PCC rule actions

A PCC rule is a unidirectional set of IP flows sharing a same set of actions. IPv4 and IPv6 flows can be combined within the same PCC rule.

A PCC rule name must be unique for each rule applied on a single PPPoE or IPoE session. For optimal PCC rule sharing, it is recommended that the same PCC rule name be used when its content is the same (that is, the same set of flows and same set of actions).

An IP flow is identified by a combination of:

5-tuple (IPv4 or IPv6): src-ip, src-port, dst-ip, dst-ip, protocol, next-header
DSCP value

The CLI equivalent is:

 match protocol | next-header <protocol>
        src-ip <ip-address>
        dst-ip <ip-address>
        src-port eq <port> | range <start-port> <end-port>
        dst-port eq <port> | range <start-port> <end-port>
        dscp <dscp>
    exit

Supported actions include forward, drop, redirect to ip next hop, redirect to a routing instance, HTTP redirect, forwarding class change, rate-limit, and account.

With a specified set of actions, PCC rules are instantiated in the SR OS by IP criteria or IPv6 criteria entries in SAP ingress or SAP egress QoS polices and in IP or IPv6 filter entries. A PCC rule precedence value determines the relative order of different PCC rules when inserted in the QoS or filter policy: a rule with a lower precedence value is be applied before a rule with a higher precedence value. Rules with the same precedence can be automatically optimized; the relative order in which they are applied is determined by the system for optimal sharing. Rules with no precedence are applied at the end and are also automatically optimized.

Table: Subscriber service PCC rule actions resulting in QoS policy changes and Table: Subscriber service PCC rule actions resulting in filter changes provide an overview of the PCC rule actions and where they apply.

Table: Subscriber service PCC rule actions resulting in QoS policy changes
Action	Direction	Description
Forwarding Class (FC) change	Ingress/Egress	changes the QoS forwarding class CLI equivalent: `config>qos sap-ingress \| sap-egress <id> create ip-criteria \| ipv6-criteria entry <id> create match <5-tuple \| dscp> exit action fc <fc> exit exit`
Rate-limit (PIR/CIR)	Ingress/Egress	rate-limit traffic matching the specified flows spawn a dynamic policer per direction (if not already present) set the PIR/CIR value of the dynamic policer map the flows to the policer The forwarded octets and packets statistics of the dynamic policer are included in subscriber service accounting. CLI equivalent: `config>qos sap-ingress \| sap-egress <id> create policer 1 # dynamic police rate <pir> cir <cir> exit ip-criteria \| ipv6-criteria entry <id> create match <5-tuple \| dscp> exit action policer 1 exit exit`
Account	Ingress / Egress	counts traffic matching the specified flows: spawn a dynamic policer per direction (if not already present) if no rate-limit action is specified in the PCC rule, set the PIR/CIR value of the dynamic policer to max map the flows to the policer The forwarded octets and packets statistics of the dynamic policer are included in subscriber service accounting. CLI equivalent: `config>qos sap-ingress \| sap-egress <id> create policer 1 # dynamic policer rate max cir max exit ip-criteria \| ipv6-criteria entry <id> create match <5-tuple \| dscp> exit action policer 1 exit exit`
Forward	Ingress/Egress	Creates an entry in the QoS policy to forward the traffic without explicit QoS action. Matching traffic does not match on the next entry (match and exit behavior). In case of overlapping flows, such as account all traffic except flow 1 and flow 2, the more specific flows must be explicitly forwarded. CLI equivalent: `config>qos sap-ingress \| sap-egress <id> create ip-criteria \| ipv6-criteria entry <id> create match <5-tuple \| dscp> exit action exit exit`

Table: Subscriber service PCC rule actions resulting in filter changes
Action	Direction	Description
Forward/Drop	Ingress/Egress	Creates a filter entry to forward or drop the traffic CLI equivalent: `config>filter ip-filter \| ipv6-filter <id> create entry <id> create match <5-tuple \| dscp> exit action forward \| drop exit exit exit`
Redirect to an IP next-hop	Ingress	redirect the traffic to the specified IP next-hop CLI equivalent: `config>filter ip-filter \| ipv6-filter <id> create entry <id> create match <5-tuple \| dscp> exit action forward next-hop <ip-address> exit exit exit`
Redirect to a routing instance	Ingress	redirect the traffic to the specified routing instance CLI equivalent: `config>filter ip-filter \| ipv6-filter <id> create entry <id> create match <5-tuple \| dscp> exit action forward router <router-instance> exit exit exit`
HTTP redirect	Ingress	HTTP redirection to the specified URL CLI equivalent: `config>filter ip-filter \| ipv6-filter <id> create entry <id> create match <5-tuple \| dscp> exit action http-redirect <rdr-url-string> exit exit exit`

Figure: Supported combinations of ingress PCC rule actions and Figure: Supported combinations of egress PCC rule actions show the actions that can be combined in a single ingress or egress PCC rule.

Figure: Supported combinations of ingress PCC rule actions

Figure: Supported combinations of egress PCC rule actions

Note:

Consider the following rules:

The Flow Status can only be set by Gx.

For RADIUS subscriber service-based PCC rules, the Flow Status is fixed to Enabled.
The filter action forward is ignored (not installed) when combined with the following filter actions: redirect next-hop, redirect router, or http-redirect.
The QoS action forward is ignored (not installed) when combined with the following QoS actions: rate-limit, FC change, account/Usage Monitoring (UM).
When the QoS action rate-limit and QoS action account or Usage Monitoring (UM) are combined, only a single dynamic policer is installed, which is used for both rate-limiting and obtaining forward statistics for accounting or usage monitoring.