L2TP LNS Inline Service Interfaces

To configure an L2TP LNS with inline service interfaces:

You can configure PPP attributes that are applied by the LNS on the inline service (si) interface to the PPP subscribers tunneled from the LAC. Because you are configuring the attributes per interface rather than with a user group profile, the attributes for subscribers can be varied with a finer granularity. This configuration matches that used for terminated PPPoE subscribers.

To configure the PPP attributes for dynamically created si interfaces:

You can configure a user group profile that enables the LNS to apply PPP attributes to the PPP subscribers tunneled from the LAC. The user group profile is associated with clients (LACs) in the L2TP access profile. Consequently all subscribers handled by a given client share the same PPP attributes.

To configure a user group profile:

Access profiles define how to validate Layer 2 Tunneling Protocol (L2TP) connections and session requests. Within each L2TP access profile, you configure one or more clients (LACs). The client characteristics are used to authenticate LACs with matching passwords, and to establish attributes of the client tunnel and session. You can configure multiple access profiles and multiple clients within each profile.

To configure an L2TP access profile:

For some LNS tunnels, you might wish to override the access profile configured at the routing instance that hosts the tunnel with a particular RADIUS server configuration. You can configure a local access profile to do so. You can subsequently use the aaa-access-profile statement to apply the local access profile to a tunnel group or LAC client.

A local access profile applied to a client overrides a local access profile applied to a tunnel group, which in turn overrides the access profile for the routing instance.

To configure an AAA local access profile:

You can configure pools of addresses that can be dynamically assigned to the tunneled PPP subscribers. The pools must be local to the routing instance where the subscriber comes up. The configured pools are supplied in the RADIUS Framed-Pool and Framed-IPv6-Pool attributes. Pools are optional when Framed-IP-Address is sent by RADIUS.

To configure an address-assignment pool, you must specify the name of the pool and configure the addresses for the pool.

You can optionally configure multiple named ranges, or subsets, of addresses within an address-assignment pool. During dynamic address assignment, a client can be assigned an address from a specific named range. To create a named range, you specify a name for the range and define the address range.

For more information about address assignment pools, see Address-Assignment Pools Overview and Address-Assignment Pool Configuration Overview.

To configure an IPv4 address-assignment pool for L2TP LNS:

The peer interface connects the LNS to the cloud towards the LACs so that IP packets can be exchanged between the tunnel endpoints. MPLS and aggregated Ethernet can also be used to reach the LACs.

To configure the LNS peer interface:

The inline service interface is a virtual physical interface that resides on the Packet Forwarding Engine. This si interface, referred to as an anchor interface, makes it possible to provide L2TP services without a special services PIC. The inline service interface is supported only by MPCs on MX Series routers. Four inline service interfaces are configurable per MPC-occupied chassis slot.

Although the range of bandwidth values is 1 Gbps through 400 Gbps, you cannot configure the bandwidth in absolute numbers such as 12,345,878,000 bps. You must use the options available in the CLI statement:

• 1g

• 10g through 100g in 10 Gbps increments: 10g, 20g, 30g, 40g, 50g, 60g, 70g, 80g, 90g, 100g

• 100g through 400g in 100 Gbps increments: 100g, 200g, 300g, 400g

The maximum bandwidth available varies among MPCs, as shown in Table 1. A system log message is generated when you configure a bandwidth higher than is supported on the MPC.

To enable inline service interfaces:

The inline service interface is a virtual physical service interface that resides on the Packet Forwarding Engine. This si interface, referred to as an anchor interface, makes it possible to provide L2TP services without a special services PIC. The inline service interface is supported only by MPCs on MX Series routers. Four inline service interfaces are configurable per MPC-occupied chassis slot.

You can maximize the number of sessions that can be shaped in one service interface by setting the maximum number of hierarchy levels to two. In this case, each LNS session consumes one L3 node in the scheduler hierarchy for shaping.

If you do not specify the number of levels (two is the only option), then the number of LNS sessions that can be shaped on the service interface is limited to the number of L2 nodes, or 4096 sessions. Additional sessions still come up, but they are not shaped.

To configure an inline service interface:

You must specify characteristics—dial-options—for each of the inline services logical interfaces that you configure for the LNS. LNS on MX Series routers supports only one session per logical interface, so you must configure it as a dedicated interface; the shared option is not supported. (LNS on M Series routers supports dedicated and shared options.) You also configure an identifying name for the logical interface that matches the name you specify in the access profile.

