ESMv6: IPoE Dual Stack Hosts

Configuring IPoE dual stack hosts for ESMv6 are dependent on the following.

• Routed CO (IES/VPRN service) with Enhanced Subscriber Management (ESM)

• Routed Gateway (RG) in the home

An IPoE dual stack subscriber may support both IPv4 and IPv6 simultaneously. The dual stack hosts share a common subscriber identification policy and have a common SLA- and Subscriber-profile.

IPoE IPv4 and IPv6 hosts operate independently because they are set up through different protocols, DHCPv4 and DHCPv6 respectively.

For a stateful IPoE dual stack subscriber, up to three different types of subscriber hosts can be instantiated.

In services supporting dual stack IPoE Routed Gateways, the RG in the home network obtains an IPv4 address through the DHCPv4 protocol and an IPv6 Prefix Delegation (PD) prefix and/or wan-host IPv6 address through the DHCPv6 protocol. The Broadband Network Gateway (BNG) authenticates and authorizes both sessions independently.

In the home network, the dual stack RG performs Network Address Translation (NAT) for IPv4, using the assigned IPv4 address as outside address. A globally unique IPv6 prefix per subscriber is assigned and delegated by the BNG to the RG for use in the home network. The RG can use Stateless Address Auto Configuration (SLAAC) or DHCPv6 to allocate IPv6 addresses from this so called Prefix Delegation (PD) prefix to the devices in the home network. The wan-host IPv6 address is used by the RG on the WAN side (network facing). In case of an unnumbered RG, no wan-host address is obtained.

The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) is defined in RFC 3315, Dynamic Host Configuration Protocol for IPv6 (DHCPv6). The protocol enables DHCPv6 servers to pass configuration parameters such as IPv6 network addresses to IPv6 nodes.

DHCPv6 uses the Identity Association (IA) option to assign IPv6 addresses or prefixes. Two different IA types will be used in this section:

• Identity Association for Non-temporary Address (IA-NA) defined in RFC 3315. Used for wan-host IPv6 address assignment.

       Option : IA_NA (3), Length : 40
         IAID : 1
         Time1: 1800 seconds
         Time2: 2880 seconds
         Option : IAADDR (5), Length : 24
           Address : 2001:db8:b001:101::1
           Preferred Lifetime : 3600 seconds
           Valid Lifetime     : 86400 seconds
  

• Identity Association for Prefix Delegation (IA-PD), defined in RFC 3633. Used for prefix delegation assignment (for an explanation on prefix delegation, see Prefix Delegation)

       Option : IA_PD (25), Length : 41
         IAID : 1
         Time1: 1800 seconds
         Time2: 2880 seconds
         Option : IAPREFIX (26), Length : 25
           Prefix : 2001:db8:a001:103::/56
           Preferred Lifetime : 3600 seconds
           Valid Lifetime     : 86400 seconds
  

The DHCPv6 lease process is outlined in DHCPv6 Lease Process (Part A) and DHCPv6 Lease Process (Part B).

A DHCPv6 client, sends a Solicit message to locate servers to the All DHCPv6 Relay Agents and Servers link-scoped multicast address (FF02::1:2), using its link-local address as source address. The DHCPv6 client includes in the Solicit message its ClientID, Identity Associations (IA) to request IPv6 address or prefix allocation and optionally an Option Request option.

Any on-link DHCPv6 server responds with a unicasted Advertise message using the link local addresses. The server includes in the Advertise message the ClientID, its ServerID, IPv6 addresses and/or prefixes in Identity Associations (IA) and options containing the requested configuration parameters.

The DHCPv6 client selects an Advertise message and sends a Request message to the All DHCPv6 Relay Agents and Servers link-scoped multicast address. It includes its ClientID, the ServerID of the corresponding DHCPv6 server, Identity Associations (IA) to request IPv6 address or prefix allocation and optionally an Option Request option.

Upon receipt of a valid Request message, the DHCPv6 server with corresponding ServerID, sends a unicast Reply message using the link local addresses. The Reply contains the ClientID and ServerID, IPv6 addresses and/or prefixes in Identity Associations (IA) and options containing the requested configuration options.

The DHCPv6 client should perform Duplicate Address Detection (DAD) on the addresses in any IA it received in the REPLY before using that address for traffic.

Upon expiration of the renew timer T1 associated with the Identity Association option, the DHCPv6 client sends a Renew to the All DHCPv6 Relay Agents and Servers link-scoped multicast address to request an extension of the lifetime of an address. It includes its ClientID, the ServerID of the DHCPv6 server that originally provided the address, and Identity Associations (IA) containing the IPv6 address or prefix for which an extension of the lifetime is requested.

Upon expiration of the rebind timer T2 associated with the Identity Association option (no response received to the Renew), the DHCPv6 client sends a Rebind to the All DHCPv6 Relay Agents and Servers link-scoped multicast address to request an extension of the lifetime of an address. It includes its ClientID and Identity Associations (IA) containing the IPv6 address or prefix for which an extension of the lifetime is requested.

If a DHCPv6 client no longer uses one or more of the assigned addresses or prefixes, it sends a Release message to the server that assigned the address or prefix. The server acknowledges with a Reply message and includes a status code (for example, success).

