For feedback and comments:
documentation.feedback@alcatel-lucent.com

Table of Contents Previous Next Index PDF

Flexible Authentication Model in ESM
In This Chapter
This section provides information about Flexible Authentication Models in ESM.
Topics in this section include:
•
Applicability
•
Overview
•
Configuration
•
Conclusion
Applicability
This example is applicable to Routed Central Office (RCO) model on 7750 SR-7/12/12e, 7750 SR-c4/12 and 7450 ESS 7/12 in mixed-mode with IOM3-XP or IMM.
The configuration was tested on release 11.0R2 in a single-homed scenario.
 
Overview
The flexible authentication model for IPoE and PPPoE subscribers allows for mixing of configuration parameters obtained during the authentication phase from different sources: LUDB, RADIUS or Local User Database (LUDB), RADIUS or DHCP options that can be populated via a custom Python script. In case the same parameter is available from multiple sources, a priority mechanism is enforced whereby the parameter received from a higher priority source overrides the parameters received from the lower priority source in the following priority LUDB to RADIUS to Python.
In this example we will configure a dual-stack IPoE and a dual stack PPPoE host using 4 different methods to obtain their configuration parameters. The setup will utilize a single 7x50 BNG node with a locally configured DHCP server and LUDB as well as an external RADIUS server. Subscriber hosts are instantiated on managed (dynamic) SAPs.
The subscriber configuration parameters are in general divided into two categories:
•
IP addressing parameters of the host — IPv4/v6 address/prefix, DNS servers, IPv4 default-gateway, IPv4 subnet-mask, IPv4/v6 address pool name, DHCPv4/v6 lease times, etc.
•
Non IP addressing parameters of the host — Subscriber hosts strings are used to associate the subscriber-host with the desired level of service (sub/sla-profiles, inter-dest-id string, etc); managed routes are used for routing purposes to/from the host; etc.
The following four scenarios will be examined:
1.
DHCP relay case (IP address is assigned via local DHCP server) with NO authentication. See .
2.
DHCP relay case (IP address is assigned via local DHCP server) with LUDB + RADIUS authentication. See .
RADIUS provides: sub/sla-profile strings and a framed IPv4 route.
LUDB provides: IP address pool, inter-dest-id string for Vport assignment, msap-defaults (routing context parameters and msap-policy).
3.
IP proxy case (IP address is assigned via RADIUS) with LUDB + RADIUS authentication.
RADIUS provides: IP addresses1 and related parameters (DNS server, IPv4 default-gateway, etc), inter-dest-id string for Vport assignment and a framed route.
LUDB provides: sub/sla-profile strings and msap-defaults (routing context parameters and msap-policy).
4.
IP proxy case (IP address is assigned via LUDB) with LUDB + RADIUS authentication.
RADIUS provides: sub/sla-profile strings and a framed IPv4 route.
LUDB provides IP addresses and related parameters (DNS server, IPv4 default-gateway, etc), inter-dest-id string for Vport assignment and msap-defaults (routing context parameters and msap-policy).
In cases 2-4, the domain-name alu-domain is appended to the IPoE and PPPoE username in LUDB, just before RADIUS authentication takes place.
Configuration
The topology is shown in Figure 370.
Figure 370: Topology
There is a common part of the configuration that applies uniformly across all four examined scenarios. This common part is outlined below and will not be repeated again when we describe more specific cases. It is assumed that the more specific cases also contain this common part of the configuration.
 
Common Configuration Examples
 
Access Ethernet Port with QinQ Encapsulation
The following output displays a configuration example.
configure port 1/1/5 
     ethernet
        mode access
        encap-type qinq           
     exit
     no shutdown
 
Capture SAP
A capture SAP is used to dynamically detect the VLAN id(s) in incoming DHCP/PPPoE packets (triggering packets) and conditionally instantiate the managed (dynamic) SAP. LUDB must be configured under the capture SAP to authorize the user accessing the capture SAP. The LUDB may contain additional parameters needed to setup the subscriber, it can point the subscriber to the RADIUS server for additional parameters or it may contain a default subscriber-host entry without any configuration parameters.
In this case the msap-defaults under the capture SAP is used to select the routing context where the msap is created. msap-defaults can be also configured in the LUDB or be supplied via RADIUS.
PPPoE policy and msap policy are used to define PPPoE and SAP level parameters. Since the (dynamic) SAP does not exist at the time when the initial DHCP/PPPoE packets are received, the PPPoE/SAP level parameters are taken from the PPPoE/msap policy under the capture SAP. For example, those parameters are used in the PPP PADx/LCP/Authentication setup phase, they define default subscriber host strings, maximum number of subscriber hosts per SAP, the anti-spoofing mode, etc.
	configure service vpls 2
		sap 1/1/5:17.* capture-sap create
	 	description "open DHCP model testing"
	 	trigger-packet dhcp dhcp6 pppoe 
	 	dhcp-user-db "open-dhcp"
	 	dhcp6-user-db "open-dhcp"
	 	pppoe-policy "pppoe_pol"
	 	pppoe-user-db "open-dhcp"
	 	msap-defaults		 
	 		group-interface "open-auth"
	 	policy "msaps"
	 	service 10
	 	exit
	exit
auto-sub-id
The auto-sub-id-key command can be used in situations where the more specific subscriber-id string is not returned from LUDB or RADIUS. In this case, the auto subscriber-id for IPoE hosts is set to the circuit-id while for PPPoE hosts the auto subscriber-id is set to the circuit-id plus session-id separated by the “|”delimiter which is inserted by default.
	configure subscriber-mgmt auto-sub-id-key 
		ipoe-sub-id-key circuit-id 
		ppp-sub-id-key circuit-id session-id
PPPoE Policy
There is a maximum of PPPoE sessions per MAC on a managed SAP. The default is 1 but is increased here to 10.
	configure subscriber-mgmt ppp-policy "pppoe_pol" 
	 	ppp-mtu 1400
	 	max-sessions-per-mac 10 
 
 
MSAP Policy
The MSAP policy defines the anti-spoofing mode which is in this particular example set to next-hop MAC (nh-mac). It also defines the default subscriber management parameters in case they are not supplied via LUDB or RADIUS.
	configure subscriber-mgmt msap-policy <msap-policy-name> create
		sub-sla-mgmt
		 	def-sub-id use-auto-id
		 	def-sub-profile "default-sub-profile"
		 	def-sla-profile "default-sla"
	 		sub-ident-policy "sub_ident_pol"
	 		multi-sub-sap limit 500
  		exit
   		ies-vprn-only-sap-parameters
		 	anti-spoof nh-mac 
   		exit
 
 
subscriber-interface Configuration
The following output displays a subscriber interface configuration.
configure service vprn 10
	subscriber-interface "sub-int-1" create
	 	allow-unmatching-subnets 								Support for ‘un-numbered’2 IPv4 clients.
 	 	address 10.12.0.1/24 								Default gateway for IPv4 ‘numbered’ clients.
 	 	ipv6
   	 		delegated-prefix-len 56							Fixed delegated prefix length for IA-PD.
   	 		allow-unmatching-prefixes							Support for ‘un-numbered’ IPv6 clients.
   	 	exit
   	 	group-interface "open-auth" create
   	 		ipv6
    	 			router-advertisements
            			 		managed-configuration 					Hint to the client to use DHCPv6.
        				 	no shutdown 					Enabling Router-Advertisements.
				exit 
				dhcp6
             				 	user-db "open-dhcp" 					Must be the same as under the capture-sap.
 				exit                       
       		 	exit
        			arp-populate 							ARP table is populated based on the lease-state table.
          			dhcp                   
          			 	trusted 						Accept DHCP packets on this group-interface.
          				lease-populate 1000 						Max number of DHCPv4 clients on each SAP of
										this grp-intf.
            				user-db "open-dhcp" 						Must be the same as under the capture-sap.
        		 	exit
			pppoe
          				policy "pppoe_pol"
         			 	session-limit 1000
         			 	sap-session-limit 1000
         				user-db "open-dhcp" 						Must be the same as under the capture-sap.
           			 	no shutdown
       		 	exit
 
