htb_class5=rate 1024kbit ceil 8192kbit htb_class6=rate 1024kbit ceil 8192kbit htb_class7=rate 1024kbit ceil 8192kbit
A string parameter that specifies the profile name for a specific fastDPI service.
String format:
service_id:profile_name
Where:
service_id — a number, fastDPI service identifier;profile_name — a string, the profile name for the service.VasExperts-Service-Profile attributes—one attribute for each service.
NAT connection (service 11) using the "cgnat" profile.
VasExperts-Service-Profile="11:cgnat"
Configuring Whitelist and Captive Portal, HTTP redirect (16 services) with the redirect page parameters set to "http://info.com" and the allowed IP address list set to "/var/lib/dpi/ip_list.bin".
VasExperts-Service-Profile = "16:BV##/var/lib/dpi/ip_list.bin#http://info.com"
Service 18 (Session-Based Policing) is used to override traffic classes (cs0 … cs7) and configure session-based policing for a specific subscriber.
The profile defines the distribution of DPI protocols across traffic classes.
Classes are assigned individually for each subscriber.
Format:
VasExperts-Service-Profile = "18:BP##profile_name#/share/#IMSI_number.dscp#IMSI_number.tbf"
where:
18 — traffic class reclassification and per-session policingBP — By Parameters##profile_name — profile name, created dynamically, displayed in the GUI and CLI#/share/ — directory on fastPCEF. Accessible over the network; only the filename is passed, while the file itself is read from the original directory. Contains source (.txt) files (not converted to binary) for easy verification#IMSI_number.dscp — protocol and traffic class mapping file. Determines which class (cs0 … cs7) the traffic is placed in. Supports the drop flag for blocking#IMSI_number.tbf — a file containing session-level policing parameters. Sets policing rules for individual protocols. Used to limit speed at the session levelExample:
VasExperts-Service-Profile =18:BP##250019500475292#/share/#250019500475292.dscp#250019500475292.tbf
A string parameter that specifies whether to activate/disable a specific service not requiring any profile. String format :
service_id:flag
here:
service_id – the number, the fastDPI service identifierflag – the flag indicating the activating/disabling of the service. The valid values are:on, enabled – corresponds to activated serviceoff, disabled – corresponds to disabled service
The example of the service to be activated: 5:on
The example of the service to be disabled: 5:off
You should use this attribute in order to disable the service in CoA. For example, to disable service 5 you should specify:
VasExperts-Enable-Service="5:off".
Whereas to activate the service 5 with my_white_list profile you should specify: VasExperts-Service-Profile="5:my_white_list"
enabled (or if the corresponding profile is not specified) the service is treated as disabled. But in case of service 4 (black list, prohibited traffic filtering)
there is more stringent rule applied: this service have to be explicitly disabled for the user, so the VasExperts-Enable-Service="4:off" attribute should be presented in the Radius server response in order to disable the service 4 "black-list".
By default, the activation of the service 4 "black-list" is managed by the global fastDPI configuration. Service 4 is usually globally activated in order to comply with the federal law.
This attribute shows whether there are many IP addresses assigned for this subscriber or only just one.
This attribute can be presented either by a byte or by a 32-bit number.
A value of 1 means that several IP addresses can be assigned to this subscriber
(corporate client), value 0 corresponds to only one IP-address.
If the VasExperts-Multi-IP-User attribute is not presented in the PDU, it is considered that only one IP address is assigned to the subscriber.
If the VasExperts-Multi-IP-User=1 attribute is set to the user so the features (active services and policing) are applied to all subscribers IP addresses and the key is a subscriber login. Note that the Stingray SG authorizes each subscriber IP address: for example, if 10 IP addresses are associated with the subscriber, an Access-Request authorization request will be sent for each of the addresses. It is expected that the response to each IP address of a multi-IP subscriber will contain the same set of active services and the same profiles. The response to the authorization of each of the 10 IP-addresses mentioned above will be applied to the subscriber login, so all the IP addresses within this login will be assigned the same set of services along with the same policing.
The subscriber name (login).
This attribute is introduced for some billing systems that aren't able to response with the User-Name attribute within the Access-Accept/Reject response, but are able to response with any VSA attribute.
User-Name and VasExperts attributes are present in response, then the value of VasExperts-UserName will be preferred.
The attribute to identify the subscriber is blocked.
For the SSG the Access-Accept response means that the subscriber is not blocked, but for blocked subscribers Access-Reject containing special subscriber attributes specifying some restrictions have to be responded.
But some implementations of radius clients do not have the ability to return the Access-Reject containing subscriber attributes.
For such implementations the VasExperts-Restrict-User attribute is provided :
In case of the VasExperts-Restrict-User=1 the SSG handles the Access-Accept as Accept-Reject.
The attribute indicating enabling/disabling local interconnect for the subscriber.
This attribute corresponds to L2 BRAS. By default, if the local interconnect is enabled, L2 BRAS interconnects any two local subscribers. You can disable interconnect using this attribute: VasExperts-Enable-Interconnect=0.
So a packet from one local subscriber to another will be dropped if the local interconnect is disabled at least for one of the subscribers.
By default, VasExperts-Enable-Interconnect=1 and if bras_terminate_local=1 is set in fastdpi.conf, then interconnect is allowed. This attribute can be used to disable interconnect for a specific subscriber by specifying VasExperts-Enable-Interconnect=0.
In addition to the mentioned above VSA attributes the Stingray Service Gateway supports the following standard Radius-attributes within the Access-Accept/Access-Reject. All of them are optional.
It specifies the duration of the subscriber authorization, in seconds. At the expiry of this time the SSG will send a second request for Access-Request to authorize.
By default, the session duration is specified in the fastdpi.conf using the auth_expired_timeout option (in minutes).
Specifies the time interval for updating Accounting statistics (in seconds) for the subscriber.
Interim interval is specified by default in the fastpcrf.conf using the radius_acct_interim_interval option.
Acct-Interim-Interval = 0 in the RADIUS response disables sending Interim-Update.
Specifies the interval over which the accounting data is unchanged, when it expires the accounting session is considered to be closed caused by the subscriber inactivity. Idle timeout is set by default by the fastpcrf.conf radius_acct_idle_timeout option.
A way to determine the subscriber inactivity is specified by the acct_check_idle_mode option defined in the fastpcrf.conf. The description of the parameters can be found in the section FastPCRF settings.
This attribute will be added to all Accounting-Request PDUs if it is set. The SSG does not analyze the value of this attribute.