Overview
This overview provides general information about VTAs and specific information about Quota and Threshold VTAs available in the SDX application library. VTAs enable service providers to track the volume of data that subscribers upload and download. By tracking this information, service providers can respond to situations in which subscribers exceed their bandwidth limits. Typical responses include:
- Charging subscribers for bandwidth consumed
- Limiting the rate at which subscribers can transfer information in the future
The SDX application library includes two VTAs:
- Periodic and Bought Quota VTA (known as Quota VTA)
- Bandwidth Threshold Crossing VTA (known as Threshold VTA)
NOTE: You can use VTAs when subscribers can log into the network with the same username only once. Threshold VTA and Quota VTA do not support multiple logins with the same username.
Service providers can implement VTAs for both residential and enterprise subscribers. The VTAs support the use of several types of identifiers for subscribers; some identifiers are suitable applicable for residential subscribers and some for enterprise subscribers. Because the SDX software supports only enterprise subscribers via JUNOS routing platforms, you cannot use some identifiers with JUNOS routing platforms. The documentation explicitly states restrictions for specific types of routers.
Terminology
Table 56 provides a list of terms and corresponding definitions that are used in the VTA documentation.
Tracking and Billing
VTAs use accounts and sessions to manage VTA subscribers. A VTA account represents the resources available for a subscriber. The units of the account depend on the VTA and the way that you choose to measure resources.
VTAs track user activity through VTA sessions. A VTA session does not necessarily correspond to an individual subscriber session or service session. For example, for Quota VTA (see Quota VTA), a single service session can correspond to multiple VTA sessions if the service session covers multiple billing periods.
VTAs require use of a relational database to store information about accounts and sessions. The default database for VTAs is MySQL. To obtain MySQL, see http://www.mysql.com/. For information about other databases that we have tested for use with VTAs, see the SDX Application Library Release Notes. When you install the VTAs from the SDX application library CD, you can view the database schemas in the folder opt/UMC/conf/vta.
The suggested billing model for services managed by VTAs is one in which subscribers pay for services when they select them through a Web portal. We provide sample portals for Quota and Threshold VTAs (see Portals for Managing Subscribers' VTA Accounts).
VTA Architecture and Connections to SDX Components
Figure 45 shows the VTA architecture and the position of a VTA in the SDX network.
The VTA comprises a server and a client. The VTA server runs in a J2EE application server and comprises the following components:
The VTA client is the point of integration with the service provider's back office. The client can include Web portals that administrators can use to monitor and manage subscribers, and Web portals that subscribers can use to view and manage their accounts.
The VTA communicates with the SAE via the EJB adapter plug-in. This plug-in is an SAE plug-in and performs the following functions:
- Filters SAE plug-in events for VTAs.
- Adapts internal SAE events to EJB-compatible methods.
- Sends SAE tracking plug-in events to the VTAs.
The VTA communicates with other SDX network components via its server's components. The following sections describe the components of the VTA server and the VTA client.
VTA Core
The VTA core performs the following functions:
- Accepts events from the EJB adaptor plug-in and delivers them to the decision plug-in.
- Retrieves data from the configuration directory and provides it to other VTA components.
- Instantiates NIC proxies and makes them available to other VTA components if they need to locate the SAE that manages a subscriber.
Decision Plug-In
Each VTA requires its own decision plug-in. The decision plug-in uses events it receives from other components to calculate values that allow the VTA to track use of network resources and control subscribers' access to those resources. The way the decision plug-in processes the data depends on the formulae you define when you customize the VTA.
The decision plug-in has two interfaces: the SAE plug-in event listener and the data update event listener. The former interface receives SAE-tracking plug-in events, and the latter interface receives events about changes to VTA accounts and sessions from the VTA client.
Account and Session Data Manager
This component has two interfaces that it uses to interact with other components: a remote interface and a local interface. The account and session data manager performs the following functions via these interfaces:
- Via the remote interface and the local interface, receives information about changes to subscribers' accounts from the VTA client and updates changes in the database.
- Provides subscribers' VTA data to the VTA client via the remote interface.