Specific Configuration Parts
 
DHCP Relay Case with No Authentication
The IP address is assigned via local DHCP server. The LUDB is accessed even in the scenario without authentication. There must be a default host LUDB entry present that will match on any value specified in the match-list criteria. The LUDB is accessed from the capture SAP (part of the common configuration). 
	configure subscriber-mgmt local-user-db "open-dhcp" create
	 	dhcp
	 		match-list circuit-id 								Host matching based on circuit-id in DHCP packets.
 	 		host "default" create
      				no shutdown
      		exit
  	 	exit
    		ppp
     			match-list username 								Host matching based on PPPoE username.
      			host "default" create 		 		force-ipv6cp			Explicitly enabled IPCPv6.
          				no shutdown
       			exit
   		exit
    		no shutdown
 
Once the routing context (service id and group-interface) is determined as defined under the capture SAP defaults (part of the common configuration), the DHCP/PPPoE requests are served according to the group-interface configuration. The IP address request is relayed to the DHCPv4/v6 server. Since the LUDB does not provide a pool name, the gi-address and the link-address is used by the DHCP relay/server to select the pool from which the IP address will be assigned.
	configure service vprn 10 subscriber-interface "sub-int-1" group-interface "open-auth" create 
		ipv6
			dhcp6      		                          
			relay 								DHCPv6 relay configuration.
				link-address 2001:DB8:1::
				server 2001:DB8::1			DHCPv6 server IPv6 address.
				client-applications dhcp ppp 
				no shutdown
			exit
		exit	
	exit
	dhcp                  
		server 10.10.1.1 									DHCPv4 server IP address.
		client-applications dhcp ppp
		gi-address 10.12.0.1
		no shutdown
	exit
 
 
DHCPv4/v6 servers are locally configured in the 7x50 and attached to a loopback interface. 
	configure service vprn 10 interface "loop-dhcp-srvr" 
		address 10.10.1.1/24		IPv4 					Address to which is DHCPv4 server attached.
		ipv6
			address 2001:DB8::1/128	 IPv6 address to which is DHCPv6 server attached.
			local-dhcp-server "v6" 						Attaching DHCPv6 server to the loopback intf.
			exit
		local-dhcp-server "local"	Attaching DHCPv4 server to the loopback intf.
		loopback
 
In the local DHCP servers two pools are defined:
•
LUDB — To be used for IP address assignment when LUDB returns the pool name.
•
Gi-addr — To be used when gi-address/link-address are used to select the pool for IP address assignment.
Lease times for IPv4 and IPv6 are configured in the local DHCP server which is used only in the relay case (when the IP address is supplied via DHCP server and not through RADIUS or the LUDB).
configure service  vprn 10
	dhcp
   		local-dhcp-server "local" create
      		use-gi-address 			The gi-address can be used to select the pool.
          use-pool-from-client 									The pool name can be explicitly provided.
          pool "ludb" create		The pool used when LUDB provides the pool name.
          	options
                	dns-server 172.16.16.16 172.16.16.17
               	lease-time hrs 1	DHCPv4 lease time.
             	exit
           	subnet 10.10.0.0/24 create
              	options
                 	subnet-mask 255.255.255.0
                   	default-router 10.10.0.1
                	exit
               	address-range 10.10.0.100 10.10.0.200 
            	exit
       	exit                
        	pool "gi-addr" create								Pool selected based on the gi-address.
           	options
              	dns-server 172.16.16.16 172.16.16.17
              	lease-time hrs 1								DHCPv4 lease time.
            	exit
             subnet 10.12.0.0/24 create
           		options
                 	subnet-mask 255.255.255.0
                  	default-router 10.12.0.1
                	exit
                 	address-range 10.12.0.100 10.12.0.200 
                	exit
            	exit
       		no shutdown
      		exit
      	exit
    	dhcp6                     
      		local-dhcp-server "v6" create
            	use-link-address 
             	use-pool-from-client
             	pool "ludb" create
            		prefix 2001:DB8:10::/48 pd wan-host create
               		preferred-lifetime min 30 
                   	rebind-timer min 20 
                   	renew-timer min 15 
                   	valid-lifetime hrs 1								DHCPv6 lease time.
                   	options
                    	dns-server 2001:DB8::1000 2001:DB8::1001
                  	exit
               	exit
            	exit
            	pool "gi-addr" create
               	prefix 2001:DB8:30::/48 pd wan-host create
                 	preferred-lifetime min 30 
                   	rebind-timer min 20 
                  	renew-timer min 15 
                 	valid-lifetime hrs 1	DHCPv6 lease time.
                   	options
                   		dns-server 2001:DB8::1000 2001:DB8::1001
                		exit
              	exit
             	exit
         		no shutdown
 
Default sub/sla-profiles, from the msap-policy, are used (part of the common configuration).
configure  subscriber-mgmt sla-profile "default-sla"
description "default SLA profile"
  	host-limit 3
 
configure  subscriber-mgmt sub-profile "default-sub-profile" 
 	description "default SUB profile"
 	egress
  		agg-rate-limit 1000 
  	exit
 
 
Show Commands
The following command shows that the default sub/sla-profiles are in use, that the IP addresses are selected from the gi-addr pool in local DHCP server and that the subscriber-id is set to circuit-id for the IPoE subscriber-host and to username|session-id combination for the PPPoE subscriber-host.
A:BNG-1# show service  active-subscribers 
===============================================================================
Active Subscribers
===============================================================================
-------------------------------------------------------------------------------
Subscriber open-dhcp (default-sub-profile)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.10] - sla:default-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.12.0.101
                00:00:65:17:10:01 N/A       DHCP
2001:DB8:30::1/128
                00:00:65:17:10:01 N/A       IPoE-DHCP6
2001:DB8:30:100::/56
                00:00:65:17:10:01 N/A       IPoE-DHCP6
-------------------------------------------------------------------------------
Subscriber open-pppoe|2 (default-sub-profile)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.11] - sla:default-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.12.0.100
                00:00:65:17:11:02 2         IPCP
2001:DB8:30:1::1/128
                00:00:65:17:11:02 2         PPP-DHCP6
2001:DB8:30:200::/56
                00:00:65:17:11:02 2         PPP-DHCP6
-------------------------------------------------------------------------------
Number of active subscribers : 2
 
The following command shows more details about the subscriber-host, such as the group-interface, address origin, acct-session-id, etc. Even though there are only two dual-stack hosts (one IPoE and one PPPoE), each of them has 3 IP addresses that show up as different hosts.
For the purpose of brevity, the output for only two IP hosts are shown, one with an IPv4 address and one with an IPv6 address. The remaining IP addresses/prefixes are not shown since the output follows the same logic.
A:BNG-1# show service id 10 subscriber-hosts detail 
=============================================================
Subscriber Host table
=============================================================
Sap                    Subscriber                
  IP Address                                     
    MAC Address          PPPoE-SID Origin       Fwding State
-------------------------------------------------------------
[1/1/5:17.10]          open-dhcp
  10.12.0.101
    00:00:65:17:10:01    N/A       DHCP         Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : default-sub-profile
SLA Profile           : default-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : N/A
Acct-Session-Id       : D897FF0000000F51DBC5A7
Acct-Q-Inst-Session-Id: D897FF0000001051DBC5A7
Address Origin        : DHCP
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
 [1/1/5:17.11]          open-pppoe|2
  2001:DB8:30:1::1/128
    00:00:65:17:11:02    2         PPP-DHCP6    Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : default-sub-profile
SLA Profile           : default-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : N/A
Acct-Session-Id       : D897FF0000001351DBC5BA
Acct-Q-Inst-Session-Id: D897FF0000000E51DBC59C
Address Origin        : DHCP
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
Number of subscriber hosts : 6 								The remaining 4 hosts are not shown here…
=============================================================
 