You must specify the inet address family for each static logical interface or in the dynamic profile for dynamic LNS interfaces. Although the CLI accepts either inet or inet6 for static logical interfaces, the subscriber cannot log in successfully unless the address family inet is configured.

To configure the static logical interface options:

To configure 1:1 LNS stateful redundancy:

The L2TP tunnel group specifies attributes that apply to L2TP tunnels and sessions from a group of LAC clients. These attributes include the access profile used to validate L2TP connection requests made to the LNS on the local gateway address, a local access profile that overrides the global access profile, the keepalive timer, and whether the IP ToS value is reflected.

To configure the LNS tunnel group:

To apply service profiles to all subscribers in a tunnel group:

• Specify one or more service profiles and any parameters to be passed to the services.

  content_copy zoom_out_map

  [edit services l2tp tunnel-group group-name]
  user@host# set service-profile profile-name(parameter)&profile-name
  

To apply service profiles to all subscribers for a particular LAC:

• Specify one or more service profiles and any parameters to be passed to the services.

  content_copy zoom_out_map

  [edit access profile profile-name client client-name l2tp]
  user@host# set service-profile profile-name(parameter)&profile-name
  

  Note:

  When service profiles are configured for a LAC client and for a tunnel group that uses that client, only the LAC client service profile is applied. It overrides the tunnel group configuration. For example, in the following configuration, the tunnel group, tg-LAC-3, uses the LAC client, LAC-3, so the LAC3 configuration overrides the tunnel group configuration. Consequently only the cos-A3 service is activated for subscribers in the tunnel group, rather than Cos2 and fw1. The shaping rate passed for the service is 24 Mbps.

  content_copy zoom_out_map

  [edit]
  user@host# set services l2tp tunnel-group tg-LAC-3 service-profile cos2(31000000)&fw1
  user@host# set access profile prof-lac client LAC-3 l2tp service-profile cos-A3(24000000)
  

You can deactivate any service applied to a subscriber session by issuing the following command:

user@host> request network-access aaa subscriber delete session-id  subscriber-session-id service-profile profile-name

You can reactivate any service applied to a subscriber session by issuing the following command:

user@host> request network-access aaa subscriber add session-id subscriber-session-id service-profile profile-name

To display the services sessions for all current subscriber sessions, use the show subscribers extensive or show network-access aaa subscribers session-id id-number detail command.

To understand how local service application works, the following examples illustrate the various configuration possibilities. First, consider the following dynamic service profile configurations, cos2 and fw1:

dynamic-profiles {
    cos2 {
        variables {
            shaping-rate default-value 10m;
            shaping-rate-in default-value 10m;
            data-in-filter uid;
            data-in-policer uid;
        }
        interfaces {
            "$junos-interface-ifd-name" {
                unit "$junos-interface-unit" {
                    family inet;
                }
            }
        }
        class-of-service {
            traffic-control-profiles {
                TrafficShaper {
                    scheduler-map a;
                    shaping-rate "$shaping-rate";
                }
            }
            interfaces {
                "$junos-interface-ifd-name" {
                    unit "$junos-interface-unit" {
                        output-traffic-control-profile TrafficShaper;
                    }
                }
            }
        }
    }
|

dynamic-profiles {
    fw1 {
        variables {
            v6input default-value v6ingress;
            v6output default-value v6egress;
            input default-value upstrm-filter;
            output default-value dwnstrm-filter;
        }
        interfaces {
            "$junos-interface-ifd-name" {
                unit "$junos-interface-unit" {
                    family inet;
                }
            }
        }
    }
}

The following statement applies both services to all subscribers in tunnel group tg1; a parameter value of 31 Mbps is passed to the cos2 service:

[edit]
user@host# set services l2tp tunnel-group tg1 service-profile cos2(31000000)&fw1

In the cos2 service profile, the shaping rate is provided by a user-defined variable with a default value of 10m, or 1Mbps. After the L2TP session is up, cos2 and fw1 are activated with service session IDs of 34 and 35, respectively.

user@host1> show subscribers extensive
...

