TechLibrary

AAA Services in Subscriber Access Networks
AAA Service Framework Overview RADIUS Attributes and Juniper Networks VSAs Supported by the AAA Service Framework RADIUS Server Options for Subscriber Access Global RADIUS Options for Subscriber Access Retaining Authentication and Accounting Information During Session Startup DNS Address Assignment Precedence Manual Configuration of the NAS-Port-ID RADIUS Attribute Manual Configuration of the NAS-Port-Type RADIUS Attribute RADIUS NAS-Port Options for Subscriber Access per Physical Interface, VLAN, or Stacked VLAN Overview Guidelines for Configuring RADIUS NAS-Port Options for Subscriber Access per Physical Interface, VLAN, or Stacked VLAN Centrally Configured Opaque DHCP Options RADIUS Accounting Statistics for Subscriber Access Overview Understanding RADIUS Accounting Duplicate Reporting Preservation of RADIUS Accounting Information During an Accounting Server Outage RADIUS Acct-On and Acct-Off Messages DNS Name Server Address Overview Understanding Session Options for Subscriber Access Removing Inactive Dynamic Subscriber VLANs AAA Configuration Testing and Troubleshooting

AAA Services in Subscriber Access Networks

AAA Service Framework Overview

RADIUS Attributes and Juniper Networks VSAs Supported by the AAA Service Framework

RADIUS Server Options for Subscriber Access

Global RADIUS Options for Subscriber Access

Retaining Authentication and Accounting Information During Session Startup

DNS Address Assignment Precedence

Manual Configuration of the NAS-Port-ID RADIUS Attribute

Manual Configuration of the NAS-Port-Type RADIUS Attribute

RADIUS NAS-Port Options for Subscriber Access per Physical Interface, VLAN, or Stacked VLAN Overview

Guidelines for Configuring RADIUS NAS-Port Options for Subscriber Access per Physical Interface, VLAN, or Stacked VLAN

Centrally Configured Opaque DHCP Options

RADIUS Accounting Statistics for Subscriber Access Overview

Understanding RADIUS Accounting Duplicate Reporting

Preservation of RADIUS Accounting Information During an Accounting Server Outage

RADIUS Acct-On and Acct-Off Messages

DNS Name Server Address Overview

Understanding Session Options for Subscriber Access

Removing Inactive Dynamic Subscriber VLANs

AAA Configuration Testing and Troubleshooting

Dynamic Service Activation
Using RADIUS Dynamic Requests for Subscriber Access Management Dynamic Service Activation During Login Overview RADIUS-Initiated Change of Authorization (CoA) Overview RADIUS-Initiated Disconnect Overview

Dynamic Service Activation

Using RADIUS Dynamic Requests for Subscriber Access Management

Dynamic Service Activation During Login Overview

RADIUS-Initiated Change of Authorization (CoA) Overview

RADIUS-Initiated Disconnect Overview

RADIUS Attributes and VSA Tables
RADIUS IETF Attributes Supported by the AAA Service Framework Juniper Networks VSAs Supported by the AAA Service Framework AAA Access Messages and Supported RADIUS Attributes and Juniper Networks VSAs for Junos OS AAA Accounting Messages and Supported RADIUS Attributes and Juniper Networks VSAs for Junos OS DSL Forum Vendor-Specific Attributes DSL Forum VSAs Support in AAA Access and Accounting Messages for Junos OS Junos OS Predefined Variables That Correspond to RADIUS Attributes and VSAs Error-Cause Codes (RADIUS Attribute 101) for Dynamic Requests Mapping Application Terminate Reasons and RADIUS Terminate Codes AAA Terminate Reasons DHCP Terminate Reasons L2TP Terminate Reasons PPP Terminate Reasons Configuring Custom Terminate Reason Mappings

RADIUS Attributes and VSA Tables

RADIUS IETF Attributes Supported by the AAA Service Framework

Juniper Networks VSAs Supported by the AAA Service Framework

AAA Access Messages and Supported RADIUS Attributes and Juniper Networks VSAs for Junos OS

AAA Accounting Messages and Supported RADIUS Attributes and Juniper Networks VSAs for Junos OS