The following command shows that there are no sub/sla-profile strings assigned to the subscriber. Instead the default sub/sla-profiles from the msap-policy are used.
The IP address is assigned by the DHCP server which also supplied the def-gw information, DNS servers, the net-mask and the lease time.
The circuit-id and the subscriber-id are set to the same value.
A:BNG-1# show service id 10 dhcp lease-state detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 10.12.0.101
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:04:01
Remaining Lease Time : 0d 00:56:00
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : ""
SLA-Profile-String   : ""
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : ""
Category-Map-Name    : ""
 
Lease Info origin    : DHCP
 
Ip-Netmask           : 255.255.255.0
Broadcast-Ip-Addr    : N/A
Default-Router       : 10.12.0.1
Primary-Dns          : 172.16.16.16
Secondary-Dns        : 172.16.16.17
Primary-Nbns         : N/A
Secondary-Nbns       : N/A
 
ServerLeaseStart     : 07/09/2013 01:11:19
ServerLastRenew      : 07/09/2013 01:11:19
ServerLeaseEnd       : 07/09/2013 02:11:19
Session-Timeout      : N/A
Lease-Time           : 0d 01:00:00
DHCP Server Addr     : 10.10.1.1
 
Relay Agent Information
  Circuit Id         : open-dhcp
  Remote Id          : ipoe-v6
Radius User-Name     : ""
-------------------------------------------------------------------------------
Number of lease states : 1
===============================================================================
 
Then there is a similar command used for DHCPv6 lease-state details.
For the purpose of brevity, the output for only two IPv6 leases is shown. The remaining two IPv6 leases are not shown since the output follows the same logic.
A:BNG-1# show service id 10 dhcp6 lease-state detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 2001:DB8:30::1/128
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:44:50
Remaining Lease Time : 0d 00:45:10
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : ""
SLA-Profile-String   : ""
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : ""
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171001
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : non-temporary
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1001
Primary-Dns          : N/A
Secondary-Dns        : N/A
Pool Name            : ""
Dhcp6 Server Addr    : 2001:DB8::1
Dhcp6 ServerId (DUID): 00030001d897ff000000
Dhcp6 InterfaceId    : open-dhcp				
Dhcp6 RemoteId       : 0000ipoe-v6
 
Lease Info origin    : DHCP
 
ServerLeaseStart     : 07/09/2013 01:11:28
ServerLastRenew      : 07/09/2013 01:41:28
ServerLeaseEnd       : 07/09/2013 02:41:28  										One hour lease time.
Session-Timeout      : N/A
Radius User-Name     : ""
-------------------------------------------------------------------------------
Service ID           : 10
IP Address           : 2001:DB8:30:1::1/128
Client HW Address    : 00:00:65:17:11:02
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.11]
Up Time              : 0d 00:44:40
Remaining Lease Time : 0d 00:45:20    
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-pppoe|2"
Sub-Profile-String   : ""
SLA-Profile-String   : ""
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : ""
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171102
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : non-temporary
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1102
Primary-Dns          : N/A
Secondary-Dns        : N/A
Pool Name            : ""
Dhcp6 Server Addr    : 2001:DB8::1
Dhcp6 ServerId (DUID): 00030001d897ff000000
Dhcp6 InterfaceId    : open-pppoe
Dhcp6 RemoteId       : N/A
 
Lease Info origin    : DHCP
 
ServerLeaseStart     : 07/09/2013 01:11:38
ServerLastRenew      : 07/09/2013 01:41:38
ServerLeaseEnd       : 07/09/2013 02:41:38
Session-Timeout      : N/A
Radius User-Name     : ""
-------------------------------------------------------------------------------
Number of lease states : 4  									The remaining 2 leases are not shown here.
===============================================================================
 
DHCP Relay Case with LUDB + RADIUS Authentication
IP address is assigned via local DHCP server.
•
RADIUS provides sub/sla-profile strings and a framed IPv4 route.
•
LUDB provides IP address pool, inter-dest-id string for Vport assignment, msap-defaults (routing context parameters and msap-policy).
Vport aggregate rate limit and the port scheduler are now added to the physical port. The Vport is associated with the subscriber through the inter-dest-id string obtained via LUDB.
configure  port 1/1/5                        
 	ethernet
   	mode access
 	encap-type qinq
  	egress-scheduler-policy "port"
  	access
   		egress
      		vport "open-dhcp" create
          	agg-rate-limit 500
              	host-match dest "open-auth-vport" create
           	exit
        	exit
     	exit
     	no shutdown
   	exit
The LUDB is used to assign the IP pool name (pool-name = ludb) and the inter-dest-id string (inter-dest-id = open-auth-vport) to the subscriber. The pool name is carried to the DHCP server via custom DHCP options [(82,9,13) in DHCPv4 and (17,1->wan_pool and 2->pfx_pool) in DHCPv6].
The domain name alu-domain is appended to the username (circuit-id = open-dhcp or username = open-pppoe) before an Access-Request message is sent to the RADIUS server which is configured in the authentication policy open-dhcp.
The inter-dest-id string taken from the LUDB is passed to the subscriber management module in the 7x50 via DHCP option 254 in DHCP ACK/Reply. 
 
configure subscriber-mgmt local-user-db "open-dhcp"
local-user-db "open-dhcp" create
    	dhcp
       	match-list circuit-id 
         	host "open-dhcp" create
            	host-identification
           		circuit-id string "open-dhcp"
            	exit
             	address pool "ludb"
             	auth-policy "open-dhcp"
            	auth-domain-name "alu-domain"
           	identification-strings 254 create
               	inter-dest-id "open-auth-vport"
           	exit
          	msap-defaults
               	group-interface "open-auth"
                	policy "msaps"
               	service 10
            	exit
            	ipv6-wan-address-pool "ludb"
            	ipv6-delegated-prefix-pool "ludb"
            	no shutdown
         	exit
     	exit
      	ppp
        	match-list circuit-id username 
          host "open-ppp" create
            	host-identification
               	username "open-pppoe"
             	exit
             	auth-policy "open-dhcp"
            	address pool "ludb"
            	password chap "ALU" hash2
           	identification-strings 254 create
             		inter-dest-id "open-auth-vport"
            	exit
           	msap-defaults
               	group-interface "open-auth"
               	policy "msaps"
                	service 10
            	exit
           	ipv6-delegated-prefix-pool "ludb"
             	ipv6-wan-address-pool "ludb"
           	no shutdown
          exit
   		exit
      	no shutdown
exit
The inter-dest-id string taken from the LUDB is passed to the subscriber management module in the 7x50 via DHCPv4/v6 option 254 that is specified in the subscriber identification policy.
configure subscriber-mgmt sub-ident-policy "sub_ident_pol" 
  	strings-from-option 254
The RADIUS server is defined in the authentication policy. The domain name can be appended to the PPPoE subscriber host directly via the authentication-policy while for IPoE subscribers, the domain name is appended via the authentication-policy in conjunction with the LUDB. This can be verified in the output (shown later) of the show service id 10 dhcp lease-state detail and show service id 10 dhcp6 lease-state detail commands (on the “radius user-name” line). 
configure subscriber-mgmt authentication-policy "open-dhcp"
password "ALU" hash2
  	ppp-user-name append "alu-domain"
  	radius-authentication-server
   		server 1 address X.Y.Z.W secret "ALU" hash2
   	exit
  	user-name-format circuit-id append
   	pppoe-access-method pap-chap
The RADIUS user configuration file uses the domain-name extension, as inserted by the 7x50 BNG, to authenticate the user:
open-dhcp@alu-domain   Cleartext-Password := "ALU"
            Alc-Subsc-Prof-Str = rad-sub,	Subscriber profile string.
            Alc-SLA-Prof-Str = rad-sla,		SLA profile string.
            Framed-Route = "192.168.1.0/24 0.0.0.0"											Managed IPv4 route.
            Fall-Through = No
 
 
open-pppoe@alu-domain  Cleartext-Password := "ALU"
            Alc-Subsc-Prof-Str = rad-sub,
            Alc-SLA-Prof-Str = rad-sla,
            Framed-Route = "192.168.2.0/24 0.0.0.0",
            Fall-Through = No
 
DHCPv4/v6 servers are locally configured in the 7x50 and attached to a loopback interface: 
configure  service  vprn  10 interface "loop-dhcp-srvr" 
  	address 10.10.1.1/24	IPv4 address to which is DHCPv4 server attached.
	ipv6
     	address 2001:DB8::1/128 			IPv6 address to which is DHCPv6 server attached.
 		local-dhcp-server "v6"  Attaching DHCPv6 server to the loopback intf.
  	exit
	local-dhcp-server "local"	 				Attaching DHCPv4 server to the loopback intf.
 	loopback
Group-interface configuration. Note that common parts of the configuration as defined earlier, still apply:
configure service vprn 10 subscriber-interface "sub-int-1" group-interface "open-auth" 
  	dhcp6
   		user-db "open-dhcp"
      		relay									DHCPv6 relay configuration.
          	link-address 2001:DB8:30::
          	server 2001:DB8::1
            	client-applications dhcp ppp
            	no shutdown
          exit
     	exit     
  	dhcp     										DHCPv4 relay configuration.
  		option   
			no circuit-id								7x50 will not insert its own circuit-id.
          no remote-id    											7x50 will not insert its own remote-id.
       	vendor-specific-option
         		pool-name					
         	exit
      	exit
   		server 10.10.1.1  
    	client-applications dhcp ppp
      	no shutdown
   	exit
	
 
exit
 
Lease times for IPv4 and IPv6 are configured in the local DHCP server. Lease times under the local DHCP server are used only in the relay case (when IP address is supplied via DHCP server and NOT RADIUS or LUDB). In the proxy case the lease times can be obtained via LUDB, RADIUS or group-interface.
configure service vprn 10
dhcp
   		local-dhcp-server "local" create
      		use-gi-address 			gi-address can be used to select the pool.
          use-pool-from-client 									pool name can be explicitly provided.
          pool "ludb" create		pool used when LUDB provides the pool name.
          	options
			dns-server 172.16.16.16 172.16.16.17
               	lease-time hrs 1
             	exit
           	subnet 10.10.0.0/24 create
              	options
                 	subnet-mask 255.255.255.0
                   	default-router 10.10.0.1
                	exit
               	address-range 10.10.0.100 10.10.0.200 
            	exit
       	exit                
        	pool "gi-addr" create  		pool selected based on the gi-address.
           	options
              	dns-server 172.16.16.16 172.16.16.17
              	lease-time hrs 1
            	exit
             subnet 10.12.0.0/24 create
           		options
                 	subnet-mask 255.255.255.0
                  	default-router 10.12.0.1
                	exit
                 	address-range 10.12.0.100 10.12.0.200 
                	exit
            	exit
       		no shutdown
      		exit
      	exit
    	dhcp6                     
      		local-dhcp-server "v6" create
			use-link-address 
			use-pool-from-client
			pool "ludb" create
				prefix 2001:DB8:10::/48 pd wan-host create
					preferred-lifetime min 30 
					rebind-timer min 20 
					renew-timer min 15 
					valid-lifetime hrs 1 
					options
						dns-server 2001:DB8::1000 2001:DB8::1001
					exit
				exit
			exit
			pool "gi-addr" create
				prefix 2001:DB8:30::/48 pd wan-host create
					preferred-lifetime min 30 
					rebind-timer min 20 
					renew-timer min 15 
					valid-lifetime hrs 1 
					options
						dns-server 2001:DB8::1000 2001:DB8::1001
					exit
				exit
			exit
			no shutdown
		exit
	exit
 
RADIUS sub/sla-profiles supplied via RADIUS are used:
configure subscriber-mgmt sla-profile "rad-sla"
 	description "sla-profile obtained via RADIUS"
  	host-limit 100
  	egress
    	qos 10 vport-scheduler
  		exit
 		ip-filter 10
exit
exit
 
configure subscriber-mgmt sub-profile "rad-sub" 
  	description "sub-profile obtained via RADIUS"
   	egress
   		agg-rate-limit 15000 
   	exit
exit
 
Show Commands
The following command shows that the rad-sub/sla-profiles, as supplied via RADIUS, are in use.
The IP addresses are selected from the pool-name LUDB in the local DHCP server. The subscriber-id is circuit-id for IPoE subscriber-host and the username|session-id combination for PPPoE subscriber host.
A:BNG-1#show service active-subscribers 
===============================================================================
Active Subscribers
===============================================================================
-------------------------------------------------------------------------------
Subscriber open-dhcp (rad-sub)		
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.10] - sla:rad-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.10.0.101															         									00:00:65:17:10:01 N/A       DHCP			
2001:DB8:10:1::1/128
                00:00:65:17:10:01 N/A       IPoE-DHCP6
2001:DB8:10:200::/56
                00:00:65:17:10:01 N/A       IPoE-DHCP6
-------------------------------------------------------------------------------
Subscriber open-pppoe|3 (rad-sub)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.11] - sla:rad-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.10.0.100
                00:00:65:17:11:02 3         IPCP
2001:DB8:10::1/128
                00:00:65:17:11:02 3         PPP-DHCP6
2001:DB8:10:100::/56
                00:00:65:17:11:02 3         PPP-DHCP6
-------------------------------------------------------------------------------
Number of active subscribers : 2
-------------------------------------------------------------------------------
 
The following command shows more details about the subscriber-host, such as the group-interface, vport, address origin, acct-session-id, etc. Vport is selected based on the inter-dest-id string supplied via the LUDB.
For the purpose of brevity, the output for only two IP addresses hosts is shown, one with an IPv4 address and one with an IPv6 address. The remaining IP addresses/prefixes are not shown since the output follows the same logic.
A:BNG-1# show service id 10 subscriber-hosts detail 
=============================================================
Subscriber Host table
=============================================================
Sap                    Subscriber                
  IP Address                              
    MAC Address          PPPoE-SID Origin       Fwding State
-------------------------------------------------------------
[1/1/5:17.10]          open-dhcp
  10.10.0.101
    00:00:65:17:10:01    N/A       DHCP         Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : rad-sub
SLA Profile           : rad-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : open-dhcp
Acct-Session-Id       : D897FF0000000551D308B2
Acct-Q-Inst-Session-Id: D897FF0000000651D308B2
Address Origin        : DHCP
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
[1/1/5:17.11]          open-pppoe|3
  2001:DB8:10::1/128
    00:00:65:17:11:02    3         PPP-DHCP6    Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : rad-sub
SLA Profile           : rad-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : open-dhcp
Acct-Session-Id       : D897FF0000000351D308AF
Acct-Q-Inst-Session-Id: D897FF0000000251D308A9
Address Origin        : DHCP
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
 