 Service Session ID: 34
   Service Session Name: cos2
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:44:16 IST
   
   Service Session ID: 35
   Service Session Name: fw1   
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:44:16 IST
   Dynamic configuration: 
     input: upstrm-filter
     output: dwnstrm-filter
     v6input: v6ingress
     v6output: v6egress

The parameter passed to cos2 is used as the value for $shaping-rate; consequently the shaping rate for the service is adjusted from the default value of 10 Mbps to 31 Mbps, as shown in the following command output. Although the output indicates the adjusting application is RADIUS CoA, the adjustment is a consequence of the parameter passed to the service profile. That operation uses the same internal framework as a CoA and is reported as such.

user@host1> show class-of-service interface si-1/0/0.3221225492
  Logical interface: si-1/0/0.3221225492, Index: 3221225492
Object                  Name                   Type                    Index
Traffic-control-profile subscriber-tcp-2       Output                  23571
Scheduler-map           a                      Output              4294967354
Classifier              dscp-ipv6-compatibility dscp-ipv6                  9
Classifier              ipprec-compatibility   ip                         13

    Adjusting application: RADIUS CoA
      Adjustment type: absolute
      configured-shaping-rate: 31000000  
      adjustment-value: 31000000
      Adjustment overhead-accounting mode: frame mode
      Adjustment overhead bytes: 0
      Adjustment target: node
      Adjustment priority: 1

Now the cos2 service is deactivated from the CLI for subscriber session 27.

user@host1> request network-access aaa subscriber delete service-profile cos2 session-id 27
Successful completion

The following output shows cos2 is gone, leaving only fw1 as an active service.

user@host1> show subscribers extensive
Type: L2TP
User Name: user@example.com
IP Address: 192.0.2.103
IP Netmask: 255.255.255.255
Logical System: default
Routing Instance: default
Interface: si-1/0/0.3221225492
Interface type: Dynamic
Underlying Interface: si-1/0/0.3221225492
Dynamic Profile Name: dyn-lns-profile
State: Active
Radius Accounting ID: 27
Session ID: 27
PFE Flow ID: 42
Login Time: 2017-08-30 07:29:39 IST
Service Sessions: 1
IP Address Pool: ipv4_pool
Accounting interval: 600
Frame/cell mode: Frame
Overhead accounting bytes: -38
Calculated downstream data rate: 1000000 kbps
Adjusted downstream data rate: 1000000 kbps

   Service Session ID: 35
   Service Session Name: fw1
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:44:16 IST
   Dynamic configuration: 
     input: upstrm-filter
     output: dwnstrm-filter
     v6input: v6ingress
     v6output: v6egress

The following command reactivates cos2 for subscriber session 27.

user@host1> request network-access aaa subscriber add service-profile cos2 session-id 27
Successful completion

The reactivated cos2 service has a new service session ID of 36.

user@host1> show subscribers extensive
...
   Service Session ID: 35
   Service Session Name: fw1
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:44:16 IST
   Dynamic configuration: 
     input: upstrm-filter
     output: dwnstrm-filter
     v6input: v6ingress
     v6output: v6egress

 Service Session ID: 36
   Service Session Name: cos2
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:58:23 IST

The reactivated cos2 service uses the default shaping rate, 10 Mbps, from the service profile.

user@host1> show class-of-service interface si-1/0/0.3221225492
  Logical interface: si-1/0/0.3221225492, Index: 3221225492
Object                  Name                   Type                    Index
Traffic-control-profile subscriber-tcp-2       Output                  23571
Scheduler-map           a                      Output              4294967354
Classifier              dscp-ipv6-compatibility dscp-ipv6                  9
Classifier              ipprec-compatibility   ip                         13

    Adjusting application: RADIUS CoA
      Adjustment type: absolute
      configured-shaping-rate: 10000000  
      adjustment-value: 10000000
      Adjustment overhead-accounting mode: frame mode
      Adjustment overhead bytes: 0
      Adjustment target: node
      Adjustment priority: 1

Next, a RADIUS CoA request is received, which includes the Activate-Service VSA (26-65). The VSA specifies and activates the service and specifies a change in the shaping rate of cos2 from the default 10 Mbps to 12 Mbps. The cos2 service session 36 still appears in the output, but is superseded by the new service session initiated by the CoA, 49.

user@host1> show subscribers extensive
...
   Service Session ID: 35
   Service Session Name: fw1
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:44:16 IST
   Dynamic configuration: 
     input: upstrm-filter
     output: dwnstrm-filter
     v6input: v6ingress
     v6output: v6egress

