A General Recommendations
While configuring the DSA, consider the following:
- Increase the resource allocation to achieve desired throughput. Details for increasing the resource allocation is provided in Activating DSA.
- Ensure that after enabling a countermeasure, its related configuration tables are
configured properly for countermeasure to take effect. In the case of no
configuration or invalid configuration, countermeasure do not have any effect.
The following table provides the configuration tables associated with
countermeasures.
Table A-1 Countermeasure Configuration
Countermeasure Name Configuration Table Origin Realm and Destination Realm Whitelist Screening Countermeasure Realm_List Application ID Whitelist Screening Countermeasure AppIdWL_Config Application ID and Command Code Consistency Check Countermeasure AppCmdCst_Config AVP Instance Check Countermeasure AVPInstChk_Config VPLMN ID and Origin Realm Consistency Check Countermeasure VplmnORCst_Config Specific AVP Screening Countermeasure SpecAVPScr_Config Time Distance Countermeasure TimeDistChk_Config Measure Rate Monitoring Countermeasure MsgRateMon_Config - For validating the configurations, set the Operating Mode parameter in Security_Countermeasure_Config table as Detection_Only. Once configurations are validated, then the Operating Mode parameter can be changed as desired.
- For stateful countermeasures, set the Operating Mode parameter in Security_Countermeasure_Config table as Detection_Only for at least the first 24 hours. This allows the security application to learn about any subscribers who are already roaming in partner networks without impacting their service. The operating mode can be changed to Detection and Correction after that period, if desired by the operator.
- Set the value for the Error Action if UDR Failure parameter (in the System_Config_Options table) as Continue Processing to ensure the requests are not dropped and roaming subscribers continue to receive service in case of any UDR error (though it is a rare occurrence). Also change the Operating mode for any enabled stateful countermeasures (in the Security_Countermeasure_Config table) to Detection_Only for 24 hours (revert to original after 24 hours) if UDR errors are observed.
- To share the common UDR database, between the DSA of different sites, the SOs need to be under the same NO.