Authentication

The authentication process for a new session on cMAG-c performs a lookup in the following order:

1. BNG EP for sessions
2. authentication flow

The BNG EP lookup returns the following:

• basic configurations for the CP protocol negotiation (for example, the IPoE profile)
• basic session configuration (for example, subscriber identification)
• the authentication flow used to authenticate the session

The authentication flow contains an ordered list of authentication databases (ADBs). The cMAG-c performs a lookup in each ADB in the list, in the specified order. The lookup returns the following configurations required to create the session:

• session attributes (for example, the SLA profile and the subscriber profile)
• address assignment configuration (for example, the local address pool name)
• optional external AAA authentication (for example, RADIUS)

When both the BNG EP lookup and the authentication flow lookup complete successfully, the cMAG-c creates a full forwarding state on the MAG-u for the session using the session management procedures.

The BNG entry point (EP) provides information needed in the authentication flow.

Use the following command to create a BNG EP.

subscriber-management entry-point

To define the control packet types that trigger the BNG EP lookup, use the following command.

subscriber-management ref-points up fixed-access ibcp-triggers

subscriber-management ref-points up fixed-access entry-point

# info from running /subscriber-management entry-point e1
    admin-state enable
    match 1 {
        attribute up-node-id
    }
    entry 10 {
        admin-state enable
        ipoe {
            authentication-flow {
                authentication-database [
                    adb1
                    adb2
                ]
            }
        }
    }

Each ADB entry contains three groups of configuration parameters:

• match criteria
• action parameters
• session creation parameters (for example, SLA profile)

After the cMAG-c chooses the best matched entry in the ADB, the cMAG-c executes the configured action. The action can be any of the following types:

• reject

  The session authentication fails and no subsequent ADB lookups are performed, even if they are configured as part of the authentication flow.

• accept

  The cMAG-c includes the session creation configuration parameters of the chosen ADB entry for the session creation.

• radius
  The cMAG-c performs the RADIUS authentication using the RADIUS authentication profile. Use the following command to configure the RADIUS authentication profile.

  subscriber-management profiles radius-authentication-profile 

  If the RADIUS authentication succeeds, the cMAG-c includes the returned RADIUS authentication attributes and the session creation configuration parameters for the session creation. If the RADIUS authentication fails, the session authentication fails.

The cMAG-c uses the session creation configuration parameters of all ADBs. The authentication flow contains an ordered list of ADBs. If ADBx comes before ADBy in the ordered list of ADBs, the values of the parameters in ADBy have priority over the values of the parameters in ADBx. For example, an authentication flow contains two ADBs, ADB1 and ADB2. If the matched entry in ADB1 returns sla-profile foo, and the matched entry in ADB2 returns sla-profile bar, a new session is created with sla-profile bar.

If a session creation configuration is not explicitly configured (for example, it equals the default value), the ADB lookup returns no value for this configuration. For example, an authentication flow contains two ADBs, ADB1 and ADB2. If ADB1 returns sla-profile bar, and the matched entry in ADB2 does not contain an explicit configuration for sla-profile (it equals the default value), a new session is created with sla-profile bar.

Some session creation configuration parameters support a special discard keyword. The discard keyword means that the previously returned ADB value for the attribute must be discarded. For example, an authentication flow contains two ADBs, ADB1 and ADB2. If ADB1 returns a value for to-client-dhcp-option-profile and ADB2 configures to-client-dhcp-option-profile discard, the cMAG-c creates the session without to-client-dhcp-option-profile.

An authentication flow contains the following configuration items:

• trigger packet type; for example, DHCPv4 discovery or PPPoE PADI packet
• ordered list of one or more ADBs for the specified trigger packet type

When the MAG-u sends a trigger packet, the cMAG-c performs a lookup in each ADB in the list, in the specified order. Each ADB can return session-related configurations. These session-related configurations can be locally configured or returned from an external AAA server.

An IPoE session has only one authentication flow. A PPPoE session requires at least one of the following independent authentication flows:

• PADI
• PAP/CHAP

If an ADB lookup fails, the session setup fails. The ADB lookup may fail, for example, if an entry is matched with the reject action or if there is an AAA authentication failure.