If the DHCPv6 server sends a Server Unicast Option, then the DHCPv6 client should unicast the Request, Renew Release, and Decline messages to the server using the IPv6 address specified in the option. The 7750 SR DHCPv6 proxy server does not include the Server Unicast Option.

The DHCPv6 client should perform Duplicate Address Detection (DAD) on each of the addresses assigned through DHCPv6, before using that address for traffic. The DHCPv6 client uses Neighbor Solicitation for this purpose as described in RFC 4862, IPv6 Stateless Address AutoConfiguration.

Unlike DHCPv4, DHCPv6 does not provide a default route. In IPv6, default routes are learned via Router Advertisements (see Enable Router Advertisements).

Prefix Delegation (PD) is a mechanism for automated delegation of IPv6 prefixes using DHCPv6. A delegating router delegates a long-lived IPv6 prefix to a requesting router. The delegating router does not require knowledge about the topology of the links in the network to which the prefixes will be assigned.

In the context of ESM IPv6, the BNG is the delegating router (DHCPv6 server) and the Routed Gateway in the home is the requesting router (DHCPv6 client). The DHCPv6 option Identity Association for Prefix Delegation (IA-PD) (Prefix Delegation) is used to assign the IPv6 prefix.

Note that the mechanism through which a requesting router (routed gateway) assigns IPv6 addresses on its interfaces (home network) is arbitrary and can be based upon SLAAC (as shown in Prefix Delegation) or DHCPv6.

RADIUS is used for authentication and authorization (later referenced as RADIUS), and is configured as follows:

configure
    router
        radius-server
            server "radius-172.16.1.2" address 172.16.1.2 secret vsecret1 create
                accept-coa
            exit
        exit
    exit
exit
 
configure
    aaa
        radius-server-policy "rsp-1" create
            servers
                router "Base"
                source-address 192.0.2.1
                server 1 name "radius-172.16.1.2"
            exit
        exit
    exit
exit
 
configure
    subscriber-mgmt
        authentication-policy "auth-1" create
            description "RADIUS authentication policy"
            pppoe-access-method pap-chap
            radius-server-policy "rsp-1"
            password letmein
        exit
    exit
exit

The subscriber management profiles used in this chapter are defined as follows:

configure
    subscriber-mgmt
        sla-profile "sla-profile-1" create
        exit
        sub-profile "sub-profile-1" create
        exit
        sub-ident-policy "sub-ident-1" create
            sub-profile-map
                use-direct-map-as-default
            exit
            sla-profile-map
                use-direct-map-as-default
            exit
            strings-from-option 254
        exit
    exit
exit

Service VPRN-1 is defined as follows:

configure
    service
        vprn 1 customer 1 create
            dhcp
                local-dhcp-server "dhcp-s1" create
                    use-gi-address
                    pool "pool-1" create
                        subnet 10.1.0.0/16 create
                            options
                                subnet-mask 255.255.0.0
                                default-router 10.1.255.254
                            exit
                            address-range 10.1.0.1 10.1.0.255 
                        exit
                    exit
                    no shutdown
                exit
            exit
            ---snip---
            interface "system" create
                address 192.0.2.1/32
                local-dhcp-server "dhcp-s1"
                loopback
            exit
            subscriber-interface "sub-int-1" create
                address 10.1.255.254/16
                dhcp
                    gi-address 10.1.255.254
                exit
                ipv6
                    delegated-prefix-len 56
                    subscriber-prefixes
                        prefix 2001:db8:a001::/48 pd
                        prefix 2001:db8:b001:100::/56 wan-host
                    exit
                exit
                group-interface "grp-int-1" create
                    description "radius authentication and authorization"
                    ipv6
                        router-advertisements
                            managed-configuration
                            no shutdown
                        exit
                        dhcp6
                            proxy-server
                                no shutdown
                            exit
                        exit
                    exit
                    dhcp
                        proxy-server
                            emulated-server 10.1.255.254
                            no shutdown
                        exit
                        server 192.0.2.1
                        trusted
                        lease-populate 10
                        no shutdown
                    exit
                    authentication-policy "auth-1"
                    sap 1/1/1:1 create
                        sub-sla-mgmt
                            sub-ident-policy "sub-ident-1"
                            multi-sub-sap 10
                            no shutdown
                        exit
                    exit
                exit
                ---snip---
            exit
            service-name "dual-stack-service"
            no shutdown
        exit
    exit
exit

The Local User Database used for authentication and authorization (later referenced as LUDB) is defined as follows:

configure
    subscriber-mgmt
        local-user-db ludb-1 create
            ipoe
                match-list mac
                host "host-3" create
                    host-identification
                        mac 00:0c:29:00:00:23
                    exit
                    address gi-address
                    identification-strings 254 create
                        subscriber-id "sub-3"
                        sla-profile-string "sla-profile-1"
                        sub-profile-string "sub-profile-1"
                    exit
                    options
                        subnet-mask 255.255.0.0
                        default-router 10.1.255.254
                    exit
                    ipv6-address 2001:db8:b001:103::3
                    ipv6-delegated-prefix 2001:db8:a001:300::/56
                    ipv6-delegated-prefix-len 56
                    options6
                        dns-server 2001:db8:dddd:1::1 2001:db8:dddd:2::1
                    exit
                    no shutdown
                exit
                ---snip---
            exit
            no shutdown
        exit
    exit
exit

