Dual-Stack Access Models in a DHCP Network

Figure 1 shows a dual-stack interface stack in a DHCP access network. The IPv4 family (inet) and the IPv6 family (inet6) can reside on the same VLAN interface.

Figure 1: Dual-Stack Interface Stack over a DHCP Access Network

You can use the AAA Service Framework for all authentication, authorization, accounting, address assignment, and dynamic request services that the BNG uses for network access. The framework supports authentication and authorization through external RADIUS servers. It also supports accounting and dynamic-request change of authorization (CoA) and disconnect operations through external servers, and address assignment through a combination of local address-assignment pools and RADIUS servers.

The BNG interacts with external servers to determine how individual subscribers access the broadband network. The BNG can also obtain information from external servers for the following:

• How subscribers are authenticated.

• How accounting statistics are collected and used.

• How dynamic requests, such as CoA, are handled.

As shown in Figure 2, an implementation of dual stack over a DHCP access network, there are separate AAA sessions for IPv4 and IPv6 authentication and accounting.

Figure 2: AAA Service Framework in a Dual Stack over a DHCP Access Network

• Collection of Accounting Statistics in a DHCP Access Network
• Change of Authorization (CoA)

Figure 3 shows a dual-stack interface stack in a DHCP wholesale network. In this scenario, the IPv4 and IPv6 demux interfaces are configured on the same VLAN interface. The demux interfaces are configured in a separate logical system:routing instance.

Figure 3: Dual-Stack Interface Stack in a DHCP Wholesale Network

In the dual-stack over a dynamic VLAN, the single-session dual-stack requires only a single session for authentication, as opposed to the three sessions required for the traditional dual-stack configuration. Accounting support for the dual-stack also uses a single session. In addition to reducing the number of sessions required, the single-session feature also simplifies router configuration, reduces RADIUS message load, and improves accounting session performance for households with dual-stack environments.

In the single-session dual-stack environment, the first DHCP session that negotiates will trigger the dynamic VLAN creation (if required) and is authorized at the DHCP application. The second leg of the dual-stack is held off until the authorization point is complete. When the second leg of the dual stack is established, the DHCP client inherits all common subscriber database values, such as circuit-id, remote-id, username, and interface name from the first leg.

In Figure 4, single subscriber session is established for dual-stack user.

Figure 4: DHCP Dual Stack Single-Session Subscriber Deployment Model

You can configure single-session dual-stack subscriber settings for DHCP relay agent and DHCP local server. You use the dual-stack-group statement to create a named group that specifies the values for dual stack subscribers. Then, you use the dual-stack statement to specify the name of the dual stack group and assign the group to subscribers at the global, group, or interface level.

• For DHCP relay agent, configure these statements at the [edit forwarding-options dhcp-relay] hierarchy level and the [edit forwarding-options dhcp-relay ... overrides] hierarchy level, respectively,

• For DHCP local server, configure these statements at the [edit system services dhcp-local-server] hierarchy level and the [edit system services dhcp-local-server ... overrides] hierarchy level, respectively,

You can configure the following common DHCP settings for the single-session dual-stack model. In most cases, these settings are similar to those used for separate DHCPv4 and DHCPv6 legs in a traditional dual-stack configuration. When configured and referenced, the dual-stack configuration takes precedence over the same items configured under the respective family.

• access-profile—Access profile that provides authentication and accounting parameters for the dual-stack group that take precedence over those configured in a global access profile or in a profile configured for the DHCP relay agent or DHCP local server.

• authentication—Authentication-related parameters (such as password and username) the router sends to the external AAA server.

  The dual-stack authentication stanza is similar to the stanza available separately for the v4 and v6 address families. When the username-include configuration syntax is used for the DHCPv4 leg of the dual-stack, the relay-agent-interface-id option is equivalent to the DHCPv4 relay-option-82 circuit-id statement, and the relay-agent-remote-id option is equivalent to the DHCPv4 relay-option-82 remote-id statement. You do not have to configure the two DHCPv4 options separately.

• classification-key—Classification key defines mechanism to be used to identify a dual stack household.

• dual-stack-interface-client-limit—Limits the number of dual stack subscribers login per interface.

  Note:

  For dual-stack subscribers, always use this statement instead of the interface-client-limit statement.

• dynamic-profile—Dynamic profile that is attached to all interfaces, to a named group of interfaces, or to a specific interface.

• liveness-detection—Configure an active liveness detection protocol that deletes the binding and releases the resources if the subscriber fails to respond to a configured number of consecutive liveness detection requests, the subscriber.

• on-demand-address-allocation—(DHCP local server) Designates whether on-demand address allocation mode is forced for a dual-stack subscriber.

  If this configuration is not present, all IP addresses and prefixes for IPv4 and IPv6 families of a dual stack subscriber will be preallocated when the first leg of a dual stack subscriber initially logs in.

  If this configuration is present when the first leg of a dual-stack subscriber initially logs in, RADIUS authentication is performed (if configured) and the IP address and prefix of this first family only will be allocated. The IP address and prefix for the other family will not be allocated unless the other family leg subsequently initially logs in.

  Note:

  The IP address allocation for the second family is informed by the RADIUS authentication previously performed at the time of the first family login.

  Starting in Junos OS Release 18.4R1, the method of address allocation is checked to determine subsequent behavior when authd notifies the DHCP process that an address pool is deleted or being drained. Table 1 describes the behavior.

  Table 1: Behavior When Address Pool is Deleted or Drained

  Address Allocation Method	Address Pool is Drained	Address Pool is Deleted
  On demand	Family with address in pool is logged out gracefully when a DHCP renew or rebind message is received.	Family with address in pool is logged out immediately.
  Preallocated	Addresses for both families are deleted gracefully when a DHCP renew or rebind message is received.	Addresses for both families are deleted immediately.

• protocol-master—This term designates either an IPv4 or IPv6 family as the primary family for a dual stack subscriber. The secondary family client binding login-in will be rejected until a valid client binding is in place for the primary family.

  CAUTION:

  If the secondary family binding is logged out for any reason, then only the secondary family binding will be torn down.

  If the primary family binding is logged out for any reason, then the corresponding bindings for both the primary and secondary families will be torn down.

• reauthenticate—(DHCP local server) Configure reauthentication of the subscriber to initiate change characteristics such as service activations/deactivations and attribute modifications.

• relay-agent-interface-id—(DHCP relay agent) Includes Relay Agent Interface-ID (option 18) in DHCPv6 packets destined for the DHCPv6 server. You can configure numerous options to specify what is included in the circuit ID value.

  For the DHCPv4 leg of the dual-stack, this statement includes the DHCPv4 relay-option-82 circuit-id in packets destined for the DHCPv4 server.

• relay-agent-remote-id—(DHCP relay agent) Includes Relay Agent Remote-ID (option 37) in DHCPv6 packets destined for a DHCPv6 server. You can configure numerous options to specify what is included in the remote ID value.

  For the DHCPv4 leg of the dual-stack, this statement includes the DHCPv4 relay-option-82 remote-id in packets destined for the DHCPv4 server.

• service-profile—Dynamic profile for the default subscriber service (or the default DHCP client management service), which is activated when the subscriber (or client) logs in.

• short-cycle protection—Detect and lock out short-lived client sessions and clients that repeatedly fail session negotiation to reduce resource usage associated with connection and authentication processing in highly scaled networks.

• Purpose
• Action