If all lookups complete successfully, the cMAG-c continues session setup using the combined configurations from all ADB lookups. For example, the BNG EP lookup returns two authentication flows for a new PPPoE session. The authentication flows return the following configuration:

• PADI authentication flow with 1 ADB: ADB1 returns PADO delay value
• PAP/CHAP authentication flow with 2 ADBs: ADB2 configures RADIUS authentication, ADB3 returns a local address pool

In this example, the cMAG-c uses the combined configuration result from the three ADB lookups to set up the PPPoE session.

Each session requires a service configuration, as described in Service selection. The service can also provide override for specific configurations. If different types of sources return the same type of configuration (for example, an address pool name), the cMAG-c uses the value of the source with the highest ranking. The sources are ranked as follows, with the highest ranked first:

1. AAA
2. Local ADB
3. Service

If different sources of the same type (for example, different ADBs) return the same type of configuration, the cMAG-c uses the last returned value. For example, if both ADB1 and ADBN return an SLA profile name, and ADB1 returns SLA profile name X and ADBN returns SLA profile name Y, the system uses SLA profile name Y because it is the last returned value.

Both the BNG EP entries and the ADB entries contain session configuration and one or more ordered match criteria. The match criteria are used in the lookup. The session configuration is used in the creation of the session.

# info from running /subscriber-management authentication-database testdb
    admin-state enable
    match 1 {
        !!! first match criteria is UP node id
        attribute up-node-id
        optional true
    }
    match 2 {
        !!! 2nd match criteria is layer2 access ID
        attribute l2-access-id
        optional true
    }
    match 3 {
        !!! 3rd match criteria is SVLAN
        attribute s-vlan
        optional true
    }
    entry 10 {
        admin-state enable
        match {
            up-node-id 172.16.10.50
            l2-access-id 1/1/2
            s-vlan-range {
                start 100
                end 200
            }
        }
        up-parameters {
            sla-profile entry10
            sub-profile entry10
        }
    }
    entry 20 {
        admin-state enable
        match {
            up-node-id 172.16.10.50
            l2-access-id 1/1/2
        }
        up-parameters {
            sla-profile entry20
            sub-profile entry20
        }
        charging {
            profiles [
                mybngcharging
            ]
        }
    }
    entry 30 {
        admin-state enable
        match {
            l2-access-id 1/1/2
            s-vlan-range {
                start 100
                end 200
            }
        }
        up-parameters {
            sla-profile entry30
            sub-profile entry30
        }
    }
    entry 40 {
        admin-state enable
        match {
            s-vlan-range {
                start 100
                end 200
            }
        }
        up-parameters {
            sla-profile entry40
            sub-profile entry40
        }
    }

To create a session, the cMAG-c requires a minimal number of session creation configuration parameters. The table lists the parameters that are required for session creation, as well as the source that contains those parameters.

subscriber-management profiles radius-authentication-profile

RADIUS authentication is triggered by the ADB lookup. Consequently, it is possible to have multiple rounds of RADIUS authentication during the authentication flow lookup. If the same attributes are returned in the Access-Accept message during multiple authentication rounds, the last attribute received is used.

A RADIUS authentication profile contains the following configuration commands:

• server-selection-profile

  The server-selection-profile command references a RADIUS server selection profile that is defined using the following command.

  subscriber-management profiles radius-server-selection-profile

  The RADIUS server selection profile references one or multiple RADIUS servers configured in the subscriber-management ref-points aaa radius context.

  The RADIUS server configuration contains a server address, port, secret, and other server-specific configuration, while the RADIUS server selection profile contains access-related configuration; for example the access algorithm for selecting the RADIUS server to send the request to from a list of servers.

• user-name-format

  The user-name-format command defines the username format for the RADIUS server.

  Use the data-trigger-source-ip option in the following command to send the source IP address of the data-trigger packet.

  subscriber-management profiles radius-authentication-profile username-format ipoe format 

• password

  The password command defines the password of the RADIUS user.

• include-attribute

  The include-attribute command defines the RADIUS attributes to be included in an Access-Request message. Use the commands in the following context to define the attributes to include.

  subscriber-management profiles radius-authentication-profile include-attributes

  See the cMAG-c RADIUS Attributes and IU Triggers for more information about the attributes and the messages they may appear in.

The username and password configuration are required for IPoE authentication and PPPoE PADI authentication.

A RADIUS Change of Authorization (CoA) message or a Disconnect Message (DM) asks for changes in the session or subscriber object.

subscriber-management ref-points aaa radius dynamic-authorization

The listening address and port are provisioned via the Kubernetes service. See the cMAG-c Installation Guide for more information.