Service VPRN-1 is extended as follows:

configure
    service
        vprn 1 customer 1 create
            ---snip---
            subscriber-interface "sub-int-1" create
                address 10.1.255.254/16
                dhcp
                    gi-address 10.1.255.254
                exit
                ipv6
                    delegated-prefix-len 56
                    subscriber-prefixes
                        prefix 2001:db8:a001::/48 pd
                        prefix 2001:db8:b001:100::/56 wan-host
                    exit
                exit
                group-interface "grp-int-2" create
                    description "ludb authentication and authorization"
                    ipv6
                        router-advertisements
                            prefix-options
                                autonomous
                            exit
                            no shutdown
                        exit
                        dhcp6
                            user-db "ludb-1"
                            proxy-server
                                client-applications ipoe
                                no shutdown
                            exit
                        exit
                    exit
                    dhcp
                        proxy-server
                            emulated-server 10.1.255.254
                            no shutdown
                        exit
                        server 192.0.2.1
                        trusted
                        lease-populate 10
                        user-db "ludb-1"
                        no shutdown
                    exit
                    sap 1/1/1:2 create
                        sub-sla-mgmt
                            def-sub-profile "sub-profile-1"
                            def-sla-profile "sla-profile-1"
                            sub-ident-policy "sub-ident-1"
                            multi-sub-sap 10
                            no shutdown
                        exit
                    exit
                exit
            exit
            service-name "dual-stack-service"
            no shutdown
        exit
    exit
exit

Applies to both scenarios RADIUS and LUDB.

IPv6 subscriber prefixes must be defined at the subscriber-interface>ipv6>subscriber-prefixes context. Three types of prefixes can be configured:

• wan-host — Prefix from which the IPv6 addresses are assigned that are to be used on the Routed Gateway WAN interface (network facing).

• pd — Prefix from which the IPv6 Prefix Delegation prefixes are assigned that are to be used by the Routed Gateway for allocation in the home network (LAN interfaces).

• pd wan-host (both) — Prefix from which both IPv6 addresses (wan-host) and IPv6 Prefix Delegation prefixes (pd) can be assigned. This requires that the delegated prefix length is set to 64 bits.

A subscriber prefix length must be between /32 and /63.

Subscriber prefixes are subnetted in fixed length subnets that are assigned to subscriber hosts:

• /64 for wan-host subscriber prefixes

  A /128 IPv6 address is assigned to the subscriber host. Broadband Forum standards require a /64 prefix per subscriber even when used for WAN interfaces and thus the full /64 subnet gets associated with the subscriber host [ref. WT-177 - IPv6 in the context of TR-101]. Two subscriber hosts cannot get an IPv6 address from the same /64 subnet.

• /delegated-prefix-len (/48..64) for pd subscriber prefixes

  The delegated prefix length is configured in the subscriber-interface>ipv6 context. The recommended value by Broadband Forum standards is /56 (default = /64) [ref. WT-177 - IPv6 in the context of TR-101]. The configured length applies to all pd subscriber prefixes on a subscriber-interface.

Applicable Subscriber-Prefix Parameters provides an overview of the subscriber-prefix parameters that apply:

(*) must be smaller than configured delegated prefix length

Applies to RADIUS and LUDB scenarios.

An IPv6 IPoE subscriber host initiates a DHCPv6 session to request its configuration data (IPv6 addresses and/or IPv6 PD prefixes, DNS servers). Upon receipt of a DHCPv6 Solicit message, the BNG authenticates the IPv6 subscriber host and obtains its configuration information from a RADIUS server or local user database. A DHCPv6 proxy server in the BNG maintains the DHCPv6 session with the IPv6 IPoE subscriber host.

The DHCPv6 proxy server must be enabled in the subscriber-interface>group-interface>ipv6>dhcp6>proxy-server context. The default is shutdown.

configure
    service
        vprn 1 customer 1 create
            subscriber-interface "sub-int-1"
                group-interface "grp-int-1"
                    ipv6
                        dhcp6
                            proxy-server
                                server-id duid-ll
                                renew-timer min 30
                                rebind-timer min 48
                                valid-lifetime days 1
                                preferred-lifetime hrs 1
                                client-applications dhcp
                                no shutdown
                            exit
                        exit
                    exit
                exit
            exit
        exit
    exit
exit

When enabled, the DHCPv6 proxy server by default allows IPv6 IPoE hosts to authenticate (configured with client-applications dhcp). Additionally, you can enable support for IPv6 PPPoE hosts. See ESMv6: PPPoE Dual Stack Hosts.

A number of timers associated with IPv6 addresses and IPv6 prefixes within DHCPv6 Identity Associations can be configured in the DHCPv6 proxy server.

