close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
- Juniper BNG CUPS Overview
- Juniper BNG CUPS Theory of Operation
play_arrow Use Juniper BNG CUPS
play_arrow Juniper BNG CUPS Controller CLI Configuration Statements
- Juniper BNG CUPS Controller CLI Configuration Statements
play_arrow Juniper BNG CUPS Controller CLI Operational Statements
- Juniper BNG CUPS Controller CLI Operational Commands
play_arrow Juniper BNG User Plane CLI Configuration Statements
play_arrow Juniper BNG User Plane CLI Operational Commands

list Table of Contents

English

Use Juniper BNG CUPS Lawful Intercept

date_range 13-Mar-25

arrow_backward

arrow_forward

This document presents conceptual information and sample configurations that you can use to help you set up lawful intercept in your Juniper BNG CUPS environment.

Lawful Intercept Overview

Lawful intercept is a process for obtaining communications network data related to a target individual or organization, as authorized by a judicial or administrative order. Subscriber secure policy (lawful intercept) provides capability to mirror traffic on a per-subscriber basis. Subscriber traffic can be mirrored as well as the events related to the subscriber session, that is being mirrored, can be monitored. (For more information about lawful intercept, see Lawful Intercept on Junos Multi-Access User Plane.)

Subscriber secure policy mirroring can be based on information provided by either RADIUS or Dynamic Tasking Control Protocol (DTCP) and can mirror both IPv4 and IPv6 traffic. After subscriber secure policy is triggered, the subscriber’s incoming and outgoing traffic are both mirrored. The original traffic is sent to its intended destination, and the mirrored traffic is sent to a mediation device for analysis. The actual mirroring operation is transparent to subscribers whose traffic is being mirrored. A special UDP/IP plus lawful intercept header is prepended to each mirrored packet sent to the mediation device. The mediation device uses the LI header (8 Bytes) to differentiate different users

BNG CUPS Subscriber Secure Policy functionality in Juniper BNG CUPS is split between the BNG CUPS Controller and the BNG User Plane in accordance with the "Support of Lawful Intercept" section of the 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Interface between the Control Plane and the User Plane Nodes; Stage 3 document.

Figure 1 shows RADIUS server based subscriber lawful Interception:

The mediation device sends intercept provisioning information to the RADIUS server.
The RADIUS server sends lawful intercept VSAs to the BNG CUPS Controller, either in an ACCESS-ACCEPT or change of authorization (CoA) message.
BNG CUPS Controller sends lawful intercept traps to the mediation device (if there are any) and programs the BNG User Plane.
Subscriber traffic is mirrored to the mediation device from the BNG User Plane.

Figure 1: RADIUS Based Subscriber Lawful Intercept

Figure 2 shows DTCP Based Subscriber Lawful Interception:

The mediation device sends a DTCP message to the BNG CUPS Controller.
The BNG CUPS Controller sends lawful intercept traps to the mediation device (if there are any) and programs the BNG User Plane.
Subscriber traffic is mirrored to the mediation device from the BNG User Plane.

Figure 2: DTCP Based Subscriber Lawful Intercept

Configure Lawful Intercept

The radius-flow-tap configuration commands are split between the BNG CUPS Controller and the BNG User Planes.

BNG CUPS Controller Lawful Intercept Configuration
BNG User Plane Lawful Intercept Configuration

BNG CUPS Controller Lawful Intercept Configuration

Configure the radius-flow-tap service for subscriber secure policy mirroring on the BNG CUPS Controller, as follows:

content_copy zoom_out_map
[edit services]
radius-flow-tap {
   policy policy-name {
…
   }  
}

Configure Dynamic Tasking Control Protocol

You run all the Dynamic Tasking Control Protocol configurations on the BNG CUPS Controller.

Perform the following configuration on the BNG CUPS Controller:

content_copy zoom_out_map
[edit]
System {
       login {
         class class-name {
             permissions flow-tap-operation;
         }
         user user-name {
             uid uid;
             class class-name;
             authentication {
                 encrypted-password <string>
             }
         }
     }
     services {
         flow-tap-dtcp {
             ssh {
                 connection-limit connection-limit;
                 rate-limit rate-limit;
             }
         }
     }
}

BNG User Plane Lawful Intercept Configuration

Configure the radius-flow-tap service for subscriber secure policy mirroring parameters for the mediation device on the BNG User Plane, as follows:

content_copy zoom_out_map
[edit services]
radius-flow-tap {
  forwarding-class class-name;
  logical-system logical-system-name routing-instance routing-instance-name;
  routing-instance routing-instance-name;
  source-ipv4-address ipv4-address;
}

arrow_backward PREVIOUS Use Juniper BNG CUPS Multicast

NEXT arrow_forward Use Juniper BNG CUPS Captive Portal and Content Delivery Services

Juniper BNG CUPS User Guide

ON THIS PAGE