Flow Admission Control; Tcp Proxy Behavior And Limitations - Cisco ASR 5000 Series Administration Manual

Enhanced Charging Service Overview
The following packets will be charged at ECS:
 Uplink packets received at Gn interface
 Downlink packets received at Gi interface
The following packets will not be considered for charging:
 Uplink packets forwarded/sent out by ECS/Stack on the Gi interface.
 Downlink packets forwarded/sent out by ECS/Stack on the Gn interface.
ECS supports bulkstats for the TCP Proxy feature. For details see the ECS Schema Statistics chapter of the Statistics and
Counters Reference.

Flow Admission Control

The Flow Admission Control feature controls the number of flows required to be proxied. It restricts admission of new
calls based on the current resource usage, thus preventing system hog and service degradation to existing subscribers.
The number of flows required to be proxied will greatly depend on the deployment scenario. Operators have the
provision to configure an upper bound on the memory used by proxy flows. This is specified as a percentage of the
Session Manager memory that may be used for proxy flows. When memory utilization by existing proxy flows reaches
this value, no further flows will be proxied.
Operators can also set a limit on the number of flows that can be proxied per subscriber. This would exercise Fair Usage
policy to a certain extent. No credit usage information by proxy is communicated to the Session Manager.

TCP Proxy Behavior and Limitations

The following are behavioral changes applicable to various ECS features and on other applications after enabling TCP
Proxy.
 TCP Proxy Model: Without TCP Proxy, for a particular flow, there is only a single TCP connection between
subscriber and server. ECS is a passive entity with respect to flows and the packets received on ingress were
sent out on egress side (except in case where some specific actions like drop are configured through CLI)
transparently.
With TCP Proxy, a flow is split into two TCP connections — one between subscriber and proxy and another
between chassis and server.
 Ingress Data Flow to Proxy: For all uplink packets, ingress flow involves completing the following steps and
then enters the Gn side TCP IP Stack of proxy:
1. IP Analysis (support for IP reassembly)
2. Shallow/Deep Packet TCP Analysis (support for TCP OOO)
3. Stateful Firewall Processing
4. Application Detection and Control Processing
5. DPI Analysis
6. Charging Function (including rule-matching, generation of various records, and applying various
For all downlink packets, ingress flow would involve completing the following steps, and then enters the Gi
side TCP IP Stack of proxy:
1. IP Analysis (support for IP reassembly)
2. Network Address Translation Processing
configured actions)
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
Enhanced Features and Functionality ▀
55