RFC 4862 defines two timers associated with graceful degradation of address bindings:

• Preferred lifetime — The length of time that a valid address is preferred (the time until deprecation). When the preferred lifetime expires, the address becomes deprecated and its use should be discouraged for new sessions.

• Valid lifetime — The length of time an address remains in the valid state (the time until invalidation). The valid lifetime must be greater than or equal to the preferred lifetime. When the valid lifetime expires, the address becomes invalid.

RFC 3315, DHCPv6, defines two timers associated with an Identity Association (IA) option that give the servers explicit control over when a client recontacts the server about a specific IA:

• T1 (renew) — The time at which the client contacts the server from which the addresses/prefix in the IA were obtained to extend the lifetimes of the addresses/prefix assigned to the IA

• T2 (rebind) — The time at which the client contacts any available server to extend the lifetimes of the addresses/prefixes assigned to the IA;

These timers are common for all DHCPv6 sessions in a group-interface and cannot be configured from RADIUS or local user database.

When violating the following rule, the default timers will be used:

If the DHCPv6 lease is not renewed by the client before the DHCPv6 lease timer expires, then the subscriber host is deleted from the system. In other words, beyond the valid lifetime, subscriber traffic from/to the associated IPv6 addresses is dropped.

Applies to both scenarios RADIUS and LUDB.

In IPv6, default routes are automatically installed via the router discovery mechanism. Unsolicited Router Advertisements (RA) must explicitly be enabled on a group interface. The default is shutdown.

configure
    service
        vprn 1 customer 1 create
            subscriber-interface "sub-int-1"
                group-interface "grp-int-1"
                    ipv6
                        router-advertisements
                            managed-configuration
                            no shutdown
                        exit
                    exit
                exit
            exit
        exit
    exit
exit

The managed-configuration flag is set for consistency only. It tells the hosts that addresses can be requested using DHCPv6. However, as described in the Security section later (see Security), the host cannot rely on this flag because DHCPv6 must be initiated by the host before the BNG sends RAs.

Additional parameters that can be configured with respect to the router advertisements (defaults are shown):

configure
    service
        vprn 1 customer 1 create
            subscriber-interface "sub-int-1"
                group-interface "grp-int-1"
                    ipv6
                        router-advertisements
                            shutdown
                            current-hop-limit 64
                            dns-options
                                no include-dns
                                rdnss-lifetime 3600
                            exit
                            no force-mcast
                            no managed-configuration
                            max-advertisement 1800
                            min-advertisement 900
                            no mtu
                            no other-stateful-configuration
                            prefix-options
                                no autonomous
                                on-link
                                preferred-lifetime 3600
                                valid-lifetime 86400
                            exit
                            reachable-time 0
                            retransmit-time 0
                            router-lifetime 4500
                        exit
                    exit
                exit
            exit
        exit
    exit
exit

Applies to the RADIUS scenario only.

The RADIUS authentication and authorization configuration for IPoE IPv6 subscriber host is no different from an IPv4 subscriber host:

configure
    router
        radius-server
            server "radius-172.16.1.2" address 172.16.1.2 secret vsecret1 create
                accept-coa
            exit
        exit
    exit
exit
 
configure
    aaa
        radius-server-policy "rsp-1" create
            servers
                router "Base"
                source-address 192.0.2.1
                server 1 name "radius-172.16.1.2"
            exit
        exit
    exit
exit
 
configure
    subscriber-mgmt
        authentication-policy "auth-1" create
            description "RADIUS authentication policy"
            pppoe-access-method pap-chap
            radius-server-policy "rsp-1"
            password letmein
        exit
    exit
exit

Additional RADIUS AVPs that are applicable to IPoE IPv6 subscriber hosts are listed in RADIUS AVPs.

A sample FreeRADIUS users record to authenticate a dual stack IPoE subscriber:

00:0c:20:00:00:21 Cleartext-Password := "letmein"
        Alc-Subsc-ID-Str = "sub-1",
        Alc-Subsc-Prof-Str = "sub-profile-1",
        Alc-SLA-Prof-Str = "sla-profile-1",
        Framed-IP-Address = 10.1.0.1,
        Framed-IP-Netmask = 255.255.0.0,
        Framed-Route = "172.16.11.0/24 0.0.0.0",
        Alc-Ipv6-Address = 2001:db8:b001:101::1,
        Delegated-IPv6-Prefix = 2001:db8:a001:100::/56,
        Alc-Ipv6-Primary-Dns = 2001:db8:dddd:1::1,
        Alc-Ipv6-Secondary-Dns = 2001:db8:dddd:2::1,

The FreeRADIUS Server 2.0.0 and greater has full support for both IPv6 attributes and IPv6 network packets.

The IPv6 address/prefix related timers can be configured in the dhcp6>proxy-server context (see Enable DHCPv6 Proxy Server).

Applies to the LUDB scenario only.

