Classifying DHCP Subscribers with the SRC CLI
Use the following configuration statements to configure DHCP classification scripts:
shared sae dhcp-classifier rulename
{targettarget
; scriptscript
;}shared sae dhcp-classifier rulename
conditionname
...A classification script can contain either a target and a condition or a script. If you do not define a script, the classifier must have both a target and a condition.
To configure DHCP classification scripts:
- From configuration mode, enter the DHCP classifier configuration. In this sample procedure, the classifier is configured in the west-region SAE group.
user@host#edit shared sae group west-region dhcp-classifier
- Create a rule for the subscriber classifier. You can create multiple rules for the classifier.
[edit shared sae group west-region dhcp-classifier]user@host#edit rule rule-1
- Configure either a target or a script for the rule.
- (Optional) Configure the target for the rule.
[edit shared sae group east-region dhcp-classifier rule rule-1]user@host#set target
target
[edit shared sae group east-region dhcp-classifier rule rule-1]user@host#set script
script
If you configure a target, see DHCP Classification Targets.
- If you configured a target for the rule, configure a match condition for the rule. You can create multiple conditions for the rule. See DHCP Classification Conditions.
[edit shared sae group east-region dhcp-classifier rule rule-1]user@host#edit condition
name
- (Optional) Change the order of rules.
[edit shared sae group east-region dhcp-classifier]user@host#insert rule rule-5 before rule-4
- (Optional) Rename a rule.
[edit shared sae group east-region dhcp-classifier]user@host#rename rule rule-2 to dhcp
- (Optional) Verify the classifier rule configuration.
[edit shared sae group east-region dhcp-classifier rule rule-1]user@host#show
target cn=default,<-dhcpProfileDN->;condition {1;}- (Optional) Verify the DHCP classifier configuration.
[edit shared sae group west-region dhcp-classifier]user@host#show
rule rule-1 {script "# DHCP classification script## The DHCP classification script can use the following fields:## interfaceName - interface where DHCP DISCOVER was received.# ifAlias - \"ip description\" of interface# ifDesc - SNMP standard name of interface# nasPortId# virtualRouterName - VR where DHCP DISCOVER was received# macAddress - MAC address of DHCP client# dhcp - DHCP options# poolName - DHCP Pool name set by authorization plug-in# authVirtualRouterName - VR name set by authorization plug-in# dhcpProfileDN - search base for DHCP Profiles";}rule rule-2 {target cn=default,<-dhcpProfileDN->;condition {1;}}DHCP Classification Conditions
DHCP classification conditions define match criteria that are used to find the DHCP profile. Use the fields in this section to define DHCP classification conditions.
authVirtualRouterName
- Name of JUNOSe virtual router that is set by an authorization plug-in through the authorization response.
- Value—Name of the virtual router in the format vrname@hostname
dhcp
- DHCP options. See Setting DHCP Parameters with DHCP Options.
dhcpProfileDN
interfaceName
- Name of the interface where the DHCP discover message was received.
- Value—Name of the interface in your router CLI syntax
- Example—interfaceName=fastEthernet6/0
ifAlias
- Description of the interface where the DHCP discover request was received.
- Value—Interface description that is configured on the router. For JUNOSe routers, it is the description configured with the interface description command
- Example—ifAlias="dhcp-subscriber12"
ifDesc
- Alternate name for the interface where the DHCP discover request was received. This is a system-generated name that is used by SNMP.
- Value
ip<slot>/<port>.<subinterface>On the JUNOS routing platform, ifDesc is the same as interfaceName. macAddress
- MAC address of the DHCP client that appears in DHCP request.
- Value—Valid MAC address
- Example—macAddress="00:11:22:33:44:55"
nasPortId
- Port identifier of an interface.
- Value—Includes interface name and additional layer 2 information
- Example—nasPortId="fastEthernet 3/1" (There is a space between fastEthernet and slot number 3/1 in the nasPortId.)
poolName
- IP address pool name that is set by an authorization plug-in through the authorization response.
- Value—Name of an address pool configured on the JUNOSe router
virtualRouterName
DHCP Classification Targets
The target of the DHCP classification script uses a syntax similar to an LDAP URL. With the exception of baseDN, all fields are optional. The syntax is:
baseDN [ ? [ attributes ] [ ? [ scope ] [ ? [ filter ] ] ] ]
- baseDN—DN of object where search starts.
- attributes—Comma-separated list of properties, in the format attribute=<-value->, that allow you to set specific attributes for directory objects that the script finds; see DHCP Classification Conditions.
You can use the attribute configuration to override attributes in the directory. For example, to override the IP pool name that is stored in the DHCP profile with the pool name that the authorization plug-in sends, use the attribute statement radiusFramedPool=<-poolName->.