Content Filtering Server Group Support; In-Line Content Filtering Support; Dns Snooping - Cisco ASR 5000 Series Administration Manual

Enhanced Charging Service Overview

Content Filtering Server Group Support

ECS supports external Content Filtering servers through Internet Content Adaptation Protocol (ICAP) implementation
between ICAP client and Active Content Filter (ACF) server (ICAP server).
ICAP is a protocol designed to support dynamic content filtering and/or content insertion and/or modification of Web
pages. Designed for flexibility, ICAP allows bearer plane nodes such as firewalls, routers, or systems running ECS to
interface with external content servers such as parental control (content filtering) servers to provide content filtering
service support.

In-line Content Filtering Support

Content Filtering is a fully integrated, subscriber-aware in-line service available for 3GPP and 3GPP2 networks to filter
HTTP and WAP requests from mobile subscribers based on the URLs in the requests. This enables operators to filter
and control the content that an individual subscriber can access, so that subscribers are inadvertently not exposed to
universally unacceptable content and/or content inappropriate as per the subscribers' preferences. Content Filtering uses
Deep Packet Inspection (DPI) capabilities of ECS to discern HTTP and WAP requests.
Important:
Administration Guide.

DNS Snooping

This section provides an overview of the DNS Snooping feature.
Important:
ECS, using L7 rules, can be configured to filter subscriber traffic based on domain name. While this works fine for
HTTP-based traffic, a subscriber's initial HTTP request may result in additional flows being established that use
protocols other than HTTP and/or may be encrypted. Also, a domain may be served by multiple servers, each with its
own IP address. This means that using an IP rule instead of an HTTP rule will result in multiple IP rules, one for each
server "behind" the domain. This necessitates service providers to maintain a list of IP addresses for domain-based
filters.
The DNS Snooping feature enables a set of IP rules to be installed based on the response from a DNS query. The rule in
this case contains a fully qualified domain name (for example, m.google.com) or its segment (for example, google) and
a switch that causes the domain to be resolved to a set of IP addresses. The rules installed are thus IP rules. Any actions
specified in the domain rule are inherited by the resulting IP rules.
When configured, DNS snooping is done on live traffic for every subscriber.
The DNS Snooping feature enables operators to create ruledefs specifying domain names or their segments. On defining
the ruledefs, the gateway will monitor all the DNS responses sent towards the UE, and snoop only the DNS response
that has q-name or a-name as specified in the rules, and identify all the IP addresses resulting from the DNS response. A
table of these IP addresses is maintained per destination context per rulebase per instance and shared across subscribers
of the same destination context same rulebase per instance. In case DNS queries made by different subscribers produce
different results, all the IP entries in the table are stored based on their Time to Live (TTL) and the configurable timer.
The TTL or the timer whichever is greater is used for aging out the IP entry. Dynamic IP rules are created for these IP
entries within the same rule having the domain name, applying the same charging action to these dynamic rules. This
solution will have the exact IP entries as obtained live from snooping DNS responses. They will be geographically and
TTL correct.
For more information on Content Filtering support, refer to the Content Filtering Services
In the 12.2 release, the DNS Snooping feature is supported only on the GGSN and P-GW.
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
Enhanced Features and Functionality ▀
37