The configuration example below focuses on the IPv6 host configuration. The details for local user database host matching and IPv4 host specific parameters are out of scope for this section.

configure
    subscriber-mgmt
        local-user-db "ludb-1" create
            dhcp
                match-list mac 
                host "host-1" create
                    host-identification
                        mac 00:0c:29:00:00:23
                    exit
                    address gi-address                       # IPv4 host
                    identification-strings 254 create
                        subscriber-id "sub-3"
                        sla-profile-string "sla-profile-1"
                        sub-profile-string "sub-profile-1"
                    exit
                    options
                        subnet-mask 255.255.0.0                  # IPv4 host
                        default-router 10.1.255.254              # IPv4 host
                    exit
                    ipv6-address 2001:db8:b001:103::3             # IPv6 host
                    ipv6-delegated-prefix 2001:db8:a001:300::/56  # IPv6 host
                    options6
                        dns-server 2001:db8:dddd:1::1 2001:db8:dddd:2::1
                    exit
                    no shutdown
                exit
            exit
            no shutdown
        exit
    exit
exit

configure
    service
        vprn 1 customer 1 create
            subscriber-interface "sub-int-1" create
                group-interface "grp-int-2" create
                    description "ludb authentication and authorization"
                    ipv6
                        ---snip---
                        dhcp6
                            user-db "ludb-1"
                            proxy-server
                                client-applications dhcp
                                no shutdown
                            exit
                        exit
                    exit
                    dhcp
                        ---snip---
                        server 192.0.2.1
                        trusted
                        lease-populate 10
                        user-db "ludb-1"
                        no shutdown
                    exit
                exit
            exit
        exit
    exit
exit

Besides the identification strings that are common to theIPv4 and IPv6 hosts, specific IPv6 host related parameters can be configured:

The IPv6 address/prefix related timers can be configured in the dhcp6>proxy-server context (see Enable DHCPv6 Proxy Server).

Applies to both scenarios RADIUS and LUDB.

The DHCP lease state is an internal database structure that keeps track of the DHCP host states. The DHCP lease state enables subscriber management functions (for example, per subscriber QoS and accounting) and security functions (for example, dynamic anti-spoof filtering) on the DHCP host.

The DHCP lease information for a specific host is extracted from the DHCPv4 ack message in case of DHCPv4 and from the DHCPv6 reply message in case of DHCPv6

Typical information stored in the DHCP lease state includes (partial table; additional data can be stored for managed SAPs, wholesale-retail).

DHCPv4 lease state population is enabled by default on a group-interface with DHCP configured as no shutdown. The number of DHCPv4 leases allowed on each SAP of the group-interface must be configured with the lease-populate option (by default a single DHCPv4 host is allowed on each SAP of the group-interface).

DCHPv6 lease state population is enabled by default on a group-interface with DHCP6 proxy-server configured as no shutdown. The number of DHCPv6 leases (hosts) cannot be limited per group-interface.

configure
    service
        vprn 1 customer 1 create
            subscriber-interface "sub-int-1" create
                group-interface "grp-int-1" create
                    description "radius authentication and authorization"
                    ipv6
                        dhcp6
                            proxy-server
                                no shutdown
                            exit
                        exit
                    exit
                    dhcp
                        proxy-server
                            emulated-server 10.1.255.254
                            no shutdown
                        exit
                        server 192.0.2.1
                        trusted
                        lease-populate 10
                        no shutdown
                    exit
                exit
            exit
        exit
    exit
exit

To check the DHCPv4 or DHCPv6 lease state for a particular service, use the following commands (detailed output as well as additional output filtering is available):

*A:BNG# show service id 1 dhcp | dhcp6 lease-state ?

  - lease-state [wholesaler <service-id>] [sap <sap-id>|sdp <sdp-id:vc-id>|
    interface <interface-name>|ip-address <ip-address[/mask]>|chaddr 
    <ieee-address>|mac <ieee-address>|{[port <port-id>][no-inter-dest-id |
     inter-dest-id <inter-dest-id>]}] [session {none|ipoe}] [detail]

*A:BNG# show service id 1 dhcp lease-state detail

===============================================================================
DHCP lease states for service 1
===============================================================================
Service ID           : 1
IP Address           : 10.1.0.1
Client HW Address    : 00:0c:29:00:00:21
Subscriber-interface : sub-int-1
Group-interface      : grp-int-1
SAP                  : 1/1/1:1
Termination Type     : local
Up Time              : 0d 00:58:34
Remaining Lease Time : 6d 23:01:26
Remaining SessionTime: N/A
Persistence Key      : 0x00000000

Sub-Ident            : "sub-1"
Sub-Profile-String   : "sub-profile-1"
SLA-Profile-String   : "sla-profile-1"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : ""
Category-Map-Name    : ""

Lease Info origin    : Radius

Ip-Netmask           : 255.255.0.0
Broadcast-Ip-Addr    : 10.1.255.255
Default-Router       : N/A
Primary-Dns          : N/A
Secondary-Dns        : N/A
Primary-Nbns         : N/A
Secondary-Nbns       : N/A

ServerLeaseStart     : 04/20/2017 13:01:09
ServerLastRenew      : 04/20/2017 13:01:09
ServerLeaseEnd       : 04/27/2017 13:01:09
Session-Timeout      : N/A
IPoE|PPP session     : No
Lease-Time           : 7d 00:00:00
DHCP Server Addr     : N/A
Radius User-Name     : "00:0c:29:00:00:21"
-------------------------------------------------------------------------------
Number of lease states : 1
===============================================================================
*A:BNG#