The following command shows that the subscriber identity is set to circuit-id (plus session-id) as instructed by auto-sub-id-key command (subscriber-id string is not returned via the LUDB or RADIUS). The lease times are set to 1h as defined in the DHCP server. The username passed to RADIUS is a circuit-id or a username appended by the alu-dmain domain name. 
A:BNG-1# show service id 10 dhcp lease-state  detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 10.10.0.101
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:12:45
Remaining Lease Time : 0d 00:47:16
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : "rad-sub"
SLA-Profile-String   : "rad-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
 
Lease Info origin    : DHCP
 
Ip-Netmask           : 255.255.255.0
Broadcast-Ip-Addr    : N/A
Default-Router       : 10.10.0.1
Primary-Dns          : 172.16.16.16
Secondary-Dns        : 172.16.16.17
Primary-Nbns         : N/A
Secondary-Nbns       : N/A
 
ServerLeaseStart     : 07/02/2013 10:06:58
ServerLastRenew      : 07/02/2013 10:06:58
ServerLeaseEnd       : 07/02/2013 11:06:58
Session-Timeout      : N/A
Lease-Time           : 0d 01:00:00
DHCP Server Addr     : 10.10.1.1
 
Relay Agent Information
  Circuit Id         : open-dhcp
  Remote Id          : ipoe-v6
Radius User-Name     : "open-dhcp@alu-domain"
 
Managed Routes       : 192.168.1.0/24           installed
-------------------------------------------------------------------------------
Number of lease states : 1
===============================================================================
 
For the purpose of brevity the output for only two IPv6 leases is shown. The remaining two IPv6 leases are not shown since the output follows the same logic.
A:BNG-1# show service id 10 dhcp6 lease-state  detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 2001:DB8:10::1/128
Client HW Address    : 00:00:65:17:11:02
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.11]
Up Time              : 0d 00:13:00
Remaining Lease Time : 0d 00:47:00
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-pppoe|3"
Sub-Profile-String   : "rad-sub"
SLA-Profile-String   : "rad-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171102
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : non-temporary
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1102
Primary-Dns          : N/A
Secondary-Dns        : N/A
Pool Name            : "ludb"
Dhcp6 Server Addr    : 2001:DB8::1
Dhcp6 ServerId (DUID): 00030001d897ff000000
Dhcp6 InterfaceId    : open-pppoe
Dhcp6 RemoteId       : N/A
 
Lease Info origin    : DHCP
 
ServerLeaseStart     : 07/02/2013 10:06:55
ServerLastRenew      : 07/02/2013 10:06:55
ServerLeaseEnd       : 07/02/2013 11:06:55
Session-Timeout      : N/A
Radius User-Name     : "open-pppoe@alu-domain"
-------------------------------------------------------------------------------
Service ID           : 10
IP Address           : 2001:DB8:10:1::1/128
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:12:52
Remaining Lease Time : 0d 00:47:08
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : "rad-sub"
SLA-Profile-String   : "rad-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171001
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : non-temporary
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1001
Primary-Dns          : N/A
Secondary-Dns        : N/A
Pool Name            : "ludb"
Dhcp6 Server Addr    : 2001:DB8::1
Dhcp6 ServerId (DUID): 00030001d897ff000000
Dhcp6 InterfaceId    : open-dhcp
Dhcp6 RemoteId       : 0000ipoe-v6
 
Lease Info origin    : DHCP
                                      
ServerLeaseStart     : 07/02/2013 10:07:03
ServerLastRenew      : 07/02/2013 10:07:03
ServerLeaseEnd       : 07/02/2013 11:07:03
Session-Timeout      : N/A
Radius User-Name     : "open-dhcp@alu-domain"
-------------------------------------------------------------------------------
 
 
IP Proxy Case with LUDB + RADIUS Authentication
IP address is assigned via RADIUS.
•
RADIUS provides IP addresses3 and related parameters (DNS server, IPv4 default-gateway, etc), inter-dest-id string for Vport assignment and a framed route.
•
LUDB provides sub/sla-profile strings and msap-defaults (routing context parameters and msap-policy).
Vport aggregate rate limit and the port scheduler are now added to the physical port. The Vport is associated with the subscriber through the inter-dest-id string obtained via the LUDB.
configure  port 1/1/5                        
 	ethernet
   	mode access
 	encap-type qinq
  	egress-scheduler-policy "port"
  	access
   		egress
      		vport "open-dhcp" create
          	agg-rate-limit 500
              	host-match dest "open-auth-vport" create
           	exit
        	exit
     	exit
     	no shutdown
   	exit
 
The LUDB is used to assign the sub/sla-profile strings.
The domain name alu-domain is appended to the username (circuit-id = open-dhcp or username = open-pppoe) before an Access-Request is sent to the RADIUS server that is configured in the authentication policy open-dhcp.
 
 
        local-user-db "open-dhcp" create
            ipoe
                match-list circuit-id
                host "open-dhcp" create
                    host-identification
                        circuit-id string "open-dhcp"
                    exit
                    auth-policy "open-dhcp"
                    auth-domain-name "alu-domain"
                    identification-strings 254 create
                        sla-profile-string "ludb-sla"
                        sub-profile-string "ludb-sub"
                    exit
                    msap-defaults
                        group-interface "open-auth"
                        policy "msaps"
                        service 10
                    exit
                    no shutdown
                exit
            exit
            ppp
                match-list circuit-id mac username
                host "open-ppp" create
                    host-identification
                        username "open-pppoe"
                    exit
                    auth-policy "open-dhcp"
                    password chap "ALU" hash2
                    identification-strings 254 create
                        sla-profile-string "ludb-sla"
                        sub-profile-string "ludb-sub"
                    exit
                    msap-defaults
                        group-interface "open-auth"
                        policy "msaps"
                        service 10
                    exit
                    no shutdown
                exit
            exit
            no shutdown
        exit
 
 
RADIUS is defined in the authentication-policy. The domain name can be appended to the PPPoE subscriber host directly via authentication-policy, while for IPoE subscribers the domain name is appended via authentication-policy in conjunction with LUDB.
configure subscriber-mgmt authentication-policy "open-dhcp"
password "ALU" hash2
  	ppp-user-name append "alu-domain"
  	radius-authentication-server
   		server 1 address X.Y.Z.W secret "ALU" hash2
   	exit
  	user-name-format circuit-id append
   	pppoe-access-method pap-chap
The RADIUS user configuration file uses the domain extension as inserted by the 7x50 BNG node to authenticate the user. The inter-dest-id string and the host IP address are provided by the RADIUS server (proxy case) along with other IP addressing parameters.
The IPv4 lease time (30 minutes) for IPv4 addresses are provided by the RADIUS server, while the lease time (30 minutes) for IPv6 addresses/prefixes are configured under the group-interface. 
open-dhcp@alu-domain   Cleartext-Password := "ALU"
            Alc-Int-Dest-Id-Str = open-auth-vport,
            Framed-IP-Address = 10.10.0.230,
            Framed-IP-Netmask = 255.255.255.0,
            Alc-Default-Router = 10.10.0.1,
            Alc-Lease-Time = 1800,
            Client-DNS-Pri = 172.16.20.20,
            Client-DNS-Sec = 172.16.20.21,
            Alc-IPv6-Address = 2001:db8::100,
            Delegated-IPv6-Prefix = 2001:DB8:40:100::/56,
            Alc-IPv6-Primary-Dns = 2001:DB8::2000,
            Alc-Ipv6-Secondary-Dns = 2001:DB8::2001,
            Framed-Route = "192.168.1.0/24 0.0.0.0",
            Fall-Through = No
 
open-pppoe@alu-domain  Cleartext-Password := "ALU"
            Alc-Int-Dest-Id-Str = open-auth-vport,
            Framed-IP-Address = 10.10.0.231,
            Framed-IP-Netmask = 255.255.255.255,
            Client-DNS-Pri = 172.16.20.20,
            Client-DNS-Sec = 172.16.20.21,
            Alc-IPv6-Address = 2001:db8:0:1::100,
            Delegated-IPv6-Prefix = 2001:DB8:40:200::/56,
            Alc-IPv6-Primary-Dns = 2001:DB8::2000,
            Alc-Ipv6-Secondary-Dns = 2001:DB8::2001,
            Framed-Route = "192.168.2.0/24 0.0.0.0",
            Fall-Through = No
 