- Generates events for the decision plug-in when VTA accounts and sessions change via the remote interface.
- Retrieves information from the VTA database via the local interface.
VTA Client Web Portals
For the Quota and Threshold VTA clients, we provide Web portals that you can use if subscribers connect to your SDX network via a JUNOSe router. These portals are simple to install, configure, and customize. For more information about the portals, see Portals for Managing Subscribers' VTA Accounts.
The sample portals run inside the J2EE application server and use the VTA core's NIC proxy and configuration manager, rather than their own NIC proxy configurations.
If you want to customize the portals to operate outside the VTA's J2EE application server, you must:
- Develop a way to connect them to the VTA's remote account and session manager interfaces.
- If the software automatically logs in subscribers with their current IP addresses (JUNOSe only), configure NIC proxies for the client (see Configuring NIC Proxies).
If subscribers connect to the network via a JUNOS routing platform or if subscribers connect to the network via a JUNOSe router and you prefer not to use the sample portals, you must develop an external VTA client that uses the sample portals to interact with the VTA server components. Your external client must send HTTP requests to the sample portals for the operations that administrators and subscribers can perform, and parse the responses from the sample portals. For advice on the best approach for your situation, contact Juniper Networks Professional Services.
Use of NICs with VTAs
If you want subscribers who connect to the network via a JUNOSe router to be able to log in to the network with their IP addresses, you must implement a NIC that maps the subscriber's IP address to the identifier that you use for subscribers in the VTA database. In particular, if you want to use the sample VTA portals we provide, you must implement this type of NIC. If you do not implement this NIC, you can provide another way for subscribers to log in, such as a central Web page where subscribers can enter their usernames and passwords.
For the Quota VTA, you can also use a NIC to allow the Quota VTA to immediately activate a subscriber's quota service when a deposit is made to the subscriber's account. This NIC must map the subscriber's identifier that you use for subscribers in the VTA database to the SAE reference. If you do not configure a NIC for this purpose or you use an identifier that the NIC cannot map to an SAE reference, subscribers must log out and log in again for the Quota VTA to be able to activate their quota services after deposits are made to their accounts.
VTA Operation
- When an event that activates a value-added service occurs (for example, a subscriber logs in), the SAE sends a session start event to the VTA via the SAE external plug-in interface.
- Optionally, the VTA collects information about the subscriber, subscriptions, and related services that it did not receive in the session start event.
- Optionally, the VTA queries a relational database for the subscriber's current set of sessions and accounts.
- Depending on the customization of the VTA, it may activate or deactivate services based on the subscriber's use of resources.
- The VTA tracks the subscriber's use of resources for a period of time.
- The VTA updates sessions and account balances in the database.
- The VTA sends to the SAE changes in the interim accounting interval and takes action to limit excessive bandwidth use or to allow increased bandwidth use.
- When an event that deactivates a value-added service occurs (for example, the subscriber logs out) the VTA updates the VTA session, closes the VTA session, and may update the account balances.
Figure 46 illustrates this process.
Events received via the remote interface can also cause the VTA to activate services, deactivate services, or change the accounting interval.
Identification of Subscribers, SAEs, and Sessions
VTAs must be able to identify each subscriber by a unique identifier, which depends on the way subscribers log in to the SDX network. VTAS use this information to manage:
You can configure VTAs to use various data keys to identify corresponding data values for these management tasks. The data keys depend on the subscriber's identifier and comprise one or more plug-in attributes.
Managing VTA Accounts and Sessions
Depending on the information that uniquely identifies subscribers in your SDX configuration, you can configure VTAs to use several types of plug-in attributes as data keys to identify accounts and sessions in the VTA database. If you use a NIC with the VTA client Web portals, the VTA can also use some of these plug-in attributes to construct a data key that the NIC can use to determine which SAE manages a subscriber. When the NIC identifies an SAE, the VTA can also obtain a key to identify the subscriber session the SAE is managing for the subscriber.
Table 57 shows the keys that you can specify for the VTAs to query the VTA database, NIC, and SAE.