*A:BNG# show service id 1 dhcp6 lease-state detail
 
===============================================================================
DHCP lease states for service 1
===============================================================================
Service ID           : 1
IP Address           : 2001:db8:a001:100::/56
Client HW Address    : 00:0c:29:00:00:21
Subscriber-interface : sub-int-1
Group-interface      : grp-int-1
SAP                  : 1/1/1:1
Termination Type     : local
Up Time              : 0d 00:55:11
Remaining Lease Time : 0d 23:34:49
Remaining SessionTime: N/A
Persistence Key      : 0x0000000b
 
Sub-Ident            : "sub-1"
Sub-Profile-String   : "sub-profile-1"
SLA-Profile-String   : "sla-profile-1"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : ""
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00010001208a25ac000c29000021
Dhcp6 IAID           : 1
Dhcp6 IAID Type      : prefix
Dhcp6 Client Ip      : fe80::20c:29ff:fe00:21
Primary-Dns          : 2001:db8:dddd:1::1
Secondary-Dns        : 2001:db8:dddd:2::1
Pool Name            : ""
Dhcp6 Server Addr    : N/A
Dhcp6 ServerId (DUID): N/A
Dhcp6 InterfaceId    : N/A
Dhcp6 RemoteId       : N/A
Radius sub-if prefix : N/A
Router adv. policy   : N/A
 
Lease Info origin    : Radius
 
ServerLeaseStart     : 04/20/2017 13:06:36
ServerLastRenew      : 04/20/2017 13:36:36
ServerLeaseEnd       : 04/21/2017 13:36:36
Session-Timeout      : N/A
IPoE|PPP session     : No
Radius User-Name     : "00:0c:29:00:00:21"
-------------------------------------------------------------------------------
Service ID           : 1
IP Address           : 2001:db8:b001:101::1/128
Client HW Address    : 00:0c:29:00:00:21
Subscriber-interface : sub-int-1
Group-interface      : grp-int-1
SAP                  : 1/1/1:1
Termination Type     : local
Up Time              : 0d 00:55:11
Remaining Lease Time : 0d 23:34:49
Remaining SessionTime: N/A
Persistence Key      : 0x0000000a
 
Sub-Ident            : "sub-1"
Sub-Profile-String   : "sub-profile-1"
SLA-Profile-String   : "sla-profile-1"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : ""
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00010001208a25ac000c29000021
Dhcp6 IAID           : 2
Dhcp6 IAID Type      : non-temporary
Dhcp6 Client Ip      : fe80::20c:29ff:fe00:21
Primary-Dns          : 2001:db8:dddd:1::1
Secondary-Dns        : 2001:db8:dddd:2::1
Pool Name            : ""
Dhcp6 Server Addr    : N/A
Dhcp6 ServerId (DUID): N/A
Dhcp6 InterfaceId    : N/A
Dhcp6 RemoteId       : N/A
Radius sub-if prefix : N/A
Router adv. policy   : N/A
 
Lease Info origin    : Radius
 
ServerLeaseStart     : 04/20/2017 13:06:36
ServerLastRenew      : 04/20/2017 13:36:36
ServerLeaseEnd       : 04/21/2017 13:36:36
Session-Timeout      : N/A
IPoE|PPP session     : No
Radius User-Name     : "00:0c:29:00:00:21"
-------------------------------------------------------------------------------
Number of lease states : 2
===============================================================================
*A:BNG#

An IPoE dual stack subscriber in a numbered Routed Gateway scenario consumes three subscriber host entries:

• IPv4 host — DHCPv4 session based

• IPv6 wan-host — DHCPv6 session based

• IPv6 Prefix Delegation host — DHCPv6 session based

*A:BNG# show service active-subscribers
 
===============================================================================
Active Subscribers
===============================================================================
-------------------------------------------------------------------------------
Subscriber sub-1 (sub-profile-1)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:1/1/1:1 - sla:sla-profile-1
-------------------------------------------------------------------------------
IP Address
                MAC Address          Session        Origin       Svc        Fwd
-------------------------------------------------------------------------------
10.1.0.1
                00:0c:29:00:00:21    N/A            DHCP         1          Y
2001:db8:a001:100::/56
                00:0c:29:00:00:21    N/A            DHCP6        1          Y
2001:db8:b001:101::1/128
                00:0c:29:00:00:21    N/A            DHCP6        1          Y
-------------------------------------------------------------------------------
 
-------------------------------------------------------------------------------
Subscriber sub-3 (sub-profile-1)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:1/1/1:2 - sla:sla-profile-1
-------------------------------------------------------------------------------
IP Address
                MAC Address          Session        Origin       Svc        Fwd
-------------------------------------------------------------------------------
10.1.0.8
                00:0c:29:00:00:23    N/A            DHCP         1          Y
2001:db8:a001:300::/56
                00:0c:29:00:00:23    N/A            DHCP6        1          Y
2001:db8:b001:103::3/128
                00:0c:29:00:00:23    N/A            DHCP6        1          Y
-------------------------------------------------------------------------------
 
