{{tag>Services}}
====== Service management. Named service profiles ======
{{indexmenu_n>3}}
Service profiles are created, modified, and deleted using the ''fdpi_ctrl'' utility. \\
Services are divided into three types:
* **Without a profile** — the service settings are described in the DPI configuration or do not require a description, for example, Service 9 (billing NetFlow/RADIUS Accounting export)
* **Anonymous (unnamed) profiles** — the service is not created in advance; its parameters are specified when the service is assigned to a subscriber in JSON format
* **Named profiles** — the service is created before being assigned to a subscriber and is stored in the internal DPI database — [[en:dpi:dpi_components:platform:dpi_admin:admin_db|]]
**Named profiles** have the following advantages over anonymous profiles:
- Simplify subscriber administration
- Allow finding subscribers with a required profile by profile name
- Allow updating the profile for all subscribers using a given profile simply by changing the profile parameters
- Allow controlling the limit on the number of unique profiles (maximum 65535)
**Anonymous (unnamed) profiles**, in turn, have the following advantages:
- No profile management is required (there is no need to create or delete profiles); the profile is automatically removed when the subscriber or the subscriber's profile is deleted
- No profile name needs to be invented
===== Command syntax =====
General command format:
fdpi_ctrl command --service service_identifier [IP_list] [LOGIN_list]
Command parameter description:
^ Parameter ^ Description, possible values, and format ^ Note ^
| ''command'' | Values:\\ 1. ''load'' — load data\\ 2. ''del'' — delete. For ''--service'', ''service_identifier'' must be specified\\ 3. ''list'' — display information for the specified ''IP_list'' or all information if the ''all'' argument is specified. | In the ''list'' and ''del'' commands, ''all'' can be specified instead of an IP/LOGIN list, meaning the command is applied to all entries. |
| ''service_identifier'' | Numeric ID corresponding to a service from the [[en:dpi:dpi_components:platform:subscriber_management:subsman_cmd#list_of_services|list]] | |
| ''IP_list'' | Values:\\ 1. ''--file'' — file containing a list of IP addresses\\ 2. ''--ip'' — single IP address, format: ''192.168.0.1''\\ 3. ''--ip_range'' — IP address range (inclusive), format: ''192.168.0.1-192.168.0.5''\\ 4. ''--cidr'' — CIDR notation, format: ''192.168.0.0/30, 5.200.43.0/24~'' (CIDR notation with excluded boundary addresses) | The first and last addresses can be excluded from a CIDR range (according to classless addressing conventions, these are the gateway and broadcast addresses) by adding the ''~'' character to the end of the CIDR definition, for example: ''--cidr 5.200.43.0/24~'' |
| ''LOGIN_list'' | Values:\\ 1. ''--file'' — file containing a list of logins\\ 2. ''--login'' — single login, format: USER1, "FIRST_NAME LAST_NAME" (login specified with escaped special characters) | "USER1" — login specified in double quotes\\ 'USER2' — login specified in single quotes |
A line beginning with the ''#'' character is treated as a comment.
=====Service list=====
When blocking services (4, 16, 49) are activated, only TCP traffic is blocked. To block UDP traffic as well, [[en:dpi:dpi_components:platform:subscriber_management:subsman_cmd#tcp_and_udp_protocol_blocking_configuration|enable]] the ''[[en:dpi:dpi_components:platform:subscriber_management:subsman_cmd#tcp_and_udp_protocol_blocking_configuration|udp_block]]'' parameter.
