close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Configuring Dynamic VLANs for Subscriber Access Networks
- play_arrow Dynamic VLAN Overview
- play_arrow Configuring Dynamic Profiles and Interfaces Used to Create Dynamic VLANs
- play_arrow Configuring Subscriber Authentication for Dynamic VLANs
- play_arrow Configuring VLANs for Households or Individual Subscribers Using ACI-Based Dynamic VLANs
- play_arrow Configuring VLANs for Households or Individual Subscribers Using Access-Line-Identifier Dynamic VLANs
- play_arrow High Availability for Service VLANs
  - Ethernet OAM Support for Service VLANs Overview
  - Configuring Ethernet OAM Support for Service VLANs with Double-Tagged Customer VLANs
play_arrow Configuring DHCP Subscriber Interfaces
- play_arrow VLAN and Demux Subscriber Interfaces Overview
- play_arrow Configuring Sets of Demux Interfaces to Provide Services to a Group of Subscribers
  - Configuring a Subscriber Interface Using a Set of Static IP Demux Interfaces
  - Configuring a Subscriber Interface Using a Set of Static VLAN Demux Interfaces
- play_arrow Configuring Dynamic Demux Interfaces That are Created by DHCP
  - Configuring Dynamic Subscriber Interfaces Using VLAN Demux Interfaces in Dynamic Profiles
  - Example: Dynamic IP Demux Subscriber Interfaces over Dynamic VLAN Demux Interfaces
- play_arrow Configuring DHCP Subscriber Interfaces over Aggregated Ethernet
- play_arrow Using Dynamic Profiles to Apply Services to DHCP Subscriber Interfaces
  - Dynamic Profile Attachment to DHCP Subscriber Interfaces Overview
  - Attaching Dynamic Profiles to DHCP Subscriber Interfaces or DHCP Client Interfaces
- play_arrow Configuring DHCP IP Demux and PPPoE Demux Interfaces Over the Same VLAN
  - Example: Concurrent Configuration of Dynamic DHCP IP Demux and PPPoE Demux Interfaces over the Same VLAN Demux Interface
- play_arrow Providing Security for DHCP Interfaces Using MAC Address Validation
  - MAC Address Validation for Subscriber Interfaces Overview
  - Configuring MAC Address Validation for Subscriber Interfaces
- play_arrow RADIUS-Sourced Weights for Targeted Distribution
  - RADIUS-Sourced Weights for Interface and Interface Set Targeted Distribution
  - Using RADIUS-Sourced Weights for Interface and Interface Set Targeted Distribution
- play_arrow Verifying Configuration and Status of Dynamic Subscribers
  - Verifying Configuration and Status of Dynamic Subscribers and Associated Sessions, Services, and Firewall Filters
play_arrow Configuring PPPoE Subscriber Interfaces
- play_arrow Configuring Dynamic PPPoE Subscriber Interfaces
- play_arrow Configuring PPPoE Subscriber Interfaces over Aggregated Ethernet Examples
- play_arrow Configuring PPPoE Session Limits
- play_arrow Configuring PPPoE Subscriber Session Lockout
- play_arrow Configuring MTU and MRU for PPP Subscribers
  - Understanding MTU and MRU Configuration for PPP Subscribers
  - Configuring MTU and MRU for PPP Subscribers
- play_arrow Configuring PPPoE Service Name Tables
- play_arrow Changing the Behavior of PPPoE Control Packets
- play_arrow Monitoring and Managing Dynamic PPPoE for Subscriber Access
  - Verifying and Managing Dynamic PPPoE Configuration
play_arrow Configuring MLPPP for Subscriber Access
- play_arrow MLPPP Support for LNS and PPPoE Subscribers Overview
- play_arrow Configuring MLPPP Link Fragmentation and Interleaving
- play_arrow Configuring Inline Service Interfaces for LNS and PPPoE Subscribers
- play_arrow Configuring L2TP Access Client for MLPPP Subscribers
  - Configuring L2TP Client Access to Support MLPPP for Static Subscribers
  - Configuring L2TP Client Access to Support MLPPP for Dynamic Subscribers
- play_arrow Configuring Static MLPPP Subscribers for MX Series
  - Example: Configuring Static LNS MLPPP Subscribers
  - Example: Configuring Static PPPoE MLPPP Subscribers
- play_arrow Configuring Dynamic MLPPP Subscribers for MX Series
  - Example: Configuring Dynamic LNS MLPPP Subscribers
  - Example: Configuring Dynamic PPPoE MLPPP Subscribers
- play_arrow Configuring Dynamic PPP Subscriber Services
- play_arrow Monitoring and Managing MLPPP for Subscriber Access
  - MLPPP Subscriber Accounting Statistics Overview
play_arrow Configuring ATM for Subscriber Access
- play_arrow Configuring ATM to Deliver Subscriber-Based Services
- play_arrow Configuring PPPoE Subscriber Interfaces Over ATM
- play_arrow Configuring ATM Virtual Path Shaping on ATM MICs with SFP
  - Configuring ATM Virtual Path Shaping on ATM MICs with SFP
- play_arrow Configuring Static Subscriber Interfaces over ATM
- play_arrow Verifying and Managing ATM Configurations
  - Verifying and Managing ATM Configurations for Subscriber Access
play_arrow Troubleshooting
- play_arrow Contacting Juniper Networks Technical Support
  - Collecting Subscriber Access Logs Before Contacting Juniper Networks Technical Support
- play_arrow Knowledge Base
  - Juniper Knowledge Base
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

keyboard_arrow_right

Configuring Lockout of PPPoE Subscriber Sessions

date_range 06-Dec-23

arrow_backward

arrow_forward

You can configure the router to temporarily lock out a failed or short-lived PPPoE subscriber session from reconnecting for a period of time. The PPPoE subscriber session can reside on a VLAN, VLAN demux, or PPPoE-over-ATM underlying interface.