Managing Subscriber Sessions and Service Sessions
When the VTA receives plug-in events, it may need to start or stop a subscriber session or service session. The plug-in events identify the SAE that manages a subscriber; however, the VTA must construct a data key from one or more plug-in attributes to identify the subscriber session or service session. Depending on the information that uniquely identifies subscribers in your SDX configuration, you must configure VTAs to use the keys shown in Table 58:
Quota VTA
The Quota VTA limits a subscriber's access rate based on the balances of accounts that record the subscriber's use of network resources. Subscribers receive a quota of transfer (upload and download) volume periodically and can purchase additional volume that they can use at any time. In this documentation, the former volume is called the periodic quota, and the latter volume is called the bought quota. For example, a subscriber may receive a 25-MB periodic quota each month. In addition, that subscriber may purchase 25 MB of bought quota in January, and use the bought quota between January and March.
The periodic quota and bought quota are tracked in separate accounts, known as the periodic account and bought account, respectively. As a subscriber consumes volume, the VTA debits the accounts, using first the periodic quota and, if no periodic quota is available, the bought quota.
Subscribers managed by a Quota VTA require a subscription, either through an individual or shared profile, to the quota service, which provides a better quality of service than the default. You must configure this subscription to be activated when the subscriber logs in. When a subscriber logs in to the SAE, the SAE tries to activate the quota service. However, if neither account has a positive balance, the VTA deactivates the quota service, and the SAE applies to the subscriber either the default policy or another policy that implements a service with a lower bandwidth.
The units of the accounts depend on the formula that you define to determine the use of network resources (see Use of Network Resources). With this formula, the VTA calculates the change to the accounts and the interim accounting interval, which also depends on a formula you define (see Interim Accounting Interval).
A Quota VTA operates as follows:
- When a service session for the quota service starts, the SAE sends a start event to the Quota VTA.
- The Quota VTA starts a VTA session that has the same identifier as the service session and a qualifier of zero.
- The Quota VTA records a zero balance change either to the periodic account, if its balance is positive, or to the bought account.
- The Quota VTA obtains the start time for the VTA session from the SAE event, and uses the current time for the time of the balance changes.
- When the Quota VTA receives the first interim update from the SAE in a VTA session, it records a balance change that details the use of resources and the event time for the VTA session. When the Quota VTA receives subsequent interim updates in the VTA session, it updates the use of resources and the event time in the balance change recorded previously.
- If the periodic account contains sufficient resources to cover the balance change, the VTA changes only the balance of that account.
- If the periodic account does not contain sufficient resources for the change, the Quota VTA records one balance change for the resources available in that account and records another balance change for the difference in the bought account. In this case, the Quota VTA records subsequent balance changes to the bought account.
- If neither account has sufficient resources, the Quota VTA deactivates the quota service.
- If the SAE session ends, the VTA session ends. When a new service session starts, Steps 1 to 3 recur. However, a service session may last for several VTA sessions. In this case, the SAE and VTA continue the process described in Step 3.
- When the administrator replenishes the periodic quota, the Quota VTA ends the VTA session, finalizes all balance changes for the session, and records a credit to the periodic account.
- When the subscriber buys quota, the Quota VTA ends the VTA session, finalizes all balance changes for the session, and records a credit to the bought account.
- When the Quota VTA next receives an interim update event from the SAE, the Quota VTA starts a new VTA session. The Quota VTA obtains the start time for the VTA session from the SAE event, and records debits to the accounts as described in Step 3.
The Quota VTA always ends the VTA session when the administrator replenishes periodic quota or the subscriber buys quota. However, a service session may last for several billing periods. In this case, when the Quota VTA starts a new VTA session, it continues to assign the SAE session identifier to the VTA session and increments the qualifier by one. Keeping the VTA session within a billing period allows the Quota VTA to finalize balance changes.