^ ID ^ Brief description ^ Link to detailed description ^
| 1 | bonus program | [[en:dpi:dpi_options:opt_cosmobonus:bonus_mgmt|Description]] |
| 2 | advertising | [[en:dpi:dpi_options:opt_advertising:ads_mgmt|Description]] |
| 3 | ad blocking | [[en:dpi:dpi_options:opt_advertising:ads_mgmt|Description]] |
| 4 | blacklist filtering | [[en:dpi:dpi_options:opt_filtration:filtration_ctrl#service_filtering_management_at_the_subscriber_level_-_subscriber_management|Description]] |
| 5 | whitelist and Captive Portal | [[en:dpi:dpi_options:opt_capture:capt_mgmt#default_profile_management_for_service_5|Description]] |
| 6 | notification via HTTP redirect | [[en:dpi:dpi_components:platform:subscriber_management:subsman_cmd#service_management_commands|Description]] |
| 7 | caching | [[en:dpi:dpi_options:opt_cache:cache_ctrl|Description]] |
| 8 | DDoS protection passed | [[en:dpi:dpi_options:opt_ddos:ssg_ddos:ddos_ddos:ddos_ddos_settings|Description]] |
| 9 | RADIUS accounting / NetFlow statistics collection for billing | [[en:dpi:bras_bng:radius_integration:radius_accounting|Description]] |
| 10 | DDoS protection | [[en:dpi:dpi_options:opt_ddos:ddos_ctrl|Description]] |
| 11 | CGNAT and NAT 1:1 | [[en:dpi:opt_cgnat|Description]] |
| 12 | PCAP traffic recording | [[en:dpi:dpi_components:platform:li_ctrl#pcap_recording_management|Description]] |
| 13 | mini Firewall | [[en:dpi:dpi_options:opt_firewall|Description]] |
| 14 | traffic diversion to a TAP interface | [[en:dpi:dpi_options:dpi_divert_spec|Description]] |
| 15 | special subscriber (all traffic is assigned to cs0; filtering (Service 4) is not applied for the vChannel and the common channel) | [[en:dpi:dpi_options:opt_bandwidth_mgmt:vipsub|Description]] |
| 16 | whitelist and redirection to the Captive Portal without Internet access | [[en:dpi:dpi_options:opt_capture:capt_mgmt#named_profile_management_for_service_16|Description]] |
| 17 | traffic mirroring to the specified VLAN | [[en:dpi:dpi_components:platform:li_ctrl#vlan_mirroring|Description]] |
| 18 | session policing for specific protocols and traffic class identification at the channel and subscriber levels | [[en:dpi:dpi_options:opt_shaping:shaping_session|Description]] |
| 19 | DNS response substitution; planned: redirecting DNS queries to the provider's DNS server | [[en:dpi:dpi_options:dns_substitution|Description]] |
| 49 | IPv6 traffic blocking | [[en:dpi:dpi_options:opt_filtration:filtration_ctrl#ipv6_traffic_blocking_service_activation|Description]] |
| 50 | marketing campaign participant with notification via HTTP redirect | [[en:dpi:dpi_components:dpiui:user_guide:ssg_control_section:ad_campaign_management|Description]] |
| 51 | reserved (internal service) | |
| 254 | VRF | [[en:dpi:dpi_components:router#subscriber_vrf_management|Description]] |
====== Creating, enabling, and disabling services ======
Profile names are unique within each service. For example, ''profile_name_1'' for Service 4 (blacklist) is different from ''profile_name_1'' for Service 5 (whitelist).
Creating a named profile for Service 6 (one-time redirect), operator news notification, and assigning this service with the profile to a subscriber:
fdpi_ctrl load profile --service 6 --profile.name redir_to_news --profile.json '{ "redirect" : "http://mysite.com/ips_news", "check" : true }'
fdpi_ctrl load --service 6 --profile.name redir_to_news --ip 192.168.0.1
fdpi_ctrl load --service 6 --profile.name redir_to_news --login test
[[en:dpi:dpi_components:platform:subscriber_management:subsman_res|]]
Assigning Service 6 without a profile (the service parameters are taken from the DPI configuration file):
fdpi_ctrl load --service 6 --ip 192.168.0.1
fdpi_ctrl load --service 6 --login test
Assigning Service 6 with an anonymous profile (an unnamed profile that exists until the service is disabled for the subscriber):
fdpi_ctrl load --service 6 --profile.json '{ "redirect" : "http://mysite.com/ips_news", "check" : true }' --ip 192.168.0.1
fdpi_ctrl load --service 6 --profile.json '{ "redirect" : "http://mysite.com/ips_news", "check" : true }' --login test
Disabling Service 6 for a specific subscriber:
fdpi_ctrl del --service 6 --ip 192.168.0.1
fdpi_ctrl del --service 6 --login test
====== Service management commands ======
Get a list of all subscribers with Service 6 enabled:
fdpi_ctrl list all --service 6
Find subscribers with Service 6 assigned using a specific named profile:
fdpi_ctrl list all --service 6 --profile.name redir_to_news
Get information for a specific IP address for Service 6:
fdpi_ctrl list --service 6 --ip 192.168.0.1
Delete a named profile (the profile must not be assigned to any subscribers before deletion):
fdpi_ctrl del profile --service 6 --profile.name redir_to_news
Modify the settings of a service with a named profile (the new settings will be applied to all subscribers using the specified service profile):
fdpi_ctrl load profile --service 6 --profile.name redir_to_news --profile.json '{ "redirect" : "http://mysite.com/ips_news_new", "check" : true }'
Display all created profiles for all services:
fdpi_ctrl list all profile --service
When specifying an IP list, multiple options can be used simultaneously: ''--file'', ''--ip'', ''--ip_range'', ''--cidr'':
fdpi_ctrl list --service 6 --ip 192.168.0.1 --ip 192.168.0.2 --file fip_1.txt --ip_range 192.168.0.3-192.168.0.6 --login USER1
The operation will be applied to all specified entries for which no error occurred.
:!: If an error occurs, previously applied changes are **not** rolled back!
[[en:dpi:dpi_components:platform:dpi_admin:tcp_udp|]]