Before you begin:

Configure the PPPoE underlying interface.

To configure the underlying interface for use with a PPPoE dynamic profile, see Configuring an Underlying Interface for Dynamic PPPoE Subscriber Interfaces.

To configure the PPPoE family for an underlying interface, see Configuring the PPPoE Family for an Underlying Interface.

To configure temporary lockout of PPPoE subscriber sessions:

Specify that you want to configure PPPoE-specific options on the underlying interface:

For a PPPoE family in a dynamic profile for a VLAN demultiplexing (demux) logical interface:
```
[edit dynamic-profiles profile-name interfaces demux0 unit logical-unit-number]
user@host# edit family pppoe
```

For a PPPoE family in a dynamic profile:

content_copy zoom_out_map
[edit dynamic-profiles profile-name interfaces interface-name unit logical-unit-number]
user@host# edit family pppoe

For a PPPoE underlying interface in a dynamic profile:

content_copy zoom_out_map
[edit dynamic-profiles profile-name interfaces interface-name unit logical-unit-number]
user@host# edit pppoe-underlying-options

For a PPPoE family on an underlying interface:

content_copy zoom_out_map
[edit interfaces interface-name unit logical-unit-number]
user@host# edit family pppoe

For an underlying interface with PPPoE encapsulation:

content_copy zoom_out_map
[edit interfaces interface-name unit logical-unit-number]
user@host# edit pppoe-underlying-options

For a PPPoE family in a dynamic profile for a PPPoE-over-ATM logical interface:

content_copy zoom_out_map
[edit dynamic-profiles profile-name interfaces at-fpc/pic/port unit logical-unit-number]
user@host# edit family pppoe

For a PPPoE family on an underlying ATM logical interface:

content_copy zoom_out_map
[edit interfaces at-fpc/pic/port unit logical-unit-number]
user@host# edit family pppoe

Enable duplicate protection to prevent negotiation of a dynamic or static PPPoE client session on the same underlying interface when a PPPoE client session with the same media access control (MAC) source address is already active on that interface.
```
[edit interfaces interface-name unit logical-unit-number pppoe-underlying-options] 
user@host# set duplicate-protection
```
Best Practice:
When you configure PPPoE subscriber session lockout, we recommend that you enable duplicate protection to ensure that the MAC source address for each PPPoE session is unique on the underlying interface.
Enable PPPoE subscriber session lockout using one of the following filtering mechanisms to identify the subscriber sessions for lockout:
- Media access control (MAC)-address based subscriber session lockout (default)
  - To configure MAC-based subscriber session lockout with the default lockout period of 1 through 300 seconds:
    [edit interfaces interface-name unit logical-unit-number pppoe-underlying-options] user@host# set short-cycle-protection
  - To configure MAC-based subscriber session lockout with a nondefault lockout period:
    [edit interfaces interface-name unit logical-unit-number pppoe-underlying-options] user@host# set short-cycle-protection lockout-time-min minimum-seconds lockout-time-max maximum-seconds
- Agent circuit identifier (ACI)-based subscriber session lockout
  - To configure ACI-based subscriber session lockout with the default lockout period:
    [edit interfaces interface-name unit logical-unit-number pppoe-underlying-options] user@host# set short-cycle-protection filter aci
    For example, the following statement configures temporary lockout based on ACI information for subscriber sessions on a dynamic VLAN demux underlying interface. It uses the default lockout time range 1 through 300 seconds.
    [edit dynamic-profiles my-demux-vlan-profile interfaces demux0 unit “$junos-interface-unit” family pppoe] user@host# set short-cycle-protection filter aci
  - To configure ACI-based subscriber session lockout with a nondefault lockout period:
    [edit interfaces interface-name unit logical-unit-number pppoe-underlying-options] user@host# set short-cycle-protection lockout-time-min minimum-seconds lockout-time-max maximum-seconds filter aci
    For example, the following statement configures temporary lockout based on ACI information for subscriber sessions on a dynamic VLAN underlying interface. It specifies a nondefault lockout time in the range 20 through 120 seconds.
    [edit dynamic-profiles my-vlan-profile interfaces “$junos-interface-ifd-name” unit “$junos-interface-unit” pppoe-underlying options] user@host# set short-cycle-protection lockout-time-min 20 lockout-time-max 120 filter aci
  Note:
  If the ACI value is not present in the PPPoE attributes when you configure ACI-based subscriber session lockout, the router uses MAC-based lockout by default. With ACI-based encapsulation type lockout, PPPoE clients without an ACI attribute are also locked out.

arrow_backward PREVIOUS Understanding the Lockout Period for PPPoE Subscriber Session Lockout

NEXT arrow_forward Clearing Lockout of PPPoE Subscriber Sessions

Broadband Subscriber VLANs and Interfaces User Guide

Configuring Lockout of PPPoE Subscriber Sessions

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Broadband Subscriber VLANs and Interfaces User Guide

Configuring Lockout of PPPoE Subscriber Sessions

Related Documentation

Stay in touch