 
The group-interface configuration is shown below. Note that common parts of the configuration as defined earlier still apply.
configure service vprn 10 subscriber-interface "sub-int-1" group-interface "open-auth" create
  	ipv6
    	dhcp6
       	proxy-server
          	renew-timer min 7 
             	rebind-timer min 10 
          	valid-lifetime min 30 
           	preferred-lifetime min 15 
          	client-applications dhcp ppp
             	no shutdown
       	exit
		exit
	exit
  	dhcp
    	proxy-server
      		emulated-server 10.12.0.1
        	no shutdown
      	exit
  	no shutdown
  	exit
exit
 
RADIUS sub/sla-profiles supplied via the LUDB are used:
configure  subscriber-mgmt sla-profile "ludb-sla" 
 	description "sla-profile obtained via LUDB"
  	host-limit 100
  	egress
   		qos 10 vport-scheduler
  	exit
ip-filter 10
exit
 
config>subscr-mgmt# sub-profile "ludb-sub" 
description "sub-profile obtained via LUDB"
  	egress
   		agg-rate-limit 15000 
  	exit       
 
 
Show Commands
The following command shows that the LUDB-sub/sla-profiles, as supplied via LUDB, are in use. The IP addresses are supplied via the RADIUS server. The subscriber-id is auto-generated (not returned via LUDB or RADIUS) and it is set to circuit-id for the IPoE subscriber-host, and to the username|session-id combination for PPPoE subscriber host. 
*A:BNG-1# show service  active-subscribers 
===============================================================================
Active Subscribers
===============================================================================
-------------------------------------------------------------------------------
Subscriber open-dhcp (ludb-sub)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.10] - sla:ludb-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.10.0.230
                00:00:65:17:10:01 N/A       DHCP
2001:DB8::100/128
                00:00:65:17:10:01 N/A       IPoE-DHCP6
2001:DB8:40:100::/56
                00:00:65:17:10:01 N/A       IPoE-DHCP6
-------------------------------------------------------------------------------
Subscriber open-pppoe|12 (ludb-sub)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.11] - sla:ludb-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.10.0.231
                00:00:65:17:11:02 12        IPCP
2001:DB8::1:0:0:0:100/128
                00:00:65:17:11:02 12        PPP-DHCP6
2001:DB8:40:200::/56
                00:00:65:17:11:02 12        PPP-DHCP6
-------------------------------------------------------------------------------
Number of active subscribers : 2
-------------------------------------------------------------------------------
 
The following command shows more details about the subscriber-host, such as the group-interface, vport, address origin, acct-session-id, etc. Vport is selected based on the inter-dest-id string supplied via RADIUS.
For the purpose of brevity, the output for only two hosts is shown, one with IPv4 address and one with IPv6 prefix. The remaining IP addresses/prefixes are not shown since the output follows the same logic.
*A:BNG-1# show service  id 10 subscriber-hosts detail 
=============================================================
Subscriber Host table
=============================================================
Sap                    Subscriber                
  IP Address                                     
    MAC Address          PPPoE-SID Origin       Fwding State
-------------------------------------------------------------
[1/1/5:17.10]          open-dhcp
  10.10.0.230
    00:00:65:17:10:01    N/A       DHCP         Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : ludb-sub
SLA Profile           : ludb-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : open-dhcp
Acct-Session-Id       : D897FF0000004751D31B6E
Acct-Q-Inst-Session-Id: D897FF0000004851D31B6E
Address Origin        : AAA
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
 
-------------------------------------------------------------
[1/1/5:17.11]          open-pppoe|12
  2001:DB8:40:200::/56
    00:00:65:17:11:02    12        PPP-DHCP6    Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : ludb-sub
SLA Profile           : ludb-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : open-dhcp
Acct-Session-Id       : D897FF0000004651D31B6B
Acct-Q-Inst-Session-Id: D897FF0000004451D31B65
Address Origin        : AAA
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
Number of subscriber hosts : 6 The remaining 4 hosts are not shown here.
=============================================================
 
The following command shows that the subscriber identity is set to circuit-id (plus session-id) as instructed by the auto-sub-id-key command (the subscriber-id string is not returned via LUDB or RADIUS). The lease times are set to 30 minutes as defined by RADIUS for IPv4 addresses and by the group-interface for IPv6 addresses/prefixes (proxy-case). The username passed to RADIUS is the circuit-id or username appended to the alu-dmain domain name.
The origin of the lease is RADIUS.
*A:BNG-1# show service  id 10 dhcp lease-state detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 10.10.0.230
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:02:24
Remaining Lease Time : 0d 00:27:37
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : "ludb-sub"
SLA-Profile-String   : "ludb-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
 
Lease Info origin    : Radius
 
Ip-Netmask           : 255.255.255.0
Broadcast-Ip-Addr    : 10.10.0.255
Default-Router       : 10.10.0.1
Primary-Dns          : 172.16.20.20
Secondary-Dns        : 172.16.20.21
Primary-Nbns         : N/A
Secondary-Nbns       : N/A
 
ServerLeaseStart     : 07/02/2013 11:26:54
ServerLastRenew      : 07/02/2013 11:26:54
ServerLeaseEnd       : 07/02/2013 11:56:54
Session-Timeout      : N/A
Lease-Time           : 0d 00:30:00
DHCP Server Addr     : N/A
 
Relay Agent Information
  Circuit Id         : open-dhcp
  Remote Id          : ipoe-v6
Radius User-Name     : "open-dhcp@alu-domain"
 
Managed Routes       : 192.168.1.0/24           installed
-------------------------------------------------------------------------------
Number of lease states : 1
===============================================================================
For the purpose of brevity, the output for only two IPv6 prefixes are shown. The remaining two IPv6 leases are not shown since the output follows the same logic.
*A:BNG-1# show service  id 10 dhcp6 lease-state detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 2001:DB8:40:100::/56
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:02:32
Remaining Lease Time : 0d 00:27:28
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : "ludb-sub"
SLA-Profile-String   : "ludb-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171001
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : prefix
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1001
Primary-Dns          : 2001:DB8::2000
Secondary-Dns        : 2001:DB8::2001
Pool Name            : ""
Dhcp6 Server Addr    : N/A
Dhcp6 ServerId (DUID): N/A
Dhcp6 InterfaceId    : open-dhcp
Dhcp6 RemoteId       : 0000ipoe-v6
 
Lease Info origin    : Radius
 
ServerLeaseStart     : 07/02/2013 11:26:58
ServerLastRenew      : 07/02/2013 11:26:58
ServerLeaseEnd       : 07/02/2013 11:56:58
Session-Timeout      : N/A
Radius User-Name     : "open-dhcp@alu-domain"
-------------------------------------------------------------------------------
Service ID           : 10
IP Address           : 2001:DB8:40:200::/56
Client HW Address    : 00:00:65:17:11:02
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.11]
Up Time              : 0d 00:02:39
Remaining Lease Time : 0d 00:27:21
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-pppoe|12"
Sub-Profile-String   : "ludb-sub"
SLA-Profile-String   : "ludb-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171102
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : prefix
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1102
Primary-Dns          : 2001:DB8::2000
Secondary-Dns        : 2001:DB8::2001
Pool Name            : ""
Dhcp6 Server Addr    : N/A
Dhcp6 ServerId (DUID): N/A
Dhcp6 InterfaceId    : open-pppoe
Dhcp6 RemoteId       : N/A
                                      
Lease Info origin    : Radius
 
ServerLeaseStart     : 07/02/2013 11:26:51
ServerLastRenew      : 07/02/2013 11:26:51
ServerLeaseEnd       : 07/02/2013 11:56:51
Session-Timeout      : N/A
Radius User-Name     : "open-pppoe@alu-domain"
-------------------------------------------------------------------------------
Number of lease states : 4 									The remaining two not shown in this output.
===============================================================================
 
IP Proxy Case with LUDB + RADIUS Authentication
P address is assigned via LUDB.
•
RADIUS provides sub/sla-profile strings and a framed IPv4 route.
•
LUDB provides IP addresses4 and related parameters (DNS server, IPv4 default-gateway, etc), inter-dest-id string for Vport assignment and msap-defaults (routing context parameters and msap-policy).
Vport aggregate rate limit and the port scheduler are now added to the physical port. The Vport is associated with the subscriber through the inter-dest-id string obtained via the LUDB.
configure  port 1/1/5                        
 	ethernet
   	mode access
 	encap-type qinq
  	egress-scheduler-policy "port"
  	access
   		egress
      		vport "open-dhcp" create
          	agg-rate-limit 500
              	host-match dest "open-auth-vport" create
           	exit
        	exit
     	exit
     	no shutdown
   	exit
 
The LUDB is used to assign the inter-dest-id string, host IP addresses and IP addressing parameters. The DHCP lease time for IPv4 addresses is set to 15 minutes in the LUDB while lease times for IPv6 addresses/prefixes is set under the group-interface (set to 30 minutes).
Domain name alu-domain is appended to the username (circuit-id = open-dhcp or username = open-pppoe) before an Access-Request is sent to the RADIUS server that is configured in the authentication-policy open-dhcp.
	local-user-db "open-dhcp" create
		dhcp
			match-list circuit-id 
			host "open-dhcp" create
				host-identification
					circuit-id string "open-dhcp"
                    exit
                    address 10.10.0.230
                    auth-policy "open-dhcp"
                    auth-domain-name "alu-domain"
                    identification-strings 254 create
                        inter-dest-id "open-auth-vport"
                    exit
                    msap-defaults
                        group-interface "open-auth"
                        policy "msaps"
                        service 10
                    exit
                    options
                        subnet-mask 255.255.255.0
                        default-router 10.10.0.254
                        dns-server 172.16.20.20 172.16.20.21
                        lease-time min 15
                    exit
                    options6
                        dns-server 2001:DB8::2000 2001:DB8::2001
                    exit
                    ipv6-address 2001:DB8::100
                    ipv6-delegated-prefix 2001:DB8:40:100::/56
                    no shutdown
                exit
            exit
 
RADIUS is defined in the authentication-policy. The domain name can be appended to the PPPoE subscriber host directly via authentication-policy while for IPoE subscribers, the domain name is appended via authentication policy in conjunction with LUDB.
configure  subscriber-mgmt authentication-policy "open-dhcp"
password "ALU" hash2
  	ppp-user-name append "alu-domain"
  	radius-authentication-server
   		server 1 address X.Y.Z.W secret "ALU" hash2
   	exit
  	user-name-format circuit-id append
   	pppoe-access-method pap-chap
The RADIUS user configuration file uses the domain extension as inserted by the 7x50 to authenticate the user. 
open-dhcp@alu-domain   Cleartext-Password := "ALU"
            Alc-Subsc-Prof-Str = rad-sub,
            Alc-SLA-Prof-Str = rad-sla,
            Framed-Route = "192.168.1.0/24 0.0.0.0",
            Fall-Through = No
 
open-pppoe@alu-domain  Cleartext-Password := "ALU"
            Alc-Subsc-Prof-Str = rad-sub,
            Alc-SLA-Prof-Str = rad-sla,
            Framed-Route = "192.168.2.0/24 0.0.0.0",
            Fall-Through = No
 
The group interface configuration is shown below. Note that common parts of the configuration as defined earlier still apply.
configure service vprn 10 subscriber-interface "sub-int-1" group-interface "open-auth" create
	ipv6
		dhcp6
			proxy-server
				renew-timer min 7 
				rebind-timer min 10 
				valid-lifetime min 30 
				preferred-lifetime min 15 
				client-applications dhcp ppp
				no shutdown
			exit
		exit
	exit
	dhcp
	proxy-server
		emulated-server 10.12.0.1
		no shutdown
	exit
	no shutdown
	exit
exit
 
RADIUS sub/sla-profiles supplied by RADIUS are defined as:
configure  subscriber-mgmt sla-profile "rad-sla" 
 	description "sla-profile obtained via LUDB"
  	host-limit 100
  	egress
   		qos 10 vport-scheduler
  	exit
ip-filter 10
exit
 
configure subscriber-mgmt sub-profile "rad-sub" 
description "sub-profile obtained via LUDB"
  	egress
   		agg-rate-limit 15000 
  	exit       
 
 
Show Commands
The following command shows that the rad-sub/sla-profiles, as provided by RADIUS, are in use. The IP addresses are provided by LUDB. The subscriber-id is auto-generated (not returned via the LUDB or RADIUS) and it is set to circuit-id for IPoE subscriber-host(s) and to username|session-id combination for PPPoE subscriber host(s).
*A:BNG-1# show service active-subscribers 
===============================================================================
Active Subscribers
===============================================================================
-------------------------------------------------------------------------------
Subscriber open-dhcp (rad-sub)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.10] - sla:rad-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.10.0.230
                00:00:65:17:10:01 N/A       DHCP
2001:DB8::100/128
                00:00:65:17:10:01 N/A       IPoE-DHCP6
2001:DB8:40:100::/56
                00:00:65:17:10:01 N/A       IPoE-DHCP6
 
-------------------------------------------------------------------------------
Subscriber open-pppoe|1 (rad-sub)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
(1) SLA Profile Instance sap:[1/1/5:17.11] - sla:rad-sla
-------------------------------------------------------------------------------
IP Address                                  
                MAC Address       PPPoE-SID Origin
--------------------------------------------------------
10.10.0.231
                00:00:65:17:11:02 1         IPCP
2001:DB8::1:0:0:0:100/128
                00:00:65:17:11:02 1         PPP-DHCP6
2001:DB8:40:200::/56
                00:00:65:17:11:02 1         PPP-DHCP6
 
-------------------------------------------------------------------------------
Number of active subscribers : 2
-------------------------------------------------------------------------------
 
The following command shows more details about the subscriber-host, such as the group-interface, vport, address origin, acct-session-id, etc. Vport is selected based on the inter-dest-id string as supplied via RADIUS.
For the purpose of brevity, the output for only two hosts is shown, one with IPv4 address and one with IPv6 prefix. The remaining IP addresses/prefixes are not shown since the output follows the same logic.
*A:BNG-1# show service id 10 subscriber-hosts detail 
=============================================================
Subscriber Host table
=============================================================
Sap                    Subscriber                
  IP Address                                     
    MAC Address          PPPoE-SID Origin       Fwding State
-------------------------------------------------------------
[1/1/5:17.10]          open-dhcp
  10.10.0.230
    00:00:65:17:10:01    N/A       DHCP         Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : rad-sub
SLA Profile           : rad-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : open-dhcp
Acct-Session-Id       : D897FF0000000051D48D5A
Acct-Q-Inst-Session-Id: D897FF0000000151D48D5A
Address Origin        : LUDB
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
 [1/1/5:17.11]          open-pppoe|1
  2001:DB8:40:200::/56
    00:00:65:17:11:02    1         PPP-DHCP6    Fwding
-------------------------------------------------------------
Subscriber-interface  : sub-int-1
Group-interface       : open-auth
Sub Profile           : rad-sub
SLA Profile           : rad-sla
App Profile           : N/A
Egress Q-Group        : policer-output-queues
Egress Vport          : open-dhcp
Acct-Session-Id       : D897FF0000000851D48D66
Acct-Q-Inst-Session-Id: D897FF0000000651D48D61
Address Origin        : LUDB
OT HTTP Rdr IP-FltrId : N/A
OT HTTP Rdr Status    : N/A
OT HTTP Rdr Fltr Src  : N/A
-------------------------------------------------------------
Number of subscriber hosts : 6  		The remaining 4 hosts are not shown here.
=============================================================
 