DSL Forum Vendor-Specific Attributes

DSL Forum VSAs Support in AAA Access and Accounting Messages for Junos OS

Junos OS Predefined Variables That Correspond to RADIUS Attributes and VSAs

Error-Cause Codes (RADIUS Attribute 101) for Dynamic Requests

Mapping Application Terminate Reasons and RADIUS Terminate Codes

AAA Terminate Reasons

DHCP Terminate Reasons

L2TP Terminate Reasons

PPP Terminate Reasons

Configuring Custom Terminate Reason Mappings

Domain Maps in Subscriber Access Networks
Domain Mapping Overview

Configuration Tasks
Configuring Router or Switch Interaction with RADIUS Servers Configuring Authentication and Accounting Parameters for Subscriber Access Specifying the Authentication and Accounting Methods for Subscriber Access Configuring Per-Subscriber Session Accounting Configuring Per-Service Session Accounting Configuring Service Packet Counting Configuring Back-up Options for RADIUS Accounting Forcing the Router to Contact the Accounting Server Immediately Configuring RADIUS Server Parameters for Subscriber Access Specifying RADIUS Authentication and Accounting Servers for Subscriber Access Configuring RADIUS Server Options for Subscriber Access Configuring RADIUS Options for Subscriber Access Globally Subscriber Access Interface Description Storage and Reporting Through RADIUS Overview Configuring a NAS-Port-ID with Additional Options Configuring a Calling-Station-ID with Additional Attributes Configuring How RADIUS Attributes Are Used for Subscriber Access Configuring RADIUS NAS-Port Options for Subscriber Access per Physical Interface, VLAN, or Stacked VLAN Configuring the RADIUS NAS-Port-Type per Physical Interface Configuring the RADIUS NAS-Port-Type per VLAN Configuring the RADIUS NAS-Port-Type per Stacked VLAN Configuring the RADIUS NAS-Port Extended Format per Physical Interface Configuring the RADIUS NAS-Port Extended Format per VLAN Configuring the RADIUS NAS-Port Extended Format per Stacked VLAN Configuring the RADIUS NAS-Port Extended Format for ATM Interfaces Configuring RADIUS-Initiated Dynamic Request Support

Configuration Tasks

Configuring Router or Switch Interaction with RADIUS Servers

Configuring Authentication and Accounting Parameters for Subscriber Access

Specifying the Authentication and Accounting Methods for Subscriber Access

Configuring Per-Subscriber Session Accounting

Configuring Per-Service Session Accounting

Configuring Service Packet Counting

Configuring Back-up Options for RADIUS Accounting

Forcing the Router to Contact the Accounting Server Immediately

Configuring RADIUS Server Parameters for Subscriber Access

Specifying RADIUS Authentication and Accounting Servers for Subscriber Access

Configuring RADIUS Server Options for Subscriber Access

Configuring RADIUS Options for Subscriber Access Globally

Subscriber Access Interface Description Storage and Reporting Through RADIUS Overview

Configuring a NAS-Port-ID with Additional Options

Configuring a Calling-Station-ID with Additional Attributes

Configuring How RADIUS Attributes Are Used for Subscriber Access

Configuring RADIUS NAS-Port Options for Subscriber Access per Physical Interface, VLAN, or Stacked VLAN

Configuring the RADIUS NAS-Port-Type per Physical Interface

Configuring the RADIUS NAS-Port-Type per VLAN

Configuring the RADIUS NAS-Port-Type per Stacked VLAN

Configuring the RADIUS NAS-Port Extended Format per Physical Interface

Configuring the RADIUS NAS-Port Extended Format per VLAN

Configuring the RADIUS NAS-Port Extended Format per Stacked VLAN

Configuring the RADIUS NAS-Port Extended Format for ATM Interfaces

Configuring RADIUS-Initiated Dynamic Request Support

Configuration Tasks for Access Profiles
Configuring an Access Profile for Subscriber Management Attaching Access Profiles Configuring DNS Name Server Addresses for Subscriber Management Configuring Subscriber Session Options

Configuration Tasks for Access Profiles

Configuring an Access Profile for Subscriber Management

Attaching Access Profiles

Configuring DNS Name Server Addresses for Subscriber Management

Configuring Subscriber Session Options

Configuration Tasks for Domain Maps
Configuring a Domain Map Specifying an Access Profile in a Domain Map Specifying an Address Pool in a Domain Map Specifying a Dynamic Profile in a Domain Map Specifying an AAA Logical System/Routing Instance in a Domain Map Specifying a Target Logical System/Routing Instance in a Domain Map Configuring Domain Name Usage for Domain Maps Specifying Domain Name Delimiters Specifying the Parsing Direction for Domain Names Enabling Domain Name Stripping Specifying a Tunnel Profile in a Domain Map Specifying a Tunnel Switch Profile in a Domain Map Configuring PADN Parameters for a Domain Map

