Configuring the SDX Software for DPI Integration

[Contents] [Prev] [Next] [Index] [Report an Error] [No Frames]

SDX 6.4.x Application Library Guide > Providing Application-Level Session Tracking and QoS Control > Configuring the SDX Software for DPI Integration
Configuring the SDX Software for DPI Integration
To set up the SDX software for the DPI solution, perform the following tasks:

Setting Up Script Services for DPI

Configuring a Virtual Router Object for DPI

Configuring Subscriptions to DPI Services

Setting Up Script Services for DPI

Every subscriber must have at least one DPI script service active during subscriber login. This DPI script service corresponds to a service bundle in the SLE that provides the default policy for processing subscriber traffic. To match the service bundle with the script service, the service bundle must have the same name as the DPI script service and be prefixed by SDX_. For example, if the script service is called dpiService1, the service bundle must be called SDX_dpiService1.

You can create a service scope to hold your script services. Putting a script service in a service scope allows the service to be used in different regions of the network. (See Configuring a Virtual Router Object for DPI for more information.) The DPI sample data contains a service scope called DPI. You can model your script services after the sample data.

After you configure a service scope, you need to configure script services for the scope and configure parameters for the script service. For more information about configuring service scopes, script services, and parameters, see SDX Services and Policies Guide, Chapter 1, Managing Services.

Adding a Service Scope

To add a service scope:

In the SDX Admin navigation pane, right-click on Scopes, highlight New, and then select Service Scope.

The New Service Scope dialog box appears.

Enter a name for the service scope, and click OK.

An object for the new service scope appears in the navigation pane, and the new service scope appears in the Main tab of the Service Scope pane.
Optionally, configure a precedence for the service scope.

Creating a DPI Script Service

To create a script service within the service scope:
In the SDX Admin navigation pane, right-click the Scopes folder, highlight New, and then click SSP service.

In the New SSP Service dialog box, enter a service name or select a name from the drop-down list.

In the Main tab pane, select script in the Type field.
Click the Script tab.
The Script tab appears in the content pane.
Fill in the fields as described below.

Script Type

Type of script that the script service uses.

Value—You must use URL for DPI script services

Default—No value

Class Name

Name of the class that implements the ScriptService SPI. The SAE instantiates this class when it starts the script service.

Value—You must enter net.juniper.smgt.dpi.sle.EllacoyaScriptService for DPI script services

Default—No value

File/URL

URL to the Java archive (JAR) files that are associated with the script.

Value—For a DPI script service, you must include all of the following JAR files.

file:///opt/UMC/sae/var/scriptservice/dpi/lib/dpi-ss.jar,

file:///opt/UMC/sae/var/scriptservice/dpi/lib/sle-client.jar,

file:///opt/UMC/sae/var/scriptservice/dpi/lib/jbossall-client.jar,

file:///opt/UMC/sae/var/scriptservice/dpi/lib/jdom.jar,

file:///opt/UMC/sae/var/scriptservice/dpi/lib/jnet.jar,

file:///opt/UMC/sae/var/scriptservice/dpi/lib/log4j.jar

NOTE: All JAR files except dpi-ss.jar are Ellacoya SLE files, and must be compatible with the version of the SLE that is being used. Check the release notes for the version of the SLE that the JAR files packaged with the SDX software are from. If in doubt, replace the JAR files from the SLE installation, which can be found in <SLE install dir>/lib (for example: /opt/ellacoya/lib).

Default—No value

Configuring the Script Service

To configure the script service, you provide parameter substitutions with the values of the configuration parameters that are in the service definitions. To do so:
In SDX Admin, select the Parameter tab in the script service configuration. The parameter pane appears.
Configure all the parameters listed in Table 28.
 Table 28:  Parameter Definitions for DPI Services  

 Parameter Name
 Description

 dpi_sle_connection_servers

 IP address or hostname of the Ellacoya SLE server.
 If there is more than one server, separate entries with a comma. Enter the SLE addresses in priority order, with the primary server first. When the script service makes a connection to an SLE, it tries the addresses in the order that you entered them until it succeeds in connecting. 
 If the connection is broken, the script service attempts to connect again, beginning with the first address in the list. Once the script connects to an SLE, it does not test the connection to the primary server and fail back to the primary server if the server recovers from a failure.


 dpi_sle_subscriber_nameattr

 Attribute that is used to identify a subscriber. This parameter instructs the SLE how to identify the subscriber. Usually subscribers are identified by their login name. You can also use the MAC address, primary user, NAS-Port ID, or interface name. The values for the parameter definition are:

   loginname
   primaryusername
   macaddr
   interfacename
   nasportid



 dpi_sle_subscriber_ipv6supported

 Specifies whether or not IPv6 is supported for the DPI service. Must currently be false because IPv6 is not supported on Ellacoya systems.


 dpi_sle_connection_domainName

 Name of the domain that contains the service bundles for this service. The Ellacoya software configures service bundles by domain. This parameter value should match the domain that is configured in the Ellacoya Service Creation Manager. 


 dpi_sle_connection_username

 Name used for authentication with the SLE. It must match the username that is configured in the Ellacoya Service Creation Manager.


 dpi_sle_connection_password

 Password used for authentication with the SLE. 


 dpi_sle_accountingmgr_storesize

 Size limit of usage and accounting data that is stored. (A script services loads usage data from the SLE.) All script services in a virtual router share the same store.
 When the SAE requests usage data more slowly than the script service loads it from the SLE, the data accumulates in the store. When the store is filled, the script service suspends loading usage data from the SLE. However, as the SAE requests usage data, space in the store is freed, allowing the script service to resume loading data from the SLE.