Use of Network Resources
With the variables shown in the following list, you can define a usage formula that determines the use of network resources. The decision plug-in evaluates this formula for every accounting event it receives from the SAE for the quota service and debits the result, an integer in the range 0-9223372036854775807, from the periodic and bought accounts.
interimTime
- Specifies the time in seconds since last accounting event. Generally, this value equals the interim accounting interval; however, the value may exceed the interim accounting interval if an accounting event is lost. Similarly, the value may be less than the interim accounting interval if a stop event occurs in the middle of an accounting interval.
- Value—Integer in the range 0-2147483647
downStreamBytes
- Specifies the amount of data in bytes that the subscriber downloaded from the network since last the last accounting event.
- Value—Integer in the range 0-9223372036854775807
upStreamBytes
- Specifies the amount of data in bytes that the subscriber uploaded to the network since last accounting event.
- Value—Integer in the range 0-9223372036854775807
You define the formula in the JavaScript scripting language (see http://devedge.netscape.com/library/manuals/2000/javascript/1.5/guide). The Quota VTA executes the script in the Rhino Javascript implementation (see http://www.mozilla.org/rhino). Table 59 shows some examples for this formula.
Interim Accounting Interval
With the variables shown in the following list, you can define a formula to dynamically adjust the interim accounting interval based on the subscriber's remaining resources and use of the network. The decision plug-in evaluates the formula to obtain the accounting interval in seconds. The result is an integer in the range -2147483648 through 2147483647; depending on the result, the decision plug-in acts as follows:
- If the result is zero, the decision plug-in disables interim accounting.
- If the result is a negative number, the decision plug-in does not change the interim accounting interval.
- If the result is a positive number, the decision plug-in changes the interim accounting interval to this value.
periodicBalance
- Specifies the current balance of the periodic account.
- Value—Integer in the range 0-9223372036854775807
boughtBalance
- Specifies the current balance of the bought account.
- Value—Integer in the range 0-9223372036854775807
lastInterimTime
sessionLength
- Specifies the length of the current session in seconds.
- Value—Integer in the range 0-2147483647; value is 0 when the decision plug-in is calculating the interim time of start events. For other events, value is set by attribute PA_SESSION_TIME.
maxUsageRate
- Specifies the maximum rate at which the subscriber can use network resources according to the formula described in Table 60. This formula uses the variables PA_UPSTREAM_BANDWIDTH, PA_DOWNSTREAM_BANDWIDTH, and lastInterimTime.
- Value—Integer in the range 0-9223372036854775807
averageUsageRate
- Specifies the average rate at which the subscriber is consuming volume in bytes per second.
- Value—Integer in the range 0-9223372036854775807; value is 0 when the decision plug-in is calculating the interim time of start events
For other events, value is the usage formula divided by PA_SESSION_TIME. The usage formula is calculated from PA_OUT_OCTETS, PA_IN_OCTETS, and PA_SESSION_TIME.
You define the formula in the JavaScript scripting language (see http://devedge.netscape.com/library/manuals/2000/javascript/1.5/guide). The Quota VTA executes the script in the Rhino Javascript implementation (see http://www.mozilla.org/rhino). The formula for interim accounting is stored in the Quota VTA configuration in the directory. Table 60 shows some examples for this formula.
Automatic Login of Subscribers
By using a NIC with the Quota VTA, you can enable subscribers who connect the SDX network via a JUNOSe router to log in via the client Web portals. The NIC must map the subscriber's IP address to one of the following values:
- Subscriber's login name
- Subscriber's DN
- Name of the interface and VR to which the subscriber connects
The value to which this NIC maps the subscriber's IP address depends on the information that uniquely identifies subscribers in your SDX configuration.
If the subscribers connect to the network via a JUNOS routing platform or you choose not implement this NIC with a JUNOSe router, you can provide subscribers with access to this information via another method, such as a central login page where subscribers can enter their usernames and passwords.
Immediate Activation of Subscriptions to Quota Service
You can configure the SDX network to allow the Quota VTA to immediately activate a subscriber's quota service when a deposit is made to the subscriber's account. To do so, you must configure a NIC to map the subscriber's identifier to the SAE reference.