-------------------------------------------------------------------------------
Number of active subscribers : 2
===============================================================================
*A:BNG#

The optional hierarchy parameter for the active-subscribers display provides a top-down level overview for this subscriber:

*A:BNG# show service active-subscribers hierarchy
 
===============================================================================
Active Subscribers Hierarchy
===============================================================================
-- sub-1 (sub-profile-1)
   |
   +-- sap:1/1/1:1 - sla:sla-profile-1
       |
       |-- 10.1.0.1 - mac:00:0c:29:00:00:21 - DHCP - svc:1
       |
       |-- 2001:db8:a001:100::/56 - mac:00:0c:29:00:00:21 - DHCP6 - svc:1
       |
       +-- 2001:db8:b001:101::1/128 - mac:00:0c:29:00:00:21 - DHCP6 - svc:1
 
-- sub-3 (sub-profile-1)
   |
   +-- sap:1/1/1:2 - sla:sla-profile-1
       |
       |-- 10.1.0.8 - mac:00:0c:29:00:00:23 - DHCP - svc:1
       |
       |-- 2001:db8:a001:300::/56 - mac:00:0c:29:00:00:23 - DHCP6 - svc:1
       |
       +-- 2001:db8:b001:103::3/128 - mac:00:0c:29:00:00:23 - DHCP6 - svc:1
 
-------------------------------------------------------------------------------
Number of active subscribers : 2
Flags: (N) = the host or the managed route is in non-forwarding state
===============================================================================
*A:BNG#

The total number (sum) of IPv4 and IPv6 hosts per subscriber can be limited in the corresponding sla-profile with the host-limits parameter:

configure
    subscr-mgmt
        sla-profile "sla-profile-1" create
            host-limits
                overall 3
            exit
        exit
    exit
exit

To display the IPv4/IPv6 routing table for dual stack hosts:

*A:BNG# show router 1 route-table ipv4 protocol sub-mgmt
 
===============================================================================
Route Table (Service: 1)
===============================================================================
Dest Prefix[Flags]                            Type    Proto     Age        Pref
      Next Hop[Interface Name]                                    Metric
-------------------------------------------------------------------------------
10.1.0.1/32                                   Remote  Sub Mgmt  01h05m03s  0
       [grp-int-1]                                                  0
10.1.0.8/32                                   Remote  Sub Mgmt  00h00m49s  0
       [grp-int-2]                                                  0
-------------------------------------------------------------------------------
No. of Routes: 2
Flags: n = Number of times nexthop is repeated
       B = BGP backup route available
       L = LFA nexthop available
       S = Sticky ECMP requested
===============================================================================
*A:BNG#

*A:BNG# show router 1 route-table ipv6 protocol sub-mgmt
 
===============================================================================
IPv6 Route Table (Service: 1)
===============================================================================
Dest Prefix[Flags]                            Type    Proto     Age        Pref
      Next Hop[Interface Name]                                    Metric
-------------------------------------------------------------------------------
2001:db8:a001:100::/56                        Remote  Sub Mgmt  01h00m03s  0
       [grp-int-1]                                                  0
2001:db8:a001:300::/56                        Remote  Sub Mgmt  00h03m00s  0
       [grp-int-2]                                                  0
2001:db8:b001:101::1/128                      Remote  Sub Mgmt  01h00m03s  0
       [grp-int-1]                                                  0
2001:db8:b001:103::3/128                      Remote  Sub Mgmt  00h03m00s  0
       [grp-int-2]                                                  0
-------------------------------------------------------------------------------
No. of Routes: 4
Flags: n = Number of times nexthop is repeated
       B = BGP backup route available
       L = LFA nexthop available
       S = Sticky ECMP requested
===============================================================================
*A:BNG#

Apart from the show commands in this chapter, the following additional commands can be used for troubleshooting:

• Default system log

• Debug

• Statistics

The default system log can be shown as follows:

A:BNG-1# show log log-id 99

Use appropriate filtering to reduce the output if needed.

Debugging can be done with the definitions as follows:

debug
    router "Base"
        radius
            packet-type authentication accounting coa
            detail-level high
        exit
    exit
    router "1"
        ip
            dhcp
                detail-level high
                mode egr-ingr-and-dropped
            exit
            dhcp6
                mode egr-ingr-and-dropped
                detail-level high
            exit
            icmp6
        exit
        local-dhcp-server "dhcp-s1"
            detail-level medium
            mode egr-ingr-and-dropped
        exit
    exit
    subscriber-mgmt
        local-user-db "ludb-1"
            detail all
        exit
    exit
exit

Additional filtering (such as only DHCPv6 debug for a particular interface) may be needed to prevent a flood of debug messages.