Configuration Tasks for Domain Maps

Configuring a Domain Map

Specifying an Access Profile in a Domain Map

Specifying an Address Pool in a Domain Map

Specifying a Dynamic Profile in a Domain Map

Specifying an AAA Logical System/Routing Instance in a Domain Map

Specifying a Target Logical System/Routing Instance in a Domain Map

Configuring Domain Name Usage for Domain Maps

Specifying Domain Name Delimiters

Specifying the Parsing Direction for Domain Names

Enabling Domain Name Stripping

Specifying a Tunnel Profile in a Domain Map

Specifying a Tunnel Switch Profile in a Domain Map

Configuring PADN Parameters for a Domain Map

Examples
Example: Configuring RADIUS-Based Subscriber Authentication and Accounting Example: Configuring an Address-Assignment Pool Example: Minimum Extended DHCP Local Server Configuration Example: Extended DHCP Local Server Configuration with Optional Pool Matching Example: Minimum DHCP Relay Agent Configuration Example: DHCP Relay Agent Configuration with Multiple Clients and Servers Example: Configuring DHCP Relay Agent Selective Traffic Processing Based on DHCP Option Strings Example: Configuring DHCP and DHCPv6 Relay Agent Group-Level Selective Traffic Processing

Examples

Example: Configuring RADIUS-Based Subscriber Authentication and Accounting

Example: Configuring an Address-Assignment Pool

Example: Minimum Extended DHCP Local Server Configuration

Example: Extended DHCP Local Server Configuration with Optional Pool Matching

Example: Minimum DHCP Relay Agent Configuration

Example: DHCP Relay Agent Configuration with Multiple Clients and Servers

Example: Configuring DHCP Relay Agent Selective Traffic Processing Based on DHCP Option Strings

Example: Configuring DHCP and DHCPv6 Relay Agent Group-Level Selective Traffic Processing

Configuration Statements
[edit access domain] Hierarchy Level [edit access profile] Hierarchy Level [edit interfaces radius-options] Hierarchy Level [edit system services subscriber-management] Hierarchy Level aaa-logical-system aaa-routing-instance access-loop-id-local access-profile access-profile-name accounting accounting-backup-options accounting-port accounting-server accounting-session-id-format accounting-stop-on-access-deny accounting-stop-on-failure address-pool attributes authentication-order authentication-server calling-station-id-delimiter calling-station-id-format client-accounting-algorithm client-authentication-algorithm client-idle-timeout client-session-timeout coa-dynamic-variable-validation coa-immediate-update coa-no-override service-class-attribute database-replication delimiter domain domain-name-server domain-name-server-inet domain-name-server-inet6 duplication duplication-vrf dynamic-profile ethernet-port-type-virtual exclude ignore immediate-update interface-description-format map mask max-outstanding-requests max-pending-accounting-stops max-withhold-time metric nas-identifier nas-port-extended-format (Access Profile) nas-port-extended-format (Interfaces) nas-port-id-delimiter nas-port-id-format nas-port-options nas-port-type nas-port-type (RADIUS Options) options order padn parse-direction port profile radius radius-options radius-options (Interfaces) radius-server report-interface-descriptions request network-access aaa replay pending-accounting-stops request-rate retry revert-interval routing-instance secret send-acct-status-on-config-change session-options source-address stacked-vlan-ranges statistics strip-domain target-logical-system target-routing-instance terminate-code timeout traceoptions (Subscriber Session Database Replication) traceoptions (Subscriber Management) tunnel-profile update-interval vlan-nas-port-stacked-format vlan-ranges vrf-name wait-for-acct-on-ack

Configuration Statements

[edit access domain] Hierarchy Level

[edit access profile] Hierarchy Level

[edit interfaces radius-options] Hierarchy Level

[edit system services subscriber-management] Hierarchy Level

accounting-backup-options

accounting-port

accounting-server

accounting-session-id-format

accounting-stop-on-access-deny

accounting-stop-on-failure

address-pool

attributes

authentication-order

authentication-server

calling-station-id-delimiter

calling-station-id-format

client-accounting-algorithm

client-authentication-algorithm

client-idle-timeout

client-session-timeout

coa-dynamic-variable-validation

coa-immediate-update

coa-no-override service-class-attribute

domain-name-server-inet

domain-name-server-inet6

duplication

duplication-vrf

dynamic-profile

ethernet-port-type-virtual

exclude

ignore

immediate-update

interface-description-format

map

mask

max-outstanding-requests

max-pending-accounting-stops

max-withhold-time

metric

nas-identifier

nas-port-extended-format (Access Profile)

