Cisco ASR 5000 Series Administration Manual page 17

Enhanced Charging Service Overview
Rule expressions may contain a number of operator types (string, =, >, and so on) based on the data type of the operand.
For example, "string" type expressions like URLs and host names can be used with comparison operators like
"contains", "!contains", "=", "!=", "starts-with", "ends-with", "!starts-with" and "!ends-with". In 14.0 and later releases,
ECS also supports regular expression based rule matching. For more information, refer to the Regular Expression
Support for Rule Matching section.
Integer type expressions like "packet size" and "sequence number" can be used with comparison operators like "=",
"!=", ">=", "<=". Each ruledef configuration consists of multiple expressions applicable to any of the fields or states
supported by the respective analyzers.
Ruledefs are of the following types:
 Routing Ruledefs—Routing ruledefs are used to route packets to content analyzers. Routing ruledefs determine
which content analyzer to route the packet to when the protocol fields and/or protocol-states in ruledef
expression are true. Up to 256 ruledefs can be configured for routing.
 Charging Ruledefs—Charging ruledefs are used to specify what action to take based on the analysis done by
the content analyzers. Actions can include redirection, charge value, and billing record emission. Up to 2048
charging ruledefs can be configured in the system.
 Post-processing Ruledefs—Used for post-processing purposes. Enables processing of packets even if the rule
matching for them has been disabled.
Important:
system considers the ruledef as a charging ruledef.
Ruledefs support a priority configuration to specify the order in which the ruledefs are examined and applied to packets.
The names of the ruledefs must be unique across the service or globally. A ruledef can be used across multiple
rulebases.
Important:
the charging actions are applied. The ruledef with the lowest priority number invokes first. For routing ruledefs, it is
important that lower level analyzers (such as the TCP analyzer) be invoked prior to the related analyzers in the next
level (such as HTTP analyzer and S-HTTP analyzers), as the next level of analyzers may require access to resources or
information from the lower level. Priorities are also important for charging ruledefs as the action defined in the first
matched charging rule apply to the packet and ECS subsystem disregards the rest of the charging ruledefs.
Each ruledef can be used across multiple rulebases, and up to 2048 ruledefs can be defined in a charging service.
In 14.1 and earlier releases, a maximum of 10 rule expressions (rule-lines) can be added in one ruledef.
In 15.0 and later releases, a maximum of 32 rule expressions (rule-lines) can be added in one ruledef.
Ruledefs have an expression part, which matches specific packets based upon analyzer field variables. This is a boolean
(analyzer_field operator value) expression that tests for analyzer field values.
The following is an example of a ruledef to match packets:
–or–
In the following example the ruledef named "rule-for-http" routes packets to the HTTP analyzer:
When a ruledef is created, if the rule-application is not specified for the ruledef, by default the
Ruledef priorities control the flow of the packets through the analyzers and control the order in which
http url contains cnn.com
http any-match = TRUE
route priority 50 ruledef rule-for-http analyzer http
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
Basic Features and Functionality ▀
17