DHCPv4 statistics can be shown as follows:

*A:BNG# show router 1 dhcp statistics
 
====================================================================
DHCP Global Statistics (Service: 1)
====================================================================
Rx Packets                           : 86
Tx Packets                           : 36
Rx Malformed Packets                 : 0
Rx Untrusted Packets                 : 0
Client Packets Discarded             : 12
Client Packets Relayed               : 46
Client Packets Snooped               : 4
Client Packets Proxied (RADIUS)      : 24
Client Packets Proxied (Diameter)    : 0
Client Packets Proxied (User-Db)     : 0
Client Packets Proxied (Lease-Split) : 0
Server Packets Discarded             : 0
Server Packets Relayed               : 25
Server Packets Snooped               : 0
DHCP RELEASEs Spoofed                : 0
DHCP FORCERENEWs Spoofed             : 0
Client packets streamed              : 0
====================================================================
*A:BNG#

DHCPv6 statistics can be shown as follows:

*A:BNG# show router 1 dhcp6 statistics
 
===========================================================================
DHCP6 statistics (Router: 1)
===========================================================================
Msg-type                      Rx             Tx             Dropped
---------------------------------------------------------------------------
1 SOLICIT                     6              0              0
2 ADVERTISE                   0              6              0
3 REQUEST                     6              0              0
4 CONFIRM                     0              0              0
5 RENEW                       1              0              0
6 REBIND                      0              0              0
7 REPLY                       0              11             0
8 RELEASE                     4              0              0
9 DECLINE                     0              0              0
10 RECONFIGURE                0              0              0
11 INFO_REQUEST               0              0              0
12 RELAY_FORW                 0              0              0
13 RELAY_REPLY                0              0              0
14 LEASEQUERY                 0              0              0
15 LEASEQUERY_REPLY           0              0              0
 
---------------------------------------------------------------------------
Dhcp6 Drop Reason Counters :
---------------------------------------------------------------------------
 1 Dhcp6 oper state is not Up on src itf                         0
 2 Dhcp6 oper state is not Up on dst itf                         0
 3 Relay Reply Msg on Client Itf                                 0
 4 Hop Count Limit reached                                       0
 5 Missing Relay Msg option, or illegal msg type                 0
 6 Unable to determine destination client Itf                    0
 7 Out of Memory                                                 0
 8 No global Pfx on Client Itf                                   0
 9 Unable to determine src Ip Addr                               0
10 No route to server                                            0
11 Subscr. Mgmt. Update failed                                   0
12 Received Relay Forw Message                                   0
13 Packet too small to contain valid dhcp6 msg                   0
14 Server cannot respond to this message                         0
15 No Server Id option in msg from server                        0
16 Missing or illegal Client Id option in client msg             0
17 Server Id option in client msg                                0
18 Server DUID in client msg does not match our own              0
19 Client sent message to unicast while not allowed              0
20 Client sent message with illegal src Ip address               0
21 Client message type not supported in pfx delegation           0
22 Nbr of addrs or pfxs exceeds allowed max (128) in msg         0
23 Unable to resolve client's mac address                        0
24 The Client was assigned an illegal address                    0
25 Illegal msg encoding                                          0
26 Client message not supported                                  0
27 IA options in info request                                    0
28 No IA option in client msg                                    0
29 No addresses in confirm msg                                   0
30 No relay servers configured                                   0
31 Blocked by host lockout                                       0
32 No link address available                                     0
33 Dropped by Python                                             0
34 Invalid server                                                0
35 Packet dropped on SRRP backup interface                       0
36 DHCP transaction not found                                    0
37 Could not determine retail interface                          0
38 Packet dropped by DHCP filter                                 0
39 Packet dropped because authentication failed                  0
===========================================================================
*A:BNG#

RADIUS statistics can be shown as follow:

*A:BNG# show subscriber-mgmt authentication "auth-1" statistics
 
===============================================================================
Authentication Policy Statistics
===============================================================================
-------------------------------------------------------------------------------
Policy name                               : auth-1
subscriber packets authenticated          : 0
subscriber packets rejected               : 0
subscriber packets rejected send failed   : 0
-------------------------------------------------------------------------------
===============================================================================
*A:BNG#

*A:BNG# show aaa radius-server-policy "rsp-1" statistics
 
===============================================================================
RADIUS server policy "rsp-1" statistics
===============================================================================
Tx transaction requests                         : 24
Rx transaction responses                        : 24
Transaction requests timed out                  : 0
Transaction requests send failed                : 0
Packet retries                                  : 0
Transaction requests send rejected              : 0
Authentication requests failed                  : 4
Accounting requests failed                      : 0
Ratio of access-reject over auth responses      : 16%
Transaction success ratio                       : 100%
Transaction failure ratio                       : 0%
Statistics last reset at                        : n/a
 
Server 1 "radius-172.16.1.2" address 172.16.1.2 auth-port 1812 acct-port 1813
-------------------------------------------------------------------------------
Tx request packets                              : 24
Rx response packets                             : 24
Request packets timed out                       : 0
Request packets send failed                     : 0
Request packets send failed (overload)          : 0
Request packets waiting for reply               : 0
Response packets with invalid authenticator     : 0
Response packets with invalid msg authenticator : 0
Authentication packets failed                   : 4
Accounting packets failed                       : 0
Avg auth response delay (10 100 1K 10K) in ms   :   1.25    168    168    168
Avg acct response delay (10 100 1K 10K) in ms   : n/a
Statistics last reset at                        : n/a
 
===============================================================================
*A:BNG#