| Both sides previous revisionPrevious revision | |
| en:dpi:dpi_components:platform:subscriber_management:subsman_common [2024/09/26 15:29] – external edit 127.0.0.1 | en:dpi:dpi_components:platform:subscriber_management:subsman_common [2026/06/29 09:41] (current) – elena.krasnobryzh |
|---|
| ====== General description ====== | ====== DPI management configuration. Integration using the PUSH method ====== |
| {{indexmenu_n>1}} | {{indexmenu_n>1}} |
| Subscriber Management (SM) allows to enable services, to control the available bandwidth and apply other actions on level of individual operator's subscribers. | |
| |
| DPI platform identifies subscribers by their IP address as there is no other information in IP packet. Therefore, in case of dynamic IP addresses' assignment, one should integrate DPI with the addresses assignment node. The latest can be Radius, DHCP, BRAS. Alternatively one can use Radius events monitor. | Subscriber Management (SM) allows you to assign services, manage bandwidth limits (policing), and perform other actions for individual subscribers. |
| |
| In order to send commands to DPI SM creates TCP link with DPI via its control port. Therefore one has to enable external access by control port on the firewall. However it is advised to run SM on the DPI platform itself. SM is configures to communicate with DPI via IO interface by default. | SSG DPI identifies subscribers by their IP addresses, since no other subscriber information is present in IP packets. Therefore, if IP addresses are assigned dynamically, integration with the IP address assignment system (RADIUS or DHCP) is required, or the [[en:dpi:dpi_components:radius|]] component must be installed. |
| |
| You have to [[en:dpi:dpi_components:platform:dpi_admin:admin_db#Activating the built-in database|activate the built-in database]] in order to preserve subscribers' profiles configuration upon restarts of the platform. Alternatively you can place the initialization scripts into /etc/dpi/init.d/ directory - (similarly to a common Linux method to control shapers and boot processes). The latest method has some advantages. It may be a suitable solution for fast migration from Linux/FreeBSD or hardware shapers with no own database. | Integration between the DPI platform and the billing system using the PUSH model assumes that the billing system (or an auxiliary system) independently sends information about the subscriber's assigned services and policing settings to the DPI before those settings are actually applied. The transmitted data is stored in the built-in UDR database and remains active immediately after a system reboot. |
| |
| | <note tip>It is recommended to use the PULL integration method (via the RADIUS protocol). Product: [[en:dpi:bras_bng|]].</note> |
| | |
| | To restore subscriber profile settings after a platform restart, you must [[en:dpi:dpi_components:platform:dpi_admin:admin_db#enabling_the_built-in_database|enable the built-in database]] or place initialization scripts in the ''/etc/dpi/init.d/'' directory (similar to the standard Linux approach for managing traffic shapers or the boot process). The latter option has its own advantages and may be suitable for rapid migration from Linux/FreeBSD or hardware traffic shapers without their own database. |
| | |
| | Common scenarios for preparing profiles used for financial blocking are described in the article [[en:dpi:dpi_options:use_cases:qs_rateplans|]]. |
| | |
| | **The ''fdpi_ctrl'' utility is a high-performance API for DPI management.\\ |
| | Example: assigning a tariff plan (policing settings) to 30,000 subscribers takes less than one second:** |
| | <code bash> |
| | time fdpi_ctrl load --policing rate_10M.cfg --file subsribers.lst |
| | Result processing file 'subsribers.lst' : 30000/30000/0/0/0 |
| | real 0m0.344s |
| | user 0m0.009s |
| | sys 0m0.144s |
| | </code> |
| | |
| | ===== Running commands remotely over SSH ===== |
| | |
| | To execute commands on the DPI server remotely via SSH without entering a password, it is recommended to use public key authentication. |
| | |
| | On the management server, perform the following steps: |
| | - Create a public/private key pair: <code bash>ssh-keygen -t rsa</code> Accept the default values in the dialog. For convenience, leave the passphrase empty((Or use ''ssh-agent'' to store passphrases.)) |
| | - Copy the public key to the DPI server using: <code bash>ssh-copy-id dpi_user@dpi_host</code> or manually: <code bash>cat ~/.ssh/id_rsa.pub | ssh dpi_user@dpi_host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"</code> |
| | - On the DPI server, verify and correct the permissions of the ''authorized_keys'' file: <code bash>chmod 700 ~dpi_user/.ssh/ |
| | chmod 600 ~dpi_user/.ssh/authorized_keys |
| | restorecon -Rv ~dpi_user/.ssh/</code> |
| | - Verify that ''fdpi_ctrl'' can be executed remotely from the management server: <code bash>ssh dpi_user@dpi_host "fdpi_ctrl load --service 6 --login test"</code> If execution fails, check the ''/var/log/secure'' log on the DPI server and enable SSH diagnostic mode using ''ssh -v ...''. |
| | |
| | ===== Running the fdpi_ctrl utility remotely ===== |
| | |
| | Commands are transmitted to the DPI over a TCP connection through the management port. Therefore, the firewall must allow external access to the management port. |
| | |
| | To enable the DPI platform to accept management commands, configure the following parameters in ''/etc/dpi/fastdpi.conf'': |
| | - Listening port number: <code bash>ctrl_port=29000</code> |
| | - Network interface name. By default, DPI listens only on the loopback interface: <code bash>ctrl_dev=eth0</code> |
| | |
| | To run the ''fdpi_ctrl'' utility remotely: |
| | - In the DPI configuration file ''/etc/dpi/fastdpi.conf'', enable listening on a management interface accessible from external hosts: <code bash>ctrl_dev=eth0</code> |
| | - In the firewall configuration ''/etc/sysconfig/iptables'', allow access to the port specified by ''ctrl_port'' and restrict access to the DPI host so that only the management server is permitted: <code bash>-A INPUT -m state --state NEW -m tcp -s 192.168.0.2 -p tcp --dport 29000 -j ACCEPT</code> |
| | - Copy the ''fdpi_ctrl'' utility to the management server and run it with the ''-r host:port'' argument: <code bash>fdpi_ctrl load --service 6 --login test -r 192.168.0.1:29000</code> |
| | |
| | <note important>Whenever the DPI version is updated, the ''fdpi_ctrl'' utility on the management server must also be updated.</note> |