nas-port-extended-format (Interfaces)

nas-port-id-delimiter

nas-port-id-format

nas-port-options

nas-port-type

nas-port-type (RADIUS Options)

radius-options (Interfaces)

radius-server

report-interface-descriptions

request network-access aaa replay pending-accounting-stops

send-acct-status-on-config-change

target-logical-system

target-routing-instance

terminate-code

timeout

traceoptions (Subscriber Session Database Replication)

traceoptions (Subscriber Management)

tunnel-profile

update-interval

vlan-nas-port-stacked-format

vlan-ranges

vrf-name

wait-for-acct-on-ack

Verifying and Managing Configurations
Verifying and Managing Subscriber AAA Information Monitoring Pending RADIUS Accounting Stop Messages Monitoring DHCP Options Configured on RADIUS Servers Verifying and Managing the RADIUS Dynamic-Request Feature Verifying and Managing Domain Map Configuration Testing a Subscriber AAA Configuration

Verifying and Managing Configurations

Verifying and Managing Subscriber AAA Information

Monitoring Pending RADIUS Accounting Stop Messages

Monitoring DHCP Options Configured on RADIUS Servers

Verifying and Managing the RADIUS Dynamic-Request Feature

Verifying and Managing Domain Map Configuration

Testing a Subscriber AAA Configuration

Monitoring Commands
clear network-access aaa statistics clear network-access aaa subscriber show accounting pending-accounting-stops show database-replication statistics show database-replication summary show network-access aaa accounting show network-access aaa radius-servers show network-access aaa statistics show network-access aaa statistics authentication show network-access aaa statistics pending-accounting-stops show network-access aaa subscribers show network-access aaa subscribers session-id show network-access domain-map show subscribers show subscribers summary show system subscriber-management summary test aaa authd-lite user test aaa dhcp user test aaa ppp user

Monitoring Commands

clear network-access aaa statistics

clear network-access aaa subscriber

show accounting pending-accounting-stops

show database-replication statistics

show database-replication summary

show network-access aaa accounting

show network-access aaa radius-servers

show network-access aaa statistics

show network-access aaa statistics authentication

show network-access aaa statistics pending-accounting-stops

show network-access aaa subscribers

show network-access aaa subscribers session-id

show network-access domain-map

show subscribers

show subscribers summary

show system subscriber-management summary

test aaa authd-lite user

test aaa dhcp user

test aaa ppp user

Acquiring Troubleshooting Information
Tracing Subscriber Management Database Operations for Subscriber Access Configuring the Subscriber Management Database Trace Log Filename Configuring the Number and Size of Subscriber Management Database Log Files Configuring Access to the Subscriber Management Database Log File Configuring a Regular Expression for Subscriber Management Database Messages to Be Logged Configuring the Subscriber Management Database Tracing Flags Tracing Subscriber Management Session Database Replication Operations for Subscriber Access Configuring the Subscriber Management Session Database Replication Trace Log Filename Configuring the Number and Size of Subscriber Management Session Database Replication Log Files Configuring Access to the Subscriber Management Session Database Replication Log File Configuring a Regular Expression for Subscriber Management Session Database Replication Messages to Be Logged Configuring the Subscriber Management Session Database Replication Tracing Flags Collecting Subscriber Access Logs Before Contacting Juniper Technical Support Compressing Troubleshooting Logs from /var/logs to Send to Juniper Technical Support

Acquiring Troubleshooting Information

Tracing Subscriber Management Database Operations for Subscriber Access

Configuring the Subscriber Management Database Trace Log Filename

Configuring the Number and Size of Subscriber Management Database Log Files

Configuring Access to the Subscriber Management Database Log File

Configuring a Regular Expression for Subscriber Management Database Messages to Be Logged

Configuring the Subscriber Management Database Tracing Flags

Tracing Subscriber Management Session Database Replication Operations for Subscriber Access

Configuring the Subscriber Management Session Database Replication Trace Log Filename

Configuring the Number and Size of Subscriber Management Session Database Replication Log Files

Configuring Access to the Subscriber Management Session Database Replication Log File

Configuring a Regular Expression for Subscriber Management Session Database Replication Messages to Be Logged