 dpi_sle_activate_inoneshot

 The values for the parameter are true or false. The default value is true. 
 If true, when a DPI script service is activated as an AOL subscription during subscriber login, the script service finds all AOL subscriptions and persistent sessions of the subscriber. The script service assumes that the SAE will activate all the subscriptions and sessions, and it starts an SLE subscriber session with a service offer that corresponds to the combination of the AOL subscriptions and persistent sessions. 
 This optimization avoids repeatedly changing the subscriber's service offer while multiple AOL subscription or persistent sessions are activated one by one. 
 Set this parameter to false if an AOL subscription or persistent session is not guaranteed to be activated during subscriber login; for example, an authorization plug-in or mutex group could prevent the activation of the services. 


 dpi_sle_subscriber_prefix

 Set this parameter to match the subscriber prefix configured in the SLE. The DPI script service adds this prefix to subscriber IDs used in SLE subscriber sessions that the DPI script service starts. 
 The default value is BBIP, which is also the default value used in the SLE. You can change the SLE subscriber prefix in the SubscriberPrefix field in the Accounting Service window of the SLE Configuration Console. 



 
Configuring a Virtual Router Object for DPI

You must create a virtual router object in the router to which the subscriber logs in, and attach the DPI service scope to the virtual router.

Each time a DPI script service is invoked by an activation, deactivation, or interim accounting request, the script service checks the service involved to see if the configuration in the service's parameter substitutions is different or newer than the parameters in the script service's configuration. If so, the script service instance updates its configuration according to the service. This functionality means you can change the configuration of the script service by updating the parameter substitutions in the service.

If you want to use the same DPI configuration throughout your network, make sure that all DPI script services have the same configuration. If you have several SLEs in your network that are responsible for the traffic coming from different sets of routers, you must ensure that the DPI script service gets the appropriate configuration on a per router basis. You can accomplish this by putting the script services into a scope and attaching the scope to the router for an SLE. Every service in the scope must have the same configuration so that the correct SLE handles all subscribers on routers that use the scope.

To attach a service scope to a virtual router configuration, enter the name of the DPI service scope for the DPI in the Scope field of the virtual router configuration. See Figure 22. For more information, see SDX Network Guide: SAE, Juniper Networks Routers, and NIC, Chapter 3, Using JUNOSe Routers in the SDX Network or SDX Network Guide: SAE, Juniper Networks Routers, and NIC, Chapter 4, Using JUNOS Routing Platforms in the SDX Network.

Figure 22: Creating a Virtual Router for DPI
Configuring Subscriptions to DPI Services

As shown in the example in Figure 23, you need to configure subscriptions to the DPI services. You can set up the subscriptions to activate immediately on login.

For more information, see SDX Subscribers and Subscriptions Guide, Chapter 8, Configuring Subscribers and Subscriptions.

Figure 23: Configuring Subscribers and Subscriptions to DPI Services

Parameter Name	Description
dpi_sle_connection_servers	IP address or hostname of the Ellacoya SLE server. If there is more than one server, separate entries with a comma. Enter the SLE addresses in priority order, with the primary server first. When the script service makes a connection to an SLE, it tries the addresses in the order that you entered them until it succeeds in connecting. If the connection is broken, the script service attempts to connect again, beginning with the first address in the list. Once the script connects to an SLE, it does not test the connection to the primary server and fail back to the primary server if the server recovers from a failure.
dpi_sle_subscriber_nameattr	Attribute that is used to identify a subscriber. This parameter instructs the SLE how to identify the subscriber. Usually subscribers are identified by their login name. You can also use the MAC address, primary user, NAS-Port ID, or interface name. The values for the parameter definition are: loginname primaryusername macaddr interfacename nasportid
dpi_sle_subscriber_ipv6supported	Specifies whether or not IPv6 is supported for the DPI service. Must currently be false because IPv6 is not supported on Ellacoya systems.
dpi_sle_connection_domainName	Name of the domain that contains the service bundles for this service. The Ellacoya software configures service bundles by domain. This parameter value should match the domain that is configured in the Ellacoya Service Creation Manager.
dpi_sle_connection_username	Name used for authentication with the SLE. It must match the username that is configured in the Ellacoya Service Creation Manager.
dpi_sle_connection_password	Password used for authentication with the SLE.
dpi_sle_accountingmgr_storesize	Size limit of usage and accounting data that is stored. (A script services loads usage data from the SLE.) All script services in a virtual router share the same store. When the SAE requests usage data more slowly than the script service loads it from the SLE, the data accumulates in the store. When the store is filled, the script service suspends loading usage data from the SLE. However, as the SAE requests usage data, space in the store is freed, allowing the script service to resume loading data from the SLE.
dpi_sle_activate_inoneshot	The values for the parameter are true or false. The default value is true. If true, when a DPI script service is activated as an AOL subscription during subscriber login, the script service finds all AOL subscriptions and persistent sessions of the subscriber. The script service assumes that the SAE will activate all the subscriptions and sessions, and it starts an SLE subscriber session with a service offer that corresponds to the combination of the AOL subscriptions and persistent sessions. This optimization avoids repeatedly changing the subscriber's service offer while multiple AOL subscription or persistent sessions are activated one by one. Set this parameter to false if an AOL subscription or persistent session is not guaranteed to be activated during subscriber login; for example, an authorization plug-in or mutex group could prevent the activation of the services.
dpi_sle_subscriber_prefix	Set this parameter to match the subscriber prefix configured in the SLE. The DPI script service adds this prefix to subscriber IDs used in SLE subscriber sessions that the DPI script service starts. The default value is BBIP, which is also the default value used in the SLE. You can change the SLE subscriber prefix in the SubscriberPrefix field in the Accounting Service window of the SLE Configuration Console.

[Contents] [Prev] [Next] [Index] [Report an Error] [No Frames]