The following command shows that the subscriber identity is set to circuit-id (plus session-id) as instructed by the auto-sub-id-key command (the subscriber-id string is not returned via the LUDB or RADIUS). The DHCPv4 lease time is set to set to 15 minutes as defined by the LUDB. The DHCPv6 lease times are set to 30 minutes as configured under the group-interface. The username passed to RADIUS is the circuit-id or username appended by the alu-dmain domain name.
The origin of the lease is RADIUS.
*A:BNG-1# show service  id 10 dhcp lease-state detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 10.10.0.230
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:02:09
Remaining Lease Time : 0d 00:12:51
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : "rad-sub"
SLA-Profile-String   : "rad-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
 
Lease Info origin    : UserDb
 
Ip-Netmask           : 255.255.255.0
Broadcast-Ip-Addr    : 10.10.0.255
Default-Router       : 10.10.0.254
Primary-Dns          : 172.16.20.20
Secondary-Dns        : 172.16.20.21
Primary-Nbns         : N/A
Secondary-Nbns       : N/A
 
ServerLeaseStart     : 07/03/2013 13:45:14
ServerLastRenew      : 07/03/2013 13:45:14
ServerLeaseEnd       : 07/03/2013 14:00:14
Session-Timeout      : N/A
Lease-Time           : 0d 00:15:00
DHCP Server Addr     : N/A
 
Relay Agent Information
  Circuit Id         : open-dhcp
  Remote Id          : ipoe-v6
Radius User-Name     : "open-dhcp@alu-domain"
 
Managed Routes       : 192.168.1.0/24           installed
-------------------------------------------------------------------------------
Number of lease states : 1
===============================================================================
For the purpose of brevity, the output for only two IPv6 leases is shown. The remaining two IPv6 leases are not shown since the output follows the same logic.
*A:BNG-1# show service  id 10 dhcp6 lease-state detail 
===============================================================================
DHCP lease states for service 10
===============================================================================
Service ID           : 10
IP Address           : 2001:DB8::100/128
Client HW Address    : 00:00:65:17:10:01
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.10]
Up Time              : 0d 00:02:17
Remaining Lease Time : 0d 00:27:43
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-dhcp"
Sub-Profile-String   : "rad-sub"
SLA-Profile-String   : "rad-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171001
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : non-temporary
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1001
Primary-Dns          : 2001:DB8::2000
Secondary-Dns        : 2001:DB8::2001
Pool Name            : ""
Dhcp6 Server Addr    : N/A
Dhcp6 ServerId (DUID): N/A
Dhcp6 InterfaceId    : open-dhcp
Dhcp6 RemoteId       : 0000ipoe-v6
 
Lease Info origin    : UserDb
 
ServerLeaseStart     : 07/03/2013 13:45:17
ServerLastRenew      : 07/03/2013 13:45:17
ServerLeaseEnd       : 07/03/2013 14:15:17
Session-Timeout      : N/A
Radius User-Name     : "open-dhcp@alu-domain"
-------------------------------------------------------------------------------
Service ID           : 10
IP Address           : 2001:DB8:40:200::/56
Client HW Address    : 00:00:65:17:11:02
Subscriber-interface : sub-int-1
Group-interface      : open-auth
SAP                  : [1/1/5:17.11]
Up Time              : 0d 00:02:09
Remaining Lease Time : 0d 00:27:51
Remaining SessionTime: N/A
Persistence Key      : N/A
 
Sub-Ident            : "open-pppoe|1"
Sub-Profile-String   : "rad-sub"
SLA-Profile-String   : "rad-sla"
App-Profile-String   : ""
Lease ANCP-String    : ""
Lease Int Dest Id    : "open-auth-vport"
Category-Map-Name    : ""
Dhcp6 ClientId (DUID): 00030001000065171102
Dhcp6 IAID           : 0
Dhcp6 IAID Type      : prefix
Dhcp6 Client Ip      : FE80::200:65FF:FE17:1102
Primary-Dns          : 2001:DB8::2000
Secondary-Dns        : 2001:DB8::2001
Pool Name            : ""
Dhcp6 Server Addr    : N/A
Dhcp6 ServerId (DUID): N/A
Dhcp6 InterfaceId    : open-pppoe
Dhcp6 RemoteId       : N/A
 
Lease Info origin    : UserDb
 
ServerLeaseStart     : 07/03/2013 13:45:26
ServerLastRenew      : 07/03/2013 13:45:26
ServerLeaseEnd       : 07/03/2013 14:15:26
Session-Timeout      : N/A
Radius User-Name     : "open-pppoe@alu-domain"
-------------------------------------------------------------------------------
Number of lease states : 4		The remaining lease states are not shown here.
===============================================================================
 
Troubleshooting Commands
The following output shows the debugging commands which can be used to troubleshoot problems with the different authentication models.
*A:BNG-1# show debug 
debug
    router "Base"
        radius
            server-address X.Y.Z.Y
            packet-type authentication 
            detail-level medium
        exit
    exit
    router "10"
        ip
            dhcp
                detail-level high
                mode egr-ingr-and-dropped
            exit
            dhcp6
                mode egr-ingr-and-dropped
                detail-level high
            exit
        exit
        local-dhcp-server "local"
            detail-level high
            mode egr-ingr-and-dropped
        exit
        local-dhcp-server "v6"
            detail-level high
            mode egr-ingr-and-dropped
        exit
    exit
    mirror-source 100
        port 1/1/5 egress ingress
        no shutdown
    exit
    service
        id 2
            dhcp
                mode egr-ingr-and-dropped
                detail-level high
                sap 1/1/5:17.*
            exit
            dhcp6
                mode all
                detail-level medium
                sap 1/1/5:17.*
            exit
            ppp
                packet
                    mode dropped-only
                    detail-level high
                    discovery
                    ppp
                    dhcp-client
                exit
            exit
        exit
        id 10
            ppp
                packet
                    mode egr-ingr-and-dropped
                    detail-level high
                    discovery
                    ppp
                    dhcp-client
                exit
            exit
        exit
    exit
    subscriber-mgmt
        local-user-db open-dhcp
            detail all
        exit
    exit
exit
Conclusion
The flexible authentication model allows access to various sources (LUDB, RADIUS, and Python) of subscriber parameters during the subscriber establishment phase. This model can be utilized for IPoE, PPPoE or L2TP subscribers in IES or VPRN services (including a wholesale/retail VRF model). A typical use case would be in a wholesale/retail environment where the wholesaler enforces its own rules via the LUDB before it passes the authentication request to the retailer’s RADIUS server.
 
1
IPv6 lease-times are provided under the group-interface.

2
numbered/unnumbered subscriber-hosts. Refer to the DHCP/PPPoE clients whose assigned IP address is outside of any IP subnet/prefix configured under the subscriber-interface.

3
IPv6 lease-times are provided under the group-interface.

4
IPv6 lease-times are provided under the group-interface.