When the cMAG-c receives a CoA or DM message, it makes the requested change to the target object. The cMAG-c RADIUS Attributes and IU Triggers list defines the message attributes that can be used to identify one or multiple sessions as target object. Filter on the value True for the CoA key column to find those attributes in the list. If a subscriber is specified in the request, the cMAG-c applies the requested changes to all sessions of the targeted subscriber.

The CoA message contains one or more attributes that define the requested changes; for example, the Alc-SLA-Prof-Str VSA defines a new SLA profile for the target object. For more information about the supported attributes, see the cMAG-c RADIUS Attributes and IU Triggers.

If the cMAG-c applies all requested changes successfully to all targeted objects, the cMAG-c sends a CoA-ACK message to the RADIUS server. If the cMAG-c can apply the requested changes only partially or only on a subset of the target objects, the cMAG-c sends a CoA-NAK message and rolls back the changes as follows:

• If the change request is for multiple attributes on a single session and only part of the attribute changes are successful, the cMAG-c sends a CoA-NAK message with ERROR-CAUSE code 404, and rolls back the already applied changes.
• If the change request is for multiple attributes on multiple sessions and the changes are successful only for a part of all the target sessions, the cMAG-c sends a CoA-NAK message with ERROR-CAUSE code 506 and rolls back the applied changes for the sessions that were only partially changed. For example, if a CoA message requests to change three attributes on five sessions, the cMAG-c successfully applies all attribute changes on session 1, session 2, and session 3 but only one attribute change on session 4 and session 5. The cMAG-c sends a CoA-NAK message with ERROR-CAUSE code 506 and rolls back the attribute change on session 4 and session 5.

A DM message only contains target objects. The cMAG-c removes the sessions of the target objects and sends an ACK message. If the target objects do not exist, the cMAG-c sends a CoA-NAK message with ERROR-CAUSE code 503.

subscriber-management ref-points aaa radius dynamic-authorization ignore-unknown-attributes

The example configurations in this section are for the following setup:

• IPoE session
• RADIUS authentication
• address pool pool-up-1 for sessions from MAG-u 1.1.1.1
• address pool pool-up-2 for sessions from MAG-u 2.2.2.2
• sla-profile basic, sub-profile basic, and authentication with radius-auth-profile-1 for sessions with s-vlan 100
• sla-profile premium, sub-profile premium, and authentication with radius-auth-profile-2 for sessions with s-vlan 200

This setup uses an authentication flow with three ADBs for which the following are returned:

• ADB adb1 only returns the address pool.
• ADB adb2 only returns the sla-profile and the sub-profile, and performs RADIUS authentication.
• ADB adb3 returns the other configuration parameters.

# info from running /subscriber-management 
  authentication-database adb1 {
        admin-state enable
        match 1 {
            attribute up-node-id
        }
        entry up-1 {
            admin-state enable
            match {
                up-node-id 1.1.1.1
            }
            address-assignment {
                local-dynamic {
                    ipv4-pool pool-up-1
                }
            }
        }
        entry up-2 {
            admin-state enable
            match {
                up-node-id 2.2.2.2
            }
            address-assignment {
                local-dynamic {
                    ipv4-pool pool-up-2
                }
            }
        }
    }
    authentication-database adb2 {
        admin-state enable
        match 1 {
            attribute s-vlan
        }
        entry basic {
            admin-state enable
            match {
                s-vlan 100
            }
            action {
                radius {
                    authentication-profile radius-auth-profile-1
                }
            }
            up-parameters {
                sla-profile basic
                sub-profile basic
            }
        }
        entry premium {
            admin-state enable
            match {
                s-vlan 200
            }
            action {
                radius {
                    authentication-profile radius-auth-profile-1
                }
            }
            up-parameters {
                sla-profile premium
                sub-profile premium
            }
        }
    }
    authentication-database adb3 {
        admin-state enable
        entry default {
            admin-state enable
            service-name mybng
            up-parameters {
                group-interface-template defaultgroup
                sap-template defaultsap
            }
        }
    }

# info from running /subscriber-management 
    entry-point e1 {
        admin-state enable
        entry 10 {
            admin-state enable
            ipoe {
                authentication-flow {
                    authentication-database [
                        adb1
                        adb2
                        adb3
                    ]
                }
            }
        }
    }

subscriber-management ref-points up fixed-access

# info from running /subscriber-management ref-points up fixed-access
    entry-point e1
    ibcp-triggers {
        ipoe-dhcp true
    }