 Service Session ID: 36
   Service Session Name: cos2
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 15:58:23 IST

 Service Session ID: 49
   Service Session Name: cos2
   State: Active
   Family: inet
   Service Activation time: 2018-02-15 16:25:04 IST
   Dynamic configuration: 
     shaping-rate: 12000000
     shaping-rate-in: 10m

user@host1> show class-of-service interface si-1/0/0.3221225492
  Logical interface: si-1/0/0.3221225492, Index: 3221225492
Object                  Name                   Type                    Index
Traffic-control-profile subscriber-tcp-2       Output                  23571
Scheduler-map           a                      Output              4294967354
Classifier              dscp-ipv6-compatibility dscp-ipv6                  9
Classifier              ipprec-compatibility   ip                         13

    Adjusting application: RADIUS CoA
      Adjustment type: absolute
      configured-shaping-rate: 12000000  
      adjustment-value: 12000000
      Adjustment overhead-accounting mode: frame mode
      Adjustment overhead bytes: 0
      Adjustment target: node
      Adjustment priority: 1

When a service is applied by both the CLI configuration and a RADIUS VSA (26-65), but with different parameters, the RADIUS configuration overrides the CLI configuration. In the following example, the CLI configuration applies the cos2 service profile with a value of 31 Mbps for the shaping rate.

[edit]
user@host# set services l2tp tunnel-group tg1 service-profile cos2(31000000)

The RADIUS Access-Accept message service activation VSA (26-65) applies cos2 with a value of 21 Mbps for the shaping rate.

l2tp@l2tp.com   User-Password := "bras"
        Auth-Type = Local,
        Service-Type = Framed-User,
        Framed-Protocol = PPP,
        ERX-Service-Activate:1 += 'cos2(21000000)',

The CLI configuration activates service session 22 with a shaping rate of 31 Mbps. The RADIUS VSA activates service session 23 with a shaping rate of 21 Mbps.

user@host1> show subscribers extensive
...
   Service Session ID: 22
   Service Session Name: cos2
   State: Active
   Family: inet
   Service Activation time: 2018-02-16 08:22:03 IST
   Dynamic configuration: 
     shaping-rate: 31000000
     shaping-rate-in: 10m

   Service Session ID: 23
   Service Session Name: cos2
   State: Active
   Family: inet
   Service Activation time: 2018-02-16 08:22:03 IST
   Dynamic configuration: 
     shaping-rate: 21000000
     shaping-rate-in: 10m

user@host1> show class-of-service interface si-1/0/0.3221225492
  Logical interface: si-1/0/0.3221225492, Index: 3221225492
Object                  Name                   Type                    Index
Traffic-control-profile subscriber-tcp-2       Output                  23571
Scheduler-map           a                      Output              4294967354
Classifier              dscp-ipv6-compatibility dscp-ipv6                  9
Classifier              ipprec-compatibility   ip                         13

    Adjusting application: RADIUS CoA
      Adjustment type: absolute
      configured-shaping-rate: 21000000  
      adjustment-value: 21000000
      Adjustment overhead-accounting mode: frame mode
      Adjustment overhead bytes: 0
      Adjustment target: node
      Adjustment priority: 1

You can create a pool of inline service interfaces, also known as a service device pool, to enable load-balancing of L2TP traffic across the interfaces. The pool is supported for dynamic LNS configurations, where it provides a set of logical interfaces that can be dynamically created and allocated to L2TP sessions on the LNS. The pool is assigned to an LNS tunnel group. L2TP maintains the state of each inline service interface and uses a round-robin method to evenly distribute the load among available interfaces when new session requests are accepted.

LNS sessions anchored on an MPC are not affected by a MIC failure as long as some other path to the peer LACs exists. If the MPC hosting the peer interface fails and there is no path to peer LACs, the failure initiates termination and clean-up of all the sessions on the MPC.

If the MPC anchoring the LNS sessions itself fails, the Routing Engine does not relocate sessions to another slot and all sessions are terminated immediately. New sessions can come up on another available interface when the client retries.

To configure the service device pool:

You can configure L2TP to dynamically assign inline service interfaces for L2TP tunnels. You must define one or more dynamic profiles and assign a profile to each tunnel group. The LNS supports IPv4-only, IPv6-only, and dual-stack IPv4/IPv6 sessions.

To configure the L2TP dynamic profile: