close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

reauthenticate (DHCP Local Server)

date_range 20-Nov-23

Syntax

content_copy zoom_out_map
reauthenticate (<lease-renewal> <remote-id-mismatch > <actual-data-rate-change>);

Hierarchy Level

[edit logical-systems name routing-instances name system services dhcp-local-server],
[edit logical-systems name routing-instances name system services dhcp-local-server dhcpv6],
[edit logical-systems name routing-instances name system services dhcp-local-server dual-stack-group name],
[edit logical-systems name system services dhcp-local-server],
[edit logical-systems name system services dhcp-local-server dhcpv6],
[edit logical-systems name system services dhcp-local-server dual-stack-group name],
[edit routing-instances name system services dhcp-local-server ],
[edit routing-instances name system services dhcp-local-server dhcpv6],
[edit routing-instances name system services dhcp-local-server 
dual-stack-group name],
[edit system services dhcp-local-server],
[edit system services dhcp-local-server dhcpv6],
[edit system services dhcp-local-server dual-stack-group name]

Description

Enable DHCP client reauthentication, that is, trigger jdhcpd to request reauthentication from authd, which in turn reissues the RADIUS Access-Request for subscriber authentication. The purpose of the reauthentication is to change characteristics of the subscriber session, such as activating subscriber services or changing attributes. You can use reauthentication as an alternative to a RADIUS CoA request.

Starting in Junos OS Release 18.1R1, reauthentication can be triggered by discover and solicit messages in addition to the previously supported renew and rebind messages. The release also introduces reauthentication support for dual-stack, single-session subscribers.

You can specify that reauthentication occurs in response to all DHCP renew, rebind, discover, or solicit messages or only in response to discover and solicit messages that include a new (different) Agent Remote ID for the DHCP client.

You can use the Juniper Networks VSA, Reauthentication-On-Renew (26-206) as an alternative to the CLI configuration to enable reauthentication. The reauthenticate statement overrides the VSA when the VSA is present with a value of disable.

Note:

Reauthentication for dual-stack, single-session subscribers requires that the on-demand-address-allocation statement is configured for the dual-stack group. This is true whether you enable reauthentication with the reauthenticate statement or the Reauthenticate-On-Renew VSA (26-206).

Note:

You cannot configure both the reauthenticate statement and the remote-id-mismatch (DHCP Local Server and DHCP Relay Agent) statement at the global level, [edit system services dhcp-local-server]. However, DHCP precedence rules do permit you to configure both statements when they are at different levels. For example, you can configure reauthenticate at the global level and remote-id-mismatch (DHCP Local Server and DHCP Relay Agent) for DHCPv6 at the [edit system services dhcp-local-server dhcpv6] or for a specific group at the [edit system services dhcp-local-server group name] hierarchy level, and so on.

Note:

Reauthentication does not support Extensible Services Subscriber Management (essmd) services. Activation or deactivation of any such service causes the request to fail.

Options

lease-renewal

Reauthenticate when a renew, rebind, discover, or solicit message is received from the DHCP client. This re-authentication is an alternative to RADIUS Change of Authorization (CoA) to change subscriber session characteristics based on the actual data rate change without interrupting the subscriber service.

remote-id-mismatch

Reauthenticate when a discover or solicit message is received from the DHCP client with a new value for the DHCP client’s Agent Remote ID. The change in value corresponds to a change in subscriber service plan. The Agent Remote ID is conveyed in option 82, suboption 2 for DHCPv4 clients and in option 37 for DHCPv6 clients.

actual-data-rate-change

Optical line terminal (OLT) adds option 82 with sub-option 9 with Broadband Forum (Vendor ID 3561). It contains the sub-attributes Actual-Data-Rate-Upstream and Actual-Data-Down-Stream encoded. The decoded upstream and downstream data send to RADIUS server as a part of authentication request. RADIUS server analyzes the data received. Based on the Actual-Data-Rate-Upstream and Actual-Data-Down-Stream values, the RADIUS server selects the service profile for the subscriber interface.

When the actual data rate changes, the DHCP server re-authenticates the subscriber service. This re-authentication is an alternative to RADIUS Change of Authorization (CoA) to change subscriber session characteristics based on the actual data rate change without interrupting the subscriber service.

Required Privilege Level

interface—To view this statement in the configuration.

interface-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 17.4R1.

Support at the [edit ... system services dhcp-local-server dual-stack-group] hierarchy level introduced in Junos OS Release 18.1R1.

actual-data-rate-change option introduced in Junos OS Release 21.4R1.

arrow_backward PREVIOUS reassembly-timeout

NEXT arrow_forward rebalance (Aggregated Ethernet Interfaces)

Junos CLI Reference

ON THIS PAGE

reauthenticate (DHCP Local Server)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

reauthenticate (DHCP Local Server)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch