Requirements

• MX Series 3D Universal Edge Router
• Junos OS Release 11.4 or later

Overview

• The access network is PPPoE.
• DHCPv6 IA_NA is used to assign a global IPv6 address on the WAN link. The address comes from a local pool that is specified using AAA RADIUS.
• DHCPv6 prefix delegation is used for subscriber LAN addressing. It uses a delegated prefix from a local pool that is specified by AAA RADIUS.
• DHCPv4 is used for subscriber LAN addressing.
• DHCPv6 subscriber sessions are layered over an underlying PPPoE subscriber session.

Topology

Figure 1: PPPoE Subscriber Access Network with DHCPv6 IA_NA and DHCPv6 Prefix Delegation

Table 1 describes the configuration components used in this example.

Configuration

• Configuring a DHCPv6 Local Server for DHCPv6 over PPPoE
• Configuring a Dynamic Profile for the PPPoE Logical Interface
• Configuring a Loopback Interface
• Configuring a VLAN Demux Interface over an Ethernet Underlying Interface
• Configuring an Interface for Communication with RADIUS Server
• Specifying the BNG IP Address
• Configuring RADIUS Server Access
• Configuring RADIUS Server Access Profile
• Configuring Local Address-Assignment Pools

CLI Quick Configuration

The following is the complete configuration for this example:

Configuring a DHCPv6 Local Server for DHCPv6 over PPPoE

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Access the DHCPv6 local server configuration.
   [edit]user@host# edit system services dhcp-local-server dhcpv6
2. Create a group for dynamic PPPoE interfaces and assign a name.

   The group feature groups a set of interfaces and then applies a common DHCP configuration to the named interface group.

   [edit system services dhcp-local-server dhcpv6]user@host# edit group v6-ppp-subscriber
3. Add an interface for dynamic PPPoE logical interfaces.
   [edit system services dhcp-local-server dhcpv6 group v6-ppp-subscriber]user@host# set interface pp0.0

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring a Dynamic Profile for the PPPoE Logical Interface

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create and name the dynamic profile.
   [edit]user@host# edit dynamic-profiles pppoe-subscriber-profile
2. Add a routing instance to the profile.
   [edit dynamic-profiles pppoe-subscriber-profile]user@host# edit routing-instances $junos-routing-instance user@host# set interface $junos-interface-name
3. Configure a PPPoE logical interface (pp0) that is used to create logical PPPoE interfaces for the IPv4 and IPv6 subscribers.
   [edit dynamic-profiles pppoe-subscriber-profile]user@host# edit interfaces pp0
4. Specify $junos-interface-unit as the predefined variable to represent the logical unit number for the pp0 interface. The variable is dynamically replaced with the actual unit number supplied by the network when the subscriber logs in.
   [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0]user@host# edit unit $junos-interface-unit
5. Specify $junos-underlying-interface as the predefined variable to represent the name of the underlying Ethernet interface on which the router creates the dynamic PPPoE logical interface. The variable is dynamically replaced with the actual name of the underlying interface, which is supplied by the network when the subscriber logs in.
   [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0 unit "$junos-interface-unit"]user@host# set pppoe-options underlying-interface $junos-underlying-interface
6. Configure the router to act as a PPPoE server when a PPPoE logical interface is dynamically created.
   [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0 unit "$junos-interface-unit"]user@host# set pppoe-options server
7. Configure the IPv4 family for the pp0 interface. Specify the unnumbered address to dynamically apply loopback interfaces. Because the example uses routing instances, assign the predefined variable $junos-loopback-interface.
   [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0 unit "$junos-interface-unit"]user@host# set family inet unnumbered-address $junos-loopback-interface
8. Configure the IPv6 family for the pp0 interface. Specify the unnumbered address to dynamically create loopback interfaces. Because the example uses routing instances without router advertisement, assign the predefined variable $junos-loopback-interface.
   [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0 unit "$junos-interface-unit"]user@host# set family inet6 unnumbered-address $junos-loopback-interface
9. Configure one or more PPP authentication protocols for the pp0 interface.
   [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0 unit "$junos-interface-unit"]user@host# set ppp-options chap user@host# set ppp-options pap
10. Enable keepalives and set an interval for keepalives. We recommend an interval of 30 seconds.
    [edit dynamic-profiles pppoe-subscriber-profile interfaces pp0 unit "$junos-interface-unit"]user@host# set keepalives interval 30

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring a Loopback Interface

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the loopback interface and specify a unit number.
   [edit]user@host# edit interfaces lo0 unit 0
2. Configure the interface for IPv4.
   [edit interfaces lo0 unit 0]user@host# set family inet address 10.0.0.1/32 primary preferred
3. Configure the interface for IPv6.
   [edit interfaces lo0 unit 0]user@host# set family inet6 address 2001:0::1/128 primary preferred

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring a VLAN Demux Interface over an Ethernet Underlying Interface

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure the underlying Ethernet interface.
   [edit]user@host# edit interfaces ge-0/3/0user@host# set flexible-vlan-tagginguser@host# set encapsulation flexible-ethernet-servicesuser@host# set hierarchical-scheduler maximum-hierarchy-levels 2
2. Create the VLAN demux interface, and specify a unit number.
   [edit]user@host# edit interfaces demux0 unit 1
3. Configure the VLAN tags.
   [edit interfaces demux0 unit 1]user@host# set vlan-tags outer 1 inner 1
4. Specify the underlying Ethernet interface.
   [edit interfaces demux0 unit 1]user@host# set demux-options underlying-interface ge-0/3/0
5. Specify the dynamic profile.
   [edit interfaces demux0 unit 1]user@host# set family pppoe dynamic-profile pppoe-subscriber-profile
6. Prevent multiple PPPoE sessions from being created for the same PPPoE subscriber on the same VLAN interface.
   [edit interfaces demux0 unit 1]user@host# set family pppoe duplicate-protection
7. (Optional) Specify that you want the demux interface to use proxy ARP.
   [edit interfaces demux0 unit 1]user@host# set proxy-arp

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring an Interface for Communication with RADIUS Server

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create the interface, specify a unit number, and configure the address.
   [edit]user@host# edit interfaces ge-0/2/5
2. Configure the interface for IPv4 and specify the address.
   [edit interfaces ge-0/2/5]user@host# set unit 0 family inet address 10.9.0.9
3. Specify that Gigabit Ethernet options are not automatically negotiated.
   [edit interfaces ge-0/2/5]user@host# set gigether-options no-auto-negotiation

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Specifying the BNG IP Address

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Best Practice: We strongly recommend that you configure the BNG IP address, thereby avoiding unpredictable behavior if the interface address on a loopback interface changes.

Step-by-Step Procedure

1. Access the routing-options configuration.
   [edit]user@host# edit routing-options
2. Specify the IP address or the BNG.
   [edit routing-options]user@host# set router-id 10.0.0.0

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring RADIUS Server Access

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create a RADIUS server configuration, and specify the address of the server.
   [edit]user@host# edit access radius-server 10.9.0.9
2. Configure the required secret (password) for the server. Secrets enclosed in quotation marks can contain spaces.
   [edit access radius-server 10.9.0.9]user@host# set secret "$9$lXRv87GUHm5FYgF/CA1I"
3. Configure the source address that the BNG uses when it sends RADIUS requests to the RADIUS server.
   [edit access radius-server 10.9.0.9]user@host# set source address 10.0.0.1
4. (Optional) Configure the number of times that the router attempts to contact a RADIUS accounting server. You can configure the router to retry from 1 through 16 times. The default setting is 3 retry attempts.
   [edit access radius-server 10.9.0.9]user@host# set retry 4
5. (Optional) Configure the length of time that the local router or switch waits to receive a response from a RADIUS server. By default, the router or switch waits 3 seconds. You can configure the timeout to be from 1 through 90 seconds.
   [edit access radius-server 10.9.0.9]user@host# set timeout 45

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring RADIUS Server Access Profile

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Create a RADIUS server access profile.
   [edit]user@host# edit access profile Access-Profile
2. Specify the order in which authentication methods are used.
   [edit access profile Access-Profile]user@host# set authentication-order radius
3. Specify the address of the RADIUS server used for authentication and the server used for accounting.
   [edit access profile Access-Profile]user@host# set radius authentication-server 10.9.0.9user@host# set radius accounting-server 10.9.0.9
4. Configure RADIUS accounting values for the access profile.
   [edit access profile Access-Profile]user@host# set accounting order [ radius none ]user@host# set accounting update-interval 120user@host# set accounting statistics volume-time

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Configuring Local Address-Assignment Pools

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure the address-assignment pool for DHCPv4.
   [edit]user@host# edit access address-assignment pool v4-pooluser@host# edit family inetuser@host# set network 10.16.0.1user@host# set range v4-range-0 low 10.16.0.1user@host# set range v4-range-0 high 10.31.255.255user@host# set dhcp-attributes maximum-lease-time 99999
2. Configure the address-assignment pool for DHCPv6 IA_NA.
   [edit]user@host# edit access address-assignment pool v6-ia-na-pooluser@host# edit family inet6user@host# set prefix 1000:0000::/64 user@host# set range v6-range-0 low 1000::1/128user@host# set range v6-range-0 high 1000::ffff:ffff/128
3. Configure the address-assignment pool for DHCPv6 prefix delegation.
   [edit]user@host# edit access address-assignment pool v6-pd-pooluser@host# edit family inet6user@host# set prefix 2012::/48 user@host# set range v6-pd prefix-length 64
4. (Optional) Enable duplicate prefix protection.
   [edit access]user@host# set address-protection

Results

From configuration mode, confirm your configuration by entering the show command.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

• Verifying Active Subscriber Sessions
• Verifying Both IPv4 and IPv6 Address in Correct Routing Instance
• Verifying Dynamic Subscriber Sessions
• Verifying DHCPv6 Address Pools Used for DHCPv6 Prefix Delegation
• Verifying DHCPv6 Address Bindings
• Verifying PPP Options Negotiated with the Remote Peer

Verifying Active Subscriber Sessions

Purpose

Verify active subscriber sessions.

Action

From operational mode, enter the show subscribers summary command.

Subscribers by State
   Active: 2
   Total: 2

Subscribers by Client Type
   DHCP: 1
   PPPoE: 1
   Total: 2

Meaning

The fields under Subscribers by State show the number of active subscribers.

The fields under Subscribers by Client Type show the number of active DHCP and PPPoE subscriber sessions.

Verifying Both IPv4 and IPv6 Address in Correct Routing Instance

Purpose

Verify that the subscriber has both an IPv4 and an IPv6 address and is placed in the correct routing instance.

Action

From operational mode, enter the show subscribers command.

Interface           IP Address/VLAN ID       User Name            LS:RI
pp0.1073741825      10.16.0.2               SBRSTATICUSER      default:default
pp0.1073741825      1000::1                                    default:default

Meaning

The Interface field shows that two subscriber sessions are running on the same interface. The IP Address field shows that one session is assigned an IPv4 address, and the second session is assigned an IPv6 address by DHCPv6 IA_NA.

The LS:RI field shows that the subscriber is placed in the correct routing instance and that traffic can be sent and received.

Verifying Dynamic Subscriber Sessions

Purpose

Verify dynamic PPPoE and DHCPv6 subscriber sessions. In this sample configuration, the DHCPv6 subscriber session should be layered over the underlying PPPoE subscriber session.

Action

From operational mode, enter the show subscribers detail command.

Type: PPPoE
User Name: SBRSTATICUSER
IP Address: 10.16.0.2
IP Netmask: 255.0.0.0
Logical System: default
Routing Instance: default
Interface: pp0.1073741825
Interface type: Dynamic
Dynamic Profile Name: pppoe-subscriber-profile
MAC Address: 00:01:02:00:00:01
State: Active
Radius Accounting ID: 2
Session ID: 2
Login Time: 2011-12-08 09:11:41 PST

Type: DHCP
IPv6 Address: 1000::1
Logical System: default
Routing Instance: default
Interface: pp0.1073741825
Interface type: Static
MAC Address: 00:01:02:00:00:01
State: Active
Radius Accounting ID: 3
Session ID: 3
Underlying Session ID: 2
Login Time: 2011-12-08 09:12:11 PST
DHCP Options: len 42
00 08 00 02 0b b8 00 01 00 0a 00 03 00 01 00 01 02 00 00 01
00 06 00 02 00 03 00 03 00 0c 00 00 00 00 00 00 00 00 00 00
00 00

Meaning

When a subscriber has logged in and started both an IPv4 and an IPv6 session, the output shows the active underlying PPPoE session and the active DHCPv6 session.

The Session ID field for the PPPoE session is 2. The Underlying Session ID for the DHCP session is 2, which shows that the PPPoE session is the underlying session.

Verifying DHCPv6 Address Pools Used for DHCPv6 Prefix Delegation

Purpose

Verify the delegated address pool used for DHCPv6 prefix delegation and the length of the IPv6 prefix that was delegated to the CPE.

Action

From operational mode, enter the show subscribers extensive command.

Type: PPPoE
User Name: SBRSTATICUSER
IP Address: 10.16.0.2
IP Netmask: 255.0.0.0
Logical System: default
Routing Instance: default
Interface: pp0.1073741825
Interface type: Dynamic
Dynamic Profile Name: pppoe-subscriber-profile
MAC Address: 00:01:02:00:00:01
State: Active
Radius Accounting ID: 2
Session ID: 2
Login Time: 2011-12-08 09:11:41 PST
IPv6 Delegated Address Pool: v6-na-pool

Type: DHCP
IPv6 Address: 1000::1
Logical System: default
Routing Instance: default
Interface: pp0.1073741825
Interface type: Static
MAC Address: 00:01:02:00:00:01
State: Active
Radius Accounting ID: 3
Session ID: 3
Underlying Session ID: 2
Login Time: 2011-12-08 09:12:11 PST
DHCP Options: len 42
00 08 00 02 0b b8 00 01 00 0a 00 03 00 01 00 01 02 00 00 01
00 06 00 02 00 03 00 03 00 0c 00 00 00 00 00 00 00 00 00 00
00 00
IPv6 Delegated Address Pool: v6-na-pool
IPv6 Delegated Network Prefix Length: 64

Meaning

The IPv6 Delegated Address Pool field shows the name of the pool that DHCPv6 used to assign the IPv6 address for this subscriber session.

Verifying DHCPv6 Address Bindings

Purpose

Display the address bindings in the client table on the DHCPv6 local server.

Action

From operational mode, enter the show dhcpv6 server binding detail command.

Session Id:  580547
     Client IPv6 Address:                                1000::4/128
     Client DUID:                           LL0x1-00:01:02:00:00:01
     State:                                 BOUND(DHCPV6_LOCAL_SERVER_STATE_BOUND)
     Lease Expires:                         2012-01-05 07:06:04 PST
     Lease Expires in:                      82943 seconds
     Lease Start:                           2012-01-04 07:06:04 PST
     Last Packet Received:                  2012-01-04 07:06:04 PST
     Incoming Client Interface:             pp0.1073926645
     Server Ip Address:                     0.0.0.0
     Client Pool Name:                                             v6-na-pool-0
     Client Id Length:                      10
     Client Id:                             /0x00030001/0x00010200/0x0001

Meaning

The Client IPv6 Address field shows the /128 address that was assigned to the CPE WAN link using DHCPv6 IA_NA.

The Client Pool Name field shows the name of the address pool that was used to assign the Client IPv6 Address.

Verifying PPP Options Negotiated with the Remote Peer

Purpose

Verify PPP options negotiated with the remote peer.

Action

From operational mode, enter the show ppp interface interface extensive command.

  Session pp0.1073926645, Type: PPP, Phase: Network
    LCP
      State: Opened
      Last started: 2012-01-04 07:05:33 PST
      Last completed: 2012-01-04 07:05:33 PST
      Negotiated options:
        Authentication protocol: pap, Magic number: 191301485, Local MRU: 1492,
        Peer MRU: 65531
    Authentication: PAP
      State: Grant
      Last started: 2012-01-04 07:05:33 PST
      Last completed: 2012-01-04 07:05:33 PST
    IPCP
      State: Opened
      Last started: 2012-01-04 07:05:34 PST
      Last completed: 2012-01-04 07:05:34 PST
      Negotiated options:
        Local address: 10.0.0.1, Remote address: 10.16.0.2

    IPV6CP
      State: Opened
      Last started: 2012-01-04 07:05:34 PST
      Last completed: 2012-01-04 07:05:34 PST
      Negotiated options:
        Local interface identifier: 2a0:a50f:fc71:e049,
        Remote interface identifier: 201:2ff:fe00:1

Meaning

The output shows the PPP options that were negotiated with the remote peer.

Under IPCP, the Negotiated options field shows the IPv4 local and remote addresses that were negotiated by IPCP.

Under IPV6CP, the Negotiated options field shows the IPv6 local and remote interface identifiers that were negotiated by IPv6CP.