If you do not configure a NIC for this purpose or you use an identifier that the NIC cannot map to an SAE reference, subscribers must log out and log in again for the Quota VTA to be able to activate their quota services when deposits are made to their accounts. This feature is available for subscribers who connect to the network via both JUNOSe routers and JUNOS routing platforms.
Threshold VTA
A Threshold VTA limits a subscriber's access rate by comparing the volume of data that the subscriber transfers with a specified limit. If a subscriber exceeds a specified usage limit over a specified period of time, the VTA applies a slow rate limit to the subscriber's connection until the subscriber's usage stays below another specified limit for another specified period of time. This action lowers the subscriber's average bandwidth consumption to an acceptable level.
Each subscriber that a Threshold VTA controls must have a subscription, either through an individual or shared profile, to a behaving service and a misbehaving service. The Threshold VTA completely controls the activation and deactivation of these subscriptions, so they must not be automatically activated on login or have any scheduled actions. The behaving service forwards traffic, assigns a high QoS profile to traffic, or assigns a fast rate limit to traffic. The misbehaving service assigns a slow rate limit to traffic.
The VTA controls the subscriber's traffic rates as follows:
- When a subscriber logs in for the first time, the VTA activates the behaving service and starts a VTA session. However, the subscription to the misbehaving service is inactive.
- If a subscriber logs out, the Threshold VTA ends the VTA session.
- When the Threshold VTA receives a service accounting event from the SAE, the decision plug-in calculates the resources that the subscriber used during a specified period of time (known as the observation period) before the SAE sent the event.
A VTA session can start before the beginning of the observation period and end after the beginning of the observation period. In this case, the Threshold VTA prorates resource usage for this session based on the portion of the session that occurred after the beginning of the observation period.
- If the subscriber exceeded the upper limit for transferred volume for the specified observation period, the Threshold VTA restricts the subscriber's data transfer rates as follows:
- Activates the misbehaving service
- Deactivates the behaving service
- Ends the current VTA session, records information about the VTA session in the database, and starts a new VTA session
When it restricts the subscriber's data transfer rates, the Threshold VTA proceeds as described in Step 5. However, if the subscriber did not exceed the upper limit for transferring volume during the observation period, the Threshold VTA proceeds as described in Steps 3 and 4.
- If the Threshold VTA is restricting the subscriber's access rates, it reviews the subscriber's use of resources as described in Step 3. If the volume of data the subscriber transfers drops below the specified lower limit for a specified period of time, the Threshold VTA:
- Activates the behaving service
- Deactivates the misbehaving service
- Ends the current VTA session, records information about the VTA session in the database, and starts a new VTA session
- The VTA repeats the processes described in Steps 4 to 5 to control the subscriber's consumption of bandwidth until the subscriber logs out.
- When a subscriber logs in subsequently, the Threshold VTA checks the last VTA session in the database to see whether the subscriber was using the behaving or misbehaving service. The VTA activates the service last used, and the decision plug-in calculates the subscriber's use of resources during the prior observation period as described in Step 3. Based on the results, the Threshold VTA determines whether or not the subscriber's data transfer rate should be restricted as described in Steps 4 to 5. The Threshold VTA then proceeds as described in Steps 2 to 5.
Automatic Login of Subscribers
By using a NIC with the Threshold VTA, you can enable subscribers who connect the SDX network via a JUNOSe router to login via the client Web portals. The NIC must map the subscriber's IP address to one of the following values:
- Subscriber's login name
- Subscriber's DN
- Name of the interface and VR to which the subscriber connects
The value to which this NIC maps the subscriber's IP address depends on the information that uniquely identifies subscribers in your SDX configuration.
If the subscribers connect to the network via a JUNOS routing platform or you choose not implement this NIC with a JUNOSe router, you can provide subscribers with access to this information via another method, such as a central login page where subscribers can enter their usernames and passwords.
Usage Formula
You can customize the formula that the VTA uses to calculate the volume of data transferred. However, the formula must be based on the variables upStreamBytes and downStreamBytes (see Use of Network Resources). By default, the VTA calculates the sum of the volume of data that a subscriber uploads and the volume of data that a subscriber downloads.