Cisco ASR 5000 Series Administration Manual page 57

Enhanced Charging Service Overview
checksum is automatically done irrespective of whether the CLI command is configured or not. If the
checksum validation fails, the packet is not processed further and so it does not go for application layer
analysis.
 TCP Reset Packet Validation: Without TCP Proxy TCP reset packet is not validated for Seq and ACK number
present in the segment and the flow is cleared immediately.
With TCP Proxy TCP Reset packet validation is done. The flow will be cleared only if a valid TCP Reset
segment is arrived. This validation is not configurable.
 TCP Timestamp (PAWS) Validation: Without TCP Proxy timestamp verification is not performed and even if
there is any timestamp error, the packet is processed normally and goes for further analysis and rule-matching.
With TCP Proxy if the connection is in established state, timestamp validation for packets is performed. If TCP
timestamp is less than the previous timestamp, the packet is marked TCP error packet and is dropped. The
packet is not analyzed further and not forwarded ahead. This packet should match TCP error rule (if
configured). This validation is not configurable.
 TCP Error Packets: Without TCP Proxy ECS being a passive entity, most of the errors (unless configured
otherwise) were ignored while parsing packets at TCP analyzer and were allowed to pass through. With TCP
Proxy TCP error packets are dropped by Gi and Gn side TCP IP stack. However, since the ECS processing is
already done before giving the packet to the stack, these packets are charged but not sent out by proxy on the
other end.
 Policy Server Interaction (Gx): With TCP Proxy, application of policy function occurs on two separate TCP
connections (non-proxy processed packets on Gn/Gi). Only external packets (the ones received from Radio and
Internet) will be subject to policy enforcement at the box. This does not have any functional impact.
 Credit Control Interaction (Gy): With TCP Proxy, application of Credit Control function occur on two separate
TCP connections (non-proxy processed packets on Gn/Gi). Only external packets (the ones received from
Radio and Internet) will be subject to credit control at the box. This does not have any functional impact.
 DPI Analyzer: With TCP Proxy, application of DPI analyzer occurs on two separate TCP connections (non-
proxy processed packets on Gn/Gi). Only external packets (the ones received from Radio and Internet) will be
subject to DPI analyzer at the chassis. Any passive analyzer in the path would be buffering packet using the
existing ECS infrastructure.
 ITC/BW Control: With TCP Proxy, only incoming traffic is dropped based on bandwidth calculation on ingress
side packets. The BW calculation and dropping of packet is be done before sending packet to ingress TCP IP
Stack. ToS and DSCP marking will be on flow level. The ToS and DSCP marking can be done only once for
whole flow and once the ToS is marked for any packet either due to "ip tos" CLI command configured in the
charging action or due to ITC/BW control, it will remain same for the whole flow.
 Next Hop and VLAN-ID: Without TCP Proxy nexthop feature is supported per packet, that is nexthop address
can be changed for each and every packet of the flow depending on the configuration in the charging action.
With TCP Proxy only flow-level next-hop will be supported. So, once the nexthop address is changed for any
packet of the flow, it will remain same for the complete flow. The same is the case for VLAN-ID.
 TCP state based rules: Without TCP Proxy there is only one TCP connection for a flow and the TCP state based
rules match to state of subscriber stack. With TCP Proxy there are two separate connections when TCP proxy
is enabled. TCP state ("tcp state" and "tcp previous-state") based rules will match to MS state on egress side.
Two new rules (tcp proxy-state and tcp proxy-prev-state) have been added to support the existing cases (of
TCP state based rules). "tcp proxy-state" and "tcp proxy-prev-state" are the state of the embedded proxy server,
that is the proxy ingress-side. These rules will not be applicable if proxy is not enabled.
Using both "tcp state" and "tcp proxy-state" in the same ruledef is allowed. If proxy is enabled, they would map
to Gi-side and Gn-side, respectively. If TCP Proxy is not enabled, the "tcp proxy-state" and "tcp proxy-prev-
state" rules will not be matched because proxy-state will not be applicable.
Cisco ASR 5x00 Enhanced Charging Services Administration Guide ▄
Enhanced Features and Functionality ▀
57